atris 3.74.28 → 3.74.29

package/lib/fleet.js

@@ -53,18 +53,27 @@ const {
 } = require('./secret-gateway');
 const { appendEngineLiveLogChunk, createEngineLiveLog, engineTerminalReason } = require('./engine-job-lifecycle');
 const { recordEngineResource } = require('./engine-resource');
+const {
+  taskTagTokens,
+  isDecisionHoldTag,
+  isDecisionTask,
+  DECISION_REFUSE_REASON,
+} = require('./task-decision');
 
 // Lanes a fleet may never staff on its own: the human keeps irreversible
 // calls. Mirrors the autoland denied lanes.
 const DENIED_TAGS = ['billing', 'money', 'payments', 'deploy', 'security', 'customer', 'external', 'feedback'];
 
-// The protected lane a task sits in (a denied tag on the task or its todo
-// tags), or null. The ship gate and the dispatch flight both ask this, so they
-// cannot disagree about which work a person must land.
+// The protected lane a task sits in, or null. This is the one place that
+// decides protection: staffing (isSafeLane), the ship gate, the dispatch flight
+// and the builder prompt all ask it, so a task one of them holds back as
+// protected is never one that another would merge. A task's tags are its tag,
+// its tags list, the tags `atris task tag` adds later and hashtags in its
+// title (all through taskTagTokens), plus the todo tags it was imported with.
 function protectedLaneOfTask(task) {
   if (!task || typeof task !== 'object') return null;
   const todoTags = task.metadata && Array.isArray(task.metadata.todo_tags) ? task.metadata.todo_tags : [];
-  const tags = [task.tag, ...todoTags].filter(Boolean).map((tag) => String(tag).toLowerCase());
+  const tags = [...taskTagTokens(task), ...todoTags.filter(Boolean).map((tag) => String(tag).trim().toLowerCase())];
   return tags.find((tag) => DENIED_TAGS.includes(tag)) || null;
 }
 
@@ -126,7 +135,8 @@ function shellQuote(value) {
 
 // The bounded prompt every engine gets: isolated worktree, MAP first, the
 // task's own check, one landing order per mode. Yolo: the engine lands it
-// itself with worktree ship. Otherwise: commit only, the conductor lands it.
+// itself with worktree ship, unless the task is in a protected lane. Otherwise:
+// commit only, the conductor lands it.
 function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
   const ref = task.display_id || task.id || 'TASK';
   const title = String(task.title || '').trim();
@@ -134,11 +144,27 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
   const done = titleDone || String((task.metadata && task.metadata.done_looks_like) || '').trim();
   const check = taskDispatchCheck(task, worktreePath || process.cwd());
   const shipMessage = title.split(/[.:](?:\s|$)/)[0].replace(/"/g, "'").slice(0, 90) || ref;
-  const commitRule = yolo
-    ? `Land it yourself. Commit on the current branch with a plain-English message, then run: atris worktree ship --message "${shipMessage} (${ref})" --verify ${shellQuote(check)} --merge, and report the PR URL. That ship command is the only push allowed. If it reports a conflict or a failed check, stop and report; never resolve conflicts yourself.`
-    : 'Commit on the current branch with a clear message. Do not push and do not create branches; the conductor lands your commit.';
+  // A protected-lane task is never shipped by its builder, yolo or not. The
+  // builder commits and stops, and the dispatch flight ships that commit once,
+  // without --merge, so a pull request opens and a person lands it. A builder
+  // that shipped too would open the pull request before the flight's own
+  // check, and if the flight's check or ship then failed, the claim would be
+  // released with that pull request open and unrecorded. Yolo still gives the
+  // builder its network for running checks.
+  const lane = yolo ? protectedLaneOfTask(task) : null;
+  let commitRule;
+  if (lane) {
+    commitRule = `This task is in the protected ${lane} lane, so a person lands it, not you. Commit on the current branch with a plain-English message. Do not push, do not run \`atris worktree ship\`, and do not create branches; the conductor ships your commit for a person to review.`;
+  } else if (yolo) {
+    commitRule = `Land it yourself. Commit on the current branch with a plain-English message, then run: atris worktree ship --message "${shipMessage} (${ref})" --verify ${shellQuote(check)} --merge, and report the PR URL. That ship command is the only push allowed. If it reports a conflict or a failed check, stop and report; never resolve conflicts yourself.`;
+  } else {
+    commitRule = 'Commit on the current branch with a clear message. Do not push and do not create branches; the conductor lands your commit.';
+  }
+  // The guard refuses a checkout that has edits in it, so it can only pass at
+  // the start. A builder that re-ran it in its review step, after its edits,
+  // took the failure as a stop order and left finished work uncommitted.
   const lines = [
-    'First, run `atris worktree guard`; if it fails, stop immediately, report back, and do not edit anything. Do this before any file edit.',
+    'Before your first edit, run `atris worktree guard` once; if it fails then, stop immediately, report back, and do not edit anything. It checks for a clean start, so it fails once edits exist: never run it again after editing.',
     '',
     ATRIS_BUILD_PROCESS_PREAMBLE,
     '',
@@ -162,7 +188,7 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
     `- ${commitRule}`,
     ...METHOD_KERNEL.map((rule) => `- ${rule}`),
     '',
-    `Final report (plain text): files changed, check command + result, commit sha${yolo ? ', PR URL' : ''} (or say what failed and why).`
+    `Final report (plain text): files changed, check command + result, commit sha${yolo && !lane ? ', PR URL' : ''} (or say what failed and why).`
   );
   const lessonFiles = [
     ...(Array.isArray(task.files) ? task.files : []),
@@ -1358,20 +1384,6 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
 // ---------------------------------------------------------------------------
 // T2: staffing
 
-const {
-  taskTagTokens,
-  isDecisionHoldTag,
-  isDecisionTask,
-  DECISION_REFUSE_REASON,
-} = require('./task-decision');
-
-function taskTags(task) {
-  // Tags added after creation live in metadata.tags (`atris task tag`); a
-  // fleet that only read task.tags/title hashtags would ignore an owner-hold
-  // flag stamped on a live task and keep restaffing it (CLI-879).
-  return taskTagTokens(task);
-}
-
 // A task flagged for a human decision is never fleet-staffable, whatever its
 // lane. Mirrors the sweep's needs-human hold so both loops agree. Also honors
 // the clearer `decision` tag so policy questions stay off autonomous lanes.
@@ -1379,10 +1391,10 @@ function isHumanHoldTag(tag) {
   return isDecisionHoldTag(tag);
 }
 
+// The fleet may staff a task only when no person has to decide it and it sits
+// in no protected lane. Protection is protectedLaneOfTask's call alone.
 function isSafeLane(task) {
-  if (isDecisionTask(task)) return false;
-  const tags = taskTags(task);
-  return !tags.some((t) => DENIED_TAGS.includes(t));
+  return !isDecisionTask(task) && !protectedLaneOfTask(task);
 }
 
 // Rough file-surface guess from a task's text: paths and bare `commands/x.js`
@@ -1713,12 +1725,10 @@ module.exports = {
   assertIsolatedWorktree,
   buildEngineCommand,
   isSafeLane,
-  taskTags,
   nextInstalledFleetEngine,
   rankFleetEnginesDetailed,
   dispatchToEngine,
   recordDispatchOutcome,
-  taskTags,
   isHumanHoldTag,
   isDecisionTask,
   DECISION_REFUSE_REASON,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.74.28",
+  "version": "3.74.29",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",