ai-foreman 1.7.20 → 1.7.22

package/dist/cli/start.js

@@ -1,12 +1,18 @@
+import { finalQaRoleInstructions, resolveEffectiveQaConfiguration } from "../qaEffectiveConfig.js";
+import { graphContext, sendGraphTurn } from "../graph/turn.js";
+import { initializeSyntheticWork } from "../buildSyntheticWork.js";
+import { admitApprovedTicket } from "../buildWorkAuthorization.js";
 import { WorkflowReader } from "../workflowReader.js";
 import { localBuildAuthority, canonicalProject, withBuildInvocation } from "../buildAdmission.js";
-import { formatRecoveryCommand } from "../recoveryGuidance.js";
+import { formatRecoveryCommand, formatDecisionCommands, formatExactRunRecovery } from "../recoveryGuidance.js";
 import { durableReadOnlyProposal } from "../readOnlyProposal.js";
 import { captureFrozenQaSource } from "../qaSnapshot.js";
 import { finishStartAdmission, superviseStart, supervisedRunId } from "../supervisedStart.js";
-import { durableHumanDecision, HumanDecisionRequired } from "../humanDecision.js";
+import { assertBuildAssignmentReconciled } from "../buildAssignment.js";
+import { durableHumanDecision, HumanDecisionRequired, HumanDecisionCancelled, servicePendingHumanDecisions } from "../humanDecision.js";
 import { requiresBuildApproval, buildScopeRevision, createBuildApprovalGate } from "../buildApproval.js";
 import { Command, Option } from "commander";
+import { accent, error, sanitizeTerminalText, success, warning } from "../terminalStyle.js";
 import { resolve, join, relative } from "node:path";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
@@ -28,6 +34,7 @@ import { loadTickets } from "../tickets/ticketLoader.js";
 import { StateDb } from "../tickets/stateDb.js";
 import { applySharedDeliveryBranch, applySizeBranchPolicy, buildBranchAuditInstruction, buildBranchPlan, parseAuditDependencies } from "../branch/planner.js";
 import { currentGitRef, ensureCleanBaseWorktree, generatedTrackerDirtyPaths } from "../branch/git.js";
+import { captureDirtyBaseline } from "../branch/dirtyBaseline.js";
 import { formatGitHubFailure, preflightGh } from "../branch/github.js";
 import { preflightGlab } from "../branch/gitlab.js";
 import { readDeliveryUnitSession, runBranchPlan } from "../branch/runner.js";
@@ -55,7 +62,6 @@ import { ObservabilityStore, RunObserver } from "../observability.js";
 import { loadProjectAutonomyConfig, resolveAutonomyPolicy, resolveQaEnablement } from "../recoveryPolicy.js";
 import { loadQaRecoveryPacket, recoverPendingQaRecoveryPublications } from "../qaRecovery.js";
 import { qaDigest } from "../qaProtocolV2.js";
-import { loadSkill } from "special-agents";
 import { acceptQaRuntimeHandoff, describeQaRuntimeHandle, frozenQaRuntimeSettings } from "../qaRuntime.js";
 const FOREMAN_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
 function fail(message) {
@@ -147,11 +153,10 @@ export function formatResumeGuidance(executable, projectDir, steps, sessionId, r
         return [
             ...run.decisions.flatMap(decision => [
                 `foreman: input required: ${decision.prompt}`,
-                `foreman: choices: ${decision.choices.map(choice => `${choice.id} (${choice.label})`).join(", ")}`,
-                `  rafi build:decide ${shellQuote(projectDir)} --run ${shellQuote(run.runId)} --decision ${shellQuote(decision.decisionId)} --choice <choice-id>`,
+                ...formatDecisionCommands(projectDir, run.runId, decision, executable),
             ]),
-            "foreman: resume this run with:",
-            `  ${formatRecoveryCommand(projectDir, "rafi")}`,
+            executable === "rafi" ? "foreman: resume this run with:" : "foreman: review recovery for this run with:",
+            `  ${formatExactRunRecovery(projectDir, run.runId, executable)}`,
         ];
     if (executable === "rafi") {
         return [
@@ -382,6 +387,8 @@ export function savedStartArguments(command, projectDir, opts) {
 }
 /** Pure validation shared by interactive start and persisted preparation. */
 export function validateStartOptions(opts, requireCount) {
+    if (opts.dirtyWork !== undefined && !["preserve", "include"].includes(opts.dirtyWork))
+        throw new Error("--dirty-work must be preserve or include");
     const recovery = Boolean(opts.resume || opts.continue || opts.recoverRun);
     const tickets = opts.ticket ?? [];
     if (!recovery && tickets.length > 1)
@@ -486,7 +493,10 @@ export function buildStartCommand() {
         .option("--auto-compact-threshold <percent>", "initial Builder context compaction threshold (1-99)")
         .option("--max-branch-depth <n>", "maximum selected branch stack depth", "5")
         .option("--pr-ready", "create ready-for-review PRs instead of draft PRs")
+        .option("--builder-network", "request build-scoped builder internet access with separate explicit approval; rechecked on resume")
+        .option("--builder-approvals", "allow the builder to request explicit per-operation sandbox approvals; QA stays restricted")
         .option("--keep-worktrees", "keep successful ticket worktrees for inspection")
+        .option("--dirty-work <mode>", "preserve | include: continue in isolated branches without merging into the dirty checkout")
         .option("--ticket <id>", "select one new ticket, or identify recovery tickets with --resume/--continue/--recover-run", collectTicket, [])
         .option("--skip-delivery-unit <id>", "skip one unfinished delivery unit for this run", collectTicket, [])
         .action(async (project, opts, command) => withBuildInvocation(async () => {
@@ -496,6 +506,11 @@ export function buildStartCommand() {
         catch (error) {
             fail(error.message);
         }
+        if (opts.dirtyWork) {
+            opts.branchPerTicket = true;
+            opts.completion = "none";
+            opts.keepWorktrees = true;
+        }
         const requestedTicketIds = opts.ticket ?? [];
         const recoveryIntent = Boolean(opts.resume || opts.continue || opts.recoverRun);
         if (!recoveryIntent && requestedTicketIds.length > 1)
@@ -543,6 +558,7 @@ export function buildStartCommand() {
         if (!existsSync(cwd))
             fail(`project directory not found: ${cwd}`);
         const recoveryRecord = opts.recoverRun ? readBuildRuns(cwd).find((run) => run.runId === opts.recoverRun) : undefined;
+        let dirtyWork = recoveryRecord?.runDecisions?.dirtyWork;
         if (opts.recoverRun && !recoveryRecord)
             fail(`recoverable build run not found: ${opts.recoverRun}`);
         const autonomyProfile = opts.autonomy;
@@ -558,6 +574,34 @@ export function buildStartCommand() {
         try {
             if (await superviseStart(cwd, supervisedInvocationId, opts.supervisor === false ? { ...frozenPolicy, supervisorEnabled: false } : frozenPolicy, { steps: opts.steps, stacks: opts.stacks, detach: opts.detach, launchToken: opts.launchToken, startArgs: savedStartArguments(command, cwd, opts) }))
                 return;
+            if (recoveryRecord || opts.preparationRun) {
+                assertBuildAssignmentReconciled(cwd, supervisedInvocationId);
+                if (!await servicePendingHumanDecisions({ projectDir: cwd, runId: supervisedInvocationId, tickets: requestedTicketIds.length ? requestedTicketIds : recoveryRecord?.tickets.length ? recoveryRecord.tickets : undefined, scopeRevision: isTicketsInitialized(cwd) ? buildScopeRevision(cwd) : undefined }))
+                    return;
+            }
+            const requestedNetwork = Boolean(opts.builderNetwork || recoveryRecord?.builderCapabilities?.requestedNetwork);
+            let grantedNetwork = false;
+            if (requestedNetwork) {
+                const permissionDb = new WorkflowDb(cwd);
+                let networkKey;
+                try {
+                    networkKey = permissionDb.pendingHumanDecisions(supervisedInvocationId).find(decision => decision.interruptionId.startsWith("builder-network:"))?.interruptionId ?? `builder-network:${process.pid}:${randomUUID()}`;
+                }
+                finally {
+                    permissionDb.close();
+                }
+                const networkDecision = await durableHumanDecision({ projectDir: cwd, runId: supervisedInvocationId, key: networkKey,
+                    prompt: "Allow the builder shell to access the internet for this build? This permits network use by any builder command, not only downloads. Workspace write confinement remains enforced. QA stays offline. Recovery requires approval again; --yes does not approve this permission.",
+                    choices: [{ id: "allow-network", label: "Allow builder internet for this build" }, { id: "stay-offline", label: "Stay offline and use a verified local bundle" }],
+                    operation: async () => {
+                        const action = await select({ message: "Allow builder internet for this build?", options: [{ value: "stay-offline", label: "Stay offline" }, { value: "allow-network", label: "Allow builder internet for this build" }] });
+                        return isCancel(action) ? undefined : action;
+                    } });
+                if (networkDecision === undefined || isCancel(networkDecision))
+                    return;
+                grantedNetwork = networkDecision === "allow-network";
+            }
+            const builderCapabilities = { requestedNetwork, grantedNetwork, ...(grantedNetwork ? { approvedAt: new Date().toISOString(), grantWorkerPid: process.pid } : {}) };
             const readinessOwner = { project: cwd, runId: supervisedInvocationId, authority: localBuildAuthority(cwd) };
             const autoApprovePlanUpdates = recoveryRecord
                 ? recoveryRecord.recoveryDecision?.planUpdateApproval === "auto"
@@ -711,6 +755,12 @@ export function buildStartCommand() {
                 fail("current-branch build recovery supports exactly one --ticket");
             }
             if (branchMode) {
+                if (dirtyWork) {
+                    branchDefaults.completionMode = "none";
+                    branchDefaults.createReview = false;
+                    branchDefaults.cleanupBranches = false;
+                    opts.keepWorktrees = true;
+                }
                 if (opts.resume && continueTickets.length > 1) {
                     fail("--resume <sessionId> in branch mode supports exactly one --ticket; use --continue for multiple tickets");
                 }
@@ -799,7 +849,7 @@ export function buildStartCommand() {
             }
             const recoveryTicket = !branchMode && recoveryRecord ? continueTickets[0] : undefined;
             const preferredTicket = selectedNewTicket ?? recoveryTicket;
-            const executionTickets = !branchMode && recoveryRecord && recoveryRecord.tickets.length
+            let executionTickets = !branchMode && recoveryRecord && recoveryRecord.tickets.length
                 ? recoveryExecutionTickets(recoveryRecord, requestedTicketIds, Boolean(opts.recoveryMode))
                 : selectedNewTicket ? [selectedNewTicket] : undefined;
             const config = loadConfig(join(cwd, "foreman.yaml"));
@@ -826,11 +876,15 @@ export function buildStartCommand() {
                 }
             }
             let activeObserver = observabilityStore ? new RunObserver(observabilityStore, invocationRunId) : undefined;
-            const finishObservationOnExit = () => {
+            const finishObservationOnExit = (exitCode) => {
                 if (!activeObserver)
                     return;
-                activeObserver.finish("interrupted");
-                observabilityStore?.closeLogFile(logPath, "interrupted");
+                const reader = new WorkflowReader(cwd);
+                const durable = reader.getRun(invocationRunId);
+                reader.close();
+                const outcome = durable?.status === "cancelled" ? "cancelled" : durable?.checkpoint === "waiting-for-human" ? "waiting-for-human" : durable?.status === "failed" ? "failed" : "interrupted";
+                activeObserver.finish(outcome, { checkpoint: durable?.checkpoint, failureCategory: `process-exit:${exitCode}` });
+                observabilityStore?.closeLogFile(logPath, outcome);
                 observabilityStore?.close();
                 activeObserver = undefined;
             };
@@ -864,6 +918,8 @@ export function buildStartCommand() {
                     workspaceIdentity: !branchMode ? captureCurrentWorkflowSessionIdentity(builderCwd) : captureWorkspaceIdentity(builderCwd),
                     ticketId: sessionRef?.ticketId,
                     deliveryUnitId: sessionRef?.deliveryUnitId,
+                    networkAccess: grantedNetwork,
+                    approvalPolicy: opts.builderApprovals ? "on-request" : "never",
                     permission: createPermissionHandler(builderPolicy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
                     onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
                     onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
@@ -871,7 +927,7 @@ export function buildStartCommand() {
                     fast: builderFast,
                     systemPromptAppend: roleBundle.system || undefined,
                     skills: roleBundle.skills.length > 0 ? roleBundle.skills : undefined,
-                    autoCompactThresholdPercent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                    autoCompactThresholdPercent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                     observer: activeObserver,
                 };
                 const adapter = agent === "codex"
@@ -894,13 +950,13 @@ export function buildStartCommand() {
                 role, source: roleDefaults.builder ? "project" : "provider", make: agent, model: model ?? "default",
                 reasoning: builderEffort ?? "default", fast: Boolean(builderFast), session_strategy: roleDefaults.builder?.session_strategy ?? "compact",
                 settings_revision: settingsRevision, display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                 compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
             } : {
                 role, source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default",
                 reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact",
                 settings_revision: settingsRevision, display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false,
-                auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50,
+                auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65,
                 compact_maximum: roleDefaults.qa?.compact_maximum ?? 10,
             };
             const liveRoleSettings = (role, base) => {
@@ -953,22 +1009,9 @@ export function buildStartCommand() {
             });
             const qaRuntimeMetadata = new WeakMap();
             const resolveQaRuntimeMetadata = (qaCwd, settings) => {
-                const bundle = loadRoleBundle("qa", { projectDir: qaCwd });
-                const effectiveRoleInstructions = `${bundle.system}\n\nYou are an independent QA reviewer. Do not edit source, tickets, configuration, or project documentation. You may run tests and create only harmless ignored caches or coverage output.`;
-                const skills = bundle.skills.map((name) => {
-                    const runtimeRoot = settings.make === "codex" ? ".codex" : ".claude";
-                    const path = [join(qaCwd, runtimeRoot, "skills", name, "SKILL.md"), join(qaCwd, ".agents", "skills", name, "SKILL.md")].find(existsSync);
-                    if (path) {
-                        const content = `## ${name}\n${readFileSync(path, "utf8").trim()}`;
-                        return { name, path, content, digest: createHash("sha256").update(content).digest("hex") };
-                    }
-                    const bundled = loadSkill(name);
-                    if (!bundled.body?.trim())
-                        throw new Error(`QA runtime ${settings.make} skill ${name} has no exact dispatchable content`);
-                    const content = `## ${bundled.name}\n${bundled.body.trim()}`;
-                    return { name, path: `special-agents:${name}`, content, digest: createHash("sha256").update(content).digest("hex") };
-                });
-                return { settings: structuredClone(settings), effectiveRoleInstructions, skills };
+                const effective = resolveEffectiveQaConfiguration(cwd, settings);
+                const effectiveRoleInstructions = finalQaRoleInstructions(effective.qaRules);
+                return { settings: structuredClone(settings), effectiveRoleInstructions, skills: effective.skills.map(skill => ({ ...skill, digest: createHash("sha256").update(skill.content).digest("hex") })) };
             };
             const createBuilderForSettings = async (builderCwd, settings) => {
                 const ready = await ensureBuildRuntimeReadyForCommand(builderCwd, settings.make, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
@@ -994,6 +1037,8 @@ export function buildStartCommand() {
                     shutdownTimeoutMs: frozenPolicy.runtimeDeadlines?.shutdown_ms,
                     turnDeadlineMs: frozenPolicy.runtimeDeadlines?.turn_ms,
                     model: settings.model === "default" ? undefined : settings.model,
+                    networkAccess: grantedNetwork,
+                    approvalPolicy: opts.builderApprovals ? "on-request" : "never",
                     permission: createPermissionHandler(policy, log, { durable: () => ({ projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, ticketId: activeObserver?.context().ticketId }) }),
                     onQuestionTrace: (trace) => log.write("question-round-trip", { ...trace }),
                     onLifecycleTrace: (trace) => log.write("provider-lifecycle", { ...trace }),
@@ -1653,7 +1698,7 @@ export function buildStartCommand() {
             if (branchMode) {
                 const ticketsConfig = loadTicketsConfig(cwd);
                 const allowedBaseDirtyPaths = generatedTrackerDirtyPaths(ticketsConfig.paths);
-                const baseWorktreePolicy = recoveryRecord ? "skip" : "enforce";
+                let baseWorktreePolicy = recoveryRecord ? "skip" : "enforce";
                 if (baseWorktreePolicy === "skip") {
                     const projection = recoveryRecord ? projectBuildRecovery(cwd, recoveryRecord) : undefined;
                     if (projection?.expectedChanges.length) {
@@ -1671,12 +1716,35 @@ export function buildStartCommand() {
                         ensureCleanBaseWorktree(cwd, { allowedDirtyPaths: allowedBaseDirtyPaths });
                     }
                     catch (err) {
-                        fail(err instanceof Error ? err.message : String(err));
+                        let mode = opts.dirtyWork;
+                        if (!mode && process.stdin.isTTY && process.stdout.isTTY && !opts.yes) {
+                            const choice = await select({ message: "Uncommitted work found. How should the isolated build start?", options: [
+                                    { value: "preserve", label: "Preserve changes; build from committed code (Recommended)" },
+                                    { value: "include", label: "Include current files as a private build baseline" },
+                                    { value: "stop", label: "Stop for manual commit or stash" },
+                                ] });
+                            if (isCancel(choice) || choice === "stop")
+                                return;
+                            mode = String(choice);
+                        }
+                        if (mode !== "preserve" && mode !== "include")
+                            fail(`${err instanceof Error ? err.message : String(err)}\nContinue safely with --dirty-work preserve (committed input) or --dirty-work include (current files). Both keep your checkout and index intact and retain isolated worktrees.`);
+                        const baseline = captureDirtyBaseline(cwd, mode);
+                        dirtyWork = { mode, ...baseline };
+                        opts.base = baseline.base;
+                        branchDefaults.completionMode = "none";
+                        branchDefaults.createReview = false;
+                        branchDefaults.cleanupBranches = false;
+                        branchDefaults.rootBaseBranches = false;
+                        opts.keepWorktrees = true;
+                        baseWorktreePolicy = "skip";
+                        console.log(`rafi: ${mode} dirty-work baseline ${baseline.base}; evidence ${baseline.recordPath}; results stay in isolated branches.`);
                     }
                 }
                 if (branchDefaults.createReview && branchDefaults.reviewProvider) {
                     await ensureReviewProviderReady(cwd, branchDefaults.reviewProvider, log, Boolean(opts.yes));
                 }
+                console.log(`foreman: builder capability request: workspace writes, shell network ${grantedNetwork ? "approved for this build" : "off"}, approvals ${opts.builderApprovals ? "per operation" : "never"}; effective policy requires provider confirmation. Use a provenance-verified local source/dependency bundle for offline acquisition.`);
                 const ready = await ensureBuildRuntimeReadyForCommand(cwd, agent, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
                     label: "start",
                     yes: Boolean(opts.yes),
@@ -1755,7 +1823,7 @@ export function buildStartCommand() {
                     try {
                         auditBuilder = await createBuilder(cwd);
                         auditViewer = printEvents(auditBuilder.events());
-                        const audit = await auditBuilder.sendTurn(buildBranchAuditInstruction(plan.nodes.map((node) => node.ticket)));
+                        const audit = await sendGraphTurn(auditBuilder, buildBranchAuditInstruction(plan.nodes.map((node) => node.ticket)), graphContext(cwd, auditBuilder.sessionRef?.()?.cwd ?? cwd, "branch-dependency-audit", plan.nodes.map(node => node.ticket.id).join(" ")), { purpose: "planning" });
                         if (audit.isError)
                             throw new Error(audit.text);
                         const auditDependencies = parseAuditDependencies(audit.text);
@@ -1860,23 +1928,23 @@ export function buildStartCommand() {
                     make: agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
                     session_strategy: roleDefaults.builder?.session_strategy ?? "compact", settings_revision: settingsRevision,
                     display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-                    auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                    auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                     compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
                 };
                 const capturedBranchQa = {
                     role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default",
                     reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", settings_revision: settingsRevision,
                     display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false,
-                    auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50,
+                    auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65,
                     compact_maximum: roleDefaults.qa?.compact_maximum ?? 10,
                 };
                 const firstResumeRef = plan.nodes[0] ? resumeSessionByTicket.get(plan.nodes[0].ticket.id)?.sessionRef : undefined;
                 let masterRun = recoveryRecord ? resumeBuildRun(cwd, recoveryRecord.runId, { builder: capturedBranchBuilder, qa: capturedBranchQa, builderSessionId: firstResumeRef?.sessionId ?? null, builderSessionRef: firstResumeRef ?? null, expectedRecoveryDecisionDigest: opts.recoveryDecisionDigest }) : createBuildRun({
                     runId: invocationRunId,
-                    tickets: plan.nodes.map((node) => node.ticket.id), deliveryUnit: selectedStacks.length ? selectedStacks.map((stack) => stack.id).join(",") : deliveryRun?.unit.id,
+                    builderCapabilities, tickets: plan.nodes.map((node) => node.ticket.id), deliveryUnit: selectedStacks.length ? selectedStacks.map((stack) => stack.id).join(",") : deliveryRun?.unit.id,
                     repositoryRoot: cwd, branchMode: branchPresentation.allocationMode, baseRef: plan.baseRef, builder: capturedBranchBuilder, qa: capturedBranchQa,
                     frozenPolicy, autonomyProfile, qaEnabled,
-                    runDecisions: { workMode: "branch-per-ticket", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBranchBuilder.auto_compact_threshold_percent ?? 50, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
+                    runDecisions: { dirtyWork, workMode: "branch-per-ticket", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBranchBuilder.auto_compact_threshold_percent ?? 65, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
                 });
                 activeContinuityRunId = masterRun.runId;
                 if (requiresBuildApproval(cwd, plan.nodes.map(node => node.ticket.id), autoApprovePlanUpdates, approvalConsequences) && plan.issues.every((issue) => !issue.blocking)) {
@@ -1888,10 +1956,25 @@ export function buildStartCommand() {
                             ],
                         }) });
                     if (isCancel(action) || action === "cancel") {
+                        const cancelled = action === "cancel";
+                        if (cancelled) {
+                            const decisions = new WorkflowDb(cwd);
+                            try {
+                                decisions.cancelPendingHumanDecisions(invocationRunId, "User cancelled build; pending decisions superseded");
+                            }
+                            finally {
+                                decisions.close();
+                            }
+                        }
+                        masterRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, masterRun, cancelled ? "cancelled" : "input-paused", { status: cancelled ? "cancelled" : "recoverable" }), cancelled ? "cancelled" : "recoverable");
+                        activeObserver?.finish(cancelled ? "cancelled" : "paused", { checkpoint: cancelled ? "user-cancel" : "prompt-eof-or-cancel" });
                         console.log("ai-foreman: cancelled");
                         process.exit(0);
                     }
                 }
+                for (const node of plan.nodes)
+                    admitApprovedTicket(cwd, masterRun.runId, node.ticket.id, buildScopeRevision(cwd), `build invocation ${invocationRunId}: approved branch plan`);
+                masterRun = checkpointBuildRun(cwd, masterRun, "capabilities-resolved", { builderCapabilities });
                 const qaResumedRecovery = recoveryRecord ? pendingQaRecoveryPacket(cwd, masterRun.runId, requestedTicketIds[0]) : undefined;
                 let qaProtocolResumeTicket;
                 if (recoveryRecord && !qaResumedRecovery) {
@@ -2149,6 +2232,17 @@ export function buildStartCommand() {
                 fireTerminalBell(config.notifications.terminal_bell);
                 process.exit(failed ? 2 : 0);
             }
+            if (!recoveryRecord && isTicketsInitialized(cwd)) {
+                const paths = resolveTicketPaths(loadTicketsConfig(cwd), cwd);
+                const state = new StateDb(paths.stateDb);
+                try {
+                    executionTickets = executionTickets ?? loadTickets(paths.tickets).filter(ticket => !["done", "canceled", "cancelled", "obsolete"].includes(state.getState(ticket.id)?.status ?? "planned")).sort((a, b) => a.order - b.order).slice(0, steps).map(ticket => ticket.id);
+                }
+                finally {
+                    state.close();
+                }
+            }
+            console.log(`foreman: builder capability request: workspace writes, shell network ${grantedNetwork ? "approved for this build" : "off"}, approvals ${opts.builderApprovals ? "per operation" : "never"}; effective policy requires provider confirmation. Use a provenance-verified local source/dependency bundle for offline acquisition.`);
             const ready = await ensureBuildRuntimeReadyForCommand(cwd, agent, { build: readinessOwner, durable: { projectDir: cwd, runId: activeContinuityRunId ?? invocationRunId, scopeRevision: buildScopeRevision(cwd, approvalConsequences) }, timeoutMs: frozenPolicy.runtimeDeadlines?.preparation_ms,
                 label: "start",
                 yes: Boolean(opts.yes),
@@ -2183,16 +2277,17 @@ export function buildStartCommand() {
                 make: agent, model: model ?? "default", reasoning: builderEffort ?? "default", fast: Boolean(builderFast),
                 session_strategy: roleDefaults.builder?.session_strategy ?? "compact", settings_revision: settingsRevision,
                 display_session_cost: sessionCostOverride ?? roleDefaults.builder?.display_session_cost ?? false,
-                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 50,
+                auto_compact_threshold_percent: thresholdOverride ?? roleDefaults.builder?.auto_compact_threshold_percent ?? 65,
                 compact_maximum: roleDefaults.builder?.compact_maximum ?? 10,
             };
-            const capturedQa = { role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default", reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false, auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 50, compact_maximum: roleDefaults.qa?.compact_maximum ?? 10, settings_revision: settingsRevision };
+            const capturedQa = { role: "qa", source: roleDefaults.qa ? "project" : "provider", make: qaAgent, model: qaModel ?? "default", reasoning: qaEffort ?? "default", fast: qaFast, session_strategy: roleDefaults.qa?.session_strategy ?? "compact", display_session_cost: sessionCostOverride ?? roleDefaults.qa?.display_session_cost ?? false, auto_compact_threshold_percent: roleDefaults.qa?.auto_compact_threshold_percent ?? 65, compact_maximum: roleDefaults.qa?.compact_maximum ?? 10, settings_revision: settingsRevision };
             let buildRun = recoveryRecord ? resumeBuildRun(cwd, recoveryRecord.runId, { builder: capturedBuilder, qa: capturedQa, builderSessionId: resumeSessionId ?? null, builderSessionRef: resumeSessionRef ?? null, expectedRecoveryDecisionDigest: opts.recoveryDecisionDigest }) : createBuildRun({
                 runId: invocationRunId,
-                tickets: [], repositoryRoot: cwd, branchMode: "current", baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch, builder: capturedBuilder, qa: capturedQa,
+                tickets: [...(executionTickets ?? [])], builderCapabilities, authorizedBatch: { tickets: [...(executionTickets ?? [])], requestedSteps: steps, scopeRevision: buildScopeRevision(cwd, approvalConsequences), startedTickets: [] }, repositoryRoot: cwd, branchMode: "current", baseRef: opts.base ?? loadTicketSetupConfig(cwd)?.build.base_branch, builder: capturedBuilder, qa: capturedQa,
                 frozenPolicy, autonomyProfile, qaEnabled,
-                runDecisions: { workMode: "current", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBuilder.auto_compact_threshold_percent ?? 50, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
+                runDecisions: { workMode: "current", workModeSource, branchPrefix, branchPrefixSource: resolvedPrefix.source, autoCompactThresholdPercent: capturedBuilder.auto_compact_threshold_percent ?? 65, thresholdSource: thresholdOverride === undefined ? "project" : "cli" },
             });
+            buildRun = checkpointBuildRun(cwd, buildRun, "capabilities-resolved", { builderCapabilities });
             activeObserver?.store.attachExecutionLease(activeObserver.executionId, readCurrentWorkflowLease(cwd)?.generation);
             activeContinuityRunId = buildRun.runId;
             const qaResumedRecovery = recoveryRecord ? pendingQaRecoveryPacket(cwd, buildRun.runId, requestedTicketIds[0]) : undefined;
@@ -2346,11 +2441,11 @@ export function buildStartCommand() {
                 builderFast ? "fast" : null,
                 qaEnabled ? null : "qa=off",
             ].filter(Boolean).join(" ");
-            console.log(`foreman: driving a ${agent} builder through ${steps} step(s)${modifiers ? ` [${modifiers}]` : ""}`);
-            console.log(`foreman: project ${cwd}`);
+            console.log(`${accent("foreman:")} driving a ${sanitizeTerminalText(agent)} builder through ${steps} step(s)${modifiers ? ` [${sanitizeTerminalText(modifiers)}]` : ""}`);
+            console.log(`${accent("foreman:")} project ${sanitizeTerminalText(cwd)}`);
             if (trackerRelPath)
-                console.log(`foreman: tracker ${trackerRelPath}`);
-            console.log(`foreman: log ${logPath}\n`);
+                console.log(`${accent("foreman:")} tracker ${sanitizeTerminalText(trackerRelPath)}`);
+            console.log(`${accent("foreman:")} log ${sanitizeTerminalText(logPath)}\n`);
             const viewer = printEvents(builder.events());
             try {
                 if (recoveryRecord && currentBranchTicketProgress(cwd, buildRun)?.remaining.length === 0) {
@@ -2439,6 +2534,18 @@ export function buildStartCommand() {
                                 ],
                             }) });
                         if (isCancel(action) || action === "cancel") {
+                            const cancelled = action === "cancel";
+                            if (cancelled) {
+                                const decisions = new WorkflowDb(cwd);
+                                try {
+                                    decisions.cancelPendingHumanDecisions(invocationRunId, "User cancelled build; pending decisions superseded");
+                                }
+                                finally {
+                                    decisions.close();
+                                }
+                            }
+                            buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, cancelled ? "cancelled" : "input-paused", { status: cancelled ? "cancelled" : "recoverable" }), cancelled ? "cancelled" : "recoverable");
+                            activeObserver?.finish(cancelled ? "cancelled" : "paused", { checkpoint: cancelled ? "user-cancel" : "prompt-eof-or-cancel" });
                             console.log("ai-foreman: cancelled");
                             statusReporter.stop("cancelled");
                             await foreman.close();
@@ -2453,7 +2560,9 @@ export function buildStartCommand() {
                                 message: "Your feedback:",
                                 validate: (v) => (v?.trim() ? undefined : "Please enter some feedback"),
                             }) });
-                        if (isCancel(fb)) {
+                        if (isCancel(fb) || fb === undefined) {
+                            buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "input-paused", { status: "recoverable" }), "recoverable");
+                            activeObserver?.finish("paused", { checkpoint: "feedback-eof-or-cancel" });
                             console.log("ai-foreman: cancelled");
                             statusReporter.stop("cancelled");
                             await foreman.close();
@@ -2466,10 +2575,16 @@ export function buildStartCommand() {
                     }
                 });
                 await ensureApproved();
+                if (!isTicketsInitialized(cwd)) {
+                    const synthetic = initializeSyntheticWork(cwd, buildRun.runId, steps, `Explicit unticketed build invocation ${invocationRunId}`, foreman.approvedPlanText());
+                    buildRun = checkpointBuildRun(cwd, buildRun, "synthetic-work-admitted", { tickets: synthetic });
+                }
                 const onTicketStart = async (ticketId) => {
                     await ensureApproved();
+                    admitApprovedTicket(cwd, buildRun.runId, ticketId, buildScopeRevision(cwd), `build invocation ${invocationRunId}: approved ticket selection`);
                     const tickets = buildRun.tickets.includes(ticketId) ? buildRun.tickets : [...buildRun.tickets, ticketId];
-                    buildRun = checkpointBuildRun(cwd, buildRun, "ticket-selected", { tickets, currentTicket: ticketId });
+                    buildRun = checkpointBuildRun(cwd, buildRun, "ticket-selected", { tickets, currentTicket: ticketId,
+                        ...(buildRun.authorizedBatch ? { authorizedBatch: { ...buildRun.authorizedBatch, approvalRevisions: [...new Set([...(buildRun.authorizedBatch.approvalRevisions ?? [buildRun.authorizedBatch.scopeRevision]), buildScopeRevision(cwd, approvalConsequences)])], startedTickets: [...new Set([...buildRun.authorizedBatch.startedTickets, ticketId])] } } : {}) });
                 };
                 const batch = () => foreman.runBatch(steps, trackerRelPath, onTicketStart, preferredTicket, executionTickets);
                 const result = await (activeObserver ? activeObserver.span("builder_work", "Builder and QA batch", batch) : batch());
@@ -2496,8 +2611,12 @@ export function buildStartCommand() {
                 pruneRecoveryTelemetryAtCompletion(cwd, config.observability.detail_retention_days);
                 activeObserver = undefined;
                 process.off("exit", finishObservationOnExit);
-                console.log(`\nforeman: ${result.completed}/${result.requested} step(s) completed`);
-                console.log(`foreman: outcome — ${result.outcome}`);
+                console.log(`\n${accent("foreman:")} ${result.completed}/${result.requested} step(s) completed`);
+                const safeOutcome = sanitizeTerminalText(result.outcome);
+                const resultOutcome = /success|complete|pass/i.test(safeOutcome) ? success(safeOutcome)
+                    : /fail|error/i.test(safeOutcome) ? error(safeOutcome)
+                        : /warn|partial|blocked/i.test(safeOutcome) ? warning(safeOutcome) : safeOutcome;
+                console.log(`${accent("foreman:")} outcome — ${resultOutcome}`);
                 if (result.detail)
                     console.log(`foreman: ${result.detail}`);
                 if (buildRun.status === "completed")
@@ -2561,6 +2680,13 @@ export function buildStartCommand() {
                     console.error(`foreman: resume this run with: ${formatRecoveryCommand(cwd)}`);
                     process.exit(2);
                 }
+                if (err instanceof HumanDecisionCancelled) {
+                    buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "cancelled", { status: "cancelled" }), "cancelled");
+                    activeObserver?.finish("cancelled", { checkpoint: "question-menu" });
+                    await foreman.close().catch(() => { });
+                    console.log("ai-foreman: cancelled");
+                    process.exit(0);
+                }
                 if (err instanceof HumanDecisionRequired) {
                     buildRun = releaseBuildLease(cwd, checkpointBuildRun(cwd, buildRun, "waiting-for-human", { status: "recoverable" }), "recoverable");
                     await foreman.close().catch(() => { });
@@ -2585,6 +2711,16 @@ export function buildStartCommand() {
                 fail(`run failed: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        catch (error) {
+            if (error instanceof HumanDecisionCancelled) {
+                console.log("ai-foreman: cancelled");
+                return;
+            }
+            if (!(error instanceof HumanDecisionRequired))
+                throw error;
+            console.error(error.message);
+            process.exitCode = 2;
+        }
         finally {
             finishStartAdmission(cwd, supervisedInvocationId);
         }
@@ -2680,8 +2816,11 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
             throw new Error("QA nonconvergence requires its owning build run");
         const scope = createHash("sha256").update(JSON.stringify([buildScopeRevision(projectDir), context.ticket, context.history])).digest("hex");
         let round = 0;
+        let waiverDecisionId;
         const ask = (phase, choices, operation) => durableHumanDecision({
             projectDir, runId, ticketId: context.ticket.id, observer: observer?.(), defer: noninteractive,
+            onAnswered: decision => { if (phase.startsWith("QA waiver confirmation") && decision.selectedChoiceId === "yes")
+                waiverDecisionId = decision.decisionId; },
             key: `qa-nonconvergence:${scope}:${round}:${phase}`, prompt: `${context.ticket.id}: ${phase}`, choices, operation,
         });
         while (true) {
@@ -2702,7 +2841,10 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                     ] }));
                 if (approved === "yes") {
                     const db = new WorkflowDb(projectDir);
+                    let authorizationRef;
                     try {
+                        if (db.qaPreparationStore().policy(runId)?.mode === "enforce")
+                            authorizationRef = db.authorizeContractQaWaiver(runId, context.ticket.id, waiverDecisionId);
                         const lease = db.currentLease();
                         if (lease) {
                             const detail = JSON.stringify({ decision: "waive", ticket: context.ticket.id, unresolved: context.history, at: new Date().toISOString() });
@@ -2714,7 +2856,7 @@ export function createQaNonconvergenceHandler(projectDir, noninteractive, planne
                         db.close();
                     }
                     console.log(`foreman: QA WAIVER recorded for ${context.ticket.id}; validation_result will be failed`);
-                    return { action: "waive" };
+                    return { action: "waive", ...(authorizationRef ? { authorizationRef } : {}) };
                 }
                 continue;
             }

package/dist/cli/status.js

@@ -2,12 +2,13 @@ import { Command } from "commander";
 import { resolve, join } from "node:path";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { findResumableBranchSessions, formatBranchContinueCommand } from "../branch/resume.js";
-import { recoverableBuildRuns } from "../buildRuns.js";
+import { readBuildRuns, recoverableBuildRuns } from "../buildRuns.js";
 import { WORKFLOW_DB_FILE } from "../workflowDb.js";
 import { WorkflowReader } from "../workflowReader.js";
 import { formatWorkflowIssue } from "../outcomes.js";
+import { accent, error, sanitizeTerminalText, success, warning } from "../terminalStyle.js";
 function fail(message) {
-    console.error(`foreman: ${message}`);
+    console.error(`${error("foreman:", { stream: process.stderr })} ${message}`);
     process.exit(1);
 }
 export function buildStatusCommand() {
@@ -24,11 +25,21 @@ export function runStatus(project) {
     const workflowPath = join(projectDir, WORKFLOW_DB_FILE);
     const workflow = existsSync(workflowPath) ? new WorkflowReader(projectDir, workflowPath) : undefined;
     const activeWorkflows = workflow?.activeRuns() ?? [];
+    for (const run of activeWorkflows) {
+        const preparation = workflow?.qaPreparation(run.runId);
+        if (!preparation || preparation.mode === "legacy")
+            continue;
+        console.log(`foreman: QA preparation ${preparation.mode} — ${run.runId}`);
+        const metrics = workflow.qaPreparationMetrics(run.runId);
+        console.log(`  admitted ${metrics.approved}; started ${metrics.started}; first reviews ${metrics.firstReviews}; passes ${metrics.firstReviewPasses}; unknown finding causes ${metrics.causes.unknown}`);
+        for (const work of preparation.works)
+            console.log(`  ${work.workId}: ${work.state}; depth ${work.depth ?? "assessment pending"}; contract ${work.digest ?? "unpublished"}${work.detail ? `; ${work.detail}` : ""}`);
+    }
     if (!existsSync(dir) && activeWorkflows.length === 0) {
         workflow?.close();
         fail(`no foreman runs found under ${dir}`);
     }
-    const logs = readdirSync(dir)
+    const logs = (existsSync(dir) ? readdirSync(dir) : [])
         .filter((f) => f.endsWith(".jsonl"))
         .sort();
     if (logs.length === 0) {
@@ -52,8 +63,12 @@ export function runStatus(project) {
     const prEvents = records.filter((r) => ["pr-created", "pr-existing", "pr-failed"].includes(String(r.event)));
     const latestFailure = findLatestGitHubFailure(records);
     const batchEnd = [...records].reverse().find((r) => r.event === "batch-end");
-    console.log(`foreman: latest run ${logs[logs.length - 1]}`);
-    console.log(`foreman: ${steps.length} step record(s), ${escalations.length} escalation(s)`);
+    const retainedRuns = readBuildRuns(projectDir).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+    const byId = new Map(retainedRuns.map(run => [run.runId, run]));
+    const recordRunId = [...records].reverse().find(record => typeof record.runId === "string" && (byId.has(record.runId) || record.event === "step" || record.event === "batch-end" || String(record.event).startsWith("branch-")))?.runId;
+    const retainedRun = typeof recordRunId === "string" ? byId.get(recordRunId) : undefined;
+    console.log(`${accent("foreman:")} latest run ${sanitizeTerminalText(logs[logs.length - 1] ?? "")}`);
+    console.log(`${accent("foreman:")} ${steps.length} step record(s), ${escalations.length} escalation(s)`);
     if (branchEvents.length || prEvents.length) {
         const completed = branchEvents.filter((r) => r.event === "branch-complete").length;
         const issues = branchEvents.filter((r) => r.event === "branch-issue").length;
@@ -61,12 +76,19 @@ export function runStatus(project) {
         console.log(`foreman: branch mode — ${completed} completed, ${issues} issue(s), ${prs} PR(s)`);
     }
     if (batchEnd) {
-        console.log(`foreman: outcome — ${batchEnd.outcome} (${batchEnd.completed}/${batchEnd.requested})`);
+        const outcome = sanitizeTerminalText(String(batchEnd.outcome ?? ""));
+        const styledOutcome = /success|complete|pass/i.test(outcome) ? success(outcome)
+            : /fail|error/i.test(outcome) ? error(outcome)
+                : /warn|partial|blocked/i.test(outcome) ? warning(outcome) : outcome;
+        console.log(`${accent("foreman:")} outcome — ${styledOutcome} (${batchEnd.completed}/${batchEnd.requested})`);
         if (batchEnd.detail)
             console.log(`foreman: ${batchEnd.detail}`);
     }
+    else if (retainedRun?.status === "completed") {
+        console.log(`${accent("foreman:")} outcome — ${success("completed")} (durable build record ${sanitizeTerminalText(retainedRun.runId)})`);
+    }
     else {
-        console.log("ai-foreman: run is still in progress or did not finish");
+        console.log(`${accent("ai-foreman:")} run is still in progress or did not finish`);
     }
     if (latestFailure) {
         console.log(`foreman: latest GitHub failure — ${latestFailure.code}: ${latestFailure.message}`);