agent-dealer 1.0.0 → 1.0.2

package/bundle/server/dist/coordinator/auto-merge.timeout.test.js

@@ -1,7 +1,17 @@
-// Unit coverage for bounded gh timeout classification (NOT-102 review finding).
-import { test } from "node:test";
+// Unit coverage for bounded gh timeout classification (NOT-102) and NOT-151 spawn ENOENT mapping.
+import { test, before } from "node:test";
 import assert from "node:assert/strict";
-import { GH_MERGE_TIMEOUT_MS, ghErrorReason, isGhTimeoutError, } from "./auto-merge.js";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not151-unit-"));
+const { GH_MERGE_TIMEOUT_MS, ghErrorReason, ghSpawnEnoentReason, isGhTimeoutError, resolveAutoMergeCwd, } = await import("./auto-merge.js");
+const { managedRepoPath } = await import("../adapters/managed-repo.js");
+before(async () => {
+    const { migrate } = await import("../db/index.js");
+    migrate();
+});
 test("isGhTimeoutError detects killed / SIGTERM from execFile timeout", () => {
     assert.equal(isGhTimeoutError({ killed: true }), true);
     assert.equal(isGhTimeoutError({ signal: "SIGTERM" }), true);
@@ -12,3 +22,35 @@ test("ghErrorReason maps timeout before stderr", () => {
     assert.equal(ghErrorReason({ stderr: " checks failed \n" }, "fallback"), "checks failed");
     assert.equal(ghErrorReason({}, "gh pr merge failed"), "gh pr merge failed");
 });
+test("NOT-151: ghSpawnEnoentReason distinguishes bad cwd from missing gh", () => {
+    const missing = path.join(os.tmpdir(), "dealer-missing-merge-cwd-xyz");
+    assert.match(ghSpawnEnoentReason({ code: "ENOENT", message: "spawn gh ENOENT" }, missing) ?? "", /invalid merge cwd/);
+    const existing = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-merge-cwd-"));
+    assert.match(ghSpawnEnoentReason({ code: "ENOENT", message: "spawn gh ENOENT" }, existing) ?? "", /gh not on PATH/);
+    assert.equal(ghSpawnEnoentReason({ stderr: "checks failed" }, existing), null);
+});
+test("NOT-151: resolveAutoMergeCwd maps portable identity to managed path when clone exists", () => {
+    const identity = "github.com/not-so-fat/agent-dealer";
+    const managed = managedRepoPath(identity);
+    fs.mkdirSync(path.join(managed, ".git"), { recursive: true });
+    const ok = resolveAutoMergeCwd(identity);
+    assert.equal(ok.ok, true);
+    if (ok.ok)
+        assert.equal(ok.cwd, managed);
+});
+test("NOT-151: resolveAutoMergeCwd fails closed when managed clone is missing", () => {
+    const missing = resolveAutoMergeCwd("github.com/missing/not-cloned");
+    assert.equal(missing.ok, false);
+    if (!missing.ok) {
+        assert.match(missing.reason, /Managed clone missing/);
+        assert.doesNotMatch(missing.reason, /ENOENT/);
+    }
+});
+test("NOT-151: resolveAutoMergeCwd accepts a real legacy local checkout", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "legacy-merge-cwd-"));
+    execFileSync("git", ["init", "-b", "main"], { cwd: dir });
+    const ok = resolveAutoMergeCwd(dir);
+    assert.equal(ok.ok, true);
+    if (ok.ok)
+        assert.equal(ok.cwd, dir);
+});

package/bundle/server/dist/coordinator/commands.js

@@ -3,6 +3,7 @@ import { getIssue, incrementIssueRound, incrementIssueInfraAttempts, resetIssueI
 import { appendWorkflowEvent, completeWorkflowInstance, getActiveWorkflowInstance, getWorkflowInstance, startWorkflowInstance, WorkflowAlreadyActiveError, } from "../repository/workflow-events.js";
 import { createHumanAction, findOpenHumanAction, getHumanAction, listHumanActionsForIssue, resolveHumanAction, } from "../repository/human-actions.js";
 import { reconcileFinding } from "../repository/findings.js";
+import { normalizeReviewerResult } from "./reviewer-result.js";
 import { getAgent } from "../repository/agents.js";
 import { githubIssuesSync } from "../adapters/agent-health.js";
 import { createIssueArtifact, latestIssueArtifact } from "../repository/artifacts.js";
@@ -499,12 +500,14 @@ function applyReviewer(issue, instance, item, outcome) {
         autoMerge: issue.autoMerge,
     }, issue.headSha);
     const hasVerdict = outcome.kind === "verdict";
+    // Normalize before emit/finding reconcile so remapped blocking findings (NOT-150) persist.
+    const verdictResult = outcome.kind === "verdict" ? normalizeReviewerResult(outcome.result) : null;
     const { projection, effect, advance } = projectReviewerRoute(route, issue.currentRound, hasVerdict);
     const ev = eventEmitter(issue, instance, item.workerSessionId, projection.issueStatus, issue.currentRound);
     const patch = {};
     for (const type of projection.events) {
-        if (type === "review.submitted" && outcome.kind === "verdict") {
-            ev.emit("review.submitted", { actorType: "reviewer", payload: outcome.result });
+        if (type === "review.submitted" && verdictResult) {
+            ev.emit("review.submitted", { actorType: "reviewer", payload: verdictResult });
         }
         else if (type === "worker.completed" || type === "worker.failed") {
             const session = item.workerSessionId ? getWorkerSession(item.workerSessionId) : null;
@@ -544,8 +547,8 @@ function applyReviewer(issue, instance, item, outcome) {
         patch.headSha = outcome.currentHeadSha;
     }
     // Thread reviewer findings across rounds (PRD §6.4) — every blocking/non-blocking finding.
-    if (outcome.kind === "verdict") {
-        for (const f of outcome.result.findings) {
+    if (verdictResult) {
+        for (const f of verdictResult.findings) {
             reconcileFinding({
                 issueId: issue.id,
                 fingerprint: f.fingerprint,
@@ -651,7 +654,7 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
 function questionFor(actionType, reason, resumeAsReviewer = false) {
     switch (actionType) {
         case "final_review":
-            return "Accept and merge this work, send it back for another repair round, or close it?";
+            return "Merge this work, send it back for another repair round, or close it?";
         case "attempts_exhausted":
             return "The review-round limit is reached. Retry with a fresh round, or close the issue?";
         case "policy_escalation":
@@ -684,9 +687,9 @@ export function responseOptionsFor(actionType, resumeAsReviewer = false) {
     switch (actionType) {
         case "final_review":
             return [
-                { choice: "complete", label: "Accept — merge & mark done" },
+                { choice: "merge", label: "Merge" },
                 { choice: "repair", label: "Another repair round" },
-                { choice: "close", label: "Close without accepting" },
+                { choice: "close", label: "Close" },
             ];
         case "attempts_exhausted":
             return [
@@ -748,9 +751,11 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice) {
     if (!issue)
         return { ok: false, code: 404, error: "Issue not found" };
     const instance = getActiveWorkflowInstance(action.issueId);
-    // NOT-102: human accept must undraft+merge (never mark done while leaving a draft PR).
+    // NOT-102 / NOT-150: human Merge (or legacy "complete") must undraft+merge.
     // Park like auto-merge, then the async wrapper runs finalizeAutoMerge outside this txn.
-    if (instance && resolution.actionType === "final_review" && resolution.choice === "complete") {
+    if (instance &&
+        resolution.actionType === "final_review" &&
+        (resolution.choice === "merge" || resolution.choice === "complete")) {
         return getDb().transaction(() => {
             resolveHumanAction(actionId, resolvedBy, { choice });
             appendWorkflowEvent({
@@ -761,7 +766,7 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice) {
                 actorRef: resolvedBy,
                 stage: "final_review",
                 round: issue.currentRound,
-                payload: { actionType: "final_review", choice: "complete", pendingMerge: true },
+                payload: { actionType: "final_review", choice: resolution.choice, pendingMerge: true },
             });
             transitionIssue(issue.id, "final_review", {
                 currentOwner: "system",
@@ -966,7 +971,8 @@ function resolveLegacyTerminalAction(action, issue, resolvedBy, resolution) {
     if (resolution.choice === "close") {
         nextStatus = "closed";
     }
-    else if (resolution.actionType === "final_review" && resolution.choice === "complete") {
+    else if (resolution.actionType === "final_review" &&
+        (resolution.choice === "merge" || resolution.choice === "complete")) {
         nextStatus = "done";
     }
     else if (resolution.actionType === "final_review" && resolution.choice === "repair") {

package/bundle/server/dist/coordinator/commands.test.js

@@ -17,11 +17,13 @@ const { startWorkflow, applyCompletion, resolveHumanActionAndAdvance, resolveHum
 const { ReviewerResult } = await import("./reviewer-result.js");
 const { listArtifactsForIssue } = await import("../repository/artifacts-for-issue.js");
 const { setMergePrForTests, clearFinalizeInflightForTests } = await import("./auto-merge.js");
+const { stubManagedCloneForTests } = await import("../adapters/managed-repo.js");
 before(() => migrate());
 beforeEach(() => {
     getDb().exec("DELETE FROM work_items");
     clearFinalizeInflightForTests();
     setMergePrForTests(async () => ({ ok: true }));
+    stubManagedCloneForTests("acme/app");
 });
 function newIssue(opts = {}) {
     return createIssue({
@@ -400,13 +402,16 @@ test("fail → retry → exhaust → resume → fail again does not collide with
     assert.equal(pending.length, 1, "a fresh item must be enqueued — the old (round, infraAttempts)-keyed row must not be silently reused");
     assert.notEqual(pending[0].id, firstRetryItem.id, "must be a NEW work item, not the pre-escalation retry's now-terminal row");
 });
-test("resolving policy_escalation:resume after a reviewer's escalated verdict (a real code-level question) still resumes as the developer", async () => {
+test("resolving product_scope_decision:resume after a reviewer's escalated+question resumes as the developer", async () => {
     const issueId = newIssue();
     startWorkflow(issueId);
     await complete(issueId, cleanHandoff);
-    await complete(issueId, { kind: "verdict", result: okReview("escalated") });
-    const action = listHumanActionsForIssue(issueId).find((a) => a.actionType === "policy_escalation");
-    assert.equal(action.continuationPreviewJson, null, "an escalated-verdict policy_escalation carries no reviewer-resume continuation");
+    await complete(issueId, {
+        kind: "verdict",
+        result: { ...okReview("escalated"), productScopeQuestion: "Should deleted users retain sessions?" },
+    });
+    const action = listHumanActionsForIssue(issueId).find((a) => a.actionType === "product_scope_decision");
+    assert.ok(action, "true product escalate opens product_scope_decision, not policy_escalation");
     const resolved = resolveHumanActionAndAdvance(action.id, "yusuke", "resume");
     assert.equal(resolved.ok, true);
     const issue = getIssue(issueId);
@@ -414,6 +419,18 @@ test("resolving policy_escalation:resume after a reviewer's escalated verdict (a
     const pending = listWorkItemsForIssue(issueId).filter((i) => i.status === "pending");
     assert.deepEqual(pending.map((i) => i.kind), ["developer"]);
 });
+test("NOT-150: bare escalated verdict remaps to automatic repair, not policy_escalation", async () => {
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    await complete(issueId, { kind: "verdict", result: okReview("escalated") });
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "repairing");
+    assert.ok(!listHumanActionsForIssue(issueId).find((a) => a.actionType === "policy_escalation"));
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "developer" && i.status === "pending").length, 1);
+    const findings = listFindingsForIssue(issueId);
+    assert.ok(findings.some((f) => f.severity === "blocking"), "bare escalate remap must thread a blocking finding into repair");
+});
 test("a stale review re-queues a reviewer at the new head without consuming a round", async () => {
     const issueId = newIssue();
     startWorkflow(issueId);

package/bundle/server/dist/coordinator/dependencies.js

@@ -16,6 +16,7 @@
 // A persisted table can replace the provider later without touching the rule.
 import { isTerminalIssueStatus } from "@agent-dealer/shared";
 import { fetchLinearBlockers } from "../adapters/linear-inbox.js";
+import { LinearHttpError } from "../adapters/linear-graphql.js";
 import { listIssuesByExternalId } from "../repository/issues.js";
 const EMPTY_SNAPSHOT = new Map();
 const DEFAULT_CACHE_TTL_MS = 60_000;
@@ -124,7 +125,10 @@ export async function blockersFor(issues) {
         fetched = await pending;
     }
     catch (err) {
-        backoffUntil = Date.now() + failureBackoffMs;
+        // NOT-152: a 429 / exhausted budget must wait for Linear's reset window, not only the
+        // short FAILURE_BACKOFF_MS — otherwise admission re-hammers once that window lapses.
+        const rateLimitMs = err instanceof LinearHttpError && err.retryAfterMs != null ? err.retryAfterMs : 0;
+        backoffUntil = Date.now() + Math.max(failureBackoffMs, rateLimitMs);
         throw err;
     }
     finally {

package/bundle/server/dist/coordinator/dependency-readiness.integration.test.js

@@ -322,6 +322,35 @@ test("a failing Linear is asked once per backoff window, not once per tick", asy
     setLinearBlockerFetcherForTests(async (ids) => new Map(ids.map((id) => [id, []])));
     assert.equal((await admitNext())?.issueId, issue.id);
 });
+test("HTTP 429 backs off until Linear's reset header, not only the short failure window", async () => {
+    // NOT-152: a rate-limit must outlive FAILURE_BACKOFF_MS when X-RateLimit-Requests-Reset says so.
+    const { LinearHttpError } = await import("../adapters/linear-graphql.js");
+    const issue = seedIssue({ source: "linear", externalId: "lin-a" });
+    let fetches = 0;
+    setBlockerFailureBackoffForTests(50);
+    setLinearBlockerFetcherForTests(async () => {
+        fetches++;
+        throw new LinearHttpError({
+            status: 429,
+            operation: "fetchLinearBlockers",
+            rateLimit: {
+                requestsRemaining: "0",
+                requestsReset: String(Date.now() + 60_000),
+            },
+            bodySnippet: "rate limited",
+            retryAfterMs: 60_000,
+        });
+    });
+    await assert.rejects(() => blockersFor([issue]), (err) => {
+        assert.ok(err instanceof LinearHttpError);
+        assert.equal(err.status, 429);
+        return true;
+    });
+    assert.equal(fetches, 1);
+    await new Promise((r) => setTimeout(r, 80));
+    await assert.rejects(() => blockersFor([issue]), /backing off/);
+    assert.equal(fetches, 1, "must not re-hit Linear while the rate-limit window is open");
+});
 test("overlapping ticks share one fetch: the second parks instead of opening a second call", async () => {
     const issue = seedIssue({ source: "linear", externalId: "lin-a" });
     let release = () => { };
@@ -371,7 +400,10 @@ function stubLinearIssues(batch, rounds = []) {
         else {
             data = { issues: { nodes: batch, pageInfo: { hasNextPage: false, endCursor: null } } };
         }
-        return { ok: true, json: async () => ({ data }) };
+        return new Response(JSON.stringify({ data }), {
+            status: 200,
+            headers: { "Content-Type": "application/json" },
+        });
     });
     return {
         requests,

package/bundle/server/dist/coordinator/human-resolution.js

@@ -8,7 +8,8 @@
  * reopen an issue or enqueue developer/reviewer work).
  */
 const VALID_CHOICES = {
-    final_review: ["complete", "repair", "close"],
+    // "complete" kept as a synonym for "merge" so older open actions / CLI callers still resolve.
+    final_review: ["merge", "complete", "repair", "close"],
     attempts_exhausted: ["retry", "close"],
     policy_escalation: ["resume", "close"],
     product_scope_decision: ["resume"],
@@ -52,8 +53,10 @@ export function parseHumanResolution(actionType, choice) {
 export function resolveHumanActionOutcome(resolution) {
     switch (resolution.actionType) {
         case "final_review":
-            if (resolution.choice === "complete")
+            // Merge (and legacy "complete") undraft+merge via commands.ts, then mark done.
+            if (resolution.choice === "merge" || resolution.choice === "complete") {
                 return { issueStatus: "done", workflowOutcome: "done", triggerReflect: true };
+            }
             if (resolution.choice === "repair")
                 return { issueStatus: "repairing", startNewRound: true, roundKind: "review" };
             if (resolution.choice === "close")

package/bundle/server/dist/coordinator/human-resolution.test.js

@@ -23,12 +23,24 @@ test("parseHumanResolution rejects reflection_interaction_required even though V
 test("resolveHumanActionOutcome throws rather than silently closing on an invalid choice reaching it directly", () => {
     assert.throws(() => resolveHumanActionOutcome({ actionType: "final_review", choice: "bogus" }), /Unrecognized final_review choice/);
 });
-test("final_review complete marks the issue done and triggers reflect", () => {
+test("final_review merge marks the issue done and triggers reflect", () => {
+    const result = resolveHumanActionOutcome({ actionType: "final_review", choice: "merge" });
+    assert.equal(result.issueStatus, "done");
+    assert.equal(result.workflowOutcome, "done");
+    assert.equal(result.triggerReflect, true);
+});
+test("final_review complete (legacy synonym) still marks done", () => {
     const result = resolveHumanActionOutcome({ actionType: "final_review", choice: "complete" });
     assert.equal(result.issueStatus, "done");
     assert.equal(result.workflowOutcome, "done");
     assert.equal(result.triggerReflect, true);
 });
+test("parseHumanResolution accepts merge for final_review", () => {
+    assert.deepStrictEqual(parseHumanResolution("final_review", "merge"), {
+        actionType: "final_review",
+        choice: "merge",
+    });
+});
 test("final_review repair sends the issue back for another round without reflect", () => {
     const result = resolveHumanActionOutcome({ actionType: "final_review", choice: "repair" });
     assert.equal(result.issueStatus, "repairing");

package/bundle/server/dist/coordinator/prompts.js

@@ -73,16 +73,18 @@ export function buildDeveloperPrompt(input) {
 }
 const REVIEWER_RESULT_SHAPE = '{"verdict":"approved"|"changes_requested"|"escalated","baseSha":"...","headSha":"...","acceptanceCriteriaAssessment":"...","evidenceAssessment":"...","findings":[{"fingerprint":"stable-slug","severity":"blocking"|"non_blocking","title":"...","rationale":"...","file":"...","line":0}],"risks":["..."],"productScopeQuestion":"..."}';
 function reviewerContractSection(baseSha, headSha) {
+    // Verdict table matches docs/PRD_ISSUE_COORDINATION.md §6.4 / design NOT-150 — do not drift.
     return [
         `## Required final JSON block`,
         `End your reply with exactly one fenced \`\`\`json block shaped like:`,
         REVIEWER_RESULT_SHAPE,
-        `Rules:`,
+        `Rules (verdict contract):`,
         `- Set "baseSha" to exactly "${baseSha}" and "headSha" to exactly "${headSha}" — these are the coordinator-verified SHAs you were checked out at, not values you compute.`,
         `- "fingerprint" must be a short, stable slug for the finding (e.g. "missing-null-check-args-ts") so the same issue re-found next round is recognized as recurring, not duplicated.`,
         `- "findings" holds every blocking AND non-blocking observation; "risks" is uncertainties that are not findings tied to a location.`,
-        `- Use "changes_requested" whenever any finding is "blocking". Use "approved" only when there are none.`,
-        `- Use "escalated" only when the acceptance criteria themselves are ambiguous, contradictory, or the diff reveals a missing product decision — not for ordinary code problems. Set "productScopeQuestion" to that question; omit it otherwise.`,
+        `- "approved": AC met for this tip and no finding is "blocking" (non_blocking nits allowed).`,
+        `- "changes_requested": any "blocking" finding a coding pass can address — including incomplete review because AC-critical files were omitted/truncated from the diff. List omitted paths in a blocking finding.`,
+        `- "escalated": only when acceptance criteria / product scope are ambiguous, contradictory, or need a human product call — not ordinary code defects, not "diff too large". You MUST set non-empty "productScopeQuestion"; omit the field otherwise.`,
         `- You cannot edit files, push, or publish anything — you only return this JSON. The coordinator publishes it to GitHub on your behalf.`,
     ];
 }
@@ -91,37 +93,43 @@ function reviewerContractSection(baseSha, headSha) {
  * earlier, much smaller per-file cap still truncated mid-file on a genuinely large PR,
  * cutting off before the code under review). Whole files only — never a mid-hunk cut,
  * which would be actively misleading — so a file either fits completely or is entirely
- * omitted and counted in `truncated`. `runReviewerEffect` treats `truncated: true` as
- * grounds to override whatever verdict the reviewer reports: the reviewer cannot see the
- * full revision, so no verdict against it can be trusted, and this must be enforced in
- * code — a prompt instruction alone is not a structural guarantee (the same reasoning
- * `args.ts`/`permissions.ts` already apply to enforcement in general).
+ * omitted and listed in `omittedPaths`. Truncation policy (PRD §6.4 / NOT-150): coordinator
+ * remaps illegal escalate / approved+blocking; never blind escalate → Resume|Close.
  */
 export const TOTAL_DIFF_LIMIT = 300_000;
+function pathFromDiffGitHeader(headerLine) {
+    // `diff --git a/path b/path` — prefer the b/ side; fall back to a/.
+    const m = headerLine.match(/^diff --git a\/(.+?) b\/(.+)$/);
+    if (!m)
+        return null;
+    return m[2] || m[1] || null;
+}
 export function formatDiffForPrompt(diff) {
     const trimmed = diff.trim();
     if (!trimmed)
-        return { text: "(empty diff)", truncated: false };
+        return { text: "(empty diff)", truncated: false, omittedPaths: [] };
     const blocks = trimmed.split(/(?=^diff --git )/m).filter(Boolean);
     const manifest = blocks.map((b) => b.slice(0, b.indexOf("\n"))).join("\n");
     const pieces = [];
+    const omittedPaths = [];
     let total = 0;
-    let omittedFiles = 0;
     for (const block of blocks) {
         if (total + block.length > TOTAL_DIFF_LIMIT) {
-            omittedFiles++;
+            const header = block.slice(0, block.indexOf("\n"));
+            omittedPaths.push(pathFromDiffGitHeader(header) ?? (header || "unknown"));
             continue;
         }
         pieces.push(block);
         total += block.length;
     }
-    const truncated = omittedFiles > 0;
+    const truncated = omittedPaths.length > 0;
     const footer = truncated
-        ? `\n... [${omittedFiles} changed file(s) omitted — this diff exceeds ${TOTAL_DIFF_LIMIT} characters. You cannot examine the complete revision; the coordinator will not accept "approved" or "changes_requested" from this session regardless of what you report.]`
+        ? `\n... [${omittedPaths.length} changed file(s) omitted — diff exceeds ${TOTAL_DIFF_LIMIT} characters. Omitted: ${omittedPaths.join(", ")}. If any omitted path is AC-critical, verdict MUST be "changes_requested" with a blocking finding listing those paths. If AC is still certifiable from the visible tip with only non_blocking findings, "approved" is allowed. Do NOT use "escalated" for truncation — escalate only with productScopeQuestion for a true product gap.]`
         : "";
     return {
         text: `Changed files (${blocks.length}):\n${manifest}\n\n${pieces.join("\n")}${footer}`,
         truncated,
+        omittedPaths,
     };
 }
 export function buildReviewerPrompt(input) {

package/bundle/server/dist/coordinator/prompts.test.js

@@ -145,6 +145,27 @@ test("reviewer prompt embeds the diff, echoes the exact SHAs to report, and forb
     assert.match(prompt, /"headSha" to exactly "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"/);
     assert.match(prompt, /You cannot edit files, push, or publish anything/);
 });
+test("NOT-150: reviewer verdict rules match the design table (blocking ⇒ changes_requested; escalate needs productScopeQuestion)", () => {
+    const prompt = buildReviewerPrompt(reviewerBase);
+    assert.match(prompt, /"approved": AC met/);
+    assert.match(prompt, /no finding is "blocking"/);
+    assert.match(prompt, /"changes_requested": any "blocking" finding/);
+    assert.match(prompt, /"escalated": only when acceptance criteria/);
+    assert.match(prompt, /MUST set non-empty "productScopeQuestion"/);
+    assert.match(prompt, /not ordinary code defects/);
+    assert.match(prompt, /not "diff too large"/);
+});
+test("NOT-150: truncated-diff footer does not reject approved/changes_requested; forbids escalate-for-truncation", async () => {
+    const { formatDiffForPrompt, TOTAL_DIFF_LIMIT } = await import("./prompts.js");
+    const big = "x".repeat(TOTAL_DIFF_LIMIT + 1);
+    const diff = `diff --git a/small.ts b/small.ts\n+ok\n\ndiff --git a/huge.ts b/huge.ts\n+${big}\n`;
+    const formatted = formatDiffForPrompt(diff);
+    assert.equal(formatted.truncated, true);
+    assert.ok(formatted.omittedPaths.some((p) => p.includes("huge.ts")));
+    assert.match(formatted.text, /changes_requested/);
+    assert.match(formatted.text, /Do NOT use "escalated" for truncation/);
+    assert.doesNotMatch(formatted.text, /will not accept "approved" or "changes_requested"/);
+});
 test("reviewer prompt includes the developer's conclusion, checks summary, and prior findings when given", () => {
     const prompt = buildReviewerPrompt({
         ...reviewerBase,

package/bundle/server/dist/coordinator/reviewer-effect.js

@@ -29,7 +29,7 @@ import { getTaskSnapshot } from "./commands.js";
 import { buildReviewerPrompt, formatDiffForPrompt, TOTAL_DIFF_LIMIT } from "./prompts.js";
 import { guidanceForNextSession } from "./guidance.js";
 import { realReviewerSpawn, reviewerSessionLogPath } from "./spawn.js";
-import { parseReviewerResult, ReviewerResult as ReviewerResultSchema } from "./reviewer-result.js";
+import { parseReviewerResult, normalizeReviewerResult, INCOMPLETE_REVIEW_FINGERPRINT, ReviewerResult as ReviewerResultSchema, } from "./reviewer-result.js";
 import { createRoleWorktree, safeRemoveWorktree, isWorktreeClean, mergeBase, fetchRef, diffShas, } from "../adapters/git-worktree.js";
 import { ensureIssueRepoCheckout, roleWorktreePathForResolution, resolveCheckoutBaseBranch, } from "../adapters/managed-repo.js";
 import { prepareWorkerDeckConnection, releaseWorkerDeckConnection } from "../adapters/agent-deck-bind.js";
@@ -108,6 +108,47 @@ async function bestEffortRemove(repo, worktreePath) {
         // leave it for crash-recovery inspection — cleanup is a courtesy, not part of the contract
     }
 }
+/** Inject a stable blocking incomplete-review finding listing omitted paths (NOT-150). */
+function withIncompleteReviewFinding(result, omittedPaths) {
+    if (result.findings.some((f) => f.fingerprint === INCOMPLETE_REVIEW_FINGERPRINT)) {
+        const { productScopeQuestion: _drop, ...rest } = result;
+        return { ...rest, verdict: "changes_requested" };
+    }
+    const paths = omittedPaths.length > 0 ? omittedPaths.join(", ") : "(unlisted omitted files)";
+    const { productScopeQuestion: _drop, ...rest } = result;
+    return {
+        ...rest,
+        verdict: "changes_requested",
+        findings: [
+            ...result.findings,
+            {
+                fingerprint: INCOMPLETE_REVIEW_FINGERPRINT,
+                severity: "blocking",
+                title: "Diff truncated — incomplete review",
+                rationale: `Reviewer prompt omitted path(s): ${paths}. Cannot fully certify acceptance criteria without them; shrink the change set or split the PR so the next review sees the full AC-critical surface.`,
+            },
+        ],
+    };
+}
+/**
+ * Truncation remap (PRD §6.4 / design NOT-150): never blind escalate → Resume|Close.
+ * Shippable approved (no blocking) stays approved; otherwise ensure changes_requested with
+ * the incomplete-review finding listing omitted paths (in addition to any other blocking).
+ */
+function applyTruncationVerdictPolicy(result, omittedPaths) {
+    const normalized = normalizeReviewerResult(result);
+    const hasProductQ = !!normalized.productScopeQuestion?.trim();
+    const hasBlocking = normalized.findings.some((f) => f.severity === "blocking");
+    if (normalized.verdict === "escalated" && hasProductQ) {
+        return normalized;
+    }
+    if (normalized.verdict === "approved" && !hasBlocking) {
+        return normalized;
+    }
+    // Truncated + not shippable-approved → changes_requested with incomplete-review (omitted paths).
+    const { productScopeQuestion: _drop, ...rest } = normalized;
+    return withIncompleteReviewFinding({ ...rest, verdict: "changes_requested" }, omittedPaths);
+}
 function readImplementationConclusion(issueId) {
     const artifact = latestIssueArtifact(issueId, "implementation_conclusion");
     if (!artifact?.contentJson)
@@ -281,7 +322,7 @@ export async function runReviewerEffect(ctx, deps = defaultDeps) {
             await fetchRef(worktreePath, baseBranch);
             const baseSha = await mergeBase({ repo: worktreePath, base: `origin/${baseBranch}`, head: headSha });
             const diff = await diffShas({ worktreePath, baseSha, headSha });
-            const { truncated: diffTruncated } = formatDiffForPrompt(diff);
+            const { truncated: diffTruncated, omittedPaths } = formatDiffForPrompt(diff);
             const openFindings = listFindingsForIssue(issue.id).filter((f) => f.status === "open" || f.status === "recurring");
             const guidance = guidanceForNextSession(issue.id, sessionId);
             const prompt = buildReviewerPrompt({
@@ -402,20 +443,23 @@ export async function runReviewerEffect(ctx, deps = defaultDeps) {
                 return { kind: "session_failed" };
             }
             result = parsed;
-            // A prompt instruction alone ("don't approve an incomplete diff") is not a structural
-            // guarantee — the same reasoning this codebase already applies to tool permissions
-            // (args.ts/permissions.ts). If the diff had to be truncated, the reviewer's verdict is
-            // overridden to "escalated" in code, regardless of what it actually reported, so a
-            // truncated review can never reach final_review or an automatic repair loop.
-            if (diffTruncated && result.verdict !== "escalated") {
+            // Truncation policy (PRD §6.4 / design NOT-150): never blind-escalate to Resume|Close.
+            // Persist evidence; remap bare escalate / approved+blocking; keep shippable approved.
+            if (diffTruncated) {
+                const reportedVerdict = result.verdict;
+                result = applyTruncationVerdictPolicy(result, omittedPaths);
                 createIssueArtifact({
                     issueId: issue.id,
                     workerSessionId: sessionId,
                     kind: "diff_truncated_evidence",
                     author: "system",
-                    content: { reportedVerdict: result.verdict, overriddenTo: "escalated", diffCharLimit: TOTAL_DIFF_LIMIT },
+                    content: {
+                        reportedVerdict,
+                        overriddenTo: result.verdict,
+                        diffCharLimit: TOTAL_DIFF_LIMIT,
+                        omittedPaths,
+                    },
                 });
-                result = { ...result, verdict: "escalated" };
             }
         }
         catch {
@@ -456,7 +500,8 @@ export async function runReviewerEffect(ctx, deps = defaultDeps) {
                 // diff). A `row` with no recorded result (still `claimed` after every wait
                 // attempt, or the winner itself failed) has nothing safe to report — escalate.
                 if (claim.row?.state === "published" && claim.row.resultJson) {
-                    const winnerResult = ReviewerResultSchema.parse(JSON.parse(claim.row.resultJson));
+                    const winnerParsed = ReviewerResultSchema.parse(JSON.parse(claim.row.resultJson));
+                    const winnerResult = normalizeReviewerResult(winnerParsed);
                     return { kind: "verdict", result: winnerResult };
                 }
                 return { kind: "publish_failed" };