agent-dealer 1.2.8 → 1.2.9

package/bundle/server/dist/coordinator/routing.js

@@ -1,4 +1,5 @@
 // packages/server/src/coordinator/routing.ts
+import { DEFAULT_MAX_CI_ATTEMPTS } from "@agent-dealer/shared";
 import { normalizeReviewerResult } from "./reviewer-result.js";
 /** Default N for NOT-147: escalate empty-tip timeout/crash after this many failures (one auto-retry). */
 export const DEFAULT_NO_PROGRESS_INFRA_ATTEMPTS = 2;
@@ -14,6 +15,13 @@ function roundsRemain(limits) {
 export function infraAttemptsRemain(limits) {
     return limits.infraAttempts < limits.maxInfraAttempts;
 }
+/**
+ * NOT-313: the one definition of "is there CI-repair budget left", mirroring
+ * {@link infraAttemptsRemain}. Absent counters read as a fresh default budget.
+ */
+export function ciAttemptsRemain(limits) {
+    return (limits.ciAttempts ?? 0) < (limits.maxCiAttempts ?? DEFAULT_MAX_CI_ATTEMPTS);
+}
 export function routeDeveloperOutcome(outcome, limits) {
     switch (outcome.kind) {
         case "clean_handoff":
@@ -103,7 +111,6 @@ export function routeDeveloperOutcome(outcome, limits) {
                 : { next: "human_action", actionType: "policy_escalation", reason: `${reason} (infra-attempt limit reached).` };
         }
         case "no_pr":
-        case "checks_failed":
         case "deck_failure": {
             // Unified infra-failure policy: the session/environment failed to produce a
             // reviewable result at all — bounded auto-retry on max_infra_attempts, decoupled
@@ -113,6 +120,30 @@ export function routeDeveloperOutcome(outcome, limits) {
                 ? { next: "retry_developer", reason }
                 : { next: "human_action", actionType: "policy_escalation", reason: `${reason} (infra-attempt limit reached).` };
         }
+        case "checks_failed": {
+            // NOT-313: a failing CI check is the expected feedback loop, not an
+            // infrastructure failure — bounded on max_ci_attempts, never the infra
+            // budget. The retry reason names the attempt number so the next session's
+            // prompt reads "CI repair attempt N of M"; the escalation names the same
+            // count plus the failing checks (via the NOT-252 enrichment), never the
+            // infra-attempt text. policy_escalation (not attempts_exhausted) so a human
+            // "resume" resets budgets without spending a review round.
+            const spent = limits.ciAttempts ?? 0;
+            const max = limits.maxCiAttempts ?? DEFAULT_MAX_CI_ATTEMPTS;
+            const base = checksFailedDetails(outcome);
+            if (ciAttemptsRemain(limits)) {
+                return {
+                    next: "retry_developer",
+                    reason: `CI repair attempt ${spent + 1} of ${max}: ${base}`,
+                    budget: "ci",
+                };
+            }
+            return {
+                next: "human_action",
+                actionType: "policy_escalation",
+                reason: `CI checks still failing after ${spent} repair attempts (limit ${max}). ${base}`,
+            };
+        }
         case "session_failed":
         case "timed_out": {
             // Same infra budget as above, plus NOT-147: empty tip after N timeout/crashes → human
@@ -140,6 +171,11 @@ export function routeDeveloperOutcome(outcome, limits) {
             // NOT-197: a hard-down network is not retryable on the infra-attempt timescale, and
             // nothing was spawned, so there is no attempt to charge. Wait for the network instead.
             return { next: "defer_work", reason: outcome.reason };
+        case "checks_pending":
+            // NOT-311: slow or not-yet-registered CI is not a developer failure — the
+            // session ended cleanly with a pushed branch and an open PR. Wait on backoff
+            // and re-poll; the deferral path (not this route) enforces the wait ceiling.
+            return { next: "defer_work", reason: outcome.reason };
     }
 }
 function infraFailureReason(outcome) {
@@ -150,17 +186,20 @@ function infraFailureReason(outcome) {
             return outcome.reason ?? "Developer session failed or crashed.";
         case "timed_out":
             return outcome.reason ?? "Developer session timed out.";
-        case "checks_failed":
-            // NOT-252: prefer the sanitized enrichment the effect threaded into `details`
-            // (failing check names + bounded untrusted excerpt at the verified head SHA).
-            // Blank/absent details keep today's exact generic reason.
-            return outcome.details?.trim() ? outcome.details : "Developer's PR checks failed.";
         case "adapter_failure":
             return `Git/GitHub verification failed: ${outcome.reason}`;
         case "deck_failure":
             return `Agent Deck ${outcome.reason}`;
     }
 }
+/**
+ * NOT-252: prefer the sanitized enrichment the effect threaded into `details`
+ * (failing check names + bounded untrusted excerpt at the verified head SHA).
+ * Blank/absent details keep the exact generic reason.
+ */
+function checksFailedDetails(outcome) {
+    return outcome.details?.trim() ? outcome.details : "Developer's PR checks failed.";
+}
 /**
  * NOT-147: when a timeout/crash left the branch with zero commits ahead of base, stop
  * burning full agent spawns after N failures (default 2 = one auto-retry). Only trips when

package/bundle/server/dist/coordinator/routing.test.js

@@ -4,6 +4,10 @@ import assert from "node:assert/strict";
 import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 const REVIEW_ROUNDS_LEFT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 0, maxInfraAttempts: 3 };
 const REVIEW_AT_LIMIT = { currentRound: 3, maxReviewRounds: 3, infraAttempts: 0, maxInfraAttempts: 3 };
+// NOT-313: CI-repair budget fixtures — infra counters stay at 0/3 throughout so
+// every CI test below also proves the infra budget is untouched, and vice versa.
+const CI_BUDGET_LEFT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 0, maxInfraAttempts: 3, ciAttempts: 1, maxCiAttempts: 3 };
+const CI_AT_LIMIT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 0, maxInfraAttempts: 3, ciAttempts: 3, maxCiAttempts: 3 };
 const INFRA_ATTEMPTS_LEFT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 1, maxInfraAttempts: 3 };
 const INFRA_AT_LIMIT = { currentRound: 1, maxReviewRounds: 3, infraAttempts: 3, maxInfraAttempts: 3 };
 const PINNED_HEAD = "pinned-head-sha";
@@ -181,6 +185,24 @@ test("a failed base fetch defers instead of spending an infra attempt (NOT-197)"
         });
     }
 });
+test("pending CI defers instead of spending an infra attempt (NOT-311)", () => {
+    const outcome = {
+        kind: "checks_pending",
+        reason: "Waiting for CI (running) - no attempt spent",
+        branch: "issue-1",
+        prNumber: 7,
+        headSha: "abc123",
+        waitStartedAt: new Date(0).toISOString(),
+    };
+    // Even with the infra budget already exhausted it waits — the session ended
+    // cleanly, so there is no failure to charge and no review handoff to make.
+    for (const limits of [INFRA_ATTEMPTS_LEFT, INFRA_AT_LIMIT]) {
+        assert.deepStrictEqual(routeDeveloperOutcome(outcome, limits), {
+            next: "defer_work",
+            reason: "Waiting for CI (running) - no attempt spent",
+        });
+    }
+});
 test("adapter failure after push retries publish only (no full developer session)", () => {
     const outcome = {
         kind: "adapter_failure",
@@ -230,43 +252,67 @@ test("NOT-307: an idle-watchdog timed_out routes exactly like a wall-clock timeo
     assert.deepStrictEqual(routeDeveloperOutcome({ kind: "timed_out" }, INFRA_AT_LIMIT).next, "human_action");
     assert.deepStrictEqual(routeDeveloperOutcome(outcome, INFRA_AT_LIMIT).next, "human_action");
 });
-test("checks_failed with infra attempts remaining retries (same bucket as session_failed/no_pr)", () => {
+test("NOT-313: checks_failed retries on the CI budget with the attempt number, not the infra bucket", () => {
     const outcome = { kind: "checks_failed" };
-    assert.deepStrictEqual(routeDeveloperOutcome(outcome, INFRA_ATTEMPTS_LEFT), {
+    assert.deepStrictEqual(routeDeveloperOutcome(outcome, REVIEW_ROUNDS_LEFT), {
+        next: "retry_developer",
+        reason: "CI repair attempt 1 of 3: Developer's PR checks failed.",
+        budget: "ci",
+    });
+    // One CI attempt already spent → the next retry is attempt 2, infra untouched.
+    assert.deepStrictEqual(routeDeveloperOutcome(outcome, CI_BUDGET_LEFT), {
         next: "retry_developer",
-        reason: "Developer's PR checks failed.",
+        reason: "CI repair attempt 2 of 3: Developer's PR checks failed.",
+        budget: "ci",
     });
 });
 test("NOT-252: checks_failed with enrichment details retries with the enriched reason, not the generic one", () => {
     const details = "Developer's PR checks failed at abc123: build.\nFailed checks (PR #7 @ abc123):\n- build (CI · failure)";
     const outcome = { kind: "checks_failed", details };
-    assert.deepStrictEqual(routeDeveloperOutcome(outcome, INFRA_ATTEMPTS_LEFT), {
+    assert.deepStrictEqual(routeDeveloperOutcome(outcome, CI_BUDGET_LEFT), {
         next: "retry_developer",
-        reason: details,
+        reason: `CI repair attempt 2 of 3: ${details}`,
+        budget: "ci",
     });
 });
 test("NOT-252: checks_failed with blank details falls back to exactly the generic reason", () => {
     for (const outcome of [{ kind: "checks_failed", details: "   " }, { kind: "checks_failed" }]) {
-        assert.deepStrictEqual(routeDeveloperOutcome(outcome, INFRA_ATTEMPTS_LEFT), {
+        assert.deepStrictEqual(routeDeveloperOutcome(outcome, CI_BUDGET_LEFT), {
             next: "retry_developer",
-            reason: "Developer's PR checks failed.",
+            reason: "CI repair attempt 2 of 3: Developer's PR checks failed.",
+            budget: "ci",
         });
     }
 });
-test("checks_failed at the infra-attempt limit escalates", () => {
+test("NOT-313: checks_failed at the CI limit escalates with a CI-specific reason, infra budget untouched", () => {
     const outcome = { kind: "checks_failed" };
-    const result = routeDeveloperOutcome(outcome, INFRA_AT_LIMIT);
+    const result = routeDeveloperOutcome(outcome, CI_AT_LIMIT);
     assert.equal(result.next, "human_action");
     assert.equal(result.actionType, "policy_escalation");
+    const reason = result.reason;
+    assert.match(reason, /CI checks still failing after 3 repair attempts \(limit 3\)/);
+    assert.doesNotMatch(reason, /infra-attempt limit reached/);
 });
-test("NOT-252: checks_failed escalation at the limit carries the enriched reason", () => {
+test("NOT-252: checks_failed escalation at the limit carries the failing check names", () => {
     const details = "Developer's PR checks failed at abc123: build.";
     const outcome = { kind: "checks_failed", details };
-    const result = routeDeveloperOutcome(outcome, INFRA_AT_LIMIT);
+    const result = routeDeveloperOutcome(outcome, CI_AT_LIMIT);
     assert.equal(result.next, "human_action");
     assert.equal(result.actionType, "policy_escalation");
+    assert.match(result.reason, /CI checks still failing after 3 repair attempts \(limit 3\)/);
     assert.match(result.reason, /at abc123: build/);
-    assert.match(result.reason, /infra-attempt limit reached/);
+    assert.doesNotMatch(result.reason, /infra-attempt limit reached/);
+});
+test("NOT-313: the budgets are independent — CI failures ignore the infra limit and infra failures ignore the CI limit", () => {
+    // An exhausted infra budget does not stop CI repair while CI budget remains.
+    const ciRetry = routeDeveloperOutcome({ kind: "checks_failed" }, INFRA_AT_LIMIT);
+    assert.equal(ciRetry.next, "retry_developer");
+    // An exhausted CI budget does not stop infra retries while infra budget remains.
+    for (const outcome of [{ kind: "session_failed" }, { kind: "timed_out" }, { kind: "no_pr" }]) {
+        const infraRetry = routeDeveloperOutcome(outcome, { ...CI_AT_LIMIT, infraAttempts: 1 });
+        assert.equal(infraRetry.next, "retry_developer", outcome.kind);
+        assert.ok(!("budget" in infraRetry) || infraRetry.budget === undefined);
+    }
 });
 test("an infra-class developer failure never spends the review-round budget, even at the review-round limit", () => {
     const outcome = { kind: "session_failed" };
@@ -462,10 +508,11 @@ test("NOT-147: tip with commits ahead still auto-retries under existing infra bu
     }
 });
 test("NOT-147: no_pr / checks_failed are unaffected by the empty-tip gate (timeout/crash only)", () => {
-    // Even with infraAttempts already spent and zero progress implied, non-crash infra
-    // failures keep the pre-NOT-147 budget-only policy.
+    // Even with attempts already spent and zero progress implied, non-crash failures
+    // keep the pre-NOT-147 budget-only policy — no_pr on the infra budget,
+    // checks_failed on its own CI budget (NOT-313).
     assert.equal(routeDeveloperOutcome({ kind: "no_pr" }, INFRA_ATTEMPTS_LEFT).next, "retry_developer");
-    assert.equal(routeDeveloperOutcome({ kind: "checks_failed" }, INFRA_ATTEMPTS_LEFT).next, "retry_developer");
+    assert.equal(routeDeveloperOutcome({ kind: "checks_failed" }, CI_BUDGET_LEFT).next, "retry_developer");
 });
 test("NOT-147: noProgressInfraAttempts is tunable (N=1 escalates on first empty-tip crash)", () => {
     const limits = { ...REVIEW_ROUNDS_LEFT, noProgressInfraAttempts: 1 };

package/bundle/server/dist/coordinator/usage-cap-defer.js

@@ -15,6 +15,7 @@ import { deferWorkItem, getWorkItem } from "../repository/work-items.js";
 import { getWorkerSession } from "../repository/worker-sessions.js";
 import { deckOutageBackoffMs, deckOutageProlongedAfterMs } from "./deck-outage-config.js";
 import { usageCapDeferralCeilingMs } from "./usage-cap-config.js";
+import { checksWaitCeilingExceeded } from "./checks-wait-config.js";
 import { workerSessionPayload } from "./session-progress.js";
 const roleFor = {
     developer: "developer",
@@ -255,6 +256,66 @@ export function deferLeasedWorkItemForAgentUnhealthy(item, leaseToken, unhealthy
         });
     })();
 }
+export function checksWaitDeferralStartedAt(payload) {
+    const v = payload.checksWaitStartedAt;
+    return typeof v === "string" && v ? v : null;
+}
+/** How many times this item has already waited on CI — drives the backoff curve. */
+export function checksWaitDeferralCount(payload) {
+    const v = payload.checksWaitDeferrals;
+    return typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.floor(v) : 0;
+}
+/**
+ * NOT-311: CI was still pending when the poll timed out, so nothing about the work
+ * was proven or disproven. The item waits on the deck-outage backoff and re-polls —
+ * no infra attempt, and the claim-time attempt_count bump is reverted, exactly like a
+ * deck outage. Unlike an outage this wait has a ceiling: past it the deferral
+ * reports `escalated` so the caller raises a human action naming the stuck PR/SHA.
+ *
+ * The re-queued payload carries `publishOnly` + `branch` so the next run takes the
+ * no-agent publish path (push-if-behind, PR verify, re-poll) instead of spawning a
+ * fresh developer session to redo committed work.
+ */
+export function deferLeasedWorkItemForChecksPending(item, leaseToken, pending, issue, instance, nowMs = Date.now()) {
+    return getDb().transaction(() => {
+        const live = liveLeasedItem(item.id, leaseToken);
+        if (!live)
+            return { deferred: false, escalated: false, reason: "lease_lost" };
+        const payload = parsePayload(live.payloadJson);
+        const firstDeferredAt = checksWaitDeferralStartedAt(payload) ?? pending.waitStartedAt ?? new Date(nowMs).toISOString();
+        if (checksWaitCeilingExceeded(firstDeferredAt, nowMs)) {
+            return { deferred: false, escalated: true };
+        }
+        const priorDeferrals = checksWaitDeferralCount(payload);
+        const until = new Date(nowMs + deckOutageBackoffMs(priorDeferrals)).toISOString();
+        return applyDeferral(live, leaseToken, issue, instance, {
+            until,
+            reason: pending.reason,
+            outcome: "checks_pending",
+            error: {
+                kind: "checks_pending",
+                until,
+                reason: pending.reason,
+                branch: pending.branch,
+                prNumber: pending.prNumber,
+                headSha: pending.headSha,
+            },
+            payloadJson: JSON.stringify({
+                ...payload,
+                publishOnly: true,
+                branch: pending.branch,
+                checksWaitStartedAt: firstDeferredAt,
+                checksWaitDeferrals: priorDeferrals + 1,
+            }),
+            intent: (_role, untilLabel) => `${pending.reason} (retrying ${untilLabel})`,
+        });
+    })();
+}
+/** NOT-311: ceiling escalation reason — names the PR and the head SHA CI never proved. */
+export function formatChecksWaitEscalationReason(pending, firstDeferredAt) {
+    return (`CI did not complete on ${pending.headSha} (PR #${pending.prNumber}, branch ${pending.branch}) — ` +
+        `waiting since ${firstDeferredAt}. ${pending.reason}`);
+}
 export function formatCapEscalationReason(cap, firstDeferredAt) {
     const hours = Math.round(usageCapDeferralCeilingMs() / 3_600_000);
     return `${cap.reason} Work deferred for over ${hours}h (since ${firstDeferredAt}).`;

package/bundle/server/dist/db/ci-attempts-migration.test.js

@@ -0,0 +1,70 @@
+// NOT-313: the CI-repair budget columns are added by separate `ALTER TABLE`
+// statements, each guarded on its own presence (same lesson as the
+// worker_sessions liveness columns in worker-session-pid-migration.test.ts): a
+// kill between the two ALTERs must still repair on the next migrate().
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-ci-migrate-"));
+const { migrate, getDb } = await import("./index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue, getIssue } = await import("../repository/issues.js");
+const CI_COLS = ["ci_attempts", "max_ci_attempts"]; // sorted: ciCols() sorts
+const ciCols = () => getDb().prepare("PRAGMA table_info(issues)").all()
+    .map((c) => c.name)
+    .filter((c) => CI_COLS.includes(c))
+    .sort();
+function newIssueId() {
+    return createIssue({
+        title: "T",
+        repo: "/r",
+        baseBranch: "main",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+    }).id;
+}
+test("migrate() adds both CI-budget columns to a DB that predates them, keeping every row", () => {
+    migrate();
+    const before = newIssueId();
+    const rowCount = getDb().prepare("SELECT COUNT(*) AS c FROM issues").get().c;
+    // A DB created before NOT-313.
+    getDb().exec("ALTER TABLE issues DROP COLUMN max_ci_attempts");
+    getDb().exec("ALTER TABLE issues DROP COLUMN ci_attempts");
+    assert.deepStrictEqual(ciCols(), []);
+    migrate();
+    assert.deepStrictEqual(ciCols(), CI_COLS);
+    // All rows survive with the defaults.
+    assert.equal(getDb().prepare("SELECT COUNT(*) AS c FROM issues").get().c, rowCount);
+    const reread = getDb()
+        .prepare("SELECT max_ci_attempts, ci_attempts FROM issues WHERE id = ?")
+        .get(before);
+    assert.equal(reread.max_ci_attempts, 3);
+    assert.equal(reread.ci_attempts, 0);
+    // The repository maps the backfilled columns, and new issues open with a full budget.
+    const issue = getIssue(before);
+    assert.equal(issue.maxCiAttempts, 3);
+    assert.equal(issue.ciAttempts, 0);
+    const fresh = getIssue(newIssueId());
+    assert.equal(fresh.maxCiAttempts, 3);
+    assert.equal(fresh.ciAttempts, 0);
+});
+test("migrate() repairs a half-applied CI upgrade instead of skipping it forever", () => {
+    migrate();
+    // Exactly the partial state a crash between the two ALTERs leaves behind.
+    getDb().exec("ALTER TABLE issues DROP COLUMN ci_attempts");
+    assert.deepStrictEqual(ciCols(), ["max_ci_attempts"]);
+    migrate();
+    assert.deepStrictEqual(ciCols(), CI_COLS, "the missing column is added");
+    assert.doesNotThrow(() => newIssueId(), "issue inserts name the restored column");
+});
+test("migrate() is idempotent once both CI columns are present", () => {
+    migrate();
+    migrate();
+    assert.deepStrictEqual(ciCols(), CI_COLS);
+    assert.doesNotThrow(() => newIssueId());
+});

package/bundle/server/dist/db/index.js

@@ -251,6 +251,19 @@ export function migrate() {
         db.exec("ALTER TABLE issues ADD COLUMN max_infra_attempts INTEGER NOT NULL DEFAULT 3");
         db.exec("ALTER TABLE issues ADD COLUMN infra_attempts INTEGER NOT NULL DEFAULT 0");
     }
+    // NOT-313: CI-repair budget, separate from the infra-attempt budget above — a
+    // failing CI check is the expected feedback loop, not a crash/timeout/adapter
+    // failure, so `checks_failed` spends `ci_attempts` (bounded by
+    // `max_ci_attempts`) and never touches `infra_attempts`. Each column is guarded
+    // on its OWN presence (see the worker_sessions liveness comment above): the two
+    // ALTERs commit separately, so a kill between them must still repair on retry.
+    const issueColsForCi = db.prepare("PRAGMA table_info(issues)").all();
+    if (!issueColsForCi.some((c) => c.name === "max_ci_attempts")) {
+        db.exec("ALTER TABLE issues ADD COLUMN max_ci_attempts INTEGER NOT NULL DEFAULT 3");
+    }
+    if (!issueColsForCi.some((c) => c.name === "ci_attempts")) {
+        db.exec("ALTER TABLE issues ADD COLUMN ci_attempts INTEGER NOT NULL DEFAULT 0");
+    }
     // NOT-102: per-issue auto-merge after reviewer approve (kick UI defaults on; existing
     // rows stay off so in-flight workflows keep the human final_review path).
     const issueColsForAutoMerge = db.prepare("PRAGMA table_info(issues)").all();

package/bundle/server/dist/db/schema.sql

@@ -114,6 +114,8 @@ CREATE TABLE IF NOT EXISTS issues (
   current_round INTEGER NOT NULL DEFAULT 1,
   max_infra_attempts INTEGER NOT NULL DEFAULT 3,
   infra_attempts INTEGER NOT NULL DEFAULT 0,
+  max_ci_attempts INTEGER NOT NULL DEFAULT 3,
+  ci_attempts INTEGER NOT NULL DEFAULT 0,
   branch TEXT,
   base_sha TEXT,
   head_sha TEXT,

package/bundle/server/dist/repository/issues.js

@@ -1,4 +1,4 @@
-import { canTransitionIssue, compileExecutionContract, CreateIssueInput, looksLikeLocalRepoPath, parseGitHubRepoInput, resolveIssueContractFields, tryCompileContract, TERMINAL_ISSUE_STATUSES, } from "@agent-dealer/shared";
+import { canTransitionIssue, compileExecutionContract, CreateIssueInput, DEFAULT_MAX_CI_ATTEMPTS, looksLikeLocalRepoPath, parseGitHubRepoInput, resolveIssueContractFields, tryCompileContract, TERMINAL_ISSUE_STATUSES, } from "@agent-dealer/shared";
 import { v4 as uuid } from "uuid";
 import { getDb } from "../db/index.js";
 function rowToIssue(row) {
@@ -27,6 +27,8 @@ function rowToIssue(row) {
         currentRound: row.current_round,
         maxInfraAttempts: row.max_infra_attempts,
         infraAttempts: row.infra_attempts,
+        maxCiAttempts: row.max_ci_attempts ?? DEFAULT_MAX_CI_ATTEMPTS,
+        ciAttempts: row.ci_attempts ?? 0,
         branch: row.branch,
         baseSha: row.base_sha,
         headSha: row.head_sha,
@@ -83,6 +85,10 @@ export function createIssue(raw) {
         current_round: 1,
         max_infra_attempts: input.maxInfraAttempts,
         infra_attempts: 0,
+        // NOT-313: no per-ticket config (stays out of CreateIssueInput) — every new
+        // issue opens with the full default CI-repair budget, unspent.
+        max_ci_attempts: DEFAULT_MAX_CI_ATTEMPTS,
+        ci_attempts: 0,
         branch: null,
         base_sha: null,
         head_sha: null,
@@ -97,13 +103,13 @@ export function createIssue(raw) {
       id, source, external_id, external_label, external_url, title, description,
       acceptance_criteria, repo, base_branch, status, current_owner, current_intent,
       developer_agent_id, reviewer_agent_id, max_review_rounds, current_round,
-      max_infra_attempts, infra_attempts,
+      max_infra_attempts, infra_attempts, max_ci_attempts, ci_attempts,
       branch, base_sha, head_sha, pr_number, pr_url, auto_merge, created_at, updated_at
     ) VALUES (
       @id, @source, @external_id, @external_label, @external_url, @title, @description,
       @acceptance_criteria, @repo, @base_branch, @status, @current_owner, @current_intent,
       @developer_agent_id, @reviewer_agent_id, @max_review_rounds, @current_round,
-      @max_infra_attempts, @infra_attempts,
+      @max_infra_attempts, @infra_attempts, @max_ci_attempts, @ci_attempts,
       @branch, @base_sha, @head_sha, @pr_number, @pr_url, @auto_merge, @created_at, @updated_at
     )
   `).run(row);
@@ -374,6 +380,21 @@ export function incrementIssueInfraAttempts(id) {
         throw new Error(`Issue vanished: ${id}`);
     return updated;
 }
+/** NOT-313: spends one CI-repair attempt — a `checks_failed` being retried
+ * automatically. Never touches `infra_attempts`; see incrementIssueInfraAttempts. */
+export function incrementIssueCiAttempts(id) {
+    const current = getIssue(id);
+    if (!current)
+        throw new Error(`Issue not found: ${id}`);
+    const now = new Date().toISOString();
+    getDb()
+        .prepare("UPDATE issues SET ci_attempts = ci_attempts + 1, updated_at = ? WHERE id = ?")
+        .run(now, id);
+    const updated = getIssue(id);
+    if (!updated)
+        throw new Error(`Issue vanished: ${id}`);
+    return updated;
+}
 /** A human resuming past a `policy_escalation` gets a fresh infra-attempt budget. */
 export function resetIssueInfraAttempts(id) {
     const current = getIssue(id);
@@ -388,6 +409,21 @@ export function resetIssueInfraAttempts(id) {
         throw new Error(`Issue vanished: ${id}`);
     return updated;
 }
+/** NOT-313: a human resuming past a CI-checks `policy_escalation` gets a fresh
+ * CI-repair budget alongside the infra one (commands.ts resets both together). */
+export function resetIssueCiAttempts(id) {
+    const current = getIssue(id);
+    if (!current)
+        throw new Error(`Issue not found: ${id}`);
+    const now = new Date().toISOString();
+    getDb()
+        .prepare("UPDATE issues SET ci_attempts = 0, updated_at = ? WHERE id = ?")
+        .run(now, id);
+    const updated = getIssue(id);
+    if (!updated)
+        throw new Error(`Issue vanished: ${id}`);
+    return updated;
+}
 /** `attempts_exhausted:retry` grants one more review round instead of instantly
  * re-exhausting: bumps current_round AND max_review_rounds together. */
 export function grantReviewRetry(id) {

package/bundle/server/dist/repository/work-items.js

@@ -97,6 +97,13 @@ export function getWorkItem(id) {
     const row = getDb().prepare("SELECT * FROM work_items WHERE id = ?").get(id);
     return row ? rowToWorkItem(row) : null;
 }
+/** Finds the row a retried enqueue would dedupe against (null when the key is unused). */
+export function getWorkItemByIdempotencyKey(idempotencyKey) {
+    const row = getDb()
+        .prepare("SELECT * FROM work_items WHERE idempotency_key = ?")
+        .get(idempotencyKey);
+    return row ? rowToWorkItem(row) : null;
+}
 export function listWorkItemsForIssue(issueId) {
     const rows = getDb()
         .prepare("SELECT * FROM work_items WHERE issue_id = ? ORDER BY created_at ASC")

package/bundle/server/dist/runners/muse-code-args.js

@@ -3,6 +3,31 @@
 // no per-attempt XDG dirs, no settings.json — those belong to the coordinator wiring (NOT-181).
 // Reviewer argv, resume and cancellation are out of scope.
 export const MUSE_COMMAND = "muse";
+/**
+ * NOT-316: what the Muse developer sandbox cannot do, derived from the real
+ * launch flags in `buildMuseDeveloperInvocation` below. The developer prompt's
+ * "Environment limits" section is rendered from this constant (not hand-written
+ * prose), and `muse-code-args.test.ts` asserts the pairing — changing
+ * `--sandbox-network` without updating this constant fails a test.
+ *
+ * Live probe results behind these values: under `restricted` there is no DNS
+ * (npm registry and GitHub API unreachable) and loopback `listen()` fails with
+ * EPERM; under `proxy-only` network works through a local proxy but `listen()`
+ * still fails; under `enabled` both work. No headless browser or
+ * credentials/Keychain are provisioned into the developer session.
+ */
+export const MUSE_SANDBOX_CAPABILITIES = {
+    /** Must equal the `--sandbox-network` value passed in the developer argv. */
+    sandboxNetwork: "restricted",
+    /** Effective network access under that sandbox mode. */
+    network: "none",
+    /** Whether loopback `listen()` works. */
+    loopbackListen: false,
+    /** Whether a browser is available for visual QA / screenshots. */
+    browser: false,
+    /** Whether credentials / Keychain are provisioned. */
+    credentialsKeychain: false,
+};
 /** The launcher re-execs a newer binary hourly unless this is set, so the pinned version can drift. */
 export const MUSE_NO_AUTO_UPDATE_ENV = { MUSE_NO_AUTO_UPDATE: "1" };
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/bundle/server/dist/runners/muse-code-args.test.js

@@ -0,0 +1,30 @@
+// packages/server/src/runners/muse-code-args.test.ts
+//
+// NOT-316: `MUSE_SANDBOX_CAPABILITIES` is mechanically tied to the real launch
+// flags — changing `--sandbox-network` without updating the constant fails a test.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { buildMuseDeveloperInvocation, MUSE_SANDBOX_CAPABILITIES, } from "./muse-code-args.js";
+const baseOpts = {
+    model: "muse-spark-1.3-contributor",
+    maxModelSteps: 40,
+    sessionId: "0b6c3f0e-4c2a-4f0e-9d3b-2f6f1a9a7c11",
+    prompt: "Implement NOT-1",
+};
+function sandboxNetworkFlag() {
+    const args = buildMuseDeveloperInvocation(baseOpts).args;
+    const i = args.indexOf("--sandbox-network");
+    assert.notEqual(i, -1, "--sandbox-network must be present in the developer argv");
+    const value = args[i + 1];
+    assert.ok(value, "--sandbox-network must have a value");
+    return value;
+}
+test("NOT-316: MUSE_SANDBOX_CAPABILITIES.sandboxNetwork matches the --sandbox-network flag actually passed", () => {
+    assert.equal(sandboxNetworkFlag(), MUSE_SANDBOX_CAPABILITIES.sandboxNetwork);
+});
+test("NOT-316: sandbox capabilities state the restricted-sandbox limits (no network/listen/browser/credentials)", () => {
+    assert.equal(MUSE_SANDBOX_CAPABILITIES.network, "none");
+    assert.equal(MUSE_SANDBOX_CAPABILITIES.loopbackListen, false);
+    assert.equal(MUSE_SANDBOX_CAPABILITIES.browser, false);
+    assert.equal(MUSE_SANDBOX_CAPABILITIES.credentialsKeychain, false);
+});

package/bundle/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-dealer/server",
-  "version": "1.2.8",
+  "version": "1.2.9",
   "type": "module",
   "main": "dist/index.js",
   "files": [
@@ -22,7 +22,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@agent-dealer/shared": "1.2.8",
+    "@agent-dealer/shared": "1.2.9",
     "@fastify/cors": "^11.0.1",
     "@fastify/static": "^8.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",