agent-dealer 1.2.7 → 1.2.9

package/bundle/server/dist/coordinator/routing.test.js

@@ -4,6 +4,10 @@ import assert from "node:assert/strict";
 import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 const REVIEW_ROUNDS_LEFT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 0, maxInfraAttempts: 3 };
 const REVIEW_AT_LIMIT = { currentRound: 3, maxReviewRounds: 3, infraAttempts: 0, maxInfraAttempts: 3 };
+// NOT-313: CI-repair budget fixtures — infra counters stay at 0/3 throughout so
+// every CI test below also proves the infra budget is untouched, and vice versa.
+const CI_BUDGET_LEFT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 0, maxInfraAttempts: 3, ciAttempts: 1, maxCiAttempts: 3 };
+const CI_AT_LIMIT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 0, maxInfraAttempts: 3, ciAttempts: 3, maxCiAttempts: 3 };
 const INFRA_ATTEMPTS_LEFT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 1, maxInfraAttempts: 3 };
 const INFRA_AT_LIMIT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 3, maxInfraAttempts: 3 };
 const PINNED_HEAD = "pinned-head-sha";
@@ -181,6 +185,24 @@ test("a failed base fetch defers instead of spending an infra attempt (NOT-197)"
         });
     }
 });
+test("pending CI defers instead of spending an infra attempt (NOT-311)", () => {
+    const outcome = {
+        kind: "checks_pending",
+        reason: "Waiting for CI (running) - no attempt spent",
+        branch: "issue-1",
+        prNumber: 7,
+        headSha: "abc123",
+        waitStartedAt: new Date(0).toISOString(),
+    };
+    // Even with the infra budget already exhausted it waits — the session ended
+    // cleanly, so there is no failure to charge and no review handoff to make.
+    for (const limits of [INFRA_ATTEMPTS_LEFT, INFRA_AT_LIMIT]) {
+        assert.deepStrictEqual(routeDeveloperOutcome(outcome, limits), {
+            next: "defer_work",
+            reason: "Waiting for CI (running) - no attempt spent",
+        });
+    }
+});
 test("adapter failure after push retries publish only (no full developer session)", () => {
     const outcome = {
         kind: "adapter_failure",
@@ -216,43 +238,81 @@ test("timed_out with infra attempts remaining retries (same bucket as session_fa
         reason: "Developer session timed out.",
     });
 });
-test("checks_failed with infra attempts remaining retries (same bucket as session_failed/no_pr)", () => {
-    const outcome = { kind: "checks_failed" };
+test("NOT-307: an idle-watchdog timed_out routes exactly like a wall-clock timeout", () => {
+    // The idle kill reads as timed_out downstream: same bounded infra retry, same
+    // budget accounting — only the reason (and the failure cause) names the stall.
+    const outcome = {
+        kind: "timed_out",
+        reason: "Developer session made no progress for 20 minutes. (last tool: npm_test) Killed on the idle timeout.",
+    };
     assert.deepStrictEqual(routeDeveloperOutcome(outcome, INFRA_ATTEMPTS_LEFT), {
         next: "retry_developer",
-        reason: "Developer's PR checks failed.",
+        reason: "Developer session made no progress for 20 minutes. (last tool: npm_test) Killed on the idle timeout.",
+    });
+    assert.deepStrictEqual(routeDeveloperOutcome({ kind: "timed_out" }, INFRA_AT_LIMIT).next, "human_action");
+    assert.deepStrictEqual(routeDeveloperOutcome(outcome, INFRA_AT_LIMIT).next, "human_action");
+});
+test("NOT-313: checks_failed retries on the CI budget with the attempt number, not the infra bucket", () => {
+    const outcome = { kind: "checks_failed" };
+    assert.deepStrictEqual(routeDeveloperOutcome(outcome, REVIEW_ROUNDS_LEFT), {
+        next: "retry_developer",
+        reason: "CI repair attempt 1 of 3: Developer's PR checks failed.",
+        budget: "ci",
+    });
+    // One CI attempt already spent → the next retry is attempt 2, infra untouched.
+    assert.deepStrictEqual(routeDeveloperOutcome(outcome, CI_BUDGET_LEFT), {
+        next: "retry_developer",
+        reason: "CI repair attempt 2 of 3: Developer's PR checks failed.",
+        budget: "ci",
     });
 });
 test("NOT-252: checks_failed with enrichment details retries with the enriched reason, not the generic one", () => {
     const details = "Developer's PR checks failed at abc123: build.\nFailed checks (PR #7 @ abc123):\n- build (CI · failure)";
     const outcome = { kind: "checks_failed", details };
-    assert.deepStrictEqual(routeDeveloperOutcome(outcome, INFRA_ATTEMPTS_LEFT), {
+    assert.deepStrictEqual(routeDeveloperOutcome(outcome, CI_BUDGET_LEFT), {
         next: "retry_developer",
-        reason: details,
+        reason: `CI repair attempt 2 of 3: ${details}`,
+        budget: "ci",
     });
 });
 test("NOT-252: checks_failed with blank details falls back to exactly the generic reason", () => {
     for (const outcome of [{ kind: "checks_failed", details: "   " }, { kind: "checks_failed" }]) {
-        assert.deepStrictEqual(routeDeveloperOutcome(outcome, INFRA_ATTEMPTS_LEFT), {
+        assert.deepStrictEqual(routeDeveloperOutcome(outcome, CI_BUDGET_LEFT), {
             next: "retry_developer",
-            reason: "Developer's PR checks failed.",
+            reason: "CI repair attempt 2 of 3: Developer's PR checks failed.",
+            budget: "ci",
         });
     }
 });
-test("checks_failed at the infra-attempt limit escalates", () => {
+test("NOT-313: checks_failed at the CI limit escalates with a CI-specific reason, infra budget untouched", () => {
     const outcome = { kind: "checks_failed" };
-    const result = routeDeveloperOutcome(outcome, INFRA_AT_LIMIT);
+    const result = routeDeveloperOutcome(outcome, CI_AT_LIMIT);
     assert.equal(result.next, "human_action");
     assert.equal(result.actionType, "policy_escalation");
+    const reason = result.reason;
+    assert.match(reason, /CI checks still failing after 3 repair attempts \(limit 3\)/);
+    assert.doesNotMatch(reason, /infra-attempt limit reached/);
 });
-test("NOT-252: checks_failed escalation at the limit carries the enriched reason", () => {
+test("NOT-252: checks_failed escalation at the limit carries the failing check names", () => {
     const details = "Developer's PR checks failed at abc123: build.";
     const outcome = { kind: "checks_failed", details };
-    const result = routeDeveloperOutcome(outcome, INFRA_AT_LIMIT);
+    const result = routeDeveloperOutcome(outcome, CI_AT_LIMIT);
     assert.equal(result.next, "human_action");
     assert.equal(result.actionType, "policy_escalation");
+    assert.match(result.reason, /CI checks still failing after 3 repair attempts \(limit 3\)/);
     assert.match(result.reason, /at abc123: build/);
-    assert.match(result.reason, /infra-attempt limit reached/);
+    assert.doesNotMatch(result.reason, /infra-attempt limit reached/);
+});
+test("NOT-313: the budgets are independent — CI failures ignore the infra limit and infra failures ignore the CI limit", () => {
+    // An exhausted infra budget does not stop CI repair while CI budget remains.
+    const ciRetry = routeDeveloperOutcome({ kind: "checks_failed" }, INFRA_AT_LIMIT);
+    assert.equal(ciRetry.next, "retry_developer");
+    // An exhausted CI budget does not stop infra retries while infra budget remains.
+    for (const outcome of [{ kind: "session_failed" }, { kind: "timed_out" }, { kind: "no_pr" }]) {
+        const infraRetry = routeDeveloperOutcome(outcome, { ...CI_AT_LIMIT, infraAttempts: 1 });
+        assert.equal(infraRetry.next, "retry_developer", outcome.kind);
+        assert.ok(!("budget" in infraRetry) || infraRetry.budget === undefined);
+    }
 });
 test("an infra-class developer failure never spends the review-round budget, even at the review-round limit", () => {
     const outcome = { kind: "session_failed" };
@@ -448,10 +508,11 @@ test("NOT-147: tip with commits ahead still auto-retries under existing infra bu
     }
 });
 test("NOT-147: no_pr / checks_failed are unaffected by the empty-tip gate (timeout/crash only)", () => {
-    // Even with infraAttempts already spent and zero progress implied, non-crash infra
-    // failures keep the pre-NOT-147 budget-only policy.
+    // Even with attempts already spent and zero progress implied, non-crash failures
+    // keep the pre-NOT-147 budget-only policy — no_pr on the infra budget,
+    // checks_failed on its own CI budget (NOT-313).
     assert.equal(routeDeveloperOutcome({ kind: "no_pr" }, INFRA_ATTEMPTS_LEFT).next, "retry_developer");
-    assert.equal(routeDeveloperOutcome({ kind: "checks_failed" }, INFRA_ATTEMPTS_LEFT).next, "retry_developer");
+    assert.equal(routeDeveloperOutcome({ kind: "checks_failed" }, CI_BUDGET_LEFT).next, "retry_developer");
 });
 test("NOT-147: noProgressInfraAttempts is tunable (N=1 escalates on first empty-tip crash)", () => {
     const limits = { ...REVIEW_ROUNDS_LEFT, noProgressInfraAttempts: 1 };

package/bundle/server/dist/coordinator/session-timeouts.js

@@ -5,6 +5,36 @@ export function developerSessionTimeoutMs() {
 export function reviewerSessionTimeoutMs() {
     return num("REVIEWER_TIMEOUT_MS", 30 * 60_000);
 }
+/**
+ * NOT-307: silent-child bound for the Muse developer lane only (other runtimes do
+ * not read this). Undefined means the watchdog is disabled. The watchdog ships
+ * ENABLED with a 30-minute default: 20 min risks false kills against the
+ * reported ~39.8 min silent gap in completed-session history; 45 min saves only
+ * 15 of the 60-min wall-clock cap; disabled does not address the observed
+ * 1-hour stalls. The ~39.8 min figure could not be re-verified — historical raw
+ * logs carry replayed `recorded_at`, not arrival times, so it may overstate
+ * true stdout/session.jsonl silence. The value is env-tunable, and the new
+ * per-event `ts`/`durationMs` plus `metadata_json` stall fields will provide
+ * the real gap distribution to recalibrate; a false kill is bounded by timeout
+ * salvage + retry from the branch. `0` disables explicitly. A non-numeric or
+ * negative value falls back to the default with a logged warning rather than
+ * silently disabling the guard (or killing healthy sessions on a typo like
+ * `-1`).
+ */
+export const DEFAULT_MUSE_IDLE_TIMEOUT_MS = 30 * 60_000;
+export function museIdleTimeoutMs() {
+    const raw = process.env.MUSE_IDLE_TIMEOUT_MS;
+    if (raw === undefined || raw.trim() === "")
+        return DEFAULT_MUSE_IDLE_TIMEOUT_MS;
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed === 0)
+        return undefined;
+    if (!Number.isFinite(parsed) || parsed < 0) {
+        console.warn(`[dealer] ignoring invalid MUSE_IDLE_TIMEOUT_MS=${JSON.stringify(raw)} — using default ${DEFAULT_MUSE_IDLE_TIMEOUT_MS}`);
+        return DEFAULT_MUSE_IDLE_TIMEOUT_MS;
+    }
+    return parsed;
+}
 export function sessionTimeoutMsFor(role) {
     return role === "reviewer" ? reviewerSessionTimeoutMs() : developerSessionTimeoutMs();
 }

package/bundle/server/dist/coordinator/usage-cap-defer.js

@@ -15,6 +15,7 @@ import { deferWorkItem, getWorkItem } from "../repository/work-items.js";
 import { getWorkerSession } from "../repository/worker-sessions.js";
 import { deckOutageBackoffMs, deckOutageProlongedAfterMs } from "./deck-outage-config.js";
 import { usageCapDeferralCeilingMs } from "./usage-cap-config.js";
+import { checksWaitCeilingExceeded } from "./checks-wait-config.js";
 import { workerSessionPayload } from "./session-progress.js";
 const roleFor = {
     developer: "developer",
@@ -255,6 +256,66 @@ export function deferLeasedWorkItemForAgentUnhealthy(item, leaseToken, unhealthy
         });
     })();
 }
+export function checksWaitDeferralStartedAt(payload) {
+    const v = payload.checksWaitStartedAt;
+    return typeof v === "string" && v ? v : null;
+}
+/** How many times this item has already waited on CI — drives the backoff curve. */
+export function checksWaitDeferralCount(payload) {
+    const v = payload.checksWaitDeferrals;
+    return typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.floor(v) : 0;
+}
+/**
+ * NOT-311: CI was still pending when the poll timed out, so nothing about the work
+ * was proven or disproven. The item waits on the deck-outage backoff and re-polls —
+ * no infra attempt, and the claim-time attempt_count bump is reverted, exactly like a
+ * deck outage. Unlike an outage this wait has a ceiling: past it the deferral
+ * reports `escalated` so the caller raises a human action naming the stuck PR/SHA.
+ *
+ * The re-queued payload carries `publishOnly` + `branch` so the next run takes the
+ * no-agent publish path (push-if-behind, PR verify, re-poll) instead of spawning a
+ * fresh developer session to redo committed work.
+ */
+export function deferLeasedWorkItemForChecksPending(item, leaseToken, pending, issue, instance, nowMs = Date.now()) {
+    return getDb().transaction(() => {
+        const live = liveLeasedItem(item.id, leaseToken);
+        if (!live)
+            return { deferred: false, escalated: false, reason: "lease_lost" };
+        const payload = parsePayload(live.payloadJson);
+        const firstDeferredAt = checksWaitDeferralStartedAt(payload) ?? pending.waitStartedAt ?? new Date(nowMs).toISOString();
+        if (checksWaitCeilingExceeded(firstDeferredAt, nowMs)) {
+            return { deferred: false, escalated: true };
+        }
+        const priorDeferrals = checksWaitDeferralCount(payload);
+        const until = new Date(nowMs + deckOutageBackoffMs(priorDeferrals)).toISOString();
+        return applyDeferral(live, leaseToken, issue, instance, {
+            until,
+            reason: pending.reason,
+            outcome: "checks_pending",
+            error: {
+                kind: "checks_pending",
+                until,
+                reason: pending.reason,
+                branch: pending.branch,
+                prNumber: pending.prNumber,
+                headSha: pending.headSha,
+            },
+            payloadJson: JSON.stringify({
+                ...payload,
+                publishOnly: true,
+                branch: pending.branch,
+                checksWaitStartedAt: firstDeferredAt,
+                checksWaitDeferrals: priorDeferrals + 1,
+            }),
+            intent: (_role, untilLabel) => `${pending.reason} (retrying ${untilLabel})`,
+        });
+    })();
+}
+/** NOT-311: ceiling escalation reason — names the PR and the head SHA CI never proved. */
+export function formatChecksWaitEscalationReason(pending, firstDeferredAt) {
+    return (`CI did not complete on ${pending.headSha} (PR #${pending.prNumber}, branch ${pending.branch}) — ` +
+        `waiting since ${firstDeferredAt}. ${pending.reason}`);
+}
 export function formatCapEscalationReason(cap, firstDeferredAt) {
     const hours = Math.round(usageCapDeferralCeilingMs() / 3_600_000);
     return `${cap.reason} Work deferred for over ${hours}h (since ${firstDeferredAt}).`;

package/bundle/server/dist/coordinator/usage-cap.integration.test.js

@@ -32,8 +32,8 @@ beforeEach(() => {
     DELETE FROM human_actions;
     DELETE FROM workflow_events;
     DELETE FROM findings;
-    DELETE FROM worker_sessions;
     DELETE FROM artifacts;
+    DELETE FROM worker_sessions;
     DELETE FROM usage_events;
     DELETE FROM workflow_instances;
     DELETE FROM issues;

package/bundle/server/dist/coordinator/worker-loop.js

@@ -83,6 +83,15 @@ function safeCompleteSession(sessionId, status, error) {
     catch (err) {
         console.error("[coordinator] completeSession", sessionId, err);
     }
+    // NOT-305: best-effort actual-use receipt the moment the session goes terminal — a
+    // later issue-completion trigger re-attempts anything still missing, so this never
+    // throws and never changes the session outcome or the issue state.
+    try {
+        void import("./playbook-feedback.js").then(({ collectPlaybookUseReceipt }) => collectPlaybookUseReceipt(sessionId).catch(() => { }));
+    }
+    catch (err) {
+        console.error("[coordinator] playbook receipt", sessionId, err);
+    }
 }
 /**
  * A failed effect (handler threw, or lost its lease mid-run). One transaction, fenced on
@@ -269,10 +278,6 @@ async function processWorkItem(claimed) {
         safeCompleteSession(session.id, "cancelled", { reason: result.reason });
         return;
     }
-    if (result.triggerReflect) {
-        const { triggerIssueReflect } = await import("./reflect-trigger.js");
-        void triggerIssueReflect(claimed.issueId).catch(() => { });
-    }
     // NOT-136: a deck-unavailable session never spawned anything — `cancelled`, not `failed`
     // (which would read as a worker crash) and not `done` (which would claim it ran).
     // NOT-197: a base-fetch failure likewise never spawned (and created no branch).
@@ -298,7 +303,16 @@ async function processWorkItem(claimed) {
             }),
         }
         : undefined;
+    // NOT-305: the session row goes terminal BEFORE the issue-level reflect trigger
+    // below. triggerIssueReflect collects receipts for every terminal session, and
+    // completeSession writes the terminal status synchronously — firing reflect first
+    // would exclude this just-finished session from the signal's worker sessions and
+    // playbook evidence.
     safeCompleteSession(session.id, sessionStatus, errorPayload);
+    if (result.triggerReflect) {
+        const { triggerIssueReflect } = await import("./reflect-trigger.js");
+        void triggerIssueReflect(claimed.issueId).catch(() => { });
+    }
 }
 /**
  * Claims and starts as many work items as free concurrency slots allow, then returns the

package/bundle/server/dist/db/ci-attempts-migration.test.js

@@ -0,0 +1,70 @@
+// NOT-313: the CI-repair budget columns are added by separate `ALTER TABLE`
+// statements, each guarded on its own presence (same lesson as the
+// worker_sessions liveness columns in worker-session-pid-migration.test.ts): a
+// kill between the two ALTERs must still repair on the next migrate().
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-ci-migrate-"));
+const { migrate, getDb } = await import("./index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue, getIssue } = await import("../repository/issues.js");
+const CI_COLS = ["ci_attempts", "max_ci_attempts"]; // sorted: ciCols() sorts
+const ciCols = () => getDb().prepare("PRAGMA table_info(issues)").all()
+    .map((c) => c.name)
+    .filter((c) => CI_COLS.includes(c))
+    .sort();
+function newIssueId() {
+    return createIssue({
+        title: "T",
+        repo: "/r",
+        baseBranch: "main",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+    }).id;
+}
+test("migrate() adds both CI-budget columns to a DB that predates them, keeping every row", () => {
+    migrate();
+    const before = newIssueId();
+    const rowCount = getDb().prepare("SELECT COUNT(*) AS c FROM issues").get().c;
+    // A DB created before NOT-313.
+    getDb().exec("ALTER TABLE issues DROP COLUMN max_ci_attempts");
+    getDb().exec("ALTER TABLE issues DROP COLUMN ci_attempts");
+    assert.deepStrictEqual(ciCols(), []);
+    migrate();
+    assert.deepStrictEqual(ciCols(), CI_COLS);
+    // All rows survive with the defaults.
+    assert.equal(getDb().prepare("SELECT COUNT(*) AS c FROM issues").get().c, rowCount);
+    const reread = getDb()
+        .prepare("SELECT max_ci_attempts, ci_attempts FROM issues WHERE id = ?")
+        .get(before);
+    assert.equal(reread.max_ci_attempts, 3);
+    assert.equal(reread.ci_attempts, 0);
+    // The repository maps the backfilled columns, and new issues open with a full budget.
+    const issue = getIssue(before);
+    assert.equal(issue.maxCiAttempts, 3);
+    assert.equal(issue.ciAttempts, 0);
+    const fresh = getIssue(newIssueId());
+    assert.equal(fresh.maxCiAttempts, 3);
+    assert.equal(fresh.ciAttempts, 0);
+});
+test("migrate() repairs a half-applied CI upgrade instead of skipping it forever", () => {
+    migrate();
+    // Exactly the partial state a crash between the two ALTERs leaves behind.
+    getDb().exec("ALTER TABLE issues DROP COLUMN ci_attempts");
+    assert.deepStrictEqual(ciCols(), ["max_ci_attempts"]);
+    migrate();
+    assert.deepStrictEqual(ciCols(), CI_COLS, "the missing column is added");
+    assert.doesNotThrow(() => newIssueId(), "issue inserts name the restored column");
+});
+test("migrate() is idempotent once both CI columns are present", () => {
+    migrate();
+    migrate();
+    assert.deepStrictEqual(ciCols(), CI_COLS);
+    assert.doesNotThrow(() => newIssueId());
+});

package/bundle/server/dist/db/index.js

@@ -131,6 +131,11 @@ export function migrate() {
     if (!workerSessionCols.some((c) => c.name === "process_started_at")) {
         db.exec("ALTER TABLE worker_sessions ADD COLUMN process_started_at TEXT");
     }
+    // NOT-305: opaque Deck correlation UUID per session. Pre-feature rows stay NULL,
+    // which readers treat as "no correlation" (receipt records a skip, never a guess).
+    if (!workerSessionCols.some((c) => c.name === "deck_correlation_id")) {
+        db.exec("ALTER TABLE worker_sessions ADD COLUMN deck_correlation_id TEXT");
+    }
     // NOT-181: the model a session actually ran (Muse's server-confirmed one). Existing rows stay
     // NULL, which every reader treats as "not recorded".
     const usageEventCols = db.prepare("PRAGMA table_info(usage_events)").all();
@@ -246,6 +251,19 @@ export function migrate() {
         db.exec("ALTER TABLE issues ADD COLUMN max_infra_attempts INTEGER NOT NULL DEFAULT 3");
         db.exec("ALTER TABLE issues ADD COLUMN infra_attempts INTEGER NOT NULL DEFAULT 0");
     }
+    // NOT-313: CI-repair budget, separate from the infra-attempt budget above — a
+    // failing CI check is the expected feedback loop, not a crash/timeout/adapter
+    // failure, so `checks_failed` spends `ci_attempts` (bounded by
+    // `max_ci_attempts`) and never touches `infra_attempts`. Each column is guarded
+    // on its OWN presence (see the worker_sessions liveness comment above): the two
+    // ALTERs commit separately, so a kill between them must still repair on retry.
+    const issueColsForCi = db.prepare("PRAGMA table_info(issues)").all();
+    if (!issueColsForCi.some((c) => c.name === "max_ci_attempts")) {
+        db.exec("ALTER TABLE issues ADD COLUMN max_ci_attempts INTEGER NOT NULL DEFAULT 3");
+    }
+    if (!issueColsForCi.some((c) => c.name === "ci_attempts")) {
+        db.exec("ALTER TABLE issues ADD COLUMN ci_attempts INTEGER NOT NULL DEFAULT 0");
+    }
     // NOT-102: per-issue auto-merge after reviewer approve (kick UI defaults on; existing
     // rows stay off so in-flight workflows keep the human final_review path).
     const issueColsForAutoMerge = db.prepare("PRAGMA table_info(issues)").all();

package/bundle/server/dist/db/schema.sql

@@ -114,6 +114,8 @@ CREATE TABLE IF NOT EXISTS issues (
   current_round INTEGER NOT NULL DEFAULT 1,
   max_infra_attempts INTEGER NOT NULL DEFAULT 3,
   infra_attempts INTEGER NOT NULL DEFAULT 0,
+  max_ci_attempts INTEGER NOT NULL DEFAULT 3,
+  ci_attempts INTEGER NOT NULL DEFAULT 0,
   branch TEXT,
   base_sha TEXT,
   head_sha TEXT,
@@ -155,6 +157,9 @@ CREATE TABLE IF NOT EXISTS worker_sessions (
   process_pid INTEGER,
   process_owner TEXT,
   process_started_at TEXT,
+  -- NOT-305: opaque Agent Deck correlation UUID, one per session, generated before
+  -- spawn and passed as observability metadata in every runtime's Deck launch config.
+  deck_correlation_id TEXT,
   created_at TEXT NOT NULL,
   started_at TEXT,
   heartbeat_at TEXT,

package/bundle/server/dist/docs-execution-analysis.test.js

@@ -67,6 +67,7 @@ test("the contract defines every phase, taxonomy code, and quality label", () =>
         "provider_capacity_rate_limit",
         "agent_cli_crash",
         "tool_test_timeout",
+        "muse_no_progress",
         "coordinator_crash",
         "validation_failure",
         "publish_git_failure",

package/bundle/server/dist/repository/artifacts-for-issue.js

@@ -23,10 +23,10 @@ export function listArtifactsForIssue(issueId, opts) {
     const limit = opts?.limit ?? 50;
     const rows = opts?.before
         ? getDb()
-            .prepare("SELECT * FROM artifacts WHERE issue_id = ? AND created_at < ? ORDER BY created_at DESC LIMIT ?")
+            .prepare("SELECT * FROM artifacts WHERE issue_id = ? AND created_at < ? ORDER BY created_at DESC, rowid DESC LIMIT ?")
             .all(issueId, opts.before, limit)
         : getDb()
-            .prepare("SELECT * FROM artifacts WHERE issue_id = ? ORDER BY created_at DESC LIMIT ?")
+            .prepare("SELECT * FROM artifacts WHERE issue_id = ? ORDER BY created_at DESC, rowid DESC LIMIT ?")
             .all(issueId, limit);
     return rows.map(rowToArtifact);
 }
@@ -36,7 +36,7 @@ export function listArtifactsForIssue(issueId, opts) {
  * scan) can't have an old row fall outside the window on an artifact-heavy issue. */
 export function listArtifactsForIssueByKind(issueId, kind) {
     const rows = getDb()
-        .prepare("SELECT * FROM artifacts WHERE issue_id = ? AND kind = ? ORDER BY created_at DESC")
+        .prepare("SELECT * FROM artifacts WHERE issue_id = ? AND kind = ? ORDER BY created_at DESC, rowid DESC")
         .all(issueId, kind);
     return rows.map(rowToArtifact);
 }

package/bundle/server/dist/repository/human-actions.js

@@ -119,6 +119,20 @@ export function findOpenHumanActionByRequestId(issueId, actionType, requestId) {
         .get(issueId, actionType, requestId);
     return row ? rowToAction(row) : null;
 }
+/**
+ * NOT-308: version-scoped Muse capability escalations live on whichever issue first
+ * observed the verdict, but later admissions for *other* issues must find the same
+ * action instead of raising a duplicate — so the lookup is by (type, request_id)
+ * across issues, not per issue. Returns open actions first so callers can skip
+ * creation; resolved ones are included so callers can distinguish "already handled".
+ */
+export function listHumanActionsByRequestId(actionType, requestId) {
+    const rows = getDb()
+        .prepare(`SELECT * FROM human_actions WHERE action_type = ? AND request_id = ?
+       ORDER BY CASE status WHEN 'open' THEN 0 ELSE 1 END, requested_at ASC`)
+        .all(actionType, requestId);
+    return rows.map(rowToAction);
+}
 export function listHumanActionsForIssue(issueId) {
     const rows = getDb()
         .prepare("SELECT * FROM human_actions WHERE issue_id = ? ORDER BY requested_at ASC")

package/bundle/server/dist/repository/issues.js

@@ -1,4 +1,4 @@
-import { canTransitionIssue, CreateIssueInput, looksLikeLocalRepoPath, parseGitHubRepoInput, TERMINAL_ISSUE_STATUSES, } from "@agent-dealer/shared";
+import { canTransitionIssue, compileExecutionContract, CreateIssueInput, DEFAULT_MAX_CI_ATTEMPTS, looksLikeLocalRepoPath, parseGitHubRepoInput, resolveIssueContractFields, tryCompileContract, TERMINAL_ISSUE_STATUSES, } from "@agent-dealer/shared";
 import { v4 as uuid } from "uuid";
 import { getDb } from "../db/index.js";
 function rowToIssue(row) {
@@ -11,6 +11,11 @@ function rowToIssue(row) {
         title: row.title,
         description: row.description,
         acceptanceCriteria: row.acceptance_criteria,
+        // NOT-306: the contract is derived from the stored description on every
+        // read — the description stays the untouched source of truth, so no
+        // migration or second authoring surface exists. A description that fails
+        // validation (written before validation existed) reads as a legacy null.
+        executionContract: tryCompileContract(row.description),
         repo: row.repo,
         baseBranch: row.base_branch,
         status: row.status,
@@ -22,6 +27,8 @@ function rowToIssue(row) {
         currentRound: row.current_round,
         maxInfraAttempts: row.max_infra_attempts,
         infraAttempts: row.infra_attempts,
+        maxCiAttempts: row.max_ci_attempts ?? DEFAULT_MAX_CI_ATTEMPTS,
+        ciAttempts: row.ci_attempts ?? 0,
         branch: row.branch,
         baseSha: row.base_sha,
         headSha: row.head_sha,
@@ -49,6 +56,12 @@ export function createIssue(raw) {
     const { repo: repoRaw, ...rest } = raw;
     const input = CreateIssueInput.omit({ repo: true }).parse(rest);
     const repo = normalizeStoredIssueRepo(repoRaw);
+    // NOT-306: validate the ticket's execution contract here so every creation
+    // path (web, API, CLI-via-API, Linear import) shares one compiler — an
+    // ambiguous/malformed contract throws instead of silently dropping fields.
+    // A missing explicit acceptanceCriteria is filled from the description; an
+    // explicit value always wins and the description is stored untouched.
+    const resolved = resolveIssueContractFields(input.description, input.acceptanceCriteria);
     const db = getDb();
     const now = new Date().toISOString();
     const id = uuid();
@@ -60,7 +73,7 @@ export function createIssue(raw) {
         external_url: input.externalUrl ?? null,
         title: input.title,
         description: input.description ?? null,
-        acceptance_criteria: input.acceptanceCriteria ?? null,
+        acceptance_criteria: resolved.acceptanceCriteria,
         repo,
         base_branch: input.baseBranch,
         status: "ready",
@@ -72,6 +85,10 @@ export function createIssue(raw) {
         current_round: 1,
         max_infra_attempts: input.maxInfraAttempts,
         infra_attempts: 0,
+        // NOT-313: no per-ticket config (stays out of CreateIssueInput) — every new
+        // issue opens with the full default CI-repair budget, unspent.
+        max_ci_attempts: DEFAULT_MAX_CI_ATTEMPTS,
+        ci_attempts: 0,
         branch: null,
         base_sha: null,
         head_sha: null,
@@ -86,13 +103,13 @@ export function createIssue(raw) {
       id, source, external_id, external_label, external_url, title, description,
       acceptance_criteria, repo, base_branch, status, current_owner, current_intent,
       developer_agent_id, reviewer_agent_id, max_review_rounds, current_round,
-      max_infra_attempts, infra_attempts,
+      max_infra_attempts, infra_attempts, max_ci_attempts, ci_attempts,
       branch, base_sha, head_sha, pr_number, pr_url, auto_merge, created_at, updated_at
     ) VALUES (
       @id, @source, @external_id, @external_label, @external_url, @title, @description,
       @acceptance_criteria, @repo, @base_branch, @status, @current_owner, @current_intent,
       @developer_agent_id, @reviewer_agent_id, @max_review_rounds, @current_round,
-      @max_infra_attempts, @infra_attempts,
+      @max_infra_attempts, @infra_attempts, @max_ci_attempts, @ci_attempts,
       @branch, @base_sha, @head_sha, @pr_number, @pr_url, @auto_merge, @created_at, @updated_at
     )
   `).run(row);
@@ -263,6 +280,20 @@ export function updateIssue(id, patch) {
     const current = getIssue(id);
     if (!current)
         throw new Error(`Issue not found: ${id}`);
+    // NOT-306: an edited description recompiles through the same compiler as
+    // creation — an ambiguous/malformed contract throws instead of landing
+    // half-parsed. A missing acceptanceCriteria is backfilled from the new
+    // description only when the issue has none; an explicit value always wins.
+    // Validation runs only when the patch touches the description, so unrelated
+    // updates (e.g. a base-branch-only sync) never fail on a stored description
+    // that predates validation.
+    const nextDescription = patch.description !== undefined ? patch.description : current.description;
+    const compiled = patch.description !== undefined ? compileExecutionContract(nextDescription) : null;
+    const nextAcceptanceCriteria = patch.acceptanceCriteria !== undefined
+        ? patch.acceptanceCriteria
+        : current.acceptanceCriteria?.trim()
+            ? current.acceptanceCriteria
+            : (compiled?.acceptanceCriteria ?? current.acceptanceCriteria);
     const now = new Date().toISOString();
     getDb()
         .prepare(`
@@ -283,8 +314,8 @@ export function updateIssue(id, patch) {
         .run({
         id,
         title: patch.title ?? current.title,
-        description: patch.description !== undefined ? patch.description : current.description,
-        acceptance_criteria: patch.acceptanceCriteria !== undefined ? patch.acceptanceCriteria : current.acceptanceCriteria,
+        description: nextDescription,
+        acceptance_criteria: nextAcceptanceCriteria,
         repo: patch.repo !== undefined ? normalizeStoredIssueRepo(patch.repo) : current.repo,
         base_branch: patch.baseBranch ?? current.baseBranch,
         developer_agent_id: patch.developerAgentId ?? current.developerAgentId,
@@ -349,6 +380,21 @@ export function incrementIssueInfraAttempts(id) {
         throw new Error(`Issue vanished: ${id}`);
     return updated;
 }
+/** NOT-313: spends one CI-repair attempt — a `checks_failed` being retried
+ * automatically. Never touches `infra_attempts`; see incrementIssueInfraAttempts. */
+export function incrementIssueCiAttempts(id) {
+    const current = getIssue(id);
+    if (!current)
+        throw new Error(`Issue not found: ${id}`);
+    const now = new Date().toISOString();
+    getDb()
+        .prepare("UPDATE issues SET ci_attempts = ci_attempts + 1, updated_at = ? WHERE id = ?")
+        .run(now, id);
+    const updated = getIssue(id);
+    if (!updated)
+        throw new Error(`Issue vanished: ${id}`);
+    return updated;
+}
 /** A human resuming past a `policy_escalation` gets a fresh infra-attempt budget. */
 export function resetIssueInfraAttempts(id) {
     const current = getIssue(id);
@@ -363,6 +409,21 @@ export function resetIssueInfraAttempts(id) {
         throw new Error(`Issue vanished: ${id}`);
     return updated;
 }
+/** NOT-313: a human resuming past a CI-checks `policy_escalation` gets a fresh
+ * CI-repair budget alongside the infra one (commands.ts resets both together). */
+export function resetIssueCiAttempts(id) {
+    const current = getIssue(id);
+    if (!current)
+        throw new Error(`Issue not found: ${id}`);
+    const now = new Date().toISOString();
+    getDb()
+        .prepare("UPDATE issues SET ci_attempts = 0, updated_at = ? WHERE id = ?")
+        .run(now, id);
+    const updated = getIssue(id);
+    if (!updated)
+        throw new Error(`Issue vanished: ${id}`);
+    return updated;
+}
 /** `attempts_exhausted:retry` grants one more review round instead of instantly
  * re-exhausting: bumps current_round AND max_review_rounds together. */
 export function grantReviewRetry(id) {

package/bundle/server/dist/repository/work-items.js

@@ -97,6 +97,13 @@ export function getWorkItem(id) {
     const row = getDb().prepare("SELECT * FROM work_items WHERE id = ?").get(id);
     return row ? rowToWorkItem(row) : null;
 }
+/** Finds the row a retried enqueue would dedupe against (null when the key is unused). */
+export function getWorkItemByIdempotencyKey(idempotencyKey) {
+    const row = getDb()
+        .prepare("SELECT * FROM work_items WHERE idempotency_key = ?")
+        .get(idempotencyKey);
+    return row ? rowToWorkItem(row) : null;
+}
 export function listWorkItemsForIssue(issueId) {
     const rows = getDb()
         .prepare("SELECT * FROM work_items WHERE issue_id = ? ORDER BY created_at ASC")