amsd-pipeline-workflow 0.1.20 → 0.1.22

package/bin/cpu-bound

@@ -0,0 +1,22 @@
+#!/bin/bash
+# cpu-bound <command...> — the live session's tools may not size their pools from the whole machine.
+#
+# Run 11, 2026-10-20 23:07 UTC: the Writer agent ran the codeline's whole jest suite; jest sized 15 workers from the host's 16 cores
+# (~270 MB each) inside the session's 4096 MB memory scope, and the kernel OOM-killed the session. The Bash pipeline fixed exactly this in
+# run 9 (lib/bounded-exec.sh): the number of workers is DERIVED from the tightest cgroup memory limit (resolve_test_workers), and the
+# process's CPU affinity is restricted to that many CPUs (bound_self_affinity) — everything it starts, the agent's own tool commands
+# included, inherits it and sizes its pool from it; a preload (lib/node-cpu-bound.js) makes runners that count os.cpus() see the bound too.
+# Those are the PIPELINE's functions, sourced from the install (SCRIPT_DIR); nothing is copied here.
+#
+# Placed INSIDE the memory scope (bin/bounded), so the cgroup it reads is the one the session lives in:   bounded cpu-bound claude -p …
+# A bound that cannot be applied is SAID (stderr) and the command still runs — as the pipeline's own wrapper does.
+set -u
+[ $# -gt 0 ] || { echo "cpu-bound: no command" >&2; exit 64; }
+if [ -n "${SCRIPT_DIR:-}" ] && [ -f "$SCRIPT_DIR/lib/bounded-exec.sh" ]; then
+  # shellcheck source=/dev/null
+  . "$SCRIPT_DIR/lib/bounded-exec.sh"
+  bound_self_affinity "$(resolve_test_workers)"
+else
+  echo "[cpu-bound] WARNING: the pipeline's lib/bounded-exec.sh was not found (SCRIPT_DIR='${SCRIPT_DIR:-}') — this session's tools run UNBOUNDED" >&2
+fi
+exec "$@"

package/driver/runtime.js

@@ -19,6 +19,9 @@ const { spawnSync } = require('child_process');
 const ROOT = path.resolve(__dirname, '..');
 const { recordSession } = require('./session-cost.js');
 
+// the names workflows were placed under by earlier versions of this driver and that a test runner's default pattern matches
+const LEGACY_WORKFLOW_FILES = ['spec'];
+
 function toMarkdown(name, def) {
   // generator/agents.js toMarkdown, from the agents JSON entry (frontmatter keys + `prompt` as the body)
   const { prompt, ...fm } = def;
@@ -65,13 +68,20 @@ function liveCommand({ name, script, agentsJson, args, sessionDir, env, cwd }) {
   if (Object.keys(map).length) pre.push({ matcher: [...matchers].join('|') || '.*', hooks: [{ type: 'command', command: dispatch, ...(timeout ? { timeout } : {}) }] });
   settings.hooks = { ...(settings.hooks || {}), PreToolUse: pre };
   fs.writeFileSync(settingsFile, JSON.stringify(settings, null, 2));
+  // A LEGACY FILE OF THE PIPELINE'S OWN goes (the Spec workflow was placed as spec.js, which a client's jest runs as a test — run 11): only a file named like a legacy workflow that carries a workflow header
+  // of that same name; a client's file of the same name is never touched
+  for (const legacy of LEGACY_WORKFLOW_FILES) {
+    const f = path.join(wfDir, `${legacy}.js`);
+    try { if (new RegExp(`^export const meta = \\{\\s*name: '${legacy}'`).test(fs.readFileSync(f, 'utf8')) && legacy !== name) fs.rmSync(f); } catch { /* none */ }
+  }
   fs.copyFileSync(script, path.join(wfDir, `${name}.js`));
   // THE RUNNER WAITS FOR ITS WORKFLOW (LIVE-AMSD-2974-3, 2026-10-18: the runner answered "It's still running in the
   // background…" and the session exited, taking the Spec workflow down with it): it answers only with the finished result
   // the session itself waits for its workflow (CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 below); the runner has no task-wait tool
   const prompt = `Run the workflow "${name}" with these args, exactly: ${JSON.stringify(args || {})}. When it has finished, reply with its result as JSON and nothing else.`;
   const claude = (env && env.CLAUDE_BIN) || 'claude';
-  const argv = [path.join(__dirname, '..', 'bin', 'bounded'), claude, '-p', prompt, '--output-format', 'json',
+  // memory scope (bin/bounded) → CPU bound derived from that scope (bin/cpu-bound, the pipeline's own bound_self_affinity) → the session: its tools (jest included) cannot out-size the scope (run 11 OOM)
+  const argv = [path.join(__dirname, '..', 'bin', 'bounded'), path.join(__dirname, '..', 'bin', 'cpu-bound'), claude, '-p', prompt, '--output-format', 'json',
     '--setting-sources', 'project', '--permission-mode', 'bypassPermissions'];
   return { cwd: home, argv, agents: Object.keys(defs).length, workflow: path.join(wfDir, `${name}.js`) };
 }

package/driver/stages.js

@@ -8,6 +8,10 @@ const { spawnSync } = require('child_process');
 const runtime = require('./runtime.js');
 const { bash } = require('./pipeline.js');
 
+// THE NAME EACH WORKFLOW IS RUN BY (and so the file it is placed in, <codeline>/.claude/workflows/<name>.js). No name may match a test runner's default pattern: the Spec workflow was "spec", the client's jest ran
+// spec.js as a test, and every whole-suite run in a codeline reported the pipeline's own file as a failing suite (run 11, 2026-10-20; test/integration/workflow-placement.test.js).
+const WORKFLOW_NAMES = { agents: 'codeline-agents', spec: 'spec-stage', writer: 'writer', assess: 'assess', bridge: 'bridge' };
+
 const ROOT = path.resolve(__dirname, '..');
 const gen = (script, args, env) => {
   const r = spawnSync(process.execPath, [path.join(ROOT, 'generator', script), ...args], { encoding: 'utf8', env, maxBuffer: 256 * 1024 * 1024 });
@@ -71,7 +75,7 @@ async function runGeneratedAgents(ctx) {
     ...(ctx.agentsDocuments ? ['--documents', ctx.agentsDocuments] : []), ...(env.JIRA_TICKET ? ['--ticket', env.JIRA_TICKET] : []),
     ...(env.EPAM_ESTIMATION_MANIFEST ? ['--estimation-manifest', env.EPAM_ESTIMATION_MANIFEST] : [])], env);
   const plan = JSON.parse(fs.readFileSync(path.join(out, 'plan.json'), 'utf8'));
-  const res = await runtime.run({ runtime: ctx.runtime, log: ctx.log, name: 'codeline-agents', script: path.join(out, 'workflows', 'codeline-agents.js'),
+  const res = await runtime.run({ runtime: ctx.runtime, log: ctx.log, name: WORKFLOW_NAMES.agents, script: path.join(out, 'workflows', 'codeline-agents.js'),
     agentsJson: path.join(out, 'agents.json'), args: withFeatures(ctx, {}), env: liveStart ? (({ EPAM_SKIP_JIRA_INGEST: _s, ...rest }) => rest)(env) : { ...env, EPAM_SKIP_JIRA_INGEST: '1' },   // a live start runs the stage's own ingest
     standin: ctx.standin && ctx.standin('codeline-agents', { plan, out }), sessionDir: path.join(out, 'session'), approved: ctx.liveApproved });
   log(`[driver] Codeline, Agents: ${res.status}${res.reason ? ` — ${res.reason}` : ''} (${res.calls || 0} question(s); phases: ${(res.phases || []).join(' → ') || 'none'})`);
@@ -141,7 +145,7 @@ async function runPlan(ctx, env, { prd, story, phase, keep, out }) {
     '--codeline-map', Object.entries(ctx.map).map(([k, v]) => `${k}=${v}`).join(','),
     '--plan-only', '--story', story.id, '--plan-keep', keep, ...(ctx.docsFrom ? ['--docs-from', ctx.docsFrom] : [])], env);
   const specEnv = JSON.parse(fs.readFileSync(path.join(out, 'checks', 'spec', 'env.json'), 'utf8'));
-  return runtime.run({ runtime: ctx.runtime, log: ctx.log, name: 'spec', script: path.join(out, 'workflows', 'spec.js'),
+  return runtime.run({ runtime: ctx.runtime, log: ctx.log, name: WORKFLOW_NAMES.spec, script: path.join(out, 'workflows', 'spec.js'),
     agentsJson: path.join(out, 'agents-spec.json'), args: withFeatures(ctx, {}), env: specEnv, standin: ctx.standin && ctx.standin('spec', { lane: { cl: first, wt: ctx.map[first] }, out }),
     sessionDir: path.join(out, 'session'), cwd: ctx.map[first], approved: ctx.liveApproved });
 }
@@ -154,7 +158,7 @@ async function runSpec(ctx, lane, env, { prd, phase, out }) {
     '--lane-log-dir', env.LOG_DIR, ...(ctx.docsFrom ? ['--docs-from', ctx.docsFrom] : []),
     ...(env.EPAM_RESUME_RUN ? ['--resume'] : [])], env);
   const specEnv = JSON.parse(fs.readFileSync(path.join(out, 'checks', 'spec', 'env.json'), 'utf8'));
-  const result = await runtime.run({ runtime: ctx.runtime, log: ctx.log, name: 'spec', script: path.join(out, 'workflows', 'spec.js'),
+  const result = await runtime.run({ runtime: ctx.runtime, log: ctx.log, name: WORKFLOW_NAMES.spec, script: path.join(out, 'workflows', 'spec.js'),
     agentsJson: path.join(out, 'agents-spec.json'), args: withFeatures(ctx, {}), env: specEnv, standin: ctx.standin && ctx.standin('spec', { lane, out }),
     sessionDir: path.join(out, 'session'), cwd: lane.wt, approved: ctx.liveApproved });
   // the spec pass's PRD is the lane's PRD (its PRD_FILE): the workflow worked on its own copy
@@ -227,7 +231,7 @@ async function runWriter(ctx, lane, env, { story, out, lineSlug, reviewCommitted
       if (k in ctx.launchEnv && String(ctx.launchEnv[k]) !== String(val)) throw new Error(`the Writer was generated with ${k}=${val}, the run was launched with ${ctx.launchEnv[k]}`);
     }
   }
-  const res = await runtime.run({ runtime: ctx.runtime, log: ctx.log, name: 'writer', script: path.join(out, 'workflows', 'writer.js'),
+  const res = await runtime.run({ runtime: ctx.runtime, log: ctx.log, name: WORKFLOW_NAMES.writer, script: path.join(out, 'workflows', 'writer.js'),
     agentsJson: path.join(out, 'agents.json'), args: withFeatures(ctx, { runId: ctx.run, story }), env, standin: ctx.standin && ctx.standin('writer', { lane, out, story }),
     sessionDir: path.join(out, 'session'), cwd: lane.wt, approved: ctx.liveApproved, costStory: story });
   persistFailures(out, env.LOG_DIR);
@@ -257,7 +261,7 @@ async function runAssess(ctx, lane, env, { label, out }) {
   fs.rmSync(out, { recursive: true, force: true });
   gen(path.join('..', 'driver', 'generate-assess.js'), ['--install', ctx.install, '--codeline', lane.wt, '--out', out, '--label', label, '--set', ctx.set,
     '--env', JSON.stringify(env)], env);
-  return runtime.run({ runtime: ctx.runtime, log: ctx.log, name: 'assess', script: path.join(out, 'workflows', 'assess.js'),
+  return runtime.run({ runtime: ctx.runtime, log: ctx.log, name: WORKFLOW_NAMES.assess, script: path.join(out, 'workflows', 'assess.js'),
     agentsJson: path.join(out, 'agents-assess.json'), args: {}, env, standin: ctx.standin && ctx.standin('assess', { lane, out }),
     sessionDir: path.join(out, 'session'), approved: ctx.liveApproved });
 }
@@ -267,9 +271,9 @@ async function runBridge(ctx, lane, env, { prd, out }) {
   fs.rmSync(out, { recursive: true, force: true });
   gen(path.join('..', 'driver', 'generate-bridge.js'), ['--install', ctx.install, '--project', ctx.project, '--run', ctx.run, '--lane', lane.cl,
     '--codeline', lane.wt, '--prd', prd, '--out', out, '--set', ctx.set, '--env', JSON.stringify({ LOG_DIR: ctx.env.LOG_DIR })], env);
-  return runtime.run({ runtime: ctx.runtime, log: ctx.log, name: 'bridge', script: path.join(out, 'workflows', 'bridge.js'),
+  return runtime.run({ runtime: ctx.runtime, log: ctx.log, name: WORKFLOW_NAMES.bridge, script: path.join(out, 'workflows', 'bridge.js'),
     agentsJson: path.join(out, 'agents-bridge.json'), args: {}, env, standin: ctx.standin && ctx.standin('bridge', { lane, out }),
     sessionDir: path.join(out, 'session'), approved: ctx.liveApproved });
 }
 
-module.exports = { runPlan, runCodelineAgents, runSpec, runPrePause, runWriter, runBridge, runAssess, featureOn, persistFailures };
+module.exports = { WORKFLOW_NAMES, runPlan, runCodelineAgents, runSpec, runPrePause, runWriter, runBridge, runAssess, featureOn, persistFailures };

package/generator/generate.js

@@ -533,6 +533,14 @@ function main(a) {
       const chain = [d.frontmatter && d.frontmatter.model].filter(Boolean);
       while (pairs[chain[chain.length - 1]] && !chain.includes(pairs[chain[chain.length - 1]])) chain.push(pairs[chain[chain.length - 1]]);
       return chain;
+    })(),
+    // WHY THE EARLIER ATTEMPTS OF THIS STORY WERE BLOCKED (run 11, 2026-10-20: five blind retries of one gate block): the last three reproduction-gate reasons in the lane's failure history
+    // (hooks/pipeline-step.js recordGateBlock appends them; the driver persists the file), for the repro-test writer's prompt
+    priorBlocks: (() => {
+      try {
+        return fs.readFileSync(path.join(process.env.LOG_DIR || '', 'story-failures.jsonl'), 'utf8').split('\n').filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } })
+          .filter((r) => r && r.storyId === a.story && r.failureClass === 'repro-gate-block' && String(r.reason || '').trim()).map((r) => String(r.reason).trim()).slice(-3);
+      } catch { return []; }
     })() },
     // The path with no jumps (for reading), and the step from every reachable state (generator/ladder.sh): the workflow walks
     // the steps, so a jump lands where the pipeline's would.

package/generator/spec-workflow.js

@@ -12,7 +12,7 @@ const { packPlan } = require('./pack-plan.js');
 function emit(plan) {
   const packed = packPlan(plan);
   return `export const meta = {
-  name: 'spec',
+  name: 'spec-stage',
   description: 'Spec stage for one lane: spec coordinator, ticket links, detective, openspec with its verification-criteria guard, change review, speckit, coordinator and model review, pause 2',
   phases: [{ title: 'Spec' }, { title: 'Review' }, { title: 'Pause 2' }],
 }

package/generator/writer-workflow.js

@@ -390,9 +390,13 @@ async function reproStep(prep) {
   const schema = { ...SCHEMAS.repro, properties: { ...SCHEMAS.repro.properties,
     source: { type: 'string', enum: [source], description: 'the source file your test covers: exactly this path' },
     test: { type: 'string', description: \`the path of the test file you wrote, relative to the codeline root (planned: \${cand.target})\` } } }
+  // EARLIER ATTEMPTS OF THIS STORY WERE BLOCKED BY THE REPRODUCTION GATE (the lane's failure history, plan.repro.priorBlocks): the writer is told why, after the pipeline's own prompt
+  const blocked = (PLAN.repro.priorBlocks || []).length
+    ? \`\\n\\nEARLIER ATTEMPTS OF THIS STORY WERE BLOCKED BY THE REPRODUCTION GATE — read why before you write the test. The gate runs your test with the fix reverted to the story's baseline and requires it to FAIL there; a test that passes without the fix reproduces nothing.\\n\${PLAN.repro.priorBlocks.map((r) => \`- \${r}\`).join('\\n')}\\n\`
+    : ''
   for (let i = 0; i < PLAN.repro.maxAttempts; i++) {
     const model = PLAN.repro.ladder[Math.min(i, PLAN.repro.ladder.length - 1)]
-    const a = await agentCall(relativize(cand.prompt) + fb.typecheck + fb.assertions + fb.commit_rejected,
+    const a = await agentCall(relativize(cand.prompt) + blocked + fb.typecheck + fb.assertions + fb.commit_rejected,
       { agentType: PLAN.agents.reproWriter, model, schema, label: \`repro test #\${i + 1}\`, phase: 'Writer' })
     const v = (a && a.validation) || { valid: false, committed: false, class: 'no_file', feedback: '', reason: a ? 'the answer carries no validation' : 'the agent ended without an answer' }
     if (v.valid) return { committed: !!v.committed, attempts: i + 1, test: a.test, reason: v.reason }

package/hooks/pipeline-step.js

@@ -16,28 +16,58 @@ const STEPS = { 'repro-gate': 'step-repro-gate.sh', 'uit-check': 'step-uit-check
   'plan-start': 'step-plan-start.sh', 'plan-fail': 'step-plan-fail.sh', 'call-failed': 'step-call-failed.sh' };   // the step scripts, beside this file
 function args(argv) { const a = {}; for (let i = 0; i < argv.length; i += 2) a[argv[i].replace(/^--/, '')] = argv[i + 1]; return a; }
 
+/** The step's result: its script's last line (or why there is none). */
+function runScriptStep(a, input) {
+  const script = STEPS[a.step];
+  if (!script) return { ran: false, passed: false, reason: `unknown step '${a.step}'` };
+  // a per-attempt step runner's own values (decision 27): its retry and the model the previous attempt ran on
+  const env = { ...process.env, ...(a.retry !== undefined ? { RUNG_RETRY: String(a.retry) } : {}), ...(a['prev-model'] ? { RUNG_PREV_MODEL: a['prev-model'] } : {}),
+    ...(a.model ? { RUNG_MODEL: a.model } : {}),
+    // a failed agent call (the gateway, hooks/step-call-failed.sh): the call the step runner was told to hand on
+    ...(() => { const c = (input.tool_input || {}).call || {}; return { CALL_AGENT: String(c.agent || ''), CALL_MODEL: String(c.model || ''),
+      CALL_STORY: String(c.story || 'global'), CALL_REASON: String(c.reason || ''), CALL_ATTEMPT: String(c.attempt || 1) }; })() };
+  const r = spawnSync('bash', [path.join(__dirname, script), a.pipeline, a.state], { encoding: 'utf8', env, maxBuffer: 64 * 1024 * 1024 });
+  // THE STEP'S RESULT IS ITS LAST LINE (each step script ends with one `jq -c` line); anything the pipeline printed ahead of
+  // it is kept on stderr, never read as the result and never let onto this hook's stdout (R3, the B60 class)
+  const lines = String(r.stdout || '').split('\n').filter((l) => l.trim());
+  if (lines.length > 1) process.stderr.write(`${lines.slice(0, -1).join('\n')}\n`);
+  try { return JSON.parse(lines[lines.length - 1]); } catch { return { ran: false, passed: false, reason: (r.stderr || `exit ${r.status}`).slice(-400) }; }
+}
+
+/**
+ * A GATE BLOCK IS FAILURE HISTORY (run 11, 2026-10-20: the reproduction gate blocked one story five times and nothing carried the reason to the next attempt).
+ * When the reproduction gate RAN and did not pass, one record is appended to the run's story-failures.jsonl in the pipeline's own format
+ * (story-attempt.sh:2666–2688: storyId, failureClass, model, attempt, exitCode, rawBytes, outputTokens, maxIterations, timestamp) plus the gate's reason: the
+ * driver persists the file to the lane's log (driver/stages.js persistFailures) and the next generation reads it (generator/generate.js plan.repro.priorBlocks).
+ */
+function recordGateBlock(a, result) {
+  if (a.step !== 'repro-gate' || !result || result.ran !== true || result.passed !== false) return null;
+  const pj = JSON.parse(fs.readFileSync(a.pipeline, 'utf8'));
+  const file = path.join(a.state, 'pipeline-env', 'logs', 'story-failures.jsonl');
+  let prior = 0;
+  try { prior = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean).map((l) => JSON.parse(l)).filter((r) => r.storyId === pj.story && r.failureClass === 'repro-gate-block').length; } catch { prior = 0; }
+  const rec = { storyId: pj.story, failureClass: 'repro-gate-block', model: 'gate', attempt: prior + 1, exitCode: 2, rawBytes: 0, outputTokens: 0, maxIterations: 0,
+    timestamp: new Date().toISOString(), gate: '3.55', reason: String(result.reason || '').slice(0, 1500) };
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.appendFileSync(file, `${JSON.stringify(rec)}\n`);
+  return rec;
+}
+
+/** The hook's answer for one StructuredOutput call: the step's result, written back into the answer. runStep is injectable for tests. */
+function answer(a, input, runStep) {
+  if (input.tool_name !== 'StructuredOutput') return false;
+  const result = (runStep || runScriptStep)(a, input);
+  try { recordGateBlock(a, result); } catch { /* a record that cannot be written never changes what the workflow is told */ }
+  process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow',
+    updatedInput: { ...(input.tool_input || {}), step: a.step, result } } })}\n`);
+  return true;
+}
+
 if (require.main === module) {
   const a = args(process.argv.slice(3));
   let input = {};
   try { input = JSON.parse(fs.readFileSync(0, 'utf8') || '{}'); } catch { /* nothing */ }
-  if (input.tool_name !== 'StructuredOutput') process.exit(0);
-  let result;
-  const script = STEPS[a.step];
-  if (!script) result = { ran: false, passed: false, reason: `unknown step '${a.step}'` };
-  else {
-    // a per-attempt step runner's own values (decision 27): its retry and the model the previous attempt ran on
-    const env = { ...process.env, ...(a.retry !== undefined ? { RUNG_RETRY: String(a.retry) } : {}), ...(a['prev-model'] ? { RUNG_PREV_MODEL: a['prev-model'] } : {}),
-      ...(a.model ? { RUNG_MODEL: a.model } : {}),
-      // a failed agent call (the gateway, hooks/step-call-failed.sh): the call the step runner was told to hand on
-      ...(() => { const c = (input.tool_input || {}).call || {}; return { CALL_AGENT: String(c.agent || ''), CALL_MODEL: String(c.model || ''),
-        CALL_STORY: String(c.story || 'global'), CALL_REASON: String(c.reason || ''), CALL_ATTEMPT: String(c.attempt || 1) }; })() };
-    const r = spawnSync('bash', [path.join(__dirname, script), a.pipeline, a.state], { encoding: 'utf8', env, maxBuffer: 64 * 1024 * 1024 });
-    // THE STEP'S RESULT IS ITS LAST LINE (each step script ends with one `jq -c` line); anything the pipeline printed ahead of
-    // it is kept on stderr, never read as the result and never let onto this hook's stdout (R3, the B60 class)
-    const lines = String(r.stdout || '').split('\n').filter((l) => l.trim());
-    if (lines.length > 1) process.stderr.write(`${lines.slice(0, -1).join('\n')}\n`);
-    try { result = JSON.parse(lines[lines.length - 1]); } catch { result = { ran: false, passed: false, reason: (r.stderr || `exit ${r.status}`).slice(-400) }; }
-  }
-  process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow',
-    updatedInput: { ...(input.tool_input || {}), step: a.step, result } } })}\n`);
+  if (!answer(a, input)) process.exit(0);
 }
+
+module.exports = { answer, recordGateBlock, STEPS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amsd-pipeline-workflow",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "The AMSD pipeline as Claude workflows. Installed by the amsd-pipeline installer: install.sh --workflows",
   "license": "UNLICENSED",
   "bin": {