agents-relay 2.0.67 → 2.0.69

package/dist/review-generation-fence.js

@@ -0,0 +1,12 @@
+/** Called inside SQLite mutateJob against the latest durable Job snapshot. */
+export function reviewGenerationMatches(current, original, task, headSha) {
+    const fresh = current.tasks.find(item => item.id === task.id);
+    if (!fresh || fresh.reviewHeadSha !== headSha || current.state !== 'ACTIVE'
+        || (current.headSha && current.headSha !== headSha)
+        || fresh.executionId !== task.executionId)
+        return false;
+    if (current.review)
+        return current.review.taskId === task.id && current.review.headSha === headSha
+            && current.review.outcome === (original.review?.outcome ?? 'pending');
+    return Boolean(task.planningDecisionId && !original.review?.taskId);
+}

package/dist/runtime-status-events.js

@@ -0,0 +1,21 @@
+import { deriveJobRuntimeStatus } from './runtime-status.js';
+import { eventFor } from './events.js';
+/** Process-local change detector. No extra durable status field or polling required. */
+export function createRuntimeStatusPublisher(bus) {
+    const last = new Map();
+    return (job) => {
+        const key = `${job.repository}\0${job.id}`;
+        const to = deriveJobRuntimeStatus(job);
+        const from = last.get(key);
+        if (from === to)
+            return;
+        last.set(key, to);
+        // First observation establishes a baseline rather than fabricating a transition.
+        if (from === undefined)
+            return;
+        const event = eventFor(job.id, '', null, 'job.runtime_status.changed', 'info', `${from} → ${to}`, 'orchestrator', { from, to, repository: job.repository, jobState: job.state, updatedAt: job.updatedAt }, { agent: 'relay', component: 'runtime-status' });
+        void bus.publish(event).catch(error => {
+            process.stderr.write(`runtime status change publish failed ${job.id}: ${String(error)}\n`);
+        });
+    };
+}

package/dist/runtime-status.js

@@ -12,13 +12,19 @@ export function implementationComplete(job) {
     const tasks = implementationTasks(job);
     return tasks.length > 0 && tasks.every(task => task.state === 'SUCCEEDED');
 }
-export function deriveJobRuntimeStatus(job, prState = 'OPEN') {
-    if (prState === 'MERGED')
-        return 'MERGED';
-    if (prState === 'CLOSED' || job.state === 'CANCELLED')
+export function deriveJobRuntimeStatus(job, _prState = 'OPEN') {
+    // External PR state is display metadata, never a Job runtime state input.
+    if (job.state === 'CANCELLED')
         return 'CANCELLED';
+    if (job.state === 'COMPLETED')
+        return 'COMPLETED';
     if (job.state === 'DRAFT')
         return 'IDLE';
+    const currentPlan = job.plans?.at(-1);
+    // An unresolved planner failure is a Job failure, not an idle Job.
+    // Active task execution still takes precedence below.
+    const plannerFailed = currentPlan?.status === 'FAILED' && !job.tasks.some(task => ['QUEUED', 'RUNNING'].includes(task.state));
+    const plannerRunning = currentPlan?.status === 'PLANNING';
     if (job.schedule) {
         if (job.tasks.some(task => task.state === 'RUNNING'))
             return 'RUNNING';
@@ -30,6 +36,10 @@ export function deriveJobRuntimeStatus(job, prState = 'OPEN') {
             return 'FAILED';
         if (job.tasks.some(task => task.state === 'DRAFT'))
             return 'WAITING';
+        if (plannerFailed)
+            return 'FAILED';
+        if (plannerRunning)
+            return 'RUNNING';
         return 'WAITING';
     }
     // Draft or queued reviewers must not mask implementation that is still active.
@@ -39,7 +49,7 @@ export function deriveJobRuntimeStatus(job, prState = 'OPEN') {
     if (implementation.some(task => task.state === 'QUEUED'))
         return 'QUEUED';
     const reviewRunning = job.tasks.some(task => task.agentName === 'reviewer' && task.state === 'RUNNING');
-    if (job.review?.outcome === 'approved' && prState === 'OPEN')
+    if (job.review?.outcome === 'approved')
         return 'MERGE_PENDING';
     if (reviewRunning)
         return 'REVIEWING';
@@ -53,9 +63,13 @@ export function deriveJobRuntimeStatus(job, prState = 'OPEN') {
         return 'FAILED';
     if (job.tasks.some(task => task.state === 'DRAFT'))
         return 'WAITING';
-    if (job.executionMode === 'autonomous' && job.autoMerge === false && job.reviewEnabled === false && implementationComplete(job) && prState === 'OPEN')
+    if (plannerFailed)
+        return 'FAILED';
+    if (plannerRunning)
+        return 'RUNNING';
+    if (job.executionMode === 'autonomous' && job.autoMerge === false && job.reviewEnabled === false && implementationComplete(job))
         return 'WAITING';
-    if (job.reviewEnabled === false && implementationComplete(job) && prState === 'OPEN')
+    if (job.reviewEnabled === false && implementationComplete(job))
         return 'MERGE_PENDING';
     return 'IDLE';
 }

package/dist/scheduled-jobs.js

@@ -1,19 +1,31 @@
-import { GitHubStore } from './store.js';
 import { nextScheduleRun, scheduleBucket } from './scheduler.js';
 import { dispatchScheduledRun } from './workflow/scheduled-run-v2.js';
-async function refresh(client, repository, trustedAuthors, ref, storeFactory) {
-    const store = storeFactory ? storeFactory() : new GitHubStore(client, repository, ref.prNumber, trustedAuthors);
-    return await store.load(ref.jobId);
-}
-export async function runScheduledBucket(client, repository, trustedAuthors, ref, engine, now = new Date(), storeFactory) {
-    let job = await refresh(client, repository, trustedAuthors, ref, storeFactory);
-    const schedule = job.schedule;
-    if (!schedule)
+/** Local-first schedule entrypoint: immutable Job ID selects the SQLite store. */
+export async function runScheduledBucketFromStore(store, ref, engine, now = new Date()) {
+    // SQLite authority provides an atomic claim. The fallback retains the
+    // existing in-memory test adapter, but cannot be used for production claims.
+    if (store.claimScheduledSlot) {
+        if (!store.finishScheduledSlot)
+            throw new Error('Atomic scheduled completion is required');
+        const claimed = await store.claimScheduledSlot(ref.jobId, ref.bucket, now);
+        if (claimed.status !== 'completed')
+            return claimed;
+        const slot = claimed.job.schedule?.currentRunSlot;
+        if (!slot)
+            throw new Error('Claimed schedule slot missing durable currentRunSlot');
+        await engine.reconcile(ref.jobId);
+        await engine.idle();
+        const job = await store.finishScheduledSlot(ref.jobId, slot, now);
+        return { job, status: 'completed' };
+    }
+    let job = await store.load(ref.jobId);
+    if (!job.schedule)
         throw new Error('Scheduled job ' + job.id + ' has no schedule metadata');
+    const schedule = job.schedule;
     const slot = new Date(schedule.nextRunAt);
     const active = job.tasks.some(task => ['QUEUED', 'RUNNING'].includes(task.state));
-    const schedulerStore = storeFactory ? storeFactory() : new GitHubStore(client, repository, ref.prNumber, trustedAuthors);
-    let actionStatus = null;
+    let claimed = false;
+    let status = 'skipped-idempotent';
     const decision = await dispatchScheduledRun({
         slotDue: scheduleBucket(slot) === ref.bucket && slot.getTime() <= now.getTime(),
         slotUnclaimed: !schedule.lastScheduledSlot || new Date(schedule.lastScheduledSlot).getTime() < slot.getTime(),
@@ -24,37 +36,32 @@ export async function runScheduledBucket(client, repository, trustedAuthors, ref
         if (actionId === 'schedule.skipActiveAdvance') {
             schedule.lastScheduledSlot = slot.toISOString();
             schedule.nextRunAt = nextScheduleRun(schedule, now).toISOString();
-            job.updatedAt = now.toISOString();
-            await schedulerStore.saveJob(job);
-            actionStatus = 'skipped-active';
-            return {};
+            status = 'skipped-active';
         }
-        if (actionId === 'schedule.claimFromSlot' || actionId === 'schedule.claimFromNow') {
+        else if (actionId === 'schedule.claimFromSlot' || actionId === 'schedule.claimFromNow') {
             schedule.lastScheduledSlot = slot.toISOString();
             schedule.currentRunSlot = slot.toISOString();
             schedule.nextRunAt = nextScheduleRun(schedule, actionId === 'schedule.claimFromSlot' ? slot : now).toISOString();
-            job.updatedAt = now.toISOString();
-            await schedulerStore.saveJob(job);
-            job = await schedulerStore.load(job.id);
-            return {};
+            claimed = true;
+            status = 'completed';
         }
-        throw new Error('Unsupported schedule graph action ' + actionId);
+        else
+            throw new Error('Unknown local schedule action: ' + actionId);
+        job.updatedAt = now.toISOString();
+        await store.saveJob(job);
+        return {};
     });
-    if (!decision.accepted || decision.target === 'skip_idempotent')
-        return { job, status: 'skipped-idempotent' };
-    if (actionStatus === 'skipped-active' || decision.target === 'skip_active')
-        return { job, status: 'skipped-active' };
-    if (decision.target !== 'claimed')
-        return { job, status: 'skipped-idempotent' };
-    if (!engine)
-        throw new Error('Scheduled jobs require the local relayd scheduler engine');
+    if (!decision.accepted || !claimed)
+        return { job, status };
     await engine.reconcile(job.id);
     await engine.idle();
-    const finished = await schedulerStore.load(job.id);
-    if (!finished.schedule)
-        throw new Error('Scheduled job ' + job.id + ' lost its schedule metadata');
-    finished.schedule.lastRunAt = now.toISOString();
-    finished.updatedAt = now.toISOString();
-    await schedulerStore.saveJob(finished);
-    return { job: finished, status: 'completed' };
+    job = await store.load(job.id);
+    if (!job.schedule)
+        throw new Error('Scheduled job lost schedule metadata');
+    job.schedule.lastRunAt = now.toISOString();
+    // A claim and its completion can share the same wall-clock timestamp.
+    // Advance the snapshot revision to satisfy SQLite's stale-write guard.
+    job.updatedAt = new Date(Math.max(now.getTime(), Date.parse(job.updatedAt) + 1)).toISOString();
+    await store.saveJob(job);
+    return { job, status: 'completed' };
 }

package/dist/service-external-actions.js

@@ -0,0 +1,27 @@
+import { LocalAuthorityDurableStore } from './local-authority-store.js';
+import { errorMessage, observability } from './observability.js';
+export async function flushServiceExternalActions(store, reconciler, jobId) {
+    if (!(store instanceof LocalAuthorityDurableStore) || store.noGitHub)
+        return 0;
+    const result = await store.projection.flushOnce();
+    if (result.projected > 0)
+        await reconciler.reconcile(jobId);
+    return result.projected;
+}
+export function startServiceExternalActionFlusher(store, reconciler, jobId, intervalMs) {
+    if (!(store instanceof LocalAuthorityDurableStore) || store.noGitHub)
+        return () => { };
+    const tick = () => {
+        void flushServiceExternalActions(store, reconciler, jobId).catch(error => observability().record({
+            stage: 'reconcile',
+            event: 'service.external_action_flush_failed',
+            level: 'warn',
+            outcome: 'failed',
+            message: errorMessage(error),
+        }));
+    };
+    tick();
+    const timer = setInterval(tick, intervalMs);
+    timer.unref();
+    return () => clearInterval(timer);
+}

package/dist/service-publication.js

@@ -0,0 +1,29 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { eventFor } from './events.js';
+import { SQLiteRelayStore, relayStorePath } from './relay-store.js';
+/** Single-Job service uses the same durable publish facts as the repository daemon. */
+export async function handleServicePublication(job, wake, bus, directory = join(homedir(), '.agents-relay', 'stores')) {
+    if (!wake.publication && !wake.publishFailure)
+        return;
+    const sqlite = new SQLiteRelayStore(relayStorePath(directory, job.repository, job.prNumber));
+    try {
+        await sqlite.recordPublication(job.id, wake.deliveryId, wake.publication, wake.publishFailure ?? null, wake.publicationObservedAt);
+    }
+    finally {
+        sqlite.close();
+    }
+    if (bus) {
+        if (wake.publication) {
+            const event = eventFor(job.id, 'release', null, 'package.published', 'succeeded', 'Published ' + wake.publication.package + '@' + wake.publication.version, 'orchestrator', { ...wake.publication, deliveryId: wake.deliveryId, repository: job.repository, prNumber: job.prNumber });
+            event.event_id = 'github:' + job.id + ':' + wake.deliveryId + ':package.published';
+            await bus.publish(event);
+        }
+        if (wake.publishFailure) {
+            const event = eventFor(job.id, 'release', null, 'package.publish_failed', 'failed', 'Publish failed: ' + wake.publishFailure.stage, 'orchestrator', { ...wake.publishFailure, deliveryId: wake.deliveryId, repository: job.repository, prNumber: job.prNumber });
+            event.event_id = 'github:' + job.id + ':' + wake.deliveryId + ':package.publish_failed';
+            await bus.publish(event);
+        }
+    }
+    // Do not use a publication event to forge a Job state change.
+}

package/dist/store-github.js

@@ -153,12 +153,23 @@ export class GitHubStore {
         const payload = { merge_method: 'squash' };
         if (expectedHeadSha)
             payload.sha = expectedHeadSha;
-        const result = await this.client.request('repos/' + this.repository + '/pulls/' + this.prNumber + '/merge', {
-            method: 'PUT',
-            body: JSON.stringify(payload),
-        });
-        if (result.merged !== true)
-            throw new Error(typeof result.message === 'string' ? result.message : 'Pull request #' + this.prNumber + ' was not merged');
+        try {
+            const result = await this.client.request('repos/' + this.repository + '/pulls/' + this.prNumber + '/merge', {
+                method: 'PUT',
+                body: JSON.stringify(payload),
+            });
+            if (result.merged !== true)
+                throw new Error(typeof result.message === 'string' ? result.message : 'Pull request #' + this.prNumber + ' was not merged');
+        }
+        catch (error) {
+            // Crash recovery can replay a merge after GitHub committed but before
+            // its local acknowledgement. Treat replay as success ONLY after verifying
+            // the actual external PR is already MERGED; never assume success offline.
+            this.prNodeCache = null;
+            const state = await this.pullRequestState().catch(() => null);
+            if (state !== 'MERGED')
+                throw error;
+        }
         this.prNodeCache = null;
     }
     async closePullRequest() {

package/dist/task-actions.js

@@ -1,6 +1,7 @@
 import { extendRetryBudget, transitionTaskEvent, tryTransitionTaskEvent } from './scheduler.js';
 import { selectRelatedTaskMutations } from './workflow/task-action-policy.js';
 export const TASK_RETRY_ACTION = 'task.retry';
+export const TASK_RECOVER_ACTION = 'task.recover';
 export const TASK_UNBLOCK_RETRY_ACTION = 'task.unblock.retry';
 export const TASK_CANCEL_ACTION = 'task.cancel';
 export const TASK_RELEASE_ACTION = 'task.release';
@@ -28,6 +29,24 @@ function clearExecution(task) {
     task.leaseExpiresAt = null;
     task.executionId = null;
 }
+function applyTaskRetrySnapshot(task, policy = {}) {
+    if (task.kind === 'planner')
+        throw new Error(`Legacy planner Task ${task.id} is read-only; retry the Plan instead`);
+    const decision = tryTransitionTaskEvent(task, 'retry');
+    if (!decision.accepted)
+        throw lifecycleRejection(task, 'restartable');
+    if (policy.extendBudget)
+        task.maxAttempts = extendRetryBudget(task);
+    clearExecution(task);
+}
+/** Fixed-job authoritative unblock continuation, applied inside one Job snapshot mutation. */
+export function applyTaskUnblockRetrySnapshot(task) {
+    if (!tryTransitionTaskEvent(task, 'retry').accepted)
+        throw lifecycleRejection(task, 'retryable after unblock');
+    task.maxAttempts = extendRetryBudget(task);
+    clearExecution(task);
+    delete task.blockedBy;
+}
 /** Shared task.retry mutation. The canonical lifecycle graph is the sole legality authority. */
 export async function applyTaskRetryAction(task, policy = {}) {
     if (task.kind === 'planner')
@@ -130,13 +149,48 @@ async function applySelectedRelatedTaskMutations(job, mutations) {
 }
 /** Compatibility bridge: domain mutation only; adapters own wake/reconcile/output behavior. */
 export async function dispatchTaskAction(store, request) {
+    if (store.mutateJob && [TASK_RETRY_ACTION, TASK_RECOVER_ACTION, TASK_CANCEL_ACTION].includes(request.id)) {
+        let updatedTask;
+        const updated = await store.mutateJob(request.jobId, current => {
+            const task = current.tasks.find(item => item.id === request.taskId);
+            if (!task)
+                throw new Error(`Task ${request.taskId} not found`);
+            if (request.id === TASK_RECOVER_ACTION) {
+                const recovery = request.recoveryTaskId ? current.tasks.find(item => item.id === request.recoveryTaskId) : undefined;
+                if (!recovery || recovery.agentName !== 'troubleshooter' || recovery.parentTaskId !== task.id || !['QUEUED', 'RUNNING'].includes(recovery.state))
+                    throw new Error(`task recover requires an active Troubleshooter recovery for ${task.id}`);
+            }
+            const relatedMutations = request.id === TASK_RECOVER_ACTION ? [] : selectRelatedTaskMutations(current, task, request.id);
+            if (request.id === TASK_RETRY_ACTION || request.id === TASK_RECOVER_ACTION)
+                applyTaskRetrySnapshot(task, { extendBudget: true });
+            else if (request.id === TASK_CANCEL_ACTION)
+                cancelTaskSnapshot(task);
+            for (const mutation of relatedMutations) {
+                const related = current.tasks.find(item => item.id === mutation.taskId);
+                if (!related)
+                    throw new Error(`Related task ${mutation.taskId} not found`);
+                cancelTaskSnapshot(related, mutation.reason);
+            }
+            updatedTask = structuredClone(task);
+            return current;
+        });
+        if (!updatedTask)
+            throw new Error(`Task ${request.taskId} was not updated`);
+        return { job: updated, task: updatedTask };
+    }
     const job = await store.load(request.jobId);
     const task = job.tasks.find(item => item.id === request.taskId);
     if (!task)
         throw new Error(`Task ${request.taskId} not found`);
-    const relatedMutations = selectRelatedTaskMutations(job, task, request.id);
+    const relatedMutations = request.id === TASK_RECOVER_ACTION ? [] : selectRelatedTaskMutations(job, task, request.id);
     if (request.id === TASK_RETRY_ACTION)
         await applyTaskRetryAction(task, { extendBudget: true });
+    else if (request.id === TASK_RECOVER_ACTION) {
+        const recovery = request.recoveryTaskId ? job.tasks.find(item => item.id === request.recoveryTaskId) : undefined;
+        if (!recovery || recovery.agentName !== 'troubleshooter' || recovery.parentTaskId !== task.id || !['QUEUED', 'RUNNING'].includes(recovery.state))
+            throw new Error(`task recover requires an active Troubleshooter recovery for ${task.id}`);
+        await applyTaskRetryAction(task, { extendBudget: true });
+    }
     else if (request.id === TASK_UNBLOCK_RETRY_ACTION)
         await applyTaskUnblockRetryAction(task);
     else if (request.id === TASK_CANCEL_ACTION)
@@ -157,3 +211,7 @@ export async function dispatchTaskAction(store, request) {
         await store.saveTask(related);
     return { job, task };
 }
+function cancelTaskSnapshot(task, reason = 'Cancelled by user') {
+    if (!tryApplyTaskCancelAction(task, reason))
+        throw lifecycleRejection(task, 'cancellable');
+}

package/dist/task-update.js

@@ -44,7 +44,7 @@ export async function applyManagedTaskUpdate(store, jobId, taskId, proposed, exp
 }
 export function managedTaskUpdateHandler(locate, wake) {
     return async (jobId, taskId, task, expectedUpdatedAt) => {
-        const target = locate(jobId);
+        const target = await locate(jobId);
         const updated = await applyManagedTaskUpdate(target.store, jobId, taskId, task, expectedUpdatedAt);
         await wake(target.repository, target.prNumber, jobId);
         return updated;

package/dist/troubleshooter.js

@@ -26,7 +26,7 @@ Retrieve this task's lifecycle event history before classifying the root cause o
 GET http://127.0.0.1:8787/api/events?job=${encodeURIComponent(job.id)}&task=${encodeURIComponent(task.id)}&limit=200
 Inspect event order, type/status, source, data/phase, duplicate events, missing expected lifecycle events, late events, and execution identifiers. If the event stream points to delivery/runtime failure, inspect the corresponding Relay/worker/tool logs too. Do not treat the final task.error string as the complete root cause.
 
-Follow the selected Troubleshooter agent contract. Diagnose root cause from durable task state + event history + relevant runtime logs before retry. The final task.error string alone is never sufficient. Classify the evidence as model/provider/runtime, worker/tool/infrastructure, semantic task failure, or timeout/unknown. Only model/provider/runtime evidence may call the narrow model re-decision action; that action gathers fresh usage, reloads current policy, updates this exact Task's routing, and does not retry it. Troubleshooter must then reactivate/retry this exact original task and verify progress. Do not manually choose a provider/model or create a replacement task. If the blocker is a shared worker/runtime/tool defect, create and directly complete a P0/self-job in the owning repository, including required release/deploy verification. If diagnosis suggests a genuine human/external blocker, do not publish task.blocked directly and do not implement the result branch procedurally. Call agents-relay escalation with the original intent, blocker, and relevant context. Pass any caller-defined notification plan through --on-needs-user/--on-needs-user-file; do not hard-code a channel. The canonical escalation graph invokes Neo escalation and owns the resolved/failed/needs_user branch; follow its selected outcome. Retry this exact original task only after the blocker is removed, reconcile the original job, and verify durable progress.`;
+Follow the selected Troubleshooter agent contract. Diagnose root cause from durable task state + event history + relevant runtime logs before retry. The final task.error string alone is never sufficient. Classify the evidence as model/provider/runtime, worker/tool/infrastructure, semantic task failure, or timeout/unknown. Only model/provider/runtime evidence may call the narrow model re-decision action; that action gathers fresh usage, reloads current policy, updates this exact Task's routing, and does not retry it. Troubleshooter must then reactivate/retry this exact original task and verify progress. Use the dedicated agents-relay task recover path with --task-id ${task.id} and --recovery-task-id ${troubleshooterTaskId(task)}; never use ordinary task retry from a Troubleshooter because manual retry intentionally supersedes active recovery. Do not manually choose a provider/model or create a replacement task. If the blocker is a shared worker/runtime/tool defect, create and directly complete a P0/self-job in the owning repository, including required release/deploy verification. If diagnosis suggests a genuine human/external blocker, do not publish task.blocked directly and do not implement the result branch procedurally. Call agents-relay escalation with the original intent, blocker, and relevant context. Pass any caller-defined notification plan through --on-needs-user/--on-needs-user-file; do not hard-code a channel. The canonical escalation graph invokes Neo escalation and owns the resolved/failed/needs_user branch; follow its selected outcome. Retry this exact original task only after the blocker is removed, reconcile the original job, and verify durable progress.`;
 }
 function belongsToCurrentRun(job, task) {
     const slot = job.schedule?.currentRunSlot;
@@ -79,7 +79,7 @@ export function pendingTroubleshooterTasks(job) {
             continuation: null,
             continuationDeliveredAt: null,
             attempt: 0,
-            maxAttempts: 1,
+            maxAttempts: 3,
             leaseOwner: null,
             leaseExpiresAt: null,
             executionId: null,
@@ -94,3 +94,22 @@ export function pendingTroubleshooterTasks(job) {
     }
     return recoveries;
 }
+export function exhaustedTroubleshooterRecoveries(job) {
+    const results = [];
+    for (const recovery of job.tasks) {
+        if (recovery.agentName !== 'troubleshooter' || recovery.state !== 'FAILED' || recovery.attempt < recovery.maxAttempts || !recovery.parentTaskId)
+            continue;
+        const original = job.tasks.find(task => task.id === recovery.parentTaskId);
+        if (!original || !['FAILED', 'BLOCKED'].includes(original.state))
+            continue;
+        const alreadyRecorded = job.recoveryFailures?.some(item => item.taskId === original.id && item.recoveryTaskId === recovery.id);
+        if (alreadyRecorded)
+            continue;
+        results.push({
+            original,
+            recovery,
+            reason: recovery.error ?? recovery.failureReason ?? `Troubleshooter ${recovery.id} ${recovery.state.toLowerCase()}`,
+        });
+    }
+    return results;
+}

package/dist/unblock.js

@@ -1,5 +1,5 @@
-import { transitionTaskEvent } from './scheduler.js';
-import { applyTaskUnblockRetryAction } from './task-actions.js';
+import { applyTaskUnblockRetrySnapshot } from './task-actions.js';
+import { tryTransitionTaskEvent } from './scheduler.js';
 import { dispatchAuthoritativeUnblock } from './workflow/authoritative-unblock-v2.js';
 export function isEffectivelyBlocked(task) { return task.kind !== 'planner' && task.state === 'BLOCKED'; }
 function baselineFor(task) {
@@ -53,14 +53,29 @@ export async function unblockAutonomousTasks(options) {
     const now = options.now ?? new Date().toISOString();
     const currentHeadSha = await store.headSha?.() ?? job.headSha ?? null;
     const facts = unblockFacts(job, tasks, currentHeadSha, trigger.reason);
-    for (const task of tasks) {
-        const baseline = baselineFor(task);
-        task.blockedBaseline = baseline;
-        task.unblock = { at: now, source: trigger.source, reason: trigger.reason, baseline, currentHeadSha: currentHeadSha ?? undefined, facts, blockerJobId: trigger.blockerJobId, resolution: trigger.resolution };
-        await transitionTaskEvent(task, 'task.unblocked');
-        task.updatedAt = now;
-        delete task.blockedBy;
-        await store.saveTask(task);
+    const apply = (current) => {
+        for (const requested of tasks) {
+            const task = current.tasks.find(item => item.id === requested.id);
+            if (!task || !isEffectivelyBlocked(task))
+                throw new Error(`Task ${requested.id} changed before authoritative unblock`);
+            const baseline = baselineFor(task);
+            if (!tryTransitionTaskEvent(task, 'task.unblocked').accepted)
+                throw new Error(`Task ${task.id} cannot be authoritatively unblocked`);
+            task.blockedBaseline = baseline;
+            task.unblock = { at: now, source: trigger.source, reason: trigger.reason, baseline, currentHeadSha: currentHeadSha ?? undefined, facts, blockerJobId: trigger.blockerJobId, resolution: trigger.resolution };
+            task.updatedAt = now;
+            delete task.blockedBy;
+        }
+        current.updatedAt = now;
+    };
+    if (store.mutateJob) {
+        const committed = await store.mutateJob(job.id, current => { apply(current); return current; });
+        Object.assign(job, structuredClone(committed));
+    }
+    else {
+        apply(job);
+        for (const task of tasks)
+            await store.saveTask(task);
     }
     const planTrigger = unconsumedUnblockTrigger(job) ?? {
         source: 'unblock', taskIds: tasks.map(task => task.id), reason: trigger.reason,
@@ -84,11 +99,28 @@ export async function unblockTask(options) {
             options.task.blockedBaseline = baseline;
             const facts = unblockFacts(options.job, [options.task], currentHeadSha, options.trigger.reason);
             options.task.unblock = { at: now, source: options.trigger.source, reason: options.trigger.reason, baseline, currentHeadSha: currentHeadSha ?? undefined, facts, blockerJobId: options.trigger.blockerJobId, resolution: options.trigger.resolution };
-            await transitionTaskEvent(options.task, 'task.unblocked');
-            await options.store.saveTask(options.task);
-            await applyTaskUnblockRetryAction(options.task);
-            options.task.updatedAt = now;
-            await options.store.saveTask(options.task);
+            const apply = (current) => {
+                const task = current.tasks.find(item => item.id === options.task.id);
+                if (!task || !isEffectivelyBlocked(task))
+                    throw new Error(`Task ${options.task.id} changed before authoritative unblock`);
+                if (!tryTransitionTaskEvent(task, 'task.unblocked').accepted)
+                    throw new Error(`Task ${task.id} cannot be authoritatively unblocked`);
+                const baseline = baselineFor(task);
+                task.blockedBaseline = baseline;
+                task.unblock = { at: now, source: options.trigger.source, reason: options.trigger.reason, baseline, currentHeadSha: currentHeadSha ?? undefined, facts, blockerJobId: options.trigger.blockerJobId, resolution: options.trigger.resolution };
+                applyTaskUnblockRetrySnapshot(task);
+                task.updatedAt = now;
+                delete task.blockedBy;
+                current.updatedAt = now;
+            };
+            if (options.store.mutateJob) {
+                const committed = await options.store.mutateJob(options.job.id, current => { apply(current); return current; });
+                Object.assign(options.job, structuredClone(committed));
+            }
+            else {
+                apply(options.job);
+                await options.store.saveTask(options.task);
+            }
             result = { replanning: false };
             return {};
         }

package/dist/worker-rejection.js

@@ -0,0 +1,11 @@
+/** Classify genuine worker-process rejection text, regardless of E2E mode. */
+export function classifyWorkerRejection(message) {
+    if (/rate[_ .-]?limit[_ .-]?exceeded|usage limit reached|quota[_ .-]?exceeded|insufficient[_ .-]?quota/i.test(message))
+        return 'rate_limit_exceeded';
+    if (/model[_ .-]?not[_ .-]?found|model (?:is )?(?:unavailable|not found|unsupported)|unsupported model/i.test(message))
+        return 'model_not_found';
+    if (/provider[_ .-]?unavailable|provider (?:is )?(?:unavailable|refused)|service unavailable/i.test(message))
+        return 'provider_unavailable';
+    return 'worker_process_failed';
+}
+export const reroutableWorkerRejections = new Set(['rate_limit_exceeded', 'model_not_found', 'provider_unavailable']);

package/dist/workflow/contracts.js

@@ -12,6 +12,9 @@ export const WORKFLOW_EVENT_NAMES = [
     'hold',
     'lease.expired',
     'implementation.completed',
+    'local.completed',
+    'local.merge.requested',
+    'effect.deliverLocalMerge.failed',
     'pr.closed',
     'pr.merged',
     'queue',
@@ -48,7 +51,6 @@ export const WORKFLOW_FACT_NAMES = [
     'scheduledRun',
     'hasUnblock',
     'manualPlan',
-    'prOpen',
     'reviewDisabled',
     'implementationComplete',
     'headAvailable',
@@ -67,6 +69,7 @@ export const WORKFLOW_EFFECT_NAMES = [
     'effect.launchTask',
     'effect.cancelActiveTasks',
     'effect.mergePullRequest',
+    'effect.deliverLocalMerge',
     'effect.cleanupJobWorktree',
 ];
 export const WORKFLOW_EFFECT_POLICIES = {
@@ -88,6 +91,12 @@ export const WORKFLOW_EFFECT_POLICIES = {
         retry: 'workflow',
         observability: 'workflow.effect',
     },
+    'effect.deliverLocalMerge': {
+        idempotency: 'job-local-source-sha',
+        failureEvent: 'effect.deliverLocalMerge.failed',
+        retry: 'workflow',
+        observability: 'workflow.effect',
+    },
     'effect.mergePullRequest': {
         idempotency: 'job-head-sha',
         failureEvent: 'effect.mergePullRequest.failed',

package/dist/workflow/definitions-v2.js

@@ -35,6 +35,8 @@ export const jobLifecycleV2 = load('job-lifecycle', JOB_STATES, {
     implementationComplete: boolGuard('implementationComplete'),
     headAvailable: boolGuard('headAvailable'),
     mergeCapable: boolGuard('mergeCapable'),
+    localCompletionAllowed: boolGuard('localCompletionAllowed'),
+    localMergeReady: boolGuard('localMergeReady'),
 });
 function topologyTargets(graph, from) {
     const source = [...graph.nodes.values()].find(node => node.kind === 'state' && node.semanticId === from);