agent-dealer 1.2.8 → 1.2.10

package/bundle/server/dist/coordinator/developer-effect.test.js

@@ -151,12 +151,25 @@ function fakeGithub(opts = {}) {
             if (number == null && !branch) {
                 throw new Error("fakeGithub.checksSnapshot requires an explicit number or branch — bare checks lookup is the NOT-82 bug");
             }
-            return opts.checks ?? "success";
+            // NOT-311: a function lets one test flip CI mid-wait (pending → success) so the
+            // deferred re-poll can prove the wait closes without a fresh agent session.
+            return typeof opts.checks === "function" ? opts.checks() : (opts.checks ?? "success");
+        },
+        async hasPullRequestWorkflow() {
+            return opts.pullRequestWorkflow ?? null;
         },
         async publishReview() {
             throw new Error("publishReview is unused by the developer effect");
         }
     };
+    if (opts.mergeable !== undefined) {
+        const mergeable = opts.mergeable;
+        adapter.prMergeableState = async ({ number }) => {
+            if (number == null)
+                throw new Error("fakeGithub.prMergeableState requires an explicit PR number");
+            return typeof mergeable === "function" ? mergeable() : mergeable;
+        };
+    }
     return adapter;
 }
 test("clean handoff: real worktree, real push, fake GitHub — issue moves to reviewing with a reviewer work item queued", async () => {
@@ -530,6 +543,8 @@ test("checks_failed: CI failure after a clean push/PR retries without a human ac
     await pump(1);
     const issue = getIssue(issueId);
     assert.equal(issue.status, "developing");
+    assert.equal(issue.ciAttempts, 1, "a checks_failed retry spends the CI budget");
+    assert.equal(issue.infraAttempts, 0, "a checks_failed retry never touches the infra budget");
     assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer").length, 0);
     const kinds = listArtifactsForIssue(issueId).map((a) => a.kind);
     const evidence = listArtifactsForIssue(issueId).find((a) => a.kind === "checks_evidence");
@@ -540,12 +555,323 @@ test("checks_failed: CI failure after a clean push/PR retries without a human ac
     assert.ok(kinds.includes("implementation_conclusion"), "conclusion must survive a post-session verification failure");
     assert.ok(kinds.includes("developer_transcript"), "raw trace must survive a post-session verification failure");
 });
-test("timed_out (checks poll): checks stay pending past the poll deadline", async () => {
+test("NOT-311: checks_pending — checks still pending at the poll deadline defers, spending no attempt", async () => {
+    // Previously this returned `timed_out`, spending an infra attempt on a session that
+    // had already ended cleanly. Now the item waits on backoff and re-polls.
     const issueId = await makeIssue();
     registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: commitingSpawn, github: fakeGithub({ checks: "pending" }) }));
     startWorkflow(issueId);
     await pump(1);
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "developing");
+    assert.equal(issue.infraAttempts, 0, "a CI wait spends no infra attempt");
+    assert.equal(issue.currentRound, 1, "a CI wait must not spend a review round");
+    assert.match(issue.currentIntent ?? "", /Waiting for CI \(running\) - no attempt spent/);
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer").length, 0, "no review handoff on unverified CI");
+    const items = listWorkItemsForIssue(issueId);
+    assert.equal(items.length, 1);
+    assert.equal(items[0].status, "pending", "the item waits, it is not finished or dead-lettered");
+    assert.equal(items[0].attemptCount, 0, "the claim-time attempt bump is reverted");
+    assert.ok(Date.parse(items[0].availableAt) > Date.parse(items[0].updatedAt), "the re-poll is gated behind a backoff");
+    const deferredPayload = JSON.parse(items[0].payloadJson ?? "{}");
+    assert.equal(deferredPayload.publishOnly, true, "the re-poll takes the no-agent publish path, not a fresh spawn");
+    assert.equal(deferredPayload.branch, issueBranchName(issueId));
+    assert.ok(deferredPayload.checksWaitStartedAt, "the wait anchors its ceiling at the first poll");
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0);
+    const events = listWorkflowEventsForIssue(issueId);
+    const deferrals = events.filter((e) => e.type === "worker.deferred");
+    assert.ok(deferrals.length > 0);
+    assert.equal(JSON.parse(deferrals[0].payloadJson ?? "{}").outcome, "checks_pending");
+    assert.equal(events.some((e) => e.type === "worker.failed"), false, "a CI wait is not a failure");
+    const completed = events.find((e) => e.type === "checks.completed");
+    assert.ok(completed, "the wait still records a checks.completed milestone");
+    assert.equal(JSON.parse(completed.payloadJson ?? "{}").snapshot, "timeout");
+});
+test("NOT-311: the deferred CI wait re-polls through publish-only and hands off once CI passes", async () => {
+    // First run waits (pending), the deferred re-poll sees success and reaches review —
+    // all without spawning a second agent session and without spending infra attempts.
+    let ci = "pending";
+    let spawns = 0;
+    const countingSpawn = async (input) => {
+        spawns++;
+        return commitingSpawn(input);
+    };
+    // A short backoff (set before the first deferral computes its `until`) lets the
+    // second pump actually pick the waiting item back up.
+    const prevBase = process.env.DECK_OUTAGE_BACKOFF_BASE_MS;
+    const prevMax = process.env.DECK_OUTAGE_BACKOFF_MAX_MS;
+    process.env.DECK_OUTAGE_BACKOFF_BASE_MS = "10";
+    process.env.DECK_OUTAGE_BACKOFF_MAX_MS = "10";
+    try {
+        const issueId = await makeIssue();
+        registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: countingSpawn, github: fakeGithub({ checks: () => ci }) }));
+        startWorkflow(issueId);
+        await pump(1);
+        assert.equal(getIssue(issueId).status, "developing");
+        assert.equal(getIssue(issueId).infraAttempts, 0);
+        const deferred = listWorkItemsForIssue(issueId)[0];
+        assert.equal(deferred.status, "pending");
+        // Fast-forward past the deferral backoff, then let CI pass.
+        await new Promise((resolve) => setTimeout(resolve, 60));
+        ci = "success";
+        await pump(1);
+        const issue = getIssue(issueId);
+        assert.equal(issue.status, "reviewing", "the re-poll hands off once CI passes");
+        assert.equal(issue.infraAttempts, 0, "waiting plus a passing re-poll still spends nothing");
+        assert.equal(spawns, 1, "the re-poll must not spawn a second agent session");
+        assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer" && i.status === "pending").length, 1);
+    }
+    finally {
+        if (prevBase === undefined)
+            delete process.env.DECK_OUTAGE_BACKOFF_BASE_MS;
+        else
+            process.env.DECK_OUTAGE_BACKOFF_BASE_MS = prevBase;
+        if (prevMax === undefined)
+            delete process.env.DECK_OUTAGE_BACKOFF_MAX_MS;
+        else
+            process.env.DECK_OUTAGE_BACKOFF_MAX_MS = prevMax;
+    }
+});
+test("NOT-311: none with a pull_request workflow on the base waits (no review handoff)", async () => {
+    const issueId = await makeIssue();
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: commitingSpawn, github: fakeGithub({ checks: "none", pullRequestWorkflow: true }) }));
+    startWorkflow(issueId);
+    await pump(1);
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "developing");
+    assert.equal(issue.infraAttempts, 0, "an unregistered-CI wait spends no infra attempt");
+    assert.match(issue.currentIntent ?? "", /Waiting for CI \(queued\) - no attempt spent/);
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer").length, 0, "no review handoff on 'no checks yet'");
+    const completed = listWorkflowEventsForIssue(issueId).find((e) => e.type === "checks.completed");
+    assert.ok(completed);
+    const payload = JSON.parse(completed.payloadJson ?? "{}");
+    assert.equal(payload.snapshot, "none");
+    assert.equal(payload.reason, "none_with_workflow");
+});
+test("NOT-311: none with no pull_request workflow on the base proceeds as today", async () => {
+    const issueId = await makeIssue();
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: commitingSpawn, github: fakeGithub({ checks: "none", pullRequestWorkflow: false }) }));
+    startWorkflow(issueId);
+    await pump(1);
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "reviewing", "no configured CI still hands off");
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer" && i.status === "pending").length, 1);
+    const completed = listWorkflowEventsForIssue(issueId).find((e) => e.type === "checks.completed");
+    assert.ok(completed);
+    const payload = JSON.parse(completed.payloadJson ?? "{}");
+    assert.equal(payload.snapshot, "none");
+    assert.equal(payload.reason, "none_no_workflow");
+});
+test("NOT-311: none with an unknown workflow answer waits fail-closed", async () => {
+    // The adapter cannot read the base (or has no such method): 'no checks yet' must
+    // never read as a pass.
+    const issueId = await makeIssue();
+    const github = fakeGithub({ checks: "none", pullRequestWorkflow: null });
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: commitingSpawn, github }));
+    startWorkflow(issueId);
+    await pump(1);
     assert.equal(getIssue(issueId).status, "developing");
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer").length, 0);
+    const completed = listWorkflowEventsForIssue(issueId).find((e) => e.type === "checks.completed");
+    assert.equal(JSON.parse(completed.payloadJson ?? "{}").reason, "none_with_workflow");
+});
+/** NOT-354: records every base-sync invocation and answers from `respond`. */
+function recordingConflictSync(respond) {
+    const calls = [];
+    return {
+        calls,
+        sync: async (call) => {
+            calls.push(call);
+            return respond(call, calls.length);
+        },
+    };
+}
+async function withShortDeferralBackoff(fn) {
+    const prevBase = process.env.DECK_OUTAGE_BACKOFF_BASE_MS;
+    const prevMax = process.env.DECK_OUTAGE_BACKOFF_MAX_MS;
+    process.env.DECK_OUTAGE_BACKOFF_BASE_MS = "10";
+    process.env.DECK_OUTAGE_BACKOFF_MAX_MS = "10";
+    try {
+        await fn();
+    }
+    finally {
+        if (prevBase === undefined)
+            delete process.env.DECK_OUTAGE_BACKOFF_BASE_MS;
+        else
+            process.env.DECK_OUTAGE_BACKOFF_BASE_MS = prevBase;
+        if (prevMax === undefined)
+            delete process.env.DECK_OUTAGE_BACKOFF_MAX_MS;
+        else
+            process.env.DECK_OUTAGE_BACKOFF_MAX_MS = prevMax;
+    }
+}
+for (const state of ["UNKNOWN", "MERGEABLE"]) {
+    test(`NOT-354: none + pull_request workflow + ${state} PR keeps the queued CI wait, no base sync`, async () => {
+        const issueId = await makeIssue();
+        const recorder = recordingConflictSync(async () => {
+            throw new Error("a non-conflicting PR must never run the base sync");
+        });
+        registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, {
+            deckCallTool: okDeckCallTool,
+            spawn: commitingSpawn,
+            github: fakeGithub({ checks: "none", pullRequestWorkflow: true, mergeable: state }),
+            conflictSync: recorder.sync,
+        }));
+        startWorkflow(issueId);
+        await pump(1);
+        assert.equal(recorder.calls.length, 0);
+        const issue = getIssue(issueId);
+        assert.equal(issue.status, "developing");
+        assert.match(issue.currentIntent ?? "", /Waiting for CI \(queued\) - no attempt spent/);
+        const deferred = listWorkflowEventsForIssue(issueId).filter((e) => e.type === "worker.deferred");
+        assert.equal(deferred.length, 1);
+        assert.equal(JSON.parse(deferred[0].payloadJson ?? "{}").outcome, "checks_pending");
+        const completed = listWorkflowEventsForIssue(issueId).find((e) => e.type === "checks.completed");
+        assert.equal(JSON.parse(completed.payloadJson ?? "{}").reason, "none_with_workflow");
+    });
+}
+test("NOT-354: none + pull_request workflow + CONFLICTING runs the base sync instead of a queued wait; a clean sync re-polls and hands off", async () => {
+    await withShortDeferralBackoff(async () => {
+        let mergeable = "CONFLICTING";
+        let ci = "none";
+        let spawns = 0;
+        const countingSpawn = async (input) => {
+            spawns++;
+            return commitingSpawn(input);
+        };
+        const issueId = await makeIssue();
+        const branch = issueBranchName(issueId);
+        const recorder = recordingConflictSync(async () => ({ outcome: "synced", headSha: git(remote, "rev-parse", branch) }));
+        registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, {
+            deckCallTool: okDeckCallTool,
+            spawn: countingSpawn,
+            github: fakeGithub({ checks: () => ci, pullRequestWorkflow: true, mergeable: () => mergeable }),
+            conflictSync: recorder.sync,
+        }));
+        startWorkflow(issueId);
+        await pump(1);
+        // The coordinator invoked the NOT-310 sync through its checks-wait entry.
+        assert.equal(recorder.calls.length, 1);
+        const call = recorder.calls[0];
+        assert.equal(call.entry, "checks_wait");
+        assert.equal(call.branch, branch);
+        assert.equal(call.baseBranch, "main");
+        assert.equal(call.repo, repo);
+        assert.equal(call.mergePr, undefined, "the checks-wait entry never merges");
+        assert.match(call.mergeReason, /conflicts with main/);
+        const events = listWorkflowEventsForIssue(issueId);
+        const completed = events.find((e) => e.type === "checks.completed");
+        assert.equal(JSON.parse(completed.payloadJson ?? "{}").reason, "conflicting");
+        const deferred = events.filter((e) => e.type === "worker.deferred");
+        assert.equal(deferred.length, 1, "the synced head waits on a normal CI re-poll");
+        const deferredReason = JSON.parse(deferred[0].payloadJson ?? "{}").reason;
+        assert.doesNotMatch(deferredReason, /Waiting for CI \(queued\)/);
+        assert.match(deferredReason, /Synced main into PR #\d+/);
+        const item = listWorkItemsForIssue(issueId)[0];
+        const payload = JSON.parse(item.payloadJson ?? "{}");
+        assert.equal(payload.publishOnly, true, "the re-poll takes the no-agent publish path");
+        assert.ok(payload.checksWaitStartedAt, "the wait keeps its original ceiling anchor");
+        // GitHub recomputes mergeability on the pushed head and CI runs.
+        await new Promise((resolve) => setTimeout(resolve, 60));
+        mergeable = "MERGEABLE";
+        ci = "success";
+        await pump(1);
+        const issue = getIssue(issueId);
+        assert.equal(issue.status, "reviewing", "the synced head continues to review with no human action");
+        assert.equal(spawns, 1, "the re-poll spawns no agent");
+        assert.equal(recorder.calls.length, 1, "no second sync");
+        assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0);
+        assert.equal(issue.infraAttempts, 0);
+    });
+});
+test("NOT-354: CONFLICTING with an unresolvable conflict queues exactly one conflict-repair round; still conflicting after it escalates once with the files", async () => {
+    const issueId = await makeIssue();
+    const prompts = [];
+    let n = 0;
+    const appendingSpawn = async (input) => {
+        prompts.push(input.prompt);
+        n++;
+        fs.appendFileSync(path.join(input.cwd, "feature.txt"), `round ${n}\n`);
+        git(input.cwd, "add", ".");
+        git(input.cwd, "-c", "user.email=agent@test", "-c", "user.name=Agent", "commit", "-q", "-m", `round ${n}`);
+        return { exitCode: 0, transcript: "Implementation conclusion: done.", logPath: "/dev/null", timedOut: false };
+    };
+    const { runMergeConflictSync } = await import("./merge-conflict-sync.js");
+    // First episode call: the sync hit a textual conflict. Second call: the real
+    // sync, whose episode bound must escalate before touching git.
+    const recorder = recordingConflictSync(async (call, i) => i === 1 ? { outcome: "repair_needed", files: ["shared.txt"] } : runMergeConflictSync(call));
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, {
+        deckCallTool: okDeckCallTool,
+        spawn: appendingSpawn,
+        github: fakeGithub({ checks: "none", pullRequestWorkflow: true, mergeable: "CONFLICTING" }),
+        conflictSync: recorder.sync,
+    }));
+    startWorkflow(issueId);
+    await pump(1);
+    let issue = getIssue(issueId);
+    assert.equal(issue.status, "developing");
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0);
+    const pending = listWorkItemsForIssue(issueId).filter((i) => i.status === "pending");
+    assert.equal(pending.length, 1, "exactly one conflict-repair round");
+    assert.equal(pending[0].kind, "developer");
+    assert.equal(pending[0].round, 2);
+    const payload = JSON.parse(pending[0].payloadJson ?? "{}");
+    assert.deepEqual(payload.conflictRepair, { baseBranch: "main", branch: issueBranchName(issueId), files: ["shared.txt"] });
+    assert.equal(payload.publishOnly, undefined, "the repair round is an agent session, not a re-poll");
+    assert.equal(listWorkflowEventsForIssue(issueId).filter((e) => e.type === "worker.deferred").length, 0, "a conflicting PR never defers as a CI wait");
+    await pump(1);
+    assert.equal(prompts.length, 2);
+    assert.ok(prompts[1].includes("main"), "repair prompt names the base");
+    assert.ok(prompts[1].includes("shared.txt"), "repair prompt names the conflicting files");
+    issue = getIssue(issueId);
+    assert.equal(issue.status, "needs_human");
+    assert.equal(recorder.calls.length, 2);
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.status === "pending").length, 0);
+    const open = listHumanActionsForIssue(issueId).filter((a) => a.status === "open");
+    assert.equal(open.length, 1, "escalates exactly once");
+    assert.equal(open[0].actionType, "policy_escalation");
+    assert.match(open[0].reason, /shared\.txt/);
+    assert.match(open[0].reason, /conflicts with main/);
+    assert.doesNotMatch(open[0].reason, /Auto-merge failed/);
+    const evidence = JSON.parse(open[0].evidenceJson);
+    assert.deepEqual(evidence.conflictingFiles, ["shared.txt"]);
+    assert.equal(evidence.mergeFailure, undefined, "a pre-review conflict offers no retry_merge");
+    await pump(1);
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 1, "no repeat escalation");
+});
+test("NOT-311: past CHECKS_WAIT_CEILING_MS the wait escalates naming the PR and head SHA", async () => {
+    // A zero ceiling makes the very first wait already past it — no clock to inject,
+    // no sleeping: the deferral reports escalated and a policy_escalation lands.
+    const prev = process.env.CHECKS_WAIT_CEILING_MS;
+    process.env.CHECKS_WAIT_CEILING_MS = "0";
+    try {
+        const issueId = await makeIssue();
+        registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: commitingSpawn, github: fakeGithub({ checks: "pending" }) }));
+        startWorkflow(issueId);
+        await pump(1);
+        const issue = getIssue(issueId);
+        assert.equal(issue.status, "needs_human");
+        assert.equal(issue.infraAttempts, 0, "a ceiling escalation spends no infra attempt");
+        const actions = listHumanActionsForIssue(issueId).filter((a) => a.status === "open");
+        assert.equal(actions.length, 1);
+        assert.equal(actions[0].actionType, "policy_escalation");
+        // The wait never hands off, so the issue row carries no PR/SHA — the milestone
+        // and the human action do.
+        const completed = listWorkflowEventsForIssue(issueId).find((e) => e.type === "checks.completed");
+        assert.ok(completed);
+        const msPayload = JSON.parse(completed.payloadJson ?? "{}");
+        assert.equal(msPayload.reason, "pending_ceiling");
+        assert.ok(msPayload.prNumber, "the milestone names the PR");
+        assert.ok(msPayload.headSha, "the milestone names the head SHA");
+        assert.match(actions[0].reason, new RegExp(`CI did not complete on ${msPayload.headSha}`));
+        assert.match(actions[0].reason, new RegExp(`PR #${msPayload.prNumber}`));
+    }
+    finally {
+        if (prev === undefined)
+            delete process.env.CHECKS_WAIT_CEILING_MS;
+        else
+            process.env.CHECKS_WAIT_CEILING_MS = prev;
+    }
 });
 test("NOT-255: a non-draft PR with otherwise-verified identity hands off cleanly (just-failed retry_merge)", async () => {
     // A merge-failure escalation is reachable from `retry_merge`, which undrafts the PR
@@ -2079,7 +2405,9 @@ test("NOT-252: checks_failed enriches checks_evidence and the retry prompt with
     registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: evolvingSpawn, github }));
     startWorkflow(issueId);
     await pump(1);
-    assert.equal(getIssue(issueId).status, "developing", "enriched checks_failed still retries on the infra budget");
+    assert.equal(getIssue(issueId).status, "developing", "enriched checks_failed still retries on the CI budget");
+    assert.equal(getIssue(issueId).ciAttempts, 1, "the enriched retry spends ci_attempts");
+    assert.equal(getIssue(issueId).infraAttempts, 0, "the enriched retry leaves infra_attempts alone");
     const evidence = listArtifactsForIssue(issueId).find((a) => a.kind === "checks_evidence");
     assert.ok(evidence, "enriched checks_failed persists checks_evidence");
     const content = JSON.parse(evidence.contentJson);
@@ -2138,3 +2466,132 @@ test("NOT-252: publish-only retry on checks_failed enriches evidence and the nex
     assert.match(prompts[1], /publish-checks/);
     assert.match(prompts[1], /is not in this registry/);
 });
+test("NOT-313: three CI repair attempts then a CI-specific escalation — infra_attempts stays 0", async () => {
+    // Exit-predicate loop: the CI budget (default 3) buys three repair attempts;
+    // the fourth consecutive checks_failed escalates with a CI-specific reason.
+    const issueId = await makeIssue();
+    const prompts = [];
+    let call = 0;
+    const evolvingSpawn = async (input) => {
+        call++;
+        prompts.push(input.prompt);
+        fs.writeFileSync(path.join(input.cwd, "feature.txt"), `implemented attempt ${call}\n`);
+        git(input.cwd, "add", ".");
+        git(input.cwd, "-c", "user.email=agent@test", "-c", "user.name=Agent", "commit", "-q", "-m", `implement ${call}`);
+        return { exitCode: 0, transcript: "Implementation conclusion: added the widget.", logPath: "/dev/null", timedOut: false };
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: evolvingSpawn, github: fakeGithub({ checks: "failure" }) }));
+    startWorkflow(issueId);
+    await pump(1); // failure #1 → CI repair attempt 1
+    assert.equal(getIssue(issueId).status, "developing");
+    assert.equal(getIssue(issueId).ciAttempts, 1);
+    assert.equal(getIssue(issueId).infraAttempts, 0);
+    await pump(1); // failure #2 → CI repair attempt 2
+    assert.equal(getIssue(issueId).status, "developing");
+    assert.equal(getIssue(issueId).ciAttempts, 2);
+    assert.equal(getIssue(issueId).infraAttempts, 0);
+    assert.match(prompts[1], /CI repair attempt 1 of 3/);
+    await pump(1); // failure #3 → CI repair attempt 3
+    assert.equal(getIssue(issueId).status, "developing");
+    assert.equal(getIssue(issueId).ciAttempts, 3);
+    assert.equal(getIssue(issueId).infraAttempts, 0);
+    assert.match(prompts[2], /CI repair attempt 2 of 3/);
+    await pump(1); // failure #4 → budget spent → escalate
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "needs_human");
+    assert.equal(issue.ciAttempts, 3, "the escalation itself spends no further CI attempt");
+    assert.equal(issue.infraAttempts, 0, "four CI failures never touched the infra budget");
+    assert.match(prompts[3], /CI repair attempt 3 of 3/);
+    const action = listHumanActionsForIssue(issueId).find((a) => a.status === "open");
+    assert.ok(action, "the exhausted CI budget raises a human action");
+    assert.equal(action.actionType, "policy_escalation");
+    assert.match(action.reason, /CI checks still failing after 3 repair attempts \(limit 3\)/);
+    assert.doesNotMatch(action.reason, /infra-attempt limit reached/);
+});
+test("NOT-315: a failing dependency install is a worktree-setup failure with the stderr tail — the session is not spawned", async () => {
+    // Hermetic repo: the shared fixture carries no package.json (so the step would skip
+    // before the runner is ever invoked), so this test cuts its own repo + remote whose
+    // main tip declares npm dependencies — the fresh worktree then really triggers the install.
+    const npmRepo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-deveff-npm-repo-"));
+    const npmRemote = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-deveff-npm-remote-"));
+    try {
+        git(npmRepo, "init", "-q", "-b", "main");
+        git(npmRepo, "config", "user.email", "test@example.com");
+        git(npmRepo, "config", "user.name", "Test");
+        fs.writeFileSync(path.join(npmRepo, "README.md"), "hello\n");
+        fs.writeFileSync(path.join(npmRepo, "package.json"), JSON.stringify({ name: "wt", version: "1.0.0" }));
+        fs.writeFileSync(path.join(npmRepo, "package-lock.json"), JSON.stringify({ name: "wt", lockfileVersion: 3, packages: {} }));
+        git(npmRepo, "add", ".");
+        git(npmRepo, "commit", "-q", "-m", "init");
+        execFileSync("git", ["init", "-q", "--bare", "-b", "main", npmRemote]);
+        git(npmRepo, "remote", "add", "origin", npmRemote);
+        git(npmRepo, "push", "-q", "origin", "main");
+        const devAgent = createAgent({ name: `dev-${Math.random()}`, runtime: "claude_code", deckId: "00000000-0000-4000-a000-000000000099" });
+        const revAgent = createAgent({ name: `rev-${Math.random()}`, runtime: "claude_code", deckId: "00000000-0000-4000-a000-000000000099" });
+        const issueId = createIssue({
+            title: "Add widget",
+            description: "Build the widget.",
+            acceptanceCriteria: "Widget renders.",
+            repo: npmRepo,
+            baseBranch: "main",
+            developerAgentId: devAgent.id,
+            reviewerAgentId: revAgent.id,
+            maxReviewRounds: 3,
+            maxInfraAttempts: 3,
+            source: "manual"
+        }).id;
+        let spawnCalls = 0;
+        const neverSpawn = async () => {
+            spawnCalls++;
+            return { exitCode: 0, transcript: "", logPath: "/dev/null", timedOut: false };
+        };
+        let depsCalls = 0;
+        const failingDeps = async () => {
+            depsCalls++;
+            const err = new Error("npm ci exited");
+            err.stderr = "npm error code EAI_AGAIN\nnpm error registry unreachable (sandbox has no network)\n";
+            throw err;
+        };
+        registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: neverSpawn, github: fakeGithub(), depsRunner: failingDeps }));
+        startWorkflow(issueId);
+        await pump(1);
+        assert.equal(depsCalls, 1, "the worktree declares npm deps, so the install must run exactly once");
+        assert.equal(spawnCalls, 0, "the session must not spawn when dependency provisioning fails");
+        const issue = getIssue(issueId);
+        assert.equal(issue.status, "developing", "adapter_failure retries on the infra budget");
+        const dev = listWorkerSessionsForIssue(issueId).find((s) => s.role === "developer");
+        // adapter_failure never spawned, so the session row goes terminal (done) with the
+        // setup failure recorded as its reason — like every other adapter_failure.
+        assert.ok(dev.status === "done" || dev.status === "failed", `terminal session, got ${dev.status}`);
+        const reason = JSON.parse(dev.errorJson ?? "{}").reason ?? dev.errorJson ?? "";
+        assert.match(reason, /worktree setup failed/);
+        assert.match(reason, /dependency install failed: /);
+        assert.match(reason, /registry unreachable/);
+    }
+    finally {
+        fs.rmSync(npmRepo, { recursive: true, force: true });
+        fs.rmSync(npmRemote, { recursive: true, force: true });
+    }
+});
+test("NOT-315: a skipped dependency install still emits worktree.deps_ready with ran/skipped and durationMs", async () => {
+    // The fixture repo carries no package.json, so the step skips (no package.json) and
+    // the fake runner is never called — the milestone must still record the skip.
+    const issueId = await makeIssue();
+    let depsCalls = 0;
+    const countingDeps = async () => {
+        depsCalls++;
+        return { stdout: "", stderr: "" };
+    };
+    registerEffectHandler("developer", (ctx) => runDeveloperEffect(ctx, { deckCallTool: okDeckCallTool, spawn: commitingSpawn, github: fakeGithub(), depsRunner: countingDeps }));
+    startWorkflow(issueId);
+    await pump(1);
+    assert.equal(getIssue(issueId).status, "reviewing", "a skipped install must not block handoff");
+    assert.equal(depsCalls, 0, "no package.json means the runner is never invoked");
+    const { listWorkflowEventsForIssue: listEvents } = await import("../repository/workflow-events.js");
+    const depsEvent = listEvents(issueId).find((e) => e.type === "worktree.deps_ready");
+    assert.ok(depsEvent, "expected a worktree.deps_ready milestone");
+    const payload = JSON.parse(depsEvent.payloadJson);
+    assert.equal(payload.ran, false);
+    assert.match(String(payload.reason ?? ""), /no package\.json/);
+    assert.ok(typeof payload.durationMs === "number" && payload.durationMs >= 0);
+});

package/bundle/server/dist/coordinator/human-resolution.js

@@ -82,6 +82,7 @@ const VALID_CHOICES = {
     // below and the only legal resolver is commands.ts's dedicated muse_capability branch
     // (acknowledge records a per-version override; there is no workflow outcome to map).
     muse_capability: ["acknowledge"],
+    operator_verification: ["verified", "waive", "repair"],
 };
 /**
  * Validates a raw (actionType, choice) pair against that action type's allowed response
@@ -114,6 +115,16 @@ export function parseHumanResolution(actionType, choice, note) {
     if (actionType === "product_scope_decision" && note) {
         return { actionType, choice, note };
     }
+    // NOT-314: operator_verification always carries a required non-empty note (the
+    // recorded result, the waiver reason, or the repair instruction). A missing or
+    // blank note is a caller error — resolveHumanActionAndAdvance 400s, never stores.
+    if (actionType === "operator_verification") {
+        if (!VALID_CHOICES.operator_verification.includes(choice))
+            return null;
+        if (!note || !note.trim())
+            return null;
+        return { actionType, choice, note: note.trim() };
+    }
     return { actionType, choice };
 }
 /**
@@ -164,6 +175,14 @@ export function resolveHumanActionOutcome(resolution) {
             throw new Error(`Unrecognized policy_escalation choice: ${resolution.choice}`);
         case "product_scope_decision":
             return { issueStatus: "developing", startNewRound: true, roundKind: "none" };
+        case "operator_verification":
+            // NOT-314: `repair` is a genuine repair cycle (same shape as
+            // final_review:repair). `verified` / `waive` never reach here — the sync
+            // core parks them for undraft+merge before consulting this outcome map
+            // (same as policy_escalation:retry_merge).
+            if (resolution.choice === "repair")
+                return { issueStatus: "repairing", startNewRound: true, roundKind: "review" };
+            throw new Error(`Unrecognized operator_verification choice: ${resolution.choice}`);
         case "deck_interaction_required":
             // Same semantics as policy_escalation:resume — an authority/control-plane hiccup is
             // not a review-round spend; a fresh attempt mints its own new authority when it runs.

package/bundle/server/dist/coordinator/human-resolution.test.js

@@ -82,3 +82,36 @@ test("deck_interaction_required close ends the issue", () => {
     assert.equal(result.issueStatus, "closed");
     assert.equal(result.workflowOutcome, "closed");
 });
+// NOT-314: operator_verification parses only with a non-empty note.
+test("parseHumanResolution accepts operator_verification choices only with a note", () => {
+    assert.deepStrictEqual(parseHumanResolution("operator_verification", "verified", "SSO login OK"), {
+        actionType: "operator_verification",
+        choice: "verified",
+        note: "SSO login OK",
+    });
+    assert.deepStrictEqual(parseHumanResolution("operator_verification", "waive", "  waiver reason  "), {
+        actionType: "operator_verification",
+        choice: "waive",
+        note: "waiver reason",
+    });
+    assert.deepStrictEqual(parseHumanResolution("operator_verification", "repair", "fix the probe"), {
+        actionType: "operator_verification",
+        choice: "repair",
+        note: "fix the probe",
+    });
+    assert.equal(parseHumanResolution("operator_verification", "verified"), null);
+    assert.equal(parseHumanResolution("operator_verification", "verified", ""), null);
+    assert.equal(parseHumanResolution("operator_verification", "verified", "   "), null);
+    assert.equal(parseHumanResolution("operator_verification", "merge", "a note"), null);
+});
+test("operator_verification repair queues another repair round; verified/waive never map here", () => {
+    const result = resolveHumanActionOutcome({
+        actionType: "operator_verification",
+        choice: "repair",
+        note: "fix the probe",
+    });
+    assert.equal(result.issueStatus, "repairing");
+    assert.equal(result.startNewRound, true);
+    assert.equal(result.roundKind, "review");
+    assert.throws(() => resolveHumanActionOutcome({ actionType: "operator_verification", choice: "verified", note: "ok" }), /Unrecognized operator_verification choice/);
+});