claude-code-session-manager 0.35.2 → 0.35.4

package/plugins/session-manager-dev/skills/my-feedback/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: my-feedback
 description: >-
-  File a feedback/enhancement request FROM the current project INTO another
+  File a feedback or enhancement request FROM the current project INTO another
   project's inbound feedback folder, following that project's own README
   convention. The cross-project complement of /process-feedback (which works the
   *current* project's inbox). Use whenever the user says "/my-feedback to X",
@@ -38,17 +38,25 @@ The invocation is `/my-feedback to <<project>>` (or "send feedback to
   <project>`."* Then list candidate sibling projects that have an intake folder:
   ```bash
   for d in ~/Projects/*/; do
-    [ -d "$d/feedback" ] && echo "  - $(basename "$d")  (feedback/)"
-    [ -d "$d/external-feedback" ] && echo "  - $(basename "$d")  (external-feedback/)"
+    [ -d "$d/session-manager-operations/feedback" ] && echo "  - $(basename "$d")  (session-manager-operations/feedback/)"
   done
   ```
   and stop.
-- Resolve the path: `~/Projects/<project>/feedback/` (some projects
-  use `external-feedback/` — check both). Fuzzy-match a near miss to a real
-  directory, but confirm the resolved name before writing.
-- **If the target has no feedback/external-feedback folder, STOP.** Don't invent
-  one — say the project doesn't accept feedback this way and ask how to proceed
-  (it may take requests via issues, a different folder, or not at all).
+- Resolve the path: `~/Projects/<project>/session-manager-operations/feedback/`.
+  This is the **one** canonical folder name — do not accept or invent variants
+  (`external-feedback/`, `feedback-inbox/`, a root-level `feedback` folder, etc.) even
+  if a near-miss directory exists; a stray differently-named folder is drift,
+  not a valid convention (burrow's `external-feedback/` existed for ~2.5 weeks
+  from exactly this mistake before being merged back into `feedback` on
+  2026-07-10 — don't recreate it, in burrow or anywhere else). Fuzzy-match a
+  near miss only to confirm it's actually named
+  `session-manager-operations/feedback/`, not to accept a differently-named
+  folder as equivalent. All session-manager per-project operations live under
+  `session-manager-operations/`.
+- **If the target has no `session-manager-operations/feedback/` folder, STOP.**
+  Don't invent one under any name — say the project doesn't accept feedback
+  this way and ask how to proceed (it may take requests via issues, a
+  different folder, or not at all).
 
 ## 1. Read the target's README FIRST — it is the authority
 
@@ -57,9 +65,9 @@ unique per project** (file-naming scheme, required sections, the status-log
 table, the closing ritual). Read it before writing anything:
 
 ```bash
-cat ~/Projects/<project>/feedback/README.md
-ls  ~/Projects/<project>/feedback/                # open items + numbering
-ls  ~/Projects/<project>/feedback/processed/ 2>/dev/null   # closed examples to match
+cat ~/Projects/<project>/session-manager-operations/feedback/README.md
+ls  ~/Projects/<project>/session-manager-operations/feedback/                # open items + numbering
+ls  ~/Projects/<project>/session-manager-operations/feedback/processed/ 2>/dev/null   # closed examples to match
 ```
 
 Read one **processed** example end-to-end to copy the house format exactly — the

package/plugins/session-manager-dev/skills/optimize-kpi/SKILL.md

@@ -62,8 +62,9 @@ files it points to:
   all, that itself is a finding — recommend adding it.
 - **The levers** — the files the section names as the knobs (tiers/config,
   selection, throughput/cadence/registry, etc.).
-- **The feedback intake** — `feedback/` (or `external-feedback/`) at the repo
-  root, and its `README.md` convention.
+- **The feedback intake** — `session-manager-operations/feedback/` at the repo
+  root (the one canonical name — do not treat a differently-named folder as
+  equivalent), and its `README.md` convention.
 
 **If CLAUDE.md declares no North-Star KPI section, STOP** and tell the user this
 project hasn't declared one — the KPI belongs in CLAUDE.md's mission statement
@@ -227,7 +228,7 @@ Give it the 3 temp files **and** the Step-2 in-flight/cooldown set. It must:
   failure mode this rule exists to prevent.
 - **Write ONE consolidated feedback item** (for the this-project-owned half) into
   this project's intake folder, named by the folder README's convention
-  (`feedback/<YYYY-MM-DD>-NN-kpi-optimization.md`, next free `NN`), with: title,
+  (`session-manager-operations/feedback/<YYYY-MM-DD>-NN-kpi-optimization.md`, next free `NN`), with: title,
   **From:** `optimize-kpi loop`, date (PT), priority + why, **TL;DR**, **Evidence**
   (cite the Step-1 scorecard numbers, the **Step-1b usage+log findings** the root
   cause rests on, *and* the Step-2 prior-lever grade), **Why it matters**

package/plugins/session-manager-dev/skills/process-feedback/SKILL.md

@@ -8,8 +8,9 @@ description: >-
   execution from there), and fold lessons back into the folder's README so
   future feedback (written by other agents/projects) gets better. Use whenever the user says "/process-feedback",
   "review the feedback folder", "work through the feedback", "any open
-  feedback?", or drops new files into feedback/. Keywords: feedback, intake,
-  external-feedback, cross-project requests, process feedback, triage feedback.
+  feedback?", or drops new files into session-manager-operations/feedback/.
+  Keywords: feedback, intake, cross-project requests, process feedback, triage
+  feedback.
 model: opus
 ---
 
@@ -21,11 +22,18 @@ an interactive human prompt. It evaluates inbound feedback, dispatches the codea
 RESOLUTION, archive). It does **not** implement, and it does **not** re-specify how PRDs are
 tracked — that lives once, in `/develop` Phase 2.
 
-Work the project's intra-project feedback intake (`feedback/` at the repo root;
-some projects name it `external-feedback/`). Each file is a request from an
-upstream/downstream service in the same stack (e.g. Burrow ⇄ signal-builder ⇄
-social-signals-trader). The folder's own `README.md` is the authority on file
-conventions — read it first; the steps below are the process.
+Work the project's intra-project feedback intake
+(`session-manager-operations/feedback/` at the repo root — this is the **one**
+canonical name; do not create or treat a differently-named folder like
+`external-feedback/` as equivalent, even for cross-service requests — that
+split caused ~2.5 weeks of drifted duplicate tracking in burrow before being
+merged back on 2026-07-10). Each file is a request from an upstream/downstream
+service in the same stack (e.g. Burrow ⇄ signal-builder ⇄ social-signals-trader)
+— cross-service origin does not mean a different folder, it's still just
+`session-manager-operations/feedback/`. The folder's own `README.md` is the
+authority on file conventions — read it first; the steps below are the
+process. All session-manager per-project operations live under
+`session-manager-operations/`.
 
 **Core principle:** this skill *triages and dispatches*; it does not implement.
 Anything that requires writing code for this project is decomposed and queued as
@@ -51,14 +59,27 @@ prevent.
 
 ## Steps
 
+### 0a. Self-migrate a legacy root-level folder first
+
+Before anything else, check for the pre-migration layout: if a legacy
+`feedback` folder exists at the repo root **and**
+`session-manager-operations/feedback/` does not, relocate it now —
+`mkdir -p session-manager-operations` (if needed), then
+`git mv feedback session-manager-operations/feedback` when the repo is
+git-tracked, else a plain `mv`. This converges any project this skill runs in
+to the new layout even if its bulk-relocation PRD hasn't landed yet. Only then
+continue with step 0.
+
 ### 0. Quick-exit — bail in milliseconds if there's nothing to do
 
 **Do this first, cheaply, before reading any code or spawning anything.** This
 skill is run on a schedule across many projects (the scheduler's feedback sweep),
 so the empty case must cost almost nothing:
 
-- If neither `feedback/` nor `external-feedback/` exists → report
-  "no feedback intake in `<project>`" and **EXIT**.
+- If `session-manager-operations/feedback/` doesn't exist (after the step-0a
+  self-migration check) → report "no feedback intake in `<project>`" and
+  **EXIT**. (Don't check for or fall back to an `external-feedback/`-style
+  variant — `session-manager-operations/feedback/` is the only canonical name.)
 - If the folder exists but holds **no open item** (every file is in `processed/`
   or marked ✅/archived; nothing open/🆕) → report "no open feedback in
   `<project>`" and **EXIT immediately**. Do NOT read source, evaluate, or start
@@ -69,7 +90,7 @@ so the empty case must cost almost nothing:
 
 ### 1. Read the intake
 
-- Read `feedback/README.md` (conventions + the status log), then every open/🆕
+- Read `session-manager-operations/feedback/README.md` (conventions + the status log), then every open/🆕
   file still in the inbox. Under this contract a **🛠 (queued) item has already
   been archived to `processed/`** at disposition time — so anything still sitting
   in the inbox is genuinely un-dispositioned and needs a pass. You will not find
@@ -90,7 +111,7 @@ drifted. Then classify each ask:
   RESOLUTION with the reason; never silently skip. Resolved now (no code) →
   close immediately in step 4.
 - **Theirs, forward** — the root cause lives in another service. Do NOT reach
-  across the boundary to hack around it; file a feedback/PRD item in *that*
+  across the boundary to hack around it; file a feedback or PRD item in *that*
   project's intake folder and reference it (use `/my-feedback to <project>`).
   Resolved now (no code in *this* repo) → close immediately in step 4.
 
@@ -122,7 +143,7 @@ Record the emitted PRD filenames/ids — you need them for steps 4–6.
 ### 4. Disposition + archive every item now — this is the definition of done
 
 Every open item gets a disposition, a `## RESOLUTION`, and a `git mv` to
-`feedback/processed/` **in this pass** — archival is at disposition time, not
+`session-manager-operations/feedback/processed/` **in this pass** — archival is at disposition time, not
 delivery time. Do NOT leave a queued item in the inbox "until its PRD lands":
 that is the drift this contract forbids. By disposition:
 

package/src/main/__tests__/adminServer.test.cjs

@@ -0,0 +1,175 @@
+/**
+ * adminServer.test.cjs — unit tests for the loopback-only scheduler admin API.
+ *
+ * Run: timeout 120 node --test src/main/__tests__/adminServer.test.cjs
+ */
+
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { createAdminServer } = require('../adminServer.cjs');
+
+function request(port, { method = 'GET', path: reqPath, token, body }) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    if (token !== undefined) headers.Authorization = `Bearer ${token}`;
+    let payload;
+    if (body !== undefined) {
+      payload = JSON.stringify(body);
+      headers['Content-Type'] = 'application/json';
+      headers['Content-Length'] = Buffer.byteLength(payload);
+    }
+    const req = http.request({ hostname: '127.0.0.1', port, method, path: reqPath, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null;
+        try { json = JSON.parse(text); } catch { /* leave null for non-JSON bodies */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+function makeFakeRemote({ jobs = [] } = {}) {
+  return {
+    async listJobs() {
+      return jobs.map((j) => ({ slug: j.slug, title: j.title, status: j.status, cwd: j.cwd }));
+    },
+    async resetJob(slug) {
+      const job = jobs.find((j) => j.slug === slug);
+      if (!job) return { ok: false, error: 'not found' };
+      job.status = 'pending';
+      job.runId = null;
+      job.startedAt = null;
+      job.finishedAt = null;
+      job.exitCode = null;
+      job.error = null;
+      delete job.runtime;
+      delete job.verifierVerdict;
+      return { ok: true, slug, status: 'pending' };
+    },
+  };
+}
+
+test('request without bearer token returns 401', async () => {
+  const remote = makeFakeRemote();
+  const admin = createAdminServer(remote);
+  const { port } = await admin.start();
+  try {
+    const res = await request(port, { path: '/admin/scheduler/jobs' });
+    assert.strictEqual(res.status, 401);
+    assert.strictEqual(res.json.ok, false);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('request with wrong bearer token returns 401', async () => {
+  const remote = makeFakeRemote();
+  const admin = createAdminServer(remote);
+  const { port } = await admin.start();
+  try {
+    const res = await request(port, { path: '/admin/scheduler/jobs', token: 'not-the-token' });
+    assert.strictEqual(res.status, 401);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('GET /admin/scheduler/jobs with correct token returns 200 + array', async () => {
+  const remote = makeFakeRemote({
+    jobs: [{ slug: '10-foo', title: 'Foo', status: 'completed', cwd: '/tmp/foo' }],
+  });
+  const admin = createAdminServer(remote);
+  const { port, token } = await admin.start();
+  try {
+    const res = await request(port, { path: '/admin/scheduler/jobs', token });
+    assert.strictEqual(res.status, 200);
+    assert.ok(Array.isArray(res.json));
+    assert.strictEqual(res.json.length, 1);
+    assert.strictEqual(res.json[0].slug, '10-foo');
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/reset-job with unknown slug returns ok:false', async () => {
+  const remote = makeFakeRemote({ jobs: [] });
+  const admin = createAdminServer(remote);
+  const { port, token } = await admin.start();
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/reset-job', token, body: { slug: 'does-not-exist' },
+    });
+    assert.strictEqual(res.status, 200);
+    assert.strictEqual(res.json.ok, false);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/reset-job with known slug flips job to pending and clears run fields', async () => {
+  const job = {
+    slug: '10-foo',
+    title: 'Foo',
+    status: 'completed',
+    cwd: '/tmp/foo',
+    runId: 'run-1',
+    startedAt: 100,
+    finishedAt: 200,
+    exitCode: 0,
+    error: null,
+    runtime: { pid: 1234 },
+    verifierVerdict: 'PASS',
+  };
+  const remote = makeFakeRemote({ jobs: [job] });
+  const admin = createAdminServer(remote);
+  const { port, token } = await admin.start();
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/reset-job', token, body: { slug: '10-foo' },
+    });
+    assert.strictEqual(res.status, 200);
+    assert.deepStrictEqual(res.json, { ok: true, slug: '10-foo', status: 'pending' });
+    assert.strictEqual(job.status, 'pending');
+    assert.strictEqual(job.runId, null);
+    assert.strictEqual(job.startedAt, null);
+    assert.strictEqual(job.finishedAt, null);
+    assert.strictEqual(job.exitCode, null);
+    assert.strictEqual(job.error, null);
+    assert.strictEqual('runtime' in job, false);
+    assert.strictEqual('verifierVerdict' in job, false);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('unknown path/method returns 404', async () => {
+  const remote = makeFakeRemote();
+  const admin = createAdminServer(remote);
+  const { port, token } = await admin.start();
+  try {
+    const res = await request(port, { path: '/admin/scheduler/nope', token });
+    assert.strictEqual(res.status, 404);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('server binds only to 127.0.0.1', async () => {
+  const remote = makeFakeRemote();
+  const admin = createAdminServer(remote);
+  await admin.start();
+  try {
+    assert.strictEqual(admin.server.address().address, '127.0.0.1');
+  } finally {
+    await admin.stop();
+  }
+});

package/src/main/__tests__/chat-mcp-consent-notice.test.cjs

@@ -0,0 +1,137 @@
+/**
+ * chat-mcp-consent-notice.test.cjs — regression for the headless MCP-consent
+ * hang: a chat run with stdin closed can never answer an MCP server's own
+ * interactive consent flow (e.g. `/design consent`). This drives the real
+ * stdout parser with a synthetic stream-json `tool_result` denial line and
+ * asserts a `chat:run:notice` event is broadcast — informational, not a
+ * terminal event.
+ *
+ * Run: timeout 120 node --test src/main/__tests__/chat-mcp-consent-notice.test.cjs
+ */
+
+'use strict';
+
+delete process.env.SM_CHAT_CONCURRENCY;
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+function writeStub(lines) {
+  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
+  const body = lines.map((l) => `process.stdout.write(${JSON.stringify(JSON.stringify(l))} + "\\n");`).join('\n');
+  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\nprocess.exit(0);\n`, { mode: 0o755 });
+  return stubPath;
+}
+
+function isTerminal(channel) {
+  return (
+    channel === 'chat:run:complete' ||
+    channel === 'chat:run:needs-input' ||
+    channel === 'chat:run:error'
+  );
+}
+
+test('MCP consent denial in a tool_result surfaces a chat:run:notice event', async () => {
+  const stubPath = writeStub([
+    {
+      type: 'user',
+      message: {
+        content: [
+          {
+            type: 'tool_result',
+            tool_use_id: 'toolu_1',
+            is_error: true,
+            content: [
+              {
+                type: 'text',
+                text:
+                  "Claude Design: write_files The user hasn't granted this — run /design consent " +
+                  "to grant it (it can't be approved automatically in this permission mode).",
+              },
+            ],
+          },
+        ],
+      },
+    },
+    { type: 'result', subtype: 'success', result: 'done anyway' },
+  ]);
+  process.env.SM_CLAUDE_BIN = stubPath;
+  delete require.cache[require.resolve('../chatRunner.cjs')];
+  const cr = require('../chatRunner.cjs');
+
+  const events = [];
+  cr.attachWindow({
+    isDestroyed: () => false,
+    webContents: {
+      isDestroyed: () => false,
+      send: (channel, payload) => events.push({ channel, payload }),
+    },
+  });
+
+  cr.run({ tabId: 'T-notice', sessionId: 'S-notice', prompt: 'do a design thing', cwd: process.cwd(), resume: false });
+
+  for (let i = 0; i < 60 && !events.some((e) => isTerminal(e.channel)); i++) {
+    await new Promise((r) => setTimeout(r, 25));
+  }
+
+  const notice = events.find((e) => e.channel === 'chat:run:notice');
+  assert.ok(notice, 'chat:run:notice should be broadcast');
+  assert.match(notice.payload.message, /consent/i, 'message mentions consent');
+  assert.match(notice.payload.message, /terminal/i, 'message mentions the raw terminal session');
+
+  // Notice is informational, not terminal — the normal result still fires.
+  const terminal = events.filter((e) => isTerminal(e.channel));
+  assert.equal(terminal.length, 1, 'exactly one terminal event still fires');
+  assert.equal(terminal[0].channel, 'chat:run:complete');
+
+  try { fs.unlinkSync(stubPath); } catch { /* already gone */ }
+  delete process.env.SM_CLAUDE_BIN;
+});
+
+test('a normal tool_result with no consent marker does not fire chat:run:notice', async () => {
+  const stubPath = writeStub([
+    {
+      type: 'user',
+      message: {
+        content: [
+          {
+            type: 'tool_result',
+            tool_use_id: 'toolu_2',
+            is_error: false,
+            content: [{ type: 'text', text: 'Wrote 3 files successfully.' }],
+          },
+        ],
+      },
+    },
+    { type: 'result', subtype: 'success', result: 'all good' },
+  ]);
+  process.env.SM_CLAUDE_BIN = stubPath;
+  delete require.cache[require.resolve('../chatRunner.cjs')];
+  const cr = require('../chatRunner.cjs');
+
+  const events = [];
+  cr.attachWindow({
+    isDestroyed: () => false,
+    webContents: {
+      isDestroyed: () => false,
+      send: (channel, payload) => events.push({ channel, payload }),
+    },
+  });
+
+  cr.run({ tabId: 'T-clean', sessionId: 'S-clean', prompt: 'do a normal thing', cwd: process.cwd(), resume: false });
+
+  for (let i = 0; i < 60 && !events.some((e) => isTerminal(e.channel)); i++) {
+    await new Promise((r) => setTimeout(r, 25));
+  }
+
+  assert.ok(
+    !events.some((e) => e.channel === 'chat:run:notice'),
+    'no chat:run:notice should fire for a clean tool_result (no false positive)',
+  );
+
+  try { fs.unlinkSync(stubPath); } catch { /* already gone */ }
+  delete process.env.SM_CLAUDE_BIN;
+});

package/src/main/__tests__/mcpStatus.test.cjs

@@ -0,0 +1,61 @@
+/**
+ * mcpStatus.test.cjs — unit tests for the `claude mcp list` output parser.
+ *
+ * Run: timeout 120 node --test src/main/__tests__/mcpStatus.test.cjs
+ */
+
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { parseMcpList } = require('../mcpStatus.cjs');
+
+const SAMPLE = `Checking MCP server health…
+
+claude.ai Gmail: https://gmailmcp.googleapis.com/mcp/v1 - ✔ Connected
+fetch: uvx mcp-server-fetch - ✔ Connected
+n8n: bash /home/bilko/.config/n8n-mcp/run.sh - ✘ Failed to connect
+session-manager-scheduler: node scripts/scheduler-mcp-server.cjs - ⏸ Pending approval (run \`claude\` to approve)
+claude_design: https://api.anthropic.com/v1/design/mcp (HTTP) - ✔ Connected
+claude.ai Google Drive: https://drivemcp.googleapis.com/mcp/v1 - ! Needs authentication
+`;
+
+test('parses the captured claude mcp list sample', () => {
+  const servers = parseMcpList(SAMPLE);
+  assert.ok(servers.length >= 6, `expected >=6 servers, got ${servers.length}`);
+
+  const byName = Object.fromEntries(servers.map((s) => [s.name, s]));
+
+  assert.equal(byName['claude.ai Gmail'].status, 'connected');
+  assert.equal(byName['fetch'].status, 'connected');
+  assert.equal(byName['n8n'].status, 'failed');
+  assert.equal(byName['session-manager-scheduler'].status, 'pending');
+  assert.equal(byName['claude_design'].status, 'connected');
+  assert.equal(byName['claude_design'].transport, 'http');
+  assert.equal(byName['claude.ai Google Drive'].status, 'needs-auth');
+});
+
+test('ignores the header and blank lines', () => {
+  const servers = parseMcpList(SAMPLE);
+  assert.ok(!servers.some((s) => /Checking MCP server health/i.test(s.name)));
+});
+
+test('defaults transport to stdio for non-HTTP targets', () => {
+  const servers = parseMcpList(SAMPLE);
+  const byName = Object.fromEntries(servers.map((s) => [s.name, s]));
+  assert.equal(byName['n8n'].transport, 'stdio');
+  assert.equal(byName['fetch'].transport, 'stdio');
+});
+
+test('returns [] (not a throw) on empty input', () => {
+  assert.deepEqual(parseMcpList(''), []);
+});
+
+test('returns [] (not a throw) on garbage input', () => {
+  assert.deepEqual(parseMcpList('this is not\na valid mcp list output\n12345'), []);
+});
+
+test('returns [] on non-string input without throwing', () => {
+  assert.deepEqual(parseMcpList(null), []);
+  assert.deepEqual(parseMcpList(undefined), []);
+});

package/src/main/__tests__/runVerify.test.cjs

@@ -285,7 +285,7 @@ test('Truly clean run (no error markers) → clean/null', async () => {
       {
         type: 'result',
         subtype: 'success',
-        result: 'Feature complete. All acceptance criteria satisfied.',
+        result: 'Feature complete. All acceptance criteria satisfied.\nSCHEDULER_VERDICT: PASS',
       },
     ];
 
@@ -367,7 +367,7 @@ test('FAIL recovered within 30 events → clean', async () => {
       {
         type: 'result',
         subtype: 'success',
-        result: 'Fixed the failing test and verified all pass.',
+        result: 'Fixed the failing test and verified all pass.\nSCHEDULER_VERDICT: PASS',
       },
     ];
 
@@ -416,7 +416,7 @@ function bashRunEvents(content, { toolName = 'Bash', resultSubtype = 'success' }
         }],
       },
     },
-    { type: 'result', subtype: resultSubtype, result: 'All acceptance criteria verified.' },
+    { type: 'result', subtype: resultSubtype, result: 'All acceptance criteria verified.\nSCHEDULER_VERDICT: PASS' },
   ];
 }
 
@@ -568,7 +568,7 @@ test('harness tool error (<tool_use_error>) in final 20% → clean', async () =>
     events.push({ type: 'user', message: { role: 'user', content: [
       { type: 'tool_result', tool_use_id: 'tbad',
         content: '<tool_use_error>Error: No such tool available: bash</tool_use_error>', is_error: true }] } });
-    events.push({ type: 'result', subtype: 'success', result: 'All acceptance criteria verified.' });
+    events.push({ type: 'result', subtype: 'success', result: 'All acceptance criteria verified.\nSCHEDULER_VERDICT: PASS' });
 
     writeLog(tmp, slug, events);
     const prdPath = writePrd(tmp, slug, '# Correctness batch');
@@ -809,6 +809,76 @@ test('no sentinel + committed + allowPreSentinelHeal=false (default) → transcr
   }
 });
 
+// ─── no_verdict_sentinel: no commit + no sentinel is not "clean" by default ──
+
+/** A run with zero tool_result pattern hits — e.g. the agent asked a
+ *  clarifying question and stopped, ending its turn without touching tools. */
+function noOpRunEvents(resultText) {
+  return [
+    { type: 'result', subtype: 'success', result: resultText },
+  ];
+}
+
+test('no_verdict_sentinel: no tool_result issues, no sentinel, no commit → needs_review', async () => {
+  const tmp = makeTmpDir();
+  try {
+    const slug = '406-browser-capture-panel-ui';
+    writeLog(tmp, slug, noOpRunEvents('I need clarification on which capture API to target before proceeding.'));
+    const prdPath = writePrd(tmp, slug, '# Browser capture panel UI');
+    const verdict = await verifyRun({
+      runDir: tmp,
+      prdPath,
+      queueEntry: { slug, status: 'running' },
+      allJobs: [],
+      committedDuringRun: false,
+    });
+    assert.equal(verdict.verdict, 'no_verdict_sentinel', `expected no_verdict_sentinel, got ${verdict.verdict}: ${verdict.reason}`);
+    assert.equal(verdict.downgradeTo, 'needs_review');
+  } finally {
+    rmdir(tmp);
+  }
+});
+
+test('no_verdict_sentinel guard: same run but committedDuringRun:true → stays clean', async () => {
+  const tmp = makeTmpDir();
+  try {
+    const slug = '406-browser-capture-panel-ui-committed';
+    writeLog(tmp, slug, noOpRunEvents('I need clarification on which capture API to target before proceeding.'));
+    const prdPath = writePrd(tmp, slug, '# Browser capture panel UI');
+    const verdict = await verifyRun({
+      runDir: tmp,
+      prdPath,
+      queueEntry: { slug, status: 'running' },
+      allJobs: [],
+      committedDuringRun: true,
+    });
+    assert.equal(verdict.verdict, 'clean', `commit landed should stay clean, got ${verdict.verdict}: ${verdict.reason}`);
+    assert.equal(verdict.downgradeTo, null);
+  } finally {
+    rmdir(tmp);
+  }
+});
+
+test('no_verdict_sentinel guard: same run but with SCHEDULER_VERDICT: PASS sentinel → stays clean', async () => {
+  const tmp = makeTmpDir();
+  try {
+    const slug = '406-browser-capture-panel-ui-sentinel';
+    writeLog(tmp, slug, noOpRunEvents('All acceptance criteria verified.\nSCHEDULER_VERDICT: PASS'));
+    const prdPath = writePrd(tmp, slug, '# Browser capture panel UI');
+    const verdict = await verifyRun({
+      runDir: tmp,
+      prdPath,
+      queueEntry: { slug, status: 'running' },
+      allJobs: [],
+      committedDuringRun: false,
+    });
+    assert.equal(verdict.verdict, 'clean', `PASS sentinel should stay clean, got ${verdict.verdict}: ${verdict.reason}`);
+    assert.equal(verdict.downgradeTo, null);
+  } finally {
+    rmdir(tmp);
+  }
+});
+
 // (e) halt + sentinel PASS → still halt (override must not apply to halt)
 test('halt result + sentinel PASS + committedDuringRun:true → still halt', async () => {
   const tmp = makeTmpDir();