agent-dealer 1.0.2 → 1.0.4

package/bundle/server/dist/coordinator/branch-tip-status.js

@@ -0,0 +1,120 @@
+// packages/server/src/coordinator/branch-tip-status.ts
+//
+// NOT-148: Issue Detail surfaces commits-ahead / "no tip yet", restart risk, and
+// dirty/preserved worktree hints next to live progress so operators can see cold-start
+// retries (and salvage leftovers) before another hour burns.
+import fs from "node:fs";
+import { classifyIssueRepo } from "../adapters/managed-repo.js";
+import { findWorktreeForBranch, inspectLeftoverWorktree, } from "../adapters/git-worktree.js";
+import { baseRefCandidates, developerBranchName, inspectBranchProgress, } from "./branch-progress.js";
+function tipLabelFor(progress) {
+    switch (progress.state) {
+        case "absent":
+        case "empty":
+            return { commitsAhead: 0, tipLabel: "no tip yet" };
+        case "unpushed":
+        case "published":
+            return {
+                commitsAhead: progress.ahead,
+                tipLabel: `${progress.ahead} ahead`,
+            };
+    }
+}
+function samePath(a, b) {
+    try {
+        return fs.realpathSync(a) === fs.realpathSync(b);
+    }
+    catch {
+        return pathNorm(a) === pathNorm(b);
+    }
+}
+function pathNorm(p) {
+    return p.replace(/\/+$/, "");
+}
+/**
+ * Pure classifier used by the API once branch progress (and optional failure context) is known.
+ * `hadFailedAttempt` is true when infraAttempts > 0 or a latest session failure is shown.
+ */
+export function classifyBranchTipStatus(opts) {
+    const worktree = opts.worktree ?? null;
+    if (!opts.progress) {
+        return {
+            branch: opts.branch,
+            state: "unknown",
+            commitsAhead: null,
+            tipLabel: "unknown",
+            restartRisk: opts.hadFailedAttempt,
+            worktree,
+        };
+    }
+    const { commitsAhead, tipLabel } = tipLabelFor(opts.progress);
+    // Empty tip = no publishable work on the branch. Do NOT treat `ahead === 0` on a
+    // `published`/`unpushed` progress object as empty — `inspectBranchProgress` can report
+    // `ahead ?? 0` when the base ref is unresolved while the branch is still publishable.
+    const emptyTip = opts.progress.state === "absent" || opts.progress.state === "empty";
+    return {
+        branch: opts.branch,
+        state: opts.progress.state,
+        commitsAhead,
+        tipLabel,
+        restartRisk: emptyTip && opts.hadFailedAttempt,
+        worktree,
+    };
+}
+/** Resolve a local clone path for read-only tip inspection — never clones. */
+function localRepoPathForTip(repoField) {
+    try {
+        const classified = classifyIssueRepo(repoField);
+        if (!fs.existsSync(classified.repoPath))
+            return null;
+        return classified.repoPath;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Dirty leftover on the issue branch that is not the live running session's checkout.
+ * Mid-run WIP is normal; a leftover after failure/escalation is the salvage signal.
+ */
+async function preservedDirtyWorktreeHint(opts) {
+    const wtPath = await findWorktreeForBranch(opts.repoPath, opts.branch).catch(() => null);
+    if (!wtPath)
+        return null;
+    if (opts.activeWorktreePath && samePath(opts.activeWorktreePath, wtPath)) {
+        return null;
+    }
+    const leftover = await inspectLeftoverWorktree(wtPath);
+    if (leftover !== "dirty_or_unpushed")
+        return null;
+    return { path: wtPath, dirty: true, preserved: true };
+}
+/** Read-only tip status for Issue Detail while developing / retrying. */
+export async function branchTipStatusForIssue(issue, opts) {
+    // Surface during active develop/repair (and reviewing, so a just-handed-off tip stays visible).
+    if (!["developing", "repairing", "reviewing"].includes(issue.status))
+        return null;
+    const branch = developerBranchName(issue);
+    const hadFailedAttempt = opts?.hadFailedAttempt ?? issue.infraAttempts > 0;
+    const repoPath = localRepoPathForTip(issue.repo);
+    let progress = null;
+    let worktree = null;
+    if (repoPath) {
+        try {
+            progress = await inspectBranchProgress({
+                repo: repoPath,
+                branch,
+                baseRefs: baseRefCandidates(issue),
+            });
+        }
+        catch {
+            progress = null;
+        }
+        worktree = await preservedDirtyWorktreeHint({
+            repoPath,
+            branch,
+            activeWorktreePath: opts?.activeWorktreePath,
+        });
+    }
+    return classifyBranchTipStatus({ branch, progress, hadFailedAttempt, worktree });
+}

package/bundle/server/dist/coordinator/branch-tip-status.test.js

@@ -0,0 +1,189 @@
+// packages/server/src/coordinator/branch-tip-status.test.ts
+import { test, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+// Worktrees / managed clones resolve under AGENT_DEALER_HOME — set before adapters load.
+const home = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "dealer-tip-home-")));
+process.env.AGENT_DEALER_HOME = home;
+const { classifyBranchTipStatus, branchTipStatusForIssue, } = await import("./branch-tip-status.js");
+const { managedRepoPath } = await import("../adapters/managed-repo.js");
+const { createRoleWorktree } = await import("../adapters/git-worktree.js");
+test("NOT-148: empty tip after a failed attempt flags restart risk", () => {
+    const status = classifyBranchTipStatus({
+        branch: "issue-x",
+        progress: { state: "empty", branch: "issue-x" },
+        hadFailedAttempt: true,
+    });
+    assert.equal(status.commitsAhead, 0);
+    assert.equal(status.tipLabel, "no tip yet");
+    assert.equal(status.restartRisk, true);
+    assert.equal(status.worktree, null);
+});
+test("NOT-148: empty tip with no prior failure is not restart risk yet", () => {
+    const status = classifyBranchTipStatus({
+        branch: "issue-x",
+        progress: { state: "absent", branch: "issue-x" },
+        hadFailedAttempt: false,
+    });
+    assert.equal(status.tipLabel, "no tip yet");
+    assert.equal(status.restartRisk, false);
+});
+test("NOT-148: tip with commits ahead is not restart risk even after failures", () => {
+    const status = classifyBranchTipStatus({
+        branch: "issue-x",
+        progress: { state: "unpushed", branch: "issue-x", ahead: 2, unpushed: 2 },
+        hadFailedAttempt: true,
+    });
+    assert.equal(status.commitsAhead, 2);
+    assert.equal(status.tipLabel, "2 ahead");
+    assert.equal(status.restartRisk, false);
+});
+test("NOT-148: published tip with ahead=0 (unresolved base) is not treated as empty tip", () => {
+    // inspectBranchProgress can report published with ahead ?? 0 when base is unresolved.
+    const status = classifyBranchTipStatus({
+        branch: "issue-x",
+        progress: { state: "published", branch: "issue-x", ahead: 0 },
+        hadFailedAttempt: true,
+    });
+    assert.equal(status.state, "published");
+    assert.equal(status.tipLabel, "0 ahead");
+    assert.equal(status.restartRisk, false);
+});
+test("NOT-148: unknown progress after failure still flags restart risk conservatively", () => {
+    const status = classifyBranchTipStatus({
+        branch: "issue-x",
+        progress: null,
+        hadFailedAttempt: true,
+    });
+    assert.equal(status.state, "unknown");
+    assert.equal(status.tipLabel, "unknown");
+    assert.equal(status.restartRisk, true);
+});
+test("NOT-148: dirty preserved worktree hint passes through on the tip status", () => {
+    const status = classifyBranchTipStatus({
+        branch: "issue-x",
+        progress: { state: "empty", branch: "issue-x" },
+        hadFailedAttempt: true,
+        worktree: { path: "/tmp/wt", dirty: true, preserved: true },
+    });
+    assert.deepEqual(status.worktree, { path: "/tmp/wt", dirty: true, preserved: true });
+});
+function git(cwd, ...args) {
+    return execFileSync("git", args, { cwd, encoding: "utf8" }).trim();
+}
+const identity = "github.com/acme/tip-status-fixture";
+let repo;
+let remote;
+before(() => {
+    repo = managedRepoPath(identity);
+    fs.mkdirSync(path.dirname(repo), { recursive: true });
+    // Fresh clone dir each suite run under the temp home.
+    if (fs.existsSync(repo))
+        fs.rmSync(repo, { recursive: true, force: true });
+    fs.mkdirSync(repo, { recursive: true });
+    git(repo, "init", "-b", "main");
+    git(repo, "config", "user.email", "test@example.com");
+    git(repo, "config", "user.name", "Test");
+    fs.writeFileSync(path.join(repo, "README.md"), "hello\n");
+    git(repo, "add", ".");
+    git(repo, "commit", "-m", "init");
+    remote = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-tip-remote-"));
+    execFileSync("git", ["init", "-q", "--bare", "-b", "main", remote]);
+    git(repo, "remote", "add", "origin", remote);
+    git(repo, "push", "-q", "origin", "main");
+});
+after(() => {
+    fs.rmSync(home, { recursive: true, force: true });
+    if (remote)
+        fs.rmSync(remote, { recursive: true, force: true });
+});
+test("NOT-148: branchTipStatusForIssue resolves managed github.com identity to local clone", async () => {
+    const branch = "issue-tip-ahead";
+    git(repo, "checkout", "-b", branch);
+    fs.writeFileSync(path.join(repo, "feat.txt"), "one\n");
+    git(repo, "add", ".");
+    git(repo, "commit", "-m", "feat");
+    git(repo, "checkout", "main");
+    const status = await branchTipStatusForIssue({
+        id: "tip-ahead",
+        branch,
+        repo: identity,
+        baseBranch: "main",
+        baseSha: null,
+        infraAttempts: 1,
+        status: "developing",
+    }, { hadFailedAttempt: true });
+    assert.ok(status);
+    assert.equal(status.commitsAhead, 1);
+    assert.equal(status.tipLabel, "1 ahead");
+    assert.equal(status.restartRisk, false);
+    assert.equal(status.worktree, null);
+});
+test("NOT-148: dirty leftover worktree (not the live session) surfaces as preserved", async () => {
+    const branch = "issue-tip-dirty";
+    git(repo, "branch", branch, "main");
+    const wt = await createRoleWorktree({
+        repo,
+        role: "developer",
+        sessionId: "s-dirty-tip",
+        ref: branch,
+    });
+    fs.writeFileSync(path.join(wt.path, "wip.txt"), "uncommitted\n");
+    const status = await branchTipStatusForIssue({
+        id: "tip-dirty",
+        branch,
+        repo: identity,
+        baseBranch: "main",
+        baseSha: null,
+        infraAttempts: 1,
+        status: "developing",
+    }, {
+        hadFailedAttempt: true,
+        activeWorktreePath: null,
+    });
+    assert.ok(status);
+    assert.ok(status.worktree);
+    assert.equal(status.worktree.dirty, true);
+    assert.equal(status.worktree.preserved, true);
+    assert.ok(status.worktree.path.includes("s-dirty-tip"));
+    try {
+        execFileSync("git", ["worktree", "remove", "--force", wt.path], { cwd: repo });
+    }
+    catch {
+        fs.rmSync(wt.path, { recursive: true, force: true });
+    }
+});
+test("NOT-148: dirty worktree owned by the live running session is not flagged as preserved", async () => {
+    const branch = "issue-tip-live-dirty";
+    git(repo, "branch", branch, "main");
+    const wt = await createRoleWorktree({
+        repo,
+        role: "developer",
+        sessionId: "s-live-dirty",
+        ref: branch,
+    });
+    fs.writeFileSync(path.join(wt.path, "editing.txt"), "mid-run\n");
+    const status = await branchTipStatusForIssue({
+        id: "tip-live",
+        branch,
+        repo: identity,
+        baseBranch: "main",
+        baseSha: null,
+        infraAttempts: 0,
+        status: "developing",
+    }, {
+        hadFailedAttempt: false,
+        activeWorktreePath: wt.path,
+    });
+    assert.ok(status);
+    assert.equal(status.worktree, null, "live WIP must not read as salvage preserve");
+    try {
+        execFileSync("git", ["worktree", "remove", "--force", wt.path], { cwd: repo });
+    }
+    catch {
+        fs.rmSync(wt.path, { recursive: true, force: true });
+    }
+});

package/bundle/server/dist/coordinator/commands.js

@@ -19,7 +19,10 @@ import { parseHumanResolution, resolveHumanActionOutcome } from "./human-resolut
 import { AUTO_MERGE_INTENT, finalizeAutoMerge } from "./auto-merge.js";
 import { capEscalationEvents, deferLeasedWorkItemForDeckOutage, deferLeasedWorkItemForUsageCap, formatCapEscalationReason, usageCapDeferralStartedAt, } from "./usage-cap-defer.js";
 import { markQueueEntryAdmitted } from "../repository/queue-entries.js";
-export const WORKFLOW_VERSION = "dev_reviewer_v1";
+import { getWorkflow } from "./workflows/registry.js";
+import { DEV_REVIEWER_V1_VERSION } from "./workflows/dev-reviewer-v1.js";
+/** Default start template — resolved through the workflow registry (NOT-70). */
+export const WORKFLOW_VERSION = getWorkflow(DEV_REVIEWER_V1_VERSION).version;
 /** NOT-103 queue admission reads the same cap state as the coordinator deferral path. */
 export { runtimeAvailability } from "../repository/runtime-availability.js";
 /**
@@ -165,7 +168,8 @@ export function startWorkflowCore(issueId) {
     }
     // Criteria were added since a pre-start gate opened — close it in the same txn as start.
     clearStaleProductScopeDecision(issue);
-    const instance = startWorkflowInstance(issueId, WORKFLOW_VERSION);
+    const template = getWorkflow(WORKFLOW_VERSION);
+    const instance = startWorkflowInstance(issueId, template.version);
     freezeTaskSnapshot(issue);
     appendWorkflowEvent({
         issueId,

package/bundle/server/dist/coordinator/developer-effect.js

@@ -41,6 +41,48 @@ import { reasonForDirtyWorktree, reasonForSessionCrash } from "./failure-reason.
 import { emitSessionMilestone, setLiveIntent, shortWorktreePath, startActivitySampler, taskBriefIsComplete, } from "./session-progress.js";
 import { VERIFICATION_RECEIPT_KIND, extractVerificationReceiptFromLog, parseVerificationReceipt, receiptForCurrentHead, receiptSupersededByFailedChecks, shouldCarryVerificationReceipt, } from "./verification-receipt.js";
 const num = (name, dflt) => Number(process.env[name] ?? dflt);
+/**
+ * NOT-147: attach commits-ahead + worktree/log pointers on timeout/crash so routing can
+ * escalate empty tips instead of burning another full spawn. Prefers counting from the
+ * worktree HEAD while it still exists; falls back to inspecting the issue branch ref.
+ * Only sets `commitsAhead` when progress is known (`empty` → 0, or a positive ahead count).
+ * `absent` / unresolvable git stays omitted so routing keeps the budget-only path.
+ */
+async function crashOrTimeoutOutcome(opts) {
+    let commitsAheadKnown = opts.commitsAhead;
+    if (commitsAheadKnown === undefined) {
+        const fromWorktree = await commitsAhead({
+            worktreePath: opts.worktreePath,
+            baseRef: `origin/${opts.baseBranch}`,
+        }).catch(() => null);
+        if (fromWorktree !== null) {
+            commitsAheadKnown = fromWorktree;
+        }
+        else {
+            const progress = await inspectBranchProgress({
+                repo: opts.repoPath,
+                branch: opts.branchName,
+                baseRefs: baseRefCandidates({
+                    baseSha: opts.baseSha ?? null,
+                    baseBranch: opts.baseBranch,
+                }),
+            });
+            if (progress.state === "empty")
+                commitsAheadKnown = 0;
+            else if (progress.state === "unpushed" || progress.state === "published") {
+                commitsAheadKnown = progress.ahead;
+            }
+            // absent → leave undefined (unknown)
+        }
+    }
+    return {
+        kind: opts.timedOut ? "timed_out" : "session_failed",
+        reason: opts.reason,
+        ...(commitsAheadKnown !== undefined ? { commitsAhead: commitsAheadKnown } : {}),
+        worktreePath: opts.worktreePath,
+        ...(opts.logPath ? { logPath: opts.logPath } : {}),
+    };
+}
 export const developerEffectConfig = {
     get sessionTimeoutMs() {
         return developerSessionTimeoutMs();
@@ -714,6 +756,24 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                 const salvageKind = spawned.timedOut ? "timeout" : "crash";
                 const salvaged = await salvageDirtyWorktree(worktreePath, salvageKind);
                 if (salvaged.ok) {
+                    // Measure progress while the worktree still exists (same rule as the clean
+                    // timeout/crash path below), then remove. Salvage always lands ≥1 tip commit.
+                    const crashReason = reasonForSessionCrash({
+                        timedOut: Boolean(spawned.timedOut),
+                        logPath: spawned.logPath,
+                        runtime,
+                    });
+                    const salvageNote = `Salvaged uncommitted work as ${salvaged.message} (${salvaged.commitSha.slice(0, 7)}).`;
+                    const crashOutcome = await crashOrTimeoutOutcome({
+                        timedOut: Boolean(spawned.timedOut),
+                        reason: `${crashReason} ${salvageNote}`,
+                        worktreePath,
+                        logPath: spawned.logPath,
+                        repoPath,
+                        branchName,
+                        baseBranch,
+                        baseSha: issue.baseSha,
+                    });
                     // Lens (NOT-145 class post-salvage-remove-unchecked): only route infra retry when
                     // the checkout is actually gone. If remove preserves (or throws), escalate with
                     // path+recovery instead of retrying into a branch still held by a leftover tree.
@@ -739,15 +799,7 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                             recoveryCommands: dirtyWorktreeRecoveryCommands(repoPath, worktreePath),
                         };
                     }
-                    const crashReason = reasonForSessionCrash({
-                        timedOut: Boolean(spawned.timedOut),
-                        logPath: spawned.logPath,
-                        runtime,
-                    });
-                    const salvageNote = `Salvaged uncommitted work as ${salvaged.message} (${salvaged.commitSha.slice(0, 7)}).`;
-                    return spawned.timedOut
-                        ? { kind: "timed_out", reason: `${crashReason} ${salvageNote}` }
-                        : { kind: "session_failed", reason: `${crashReason} ${salvageNote}` };
+                    return crashOutcome;
                 }
                 // Salvage failed — do not remove. Escalate with actionable recovery.
                 const dirtyReason = reasonForDirtyWorktree(spawned.logPath, runtime);
@@ -758,10 +810,22 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                     recoveryCommands: dirtyWorktreeRecoveryCommands(repoPath, worktreePath),
                 };
             }
+            const crashOutcome = await crashOrTimeoutOutcome({
+                timedOut: Boolean(spawned.timedOut),
+                reason: reasonForSessionCrash({
+                    timedOut: Boolean(spawned.timedOut),
+                    logPath: spawned.logPath,
+                    runtime,
+                }),
+                worktreePath,
+                logPath: spawned.logPath,
+                repoPath,
+                branchName,
+                baseBranch,
+                baseSha: issue.baseSha,
+            });
             await bestEffortRemove(repoPath, worktreePath);
-            return spawned.timedOut
-                ? { kind: "timed_out", reason: reasonForSessionCrash({ timedOut: true, logPath: spawned.logPath, runtime }) }
-                : { kind: "session_failed", reason: reasonForSessionCrash({ timedOut: false, logPath: spawned.logPath, runtime }) };
+            return crashOutcome;
         }
         // Persisted as soon as the session itself completes — a review round found these
         // dropped on any later verification failure (checks failing, a gh error), even though

package/bundle/server/dist/coordinator/developer-effect.test.js

@@ -183,6 +183,8 @@ test("clean handoff: real worktree, real push, fake GitHub — issue moves to re
     assert.ok(kinds.includes("implementation_conclusion"));
     assert.ok(kinds.includes("developer_transcript"));
     assert.ok(kinds.includes("checks_evidence"));
+    // NOT-146: clean handoff is commits + publish — not gated on a full-suite / Lens receipt.
+    assert.ok(!kinds.includes("verification_receipt"), "NOT-146: handoff must succeed without a full-suite verification receipt");
     assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer" && i.status === "pending").length, 1);
     const usage = listUsageEventsForIssue(issueId);
     assert.equal(usage.length, 1);
@@ -411,6 +413,24 @@ test("timed_out (session): the spawn wall-clock timeout is reported distinctly f
     const dev = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
     assert.equal(dev.status, "timed_out");
 });
+test("NOT-147: empty tip + 2 session timeouts escalates to human — no third spawn", async () => {
+    const issueId = await makeIssue();
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: timedOutSpawn, github: fakeGithub() }));
+    startWorkflow(issueId);
+    await pump(1); // failure #1 → auto-retry
+    assert.equal(getIssue(issueId).status, "developing");
+    assert.equal(getIssue(issueId).infraAttempts, 1);
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "developer" && i.status === "pending").length, 1);
+    await pump(1); // failure #2 with still-empty tip → policy_escalation
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "needs_human");
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "developer" && i.status === "pending").length, 0, "must not enqueue a third hour-long spawn");
+    const { listHumanActionsForIssue } = await import("../repository/human-actions.js");
+    const action = listHumanActionsForIssue(issueId).find((a) => a.status === "open");
+    assert.ok(action);
+    assert.equal(action.actionType, "policy_escalation");
+    assert.match(action.reason, /stuck: no commits after 2 timeouts\/crashes/i);
+});
 test("checks_failed: CI failure after a clean push/PR retries without a human action", async () => {
     const issueId = await makeIssue();
     registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: commitingSpawn, github: fakeGithub({ checks: "failure" }) }));

package/bundle/server/dist/coordinator/projection.test.js

@@ -119,3 +119,29 @@ test("infra-class retries — including a stale re-review — spend the infra bu
     const stale = projectReviewerRoute(routeReviewerOutcome({ kind: "stale", currentHeadSha: "new" }, REVIEW_ROUNDS_LEFT, PINNED_HEAD), 1, false);
     assert.equal(stale.advance, "infra");
 });
+test("NOT-147: empty-tip no-progress escalation projects to needs_human without spending infra budget", () => {
+    const INFRA_ATTEMPTS_LEFT = {
+        currentRound: 1,
+        maxReviewRounds: 3,
+        infraAttempts: 1,
+        maxInfraAttempts: 3,
+    };
+    const route = routeDeveloperOutcome({
+        kind: "timed_out",
+        commitsAhead: 0,
+        reason: "Developer session timed out.",
+        worktreePath: "/data/worktrees/s-dev-developer",
+        logPath: "/data/logs/s-dev.log",
+    }, INFRA_ATTEMPTS_LEFT);
+    assert.equal(route.next, "human_action");
+    const { projection, effect, advance } = projectDeveloperRoute(route, "developing", 1);
+    assert.equal(projection.issueStatus, "needs_human");
+    assert.equal(projection.currentOwner, "human");
+    assert.equal(advance, "none", "escalation must not burn another infra attempt");
+    assert.equal(effect.kind, "human_action");
+    if (effect.kind === "human_action") {
+        assert.equal(effect.actionType, "policy_escalation");
+        assert.match(effect.reason, /stuck: no commits after 2 timeouts\/crashes/i);
+    }
+    assertLegal("developing", projection.issueStatus);
+});

package/bundle/server/dist/coordinator/prompts.js

@@ -68,7 +68,10 @@ export function buildDeveloperPrompt(input) {
     parts.push(`## Required`, 
     // NOT-115: encourage incremental commits so a mid-session death leaves less
     // uncommitted work for dirty_worktree escalation — soft mitigation only.
-    `Run tests and Lens checks. Make incremental commits with \`git\` at coherent slice boundaries (for example after the tests for that slice pass) — do not leave all work uncommitted until the very end. A final commit of any remaining changes and the **implementation conclusion** remain required before you exit.`, `Commit any remaining changes with \`git\` — do NOT push and do NOT open a pull request; the coordinator pushes your branch and opens/updates the draft PR after this session ends.`, `End your reply with a short **implementation conclusion**: what changed, why, any deviations from the acceptance criteria, and known follow-ups. This is distinct from the PR description and is required every round.`);
+    // NOT-146: timed-spawn handoff bar is commits + targeted tests for the change.
+    // Full suite / Lens run on a separate verify/review budget (NOT-74) — they do not
+    // gate developer clean_handoff; the coordinator does not block on full-suite alone.
+    `Run targeted tests for the change. A clean handoff is valid with commits plus those targeted tests — full suite / Lens checks are not required inside this timed developer spawn (they run on a separate review/verify budget). Make incremental commits with \`git\` at coherent slice boundaries (for example after the tests for that slice pass) — do not leave all work uncommitted until the very end. A final commit of any remaining changes and the **implementation conclusion** remain required before you exit.`, `Commit any remaining changes with \`git\` — do NOT push and do NOT open a pull request; the coordinator pushes your branch and opens/updates the draft PR after this session ends.`, `End your reply with a short **implementation conclusion**: what changed, why, any deviations from the acceptance criteria, and known follow-ups. This is distinct from the PR description and is required every round.`);
     return parts.join("\n");
 }
 const REVIEWER_RESULT_SHAPE = '{"verdict":"approved"|"changes_requested"|"escalated","baseSha":"...","headSha":"...","acceptanceCriteriaAssessment":"...","evidenceAssessment":"...","findings":[{"fingerprint":"stable-slug","severity":"blocking"|"non_blocking","title":"...","rationale":"...","file":"...","line":0}],"risks":["..."],"productScopeQuestion":"..."}';

package/bundle/server/dist/coordinator/prompts.test.js

@@ -25,6 +25,18 @@ test("developer prompt asks for incremental commits at slice boundaries and keep
     assert.match(prompt, /implementation conclusion/i);
     assert.match(prompt, /do NOT push and do NOT open a pull request/);
 });
+// NOT-146: timed developer spawn covers implement + targeted tests; full suite / Lens
+// live on a separate budget (NOT-74), not inside the same wall clock.
+test("NOT-146: developer prompt handoff bar is commits + targeted tests, not full suite/Lens in-spawn", () => {
+    const prompt = buildDeveloperPrompt({ taskSnapshot, round: 1 });
+    assert.match(prompt, /targeted tests?/i);
+    assert.match(prompt, /handoff/i);
+    assert.match(prompt, /full suite/i);
+    assert.match(prompt, /[Ll]ens/);
+    // Must not still demand Lens inside the timed spawn as a hard Required step.
+    assert.doesNotMatch(prompt, /^Run tests and Lens checks\./m);
+    assert.match(prompt, /do NOT push and do NOT open a pull request/);
+});
 test("repair round includes findings and references the round number", () => {
     const prompt = buildDeveloperPrompt({
         taskSnapshot,

package/bundle/server/dist/coordinator/routing.js

@@ -1,5 +1,7 @@
 // packages/server/src/coordinator/routing.ts
 import { normalizeReviewerResult } from "./reviewer-result.js";
+/** Default N for NOT-147: escalate empty-tip timeout/crash after this many failures (one auto-retry). */
+export const DEFAULT_NO_PROGRESS_INFRA_ATTEMPTS = 2;
 function roundsRemain(limits) {
     return limits.currentRound < limits.maxReviewRounds;
 }
@@ -78,8 +80,6 @@ export function routeDeveloperOutcome(outcome, limits) {
                 : { next: "human_action", actionType: "policy_escalation", reason: `${reason} (infra-attempt limit reached).` };
         }
         case "no_pr":
-        case "session_failed":
-        case "timed_out":
         case "checks_failed":
         case "deck_failure": {
             // Unified infra-failure policy: the session/environment failed to produce a
@@ -90,6 +90,23 @@ export function routeDeveloperOutcome(outcome, limits) {
                 ? { next: "retry_developer", reason }
                 : { next: "human_action", actionType: "policy_escalation", reason: `${reason} (infra-attempt limit reached).` };
         }
+        case "session_failed":
+        case "timed_out": {
+            // Same infra budget as above, plus NOT-147: empty tip after N timeout/crashes → human
+            // gate so we do not burn attempts 3–4 on a branch that never moved.
+            const reason = infraFailureReason(outcome);
+            if (!infraAttemptsRemain(limits)) {
+                return {
+                    next: "human_action",
+                    actionType: "policy_escalation",
+                    reason: `${reason} (infra-attempt limit reached).`,
+                };
+            }
+            const noProgressGate = emptyTipNoProgressGate(outcome, limits, reason);
+            if (noProgressGate)
+                return noProgressGate;
+            return { next: "retry_developer", reason };
+        }
         case "usage_capped":
             return { next: "defer_work", until: outcome.until, reason: outcome.reason };
         case "deck_unavailable":
@@ -114,6 +131,30 @@ function infraFailureReason(outcome) {
             return `Agent Deck ${outcome.reason}`;
     }
 }
+/**
+ * NOT-147: when a timeout/crash left the branch with zero commits ahead of base, stop
+ * burning full agent spawns after N failures (default 2 = one auto-retry). Only trips when
+ * `commitsAhead` is explicitly known to be 0 — missing progress keeps the budget-only path.
+ */
+function emptyTipNoProgressGate(outcome, limits, lastFailureReason) {
+    if (outcome.commitsAhead !== 0)
+        return null;
+    const n = limits.noProgressInfraAttempts ?? DEFAULT_NO_PROGRESS_INFRA_ATTEMPTS;
+    // infraAttempts = retries already spent; +1 includes the failure being routed.
+    const failuresIncludingCurrent = limits.infraAttempts + 1;
+    if (failuresIncludingCurrent < n)
+        return null;
+    const pointers = [
+        outcome.worktreePath ? `worktree: ${outcome.worktreePath}` : null,
+        outcome.logPath ? `log: ${outcome.logPath}` : null,
+    ].filter((p) => p != null);
+    const pointerSuffix = pointers.length > 0 ? ` ${pointers.join("; ")}.` : "";
+    return {
+        next: "human_action",
+        actionType: "policy_escalation",
+        reason: `stuck: no commits after ${n} timeouts/crashes. Last failure: ${lastFailureReason}.${pointerSuffix}`,
+    };
+}
 export function routeReviewerOutcome(outcome, limits, pinnedHeadSha) {
     switch (outcome.kind) {
         case "stale":