ai-foreman 1.7.22 → 1.7.24

package/dist/activity.d.ts

@@ -48,6 +48,7 @@ export declare class ActivityReporter {
     private lastSemanticKey?;
     private paused;
     private agentStatusLine?;
+    private readonly reportedToolIssues;
     constructor(command: string, options?: ActivityReporterOptions);
     begin(label: string): () => void;
     update(state: string, detail?: string, metadata?: {
@@ -58,6 +59,8 @@ export declare class ActivityReporter {
     pulse(detail?: string): void;
     /** A completed tool or turn is distinct from transport/status activity. */
     completedWork(): void;
+    /** One tool may fail recoverably many times while the agent continues. */
+    reportToolIssue(name: string): void;
     note(message: string): void;
     writePersistent(text: string): void;
     /** Keep role/provider/context state attached to the current activity status. */

package/dist/activity.js

@@ -32,6 +32,7 @@ export class ActivityReporter {
     lastSemanticKey;
     paused = 0;
     agentStatusLine;
+    reportedToolIssues = new Set();
     constructor(command, options = {}) {
         this.command = command;
         this.output = options.output ?? {
@@ -95,6 +96,16 @@ export class ActivityReporter {
         this.lastUsefulProgressAt = this.now();
         this.usefulProgressWarningPrinted = false;
     }
+    /** One tool may fail recoverably many times while the agent continues. */
+    reportToolIssue(name) {
+        const key = clean(name, 100).toLowerCase();
+        if (this.reportedToolIssues.has(key)) {
+            this.pulse();
+            return;
+        }
+        this.reportedToolIssues.add(key);
+        this.update("tool reported a failure; agent continuing", name);
+    }
     note(message) {
         this.clearLine();
         this.output.write(`${sanitizeTerminalText(message).replace(/[\r\t]+/g, " ").slice(0, 500)}\n`);
@@ -307,7 +318,7 @@ export function reportBuilderEvent(event) {
                 else if (event.status === "cancelled")
                     reporter.update("tool cancelled", event.name);
                 else if (isFailedToolCompletion(event))
-                    reporter.update("tool failed", event.name);
+                    reporter.reportToolIssue(event.name);
                 else
                     reporter.pulse();
                 break;

package/dist/adapters/claude.js

@@ -637,7 +637,20 @@ export class ClaudeAdapter {
             const failed = block.is_error === true;
             // TIME_ELAPSED alone does not establish success or failure. Preserve it as unknown.
             const elapsedOnly = /^\s*TIME_ELAPSED\s*$/.test(text);
-            const status = failed && /timed?\s*out|timeout/i.test(text) ? "timed_out" : failed && /cancel(?:led|ed)/i.test(text) ? "cancelled" : elapsedOnly ? "unknown" : failed ? "failed" : "completed";
+            // An SDK `is_error` bit without a terminal reason is not enough to call
+            // the tool failed: enterprise gateways can emit provisional errors and
+            // continue the same turn. Preserve that state as unknown until a
+            // correlated, explicit terminal result arrives.
+            const resultReason = elapsedOnly ? "elapsed_placeholder"
+                : failed && /timed?\s*out|timeout/i.test(text) ? "timeout"
+                    : failed && /cancel(?:led|ed)/i.test(text) ? "cancelled"
+                        : failed && /permission denied/i.test(text) ? "permission_denied"
+                            : failed && /not found/i.test(text) ? "not_found"
+                                : failed && /\b(?:exit(?:ed)?|status)\s+[1-9]\d*\b/i.test(text) ? "nonzero_exit"
+                                    : failed && /\b(?:failed|error|exception)\b/i.test(text) ? "explicit_error"
+                                        : failed ? "unexplained_error"
+                                            : "completed";
+            const status = resultReason === "timeout" ? "timed_out" : resultReason === "cancelled" ? "cancelled" : ["permission_denied", "not_found", "nonzero_exit", "explicit_error"].includes(resultReason) ? "failed" : resultReason === "completed" ? "completed" : "unknown";
             if (status !== "unknown") {
                 this.completedToolCalls.add(callId);
                 if (this.completedToolCalls.size > 1000)
@@ -645,6 +658,9 @@ export class ClaudeAdapter {
                 this.toolCalls.delete(callId);
             }
             const outputDigest = createHash("sha256").update(text).digest("hex");
+            // Persist only correlation metadata. The result text can contain source
+            // paths, command output, or credentials and must not enter lifecycle logs.
+            this.opts.onLifecycleTrace?.({ phase: "provider-tool-result", at: new Date().toISOString(), sessionId: this._sessionId, providerTurnId: this.activeProviderTurnId, toolCallId: callId, toolName: call?.name ?? "unidentified tool", classification: status, resultReason, isError: failed, outputDigest, rawOutputBytes: Buffer.byteLength(text) });
             if (status === "unknown") {
                 if (this.unknownToolResults.get(callId) === outputDigest)
                     continue;

package/dist/adapters/types.d.ts

@@ -269,6 +269,7 @@ export interface BuilderAdapterOptions {
     turnDeadlineMs?: number;
     shutdownTimeoutMs?: number;
     /** Metadata-only lifecycle trace; no prompts, responses, credentials, or tool inputs. */
+    /** Bounded, redacted provider lifecycle diagnostics; never include raw tool output. */
     onLifecycleTrace?: (event: {
         phase: string;
         at: string;
@@ -276,6 +277,14 @@ export interface BuilderAdapterOptions {
         sessionId?: string;
         method?: string;
         timeoutMs?: number;
+        providerTurnId?: string;
+        toolCallId?: string;
+        toolName?: string;
+        classification?: string;
+        resultReason?: string;
+        isError?: boolean;
+        outputDigest?: string;
+        rawOutputBytes?: number;
     }) => void;
 }
 export interface BuilderAdapter {

package/dist/branch/runner.js

@@ -96,7 +96,7 @@ export async function runBranchPlan(opts) {
                 recoveryDb.close();
             }
             if (exactInterruptedMerge) {
-                opts.log.write("branch-resume", { detail: "Base contains exactly the staged tree of its durable interrupted merge" });
+                opts.log.write("branch-resume", { runId: opts.runId, detail: "Base contains exactly the staged tree of its durable interrupted merge" });
             }
             else if (baseWorktreePolicy === "warn") {
                 console.warn(`foreman: warning: ${error instanceof Error ? error.message : String(error)}`);
@@ -117,7 +117,7 @@ export async function runBranchPlan(opts) {
     let builderWorkSessions = 0;
     const qaStream = { reviews: 0, modificationViolations: 0 };
     for (const issue of opts.plan.issues) {
-        opts.log.write("branch-issue", { ...issue });
+        opts.log.write("branch-issue", { runId: opts.runId, ...issue });
         notifyIssue(opts.notificationsEnabled, issue.message);
         if (issue.blocking) {
             summaries.push({
@@ -244,6 +244,7 @@ export async function runBranchPlan(opts) {
             const detail = `dependency ${missingDependency} did not complete`;
             summaries.push(summaryFor(node, "skipped", detail));
             opts.log.write("branch-issue", {
+                runId: opts.runId,
                 ticket: node.ticket.id,
                 code: "dependency_unavailable",
                 message: detail,
@@ -261,6 +262,7 @@ export async function runBranchPlan(opts) {
                 const detail = `dependency ${missingPush} branch was not pushed`;
                 summaries.push(summaryFor(node, "skipped", detail, "skipped"));
                 opts.log.write("branch-issue", {
+                    runId: opts.runId,
                     ticket: node.ticket.id,
                     code: "dependency_unavailable",
                     message: detail,
@@ -275,6 +277,7 @@ export async function runBranchPlan(opts) {
             if (!mergeReadiness.ok) {
                 summaries.push(summaryFor(node, "skipped", mergeReadiness.message, "skipped"));
                 opts.log.write("branch-issue", {
+                    runId: opts.runId,
                     ticket: node.ticket.id,
                     code: mergeReadiness.code,
                     message: mergeReadiness.message,
@@ -295,6 +298,7 @@ export async function runBranchPlan(opts) {
             admissionDb.close();
         }
         opts.log.write("branch-start", {
+            runId: opts.runId,
             ticket: node.ticket.id,
             branch: node.branch,
             base: node.baseBranch,
@@ -314,6 +318,7 @@ export async function runBranchPlan(opts) {
         try {
             if (resumeSession) {
                 opts.log.write("branch-resume", {
+                    runId: opts.runId,
                     ticket: node.ticket.id,
                     branch: node.branch,
                     base: node.baseBranch,
@@ -660,7 +665,7 @@ export async function runBranchPlan(opts) {
                 }));
                 if (push.ok) {
                     confirmJournal(opts.projectDir, pushOperation, node.branch, { sha: commit });
-                    opts.log.write("branch-push", { ticket: node.ticket.id, branch: node.branch, status: "pushed" });
+                    opts.log.write("branch-push", { runId: opts.runId, ticket: node.ticket.id, branch: node.branch, status: "pushed" });
                     summary.pushStatus = "pushed";
                     workflowCheckpoint(opts.projectDir, opts.runId, "push-after", node.ticket.id, { branch: node.branch, sha: commit });
                 }
@@ -677,6 +682,7 @@ export async function runBranchPlan(opts) {
                         output: push.output,
                     };
                     opts.log.write("branch-push", {
+                        runId: opts.runId,
                         ticket: node.ticket.id,
                         branch: node.branch,
                         status: "failed",
@@ -786,6 +792,7 @@ export async function runBranchPlan(opts) {
                 }
                 summary.pr = { status: "merged", url: mergeCommit };
                 opts.log.write("branch-direct-merge", {
+                    runId: opts.runId,
                     ticket: node.ticket.id,
                     branch: node.branch,
                     base: node.baseBranch,
@@ -819,6 +826,7 @@ export async function runBranchPlan(opts) {
             successfulBranches.add(node.ticket.id);
             summaries.push(summary);
             opts.log.write("branch-complete", {
+                runId: opts.runId,
                 ticket: node.ticket.id,
                 branch: node.branch,
                 commit,
@@ -844,7 +852,7 @@ export async function runBranchPlan(opts) {
             }
             if (err instanceof SessionUnavailableError || err instanceof SessionUnavailableContinuityError) {
                 const message = err.message;
-                opts.log.write("branch-issue", { ticket: node.ticket.id, code: "session_unavailable", message, blocking: true });
+                opts.log.write("branch-issue", { runId: opts.runId, ticket: node.ticket.id, code: "session_unavailable", message, blocking: true });
                 notifyIssue(opts.notificationsEnabled, `${node.ticket.id}: ${message}`);
                 summaries.push(summaryFor(node, "blocked", message));
                 opts.onSessionUnavailable?.(err);
@@ -856,7 +864,7 @@ export async function runBranchPlan(opts) {
                 : message.includes("tracker/control")
                     ? "tracker_touched"
                     : "builder_error";
-            opts.log.write("branch-issue", { ticket: node.ticket.id, code, message, blocking: false });
+            opts.log.write("branch-issue", { runId: opts.runId, ticket: node.ticket.id, code, message, blocking: false });
             notifyIssue(opts.notificationsEnabled, `${node.ticket.id}: ${message}`);
             journalTracker(opts.projectDir, opts.runId, `${opts.runId}:tracker-update:${node.ticket.id}:runtime-block${continuationSuffix}`, { ticket: node.ticket.id, status: "blocked", detail: message }, () => cmdBlock(opts.projectDir, node.ticket.id, { summary: message, actor: "foreman" }));
             summaries.push(summaryFor(node, "blocked", message));
@@ -1025,6 +1033,7 @@ async function waitForAutoMergeDependenciesInternal(opts, node, provider) {
             }
             if (!waitLogged) {
                 opts.log.write("branch-auto-merge-wait", {
+                    runId: opts.runId,
                     ticket: node.ticket.id,
                     pending,
                     timeoutMinutes: opts.autoMergeTimeoutMinutes ?? null,
@@ -1046,7 +1055,7 @@ async function waitForAutoMergeDependenciesInternal(opts, node, provider) {
         if (waitSpanId && opts.observer)
             opts.observer.store.finishSpan(waitSpanId, { outcome: waitOutcome });
         if (waitLogged)
-            opts.log.write("branch-auto-merge-wait", { ticket: node.ticket.id, outcome: waitOutcome, terminal: true });
+            opts.log.write("branch-auto-merge-wait", { runId: opts.runId, ticket: node.ticket.id, outcome: waitOutcome, terminal: true });
     }
 }
 function autoMergePollMs() {
@@ -1080,6 +1089,7 @@ function blockBranchIssue(opts, node, summary, code, message, details) {
     summary.buildStatus = "blocked";
     summary.detail = message;
     opts.log.write("branch-issue", {
+        runId: opts.runId,
         ticket: node.ticket.id,
         code,
         message,
@@ -1128,6 +1138,7 @@ Branch-mode rules:
 - Do not switch branches.
 - Do not push, create PRs, or run git commit.
 - Do not edit .tickets/, ${progressDoc}, or other tracker state.
+- If a required test is denied only because you added a pipe, redirection, substitution, or wrapper, retry the exact required-test command without that extra shell syntax. Do not retry other denied actions.
 - If another selected ticket is required before this one can be completed, stop and end with STEP_STATUS: blocked | ticket="${node.ticket.id}" branch_dependency="<ticket-id>" reason="<why>".
 - End with STEP_STATUS: done | ticket="${node.ticket.id}" summary="<what changed>" when the ticket is implemented.
 

package/dist/buildAssignment.d.ts

@@ -2,6 +2,7 @@ import type { BuilderAdapter } from "./adapters/types.js";
 import type { StepStatus } from "./foreman.js";
 import type { TurnResult } from "./adapters/types.js";
 import { type FrozenQaSourceState } from "./qaSnapshot.js";
+import type { ProviderSessionRefV1 } from "rafi-spec";
 /** Work responses confirm an assignment; they never select the next ticket. */
 export declare function validateBuildAssignment(ticketId: string, status: StepStatus, responseText?: string): string | undefined;
 export interface BuildAssignmentCapture {
@@ -19,6 +20,18 @@ type BuildSourceState = Pick<FrozenQaSourceState, "digest" | "head" | "contentDi
 };
 export declare class BuildAssignmentRejected extends Error {
 }
+/**
+ * Retire only the host-side records for a Builder turn that was interrupted
+ * before Rafi received a durable response.  The next turn is sent to the
+ * *same validated provider session*, so it continues the outstanding work
+ * rather than treating unknown work as complete or replaying it in a new
+ * conversation.
+ */
+export declare function prepareExactSessionBuilderContinuation(projectDir: string, runId: string, session: ProviderSessionRefV1): {
+    ticketIds: string[];
+    dispatchIds: string[];
+    assignmentIds: string[];
+};
 export interface BuilderGuidanceFollowup {
     reviewAttemptId: string;
     requirementsDigest: string;

package/dist/buildAssignment.js

@@ -26,6 +26,69 @@ export function validateBuildAssignment(ticketId, status, responseText = "") {
 }
 export class BuildAssignmentRejected extends Error {
 }
+/**
+ * Retire only the host-side records for a Builder turn that was interrupted
+ * before Rafi received a durable response.  The next turn is sent to the
+ * *same validated provider session*, so it continues the outstanding work
+ * rather than treating unknown work as complete or replaying it in a new
+ * conversation.
+ */
+export function prepareExactSessionBuilderContinuation(projectDir, runId, session) {
+    const db = new WorkflowDb(projectDir);
+    try {
+        const dispatches = db.unresolvedRoleDispatches(runId, "builder");
+        if (!dispatches.length)
+            throw new BuildAssignmentRejected("No interrupted Builder dispatch is awaiting exact-session continuation");
+        if (dispatches.some(dispatch => !sameSession(dispatch.intent.sessionRef, session))) {
+            throw new BuildAssignmentRejected("Interrupted Builder dispatch is not bound to the validated exact provider session");
+        }
+        const assignments = db.operations(runId).filter(operation => operation.kind === "build-assignment" && ["in_progress", "uncertain"].includes(operation.status));
+        if (!assignments.length)
+            throw new BuildAssignmentRejected("Interrupted Builder dispatch has no durable in-progress assignment");
+        const ticketIds = assignments.map(operation => operation.intent.ticketId)
+            .filter((ticketId) => typeof ticketId === "string");
+        if (ticketIds.length !== assignments.length)
+            throw new BuildAssignmentRejected("Interrupted Builder assignment is missing its ticket identity");
+        db.atomic(() => {
+            const resumedAt = new Date().toISOString();
+            for (const dispatch of dispatches) {
+                db.updateOperation(dispatch.idempotencyKey, "failed", {
+                    result: { recovery: "exact-session-continuation", resumedAt, sessionRef: session },
+                    error: "Host interruption: the same validated Builder session will reconcile and continue this turn",
+                });
+            }
+            for (const assignment of assignments) {
+                db.updateOperation(assignment.idempotencyKey, "failed", {
+                    result: { recovery: "exact-session-continuation", resumedAt, sessionRef: session },
+                    error: "Host interruption: work remains assigned to the validated Builder session; do not send it to QA yet",
+                });
+            }
+            const run = db.getRun(runId);
+            if (run)
+                db.transition(runId, {
+                    checkpoint: "builder-exact-session-continuation",
+                    state: { ...run.state, interruptedBuilderContinuation: { ticketIds, sessionRef: session, resumedAt } },
+                    event: "builder_exact_session_continuation_authorized",
+                    payload: { ticketIds, sessionRef: session },
+                });
+        });
+        return { ticketIds: [...new Set(ticketIds)], dispatchIds: dispatches.map(item => item.idempotencyKey), assignmentIds: assignments.map(item => item.idempotencyKey) };
+    }
+    finally {
+        db.close();
+    }
+}
+function sameSession(value, session) {
+    if (!value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return candidate.provider === session.provider
+        && candidate.sessionId === session.sessionId
+        && candidate.role === "builder"
+        && candidate.stream === "builder"
+        && candidate.cwd === session.cwd
+        && candidate.configRoot === session.configRoot;
+}
 export function assertBuildAssignmentReconciled(projectDir, runId, worktree = projectDir) {
     const reader = new WorkflowReader(projectDir);
     try {

package/dist/buildOwnershipRepair.d.ts

@@ -31,3 +31,5 @@ export declare function repairOwnership(projectDir: string, value: unknown, user
     afterLocalCommit?(): void;
     afterPublication?(): void;
 }): Record<string, unknown>;
+/** Resume only already-admitted work interrupted while recording its response. */
+export declare function reconcileInterruptedInScopeWork(projectDir: string, runId: string, workId: string): Record<string, unknown>;

package/dist/buildOwnershipRepair.js

@@ -9,6 +9,7 @@ import { loadTickets } from "./tickets/ticketLoader.js";
 import { bindBuildAuthority, checkpointBuildRun } from "./buildRuns.js";
 import { classifyProcess } from "./processIdentity.js";
 import { validateOwnershipRepair } from "./buildWorkReconciliation.js";
+import { randomUUID } from "node:crypto";
 export function prepareOwnershipRepair(projectDir, runId, workId) {
     const snapshot = readQaEvidenceSnapshot(projectDir, runId);
     if (snapshot.availability === "corrupt" || snapshot.availability === "unreadable" || snapshot.availability === "missing")
@@ -24,7 +25,11 @@ export function prepareOwnershipRepair(projectDir, runId, workId) {
 export function repairOwnership(projectDir, value, userTurn, faults) {
     validateOwnershipRepair(value);
     const request = value;
-    if (!userTurn.trim().startsWith("/qa-repair ") || JSON.stringify(JSON.parse(userTurn.trim().slice("/qa-repair ".length))) !== JSON.stringify(request))
+    const explicitHostRequest = userTurn.trim().startsWith("/qa-repair ") && JSON.stringify(JSON.parse(userTurn.trim().slice("/qa-repair ".length))) === JSON.stringify(request);
+    const resumeRequest = userTurn.trim() === "rafi resume reconciliation " + JSON.stringify(request)
+        && request.choice === "authorize_mapped_work"
+        && request.authorization === "Resume reconciled already-approved in-scope work after an interrupted assignment response";
+    if (!explicitHostRequest && !resumeRequest)
         throw new Error("Repair requires the original explicit host request");
     const reader = new WorkflowReader(projectDir);
     try {
@@ -109,3 +114,20 @@ export function repairOwnership(projectDir, value, userTurn, faults) {
         }
     }
 }
+/** Resume only already-admitted work interrupted while recording its response. */
+export function reconcileInterruptedInScopeWork(projectDir, runId, workId) {
+    const plan = prepareOwnershipRepair(projectDir, runId, workId);
+    const conflicts = plan.ownership.conflicts;
+    if (!conflicts.length || conflicts.some(conflict => conflict.workId !== workId || conflict.classification !== "assignment_response_conflict")) {
+        throw new Error("Interrupted work is not a single in-scope assignment response conflict");
+    }
+    const request = {
+        version: 1, requestId: `resume-${randomUUID()}`, runId, workId,
+        expectedRevision: plan.expectedRevision, choice: "authorize_mapped_work",
+        inspectedSourceDigest: plan.inspectedSourceDigest, scopeRevision: plan.scopeRevision,
+        authorization: "Resume reconciled already-approved in-scope work after an interrupted assignment response",
+        attestation: "Rafi retained the interrupted response and inspected the current preserved source; do not replay the provider turn and require fresh QA",
+        mapping: plan.requiredPaths.map(path => ({ path, workId })),
+    };
+    return repairOwnership(projectDir, request, `rafi resume reconciliation ${JSON.stringify(request)}`);
+}

package/dist/cli/start.js

@@ -43,7 +43,7 @@ import { buildRunSessionBinding, checkpointBuildRun, completeBuildRun, createBui
 import { parse as parseYaml } from "yaml";
 import { findResumableBranchSessions, formatBranchContinueCommand, formatBranchSummaryFollowupCommands, } from "../branch/resume.js";
 import { detectGitProvider, loadTicketSetupConfig } from "../tickets/setupConfig.js";
-import { loadDeliveryConfig, selectDeliveryUnitForRun, selectStacksForRun, updateStackDeliveryState } from "../tickets/delivery.js";
+import { loadDeliveryConfig, selectDeliveryTicketsForRun, selectDeliveryUnitForRun, selectStacksForRun, updateStackDeliveryState } from "../tickets/delivery.js";
 import { AgentStatusReporter, RoleStatusAdapter } from "../statusReporter.js";
 import { currentActivity, withActivityPhase } from "../activity.js";
 import { fireTerminalBell } from "../notify.js";
@@ -628,6 +628,7 @@ export function buildStartCommand() {
             let deliveryConfig;
             let selectedStacks = [];
             let selectedStackTickets;
+            let selectedDeliveryTickets;
             if (isTicketsInitialized(cwd)) {
                 const delivery = loadDeliveryConfig(cwd);
                 deliveryConfig = delivery;
@@ -637,6 +638,7 @@ export function buildStartCommand() {
                     const earlyDb = new StateDb(earlyPaths.stateDb);
                     const earlyStates = earlyDb.getAllStates();
                     earlyDb.close();
+                    let skippedDeliveryUnits = opts.skipDeliveryUnit ?? [];
                     if (stackCount !== undefined) {
                         const earlyTickets = loadTickets(earlyPaths.tickets);
                         const selection = selectStacksForRun(delivery, earlyTickets, earlyStates, stackCount);
@@ -653,15 +655,23 @@ export function buildStartCommand() {
                         opts.provider = [...providers][0];
                     }
                     else
-                        deliveryRun = selectDeliveryUnitForRun(delivery, earlyStates, opts.skipDeliveryUnit ?? []);
+                        deliveryRun = selectDeliveryUnitForRun(delivery, earlyStates, skippedDeliveryUnits);
                     if (deliveryRun?.state === "resume" && !opts.yes && process.stdin.isTTY && process.stdout.isTTY) {
                         const answer = await select({ message: `Resume unfinished delivery unit ${deliveryRun.unit.id} (${deliveryRun.remaining.length} remaining)?`, options: [
                                 { value: "resume", label: "Resume (Recommended)" }, { value: "skip", label: "Skip for this run" },
                             ] });
                         if (isCancel(answer))
                             process.exit(0);
-                        if (answer === "skip")
-                            deliveryRun = selectDeliveryUnitForRun(delivery, earlyStates, [deliveryRun.unit.id, ...(opts.skipDeliveryUnit ?? [])]);
+                        if (answer === "skip") {
+                            skippedDeliveryUnits = [deliveryRun.unit.id, ...skippedDeliveryUnits];
+                            deliveryRun = selectDeliveryUnitForRun(delivery, earlyStates, skippedDeliveryUnits);
+                        }
+                    }
+                    if (stackCount === undefined) {
+                        selectedDeliveryTickets = selectDeliveryTicketsForRun(delivery, earlyStates, steps, skippedDeliveryUnits);
+                        if (selectedDeliveryTickets.length < steps) {
+                            console.log(`foreman: requested --steps ${steps}; admitting ${selectedDeliveryTickets.length} ticket(s). The next delivery unit uses shared/current branch semantics or is not yet eligible, so it will run separately.`);
+                        }
                     }
                 }
             }
@@ -1814,7 +1824,7 @@ export function buildStartCommand() {
                         branchPrefix,
                         maxBranchDepth,
                         rootBaseBranches: branchDefaults.rootBaseBranches,
-                        ticketIds: selectedNewTicket ? [selectedNewTicket] : selectedStackTickets ?? deliveryRun?.remaining.slice(0, steps) ?? recoveryRecord?.tickets,
+                        ticketIds: selectedNewTicket ? [selectedNewTicket] : selectedStackTickets ?? selectedDeliveryTickets ?? deliveryRun?.remaining.slice(0, steps) ?? recoveryRecord?.tickets,
                     });
                     let auditBuilder;
                     let auditViewer;
@@ -1834,7 +1844,7 @@ export function buildStartCommand() {
                             maxBranchDepth,
                             auditDependencies,
                             rootBaseBranches: branchDefaults.rootBaseBranches,
-                            ticketIds: selectedNewTicket ? [selectedNewTicket] : selectedStackTickets ?? deliveryRun?.remaining.slice(0, steps) ?? recoveryRecord?.tickets,
+                            ticketIds: selectedNewTicket ? [selectedNewTicket] : selectedStackTickets ?? selectedDeliveryTickets ?? deliveryRun?.remaining.slice(0, steps) ?? recoveryRecord?.tickets,
                         });
                         auditDependencyCount = auditDependencies.length;
                     }

package/dist/cli/status.js

@@ -65,7 +65,22 @@ export function runStatus(project) {
     const batchEnd = [...records].reverse().find((r) => r.event === "batch-end");
     const retainedRuns = readBuildRuns(projectDir).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
     const byId = new Map(retainedRuns.map(run => [run.runId, run]));
-    const recordRunId = [...records].reverse().find(record => typeof record.runId === "string" && (byId.has(record.runId) || record.event === "step" || record.event === "batch-end" || String(record.event).startsWith("branch-")))?.runId;
+    // Branch completion is the terminal fact for branch-per-ticket runs. Prefer
+    // its durable run identity over later bookkeeping/audit records in the same
+    // daily log, which may not themselves have a retained build record.
+    const lastProgressIndex = records.reduce((last, record, index) => (record.event === "step" || record.event === "batch-end" || String(record.event).startsWith("branch-") ? index : last), -1);
+    const completedBranchRunId = lastProgressIndex >= 0
+        && records[lastProgressIndex]?.event === "branch-complete"
+        && typeof records[lastProgressIndex]?.runId === "string"
+        && byId.has(records[lastProgressIndex].runId)
+        ? records[lastProgressIndex].runId
+        : undefined;
+    // Older branch logs omitted runId. Infer only when the last meaningful
+    // record is a completion and exactly one durable completed run owns that
+    // ticket; ambiguity remains deliberately unresolved rather than borrowing
+    // an unrelated historical result.
+    const legacyCompletedBranchRunId = completedBranchRunId ? undefined : legacyCompletedRunId(records, lastProgressIndex, retainedRuns);
+    const recordRunId = completedBranchRunId ?? legacyCompletedBranchRunId ?? [...records].reverse().find(record => typeof record.runId === "string" && (byId.has(record.runId) || record.event === "step" || record.event === "batch-end" || String(record.event).startsWith("branch-")))?.runId;
     const retainedRun = typeof recordRunId === "string" ? byId.get(recordRunId) : undefined;
     console.log(`${accent("foreman:")} latest run ${sanitizeTerminalText(logs[logs.length - 1] ?? "")}`);
     console.log(`${accent("foreman:")} ${steps.length} step record(s), ${escalations.length} escalation(s)`);
@@ -116,6 +131,13 @@ export function runStatus(project) {
     printWorkflowIssues(workflow, activeWorkflows);
     workflow?.close();
 }
+function legacyCompletedRunId(records, lastProgressIndex, retainedRuns) {
+    const terminal = lastProgressIndex >= 0 ? records[lastProgressIndex] : undefined;
+    if (terminal?.event !== "branch-complete" || typeof terminal.runId === "string" || typeof terminal.ticket !== "string")
+        return undefined;
+    const candidates = retainedRuns.filter(run => run.status === "completed" && run.tickets.includes(terminal.ticket));
+    return candidates.length === 1 ? candidates[0].runId : undefined;
+}
 function printWorkflowIssues(workflow, runs) {
     if (!workflow || runs.length === 0)
         return;

package/dist/foreman.js

@@ -151,7 +151,7 @@ export function buildPrimer(n, trackerPath, ticketsEnabled = false, preferredTic
 Rules:
 - Do exactly ONE ticket or step this turn, then stop.
 - ${MARKER_SPEC}
-- If a tool action is denied by foreman policy, do not retry it; report it via the blocked marker.${trackerRule}${preferredTicketRule}
+- If a tool action is denied by foreman policy, do not retry the denied form; report it via the blocked marker. The one exception is a required test that you changed by adding a pipe, redirection, substitution, or wrapper: retry the exact required-test command without that extra shell syntax before reporting it blocked.${trackerRule}${preferredTicketRule}
 
 This is step 1 of ${n}. Implement the next ticket or step now.`;
 }
@@ -170,6 +170,8 @@ export function buildQaInstruction() {
 
 Triple-check. Do not rubber-stamp your own work. Be skeptical.
 
+If an otherwise required test is denied only because you added a pipe, redirection, substitution, or wrapper, retry the exact required-test command without that extra shell syntax. Do not retry other denied actions.
+
 If everything is solid, end with STEP_STATUS: qa_pass.
 If anything is off, return the required RAFI_QA_FAILURE_REPORT_START/RAFI_QA_FAILURE_REPORT_END JSON envelope immediately before STEP_STATUS: qa_fail. The report must contain every check, every blocking finding, and all nonblocking observations. Do NOT fix issues on this turn — just report them. Foreman will instruct the Builder to fix them next.
 

package/dist/handoffs.js

@@ -326,26 +326,29 @@ export class HandoffService {
                 return response;
             };
             const acceptancePrompt = [
+                handoffAcceptanceInstruction(),
                 "Accept this validated Rafi handoff. Do not repeat completed work and reconcile host receipts before side effects.",
                 staged.markdown,
                 `Manifest JSON: ${JSON.stringify(staged.manifest)}`,
                 ...(options.guidance ? [`Human recovery guidance: ${options.guidance}`] : []),
-                `Reply with ${HANDOFF_ACCEPTED} on the first line, then ${continuityInstruction()}`,
+                handoffAcceptanceInstruction(),
             ].join("\n\n");
             let response = await sendAcceptance(acceptancePrompt);
-            let validation = validateHandoffAcceptance(staged, successor, response.text);
+            let acceptanceText = response.rawResponse ?? response.text;
+            let validation = validateHandoffAcceptance(staged, successor, acceptanceText);
             if (validation && (validation.code === "missing-acknowledgement" || validation.code === "invalid-continuity-delta")) {
                 const repairPrompt = [
                     `Your handoff acknowledgement was rejected: ${validation.message}.`,
                     "Correction only: do not use tools, repeat completed work, or perform implementation.",
-                    `Reply with ${HANDOFF_ACCEPTED} on the first line, then ${continuityInstruction()}`,
+                    handoffAcceptanceInstruction(),
                 ].join("\n\n");
                 response = await sendAcceptance(repairPrompt);
-                validation = validateHandoffAcceptance(staged, successor, response.text);
+                acceptanceText = response.rawResponse ?? response.text;
+                validation = validateHandoffAcceptance(staged, successor, acceptanceText);
             }
             if (validation)
                 throw new HandoffAcceptanceError(validation.code, staged.manifest.runId, staged.manifest.generation, validation.message);
-            const parsed = parseContinuityDelta(response.text);
+            const parsed = parseContinuityDelta(acceptanceText);
             const sessionId = successor.sessionId();
             const observedSuccessorRef = successor.sessionRef?.();
             const successorRef = observedSuccessorRef ? { ...observedSuccessorRef, generation: staged.manifest.generation, validatedAt: new Date().toISOString() } : undefined;
@@ -513,6 +516,15 @@ function validateHandoffAcceptance(staged, successor, text) {
     }
     return undefined;
 }
+/** Keep the small acknowledgement protocol visible above and after a large handoff packet. */
+function handoffAcceptanceInstruction() {
+    return [
+        "Mandatory response protocol: do not call tools or add a preface, explanation, or Markdown fence.",
+        `Your first non-whitespace line must be exactly ${HANDOFF_ACCEPTED}.`,
+        "After it, emit exactly one RAFI_CONTINUITY_DELTA record as instructed below.",
+        continuityInstruction(),
+    ].join("\n");
+}
 async function promptHandoffRecovery(error, runtime, allowProviderSwitch) {
     const { select, isCancel } = await import("@clack/prompts");
     return pauseActivityForInput(async () => {

package/dist/ticketPlanning.d.ts

@@ -64,11 +64,15 @@ export interface TicketPlanningContext {
     }>;
     existingNext: string[];
 }
+/** The tracker facts needed to validate a proposal before it is approved. */
+export interface TicketPlanValidationContext {
+    futureWorkIds?: Iterable<number>;
+}
 export declare function readTicketPlanningContext(projectDir: string): TicketPlanningContext;
 export declare function ticketPlanningFingerprint(projectDir: string): PlanningFingerprint[];
 export declare function planningFingerprintChanges(projectDir: string, expected: PlanningFingerprint[]): string[];
-export declare function extractTicketPlanProposal(output: string, existingTickets?: TicketDef[]): TicketPlanProposal;
-export declare function validateTicketPlanProposal(value: unknown, existingTickets?: TicketDef[]): string[];
+export declare function extractTicketPlanProposal(output: string, existingTickets?: TicketDef[], context?: TicketPlanValidationContext): TicketPlanProposal;
+export declare function validateTicketPlanProposal(value: unknown, existingTickets?: TicketDef[], context?: TicketPlanValidationContext): string[];
 export interface ApplyTicketPlanOptions {
     expectedFingerprint: PlanningFingerprint[];
     docsRoot: string;

package/dist/ticketPlanning.js

@@ -12,6 +12,9 @@ import { normalizeDeliveryConfig, validateDeliveryConfig } from "./tickets/deliv
 import { loadTicketSetupConfig, mergeTicketSetup, saveTicketSetupConfig } from "./tickets/setupConfig.js";
 export const PROPOSAL_START = "RAFI_PROPOSAL_START";
 export const PROPOSAL_END = "RAFI_PROPOSAL_END";
+const TICKET_STATUSES = new Set([
+    "planned", "next", "in_progress", "blocked", "done", "canceled", "obsolete",
+]);
 export function readTicketPlanningContext(projectDir) {
     const config = loadTicketsConfig(projectDir);
     const paths = resolveTicketPaths(config, projectDir);
@@ -41,7 +44,7 @@ export function ticketPlanningFingerprint(projectDir) {
 export function planningFingerprintChanges(projectDir, expected) {
     return expected.filter((item) => fileHash(join(projectDir, item.path)) !== item.sha256).map((item) => item.path);
 }
-export function extractTicketPlanProposal(output, existingTickets = []) {
+export function extractTicketPlanProposal(output, existingTickets = [], context = {}) {
     const start = output.lastIndexOf(PROPOSAL_START);
     const end = output.lastIndexOf(PROPOSAL_END);
     if (start < 0 || end <= start)
@@ -54,12 +57,12 @@ export function extractTicketPlanProposal(output, existingTickets = []) {
     catch (err) {
         throw new Error(`planner proposal is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
     }
-    const issues = validateTicketPlanProposal(parsed, existingTickets);
+    const issues = validateTicketPlanProposal(parsed, existingTickets, context);
     if (issues.length)
         throw new Error(`invalid planner proposal:\n${issues.map((issue) => `- ${issue}`).join("\n")}`);
     return parsed;
 }
-export function validateTicketPlanProposal(value, existingTickets = []) {
+export function validateTicketPlanProposal(value, existingTickets = [], context = {}) {
     const issues = [];
     if (!value || typeof value !== "object" || Array.isArray(value))
         return ["proposal must be an object"];
@@ -109,9 +112,26 @@ export function validateTicketPlanProposal(value, existingTickets = []) {
             if (!ids.has(id))
                 issues.push(`supersession references unknown ticket ${id}`);
     }
-    for (const change of p.state_changes)
-        if (!ids.has(change.id) || !change.reason?.trim())
-            issues.push(`invalid state change for ${change.id}`);
+    for (const change of p.state_changes) {
+        if (!change || typeof change !== "object" || !ids.has(change.id) || !change.reason?.trim()) {
+            issues.push(`invalid state change for ${String(change && typeof change === "object" ? change.id : undefined)}`);
+            continue;
+        }
+        if (!TICKET_STATUSES.has(change.status))
+            issues.push(`state change for ${change.id} has invalid status ${String(change.status)}`);
+    }
+    const futureWorkIds = context.futureWorkIds ? new Set(context.futureWorkIds) : undefined;
+    for (const disposition of p.future_work) {
+        if (!disposition || typeof disposition !== "object" || !Number.isInteger(disposition.id)) {
+            issues.push(`future work disposition has invalid id ${String(disposition && typeof disposition === "object" ? disposition.id : undefined)}`);
+            continue;
+        }
+        if (!["accepted", "rejected", "merged", "queued"].includes(disposition.disposition)) {
+            issues.push(`future work item ${disposition.id} has invalid disposition ${String(disposition.disposition)}`);
+        }
+        if (futureWorkIds && !futureWorkIds.has(disposition.id))
+            issues.push(`future work item ${disposition.id} does not exist`);
+    }
     for (const item of p.source_reconciliation) {
         if (!item.source?.trim() || !item.item?.trim())
             issues.push("source reconciliation needs source and item");
@@ -151,7 +171,8 @@ export function applyApprovedTicketPlan(projectDir, proposal, opts) {
     const existing = loadTickets(paths.tickets);
     if (existing.length > 0 && !existsSync(paths.stateDb))
         throw new Error("tickets exist but the ignored ticket-state database is missing; restore it before planning so completed work is not treated as new");
-    const proposalIssues = validateTicketPlanProposal(proposal, existing);
+    const currentContext = readTicketPlanningContext(root);
+    const proposalIssues = validateTicketPlanProposal(proposal, existing, { futureWorkIds: currentContext.futureWork.flatMap((item) => typeof item.id === "number" ? [item.id] : []) });
     if (proposalIssues.length)
         throw new Error(`approved proposal is invalid:\n${proposalIssues.map((issue) => `- ${issue}`).join("\n")}`);
     const lockPath = join(root, ".tickets", "planning.lock");

package/dist/tickets/delivery.d.ts

@@ -64,6 +64,14 @@ export interface DeliveryUnitProgress {
 export declare function deliveryProgress(config: DeliveryConfig, states: Map<string, TicketState>): DeliveryUnitProgress[];
 export declare function formatDeliverySummary(config: DeliveryConfig, states: Map<string, TicketState>): string[];
 export declare function selectDeliveryUnitForRun(config: DeliveryConfig, states: Map<string, TicketState>, skipUnitIds?: readonly string[]): DeliveryUnitProgress | undefined;
+/**
+ * Select the tickets a normal `--steps N` run may admit from delivery units.
+ *
+ * A delivery unit remains the unit of resume/branch semantics. A multi-unit
+ * normal run may contain only per-ticket units: shared and current-branch
+ * units have unit-level branch semantics, so they are hard boundaries.
+ */
+export declare function selectDeliveryTicketsForRun(config: DeliveryConfig, states: Map<string, TicketState>, steps: number, skipUnitIds?: readonly string[]): string[];
 export interface StackBatchSelection {
     stacks: DeliveryStack[];
     tickets: string[];

package/dist/tickets/delivery.js

@@ -283,6 +283,33 @@ export function selectDeliveryUnitForRun(config, states, skipUnitIds = []) {
     const progress = deliveryProgress(config, states).filter((item) => !skipped.has(item.unit.id));
     return progress.find((item) => item.state === "resume") ?? progress.find((item) => item.state === "ready");
 }
+/**
+ * Select the tickets a normal `--steps N` run may admit from delivery units.
+ *
+ * A delivery unit remains the unit of resume/branch semantics. A multi-unit
+ * normal run may contain only per-ticket units: shared and current-branch
+ * units have unit-level branch semantics, so they are hard boundaries.
+ */
+export function selectDeliveryTicketsForRun(config, states, steps, skipUnitIds = []) {
+    const skipped = new Set(skipUnitIds);
+    const eligible = deliveryProgress(config, states).filter((item) => !skipped.has(item.unit.id));
+    const ordered = [...eligible.filter((item) => item.state === "resume"), ...eligible.filter((item) => item.state === "ready")];
+    const selected = [];
+    for (const item of ordered) {
+        if (selected.length >= steps)
+            break;
+        // Do not add a unit with different branch semantics to an existing batch.
+        // If it is the first eligible unit, it is still valid to select work from
+        // that one unit; the caller preserves its unit semantics.
+        if (selected.length > 0 && item.unit.branch_mode !== "per-ticket")
+            break;
+        const available = item.remaining.slice(0, steps - selected.length);
+        selected.push(...available);
+        if (item.unit.branch_mode !== "per-ticket")
+            break;
+    }
+    return selected;
+}
 /** Complete preflight simulation for exact `--stacks N` selection. */
 export function selectStacksForRun(config, ticketDefs, states, count) {
     if (!Number.isInteger(count) || count < 1)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-foreman",
-  "version": "1.7.22",
+  "version": "1.7.24",
   "description": "An orchestrator that keeps Codex CLI / Claude Code builders moving through their step list unattended. Part of Rafi.",
   "license": "Apache-2.0",
   "type": "module",