ai-foreman 1.7.20 → 1.7.21

package/dist/cli/start.js

@@ -1,12 +1,18 @@
+import { finalQaRoleInstructions, resolveEffectiveQaConfiguration } from "../qaEffectiveConfig.js";
+import { graphContext, sendGraphTurn } from "../graph/turn.js";
+import { initializeSyntheticWork } from "../buildSyntheticWork.js";
+import { admitApprovedTicket } from "../buildWorkAuthorization.js";
 import { WorkflowReader } from "../workflowReader.js";
 import { localBuildAuthority, canonicalProject, withBuildInvocation } from "../buildAdmission.js";
-import { formatRecoveryCommand } from "../recoveryGuidance.js";
+import { formatRecoveryCommand, formatDecisionCommands, formatExactRunRecovery } from "../recoveryGuidance.js";
 import { durableReadOnlyProposal } from "../readOnlyProposal.js";
 import { captureFrozenQaSource } from "../qaSnapshot.js";
 import { finishStartAdmission, superviseStart, supervisedRunId } from "../supervisedStart.js";
-import { durableHumanDecision, HumanDecisionRequired } from "../humanDecision.js";
+import { assertBuildAssignmentReconciled } from "../buildAssignment.js";
+import { durableHumanDecision, HumanDecisionRequired, HumanDecisionCancelled, servicePendingHumanDecisions } from "../humanDecision.js";
 import { requiresBuildApproval, buildScopeRevision, createBuildApprovalGate } from "../buildApproval.js";
 import { Command, Option } from "commander";
+import { accent, error, sanitizeTerminalText, success, warning } from "../terminalStyle.js";
 import { resolve, join, relative } from "node:path";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
@@ -55,7 +61,6 @@ import { ObservabilityStore, RunObserver } from "../observability.js";
 import { loadProjectAutonomyConfig, resolveAutonomyPolicy, resolveQaEnablement } from "../recoveryPolicy.js";
 import { loadQaRecoveryPacket, recoverPendingQaRecoveryPublications } from "../qaRecovery.js";
 import { qaDigest } from "../qaProtocolV2.js";
-import { loadSkill } from "special-agents";
 import { acceptQaRuntimeHandoff, describeQaRuntimeHandle, frozenQaRuntimeSettings } from "../qaRuntime.js";
 const FOREMAN_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
 function fail(message) {
@@ -147,11 +152,10 @@ export function formatResumeGuidance(executable, projectDir, steps, sessionId, r
         return [
             ...run.decisions.flatMap(decision => [
                 `foreman: input required: ${decision.prompt}`,
-                `foreman: choices: ${decision.choices.map(choice => `${choice.id} (${choice.label})`).join(", ")}`,
-                `  rafi build:decide ${shellQuote(projectDir)} --run ${shellQuote(run.runId)} --decision ${shellQuote(decision.decisionId)} --choice <choice-id>`,
+                ...formatDecisionCommands(projectDir, run.runId, decision, executable),
             ]),
-            "foreman: resume this run with:",
-            `  ${formatRecoveryCommand(projectDir, "rafi")}`,
+            executable === "rafi" ? "foreman: resume this run with:" : "foreman: review recovery for this run with:",
+            `  ${formatExactRunRecovery(projectDir, run.runId, executable)}`,
         ];
     if (executable === "rafi") {
         return [
@@ -486,6 +490,8 @@ export function buildStartCommand() {
         .option("--auto-compact-threshold <percent>", "initial Builder context compaction threshold (1-99)")
         .option("--max-branch-depth <n>", "maximum selected branch stack depth", "5")
         .option("--pr-ready", "create ready-for-review PRs instead of draft PRs")
+        .option("--builder-network", "request build-scoped builder internet access with separate explicit approval; rechecked on resume")
+        .option("--builder-approvals", "allow the builder to request explicit per-operation sandbox approvals; QA stays restricted")
         .option("--keep-worktrees", "keep successful ticket worktrees for inspection")
         .option("--ticket <id>", "select one new ticket, or identify recovery tickets with --resume/--continue/--recover-run", collectTicket, [])
         .option("--skip-delivery-unit <id>", "skip one unfinished delivery unit for this run", collectTicket, [])
@@ -558,6 +564,34 @@ export function buildStartCommand() {
         try {
             if (await superviseStart(cwd, supervisedInvocationId, opts.supervisor === false ? { ...frozenPolicy, supervisorEnabled: false } : frozenPolicy, { steps: opts.steps, stacks: opts.stacks, detach: opts.detach, launchToken: opts.launchToken, startArgs: savedStartArguments(command, cwd, opts) }))
                 return;
+            if (recoveryRecord || opts.preparationRun) {
+                assertBuildAssignmentReconciled(cwd, supervisedInvocationId);
+                if (!await servicePendingHumanDecisions({ projectDir: cwd, runId: supervisedInvocationId, tickets: requestedTicketIds.length ? requestedTicketIds : recoveryRecord?.tickets.length ? recoveryRecord.tickets : undefined, scopeRevision: isTicketsInitialized(cwd) ? buildScopeRevision(cwd) : undefined }))
+                    return;
+            }
+            const requestedNetwork = Boolean(opts.builderNetwork || recoveryRecord?.builderCapabilities?.requestedNetwork);
+            let grantedNetwork = false;
+            if (requestedNetwork) {
+                const permissionDb = new WorkflowDb(cwd);
+                let networkKey;
+                try {
+                    networkKey = permissionDb.pendingHumanDecisions(supervisedInvocationId).find(decision => decision.interruptionId.startsWith("builder-network:"))?.interruptionId ?? `builder-network:${process.pid}:${randomUUID()}`;
+                }
+                finally {
+                    permissionDb.close();
+                }
+                const networkDecision = await durableHumanDecision({ projectDir: cwd, runId: supervisedInvocationId, key: networkKey,
+                    prompt: "Allow the builder shell to access the internet for this build? This permits network use by any builder command, not only downloads. Workspace write confinement remains enforced. QA stays offline. Recovery requires approval again; --yes does not approve this permission.",
+                    choices: [{ id: "allow-network", label: "Allow builder internet for this build" }, { id: "stay-offline", label: "Stay offline and use a verified local bundle" }],
+                    operation: async () => {
+                        const action = await select({ message: "Allow builder internet for this build?", options: [{ value: "stay-offline", label: "Stay offline" }, { value: "allow-network", label: "Allow builder internet for this build" }] });
+                        return isCancel(action) ? undefined : action;
+                    } });
+                if (networkDecision === undefined || isCancel(networkDecision))
+                    return;
+                grantedNetwork = networkDecision === "allow-network";
+            }
+            const builderCapabilities = { requestedNetwork, grantedNetwork, ...(grantedNetwork ? { approvedAt: new Date().toISOString(), grantWorkerPid: process.pid } : {}) };
             const readinessOwner = { project: cwd, runId: supervisedInvocationId, authority: localBuildAuthority(cwd) };
             const autoApprovePlanUpdates = recoveryRecord
                 ? recoveryRecord.recoveryDecision?.planUpdateApproval === "auto"
@@ -799,7 +833,7 @@ export function buildStartCommand() {
             }
             const recoveryTicket = !branchMode && recoveryRecord ? continueTickets[0] : undefined;
             const preferredTicket = selectedNewTicket ?? recoveryTicket;
-            const executionTickets = !branchMode && recoveryRecord && recoveryRecord.tickets.length
+            let executionTickets = !branchMode && recoveryRecord && recoveryRecord.tickets.length
                 ? recoveryExecutionTickets(recoveryRecord, requestedTicketIds, Boolean(opts.recoveryMode))
                 : selectedNewTicket ? [selectedNewTicket] : undefined;
             const config = loadConfig(join(cwd, "foreman.yaml"));
@@ -826,11 +860,15 @@ export function buildStartCommand() {
                 }
             }
             let activeObserver = observabilityStore ? new RunObserver(observabilityStore, invocationRunId) : undefined;
-            const finishObservationOnExit = () => {
+            const finishObservationOnExit = (exitCode) => {
                 if (!activeObserver)
                     return;
-                activeObserver.finish("interrupted");
-                observabilityStore?.closeLogFile(logPath, "interrupted");
+                const reader = new WorkflowReader(cwd);
+                const durable = reader.getRun(invocationRunId);
+                reader.close();
+                const outcome = durable?.status === "cancelled" ? "cancelled" : durable?.checkpoint === "waiting-for-human" ? "waiting-for-human" : durable?.status === "failed" ? "failed" : "interrupted";
+                activeObserver.finish(outcome, { checkpoint: durable?.checkpoint, failureCategory: `process-exit:${exitCode}` });
+                observabilityStore?.closeLogFile(logPath, outcome);
                 observabilityStore?.close();
                 activeObserver = undefined;
             };
@@ -864,6 +902,8 @@ export function buildStartCommand() {
                     workspaceIdentity: !branchMode ? captureCurrentWorkflowSessionIdentity(builderCwd) : captureWorkspaceIdentity(builderCwd),
                     ticketId: sessionRef?.ticketId,
                     deliveryUnitId: sessionRef?.deliveryUnitId,
+                    networkAccess: grantedNetwork,
+                    approvalPolicy: opts.builderApprovals ? "on-request" : "never",
                     permission: createPermissionHandler(builderPolicy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
                     onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
                     onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
@@ -871,7 +911,7 @@ export function buildStartCommand() {
                     fast: builderFast,
                     systemPromptAppend: roleBundle.system || undefined,
                     skills: roleBundle.skills.length > 0 ? roleBundle.skills : undefined,
-                    autoCompactThresholdPercent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                    autoCompactThresholdPercent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                     observer: activeObserver,
                 };
                 const adapter = agent === "codex"
@@ -894,13 +934,13 @@ export function buildStartCommand() {
                 role, source: roleDefaults.builder ? "project" : "provider", make: agent, model: model ?? "default",
                 reasoning: builderEffort ?? "default", fast: Boolean(builderFast), session_strategy: roleDefaults.builder?.session_strategy ?? "compact",
                 settings_revision: settingsRevision, display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                 compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
             } : {
                 role, source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default",
                 reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact",
                 settings_revision: settingsRevision, display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false,
-                auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50,
+                auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65,
                 compact_maximum: roleDefaults.qa?.compact_maximum ?? 10,
             };
             const liveRoleSettings = (role, base) => {
@@ -953,22 +993,9 @@ export function buildStartCommand() {
             });
             const qaRuntimeMetadata = new WeakMap();
             const resolveQaRuntimeMetadata = (qaCwd, settings) => {
-                const bundle = loadRoleBundle("qa", { projectDir: qaCwd });
-                const effectiveRoleInstructions = `${bundle.system}\n\nYou are an independent QA reviewer. Do not edit source, tickets, configuration, or project documentation. You may run tests and create only harmless ignored caches or coverage output.`;
-                const skills = bundle.skills.map((name) => {
-                    const runtimeRoot = settings.make === "codex" ? ".codex" : ".claude";
-                    const path = [join(qaCwd, runtimeRoot, "skills", name, "SKILL.md"), join(qaCwd, ".agents", "skills", name, "SKILL.md")].find(existsSync);
-                    if (path) {
-                        const content = `## ${name}\n${readFileSync(path, "utf8").trim()}`;
-                        return { name, path, content, digest: createHash("sha256").update(content).digest("hex") };
-                    }
-                    const bundled = loadSkill(name);
-                    if (!bundled.body?.trim())
-                        throw new Error(`QA runtime ${settings.make} skill ${name} has no exact dispatchable content`);
-                    const content = `## ${bundled.name}\n${bundled.body.trim()}`;
-                    return { name, path: `special-agents:${name}`, content, digest: createHash("sha256").update(content).digest("hex") };
-                });
-                return { settings: structuredClone(settings), effectiveRoleInstructions, skills };
+                const effective = resolveEffectiveQaConfiguration(cwd, settings);
+                const effectiveRoleInstructions = finalQaRoleInstructions(effective.qaRules);
+                return { settings: structuredClone(settings), effectiveRoleInstructions, skills: effective.skills.map(skill => ({ ...skill, digest: createHash("sha256").update(skill.content).digest("hex") })) };
             };
             const createBuilderForSettings = async (builderCwd, settings) => {
                 const ready = await ensureBuildRuntimeReadyForCommand(builderCwd, settings.make, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
@@ -994,6 +1021,8 @@ export function buildStartCommand() {
                     shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
                     turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
                     model: settings.model === "default" ? undefined : settings.model,
+                    networkAccess: grantedNetwork,
+                    approvalPolicy: opts.builderApprovals ? "on-request" : "never",
                     permission: createPermissionHandler(policy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
                     onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
                     onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
@@ -1677,6 +1706,7 @@ export function buildStartCommand() {
                 if (branchDefaults.createReview && branchDefaults.reviewProvider) {
                     await ensureReviewProviderReady(cwd, branchDefaults.reviewProvider, log, Boolean(opts.yes));
                 }
+                console.log(`foreman: builder capability request: workspace writes, shell network ${grantedNetwork ? "approved for this build" : "off"}, approvals ${opts.builderApprovals ? "per operation" : "never"}; effective policy requires provider confirmation. Use a provenance-verified local source/dependency bundle for offline acquisition.`);
                 const ready = await ensureBuildRuntimeReadyForCommand(cwd, agent, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
                     label: "start",
                     yes: Boolean(opts.yes),
@@ -1755,7 +1785,7 @@ export function buildStartCommand() {
                     try {
                         auditBuilder = await createBuilder(cwd);
                         auditViewer = printEvents(auditBuilder.events());
-                        const audit = await auditBuilder.sendTurn(buildBranchAuditInstruction(plan.nodes.map((node) => node.ticket)));
+                        const audit = await sendGraphTurn(auditBuilder, buildBranchAuditInstruction(plan.nodes.map((node) => node.ticket)), graphContext(cwd, auditBuilder.sessionRef?.()?.cwd ?? cwd, "branch-dependency-audit", plan.nodes.map(node => node.ticket.id).join(" ")), { purpose: "planning" });
                         if (audit.isError)
                             throw new Error(audit.text);
                         const auditDependencies = parseAuditDependencies(audit.text);
@@ -1860,23 +1890,23 @@ export function buildStartCommand() {
                     make: agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
                     session_strategy: roleDefaults.builder?.session_strategy ?? "compact", settings_revision: settingsRevision,
                     display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-                    auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                    auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                     compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
                 };
                 const capturedBranchQa = {
                     role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default",
                     reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", settings_revision: settingsRevision,
                     display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false,
-                    auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50,
+                    auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65,
                     compact_maximum: roleDefaults.qa?.compact_maximum ?? 10,
                 };
                 const firstResumeRef = plan.nodes[0] ? resumeSessionByTicket.get(plan.nodes[0].ticket.id)?.sessionRef : undefined;
                 let masterRun = recoveryRecord ? resumeBuildRun(cwd, recoveryRecord.runId, { builder: capturedBranchBuilder, qa: capturedBranchQa, builderSessionId: firstResumeRef?.sessionId ?? null, builderSessionRef: firstResumeRef ?? null, expectedRecoveryDecisionDigest: opts.recoveryDecisionDigest }) : createBuildRun({
                     runId: invocationRunId,
-                    tickets: plan.nodes.map((node) => node.ticket.id), deliveryUnit: selectedStacks.length ? selectedStacks.map((stack) => stack.id).join(",") : deliveryRun?.unit.id,
+                    builderCapabilities, tickets: plan.nodes.map((node) => node.ticket.id), deliveryUnit: selectedStacks.length ? selectedStacks.map((stack) => stack.id).join(",") : deliveryRun?.unit.id,
                     repositoryRoot: cwd, branchMode: branchPresentation.allocationMode, baseRef: plan.baseRef, builder: capturedBranchBuilder, qa: capturedBranchQa,
                     frozenPolicy, autonomyProfile, qaEnabled,
-                    runDecisions: { workMode: "branch-per-ticket", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBranchBuilder.auto_compact_threshold_percent ?? 50, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
+                    runDecisions: { workMode: "branch-per-ticket", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBranchBuilder.auto_compact_threshold_percent ?? 65, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
                 });
                 activeContinuityRunId = masterRun.runId;
                 if (requiresBuildApproval(cwd, plan.nodes.map(node => node.ticket.id), autoApprovePlanUpdates, approvalConsequences) && plan.issues.every((issue) => !issue.blocking)) {
@@ -1888,10 +1918,25 @@ export function buildStartCommand() {
                             ],
                         }) });
                     if (isCancel(action) || action === "cancel") {
+                        const cancelled = action === "cancel";
+                        if (cancelled) {
+                            const decisions = new WorkflowDb(cwd);
+                            try {
+                                decisions.cancelPendingHumanDecisions(invocationRunId, "User cancelled build; pending decisions superseded");
+                            }
+                            finally {
+                                decisions.close();
+                            }
+                        }
+                        masterRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, cancelled ? "cancelled" : "input-paused", { status: cancelled ? "cancelled" : "recoverable" }), cancelled ? "cancelled" : "recoverable");
+                        activeObserver?.finish(cancelled ? "cancelled" : "paused", { checkpoint: cancelled ? "user-cancel" : "prompt-eof-or-cancel" });
                         console.log("ai-foreman: cancelled");
                         process.exit(0);
                     }
                 }
+                for (const node of plan.nodes)
+                    admitApprovedTicket(cwd, masterRun.runId, node.ticket.id, buildScopeRevision(cwd), `build invocation ${invocationRunId}: approved branch plan`);
+                masterRun = checkpointBuildRun(cwd, masterRun, "capabilities-resolved", { builderCapabilities });
                 const qaResumedRecovery = recoveryRecord ? pendingQaRecoveryPacket(cwd, masterRun.runId, requestedTicketIds[0]) : undefined;
                 let qaProtocolResumeTicket;
                 if (recoveryRecord && !qaResumedRecovery) {
@@ -2149,6 +2194,17 @@ export function buildStartCommand() {
                 fireTerminalBell(config.notifications.terminal_bell);
                 process.exit(failed ? 2 : 0);
             }
+            if (!recoveryRecord && isTicketsInitialized(cwd)) {
+                const paths = resolveTicketPaths(loadTicketsConfig(cwd), cwd);
+                const state = new StateDb(paths.stateDb);
+                try {
+                    executionTickets = executionTickets ?? loadTickets(paths.tickets).filter(ticket => !["done", "canceled", "cancelled", "obsolete"].includes(state.getState(ticket.id)?.status ?? "planned")).sort((a, b) => a.order - b.order).slice(0, steps).map(ticket => ticket.id);
+                }
+                finally {
+                    state.close();
+                }
+            }
+            console.log(`foreman: builder capability request: workspace writes, shell network ${grantedNetwork ? "approved for this build" : "off"}, approvals ${opts.builderApprovals ? "per operation" : "never"}; effective policy requires provider confirmation. Use a provenance-verified local source/dependency bundle for offline acquisition.`);
             const ready = await ensureBuildRuntimeReadyForCommand(cwd, agent, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
                 label: "start",
                 yes: Boolean(opts.yes),
@@ -2183,16 +2239,17 @@ export function buildStartCommand() {
                 make: agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
                 session_strategy: roleDefaults.builder?.session_strategy ?? "compact", settings_revision: settingsRevision,
                 display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                 compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
             };
-            const capturedQa = { role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default", reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false, auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50, compact_maximum: roleDefaults.qa?.compact_maximum ?? 10, settings_revision: settingsRevision };
+            const capturedQa = { role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default", reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false, auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65, compact_maximum: roleDefaults.qa?.compact_maximum ?? 10, settings_revision: settingsRevision };
             let buildRun = recoveryRecord ? resumeBuildRun(cwd, recoveryRecord.runId, { builder: capturedBuilder, qa: capturedQa, builderSessionId: resumeSessionId ?? null, builderSessionRef: resumeSessionRef ?? null, expectedRecoveryDecisionDigest: opts.recoveryDecisionDigest }) : createBuildRun({
                 runId: invocationRunId,
-                tickets: [], repositoryRoot: cwd, branchMode: "current", baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch, builder: capturedBuilder, qa: capturedQa,
+                tickets: [...(executionTickets ?? [])], builderCapabilities, authorizedBatch: { tickets: [...(executionTickets ?? [])], requestedSteps: steps, scopeRevision: buildScopeRevision(cwd, approvalConsequences), startedTickets: [] }, repositoryRoot: cwd, branchMode: "current", baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch, builder: capturedBuilder, qa: capturedQa,
                 frozenPolicy, autonomyProfile, qaEnabled,
-                runDecisions: { workMode: "current", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBuilder.auto_compact_threshold_percent ?? 50, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
+                runDecisions: { workMode: "current", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBuilder.auto_compact_threshold_percent ?? 65, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
             });
+            buildRun = checkpointBuildRun(cwd, buildRun, "capabilities-resolved", { builderCapabilities });
             activeObserver?.store.attachExecutionLease(activeObserver.executionId, readCurrentWorkflowLease(cwd)?.generation);
             activeContinuityRunId = buildRun.runId;
             const qaResumedRecovery = recoveryRecord ? pendingQaRecoveryPacket(cwd, buildRun.runId, requestedTicketIds[0]) : undefined;
@@ -2346,11 +2403,11 @@ export function buildStartCommand() {
                 builderFast ? "fast" : null,
                 qaEnabled ? null : "qa=off",
             ].filter(Boolean).join(" ");
-            console.log(`foreman: driving a ${agent} builder through ${steps} step(s)${modifiers ? ` [${modifiers}]` : ""}`);
-            console.log(`foreman: project ${cwd}`);
+            console.log(`${accent("foreman:")} driving a ${sanitizeTerminalText(agent)} builder through ${steps} step(s)${modifiers ? ` [${sanitizeTerminalText(modifiers)}]` : ""}`);
+            console.log(`${accent("foreman:")} project ${sanitizeTerminalText(cwd)}`);
             if (trackerRelPath)
-                console.log(`foreman: tracker ${trackerRelPath}`);
-            console.log(`foreman: log ${logPath}\n`);
+                console.log(`${accent("foreman:")} tracker ${sanitizeTerminalText(trackerRelPath)}`);
+            console.log(`${accent("foreman:")} log ${sanitizeTerminalText(logPath)}\n`);
             const viewer = printEvents(builder.events());
             try {
                 if (recoveryRecord && currentBranchTicketProgress(cwd, buildRun)?.remaining.length === 0) {
@@ -2439,6 +2496,18 @@ export function buildStartCommand() {
                                 ],
                             }) });
                         if (isCancel(action) || action === "cancel") {
+                            const cancelled = action === "cancel";
+                            if (cancelled) {
+                                const decisions = new WorkflowDb(cwd);
+                                try {
+                                    decisions.cancelPendingHumanDecisions(invocationRunId, "User cancelled build; pending decisions superseded");
+                                }
+                                finally {
+                                    decisions.close();
+                                }
+                            }
+                            buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, cancelled ? "cancelled" : "input-paused", { status: cancelled ? "cancelled" : "recoverable" }), cancelled ? "cancelled" : "recoverable");
+                            activeObserver?.finish(cancelled ? "cancelled" : "paused", { checkpoint: cancelled ? "user-cancel" : "prompt-eof-or-cancel" });
                             console.log("ai-foreman: cancelled");
                             statusReporter.stop("cancelled");
                             await foreman.close();
@@ -2453,7 +2522,9 @@ export function buildStartCommand() {
                                 message: "Your feedback:",
                                 validate: (v) => (v?.trim() ? undefined : "Please enter some feedback"),
                             }) });
-                        if (isCancel(fb)) {
+                        if (isCancel(fb) || fb === undefined) {
+                            buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "input-paused", { status: "recoverable" }), "recoverable");
+                            activeObserver?.finish("paused", { checkpoint: "feedback-eof-or-cancel" });
                             console.log("ai-foreman: cancelled");
                             statusReporter.stop("cancelled");
                             await foreman.close();
@@ -2466,10 +2537,16 @@ export function buildStartCommand() {
                     }
                 });
                 await ensureApproved();
+                if (!isTicketsInitialized(cwd)) {
+                    const synthetic = initializeSyntheticWork(cwd, buildRun.runId, steps, `Explicit unticketed build invocation ${invocationRunId}`, foreman.approvedPlanText());
+                    buildRun = checkpointBuildRun(cwd, buildRun, "synthetic-work-admitted", { tickets: synthetic });
+                }
                 const onTicketStart = async (ticketId) => {
                     await ensureApproved();
+                    admitApprovedTicket(cwd, buildRun.runId, ticketId, buildScopeRevision(cwd), `build invocation ${invocationRunId}: approved ticket selection`);
                     const tickets = buildRun.tickets.includes(ticketId) ? buildRun.tickets : [...buildRun.tickets, ticketId];
-                    buildRun = checkpointBuildRun(cwd, buildRun, "ticket-selected", { tickets, currentTicket: ticketId });
+                    buildRun = checkpointBuildRun(cwd, buildRun, "ticket-selected", { tickets, currentTicket: ticketId,
+                        ...(buildRun.authorizedBatch ? { authorizedBatch: { ...buildRun.authorizedBatch, approvalRevisions: [...new Set([...(buildRun.authorizedBatch.approvalRevisions ?? [buildRun.authorizedBatch.scopeRevision]), buildScopeRevision(cwd, approvalConsequences)])], startedTickets: [...new Set([...buildRun.authorizedBatch.startedTickets, ticketId])] } } : {}) });
                 };
                 const batch = () => foreman.runBatch(steps, trackerRelPath, onTicketStart, preferredTicket, executionTickets);
                 const result = await (activeObserver ? activeObserver.span("builder_work", "Builder and QA batch", batch) : batch());
@@ -2496,8 +2573,12 @@ export function buildStartCommand() {
                 pruneRecoveryTelemetryAtCompletion(cwd, config.observability.detail_retention_days);
                 activeObserver = undefined;
                 process.off("exit", finishObservationOnExit);
-                console.log(`\nforeman: ${result.completed}/${result.requested} step(s) completed`);
-                console.log(`foreman: outcome — ${result.outcome}`);
+                console.log(`\n${accent("foreman:")} ${result.completed}/${result.requested} step(s) completed`);
+                const safeOutcome = sanitizeTerminalText(result.outcome);
+                const resultOutcome = /success|complete|pass/i.test(safeOutcome) ? success(safeOutcome)
+                    : /fail|error/i.test(safeOutcome) ? error(safeOutcome)
+                        : /warn|partial|blocked/i.test(safeOutcome) ? warning(safeOutcome) : safeOutcome;
+                console.log(`${accent("foreman:")} outcome — ${resultOutcome}`);
                 if (result.detail)
                     console.log(`foreman: ${result.detail}`);
                 if (buildRun.status === "completed")
@@ -2561,6 +2642,13 @@ export function buildStartCommand() {
                     console.error(`foreman: resume this run with: ${formatRecoveryCommand(cwd)}`);
                     process.exit(2);
                 }
+                if (err instanceof HumanDecisionCancelled) {
+                    buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "cancelled", { status: "cancelled" }), "cancelled");
+                    activeObserver?.finish("cancelled", { checkpoint: "question-menu" });
+                    await foreman.close().catch(() => { });
+                    console.log("ai-foreman: cancelled");
+                    process.exit(0);
+                }
                 if (err instanceof HumanDecisionRequired) {
                     buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "waiting-for-human", { status: "recoverable" }), "recoverable");
                     await foreman.close().catch(() => { });
@@ -2585,6 +2673,16 @@ export function buildStartCommand() {
                 fail(`run failed: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        catch (error) {
+            if (error instanceof HumanDecisionCancelled) {
+                console.log("ai-foreman: cancelled");
+                return;
+            }
+            if (!(error instanceof HumanDecisionRequired))
+                throw error;
+            console.error(error.message);
+            process.exitCode = 2;
+        }
         finally {
             finishStartAdmission(cwd, supervisedInvocationId);
         }
@@ -2680,8 +2778,11 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
             throw new Error("QA nonconvergence requires its owning build run");
         const scope = createHash("sha256").update(JSON.stringify([buildScopeRevision(projectDir), context.ticket, context.history])).digest("hex");
         let round = 0;
+        let waiverDecisionId;
         const ask = (phase, choices, operation) => durableHumanDecision({
             projectDir, runId, ticketId: context.ticket.id, observer: observer?.(), defer: noninteractive,
+            onAnswered: decision => { if (phase.startsWith("QA waiver confirmation") && decision.selectedChoiceId === "yes")
+                waiverDecisionId = decision.decisionId; },
             key: `qa-nonconvergence:${scope}:${round}:${phase}`, prompt: `${context.ticket.id}: ${phase}`, choices, operation,
         });
         while (true) {
@@ -2702,7 +2803,10 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                     ] }));
                 if (approved === "yes") {
                     const db = new WorkflowDb(projectDir);
+                    let authorizationRef;
                     try {
+                        if (db.qaPreparationStore().policy(runId)?.mode === "enforce")
+                            authorizationRef = db.authorizeContractQaWaiver(runId, context.ticket.id, waiverDecisionId);
                         const lease = db.currentLease();
                         if (lease) {
                             const detail = JSON.stringify({ decision: "waive", ticket: context.ticket.id, unresolved: context.history, at: new Date().toISOString() });
@@ -2714,7 +2818,7 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                         db.close();
                     }
                     console.log(`foreman: QA WAIVER recorded for ${context.ticket.id}; validation_result will be failed`);
-                    return { action: "waive" };
+                    return { action: "waive", ...(authorizationRef ? { authorizationRef } : {}) };
                 }
                 continue;
             }

package/dist/cli/status.js

@@ -6,8 +6,9 @@ import { recoverableBuildRuns } from "../buildRuns.js";
 import { WORKFLOW_DB_FILE } from "../workflowDb.js";
 import { WorkflowReader } from "../workflowReader.js";
 import { formatWorkflowIssue } from "../outcomes.js";
+import { accent, error, sanitizeTerminalText, success, warning } from "../terminalStyle.js";
 function fail(message) {
-    console.error(`foreman: ${message}`);
+    console.error(`${error("foreman:", { stream: process.stderr })} ${message}`);
     process.exit(1);
 }
 export function buildStatusCommand() {
@@ -24,6 +25,16 @@ export function runStatus(project) {
     const workflowPath = join(projectDir, WORKFLOW_DB_FILE);
     const workflow = existsSync(workflowPath) ? new WorkflowReader(projectDir, workflowPath) : undefined;
     const activeWorkflows = workflow?.activeRuns() ?? [];
+    for (const run of activeWorkflows) {
+        const preparation = workflow?.qaPreparation(run.runId);
+        if (!preparation || preparation.mode === "legacy")
+            continue;
+        console.log(`foreman: QA preparation ${preparation.mode} — ${run.runId}`);
+        const metrics = workflow.qaPreparationMetrics(run.runId);
+        console.log(`  admitted ${metrics.approved}; started ${metrics.started}; first reviews ${metrics.firstReviews}; passes ${metrics.firstReviewPasses}; unknown finding causes ${metrics.causes.unknown}`);
+        for (const work of preparation.works)
+            console.log(`  ${work.workId}: ${work.state}; depth ${work.depth ?? "assessment pending"}; contract ${work.digest ?? "unpublished"}${work.detail ? `; ${work.detail}` : ""}`);
+    }
     if (!existsSync(dir) && activeWorkflows.length === 0) {
         workflow?.close();
         fail(`no foreman runs found under ${dir}`);
@@ -52,8 +63,8 @@ export function runStatus(project) {
     const prEvents = records.filter((r) => ["pr-created", "pr-existing", "pr-failed"].includes(String(r.event)));
     const latestFailure = findLatestGitHubFailure(records);
     const batchEnd = [...records].reverse().find((r) => r.event === "batch-end");
-    console.log(`foreman: latest run ${logs[logs.length - 1]}`);
-    console.log(`foreman: ${steps.length} step record(s), ${escalations.length} escalation(s)`);
+    console.log(`${accent("foreman:")} latest run ${sanitizeTerminalText(logs[logs.length - 1] ?? "")}`);
+    console.log(`${accent("foreman:")} ${steps.length} step record(s), ${escalations.length} escalation(s)`);
     if (branchEvents.length || prEvents.length) {
         const completed = branchEvents.filter((r) => r.event === "branch-complete").length;
         const issues = branchEvents.filter((r) => r.event === "branch-issue").length;
@@ -61,12 +72,16 @@ export function runStatus(project) {
         console.log(`foreman: branch mode — ${completed} completed, ${issues} issue(s), ${prs} PR(s)`);
     }
     if (batchEnd) {
-        console.log(`foreman: outcome — ${batchEnd.outcome} (${batchEnd.completed}/${batchEnd.requested})`);
+        const outcome = sanitizeTerminalText(String(batchEnd.outcome ?? ""));
+        const styledOutcome = /success|complete|pass/i.test(outcome) ? success(outcome)
+            : /fail|error/i.test(outcome) ? error(outcome)
+                : /warn|partial|blocked/i.test(outcome) ? warning(outcome) : outcome;
+        console.log(`${accent("foreman:")} outcome — ${styledOutcome} (${batchEnd.completed}/${batchEnd.requested})`);
         if (batchEnd.detail)
             console.log(`foreman: ${batchEnd.detail}`);
     }
     else {
-        console.log("ai-foreman: run is still in progress or did not finish");
+        console.log(`${accent("ai-foreman:")} run is still in progress or did not finish`);
     }
     if (latestFailure) {
         console.log(`foreman: latest GitHub failure — ${latestFailure.code}: ${latestFailure.message}`);

package/dist/cli/tickets.js

@@ -1,4 +1,5 @@
 import { Command } from "commander";
+import { accent, error, sanitizeTerminalText, success, warning } from "../terminalStyle.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
@@ -1240,6 +1241,7 @@ export async function cmdPopulateCli(opts) {
         builder = roleBuilder.builder;
         viewer = printEvents(builder.events());
         const foreman = new Foreman(builder, log, { desktop: config.notifications.enabled, terminalBell: config.notifications.terminal_bell }, false, 3, dir);
+        foreman.setGraphPurpose("ticket-population");
         console.log(`foreman tickets: populating tickets with ${roleBuilder.runtime}`);
         console.log(`foreman tickets: project ${dir}`);
         console.log(`foreman tickets: role ${TICKET_POPULATE_ROLE}`);
@@ -1927,7 +1929,7 @@ export function buildTicketsCommand(options = {}) {
                 evidence: opts.evidence,
                 lastError: opts.lastError,
             });
-            console.log(`foreman tickets: updated ${ticketId}`);
+            console.log(`${accent("foreman tickets:")} updated ${sanitizeTerminalText(ticketId)}`);
         }
         catch (err) {
             fail(String(err instanceof Error ? err.message : err));
@@ -1954,7 +1956,7 @@ export function buildTicketsCommand(options = {}) {
                 evidence: opts.evidence,
                 validationNotes: opts.validationNotes,
             });
-            console.log(`foreman tickets: completed ${ticketId}`);
+            console.log(`${accent("foreman tickets:")} ${success("completed")} ${sanitizeTerminalText(ticketId)}`);
         }
         catch (err) {
             fail(String(err instanceof Error ? err.message : err));
@@ -1979,7 +1981,7 @@ export function buildTicketsCommand(options = {}) {
                 actor: opts.actor,
                 unblockCriteria: opts.unblockCriteria,
             });
-            console.log(`foreman tickets: blocked ${ticketId}`);
+            console.log(`${accent("foreman tickets:")} ${warning("blocked")} ${sanitizeTerminalText(ticketId)}`);
         }
         catch (err) {
             fail(String(err instanceof Error ? err.message : err));
@@ -1998,7 +2000,7 @@ export function buildTicketsCommand(options = {}) {
                 summary: opts.summary,
                 actor: opts.actor,
             });
-            console.log(`foreman tickets: unblocked ${ticketId}`);
+            console.log(`${accent("foreman tickets:")} ${success("unblocked")} ${sanitizeTerminalText(ticketId)}`);
         }
         catch (err) {
             fail(String(err instanceof Error ? err.message : err));
@@ -2188,10 +2190,10 @@ export function buildTicketsCommand(options = {}) {
         try {
             const result = cmdValidate(cwd(opts));
             if (result.issues.length === 0) {
-                console.log("foreman tickets: validation passed — all 4 passes clean");
+                console.log(`${accent("foreman tickets:")} ${success("validation passed")} — all 4 passes clean`);
             }
             else {
-                console.log(`foreman tickets: ${result.issues.length} issue(s) found:`);
+                console.log(`${accent("foreman tickets:")} ${error(`${result.issues.length} issue(s) found:`)}`);
                 console.log(formatValidationIssues(result.issues));
                 if (!result.clean)
                     process.exit(1);
@@ -2221,7 +2223,7 @@ export function buildTicketsCommand(options = {}) {
                         console.log(line);
                 return;
             }
-            console.log("Batches: none configured. Queue is flat.");
+            console.log(`${accent("Batches:")} none configured. Queue is flat.`);
             const rows = cmdQueue(dir, opts.limit !== undefined ? Number(opts.limit) : undefined);
             if (rows.length === 0) {
                 console.log("No remaining tickets.");

package/dist/continuity.d.ts

@@ -61,6 +61,14 @@ export interface ContinuityAdapterOptions {
 export declare class ContinuityAdapter implements BuilderAdapter {
     private readonly options;
     private adapter;
+    contractCapabilities(): {
+        sameSessionAcceptance: boolean;
+        nativeCompactionBarrier: boolean;
+    };
+    private contractEnforcing;
+    enableContractEnforcement(): void;
+    contractCompactionSequence(): number;
+    acceptContractDelivery(sequence: number): void;
     private readonly queue;
     private sourcePump?;
     private recoveryLeasePending;
@@ -74,7 +82,9 @@ export declare class ContinuityAdapter implements BuilderAdapter {
         handback?: boolean;
         responseOnly?: boolean;
         logicalActionId?: string;
+        purpose?: import("./providerPhase.js").ProviderTurnPurpose;
     }): Promise<TurnResult>;
+    private sendTurnOwned;
     observeEvents(listener: (event: import("./adapters/types.js").BuilderEvent) => void): () => void;
     acceptHandbackTurn(turn: TurnResult): void;
     sessionId(): string | undefined;
@@ -90,6 +100,7 @@ export declare class ContinuityAdapter implements BuilderAdapter {
     restoreNativeCompactions(compactions: NativeCompaction[]): void;
     contextUsageAfterNativeCompaction(compaction: NativeCompaction): Promise<ContextUsage | undefined>;
     contextUsage(): Promise<ContextUsage | undefined>;
+    graphRuntimeSettings(): Pick<import("./adapters/types.js").BuilderAdapterOptions, "model" | "effort" | "fast" | "runtimeExecutable"> | undefined;
     sessionUsage(): Promise<ProviderSessionUsage | undefined>;
     switchSettings(settings: ProviderSettingSwitch): Promise<CompactResult>;
     events(): AsyncIterable<import("./adapters/types.js").BuilderEvent>;