agent-dealer 1.2.4 → 1.2.6

package/bundle/server/dist/coordinator/developer-effect.test.js

@@ -109,11 +109,6 @@ const commitingSpawn = async (input) => {
 };
 /** Never touches the worktree — nothing to push, the no_pr outcome. */
 const noopSpawn = async () => ({ exitCode: 0, transcript: "", logPath: "/dev/null", timedOut: false });
-/** Leaves an untracked file uncommitted — the dirty_worktree outcome. */
-const dirtySpawn = async (input) => {
-    fs.writeFileSync(path.join(input.cwd, "scratch.txt"), "oops\n");
-    return { exitCode: 0, transcript: "", logPath: "/dev/null", timedOut: false };
-};
 const crashingSpawn = async () => ({ exitCode: 1, transcript: "boom", logPath: "/dev/null", timedOut: false });
 const timedOutSpawn = async () => ({ exitCode: 1, transcript: "", logPath: "/dev/null", timedOut: true });
 /**
@@ -253,9 +248,23 @@ test("the branch created on a retried round is reused, not re-created — no 'br
     assert.match(prompts[1], /\*\*Last failure:\*\* Developer session produced no PR\./);
     assert.doesNotMatch(prompts[1], /fresh branch/);
 });
-test("dirty_worktree: an uncommitted file escalates without consuming a round", async () => {
+test("dirty_worktree: an uncommitted file whose salvage commit fails escalates without consuming a round", async () => {
+    // NOT-275: a clean exit (exitCode 0) that leaves the worktree dirty is salvaged
+    // first — escalation only happens when the salvage commit itself fails. Force
+    // that failure with a rejecting pre-commit hook (same technique as the NOT-145
+    // salvage-failure test).
     const issueId = await makeIssue();
-    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: dirtySpawn, github: fakeGithub() }));
+    const salvageBlockedSpawn = async (input) => {
+        fs.writeFileSync(path.join(input.cwd, "scratch.txt"), "oops\n");
+        const common = git(input.cwd, "rev-parse", "--git-common-dir");
+        const hooks = path.isAbsolute(common) ? path.join(common, "hooks") : path.join(input.cwd, common, "hooks");
+        fs.mkdirSync(hooks, { recursive: true });
+        const hookPath = path.join(hooks, "pre-commit");
+        fs.writeFileSync(hookPath, "#!/bin/sh\necho salvage-blocked >&2\nexit 1\n");
+        fs.chmodSync(hookPath, 0o755);
+        return { exitCode: 0, transcript: "", logPath: "/dev/null", timedOut: false };
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: salvageBlockedSpawn, github: fakeGithub() }));
     startWorkflow(issueId);
     await pump(1);
     const issue = getIssue(issueId);
@@ -263,9 +272,90 @@ test("dirty_worktree: an uncommitted file escalates without consuming a round",
     assert.equal(issue.currentRound, 1, "dirty worktree never consumes a round");
     const action = listHumanActionsForIssue(issueId).find((a) => a.actionType === "policy_escalation");
     assert.ok(action, "expected a policy_escalation human action");
-    // NOT-145 / NOT-137: exit-0 dirty escalations carry path + recovery like worktree_conflict.
+    assert.match(action.reason, /Auto-commit salvage failed|salvage-blocked/i);
+    // NOT-145 / NOT-137: dirty escalations carry path + recovery like worktree_conflict.
     assert.match(action.reason, /Recovery:/);
     assert.match(action.reason, /git status/);
+    // Cleanup hook so later tests in this file aren't poisoned (worktrees share
+    // .git/hooks via the common dir).
+    const round1 = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
+    const leftover = roleWorktreePath(repo, round1.id, "developer");
+    assert.ok(fs.existsSync(path.join(leftover, "scratch.txt")), "failed salvage must not wipe WIP");
+    const common = git(repo, "rev-parse", "--git-common-dir");
+    const hooks = path.isAbsolute(common) ? path.join(common, "hooks") : path.join(repo, common, "hooks");
+    fs.rmSync(path.join(hooks, "pre-commit"), { force: true });
+    fs.rmSync(leftover, { recursive: true, force: true });
+    await withRepoLock(repo, async () => execFileSync("git", ["worktree", "prune"], { cwd: repo }));
+});
+test("NOT-275: a clean exit that leaves tracked + untracked changes salvages a checkpoint and proceeds to push/PR", async () => {
+    // The session exits 0 (not timed out, no usage cap) but never ran `git commit`.
+    // The effect must auto-commit the WIP as a salvage checkpoint on the issue
+    // branch and continue exactly as if the agent had committed the work itself —
+    // it must NOT return kind: "dirty_worktree".
+    const issueId = await makeIssue();
+    const cleanExitDirtySpawn = async (input) => {
+        fs.appendFileSync(path.join(input.cwd, "README.md"), "more docs\n");
+        fs.writeFileSync(path.join(input.cwd, "feature.txt"), "implemented\n");
+        return { exitCode: 0, transcript: "Implementation conclusion: added the widget.", logPath: "/dev/null", timedOut: false };
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: cleanExitDirtySpawn, github: fakeGithub() }));
+    startWorkflow(issueId);
+    await pump(1);
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "reviewing", "salvaged clean-exit work proceeds to push/PR like a self-committed session");
+    assert.equal(issue.currentRound, 1);
+    assert.ok(issue.headSha, "push happened — head SHA recorded");
+    assert.ok(issue.prNumber, "draft PR opened");
+    assert.equal(git(repo, "ls-remote", "origin", `refs/heads/${issue.branch}`).length > 0, true);
+    const branch = issueBranchName(issueId);
+    assert.equal(git(repo, "log", "-1", "--pretty=%s", branch), "wip: crash salvage");
+    assert.ok(git(repo, "show", `${branch}:feature.txt`).includes("implemented"), "untracked WIP is in the salvage tip");
+    assert.ok(git(repo, "show", `${branch}:README.md`).includes("more docs"), "tracked WIP is in the salvage tip");
+    const dev = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
+    assert.equal(dev.status, "done");
+    assert.ok(!listHumanActionsForIssue(issueId).find((a) => a.actionType === "policy_escalation"), "no dirty_worktree escalation");
+    // Deliverable 1: the salvage path emits the commit checkpoint evidence event.
+    const salvageCommits = listWorkflowEventsForIssue(issueId)
+        .filter((e) => e.type === "checkpoint.observed")
+        .map((e) => JSON.parse(e.payloadJson))
+        .filter((p) => p.kind === "commit" && p.origin === "salvage");
+    assert.equal(salvageCommits.length, 1, "salvage emits exactly one salvage-origin commit checkpoint");
+    assert.equal(salvageCommits[0].observedSha, issue.headSha, "the checkpoint vouches for the salvaged tip");
+});
+test("NOT-275: a clean exit with dirty worktree still returns dirty_worktree when the salvage commit itself fails", async () => {
+    const issueId = await makeIssue();
+    const failingSalvageSpawn = async (input) => {
+        fs.appendFileSync(path.join(input.cwd, "README.md"), "more docs\n");
+        fs.writeFileSync(path.join(input.cwd, "feature.txt"), "implemented\n");
+        // Reject the coordinator's salvage commit so we exercise the escalate-and-preserve path.
+        const common = git(input.cwd, "rev-parse", "--git-common-dir");
+        const hooks = path.isAbsolute(common) ? path.join(common, "hooks") : path.join(input.cwd, common, "hooks");
+        fs.mkdirSync(hooks, { recursive: true });
+        const hookPath = path.join(hooks, "pre-commit");
+        fs.writeFileSync(hookPath, "#!/bin/sh\necho salvage-blocked >&2\nexit 1\n");
+        fs.chmodSync(hookPath, 0o755);
+        return { exitCode: 0, transcript: "", logPath: "/dev/null", timedOut: false };
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: failingSalvageSpawn, github: fakeGithub() }));
+    startWorkflow(issueId);
+    await pump(1);
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "needs_human");
+    assert.equal(issue.currentRound, 1, "dirty worktree never consumes a round");
+    const action = listHumanActionsForIssue(issueId).find((a) => a.actionType === "policy_escalation");
+    assert.ok(action, "expected a policy_escalation human action");
+    assert.match(action.reason, /Auto-commit salvage failed|salvage-blocked/i);
+    assert.match(action.reason, /Recovery:/);
+    assert.match(action.reason, /git status/);
+    const round1 = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
+    const leftover = roleWorktreePath(repo, round1.id, "developer");
+    assert.ok(fs.existsSync(path.join(leftover, "feature.txt")), "failed salvage must not wipe WIP");
+    // Cleanup hook so later tests in this file aren't poisoned.
+    const common = git(repo, "rev-parse", "--git-common-dir");
+    const hooks = path.isAbsolute(common) ? path.join(common, "hooks") : path.join(repo, common, "hooks");
+    fs.rmSync(path.join(hooks, "pre-commit"), { force: true });
+    fs.rmSync(leftover, { recursive: true, force: true });
+    await withRepoLock(repo, async () => execFileSync("git", ["worktree", "prune"], { cwd: repo }));
 });
 test("session_failed: the agent process exits non-zero — retried like no_pr", async () => {
     const issueId = await makeIssue();
@@ -924,16 +1014,28 @@ test("NOT-88: a leftover clean worktree from a resolved unpushed_commit escalati
 });
 test("NOT-88: a leftover dirty worktree escalates as an actionable worktree_conflict on every Resume — no infra budget burned, no opaque crash loop", async () => {
     const issueId = await makeIssue();
-    // Round 1 exits 0 but leaves the worktree dirty — dirty_worktree escalation preserves the
-    // checkout (NOT-145 salvage applies only to timeout/crash infra deaths). That leftover is
+    // Round 1 exits 0 but leaves the worktree dirty with salvage blocked (NOT-275
+    // salvages clean-exit dirt first, so a rejecting pre-commit hook forces the
+    // dirty_worktree escalation that preserves the checkout). That leftover is
     // the setup NOT-88's collision needs: round 2 must find that SAME dirty leftover still
     // holding the branch.
-    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: dirtySpawn, github: fakeGithub() }));
+    const salvageBlockedDirtySpawn = async (input) => {
+        fs.writeFileSync(path.join(input.cwd, "scratch.txt"), "oops\n");
+        const common = git(input.cwd, "rev-parse", "--git-common-dir");
+        const hooks = path.isAbsolute(common) ? path.join(common, "hooks") : path.join(input.cwd, common, "hooks");
+        fs.mkdirSync(hooks, { recursive: true });
+        const hookPath = path.join(hooks, "pre-commit");
+        fs.writeFileSync(hookPath, "#!/bin/sh\necho salvage-blocked >&2\nexit 1\n");
+        fs.chmodSync(hookPath, 0o755);
+        return { exitCode: 0, transcript: "", logPath: "/dev/null", timedOut: false };
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: salvageBlockedDirtySpawn, github: fakeGithub() }));
     startWorkflow(issueId);
     await pump(1);
     const round1Session = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
     const leftoverPath = roleWorktreePath(repo, round1Session.id, "developer");
     assert.ok(fs.existsSync(path.join(leftoverPath, "scratch.txt")), "the dirty leftover must be preserved");
+    const statusBeforeResume = git(leftoverPath, "status", "--porcelain");
     const firstAction = listHumanActionsForIssue(issueId).find((a) => a.actionType === "policy_escalation" && a.status === "open");
     assert.ok(firstAction);
     // Resume without actually cleaning the leftover: must re-detect the same conflict and
@@ -950,9 +1052,183 @@ test("NOT-88: a leftover dirty worktree escalates as an actionable worktree_conf
     assert.ok(secondAction, "a fresh, actionable escalation — not silence and not a crash");
     assert.match(secondAction.reason, /uncommitted changes/);
     assert.match(secondAction.reason, new RegExp(leftoverPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
+    // NOT-280: the dead predecessor's dirt was salvage-attempted; the escalation names the
+    // actual git failure, and the checkout is left exactly as found.
+    assert.match(secondAction.reason, /Automatic salvage/);
+    assert.match(secondAction.reason, /git .*commit .*failed: .*salvage-blocked/s);
+    assert.equal(git(leftoverPath, "status", "--porcelain"), statusBeforeResume, "index and files left as found");
+    // NOT-280: a second Resume with nothing changed lands on the SAME action — reopened,
+    // never an identical copy.
+    resolveHumanActionAndAdvance(secondAction.id, "test", "resume");
+    await pump(1);
+    assert.equal(getIssue(issueId).status, "needs_human");
+    const afterRepeat = listHumanActionsForIssue(issueId);
+    assert.equal(afterRepeat.length, 2, "no duplicate action for an unchanged blocker");
+    const reopened = afterRepeat.find((a) => a.id === secondAction.id);
+    assert.equal(reopened.status, "open");
+    // Cleanup the salvage-blocking hook too (worktrees share .git/hooks via the
+    // common dir — leaving it would reject commits in every later test).
+    const commonDir = git(repo, "rev-parse", "--git-common-dir");
+    const hooksDir = path.isAbsolute(commonDir) ? path.join(commonDir, "hooks") : path.join(repo, commonDir, "hooks");
+    fs.rmSync(path.join(hooksDir, "pre-commit"), { force: true });
     fs.rmSync(leftoverPath, { recursive: true, force: true });
     await withRepoLock(repo, async () => execFileSync("git", ["worktree", "prune"], { cwd: repo }));
 });
+test("NOT-280: Resume salvages a dead predecessor's dirty managed checkout once, records one checkpoint, and continues from that tip — no worktree_conflict", async () => {
+    const issueId = await makeIssue();
+    const branch = issueBranchName(issueId);
+    const commonDir = git(repo, "rev-parse", "--git-common-dir");
+    const hooksDir = path.isAbsolute(commonDir) ? path.join(commonDir, "hooks") : path.join(repo, commonDir, "hooks");
+    // Round 1 = the older backend: ticket-scoped edits (tracked + untracked), no commit, and
+    // its own session-end salvage blocked — so the dirty checkout is preserved.
+    let call = 0;
+    const heads = [];
+    const spawn = async (input) => {
+        call++;
+        if (call === 1) {
+            fs.appendFileSync(path.join(input.cwd, "README.md"), "ticket edit\n");
+            fs.writeFileSync(path.join(input.cwd, "widget.txt"), "widget\n");
+            fs.mkdirSync(hooksDir, { recursive: true });
+            fs.writeFileSync(path.join(hooksDir, "pre-commit"), "#!/bin/sh\necho blocked >&2\nexit 1\n", { mode: 0o755 });
+            return { exitCode: 0, transcript: "", logPath: "/dev/null", timedOut: false };
+        }
+        heads.push(git(input.cwd, "rev-parse", "HEAD"));
+        return noopSpawn(input);
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn, github: fakeGithub() }));
+    startWorkflow(issueId);
+    await pump(1);
+    assert.equal(getIssue(issueId).status, "needs_human");
+    const round1 = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
+    const leftoverPath = roleWorktreePath(repo, round1.id, "developer");
+    const tipBefore = git(leftoverPath, "rev-parse", "HEAD");
+    // The hook is gone now (the environment that blocked the old backend changed); the
+    // dirty checkout still holds the branch. Resume must salvage it — not escalate.
+    fs.rmSync(path.join(hooksDir, "pre-commit"), { force: true });
+    const firstAction = listHumanActionsForIssue(issueId).find((a) => a.status === "open");
+    resolveHumanActionAndAdvance(firstAction.id, "test", "resume");
+    await pump(1);
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "reviewing", "the pending attempt continued from the saved tip and handed off");
+    assert.equal(issue.currentRound, 1, "no review round spent");
+    const actions = listHumanActionsForIssue(issueId);
+    assert.equal(actions.length, 1, "no worktree_conflict human action");
+    // Exactly one salvage commit carrying both changes, and the attempt started on it.
+    const salvageSha = heads[0];
+    assert.equal(git(repo, "rev-list", "--count", `${tipBefore}..${salvageSha}`), "1");
+    assert.equal(git(repo, "log", "-1", "--format=%s", salvageSha), "wip: resume salvage");
+    assert.deepEqual(git(repo, "show", "--name-only", "--format=", salvageSha).split("\n").sort(), ["README.md", "widget.txt"]);
+    assert.equal(git(remote, "rev-parse", branch), salvageSha, "the salvaged tip is what was published");
+    const checkpoints = listWorkflowEventsForIssue(issueId).filter((e) => {
+        if (e.type !== "checkpoint.observed")
+            return false;
+        const p = JSON.parse(e.payloadJson ?? "{}");
+        return p.origin === "salvage" && p.observedSha === salvageSha;
+    });
+    assert.equal(checkpoints.length, 1, "one durable salvage checkpoint");
+    assert.equal(checkpoints[0].workerSessionId, round1.id, "tied to the predecessor session");
+});
+test("NOT-280: a salvage checkpoint that cannot be persisted blocks before spawning, keeps the checkout, and never duplicates its action", async () => {
+    const issueId = await makeIssue();
+    const commonDir = git(repo, "rev-parse", "--git-common-dir");
+    const hooksDir = path.isAbsolute(commonDir) ? path.join(commonDir, "hooks") : path.join(repo, commonDir, "hooks");
+    let call = 0;
+    const heads = [];
+    const spawn = async (input) => {
+        call++;
+        if (call === 1) {
+            fs.writeFileSync(path.join(input.cwd, "persist.txt"), "ticket work\n");
+            fs.mkdirSync(hooksDir, { recursive: true });
+            fs.writeFileSync(path.join(hooksDir, "pre-commit"), "#!/bin/sh\necho blocked >&2\nexit 1\n", { mode: 0o755 });
+            return { exitCode: 0, transcript: "", logPath: "/dev/null", timedOut: false };
+        }
+        heads.push(git(input.cwd, "rev-parse", "HEAD"));
+        return noopSpawn(input);
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn, github: fakeGithub() }));
+    startWorkflow(issueId);
+    await pump(1);
+    const round1 = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
+    const leftoverPath = roleWorktreePath(repo, round1.id, "developer");
+    const tipBefore = git(leftoverPath, "rev-parse", "HEAD");
+    fs.rmSync(path.join(hooksDir, "pre-commit"), { force: true });
+    // The Dealer database rejects the resume-salvage checkpoint row.
+    getDb().exec(`CREATE TRIGGER not280_block_salvage_checkpoint BEFORE INSERT ON workflow_events
+    WHEN NEW.idempotency_key LIKE 'checkpoint:resume-salvage:%'
+    BEGIN SELECT RAISE(ABORT, 'checkpoint store unavailable'); END`);
+    try {
+        const firstAction = listHumanActionsForIssue(issueId).find((a) => a.status === "open");
+        resolveHumanActionAndAdvance(firstAction.id, "test", "resume");
+        await pump(1);
+        assert.equal(getIssue(issueId).status, "needs_human", "no attempt proceeds without its durable checkpoint");
+        assert.equal(heads.length, 0, "nothing spawned");
+        const blocker = listHumanActionsForIssue(issueId).find((a) => a.status === "open");
+        assert.match(blocker.reason, /durable checkpoint could not be recorded/);
+        assert.match(blocker.reason, /checkpoint store unavailable/);
+        assert.ok(blocker.reason.includes(leftoverPath));
+        const salvageSha = git(leftoverPath, "rev-parse", "HEAD");
+        assert.equal(git(repo, "rev-list", "--count", `${tipBefore}..${salvageSha}`), "1", "the salvage commit is kept");
+        assert.equal(git(leftoverPath, "status", "--porcelain"), "", "checkout left intact on its salvage tip");
+        // Unchanged blocker: Resume reuses the same action, and never re-commits.
+        const countBefore = listHumanActionsForIssue(issueId).length;
+        resolveHumanActionAndAdvance(blocker.id, "test", "resume");
+        await pump(1);
+        assert.equal(listHumanActionsForIssue(issueId).length, countBefore, "no duplicate action");
+        assert.equal(git(leftoverPath, "rev-parse", "HEAD"), salvageSha, "no duplicate commit");
+        // Store fixed: the next Resume records the checkpoint and continues from the saved tip.
+        getDb().exec("DROP TRIGGER not280_block_salvage_checkpoint");
+        const reopened = listHumanActionsForIssue(issueId).find((a) => a.status === "open");
+        resolveHumanActionAndAdvance(reopened.id, "test", "resume");
+        await pump(1);
+        assert.equal(getIssue(issueId).status, "reviewing");
+        assert.equal(heads[0], salvageSha);
+        const checkpoints = listWorkflowEventsForIssue(issueId).filter((e) => {
+            if (e.type !== "checkpoint.observed")
+                return false;
+            const p = JSON.parse(e.payloadJson ?? "{}");
+            return p.origin === "salvage" && p.observedSha === salvageSha;
+        });
+        assert.equal(checkpoints.length, 1, "exactly one durable salvage checkpoint once the store recovers");
+        assert.equal(checkpoints[0].workerSessionId, round1.id);
+    }
+    finally {
+        getDb().exec("DROP TRIGGER IF EXISTS not280_block_salvage_checkpoint");
+    }
+});
+test("NOT-280: a restart after the salvage commit (before cleanup) detects the saved tip — no duplicate commit or checkpoint", async () => {
+    const issueId = await makeIssue();
+    const branch = issueBranchName(issueId);
+    // A dead predecessor's checkout whose resume salvage already landed — the state a
+    // coordinator crash between the salvage commit and the attempt leaves behind.
+    git(repo, "branch", branch, "main");
+    const predecessor = createWorkerSession({
+        issueId,
+        role: "developer",
+        round: 1,
+        agentId: getIssue(issueId).developerAgentId,
+        runtime: "claude_code",
+    });
+    const leftoverPath = roleWorktreePath(repo, predecessor.id, "developer");
+    await withRepoLock(repo, async () => execFileSync("git", ["worktree", "add", "-q", leftoverPath, branch], { cwd: repo }));
+    fs.writeFileSync(path.join(leftoverPath, "saved.txt"), "work\n");
+    git(leftoverPath, "add", "-A");
+    git(leftoverPath, "-c", "user.email=agent-dealer@localhost", "-c", "user.name=Agent Dealer", "commit", "-q", "-m", "wip: resume salvage");
+    const salvageSha = git(leftoverPath, "rev-parse", "HEAD");
+    const heads = [];
+    const spawn = async (input) => {
+        heads.push(git(input.cwd, "rev-parse", "HEAD"));
+        return noopSpawn(input);
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn, github: fakeGithub() }));
+    startWorkflow(issueId);
+    await pump(1);
+    assert.equal(heads[0], salvageSha, "continued from the saved tip, not a new commit");
+    assert.equal(git(repo, "rev-parse", `refs/heads/${branch}`), salvageSha);
+    assert.equal(getIssue(issueId).status, "reviewing");
+    const checkpoints = listWorkflowEventsForIssue(issueId).filter((e) => e.type === "checkpoint.observed" && JSON.parse(e.payloadJson ?? "{}").origin === "salvage" && JSON.parse(e.payloadJson ?? "{}").observedSha === salvageSha);
+    assert.equal(checkpoints.length, 1);
+    assert.equal(checkpoints[0].workerSessionId, predecessor.id);
+});
 test("baseSha is resolved against the fetched base ref, not a stale local branch", async () => {
     // A review round found mergeBase used the local `main`, never fetched — if origin/main
     // had moved since this repo checkout last fetched, the recorded baseSha would be the
@@ -1650,7 +1926,10 @@ test("NOT-130: a green suite on a dirty worktree is not persisted as tip evidenc
     startWorkflow(issueId);
     await pump(1);
     assert.equal(listArtifactsForIssue(issueId).some((a) => a.kind === "verification_receipt"), false, "dirty tree must not mint a tip-scoped verification receipt");
-    assert.equal(getIssue(issueId).status, "needs_human");
+    // NOT-275: the post-suite dirt is salvaged and the handoff proceeds (the receipt
+    // check above stays the point of this test — the suite ran on a dirty tree, so
+    // no tip-scoped receipt may exist even after the salvaged push/PR).
+    assert.equal(getIssue(issueId).status, "reviewing");
 });
 test("NOT-130: checks_failed retry does not carry a prior green receipt into the prompt", async () => {
     const issueId = await makeIssue();

package/bundle/server/dist/coordinator/human-resolution.js

@@ -12,6 +12,8 @@ export const MERGE_FAILURE_RESPONSE_OPTIONS = [
 export const MERGE_FAILURE_EVIDENCE_KEY = "mergeFailure";
 /** Evidence key marking a policy_escalation as a NOT-221 diverged-push escalation. */
 export const PUSH_DIVERGENCE_EVIDENCE_KEY = "pushDivergence";
+/** NOT-280: evidence key holding a worktree blocker's `{ fingerprint }` for action dedupe. */
+export const WORKTREE_BLOCKER_EVIDENCE_KEY = "worktreeBlocker";
 /**
  * NOT-221: the stored response options for a diverged-push policy_escalation. The label
  * names the recovery so the dashboard button is self-explanatory next to the SHAs the
@@ -22,6 +24,31 @@ export const PUSH_DIVERGENCE_RESPONSE_OPTIONS = [
     { choice: "resume", label: "Resume development" },
     { choice: "close", label: "Close" },
 ];
+/**
+ * NOT-272: cap for the optional human note on a `product_scope_decision` resolution.
+ * Introduced here (no route-level text cap convention exists to mirror) — long enough
+ * for a real scope decision, short enough to fit verbatim in the next round's prompt.
+ */
+export const PRODUCT_SCOPE_NOTE_MAX_CHARS = 4000;
+/**
+ * NOT-272: normalizes the raw `note` body field of POST /api/human-actions/:id/resolve.
+ * Absent/blank is "no note" (today's behavior); a present non-string or an over-long
+ * string is a caller error. Scoping to `product_scope_decision` happens in
+ * `parseHumanResolution` / the resolve path — this only validates the shape.
+ */
+export function normalizeResolutionNote(note) {
+    if (note === undefined || note === null)
+        return { ok: true };
+    if (typeof note !== "string")
+        return { ok: false, error: "note must be a string" };
+    const trimmed = note.trim();
+    if (!trimmed)
+        return { ok: true };
+    if (trimmed.length > PRODUCT_SCOPE_NOTE_MAX_CHARS) {
+        return { ok: false, error: `note must be at most ${PRODUCT_SCOPE_NOTE_MAX_CHARS} characters` };
+    }
+    return { ok: true, note: trimmed };
+}
 /**
  * The only choices resolveHumanActionOutcome accepts per action type — the stored "response
  * options." `reflection_interaction_required` and `outbound_delivery_interaction_required`
@@ -58,7 +85,7 @@ const VALID_CHOICES = {
  * Run-scoped, has no Issue/workflow_instance to advance, and its only legal resolver is
  * `resolveOutboundDeliveryAction` (queue/approve-deliver.ts).
  */
-export function parseHumanResolution(actionType, choice) {
+export function parseHumanResolution(actionType, choice, note) {
     if (actionType === "reflection_interaction_required" || actionType === "outbound_delivery_interaction_required") {
         return null;
     }
@@ -66,6 +93,11 @@ export function parseHumanResolution(actionType, choice) {
         return null;
     if (!VALID_CHOICES[actionType].includes(choice))
         return null;
+    // NOT-272: `note` is declared only on the product_scope_decision variant — a note
+    // arriving with any other action type is dropped here, never stored or threaded.
+    if (actionType === "product_scope_decision" && note) {
+        return { actionType, choice, note };
+    }
     return { actionType, choice };
 }
 /**