agent-dealer 1.3.3 → 1.3.4

package/bundle/server/dist/coordinator/commands.js

@@ -32,7 +32,7 @@ import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 import { projectDeveloperRoute, projectReviewerRoute } from "./projection.js";
 import { MERGE_CONFLICT_FILES_EVIDENCE_KEY, MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS, PUSH_DIVERGENCE_EVIDENCE_KEY, PUSH_DIVERGENCE_RESPONSE_OPTIONS, WORKTREE_BLOCKER_EVIDENCE_KEY, normalizeResolutionNote, parseHumanResolution, resolveHumanActionOutcome, } from "./human-resolution.js";
 import { AUTH_TRANSIENT_RETRY_PAYLOAD_KEY, RUNTIME_AUTH_PARK_EVIDENCE_KEY, authProbeConfirmsFailure, defaultRemediationForRuntime, gateRuntimeAuthParkResume, parseRuntimeAuthParkEvidence, remediationFromProbe, } from "./runtime-auth-park.js";
-import { AUTO_MERGE_INTENT, finalizeAutoMerge } from "./auto-merge.js";
+import { AUTO_MERGE_INTENT, OPERATOR_VERIFICATION_INTENT, finalizeAutoMerge } from "./auto-merge.js";
 import { triggerLinearPostMerge } from "./linear-merge-verify.js";
 import { conflictRepairSpent, queueConflictRepairRound } from "./merge-conflict-sync.js";
 import { OPERATOR_VERIFICATION_ARTIFACT_KIND, OPERATOR_VERIFICATION_RESPONSE_OPTIONS, } from "./operator-criteria.js";
@@ -261,6 +261,84 @@ export function applyParkedEdit(issueId, patch) {
         throw err;
     }
 }
+export function autoMergePolicyEditability(issue) {
+    switch (issue.status) {
+        case "ready":
+            return { editable: true, reason: null };
+        case "developing":
+        case "reviewing":
+        case "repairing":
+            return getActiveWorkflowInstance(issue.id)
+                ? { editable: true, reason: null }
+                : { editable: false, reason: "No active workflow is running for this issue." };
+        case "needs_human": {
+            const open = listHumanActionsForIssue(issue.id).filter((a) => a.status === "open");
+            // The operator-verification gate runs after approval routing: resolving it continues
+            // the already-committed merge path, so the policy is locked while it is open.
+            if (issue.currentIntent === OPERATOR_VERIFICATION_INTENT ||
+                open.some((a) => a.actionType === "operator_verification")) {
+                return {
+                    editable: false,
+                    reason: "The reviewer approved and the merge decision is committed — it waits only on operator verification.",
+                };
+            }
+            // Merge-failure parks, including the no-head operator-verification escalation.
+            if (open.some((a) => a.actionType === "policy_escalation" && isMergeFailureAction(a))) {
+                return {
+                    editable: false,
+                    reason: "The reviewer approved and the merge was already attempted — use the merge-failure action instead.",
+                };
+            }
+            return { editable: true, reason: null };
+        }
+        case "final_review":
+            return {
+                editable: false,
+                reason: issue.currentOwner === "system" && issue.currentIntent === AUTO_MERGE_INTENT
+                    ? "The reviewer approved and auto-merge is already in flight."
+                    : "The reviewer approved and the merge decision is committed — use Merge on the final review action.",
+            };
+        case "done":
+        case "closed":
+            return { editable: false, reason: `The issue is ${issue.status}.` };
+    }
+}
+/**
+ * NOT-490: an `autoMerge`-only update — the one input that may change during a live
+ * round, because nothing reads it until approved-review routing. Guard re-check, row
+ * write and audit run in one SQLite transaction, which serializes against the
+ * reviewer-completion transaction: an update committed first is the value
+ * `applyReviewer` routes on; a reviewer decision committed first moves the issue to
+ * `final_review` and this answers 409, so one approval can never yield both an
+ * auto-merge and a `final_review` action. Queue entry, frozen snapshot, agents,
+ * budgets, branch and PR are untouched (`updateIssue` writes only the policy column
+ * here). A real change appends one `issue.reassigned` event with before/after values
+ * and the actor; a no-op appends nothing.
+ */
+export function applyAutoMergePolicyUpdate(issueId, autoMerge, actor) {
+    return getDb().transaction(() => {
+        const fresh = getIssue(issueId);
+        if (!fresh)
+            return { ok: false, code: 404, error: "Not found" };
+        const editability = autoMergePolicyEditability(fresh);
+        if (!editability.editable) {
+            return { ok: false, code: 409, error: `Auto-merge can no longer be changed: ${editability.reason}` };
+        }
+        if (fresh.autoMerge === autoMerge)
+            return { ok: true, issue: fresh, changed: false };
+        const next = updateIssue(issueId, { autoMerge });
+        appendWorkflowEvent({
+            issueId,
+            workflowInstanceId: getActiveWorkflowInstance(issueId)?.id ?? null,
+            type: "issue.reassigned",
+            actorType: "human",
+            stage: next.status,
+            round: next.currentRound,
+            payload: { fromAutoMerge: fresh.autoMerge, toAutoMerge: next.autoMerge, actor },
+        });
+        return { ok: true, issue: next, changed: true };
+    })();
+}
 /**
  * Stable identity-plus-bytes key for one attachment manifest entry. blobPath is
  * excluded: it is content-addressed from the compared fields under an

package/bundle/server/dist/coordinator/commands.test.js

@@ -42,6 +42,8 @@ function newIssue(opts = {}) {
         baseBranch: "main",
         maxReviewRounds: opts.maxReviewRounds ?? 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/developer-effect.test.js

@@ -89,6 +89,8 @@ async function makeIssue(opts = {}) {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/repair-cycle.integration.test.js

@@ -84,6 +84,8 @@ async function makeIssue() {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/reviewer-effect.test.js

@@ -104,6 +104,8 @@ async function makeIssue(opts = {}) {
         reviewerAgentId: rev.id,
         maxReviewRounds: 3,
         maxInfraAttempts: opts.maxInfraAttempts ?? 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/coordinator/worker-loop.test.js

@@ -51,6 +51,8 @@ function newIssue(maxReviewRounds = 3) {
         baseBranch: "main",
         maxReviewRounds,
         maxInfraAttempts: 3,
+        // NOT-489: omitted now means auto-merge; this suite exercises final human review.
+        autoMerge: false,
         source: "manual"
     }).id;
 }

package/bundle/server/dist/db/auto-merge-default-migration.test.js

@@ -0,0 +1,52 @@
+// NOT-489: a clean install's `issues.auto_merge` column defaults on, while an upgrade
+// never rewrites an existing issue's stored choice — and new creates on the upgraded
+// database still take the shared `CreateIssueInput` default (true), not the column's.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import Database from "better-sqlite3";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-auto-merge-migrate-"));
+const { migrate, getDb } = await import("./index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue, getIssue } = await import("../repository/issues.js");
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const autoMergeDefault = (db) => db.prepare("PRAGMA table_info(issues)").all().find((c) => c.name === "auto_merge").dflt_value;
+const storedAutoMerge = (id) => getDb().prepare("SELECT auto_merge FROM issues WHERE id = ?").get(id).auto_merge;
+function newIssueId(autoMerge) {
+    return createIssue({
+        title: "T",
+        repo: "github.com/acme/app",
+        baseBranch: "main",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+        ...(autoMerge === undefined ? {} : { autoMerge }),
+    }).id;
+}
+test("a clean schema defaults auto_merge on", () => {
+    const db = new Database(":memory:");
+    db.exec(fs.readFileSync(path.join(__dirname, "schema.sql"), "utf8"));
+    assert.equal(autoMergeDefault(db), "1");
+});
+test("upgrading preserves every stored auto_merge value; post-upgrade omitted-field creates still get true", () => {
+    migrate();
+    const optedOut = newIssueId(false);
+    const optedIn = newIssueId(true);
+    // An upgraded database whose column predates NOT-489 (still DEFAULT 0).
+    getDb().exec("ALTER TABLE issues DROP COLUMN auto_merge");
+    getDb().exec("ALTER TABLE issues ADD COLUMN auto_merge INTEGER NOT NULL DEFAULT 0");
+    getDb().prepare("UPDATE issues SET auto_merge = 1 WHERE id = ?").run(optedIn);
+    assert.equal(autoMergeDefault(getDb()), "0");
+    migrate();
+    assert.equal(storedAutoMerge(optedOut), 0, "a pre-existing false row is not rewritten");
+    assert.equal(getIssue(optedOut).autoMerge, false);
+    assert.equal(storedAutoMerge(optedIn), 1);
+    const fresh = newIssueId();
+    assert.equal(storedAutoMerge(fresh), 1, "an omitted-field create on the upgraded DB stores true");
+    assert.equal(getIssue(fresh).autoMerge, true);
+});

package/bundle/server/dist/db/index.js

@@ -264,8 +264,10 @@ export function migrate() {
     if (!issueColsForCi.some((c) => c.name === "ci_attempts")) {
         db.exec("ALTER TABLE issues ADD COLUMN ci_attempts INTEGER NOT NULL DEFAULT 0");
     }
-    // NOT-102: per-issue auto-merge after reviewer approve (kick UI defaults on; existing
-    // rows stay off so in-flight workflows keep the human final_review path).
+    // NOT-102: per-issue auto-merge after reviewer approve. Rows that predate the column
+    // backfill off so in-flight workflows keep the human final_review path. NOT-489: new
+    // creates write the shared `CreateIssueInput` default (true) explicitly, so this
+    // backfill DEFAULT never decides a new issue's policy and stays 0 to preserve old rows.
     const issueColsForAutoMerge = db.prepare("PRAGMA table_info(issues)").all();
     if (!issueColsForAutoMerge.some((c) => c.name === "auto_merge")) {
         db.exec("ALTER TABLE issues ADD COLUMN auto_merge INTEGER NOT NULL DEFAULT 0");

package/bundle/server/dist/db/schema.sql

@@ -121,7 +121,7 @@ CREATE TABLE IF NOT EXISTS issues (
   head_sha TEXT,
   pr_number INTEGER,
   pr_url TEXT,
-  auto_merge INTEGER NOT NULL DEFAULT 0,
+  auto_merge INTEGER NOT NULL DEFAULT 1,
   created_at TEXT NOT NULL,
   updated_at TEXT NOT NULL
 );

package/bundle/server/dist/dev-review-cli-happy-path.integration.test.js

@@ -280,6 +280,8 @@ test("agent-operated CLI: discover profiles, create + start a Dev-review issue,
         "Widget renders.",
         "--base-branch",
         "main",
+        // NOT-489: auto-merge is the default; this walk drives the final-review action.
+        "--no-auto-merge",
     ]));
     const issueId = created.id;
     assert.equal(created.status, "ready");

package/bundle/server/dist/routes/auto-merge-policy.test.js

@@ -0,0 +1,378 @@
+// NOT-490: auto-merge policy changes on queued and in-flight issues — the policy-only
+// PATCH path, its audit event, the frozen-input guard for mixed patches, and the
+// linearization against reviewer-approval routing.
+import { test, before, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import Fastify from "fastify";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not490-"));
+const { migrate, getDb } = await import("../db/index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CODEX_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { registerIssueRoutes } = await import("./issues.js");
+const { createIssue, getIssue } = await import("../repository/issues.js");
+const { listHumanActionsForIssue } = await import("../repository/human-actions.js");
+const { listWorkflowEventsForIssue } = await import("../repository/workflow-events.js");
+const { claimWorkItem } = await import("../repository/work-items.js");
+const { enqueueIssue, getQueuedEntryForIssue, listQueuedEntries } = await import("../repository/queue-entries.js");
+const { queueStatusForIssue, setAdmissionHealthCheckerForTests } = await import("../coordinator/admission.js");
+const { startWorkflow, applyCompletion, getTaskSnapshot } = await import("../coordinator/commands.js");
+const { ReviewerResult } = await import("../coordinator/reviewer-result.js");
+const { setMergePrForTests, clearFinalizeInflightForTests } = await import("../coordinator/auto-merge.js");
+let fixtureRepo = "";
+before(() => {
+    migrate();
+    setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
+    // A real local checkout so the auto-merge finalizer resolves its cwd.
+    fixtureRepo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not490-repo-"));
+    execFileSync("git", ["init", "-b", "main"], { cwd: fixtureRepo });
+    execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: fixtureRepo });
+    execFileSync("git", ["config", "user.name", "Test"], { cwd: fixtureRepo });
+    fs.writeFileSync(path.join(fixtureRepo, "README.md"), "hi\n");
+    execFileSync("git", ["add", "."], { cwd: fixtureRepo });
+    execFileSync("git", ["commit", "-m", "init"], { cwd: fixtureRepo });
+});
+let mergeCalls = 0;
+beforeEach(() => {
+    getDb().exec(`
+    DELETE FROM work_items;
+    DELETE FROM human_actions;
+    DELETE FROM workflow_events;
+    DELETE FROM findings;
+    DELETE FROM review_publications;
+    DELETE FROM worker_sessions;
+    DELETE FROM artifacts;
+    DELETE FROM usage_events;
+    DELETE FROM workflow_instances;
+    DELETE FROM queue_entries;
+    DELETE FROM issues;
+  `);
+    mergeCalls = 0;
+    clearFinalizeInflightForTests();
+    setMergePrForTests(async () => {
+        mergeCalls++;
+        return { ok: true };
+    });
+});
+afterEach(() => {
+    setMergePrForTests(null);
+    clearFinalizeInflightForTests();
+});
+async function buildApp() {
+    const app = Fastify();
+    await registerIssueRoutes(app);
+    return app;
+}
+function newIssue(opts) {
+    return createIssue({
+        title: opts.title ?? "Policy target",
+        description: "d",
+        acceptanceCriteria: opts.acceptanceCriteria ?? "It works",
+        repo: fixtureRepo,
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        baseBranch: "main",
+        maxReviewRounds: opts.maxReviewRounds ?? 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+        autoMerge: opts.autoMerge,
+    }).id;
+}
+async function complete(issueId, outcome) {
+    const item = claimWorkItem(`test-${issueId}`, { leaseMs: 60_000 });
+    assert.ok(item && item.issueId === issueId, "expected to lease this issue's work item");
+    return applyCompletion(item.id, item.leaseToken, outcome);
+}
+const review = (verdict) => ReviewerResult.parse({
+    verdict,
+    baseSha: "b",
+    headSha: "h",
+    acceptanceCriteriaAssessment: "ok",
+    evidenceAssessment: "ok",
+    findings: [],
+    risks: [],
+});
+const cleanHandoff = {
+    kind: "clean_handoff",
+    branch: "issue-490",
+    headSha: "abc123",
+    baseSha: "base1",
+    prNumber: 42,
+    prUrl: "https://gh/pr/42",
+};
+function policyEvents(issueId) {
+    return listWorkflowEventsForIssue(issueId).filter((e) => e.type === "issue.reassigned");
+}
+/** Every issue column except the policy itself and the write timestamp. */
+function frozenView(issueId) {
+    const { autoMerge: _a, updatedAt: _u, ...rest } = getIssue(issueId);
+    return rest;
+}
+/** Drives a fresh autoMerge issue into each eligible pre-decision state. */
+const ELIGIBLE = [
+    {
+        status: "developing",
+        setup: async (autoMerge) => {
+            const id = newIssue({ autoMerge });
+            assert.equal(startWorkflow(id).ok, true);
+            return id;
+        },
+    },
+    {
+        status: "reviewing",
+        setup: async (autoMerge) => {
+            const id = newIssue({ autoMerge });
+            startWorkflow(id);
+            await complete(id, cleanHandoff);
+            return id;
+        },
+    },
+    {
+        status: "repairing",
+        setup: async (autoMerge) => {
+            const id = newIssue({ autoMerge });
+            startWorkflow(id);
+            await complete(id, cleanHandoff);
+            await complete(id, { kind: "verdict", result: review("changes_requested") });
+            return id;
+        },
+    },
+    {
+        status: "needs_human",
+        setup: async (autoMerge) => {
+            // Review-round budget of 1: changes_requested parks at attempts_exhausted, which a
+            // human resume continues in the same workflow.
+            const id = newIssue({ autoMerge, maxReviewRounds: 1 });
+            startWorkflow(id);
+            await complete(id, cleanHandoff);
+            await complete(id, { kind: "verdict", result: review("changes_requested") });
+            return id;
+        },
+    },
+];
+test("NOT-490: a queued ready issue accepts an autoMerge-only update with queue entry, wait reason and other fields untouched", async () => {
+    const app = await buildApp();
+    const first = newIssue({ autoMerge: true, title: "Ahead" });
+    const id = newIssue({ autoMerge: false });
+    const behind = newIssue({ autoMerge: true, title: "Behind" });
+    for (const issueId of [first, id, behind])
+        enqueueIssue(issueId);
+    const queueBefore = listQueuedEntries();
+    const statusBefore = queueStatusForIssue(id);
+    const entryBefore = getQueuedEntryForIssue(id);
+    const issueBefore = frozenView(id);
+    assert.ok(entryBefore, "precondition: queued");
+    const detailBefore = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.deepEqual(detailBefore.autoMergePolicy, { editable: true, reason: null });
+    const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true, updatedBy: "operator-1" } });
+    assert.equal(res.statusCode, 200);
+    assert.equal(res.json().autoMerge, true);
+    assert.equal(getIssue(id).autoMerge, true);
+    assert.equal(getIssue(id).status, "ready");
+    assert.deepEqual(frozenView(id), issueBefore, "every other issue field is unchanged");
+    assert.deepEqual(getQueuedEntryForIssue(id), entryBefore, "same queue entry");
+    assert.deepEqual(listQueuedEntries(), queueBefore, "queue order and entries are untouched");
+    assert.deepEqual(queueStatusForIssue(id), statusBefore, "same position and wait reason");
+    const events = policyEvents(id);
+    assert.equal(events.length, 1);
+    assert.equal(events[0].actorType, "human");
+    assert.deepEqual(JSON.parse(events[0].payloadJson), { fromAutoMerge: false, toAutoMerge: true, actor: "operator-1" });
+    // A queued issue also refuses coordinator-owned fields smuggled beside the policy.
+    for (const mixed of [{ autoMerge: false, branch: "x" }, { autoMerge: false, status: "done" }, { autoMerge: false, headSha: "s" }]) {
+        const refused = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: mixed });
+        assert.equal(refused.statusCode, 409, `mixed ${JSON.stringify(mixed)} must be refused`);
+        assert.equal(getIssue(id).autoMerge, true, "no partial write");
+        assert.equal(policyEvents(id).length, 1);
+        assert.deepEqual(listQueuedEntries(), queueBefore);
+    }
+    // Idempotent no-op: 200, no event.
+    const again = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } });
+    assert.equal(again.statusCode, 200);
+    assert.equal(policyEvents(id).length, 1, "a no-op update records nothing");
+    // And back off, attributed to the default actor.
+    await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } });
+    const after = policyEvents(id);
+    assert.equal(after.length, 2);
+    assert.deepEqual(JSON.parse(after[1].payloadJson), { fromAutoMerge: true, toAutoMerge: false, actor: "human" });
+    assert.deepEqual(listQueuedEntries(), queueBefore);
+    await app.close();
+});
+for (const { status, setup } of ELIGIBLE) {
+    test(`NOT-490: an active ${status} issue accepts an autoMerge-only update; a mixed patch is 409 with no partial write`, async () => {
+        const app = await buildApp();
+        const id = await setup(false);
+        assert.equal(getIssue(id).status, status, "precondition");
+        const snapshotBefore = JSON.stringify(getTaskSnapshot(getIssue(id)));
+        const issueBefore = frozenView(id);
+        const eventsBefore = listWorkflowEventsForIssue(id).length;
+        const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+        assert.equal(detail.autoMergePolicy.editable, true);
+        // Mixed patches that carry a frozen field fail closed and write nothing.
+        for (const mixed of [
+            { autoMerge: true, title: "New title" },
+            { autoMerge: true, repo: "acme/other" },
+            { autoMerge: true, developerAgentId: BUILTIN_AGENT_CODEX_ID },
+            { autoMerge: true, maxReviewRounds: 9 },
+            // Coordinator-owned fields the schema does not declare: a non-strict parse would
+            // strip them, so the route must refuse on the raw body keys.
+            { autoMerge: true, branch: "other" },
+            { autoMerge: true, status: "done" },
+            { autoMerge: true, headSha: "deadbeef" },
+            { autoMerge: true, prNumber: 7 },
+            { autoMerge: true, prUrl: "https://gh/pr/7" },
+            { autoMerge: true, queuePosition: 0 },
+        ]) {
+            const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: mixed });
+            assert.equal(res.statusCode, 409, `mixed ${JSON.stringify(mixed)} must be refused`);
+            assert.equal(getIssue(id).autoMerge, false, "no partial write of the policy");
+            assert.deepEqual(frozenView(id), issueBefore);
+            assert.equal(listWorkflowEventsForIssue(id).length, eventsBefore);
+        }
+        const ok = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } });
+        assert.equal(ok.statusCode, 200);
+        assert.equal(getIssue(id).autoMerge, true);
+        assert.equal(getIssue(id).status, status, "status is untouched");
+        assert.deepEqual(frozenView(id), issueBefore, "frozen inputs, branch, PR, rounds untouched");
+        assert.equal(JSON.stringify(getTaskSnapshot(getIssue(id))), snapshotBefore, "frozen task snapshot untouched");
+        const events = policyEvents(id);
+        assert.equal(events.length, 1);
+        assert.deepEqual(JSON.parse(events[0].payloadJson), { fromAutoMerge: false, toAutoMerge: true, actor: "human" });
+        assert.ok(events[0].workflowInstanceId, "the event is scoped to the live workflow");
+        const noop = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } });
+        assert.equal(noop.statusCode, 200);
+        assert.equal(policyEvents(id).length, 1);
+        await app.close();
+    });
+}
+test("NOT-490: a policy update committed before reviewer routing turns approval into the guarded auto-merge", async () => {
+    const app = await buildApp();
+    const id = newIssue({ autoMerge: false });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    assert.equal((await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } })).statusCode, 200);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "done");
+    assert.equal(mergeCalls, 1, "exactly one merge");
+    assert.equal(listHumanActionsForIssue(id).filter((a) => a.actionType === "final_review").length, 0, "no final_review action");
+    assert.equal(listWorkflowEventsForIssue(id).filter((e) => e.type === "final_review.requested").length, 0);
+    await app.close();
+});
+test("NOT-490: a committed false policy routes approval to final_review and never merges", async () => {
+    const app = await buildApp();
+    const id = newIssue({ autoMerge: true });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    assert.equal((await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } })).statusCode, 200);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "final_review");
+    assert.equal(getIssue(id).currentOwner, "human");
+    assert.equal(mergeCalls, 0);
+    assert.equal(listHumanActionsForIssue(id).filter((a) => a.actionType === "final_review").length, 1);
+    await app.close();
+});
+test("NOT-490: a reviewer decision committed first wins — the later update is 409 and creates no second effect", async () => {
+    const app = await buildApp();
+    const id = newIssue({ autoMerge: false });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "final_review");
+    const eventsBefore = listWorkflowEventsForIssue(id).length;
+    const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.equal(detail.autoMergePolicy.editable, false);
+    assert.match(detail.autoMergePolicy.reason ?? "", /Merge/);
+    const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } });
+    assert.equal(res.statusCode, 409);
+    assert.match(res.json().error, /no longer be changed/);
+    assert.equal(getIssue(id).autoMerge, false);
+    assert.equal(getIssue(id).status, "final_review");
+    assert.equal(mergeCalls, 0, "no auto-merge effect");
+    assert.equal(listHumanActionsForIssue(id).filter((a) => a.actionType === "final_review").length, 1, "one final_review action");
+    assert.equal(listWorkflowEventsForIssue(id).length, eventsBefore, "no audit event for the losing update");
+    await app.close();
+});
+test("NOT-490: while auto-merge finalization is in flight the policy is locked; the merge completes once", async () => {
+    const app = await buildApp();
+    let releaseMerge;
+    const mergeGate = new Promise((resolve) => (releaseMerge = resolve));
+    setMergePrForTests(async () => {
+        mergeCalls++;
+        await mergeGate;
+        return { ok: true };
+    });
+    const id = newIssue({ autoMerge: true });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    const approval = complete(id, { kind: "verdict", result: review("approved") });
+    // The routing transaction commits before the async merge — wait for the park.
+    for (let i = 0; i < 200 && getIssue(id).status !== "final_review"; i++) {
+        await new Promise((r) => setImmediate(r));
+    }
+    assert.equal(getIssue(id).status, "final_review");
+    assert.equal(getIssue(id).currentOwner, "system");
+    const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.equal(detail.autoMergePolicy.editable, false);
+    assert.match(detail.autoMergePolicy.reason ?? "", /in flight/);
+    const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } });
+    assert.equal(res.statusCode, 409);
+    assert.equal(getIssue(id).autoMerge, true);
+    releaseMerge();
+    await approval;
+    assert.equal(getIssue(id).status, "done");
+    assert.equal(mergeCalls, 1);
+    assert.equal(listHumanActionsForIssue(id).length, 0, "no human action created");
+    assert.equal(policyEvents(id).length, 0);
+    await app.close();
+});
+test("NOT-490: an operator-verification park after approval keeps the committed policy locked", async () => {
+    const app = await buildApp();
+    const id = newIssue({
+        autoMerge: true,
+        acceptanceCriteria: "- [ ] Operator signs in with SSO [operator]",
+    });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "needs_human");
+    const gate = listHumanActionsForIssue(id).filter((a) => a.status === "open");
+    assert.deepEqual(gate.map((a) => a.actionType), ["operator_verification"], "precondition: parked at the gate");
+    assert.equal(mergeCalls, 0);
+    const eventsBefore = listWorkflowEventsForIssue(id).length;
+    const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.equal(detail.autoMergePolicy.editable, false);
+    assert.match(detail.autoMergePolicy.reason ?? "", /operator verification/);
+    const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } });
+    assert.equal(res.statusCode, 409);
+    assert.match(res.json().error, /no longer be changed/);
+    assert.equal(getIssue(id).autoMerge, true, "committed policy is unchanged");
+    assert.equal(listWorkflowEventsForIssue(id).length, eventsBefore, "no audit event for the refused update");
+    assert.equal(policyEvents(id).length, 0);
+    await app.close();
+});
+test("NOT-490: a merge-failure park and terminal issues are read-only with an explanation", async () => {
+    const app = await buildApp();
+    setMergePrForTests(async () => ({ ok: false, reason: "protected branch" }));
+    const id = newIssue({ autoMerge: true });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "needs_human");
+    const parked = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.equal(parked.autoMergePolicy.editable, false);
+    assert.match(parked.autoMergePolicy.reason ?? "", /merge/);
+    assert.equal((await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } })).statusCode, 409);
+    assert.equal(getIssue(id).autoMerge, true);
+    setMergePrForTests(async () => ({ ok: true }));
+    const done = newIssue({ autoMerge: true, title: "Done" });
+    startWorkflow(done);
+    await complete(done, cleanHandoff);
+    await complete(done, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(done).status, "done");
+    const doneDetail = (await app.inject({ method: "GET", url: `/api/issues/${done}` })).json();
+    assert.deepEqual(doneDetail.autoMergePolicy, { editable: false, reason: "The issue is done." });
+    assert.equal((await app.inject({ method: "PATCH", url: `/api/issues/${done}`, payload: { autoMerge: false } })).statusCode, 409);
+    assert.equal(policyEvents(done).length, 0);
+    await app.close();
+});

package/bundle/server/dist/routes/human-actions.test.js

@@ -36,7 +36,7 @@ async function buildApp() {
     return app;
 }
 function seedIssueAwaitingFinalReview() {
-    const issue = createIssue({ title: "Awaiting review", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const issue = createIssue({ title: "Awaiting review", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, maxReviewRounds: 3, maxInfraAttempts: 3, autoMerge: false, source: "manual" });
     transitionIssue(issue.id, "developing");
     transitionIssue(issue.id, "reviewing");
     transitionIssue(issue.id, "final_review", { currentOwner: "human" });
@@ -48,7 +48,7 @@ function seedIssueAwaitingFinalReview() {
  * (unlike seedIssueAwaitingFinalReview's hand-crafted transitions) — needed to exercise
  * resolveHumanActionAndAdvance's actual transactional path through the route. */
 async function seedRealIssueAwaitingFinalReview() {
-    const issue = createIssue({ title: "Real workflow", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const issue = createIssue({ title: "Real workflow", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, autoMerge: false, source: "manual" });
     const start = startWorkflow(issue.id);
     assert.equal(start.ok, true);
     const devItem = claimWorkItem(`route-test-${issue.id}-dev`, { leaseMs: 60_000 });
@@ -286,7 +286,7 @@ test("POST resolve 400s on a choice not valid for reflection_interaction_require
 });
 // NOT-272: seeds.
 function seedPreStartScopeDecision() {
-    const issue = createIssue({ title: "Scope gated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const issue = createIssue({ title: "Scope gated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, autoMerge: false, source: "manual" });
     const action = createHumanAction({
         issueId: issue.id,
         actionType: "product_scope_decision",
@@ -299,7 +299,7 @@ function seedPreStartScopeDecision() {
 /** Drives a real issue to a mid-workflow product_scope_decision via a reviewer
  * escalate verdict carrying a productScopeQuestion (NOT-150 routing). */
 async function seedMidWorkflowScopeDecision() {
-    const issue = createIssue({ title: "Scope escalated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const issue = createIssue({ title: "Scope escalated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, autoMerge: false, source: "manual" });
     const start = startWorkflow(issue.id);
     assert.equal(start.ok, true);
     const devItem = claimWorkItem(`scope-note-test-${issue.id}-dev`, { leaseMs: 60_000 });