agentic-qe 3.14.2 → 3.14.4

package/dist/coordination/handlers/test-execution-handlers.js

@@ -8,6 +8,8 @@ import { v4 as uuidv4 } from 'uuid';
 import * as fs from 'fs/promises';
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
+import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
+import { createVitestJsonReport } from '../../shared/vitest-json-report.js';
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -160,73 +162,67 @@ export function registerTestExecutionHandlers(ctx) {
             return err(toError(error));
         }
     });
+    // execute-tests accepts a nonempty list of concrete paths; callers expand globs.
     // Register test execution handler - runs real tests via child process
     ctx.registerHandler('execute-tests', async (task) => {
         const payload = task.payload;
         try {
             const testFiles = payload.testFiles || [];
             if (testFiles.length === 0) {
-                return ok({
-                    total: 0, passed: 0, failed: 0, skipped: 0,
-                    duration: 0, coverage: 0, failedTests: [],
-                    warning: 'No test files specified. Provide testFiles array with paths to test files.',
-                });
+                return err(new TestRunnerExecutionError('No test files specified. Provide testFiles array with paths to test files.'));
             }
-            // Attempt to run tests using common test runners
-            const cwd = process.cwd();
-            let output;
-            // Validate test file paths to prevent command injection
-            const safePathPattern = /^[a-zA-Z0-9_.\/\-@]+$/;
-            const safeFiles = testFiles.filter(f => safePathPattern.test(f));
-            if (safeFiles.length !== testFiles.length) {
-                return ok({
-                    total: 0, passed: 0, failed: 0, skipped: 0,
-                    duration: 0, coverage: 0, failedTests: [],
-                    warning: 'Some test file paths contain invalid characters and were rejected.',
-                });
+            // Validate test file paths before invoking a runner.
+            const safePathPattern = /^[a-zA-Z0-9_./@-]+$/;
+            if (testFiles.some(file => !safePathPattern.test(file))) {
+                return err(new TestRunnerExecutionError('Some test file paths contain invalid characters and were rejected. Provide concrete paths; expand glob patterns before calling.'));
             }
+            const { spawnSync } = await import('child_process');
+            const options = { cwd: process.cwd(), timeout: 120000, encoding: 'utf-8' };
+            let runner = 'vitest';
+            // Vitest 5 writes the JSON report to a file rather than stdout; an explicit
+            // --outputFile gives Vitest 4 and 5 the same contract.
+            const report = createVitestJsonReport();
+            let execution;
+            let output;
             try {
-                // Use spawnSync with argument arrays to prevent command injection
-                const { spawnSync } = await import('child_process');
-                const vitestResult = spawnSync('npx', ['vitest', 'run', ...safeFiles, '--reporter=json'], {
-                    cwd, timeout: 120000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
-                });
-                output = vitestResult.stdout || '';
-                // If vitest failed (not just test failures), try jest
-                if (!output.includes('{') && vitestResult.status !== 0) {
-                    const jestResult = spawnSync('npx', ['jest', ...safeFiles, '--json'], {
-                        cwd, timeout: 120000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
-                    });
-                    output = jestResult.stdout || '';
-                }
+                execution = spawnSync('npx', ['vitest', 'run', ...testFiles, '--reporter=json', ...report.args], options);
+                output = execution.error || execution.signal
+                    ? ''
+                    : report.read(execution.stdout || '') ?? '';
+            }
+            finally {
+                report.cleanup();
             }
-            catch (execError) {
-                // Test runner may exit non-zero when tests fail — that's expected
-                output = execError.stdout || '';
+            // Preserve the existing Jest fallback when Vitest cannot produce a report.
+            if (!output.includes('{') && execution.status !== 0 && !execution.error && !execution.signal) {
+                runner = 'jest';
+                execution = spawnSync('npx', ['jest', ...testFiles, '--json'], options);
+                output = execution.stdout || '';
+            }
+            const diagnostics = [execution.error?.message, execution.signal && `Terminated by ${execution.signal}`, execution.stderr, output].filter(Boolean).join('\n');
+            if (execution.error) {
+                return err(new TestRunnerExecutionError(`${runner} could not complete: ${diagnostics.slice(0, 4000)}`));
             }
-            // Try to parse JSON output from test runner
             try {
                 const jsonStart = output.indexOf('{');
                 if (jsonStart >= 0) {
                     const json = JSON.parse(output.slice(jsonStart));
-                    // vitest format
                     if (json.testResults) {
                         const total = json.numTotalTests || 0;
                         const passed = json.numPassedTests || 0;
                         const failed = json.numFailedTests || 0;
-                        return ok({ total, passed, failed, skipped: total - passed - failed, duration: 0, coverage: 0, failedTests: [] });
+                        const skipped = total - passed - failed;
+                        const executionError = getTestRunnerExecutionError(runner, testFiles.join(', '), execution.status, { passed, failed, skipped }, diagnostics, json);
+                        if (executionError)
+                            return err(executionError);
+                        return ok({ total, passed, failed, skipped, duration: 0, coverage: 0, failedTests: [] });
                     }
                 }
             }
             catch {
-                // JSON parsing failed — return raw info
+                // A malformed report cannot establish that the requested tests completed.
             }
-            return ok({
-                total: testFiles.length, passed: 0, failed: 0, skipped: 0,
-                duration: 0, coverage: 0, failedTests: [],
-                warning: 'Could not parse test runner output. Check that vitest or jest is installed.',
-                rawOutput: output.slice(0, 500),
-            });
+            return err(new TestRunnerExecutionError(`Could not parse ${runner} results (exit code ${execution.status ?? 'unknown'}):\n${diagnostics.slice(0, 4000)}`));
         }
         catch (error) {
             return err(toError(error));

package/dist/coordination/interfaces.d.ts

@@ -69,7 +69,7 @@ export interface Protocol {
 /**
  * Status of a protocol action execution
  */
-export type ActionExecutionStatus = 'pending' | 'running' | 'completed' | 'failed' | 'skipped' | 'cancelled';
+export type ActionExecutionStatus = 'pending' | 'running' | 'completed' | 'failed' | 'unknown' | 'skipped' | 'cancelled';
 /**
  * Result of a single action execution
  */
@@ -94,7 +94,7 @@ export interface ActionExecutionResult {
 /**
  * Status of protocol execution
  */
-export type ProtocolExecutionStatus = 'pending' | 'running' | 'completed' | 'failed' | 'cancelled' | 'paused';
+export type ProtocolExecutionStatus = 'pending' | 'running' | 'completed' | 'failed' | 'unknown' | 'cancelled' | 'paused';
 /**
  * Protocol execution state
  */

package/dist/coordination/protocol-executor.js

@@ -6,6 +6,13 @@ import { v4 as uuidv4 } from 'uuid';
 import { ok, err, } from '../shared/types/index.js';
 import { createEvent } from '../shared/events/index.js';
 import { toErrorMessage, toError } from '../shared/error-utils.js';
+/** The caller stopped waiting, but the domain operation may still take effect. */
+class ActionTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`Action timed out after ${timeoutMs}ms; outcome is unknown`);
+        this.name = 'ActionTimeoutError';
+    }
+}
 // ============================================================================
 // Protocol Events
 // ============================================================================
@@ -13,10 +20,12 @@ const ProtocolEvents = {
     ProtocolStarted: 'coordination.ProtocolStarted',
     ProtocolCompleted: 'coordination.ProtocolCompleted',
     ProtocolFailed: 'coordination.ProtocolFailed',
+    ProtocolOutcomeUnknown: 'coordination.ProtocolOutcomeUnknown',
     ProtocolCancelled: 'coordination.ProtocolCancelled',
     ActionStarted: 'coordination.ActionStarted',
     ActionCompleted: 'coordination.ActionCompleted',
     ActionFailed: 'coordination.ActionFailed',
+    ActionOutcomeUnknown: 'coordination.ActionOutcomeUnknown',
 };
 // ============================================================================
 // Protocol Executor Implementation
@@ -256,18 +265,22 @@ export class DefaultProtocolExecutor {
             // Execute actions
             await this.executeActions(context);
             // Check for failures
-            const hasFailures = Array.from(context.actionResults.values()).some((r) => r.status === 'failed');
+            const results = Array.from(context.actionResults.values());
+            const unknownActions = results.filter((r) => r.status === 'unknown').map((r) => r.actionId);
+            const failedActions = results.filter((r) => r.status === 'failed').map((r) => r.actionId);
             if (context.cancelled) {
                 execution.status = 'cancelled';
             }
-            else if (hasFailures) {
+            else if (unknownActions.length > 0) {
+                execution.status = 'unknown';
+                await this.publishEvent(ProtocolEvents.ProtocolOutcomeUnknown, { executionId, protocolId: protocol.id, unknownActions, failedActions }, correlationId);
+            }
+            else if (failedActions.length > 0) {
                 execution.status = 'failed';
                 await this.publishEvent(ProtocolEvents.ProtocolFailed, {
                     executionId,
                     protocolId: protocol.id,
-                    failedActions: Array.from(context.actionResults.values())
-                        .filter((r) => r.status === 'failed')
-                        .map((r) => r.actionId),
+                    failedActions,
                 }, correlationId);
             }
             else {
@@ -313,6 +326,23 @@ export class DefaultProtocolExecutor {
             const readyActions = protocol.actions.filter((action) => pending.has(action.id) &&
                 this.dependenciesSatisfied(action, completed));
             if (readyActions.length === 0 && pending.size > 0) {
+                // A failed/unknown prerequisite cannot authorize a dependent action.
+                // Mark the dependent skipped instead of misreporting a deadlock.
+                let skipped = false;
+                for (const action of protocol.actions) {
+                    if (!pending.has(action.id))
+                        continue;
+                    if (action.dependsOn?.some((dep) => {
+                        const status = actionResults.get(dep)?.status;
+                        return status !== undefined && status !== 'completed';
+                    })) {
+                        actionResults.set(action.id, { actionId: action.id, status: 'skipped' });
+                        pending.delete(action.id);
+                        skipped = true;
+                    }
+                }
+                if (skipped)
+                    continue;
                 // Deadlock - some actions can't be executed
                 throw new Error(`Deadlock detected: actions ${Array.from(pending).join(', ')} cannot proceed`);
             }
@@ -402,6 +432,26 @@ export class DefaultProtocolExecutor {
             }
             catch (error) {
                 lastError = toError(error);
+                if (error instanceof ActionTimeoutError) {
+                    // Promise.race cannot cancel the losing provider call. It may have
+                    // committed an effect already, so replay would be unsafe.
+                    const completedAt = new Date();
+                    await this.publishEvent(ProtocolEvents.ActionOutcomeUnknown, {
+                        executionId: context.execution.executionId,
+                        actionId: action.id,
+                        error: error.message,
+                        attempts,
+                    }, context.execution.correlationId);
+                    return {
+                        actionId: action.id,
+                        status: 'unknown',
+                        startedAt,
+                        completedAt,
+                        duration: completedAt.getTime() - startedAt.getTime(),
+                        error: error.message,
+                        retryAttempts: attempts > 1 ? attempts - 1 : undefined,
+                    };
+                }
                 // Retry if configured and not last attempt
                 if (attempts < maxAttempts && action.retry) {
                     const backoff = action.retry.backoffMs *
@@ -441,10 +491,19 @@ export class DefaultProtocolExecutor {
      * Execute a promise with timeout
      */
     async executeWithTimeout(promise, timeoutMs) {
-        return Promise.race([
-            promise,
-            new Promise((_, reject) => setTimeout(() => reject(new Error('Action timeout')), timeoutMs)),
-        ]);
+        let timer;
+        try {
+            return await Promise.race([
+                promise,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new ActionTimeoutError(timeoutMs)), timeoutMs);
+                }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
     }
     /**
      * Set up event-based triggers for a protocol

package/dist/coordination/protocols/security-audit.d.ts

@@ -61,6 +61,8 @@ export interface SecurityAuditResult {
     readonly overallRiskScore: RiskScore;
     readonly recommendations: string[];
     readonly deploymentDecision: DeploymentDecision;
+    /** Requested checks without complete execution evidence; findings remain usable. */
+    readonly incompleteChecks?: readonly string[];
 }
 /**
  * Triaged vulnerability findings
@@ -219,6 +221,7 @@ export declare class SecurityAuditProtocol {
     private cleanupAgents;
     private getAuditOptionsForTrigger;
     private updatePhase;
+    private recordIncompleteCheck;
     private createEmptyTriagedFindings;
     private calculateSummary;
     private calculateRiskValue;

package/dist/coordination/protocols/security-audit.js

@@ -111,16 +111,25 @@ export class SecurityAuditProtocol {
                 triagedFindings: this.createEmptyTriagedFindings(),
                 overallRiskScore: RiskScore.create(0),
                 recommendations: [],
-                deploymentDecision: { allowed: true, reason: '', blockingIssues: [], warnings: [] },
+                incompleteChecks: [],
+                deploymentDecision: { allowed: false, reason: 'Audit not completed', blockingIssues: [], warnings: [] },
             };
             // Adjust scope based on trigger
             const auditOptions = this.getAuditOptionsForTrigger(trigger);
             // Phase 1: Vulnerability Scan (SAST)
-            this.updatePhase('vulnerability-scan');
-            const sastResult = await this.scanVulnerabilities(auditOptions);
-            if (sastResult.success) {
-                this.currentAudit = { ...this.currentAudit, sastResult: sastResult.value };
-                await this.publishVulnerabilities(sastResult.value.vulnerabilities);
+            if (auditOptions.includeSAST) {
+                this.updatePhase('vulnerability-scan');
+                const sastResult = await this.scanVulnerabilities(auditOptions);
+                if (sastResult.success) {
+                    this.currentAudit = { ...this.currentAudit, sastResult: sastResult.value };
+                    await this.publishVulnerabilities(sastResult.value.vulnerabilities);
+                    if (sastResult.value.evidence?.completeness !== 'complete') {
+                        this.recordIncompleteCheck('SAST coverage is incomplete or unverified');
+                    }
+                }
+                else {
+                    this.recordIncompleteCheck('SAST scan did not complete');
+                }
             }
             // Phase 2: Dependency Scan
             this.updatePhase('dependency-scan');
@@ -129,32 +138,51 @@ export class SecurityAuditProtocol {
                 this.currentAudit = { ...this.currentAudit, dependencyResult: depResult.value };
                 await this.publishDependencyVulnerabilities(depResult.value.vulnerabilities);
             }
+            else {
+                this.recordIncompleteCheck('Dependency scan did not complete');
+            }
             // Phase 3: Secret Scan (if enabled)
-            if (this.config.enableSecretScan) {
+            if (auditOptions.includeSecrets) {
                 this.updatePhase('secret-scan');
                 const secretResult = await this.auditSecrets();
                 if (secretResult.success) {
                     this.currentAudit = { ...this.currentAudit, secretResult: secretResult.value };
                     await this.publishSecretExposures(secretResult.value.secretsFound);
                 }
+                else {
+                    this.recordIncompleteCheck('Secret scan is unavailable');
+                }
             }
             // Phase 4: DAST Scan (if enabled and URL provided)
-            if (this.config.enableDAST && this.config.targetUrl) {
+            if (auditOptions.includeDAST && this.config.targetUrl) {
                 const dastResult = await this.runDASTScan(this.config.targetUrl);
                 if (dastResult.success) {
                     this.currentAudit = { ...this.currentAudit, dastResult: dastResult.value };
+                    this.recordIncompleteCheck('DAST coverage is unverified: the scanner returned no execution receipt');
                     await this.publishVulnerabilities(dastResult.value.vulnerabilities);
                 }
+                else {
+                    this.recordIncompleteCheck('DAST scan did not complete');
+                }
+            }
+            else if (auditOptions.includeDAST) {
+                this.recordIncompleteCheck('DAST requested without a target URL');
             }
             // Phase 5: Compliance Validation
-            this.updatePhase('compliance-validation');
-            const complianceResult = await this.validateCompliance();
-            if (complianceResult.success) {
-                this.currentAudit = {
-                    ...this.currentAudit,
-                    complianceReports: complianceResult.value,
-                };
-                await this.publishComplianceResults(complianceResult.value);
+            if (this.config.complianceStandards.length > 0) {
+                this.updatePhase('compliance-validation');
+                const complianceResult = await this.validateCompliance();
+                if (complianceResult.success) {
+                    this.currentAudit = {
+                        ...this.currentAudit,
+                        complianceReports: complianceResult.value,
+                    };
+                    await this.publishComplianceResults(complianceResult.value);
+                    this.recordIncompleteCheck('Protocol compliance checks have no verified execution receipt');
+                }
+                else {
+                    this.recordIncompleteCheck('Compliance validation did not complete');
+                }
             }
             // Phase 6: Triage Findings
             this.updatePhase('triage');
@@ -296,26 +324,9 @@ export class SecurityAuditProtocol {
      * Audit for exposed secrets/credentials
      */
     async auditSecrets() {
-        try {
-            const agentId = await this.spawnAgent('secret-scanner', ['secret-scan', 'credential-audit']);
-            if (!agentId.success) {
-                return err(agentId.error);
-            }
-            const secretsFound = [];
-            // In production, this would scan actual files with patterns like:
-            // - API keys: /(?:api[_-]?key|apikey)/gi
-            // - Passwords: /(?:password|passwd|pwd)/gi
-            // - Tokens: /(?:secret|token|bearer)/gi
-            // - Private keys: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/gi
-            // For now, report no secrets found (clean scan)
-            return ok({
-                secretsFound,
-                filesScanned: this.config.scanPaths.length * 10, // Estimate
-            });
-        }
-        catch (error) {
-            return err(toError(error));
-        }
+        // Agent allocation is not scan execution. Until this protocol has a real
+        // secret-scanner adapter, retain an explicit unavailable result.
+        return err(new Error('Secret scanning is unavailable in SecurityAuditProtocol: no scanner is implemented.'));
     }
     /**
      * Run DAST scan against target URL
@@ -383,7 +394,7 @@ export class SecurityAuditProtocol {
             return {
                 riskScore: RiskScore.create(0),
                 recommendations: [],
-                deploymentDecision: { allowed: true, reason: 'No audit data', blockingIssues: [], warnings: [] },
+                deploymentDecision: { allowed: false, reason: 'No audit data', blockingIssues: ['No audit evidence'], warnings: [] },
             };
         }
         // Calculate risk score
@@ -641,6 +652,14 @@ export class SecurityAuditProtocol {
             this.currentAudit = { ...this.currentAudit, phase };
         }
     }
+    recordIncompleteCheck(reason) {
+        if (this.currentAudit) {
+            this.currentAudit = {
+                ...this.currentAudit,
+                incompleteChecks: [...(this.currentAudit.incompleteChecks ?? []), reason],
+            };
+        }
+    }
     createEmptyTriagedFindings() {
         return {
             critical: [],
@@ -717,6 +736,9 @@ export class SecurityAuditProtocol {
         const recommendations = [];
         if (!this.currentAudit)
             return recommendations;
+        for (const check of this.currentAudit.incompleteChecks ?? []) {
+            recommendations.push(`Complete the required security check before approving deployment: ${check}`);
+        }
         const { triagedFindings, complianceReports } = this.currentAudit;
         // Critical findings
         if (triagedFindings.critical.length > 0) {
@@ -747,10 +769,10 @@ export class SecurityAuditProtocol {
         return recommendations;
     }
     determineDeploymentDecision(_riskScore) {
-        const blockingIssues = [];
+        const blockingIssues = [...(this.currentAudit?.incompleteChecks ?? [])];
         const warnings = [];
         if (!this.currentAudit) {
-            return { allowed: true, reason: 'No audit data', blockingIssues, warnings };
+            return { allowed: false, reason: 'No audit data', blockingIssues: ['No audit evidence'], warnings };
         }
         const { triagedFindings, complianceReports } = this.currentAudit;
         // Check critical vulnerabilities

package/dist/coordination/queen-coordinator.js

@@ -351,13 +351,19 @@ export class QueenCoordinator {
         const execution = this.tasks.get(taskId);
         if (!execution)
             return err(new Error(`Task not found: ${taskId}`));
+        // Repeated cancellation is one decision, not another event or capacity release.
+        if (execution.status === 'cancelled')
+            return ok(undefined);
         if (execution.status === 'completed' || execution.status === 'failed') {
             return err(new Error(`Task already finished: ${taskId}`));
         }
-        if (execution.status === 'running' || execution.status === 'assigned') {
-            this.runningTaskCounter = Math.max(0, this.runningTaskCounter - 1);
-        }
-        this.tasks.set(taskId, { ...execution, status: 'cancelled', completedAt: new Date() });
+        const cancellationResultPending = execution.status === 'running' || execution.status === 'assigned';
+        // Keep the capacity slot until the outstanding result arrives. Stopping an
+        // agent does not necessarily stop a domain plugin or its child process.
+        this.tasks.set(taskId, {
+            ...execution, status: 'cancelled', completedAt: new Date(),
+            cancellationResultPending,
+        });
         removeFromQueues(this.taskQueue, this.domainQueues, execution.task);
         for (const agentId of execution.assignedAgents) {
             await this.agentCoordinator.stop(agentId);

package/dist/coordination/queen-event-handlers.js

@@ -7,6 +7,7 @@
 import { getCrossPhaseHookExecutor } from '../hooks/cross-phase-hooks.js';
 // Governance
 import { queenGovernanceAdapter } from '../governance/index.js';
+import { settleCancelledTask } from './cancelled-task-settlement.js';
 // ============================================================================
 // Event subscription
 // ============================================================================
@@ -51,6 +52,14 @@ async function handleDomainEvent(ctx, event) {
 // ============================================================================
 export async function handleTaskCompleted(ctx, event) {
     const { taskId, result } = event.payload;
+    const cancelled = settleCancelledTask(ctx.tasks, taskId);
+    if (cancelled.ignored) {
+        if (cancelled.settledNow) {
+            ctx.runningTaskCounter = Math.max(0, ctx.runningTaskCounter - 1);
+            await ctx.processQueue();
+        }
+        return;
+    }
     const execution = ctx.tasks.get(taskId);
     if (execution) {
         // CC-002 FIX: Decrement the atomic counter when task completes
@@ -154,6 +163,14 @@ export async function handleTaskCompleted(ctx, event) {
 // ============================================================================
 export async function handleTaskFailed(ctx, event) {
     const { taskId, error } = event.payload;
+    const cancelled = settleCancelledTask(ctx.tasks, taskId);
+    if (cancelled.ignored) {
+        if (cancelled.settledNow) {
+            ctx.runningTaskCounter = Math.max(0, ctx.runningTaskCounter - 1);
+            await ctx.processQueue();
+        }
+        return;
+    }
     const execution = ctx.tasks.get(taskId);
     if (execution) {
         // CC-002 FIX: Decrement the atomic counter when task fails

package/dist/coordination/queen-task-management.js

@@ -7,6 +7,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../shared/types/index.js';
 import { binaryInsert, createdAtComparator } from '../shared/utils/index.js';
 import { TASK_DOMAIN_MAP } from './queen-types.js';
+import { settleCancelledTask } from './cancelled-task-settlement.js';
 // ============================================================================
 // Task comparator for priority queue binary insertion
 // ============================================================================
@@ -214,6 +215,14 @@ export async function assignTaskToDomain(ctx, task, domain) {
         ...(routeDecision?.triggerMultiModel ? ['advisor:triggerMultiModel'] : []),
     ];
     const spawnResult = await ctx.requestAgentSpawn(domain, agentType, spawnCapabilities);
+    // A queued task can be cancelled while routing or agent spawn is awaiting.
+    // Do not recreate it as running or dispatch its plugin afterward.
+    if (ctx.tasks.get(task.id)?.status === 'cancelled') {
+        if (spawnResult.success)
+            await ctx.agentCoordinator.stop(spawnResult.value);
+        ctx.runningTaskCounter = Math.max(0, ctx.runningTaskCounter - 1);
+        return ok(task.id);
+    }
     const agentIds = [];
     if (spawnResult.success) {
         agentIds.push(spawnResult.value);
@@ -252,6 +261,14 @@ export async function assignTaskToDomain(ctx, task, domain) {
             };
             const execResult = await plugin.executeTask(request, (result) => handleTaskCompletionCallback(ctx, result));
             if (!execResult.success) {
+                const cancelled = settleCancelledTask(ctx.tasks, task.id);
+                if (cancelled.ignored) {
+                    if (cancelled.settledNow) {
+                        ctx.runningTaskCounter = Math.max(0, ctx.runningTaskCounter - 1);
+                        await processQueue(ctx);
+                    }
+                    return ok(task.id);
+                }
                 ctx.tasks.set(task.id, {
                     ...execution,
                     status: 'failed',
@@ -298,6 +315,14 @@ async function handleTaskCompletionCallback(ctx, result) {
         console.warn(`[Queen] Received completion for unknown task: ${result.taskId}`);
         return;
     }
+    const cancelled = settleCancelledTask(ctx.tasks, result.taskId);
+    if (cancelled.ignored) {
+        if (cancelled.settledNow) {
+            ctx.runningTaskCounter = Math.max(0, ctx.runningTaskCounter - 1);
+            await processQueue(ctx);
+        }
+        return;
+    }
     const updated = {
         ...execution,
         status: result.success ? 'completed' : 'failed',

package/dist/coordination/queen-types.d.ts

@@ -42,6 +42,8 @@ export interface TaskExecution {
     readonly assignedAgents: string[];
     readonly startedAt?: Date;
     readonly completedAt?: Date;
+    /** True until an already-running task result arrives after cancellation. */
+    readonly cancellationResultPending?: boolean;
     readonly result?: unknown;
     readonly error?: string;
     readonly retryCount: number;