agent-dealer 1.2.8 → 1.2.9

package/bundle/server/dist/coordinator/operator-criteria.js

@@ -0,0 +1,168 @@
+// packages/server/src/coordinator/operator-criteria.ts
+//
+// NOT-314: `[operator]`-tagged acceptance criteria are a first-class merge gate.
+// Some ACs can only be proven by a human with real credentials, a real login, or
+// a paid session — the builder discovers this mid-run and today burns rounds
+// before raising a product-scope escalation. Instead the tag is deliberate: the
+// frozen snapshot's operator criteria block auto-merge until a human records the
+// result (verified / waive) or sends the work back (repair).
+//
+// This module is pure except for the frozen-snapshot + verification-record
+// readers at the bottom. The gate itself lives in auto-merge.ts
+// (finalizeAutoMergeOnce, after reviewer approve, before the `gh` merge);
+// resolution lives in commands.ts's resolveHumanActionAndAdvance.
+import { latestIssueArtifact } from "../repository/artifacts.js";
+import { listArtifactsForIssueByKind } from "../repository/artifacts-for-issue.js";
+import { listWorkflowEventsForIssue } from "../repository/workflow-events.js";
+/** The frozen snapshot artifact kind — same string as commands.ts's
+ * TASK_SNAPSHOT_ARTIFACT_KIND, repeated here so this module never imports the
+ * coordinator kernel (commands.ts imports auto-merge.ts, which imports this). */
+const TASK_SNAPSHOT_KIND = "task_snapshot";
+/** Issue artifact kind holding a recorded `verified` result (author human). */
+export const OPERATOR_VERIFICATION_ARTIFACT_KIND = "operator_verification";
+/**
+ * NOT-314: the stored response options for an `operator_verification` action.
+ * Shared by auto-merge.ts (which raises it) and commands.ts's responseOptionsFor
+ * so the two can never drift apart — same pattern as MERGE_FAILURE_RESPONSE_OPTIONS.
+ */
+export const OPERATOR_VERIFICATION_RESPONSE_OPTIONS = [
+    { choice: "verified", label: "Verified — merge" },
+    { choice: "waive", label: "Waive — merge without it" },
+    { choice: "repair", label: "Another repair round" },
+];
+/** Dedupe key for the gate's action: one open action per issue + head SHA. */
+export function operatorVerificationRequestId(headSha) {
+    return `operator-verification:${headSha}`;
+}
+const OPERATOR_TAG_RE = /\[operator\]/i;
+/** An indented checkbox (a nested sub-task) — never a command, never a gate. */
+const INDENTED_CHECKBOX_RE = /^\s+[-*]\s*\[[ xX]?\]/;
+/** An indented plain bullet — an evidence/command sub-bullet. */
+const INDENTED_BULLET_RE = /^\s+[-*]\s+(.*)$/;
+/**
+ * Returns each top-level (unindented) checkbox AC whose text contains the token
+ * `[operator]` (case-insensitive, anywhere in the line), together with the
+ * indented bullet lines directly under it (the command to run).
+ *
+ * "Top-level" means the checkbox marker starts at column 0; indented
+ * checkboxes (sub-tasks) never open the gate. Collection of a criterion's
+ * commands stops at the next column-0 checkbox, a non-bullet line, or EOF —
+ * blank lines inside the sub-bullet block are skipped, not terminators.
+ */
+export function extractOperatorCriteria(acceptanceCriteria) {
+    const found = [];
+    const lines = acceptanceCriteria.split("\n");
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        const top = line.match(/^[-*]\s*\[[ xX]?\]\s*(.*)$/);
+        if (top && OPERATOR_TAG_RE.test(top[1] ?? "")) {
+            const criterion = { text: (top[1] ?? "").trim(), commands: [] };
+            i += 1;
+            while (i < lines.length) {
+                const sub = lines[i];
+                if (/^\s*$/.test(sub)) {
+                    i += 1;
+                    continue;
+                }
+                // A column-0 checkbox ends this criterion's block (operator or not —
+                // the outer loop classifies it).
+                if (/^[-*]\s*\[[ xX]?\]\s*/.test(sub))
+                    break;
+                // A nested (indented) checkbox is a sub-task, not a command — it ends
+                // the block without being collected.
+                if (INDENTED_CHECKBOX_RE.test(sub))
+                    break;
+                const bullet = sub.match(INDENTED_BULLET_RE);
+                if (bullet) {
+                    criterion.commands.push((bullet[1] ?? "").trim());
+                    i += 1;
+                    continue;
+                }
+                break;
+            }
+            found.push(criterion);
+            continue;
+        }
+        i += 1;
+    }
+    return found;
+}
+/** The frozen snapshot's acceptanceCriteria, falling back to the live issue
+ * fields for items queued before snapshots existed (same fallback as
+ * commands.ts's getTaskSnapshot). */
+export function snapshotAcceptanceCriteria(issue) {
+    try {
+        const artifact = latestIssueArtifact(issue.id, TASK_SNAPSHOT_KIND);
+        if (artifact?.contentJson) {
+            const parsed = JSON.parse(artifact.contentJson);
+            if (typeof parsed.acceptanceCriteria === "string")
+                return parsed.acceptanceCriteria;
+        }
+    }
+    catch {
+        // fall through to the live-field fallback below
+    }
+    return issue.acceptanceCriteria ?? "";
+}
+/** The frozen snapshot's `[operator]` criteria for this issue ([] when none). */
+export function getOperatorCriteriaForIssue(issue) {
+    return extractOperatorCriteria(snapshotAcceptanceCriteria(issue));
+}
+function recordHeadSha(record) {
+    return record && typeof record.headSha === "string" && record.headSha ? record.headSha : null;
+}
+/**
+ * True when the human already recorded a result for exactly `headSha`: either a
+ * `verified` artifact (kind `operator_verification`, author human) or a
+ * `operator_verification.waived` workflow event. A result pins the head it was
+ * recorded at — new commits re-block the gate.
+ */
+export function hasOperatorVerificationForHead(issueId, headSha) {
+    if (!headSha)
+        return false;
+    try {
+        for (const artifact of listArtifactsForIssueByKind(issueId, OPERATOR_VERIFICATION_ARTIFACT_KIND)) {
+            if (!artifact.contentJson)
+                continue;
+            try {
+                const record = JSON.parse(artifact.contentJson);
+                if (recordHeadSha(record) === headSha)
+                    return true;
+            }
+            catch {
+                // unreadable artifact content cannot prove verification
+            }
+        }
+    }
+    catch {
+        // a read failure fails closed below (no verification found → gate blocks)
+    }
+    try {
+        for (const event of listWorkflowEventsForIssue(issueId)) {
+            if (event.type !== "operator_verification.waived" || !event.payloadJson)
+                continue;
+            try {
+                const record = JSON.parse(event.payloadJson);
+                if (recordHeadSha(record) === headSha)
+                    return true;
+            }
+            catch {
+                // unreadable payload cannot prove a waiver
+            }
+        }
+    }
+    catch {
+        // same fail-closed reasoning as above
+    }
+    return false;
+}
+/** One numbered criterion + its commands, for the gate's reason/question. */
+export function formatOperatorCriteria(criteria) {
+    return criteria.flatMap((criterion, index) => {
+        const lines = [`${index + 1}. ${criterion.text}`];
+        for (const command of criterion.commands)
+            lines.push(`   - ${command}`);
+        return lines;
+    });
+}

package/bundle/server/dist/coordinator/operator-criteria.test.js

@@ -0,0 +1,78 @@
+// NOT-314: `[operator]` criterion parser — pure cases (no DB).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { extractOperatorCriteria } from "./operator-criteria.js";
+test("two [operator] ACs return both; the indented command sub-bullet is collected", () => {
+    const criteria = extractOperatorCriteria([
+        "- [ ] Agent can list sessions from the registry",
+        "- [ ] Operator can sign in with SSO and see the org dashboard [operator]",
+        "  - `npm run probe:sso -- --env staging`",
+        "- [ ] Sessions expire after 30 days of inactivity",
+        "- [ ] Operator can complete a paid checkout in the sandbox [operator]",
+        "",
+        "- [ ] Docs describe the probe",
+    ].join("\n"));
+    assert.equal(criteria.length, 2);
+    assert.equal(criteria[0].text, "Operator can sign in with SSO and see the org dashboard [operator]");
+    assert.deepEqual(criteria[0].commands, ["`npm run probe:sso -- --env staging`"]);
+    assert.equal(criteria[1].text, "Operator can complete a paid checkout in the sandbox [operator]");
+    assert.deepEqual(criteria[1].commands, []);
+});
+test("a snapshot with no [operator] AC returns an empty list", () => {
+    assert.deepEqual(extractOperatorCriteria("- [ ] Agent lists sessions\n- [ ] Sessions expire after 30d\n"), []);
+    assert.deepEqual(extractOperatorCriteria(""), []);
+});
+test("tag case variants match: [OPERATOR], [Operator], [oPeRaToR]", () => {
+    const criteria = extractOperatorCriteria(["- [ ] First [OPERATOR]", "- [ ] Second [Operator]", "- [ ] Third [oPeRaToR]"].join("\n"));
+    assert.equal(criteria.length, 3);
+});
+test("tag position variants match: leading, middle, trailing, and bare", () => {
+    const criteria = extractOperatorCriteria([
+        "- [ ] [operator] Leading tag proves login",
+        "- [ ] Middle [operator] tag proves login",
+        "- [ ] Trailing tag proves login [operator]",
+        "- [ ] [operator]",
+    ].join("\n"));
+    assert.equal(criteria.length, 4);
+    assert.equal(criteria[0].text, "[operator] Leading tag proves login");
+});
+test("multiple indented sub-bullets all collect; blank lines inside the block are skipped", () => {
+    const criteria = extractOperatorCriteria([
+        "- [ ] Paid checkout works end to end [operator]",
+        "  - `npm run probe:checkout -- --env staging`",
+        "",
+        "  - see docs/probes/checkout.md for the test card",
+    ].join("\n"));
+    assert.equal(criteria.length, 1);
+    assert.deepEqual(criteria[0].commands, [
+        "`npm run probe:checkout -- --env staging`",
+        "see docs/probes/checkout.md for the test card",
+    ]);
+});
+test("indented (nested) checkboxes never open the gate, even with the tag", () => {
+    const criteria = extractOperatorCriteria(["- [ ] Parent task", "  - [ ] Nested subtask [operator]", "- [ ] Other"].join("\n"));
+    assert.deepEqual(criteria, []);
+});
+test("a checked box with the tag still matches, and `*` markers work", () => {
+    const criteria = extractOperatorCriteria(["* [x] Already proven by hand [operator]", "- [ ] Plain task"].join("\n"));
+    assert.equal(criteria.length, 1);
+    assert.equal(criteria[0].text, "Already proven by hand [operator]");
+});
+test("the next top-level checkbox ends the command block; prose ends it too", () => {
+    const criteria = extractOperatorCriteria([
+        "- [ ] First [operator]",
+        "  - `cmd-one`",
+        "- [ ] Second without tag",
+        "- [ ] Third [operator]",
+        "  - `cmd-three`",
+        "Trailing prose, not a bullet.",
+        "- [ ] Fourth [operator]",
+    ].join("\n"));
+    assert.equal(criteria.length, 3);
+    assert.deepEqual(criteria[0].commands, ["`cmd-one`"]);
+    assert.deepEqual(criteria[1].commands, ["`cmd-three`"]);
+    assert.deepEqual(criteria[2].commands, []);
+});
+test("[agent] in AC text is not an operator criterion", () => {
+    assert.deepEqual(extractOperatorCriteria("- [ ] Agent lists sessions [agent]\n"), []);
+});

package/bundle/server/dist/coordinator/operator-verification.integration.test.js

@@ -0,0 +1,347 @@
+// NOT-314: `[operator]` gate — approved reviews block before merge until a
+// human records the result, then merge on verified/waive and repair on repair.
+// DB-backed (same harness shape as auto-merge.integration.test.ts).
+import { test, before, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not314-"));
+const { migrate, getDb } = await import("../db/index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue, getIssue, updateIssue, transitionIssue } = await import("../repository/issues.js");
+const { listHumanActionsForIssue } = await import("../repository/human-actions.js");
+const { listArtifactsForIssueByKind } = await import("../repository/artifacts-for-issue.js");
+const { listWorkflowEventsForIssue, getActiveWorkflowInstance } = await import("../repository/workflow-events.js");
+const { claimWorkItem, getWorkItem } = await import("../repository/work-items.js");
+const { startWorkflow, applyCompletion, resolveHumanActionAndAdvance, resolveHumanActionAndAdvanceAsync, responseOptionsFor, } = await import("./commands.js");
+const { ReviewerResult } = await import("./reviewer-result.js");
+const { setMergePrForTests, clearFinalizeInflightForTests, finalizeAutoMerge, gateOperatorVerification, OPERATOR_VERIFICATION_INTENT, } = await import("./auto-merge.js");
+const { stubManagedCloneForTests } = await import("../adapters/managed-repo.js");
+const OPERATOR_AC = [
+    "- [ ] Agent can list sessions from the registry",
+    "- [ ] Operator can sign in with SSO and see the org dashboard [operator]",
+    "  - `npm run probe:sso -- --env staging`",
+    "- [ ] Docs describe the probe",
+].join("\n");
+let managedCwd = "";
+before(() => {
+    migrate();
+    managedCwd = stubManagedCloneForTests("acme/app");
+});
+beforeEach(() => {
+    getDb().exec(`
+    DELETE FROM work_items;
+    DELETE FROM human_actions;
+    DELETE FROM workflow_events;
+    DELETE FROM findings;
+    DELETE FROM review_publications;
+    DELETE FROM worker_sessions;
+    DELETE FROM artifacts;
+    DELETE FROM usage_events;
+    DELETE FROM workflow_instances;
+    DELETE FROM issues;
+  `);
+    clearFinalizeInflightForTests();
+    setMergePrForTests(async () => ({ ok: true }));
+});
+afterEach(() => {
+    setMergePrForTests(null);
+    clearFinalizeInflightForTests();
+});
+function newIssue(acceptanceCriteria = OPERATOR_AC) {
+    return createIssue({
+        title: "Coordinate me",
+        description: "d",
+        acceptanceCriteria,
+        repo: "acme/app",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        baseBranch: "main",
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+        autoMerge: true,
+    }).id;
+}
+function claim(issueId) {
+    const item = claimWorkItem(`test-${issueId}`, { leaseMs: 60_000 });
+    assert.ok(item && item.issueId === issueId, "expected to lease this issue's work item");
+    return item;
+}
+const okReview = ReviewerResult.parse({
+    verdict: "approved",
+    baseSha: "b",
+    headSha: "h",
+    acceptanceCriteriaAssessment: "ok",
+    evidenceAssessment: "ok",
+    findings: [],
+    risks: [],
+});
+const cleanHandoff = {
+    kind: "clean_handoff",
+    branch: "issue-1",
+    headSha: "abc123",
+    baseSha: "base1",
+    prNumber: 42,
+    prUrl: "https://gh/pr/42",
+};
+/** Developer handoff + approved review with autoMerge on (routes into finalize). */
+async function approve(issueId, handoff = cleanHandoff) {
+    const dev = claim(issueId);
+    await applyCompletion(dev.id, dev.leaseToken, handoff);
+    const rev = claim(issueId);
+    return applyCompletion(rev.id, rev.leaseToken, { kind: "verdict", result: okReview });
+}
+function openOperatorAction(issueId) {
+    const action = listHumanActionsForIssue(issueId).find((a) => a.actionType === "operator_verification" && a.status === "open");
+    assert.ok(action, "expected an open operator_verification action");
+    return action;
+}
+test("approved review with an [operator] AC raises operator_verification and never merges", async () => {
+    const calls = [];
+    setMergePrForTests(async (opts) => {
+        calls.push(opts);
+        return { ok: true };
+    });
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    const result = await approve(issueId);
+    assert.equal(result.applied, true);
+    if (result.applied)
+        assert.equal(result.issueStatus, "needs_human");
+    assert.equal(calls.length, 0, "the merge adapter must not run behind the gate");
+    const issue = getIssue(issueId);
+    assert.equal(issue.status, "needs_human");
+    assert.equal(issue.currentOwner, "human");
+    assert.equal(issue.currentIntent, OPERATOR_VERIFICATION_INTENT);
+    assert.ok(getActiveWorkflowInstance(issueId), "workflow stays active for the human decision");
+    const action = openOperatorAction(issueId);
+    assert.match(action.question, /sign in with SSO/);
+    assert.match(action.question, /npm run probe:sso -- --env staging/);
+    const evidence = JSON.parse(action.evidenceJson);
+    assert.equal(evidence.operatorVerification.headSha, "abc123");
+    assert.equal(evidence.operatorVerification.criteria.length, 1);
+    assert.deepEqual(evidence.operatorVerification.criteria[0].commands, [
+        "`npm run probe:sso -- --env staging`",
+    ]);
+    const options = JSON.parse(action.responseOptionsJson);
+    assert.deepEqual(options.map((o) => o.choice), ["verified", "waive", "repair"]);
+});
+test("a second finalize for the same head reuses the open action — still no merge", async () => {
+    let merges = 0;
+    setMergePrForTests(async () => {
+        merges += 1;
+        return { ok: true };
+    });
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await approve(issueId);
+    const first = openOperatorAction(issueId).id;
+    const again = await finalizeAutoMerge(issueId);
+    assert.equal(again.humanActionId, first);
+    assert.equal(again.issueStatus, "needs_human");
+    assert.equal(merges, 0);
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.actionType === "operator_verification" && a.status === "open").length, 1);
+});
+test("operator criteria with no recorded head SHA escalate instead of merging", async () => {
+    let merges = 0;
+    setMergePrForTests(async () => {
+        merges += 1;
+        return { ok: true };
+    });
+    // Parked for auto-merge with operator criteria but no handoff ever recorded
+    // a head SHA — the gate cannot pin a verification, so it must hold the merge.
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    transitionIssue(issueId, "reviewing", { currentOwner: "system", currentIntent: "test" });
+    transitionIssue(issueId, "final_review", { currentOwner: "system", currentIntent: "review-test" });
+    assert.equal(getIssue(issueId).headSha, null);
+    const blocked = gateOperatorVerification(issueId);
+    assert.ok(blocked, "the gate must hold the merge when no head can be pinned");
+    assert.equal(blocked.issueStatus, "needs_human");
+    assert.ok(blocked.humanActionId);
+    assert.equal(merges, 0);
+    assert.equal(getIssue(issueId).status, "needs_human");
+    const open = listHumanActionsForIssue(issueId).filter((a) => a.status === "open");
+    assert.equal(open.length, 1);
+    assert.equal(open[0].actionType, "policy_escalation");
+    assert.match(open[0].reason, /no head SHA/);
+    // A repeat finalize reuses the open escalation — still no merge, no duplicate.
+    const again = gateOperatorVerification(issueId);
+    assert.ok(again);
+    assert.equal(again.humanActionId, blocked.humanActionId);
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 1);
+    assert.equal(merges, 0);
+});
+test("operator criteria at an unexpected status park the finalize without merging", async () => {
+    let merges = 0;
+    setMergePrForTests(async () => {
+        merges += 1;
+        return { ok: true };
+    });
+    // A racer's finalize while the issue is still reviewing (never parked): the
+    // gate invents no action there, but must not let the merge through either.
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    transitionIssue(issueId, "reviewing", { currentOwner: "system", currentIntent: "test" });
+    const parked = gateOperatorVerification(issueId);
+    assert.ok(parked, "the gate must not let the merge through off-park");
+    assert.equal(parked.issueStatus, "reviewing");
+    assert.equal(parked.humanActionId, null);
+    assert.equal(getIssue(issueId).status, "reviewing");
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0);
+    assert.equal(merges, 0);
+});
+test("no [operator] AC: the existing auto-merge path is unchanged", async () => {
+    const calls = [];
+    setMergePrForTests(async (opts) => {
+        calls.push(opts);
+        return { ok: true };
+    });
+    const issueId = newIssue("It works");
+    startWorkflow(issueId);
+    const result = await approve(issueId);
+    assert.equal(result.applied, true);
+    if (result.applied) {
+        assert.equal(result.issueStatus, "done");
+        assert.equal(result.instanceCompleted, true);
+    }
+    assert.deepEqual(calls, [{ cwd: managedCwd, number: 42 }]);
+    assert.equal(getIssue(issueId).status, "done");
+});
+test("the gate reads the frozen snapshot, not live edits after start", async () => {
+    const calls = [];
+    setMergePrForTests(async (opts) => {
+        calls.push(opts);
+        return { ok: true };
+    });
+    const issueId = newIssue("It works");
+    startWorkflow(issueId);
+    updateIssue(issueId, { acceptanceCriteria: OPERATOR_AC });
+    await approve(issueId);
+    assert.equal(getIssue(issueId).status, "done", "a tag added after freeze must not gate");
+    assert.equal(calls.length, 1);
+});
+test("verified with a note stores the artifact and merges", async () => {
+    const calls = [];
+    setMergePrForTests(async (opts) => {
+        calls.push(opts);
+        return { ok: true };
+    });
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await approve(issueId);
+    const action = openOperatorAction(issueId);
+    const resolved = await resolveHumanActionAndAdvanceAsync(action.id, "op", "verified", {
+        note: "SSO login OK — org dashboard listed 3 orgs (probe output pasted).",
+    });
+    assert.equal(resolved.ok, true);
+    if (resolved.ok) {
+        assert.equal(resolved.issueStatus, "done");
+        assert.equal(resolved.instanceCompleted, true);
+        assert.equal(resolved.triggerReflect, true);
+    }
+    assert.deepEqual(calls, [{ cwd: managedCwd, number: 42 }]);
+    assert.equal(getIssue(issueId).status, "done");
+    const stored = listArtifactsForIssueByKind(issueId, "operator_verification");
+    assert.equal(stored.length, 1);
+    assert.equal(stored[0].author, "human");
+    const content = JSON.parse(stored[0].contentJson);
+    assert.equal(content.headSha, "abc123");
+    assert.match(content.note, /SSO login OK/);
+    assert.equal(content.verifiedBy, "op");
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0);
+});
+test("waive with a note records the waiver event and merges", async () => {
+    const calls = [];
+    setMergePrForTests(async (opts) => {
+        calls.push(opts);
+        return { ok: true };
+    });
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await approve(issueId);
+    const action = openOperatorAction(issueId);
+    const resolved = await resolveHumanActionAndAdvanceAsync(action.id, "op", "waive", {
+        note: "Staging SSO is down today; shipping behind the flag, will verify tomorrow.",
+    });
+    assert.equal(resolved.ok, true);
+    if (resolved.ok)
+        assert.equal(resolved.issueStatus, "done");
+    assert.equal(calls.length, 1);
+    assert.equal(getIssue(issueId).status, "done");
+    const waived = listWorkflowEventsForIssue(issueId).filter((e) => e.type === "operator_verification.waived");
+    assert.equal(waived.length, 1);
+    const payload = JSON.parse(waived[0].payloadJson);
+    assert.equal(payload.headSha, "abc123");
+    assert.match(payload.note, /Staging SSO is down/);
+});
+test("repair starts a repair round, threads the note, and a new head re-blocks the gate", async () => {
+    const calls = [];
+    setMergePrForTests(async (opts) => {
+        calls.push(opts);
+        return { ok: true };
+    });
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await approve(issueId);
+    const first = openOperatorAction(issueId);
+    const repaired = resolveHumanActionAndAdvance(first.id, "op", "repair", {
+        note: "The probe 404s — its path moved; fix the script and the doc.",
+    });
+    assert.equal(repaired.ok, true);
+    if (repaired.ok) {
+        assert.equal(repaired.issueStatus, "repairing");
+        assert.ok(repaired.nextWorkItemId, "a repair round must be queued");
+    }
+    assert.equal(calls.length, 0, "repair must not merge");
+    const next = getWorkItem(repaired.ok ? repaired.nextWorkItemId : "");
+    assert.ok(next, "expected the queued repair work item");
+    const repairPayload = JSON.parse(next.payloadJson);
+    assert.equal(repairPayload.operatorRepairNote, "The probe 404s — its path moved; fix the script and the doc.");
+    // The repair round ships a new head; approving it must gate again on the new SHA.
+    const secondHandoff = { ...cleanHandoff, headSha: "new999" };
+    await approve(issueId, secondHandoff);
+    assert.equal(calls.length, 0, "the new head must not merge unverified");
+    const second = openOperatorAction(issueId);
+    assert.notEqual(second.id, first.id, "a moved head gets a fresh gate action");
+    const evidence = JSON.parse(second.evidenceJson);
+    assert.equal(evidence.operatorVerification.headSha, "new999");
+});
+test("an empty note is rejected with 400 for every choice and leaves the action open", () => {
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    return approve(issueId).then(() => {
+        const action = openOperatorAction(issueId);
+        for (const choice of ["verified", "waive", "repair"]) {
+            for (const note of [undefined, "", "   "]) {
+                const result = resolveHumanActionAndAdvance(action.id, "op", choice, { note });
+                assert.equal(result.ok, false);
+                if (!result.ok)
+                    assert.equal(result.code, 400, `${choice} with empty note must 400`);
+            }
+        }
+        assert.equal(openOperatorAction(issueId).id, action.id, "the action must stay open");
+    });
+});
+test("an unknown choice on operator_verification is rejected with 400", () => {
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    return approve(issueId).then(() => {
+        const action = openOperatorAction(issueId);
+        const result = resolveHumanActionAndAdvance(action.id, "op", "merge", {
+            note: "has a note but wrong choice",
+        });
+        assert.equal(result.ok, false);
+        if (!result.ok)
+            assert.equal(result.code, 400);
+    });
+});
+test("responseOptionsFor(operator_verification) matches the gate's stored options", () => {
+    assert.deepEqual(responseOptionsFor("operator_verification"), [
+        { choice: "verified", label: "Verified — merge" },
+        { choice: "waive", label: "Waive — merge without it" },
+        { choice: "repair", label: "Another repair round" },
+    ]);
+});

package/bundle/server/dist/coordinator/playbook-feedback.js

@@ -302,6 +302,9 @@ const CORRECTION_CHOICES = {
     policy_escalation: ["resume", "repair", "retry_merge"],
     product_scope_decision: ["resume"],
     deck_interaction_required: ["resume"],
+    // NOT-314: an operator_verification repair sends the work back like any
+    // other repair round; verified/waive accept the work (no correction signal).
+    operator_verification: ["repair"],
 };
 function resolutionChoice(resolutionJson) {
     if (!resolutionJson)

package/bundle/server/dist/coordinator/projection.js

@@ -14,19 +14,25 @@ export function projectDeveloperRoute(route, currentStatus, round) {
                 effect: { kind: "enqueue", workItem: "reviewer", atHeadSha: route.headSha },
                 advance: "none",
             };
-        case "retry_developer":
+        case "retry_developer": {
+            // NOT-313: a CI-repair retry spends the CI budget, never the infra one —
+            // the route's budget marker (set only by the checks_failed path) decides.
+            const isCiRepair = route.budget === "ci";
             return {
                 projection: {
                     // developing → developing and repairing → repairing are both self-loops;
-                    // an infra-retry developer failure stays in "repairing".
+                    // a retried developer failure stays in "repairing".
                     issueStatus: currentStatus === "repairing" ? "repairing" : "developing",
                     currentOwner: "developer",
-                    currentIntent: `Developer retrying (infra attempt) — ${route.reason}`,
+                    currentIntent: isCiRepair
+                        ? `Developer retrying (CI repair attempt) — ${route.reason}`
+                        : `Developer retrying (infra attempt) — ${route.reason}`,
                     events: ["worker.failed"],
                 },
                 effect: { kind: "enqueue", workItem: "developer", retryReason: route.reason },
-                advance: "infra",
+                advance: isCiRepair ? "ci" : "infra",
             };
+        }
         case "retry_publish":
             return {
                 projection: {

package/bundle/server/dist/coordinator/projection.test.js

@@ -119,6 +119,19 @@ test("infra-class retries — including a stale re-review — spend the infra bu
     const stale = projectReviewerRoute(routeReviewerOutcome({ kind: "stale", currentHeadSha: "new" }, REVIEW_ROUNDS_LEFT, PINNED_HEAD), 1, false);
     assert.equal(stale.advance, "infra");
 });
+test("NOT-313: a checks_failed retry spends the CI budget, never the infra one", () => {
+    const ciRetry = projectDeveloperRoute(routeDeveloperOutcome({ kind: "checks_failed" }, REVIEW_ROUNDS_LEFT), "developing", 1);
+    assert.equal(ciRetry.advance, "ci");
+    assert.deepStrictEqual(ciRetry.effect, {
+        kind: "enqueue",
+        workItem: "developer",
+        retryReason: "CI repair attempt 1 of 3: Developer's PR checks failed.",
+    });
+    assert.match(ciRetry.projection.currentIntent, /CI repair attempt/);
+    // An infra-class retry keeps the exact pre-NOT-313 shape — no budget marker.
+    const infraRetry = projectDeveloperRoute(routeDeveloperOutcome({ kind: "session_failed" }, REVIEW_ROUNDS_LEFT), "developing", 1);
+    assert.equal(infraRetry.advance, "infra");
+});
 test("NOT-147: empty-tip no-progress escalation projects to needs_human without spending infra budget", () => {
     const INFRA_ATTEMPTS_LEFT = {
         currentRound: 1,