lastlight 0.1.15 → 0.2.1

package/dist/workflows/runner.js

@@ -1,87 +1,13 @@
-import { randomUUID } from "crypto";
-import { execSync } from "child_process";
-import { readFileSync } from "fs";
-import { join, resolve } from "path";
-import { executeAgent } from "../engine/executor.js";
-import { resolveModel } from "../config.js";
-import { listRunningContainers } from "../admin/docker.js";
+import { resolveModel, resolveVariant } from "../config.js";
 import { loadPromptTemplate } from "./loader.js";
 import { renderTemplate } from "./templates.js";
-import { evalUntilExpression } from "./loop-eval.js";
 import { buildDag, getReadyNodes, getNodesToSkip, isComplete } from "./dag.js";
-/**
- * Load a skill's SKILL.md instructions from skills/<name>/SKILL.md, falling
- * back to .claude/skills/<name>/SKILL.md if the project-local copy isn't
- * present (matches the legacy executeSkill lookup order).
- */
-function loadSkillInstructions(skillName) {
-    for (const base of [resolve("skills"), resolve(".claude/skills")]) {
-        try {
-            return readFileSync(join(base, skillName, "SKILL.md"), "utf-8");
-        }
-        catch {
-            /* try next path */
-        }
-    }
-    throw new Error(`Skill not found: skills/${skillName}/SKILL.md`);
-}
-/**
- * Build the agent prompt for a phase, handling both `prompt:` (template file)
- * and `skill:` (SKILL.md reference) phase definitions.
- *
- * Skill phases produce the same prompt shape the legacy executeSkill used:
- *     "Follow these skill instructions:\n\n<SKILL.md>\n\nContext:\n<key: value lines>"
- * Template variables ({{owner}}, {{issueNumber}}, etc.) are still rendered in
- * the SKILL.md content so skills can reference workflow context if they want.
- */
-function buildPhasePrompt(phase, ctx, extraCtx) {
-    const fullCtx = extraCtx ? { ...ctx, ...extraCtx } : ctx;
-    if (phase.skill) {
-        const skillContent = loadSkillInstructions(phase.skill);
-        const renderedSkill = renderTemplate(skillContent, fullCtx);
-        // Build a context block from the workflow context — same shape that the
-        // legacy executeSkill produced, so existing skill instructions still work.
-        const contextLines = Object.entries(fullCtx)
-            .filter(([, v]) => v !== undefined && v !== null)
-            .map(([k, v]) => `${k}: ${typeof v === "object" ? JSON.stringify(v) : v}`)
-            .join("\n");
-        return `Follow these skill instructions:\n\n${renderedSkill}\n\nContext:\n${contextLines}`;
-    }
-    if (phase.prompt) {
-        const template = loadPromptTemplate(phase.prompt);
-        return renderTemplate(template, fullCtx);
-    }
-    throw new Error(`Phase "${phase.name}" has neither prompt: nor skill: — cannot build prompt`);
-}
-// ── Phase-level deduplication ────────────────────────────────────────────────
-/**
- * Check if a sandbox container is actually running for a given taskId prefix.
- */
-async function isContainerAlive(taskId) {
-    try {
-        const containers = await listRunningContainers();
-        return containers.some((c) => c.taskId === taskId);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Check if an error was caused by manual termination.
- */
-export function isTerminated(error) {
-    if (!error)
-        return false;
-    const lower = error.toLowerCase();
-    return (lower.includes("terminated") ||
-        lower.includes("killed") ||
-        lower.includes("exit undefined") ||
-        (lower.includes("container") && lower.includes("not running")));
-}
-function pickResult(r) {
-    return { success: r.success, output: r.output, error: r.error };
-}
-function gitAccessProfileForWorkflow(workflowName) {
+import { qaImageAvailable, SANDBOX_IMAGE_QA } from "../sandbox/images.js";
+import { PhaseExecutor, isTerminated, } from "./phase-executor.js";
+import { collapseDetail } from "../notify/render.js";
+// `isTerminated` used to live here; re-exported for API stability.
+export { isTerminated };
+export function gitAccessProfileForWorkflow(workflowName) {
     switch (workflowName) {
         case "build":
         case "pr-fix":
@@ -90,159 +16,58 @@ function gitAccessProfileForWorkflow(workflowName) {
             return "review-write";
         case "issue-triage":
         case "issue-comment":
+        case "pr-comment":
         case "explore":
+        case "answer":
+        case "security-review":
+        // verify / qa-test / demo read the repo and post a findings/demo comment —
+        // they never push code, so issues-write (contents:read + issues:write) is
+        // enough.
+        case "verify":
+        case "qa-test":
+        case "demo":
             return "issues-write";
+        case "security-feedback":
+            return "repo-write";
         default:
             return "read";
     }
 }
-function gitSandboxAccessForWorkflow(workflowName, owner, repo) {
+export function gitSandboxAccessForWorkflow(workflowName, owner, repo, prePopulateBranch, runId) {
     const profile = gitAccessProfileForWorkflow(workflowName);
     return {
         owner,
         repo,
         profile,
-        // Only high-trust code-writing workflows get sandbox-side app-key access.
-        allowMcpAppAuth: profile === "repo-write",
-    };
-}
-/**
- * Run a single agent phase with DB-tracked deduplication.
- */
-async function runPhase(workflowName, phaseName, taskId, triggerId, prompt, config, db, modelOverride, workflowRunId, githubAccess) {
-    const dedupKey = `${workflowName}:${phaseName}`;
-    if (db) {
-        const status = db.shouldRunPhase(dedupKey, triggerId, workflowRunId);
-        if (status === "running") {
-            const alive = await isContainerAlive(taskId);
-            if (alive) {
-                console.log(`[runner] Phase ${phaseName} is already running (container alive) — skipping`);
-                return { skipped: true, reason: "running" };
-            }
-            console.log(`[runner] Phase ${phaseName} was running but container is dead — cleaning up`);
-            db.markStaleAsFailed(dedupKey, triggerId, workflowRunId);
-        }
-        else if (status === "done") {
-            console.log(`[runner] Phase ${phaseName} already completed successfully — skipping`);
-            return { skipped: true, reason: "done" };
-        }
-        const executionId = randomUUID();
-        db.recordStart({
-            id: executionId,
-            triggerType: "webhook",
-            triggerId,
-            skill: dedupKey,
-            repo: undefined,
-            issueNumber: undefined,
-            startedAt: new Date().toISOString(),
-            workflowRunId,
-        });
-        const phaseConfig = modelOverride ? { ...config, model: modelOverride } : config;
-        const result = await executeAgent(prompt, phaseConfig, {
-            taskId,
-            githubAccess,
-            // Persist the session id as soon as it arrives so the dashboard can
-            // show live agent logs for an in-flight phase, not just completed ones.
-            onSessionId: (sessionId) => {
-                try {
-                    db.recordSessionId(executionId, sessionId);
-                }
-                catch (err) {
-                    console.warn(`[runner] Failed to persist session id mid-run for ${phaseName}:`, err);
-                }
-            },
-        });
-        db.recordFinish(executionId, {
-            success: result.success,
-            error: result.error,
-            turns: result.turns,
-            durationMs: result.durationMs,
-            sessionId: result.sessionId,
-            costUsd: result.costUsd,
-            inputTokens: result.inputTokens,
-            cacheCreationInputTokens: result.cacheCreationInputTokens,
-            cacheReadInputTokens: result.cacheReadInputTokens,
-            outputTokens: result.outputTokens,
-            apiDurationMs: result.apiDurationMs,
-            stopReason: result.stopReason,
-        });
-        return { result, skipped: false };
-    }
-    const phaseConfig = modelOverride ? { ...config, model: modelOverride } : config;
-    const result = await executeAgent(prompt, phaseConfig, { taskId, githubAccess });
-    return { result, skipped: false };
-}
-// ── Resume logic ─────────────────────────────────────────────────────────────
-/**
- * Resolve a recorded phase name to its index in `definition.phases`.
- * Handles the generated iteration labels the runner writes for looping phases:
- *
- *   `${phase}_iter_${n}` — generic_loop iteration
- *   `${phase}_fix_${n}`  — reviewer-style loop fix cycle
- *   `${phase}_${n}`      — reviewer-style loop re-review cycle
- *
- * Returns -1 when the name doesn't match any phase (unknown/untracked labels
- * like `waiting_approval` or user set_phase values such as `complete`).
- */
-export function phaseIndexInDefinition(definition, name) {
-    const exact = definition.phases.findIndex((p) => p.name === name);
-    if (exact >= 0)
-        return exact;
-    const tryStrip = (re) => {
-        const m = name.match(re);
-        if (!m)
-            return -1;
-        return definition.phases.findIndex((p) => p.name === m[1]);
+        // Never forward the App PEM into sandboxes. The harness already mints a
+        // profile-scoped token and forwards it as GITHUB_TOKEN, so the agent gets
+        // github tools in static-token mode without the App private key ever
+        // entering the sandbox.
+        allowMcpAppAuth: false,
+        prePopulateBranch,
+        runId,
+        // Read-only workflows never need git history — clone at --depth 1. Only
+        // the code-pushing profiles (build / pr-fix / security-feedback) keep the
+        // deeper clone for rebase/amend headroom.
+        shallow: profile !== "repo-write",
     };
-    const iterIdx = tryStrip(/^(.*)_iter_\d+$/);
-    if (iterIdx >= 0)
-        return iterIdx;
-    const fixIdx = tryStrip(/^(.*)_fix_\d+$/);
-    if (fixIdx >= 0)
-        return fixIdx;
-    const cycleIdx = tryStrip(/^(.*)_\d+$/);
-    if (cycleIdx >= 0)
-        return cycleIdx;
-    return -1;
-}
-/**
- * Given the phase the runner last completed, return the name of the phase the
- * runner should run next. Returns `null` when there is no next phase (i.e. the
- * workflow is done).
- */
-export function nextPhaseAfter(definition, completedPhase) {
-    const idx = phaseIndexInDefinition(definition, completedPhase);
-    if (idx < 0 || idx >= definition.phases.length - 1)
-        return null;
-    return definition.phases[idx + 1].name;
-}
-/**
- * Find the phase that owns an approval gate with the given name — either via
- * `phase.approval_gate` or `phase.loop.approval_gate`. Returns `null` when no
- * phase declares that gate. Gate names should be unique within a workflow.
- */
-function findGateOwningPhase(definition, gateName) {
-    for (const p of definition.phases) {
-        if (p.approval_gate === gateName)
-            return p.name;
-        if (p.loop?.approval_gate === gateName)
-            return p.name;
-    }
-    return null;
-}
-// ── Main workflow runner ─────────────────────────────────────────────────────
-/** Returns true if any phase declares explicit dependencies — triggers DAG execution path. */
-function hasDependencies(definition) {
-    return definition.phases.some((p) => p.depends_on && p.depends_on.length > 0);
 }
+// ── Unified workflow scheduler ───────────────────────────────────────────────
 /**
  * Run an agent workflow defined by a YAML definition.
- * Interprets phases, approval gates, and loops generically — the runner has
- * no knowledge of specific phase names.
+ *
+ * Every workflow executes as a DAG: workflows that declare no `depends_on`
+ * are run as a synthesized chain (each phase depends on the one before it),
+ * reproducing the old linear semantics including the failure cascade. Ready
+ * nodes are executed **one at a time in declaration order** (sequential).
+ * Each node's body — context / standard agent / reviewer-loop / generic-loop,
+ * plus approval and reply gates — lives in {@link PhaseExecutor}; the
+ * scheduler here owns the DAG, the `phases[]`/`outputs{}` accumulation, and
+ * the in-memory node status.
  */
-export async function runWorkflow(definition, ctx, config, callbacks, db, models, approvalConfig, workflowId) {
+export async function runWorkflow(definition, ctx, config, callbacks, db, models, approvalConfig, workflowId, variants) {
     const phases = [];
-    const phaseOutputs = {};
+    const outputs = {};
     const { taskId } = ctx;
     // Slack-originated runs carry an explicit `slack:` trigger id — everything
     // else (GitHub webhook, CLI) uses the legacy owner/repo#N shape.
@@ -252,25 +77,73 @@ export async function runWorkflow(definition, ctx, config, callbacks, db, models
     // iteration at the right index and templates can read {{scratch.*}}.
     const scratch = ctx.scratch
         ? { ...ctx.scratch }
-        : (db && workflowId ? { ...(db.getWorkflowRun(workflowId)?.scratch ?? {}) } : {});
+        : (db && workflowId ? { ...(db.runs.getRun(workflowId)?.scratch ?? {}) } : {});
     ctx.scratch = scratch;
-    const githubAccess = gitSandboxAccessForWorkflow(definition.name, ctx.owner, ctx.repo);
+    const prePopulateBranch = typeof ctx.prePopulateBranch === "string"
+        ? ctx.prePopulateBranch
+        : undefined;
+    const githubAccess = gitSandboxAccessForWorkflow(definition.name, ctx.owner, ctx.repo, prePopulateBranch, workflowId);
     const notify = callbacks.postComment || (async () => { });
+    const reporter = callbacks.reporter;
     const onStart = callbacks.onPhaseStart || (async () => { });
     const onEnd = callbacks.onPhaseEnd || (async () => { });
+    // Terminal step key — dynamic loop steps (re-review / fix cycles) are
+    // inserted just above it so the checklist reads top-to-bottom in run order.
+    const lastPhaseKey = [...definition.phases]
+        .reverse()
+        .find((p) => (p.type ?? "agent") !== "context")?.name;
     const modelFor = (taskType) => models ? resolveModel(models, taskType) : undefined;
-    /** Render a prompt template with current context. */
+    const variantFor = (taskType) => variants ? resolveVariant(variants, taskType) : undefined;
+    /** Render a prompt template with current context + outputs. */
     const renderPrompt = (promptPath, extraCtx) => {
         const template = loadPromptTemplate(promptPath);
-        return renderTemplate(template, { ...ctx, phaseOutputs, ...(extraCtx || {}) });
+        return renderTemplate(template, { ...ctx, phaseOutputs: outputs, ...(extraCtx || {}) });
     };
-    /** Render a YAML-provided message template and post it as a comment. */
+    /**
+     * Render a YAML message template and post it as a *standalone* message.
+     * Routes through `reporter.note()` when the in-place checklist is active,
+     * else the legacy `postComment`.
+     */
     const notifyMessage = async (template, extraCtx) => {
         if (!template)
             return;
-        const rendered = renderTemplate(template, { ...ctx, phaseOutputs, ...(extraCtx || {}) });
-        if (rendered.trim())
+        const rendered = renderTemplate(template, { ...ctx, phaseOutputs: outputs, ...(extraCtx || {}) });
+        if (!rendered.trim())
+            return;
+        if (reporter)
+            await reporter.note(rendered);
+        else
+            await notify(rendered);
+    };
+    /** Post a pre-rendered standalone message (already-built string). */
+    const postNote = async (text) => {
+        if (!text.trim())
+            return;
+        if (reporter)
+            await reporter.note(text);
+        else
+            await notify(text);
+    };
+    /** Transition a checklist step (and optionally render a YAML message detail). */
+    const reportStep = async (key, status, template, extraCtx, opts) => {
+        const rendered = template
+            ? renderTemplate(template, { ...ctx, phaseOutputs: outputs, ...(extraCtx || {}) }).trim()
+            : "";
+        if (reporter) {
+            const detail = collapseDetail(rendered);
+            if (opts?.insert) {
+                const step = { key, label: opts.label ?? key, status, detail };
+                await reporter.insertStep(step, opts.insertBefore ?? lastPhaseKey);
+            }
+            else {
+                await reporter.step(key, status, detail);
+            }
+            if (opts?.alsoNote && rendered)
+                await reporter.note(rendered);
+        }
+        else if (rendered) {
             await notify(rendered);
+        }
     };
     /** Persist a phase transition to the DB workflow run. */
     const persistPhase = (phase, summary) => {
@@ -281,758 +154,207 @@ export async function runWorkflow(definition, ctx, config, callbacks, db, models
                 success: true,
                 summary,
             };
-            db.updateWorkflowPhase(workflowId, phase, entry);
+            db.runs.appendPhase(workflowId, phase, entry);
         }
     };
     /** Mark the workflow run as failed. */
     const failWorkflow = (errorMsg) => {
         if (db && workflowId) {
-            db.finishWorkflowRun(workflowId, "failed", errorMsg);
+            db.runs.finishRun(workflowId, "failed", { error: errorMsg });
         }
     };
-    // Determine resume point from the DB row's currentPhase. If the row doesn't
-    // exist (no DB), default to running everything from the first phase.
-    let resumeFromIdx = 0;
-    if (db && workflowId) {
-        const run = db.getWorkflowRun(workflowId);
-        if (run?.currentPhase) {
-            const next = nextPhaseAfter(definition, run.currentPhase);
-            if (next) {
-                const idx = phaseIndexInDefinition(definition, next);
-                if (idx >= 0)
-                    resumeFromIdx = idx;
-            }
-        }
-    }
-    const shouldRun = (phaseName) => {
-        const idx = phaseIndexInDefinition(definition, phaseName);
-        // Unknown phases always run — they're not tracked in the definition order.
-        if (idx === -1)
-            return true;
-        return idx >= resumeFromIdx;
-    };
     /** Should an approval gate with this name actually pause the workflow? */
     const gateEnabled = (gateName) => !!gateName && approvalConfig?.[gateName] === true;
-    // ── Execute phases ────────────────────────────────────────────────────────
-    if (hasDependencies(definition)) {
-        return runDagWorkflow(definition, ctx, config, callbacks, db, models, approvalConfig, workflowId, { phases, phaseOutputs, triggerId, notify, notifyMessage, onStart, onEnd, modelFor, renderPrompt, persistPhase, failWorkflow, gateEnabled, githubAccess });
-    }
-    for (const phase of definition.phases) {
-        const { name: phaseName, type: phaseType = "agent" } = phase;
-        // Linear workflows share one sandbox workspace across phases via `taskId`.
-        // (DAG path uses phase-scoped taskIds to avoid concurrent write races.)
-        // ── Context-only phase (no agent execution) ───────────────────────────
-        if (phaseType === "context") {
-            if (shouldRun(phaseName)) {
-                await onStart(phaseName);
-                phases.push({ phase: phaseName, success: true, output: "Context assembled" });
-                // Persist a phase_history entry so the dashboard pipeline marks
-                // context phases as 'done' instead of leaving them stuck on
-                // 'pending' — they have no execution row to derive status from.
-                persistPhase(phaseName, "Context assembled");
-                await onEnd(phaseName, phases[phases.length - 1]);
+    // ── Collaborators ───────────────────────────────────────────────────────────
+    const runScope = {
+        definition,
+        ctx,
+        config,
+        taskId,
+        triggerId,
+        githubAccess,
+        scratch,
+        db,
+        workflowId,
+    };
+    const phaseReporter = {
+        onStart,
+        onEnd,
+        step: reportStep,
+        message: notifyMessage,
+        postNote,
+        persistPhase,
+        failWorkflow,
+    };
+    const phaseResolver = {
+        modelFor,
+        variantFor,
+        renderPrompt,
+        gateEnabled,
+    };
+    const executor = new PhaseExecutor(runScope, phaseReporter, phaseResolver);
+    // ── Schedule ─────────────────────────────────────────────────────────────────
+    const dag = buildDag(definition.phases, { chainIfNoDeps: true });
+    // Phase lookup + the backend this run is actually executing on. Used by the
+    // `requires_sandbox` gate below — config.sandbox is undefined when no backend
+    // override is set, which resolves to gondolin (see agent-executor).
+    const phaseByName = new Map(definition.phases.map((p) => [p.name, p]));
+    const activeBackend = config.sandbox ?? "gondolin";
+    while (!isComplete(dag)) {
+        // Honour a cancel that landed during the previous phase's execution.
+        if (db && workflowId) {
+            const latest = db.runs.getRun(workflowId);
+            if (latest?.status === "cancelled") {
+                console.log(`[runner] ${definition.name} cancelled — stopping`);
+                return { success: false, phases };
             }
-            continue;
         }
-        // ── Agent phase ───────────────────────────────────────────────────────
-        if (!phase.prompt && !phase.skill) {
-            console.warn(`[runner] Phase "${phaseName}" has type=agent but neither prompt: nor skill: — skipping`);
-            continue;
+        // Skip nodes whose trigger rule fails (deps terminal, rule unsatisfied).
+        // This is how a failure cascades to the end of a chain as skips. Skips are
+        // recorded in the executions ledger — the single source of truth the
+        // dashboard derives phase status from.
+        const toSkip = getNodesToSkip(dag);
+        for (const node of toSkip) {
+            node.status = "skipped";
+            phases.push({ phase: node.name, success: true, output: "Skipped (trigger rule not satisfied)" });
+            db?.executions.recordSkippedPhase(`${definition.name}:${node.name}`, triggerId, workflowId, githubAccess.repo);
+            await reportStep(node.name, "skipped");
         }
-        // Check if this is a looping phase (e.g. reviewer)
-        if (phase.loop) {
-            const loop = phase.loop;
-            const MAX_CYCLES = loop.max_cycles;
-            let approved = false;
-            let fixCycles = 0;
-            if (!shouldRun(phaseName)) {
-                // The phase was already completed — mark as approved and continue to next phase
-                approved = true;
-                phases.push({ phase: phaseName, success: true, output: "Already completed" });
-            }
-            while (!approved && fixCycles <= MAX_CYCLES) {
-                const reviewLabel = fixCycles === 0 ? phaseName : `${phaseName}_${fixCycles + 1}`;
-                if (!shouldRun(phaseName) && fixCycles === 0) {
-                    approved = true;
-                    break;
-                }
-                await onStart(reviewLabel);
-                await notifyMessage(loop.messages?.on_cycle_start, { cycle: fixCycles + 1, maxCycles: MAX_CYCLES });
-                // Choose prompt: first cycle uses phase.prompt or phase.skill (via
-                // buildPhasePrompt), subsequent cycles always use the re_review_prompt
-                // template path defined in loop.on_request_changes.
-                const reviewPrompt = fixCycles === 0
-                    ? buildPhasePrompt(phase, { ...ctx, phaseOutputs }, { fixCycle: fixCycles })
-                    : renderPrompt(loop.on_request_changes.re_review_prompt, { fixCycle: fixCycles });
-                // Resolve model
-                const reviewModelRaw = phase.model ? renderTemplate(phase.model, ctx) : undefined;
-                const reviewModel = reviewModelRaw || modelFor(phaseName);
-                const rr = await runPhase(definition.name, reviewLabel, taskId, triggerId, reviewPrompt, config, db, reviewModel, workflowId, githubAccess);
-                if (rr.skipped) {
-                    if (rr.reason === "running") {
-                        await notifyMessage(phase.messages?.on_skipped_done);
-                        return { success: false, phases };
-                    }
-                    approved = true;
-                    phases.push({ phase: reviewLabel, success: true, output: "Already completed" });
-                    break;
-                }
-                phases.push({ phase: reviewLabel, ...pickResult(rr.result) });
-                await onEnd(reviewLabel, phases[phases.length - 1]);
-                // Parse verdict
-                const reviewerOutput = (rr.result.output || "").trim();
-                const verdictMarker = reviewerOutput.match(/^\s*VERDICT:\s*(APPROVED|REQUEST_CHANGES)\s*$/im);
-                let isApproved;
-                if (verdictMarker) {
-                    isApproved = verdictMarker[1].toUpperCase() === "APPROVED";
-                }
-                else {
-                    const upper = reviewerOutput.toUpperCase();
-                    const hasRequestChanges = /\bREQUEST_CHANGES\b/.test(upper);
-                    isApproved = !hasRequestChanges && /^APPROVED\b/.test(upper);
-                    console.warn(`[runner] Reviewer output missing VERDICT: marker — using fallback detection (isApproved=${isApproved})`);
-                }
-                if (isApproved) {
-                    approved = true;
-                    persistPhase(reviewLabel, "APPROVED");
-                    await notifyMessage(loop.messages?.on_approved, { cycle: fixCycles + 1 });
-                }
-                else if (fixCycles < MAX_CYCLES) {
-                    fixCycles++;
-                    persistPhase(reviewLabel, "REQUEST_CHANGES");
-                    // Approval gate before fix loop
-                    const gateKey = loop.approval_gate;
-                    if (gateEnabled(gateKey) && db && workflowId) {
-                        const approvalId = randomUUID();
-                        db.createApproval({
-                            id: approvalId,
-                            workflowRunId: workflowId,
-                            gate: gateKey,
-                            summary: `Reviewer requested changes (cycle ${fixCycles}/${MAX_CYCLES}) on phase ${phaseName}.`,
-                            requestedBy: ctx.sender,
-                            createdAt: new Date().toISOString(),
-                        });
-                        db.updateWorkflowPhase(workflowId, "waiting_approval", {
-                            phase: "waiting_approval",
-                            timestamp: new Date().toISOString(),
-                            success: true,
-                            summary: `Waiting for approval: ${gateKey} (${approvalId})`,
-                        });
-                        db.pauseWorkflowRun(workflowId);
-                        await notifyMessage(loop.messages?.on_pause_for_approval, {
-                            cycle: fixCycles,
-                            maxCycles: MAX_CYCLES,
-                            gateKey,
-                        });
-                        return { success: true, phases, paused: true };
-                    }
-                    await notifyMessage(loop.messages?.on_request_changes, { cycle: fixCycles, maxCycles: MAX_CYCLES });
-                    // Run fix phase
-                    const fixLabel = `${phaseName}_fix_${fixCycles}`;
-                    await onStart(fixLabel);
-                    await notifyMessage(loop.messages?.on_fix_start, { cycle: fixCycles, maxCycles: MAX_CYCLES });
-                    const fixModelRaw = loop.on_request_changes.fix_model
-                        ? renderTemplate(loop.on_request_changes.fix_model, ctx)
-                        : undefined;
-                    const fixModel = fixModelRaw || modelFor(`${phaseName}_fix`) || modelFor(phaseName);
-                    const fixPromptRendered = renderPrompt(loop.on_request_changes.fix_prompt, {
-                        fixCycle: fixCycles,
-                    });
-                    const fr = await runPhase(definition.name, fixLabel, taskId, triggerId, fixPromptRendered, config, db, fixModel, workflowId, githubAccess);
-                    if (fr.skipped) {
-                        if (fr.reason === "running") {
-                            await notifyMessage(phase.messages?.on_skipped_done);
-                            return { success: false, phases };
-                        }
-                        phases.push({ phase: fixLabel, success: true, output: "Already completed" });
-                    }
-                    else {
-                        phases.push({ phase: fixLabel, ...pickResult(fr.result) });
-                        await onEnd(fixLabel, phases[phases.length - 1]);
-                        if (!fr.result.success) {
-                            if (!isTerminated(fr.result.error)) {
-                                await notifyMessage(loop.messages?.on_fix_failed, { cycle: fixCycles, maxCycles: MAX_CYCLES });
-                            }
-                            break;
-                        }
-                        persistPhase(fixLabel);
-                    }
-                }
-                else {
-                    persistPhase(reviewLabel, "REQUEST_CHANGES — max cycles reached");
-                    await notifyMessage(loop.messages?.on_max_cycles, { cycle: fixCycles, maxCycles: MAX_CYCLES });
-                    break;
-                }
+        const ready = getReadyNodes(dag);
+        // Capability gate: skip any ready node whose declared capability isn't
+        // available on this host. Safe-by-default graceful degradation — a gated
+        // phase (e.g. the browser-QA step that needs the docker image) silently
+        // no-ops instead of failing the workflow. Two reasons trigger a skip:
+        //   1. `requires_sandbox` names a backend other than the one running.
+        //   2. `sandbox_image: qa` but the browser-QA image isn't built here (only
+        //      checked on docker — on other backends the field is inert).
+        // Uses the same non-failing skip mechanics as the trigger-rule skip above,
+        // plus the phase's `on_skipped_done` message so the user sees why.
+        const gatedSkip = [];
+        for (const node of ready) {
+            const phaseDef = phaseByName.get(node.name);
+            const req = phaseDef?.requires_sandbox;
+            if (req !== undefined && req !== activeBackend) {
+                gatedSkip.push({ node, reason: `requires ${req} sandbox; running ${activeBackend}` });
             }
-            // Expose loop outcome as a structured phase output so downstream phases
-            // can read {{phaseName.approved}} / {{phaseName.cycles}} in their prompts.
-            if (phase.output_var) {
-                phaseOutputs[phase.output_var] = { approved, cycles: fixCycles };
+            else if (phaseDef?.sandbox_image === "qa" &&
+                activeBackend === "docker" &&
+                !qaImageAvailable()) {
+                gatedSkip.push({ node, reason: `requires the ${SANDBOX_IMAGE_QA} image, not built on this host` });
             }
-            continue;
         }
-        // ── Generic loop phase ────────────────────────────────────────────────
-        if (phase.generic_loop) {
-            const loop = phase.generic_loop;
-            const MAX_ITER = loop.max_iterations;
-            const MAX_PREV_OUTPUT_BYTES = 10 * 1024; // cap accumulated output at 10KB
-            if (!shouldRun(phaseName)) {
-                phases.push({ phase: phaseName, success: true, output: "Already completed" });
-                continue;
-            }
-            // Reply-gate loops resume mid-flight: read the saved iteration out
-            // of scratch[scratch_key] so we pick up at N+1 instead of 1 and
-            // don't re-run iterations whose dedup rows are already "done".
-            const scratchKey = loop.scratch_key;
-            const scratchSlot = (scratchKey
-                ? scratch[scratchKey] ?? {}
-                : {});
-            const resumeFromIter = loop.gate_kind === "reply" && typeof scratchSlot.iteration === "number"
-                ? Math.min(scratchSlot.iteration, MAX_ITER)
-                : 0;
-            let iteration = resumeFromIter;
-            let complete = false;
-            let previousOutput = scratchSlot.lastOutput ?? "";
-            while (!complete && iteration < MAX_ITER) {
-                iteration++;
-                const iterLabel = `${phaseName}_iter_${iteration}`;
-                await onStart(iterLabel);
-                // Build prompt with loop context vars
-                const iterCtx = {
-                    iteration,
-                    maxIterations: MAX_ITER,
-                    previousOutput: loop.fresh_context ? "" : previousOutput,
-                    phaseOutputs,
-                    scratch,
-                };
-                const prompt = buildPhasePrompt(phase, ctx, iterCtx);
-                const modelRaw = phase.model ? renderTemplate(phase.model, ctx) : undefined;
-                const model = modelRaw || modelFor(phaseName);
-                const ir = await runPhase(definition.name, iterLabel, taskId, triggerId, prompt, config, db, model, workflowId, githubAccess);
-                if (ir.skipped) {
-                    if (ir.reason === "running") {
-                        await notifyMessage(phase.messages?.on_skipped_done, { iteration });
-                        return { success: false, phases };
-                    }
-                    // Already done — treat as complete
-                    phases.push({ phase: iterLabel, success: true, output: "Already completed" });
-                    complete = true;
-                    break;
-                }
-                phases.push({ phase: iterLabel, ...pickResult(ir.result) });
-                await onEnd(iterLabel, phases[phases.length - 1]);
-                if (!ir.result.success) {
-                    if (!isTerminated(ir.result.error)) {
-                        await notifyMessage(phase.messages?.on_failure, { iteration });
-                    }
-                    failWorkflow(ir.result.error);
-                    return { success: false, phases };
-                }
-                const iterOutput = ir.result.output || "";
-                // Accumulate previousOutput (cap at MAX_PREV_OUTPUT_BYTES)
-                if (!loop.fresh_context) {
-                    const combined = previousOutput ? `${previousOutput}\n${iterOutput}` : iterOutput;
-                    previousOutput = combined.length > MAX_PREV_OUTPUT_BYTES
-                        ? combined.slice(-MAX_PREV_OUTPUT_BYTES)
-                        : combined;
-                }
-                // Evaluate until expression
-                let conditionMet = false;
-                if (loop.until) {
-                    conditionMet = evalUntilExpression(loop.until, {
-                        output: iterOutput,
-                        scratch,
-                        ...Object.fromEntries(Object.entries(ctx)
-                            .filter(([, v]) => typeof v === "string")
-                            .map(([k, v]) => [k, v])),
-                    });
-                }
-                // Evaluate until_bash
-                if (!conditionMet && loop.until_bash) {
-                    try {
-                        execSync(loop.until_bash, { timeout: 30_000, stdio: "pipe", cwd: config.sandboxDir ?? config.cwd });
-                        conditionMet = true; // exit 0
-                    }
-                    catch {
-                        conditionMet = false; // non-zero exit
-                    }
-                }
-                if (conditionMet) {
-                    complete = true;
-                    if (scratchKey && db && workflowId) {
-                        db.updateWorkflowRunScratch(workflowId, {
-                            [scratchKey]: { ...scratchSlot, iteration, ready: true, lastOutput: iterOutput },
-                        });
-                        scratch[scratchKey] = {
-                            ...scratch[scratchKey],
-                            iteration,
-                            ready: true,
-                            lastOutput: iterOutput,
-                        };
-                    }
-                    persistPhase(iterLabel, `iteration ${iteration} — condition met`);
-                    break;
-                }
-                // Interactive gate between iterations
-                if (loop.interactive && !complete && db && workflowId) {
-                    const isReply = loop.gate_kind === "reply";
-                    const gateMsg = loop.gate_message
-                        ? renderTemplate(loop.gate_message, { ...ctx, phaseOutputs, iteration, maxIterations: MAX_ITER, scratch })
-                        : `Loop iteration ${iteration}/${MAX_ITER} complete.`;
-                    // Persist iteration + last output into scratch BEFORE pausing so
-                    // the resume path can pick up at N+1 instead of re-running from 1.
-                    if (scratchKey) {
-                        const slot = {
-                            ...scratch[scratchKey],
-                            iteration,
-                            lastOutput: iterOutput,
-                        };
-                        scratch[scratchKey] = slot;
-                        db.updateWorkflowRunScratch(workflowId, { [scratchKey]: slot });
-                    }
-                    const approvalId = randomUUID();
-                    db.createApproval({
-                        id: approvalId,
-                        workflowRunId: workflowId,
-                        gate: `${phaseName}_iter_${iteration}`,
-                        summary: gateMsg,
-                        kind: isReply ? "reply" : "approve",
-                        requestedBy: ctx.sender,
-                        createdAt: new Date().toISOString(),
-                    });
-                    db.updateWorkflowPhase(workflowId, "waiting_approval", {
-                        phase: "waiting_approval",
-                        timestamp: new Date().toISOString(),
-                        success: true,
-                        summary: `Waiting for ${isReply ? "reply" : "approval"}: ${phaseName}_iter_${iteration} (${approvalId})`,
-                    });
-                    db.pauseWorkflowRun(workflowId);
-                    if (isReply) {
-                        // Combine the agent's questions + gate hint into one message
-                        // so it reads as a single comment on GitHub / Slack.
-                        const parts = [iterOutput.trim(), gateMsg.trim()].filter(Boolean);
-                        if (parts.length > 0)
-                            await notify(parts.join("\n\n---\n\n"));
-                    }
-                    else {
-                        await notify(`**${phaseName} iteration ${iteration}/${MAX_ITER} complete** — approval required to continue.\n\n` +
-                            `${gateMsg}\n\n` +
-                            `**To continue:** comment \`@last-light approve\`\n` +
-                            `**To abort:** comment \`@last-light reject [reason]\``);
-                    }
-                    return { success: true, phases, paused: true };
-                }
-                persistPhase(iterLabel);
-            }
-            if (!complete) {
-                await notifyMessage(phase.messages?.on_failure, {
-                    iteration,
-                    maxIterations: MAX_ITER,
+        if (gatedSkip.length > 0) {
+            for (const { node, reason } of gatedSkip) {
+                node.status = "skipped";
+                const phaseDef = phaseByName.get(node.name);
+                phases.push({
+                    phase: node.name,
+                    success: true,
+                    output: `Skipped (${reason})`,
                 });
+                db?.executions.recordSkippedPhase(`${definition.name}:${node.name}`, triggerId, workflowId, githubAccess.repo);
+                await reportStep(node.name, "skipped", phaseDef?.messages?.on_skipped_done);
             }
-            if (phase.output_var) {
-                phaseOutputs[phase.output_var] = { completed: complete, iterations: iteration };
-            }
-            continue;
+            continue; // re-evaluate the DAG with these nodes now terminal
         }
-        // ── Standard (non-looping) agent phase ───────────────────────────────
-        if (!shouldRun(phaseName))
+        if (ready.length === 0) {
+            if (toSkip.length === 0)
+                break; // stuck (shouldn't happen in a valid DAG)
+            continue; // only had skips — loop to process downstream
+        }
+        // Sequential: run the earliest-declared ready node, one at a time.
+        // Resume is ledger-driven: a completed phase's `runPhase` call returns
+        // skipped:done via `shouldRunPhase`, so re-running from the top is safe.
+        const node = ready[0];
+        node.status = "running";
+        let outcome;
+        try {
+            outcome = await executor.execute(node, outputs);
+        }
+        catch (err) {
+            // An agent call threw (OOM / unexpected). Mark the node failed so the
+            // failure cascades to downstream skips, mirroring a normal failure.
+            console.error(`[runner] Phase "${node.name}" threw unexpectedly:`, err);
+            phases.push({ phase: node.name, success: false, error: String(err), output: "" });
+            node.status = "failed";
             continue;
-        await onStart(phaseName);
-        await notifyMessage(phase.messages?.on_start);
-        // Resolve model
-        const modelRaw = phase.model ? renderTemplate(phase.model, ctx) : undefined;
-        const model = modelRaw || modelFor(phaseName);
-        const prompt = buildPhasePrompt(phase, ctx, { phaseOutputs });
-        const pr = await runPhase(definition.name, phaseName, taskId, triggerId, prompt, config, db, model, workflowId, githubAccess);
-        if (pr.skipped) {
-            if (pr.reason === "running") {
-                await notifyMessage(phase.messages?.on_skipped_done);
-                return { success: false, phases };
-            }
-            phases.push({ phase: phaseName, success: true, output: "Already completed" });
-            // Persist a phase_history entry even when the phase was deduped, so
-            // the dashboard's pipeline view shows the phase as 'done' instead of
-            // stuck on 'active'/pending. Without this the run looks half-finished
-            // even though it succeeded.
-            persistPhase(phaseName, "Already completed (deduplicated)");
-            await onEnd(phaseName, { phase: phaseName, success: true, output: "Already completed" });
-            await notifyMessage(phase.messages?.on_skipped_done);
         }
-        else {
-            phases.push({ phase: phaseName, ...pickResult(pr.result) });
-            await onEnd(phaseName, phases[phases.length - 1]);
-            // Record phase output (raw string) for downstream ${phaseName.output}
-            // substitution and, when phase.output_var is set, under the aliased key
-            // so prompts can read {{aliased}} / ${aliased.output} / {{aliased.field}}.
-            const rawOutput = pr.result.output ?? "";
-            phaseOutputs[phaseName] = rawOutput;
-            if (phase.output_var) {
-                phaseOutputs[phase.output_var] = rawOutput;
-            }
-            if (!pr.result.success) {
-                if (!isTerminated(pr.result.error)) {
-                    await notifyMessage(phase.messages?.on_failure);
-                }
-                failWorkflow(pr.result.error);
-                return { success: false, phases };
-            }
-            // Check on_output rules
-            if (phase.on_output) {
-                const outputUpper = (pr.result.output?.toUpperCase() || "");
-                if (phase.on_output.contains_BLOCKED && outputUpper.includes("BLOCKED")) {
-                    const rule = phase.on_output.contains_BLOCKED;
-                    const hasUnlessLabel = rule.unless_label && ctx.issueLabels.includes(rule.unless_label);
-                    const titleMatches = !!rule.unless_title_matches &&
-                        new RegExp(rule.unless_title_matches, "i").test(ctx.issueTitle || "");
-                    if (hasUnlessLabel || titleMatches) {
-                        // Rule bypassed — fall through to phase success path.
-                        await notifyMessage(rule.bypass_message || phase.messages?.on_blocked_bypassed);
-                    }
-                    else if (rule.action === "fail") {
-                        db?.markLatestAsFailed(`${definition.name}:${phaseName}`, triggerId, rule.message || "BLOCKED", workflowId);
-                        failWorkflow(rule.message || "BLOCKED");
-                        const blockedTemplate = rule.message || phase.messages?.on_blocked;
-                        if (blockedTemplate) {
-                            await notifyMessage(blockedTemplate);
-                        }
-                        return { success: false, phases };
-                    }
-                }
-            }
-            // Approval gate
-            if (phase.approval_gate && gateEnabled(phase.approval_gate) && db && workflowId) {
-                const gateKey = phase.approval_gate;
-                const approvalId = randomUUID();
-                db.createApproval({
-                    id: approvalId,
-                    workflowRunId: workflowId,
-                    gate: gateKey,
-                    summary: `${phaseName} complete — awaiting ${gateKey} approval.`,
-                    requestedBy: ctx.sender,
-                    createdAt: new Date().toISOString(),
-                });
-                db.updateWorkflowPhase(workflowId, "waiting_approval", {
-                    phase: "waiting_approval",
-                    timestamp: new Date().toISOString(),
-                    success: true,
-                    summary: `Waiting for approval: ${gateKey} (${approvalId})`,
-                });
-                db.pauseWorkflowRun(workflowId);
-                await notifyMessage(phase.approval_gate_message, { gateKey });
-                return { success: true, phases, paused: true };
-            }
-            persistPhase(phaseName);
-            await notifyMessage(phase.messages?.on_success);
+        for (const r of outcome.results)
+            phases.push(r);
+        if (outcome.outputVars)
+            Object.assign(outputs, outcome.outputVars);
+        if (outcome.aborted) {
+            // Dedup running-skip — another instance owns this phase. Stop without
+            // cascading skips; this isn't a phase failure.
+            return { success: false, phases };
         }
+        if (outcome.paused) {
+            return { success: true, phases, paused: true };
+        }
+        node.status = outcome.status;
     }
     // ── Workflow wrap-up ──────────────────────────────────────────────────────
     //
     // If the definition declares an `on_success.set_phase` terminal marker on any
-    // phase, record it so the DB row shows the workflow as fully complete. We
-    // also try to extract a PR number from the terminal phase's output so
-    // callers can surface it — purely opportunistic, no hardcoded phase names.
+    // phase, record it so the DB row shows the workflow as fully complete. Also
+    // opportunistically extract a PR number from the terminal phase's output.
     const anyFailed = phases.some((p) => !p.success);
     const success = !anyFailed;
     let prNumber;
+    let prUrl;
     const terminalPhase = [...definition.phases].reverse().find((p) => p.on_success?.set_phase);
     if (terminalPhase) {
         const terminalResult = phases.find((p) => p.phase === terminalPhase.name);
         const prMatch = terminalResult?.output?.match(/#(\d+)/);
         if (prMatch)
             prNumber = parseInt(prMatch[1], 10);
-        if (success && terminalPhase.on_success?.set_phase) {
-            persistPhase(terminalPhase.on_success.set_phase, prNumber ? `PR #${prNumber}` : undefined);
-        }
+        const urlMatch = terminalResult?.output?.match(/https?:\/\/[^\s)]+\/pull\/\d+/);
+        if (urlMatch)
+            prUrl = urlMatch[0];
     }
     if (success) {
         if (db && workflowId) {
-            db.finishWorkflowRun(workflowId, "succeeded");
+            // Fold the `on_success.set_phase` terminal marker into the same
+            // transaction as the status flip so the dashboard never sees one
+            // without the other.
+            const terminalMarker = terminalPhase?.on_success?.set_phase
+                ? { phase: terminalPhase.on_success.set_phase, summary: prNumber ? `PR #${prNumber}` : undefined }
+                : undefined;
+            db.runs.finishRun(workflowId, "succeeded", terminalMarker ? { terminalMarker } : {});
         }
     }
     else {
         const firstFailure = phases.find((p) => !p.success);
         failWorkflow(firstFailure?.error || "workflow failed");
     }
-    return { success, phases, prNumber };
-}
-/**
- * DAG-based workflow execution. Called when any phase declares `depends_on`.
- * Runs independent phases concurrently via Promise.allSettled.
- */
-async function runDagWorkflow(definition, ctx, config, callbacks, db, models, approvalConfig, workflowId, runnerCtx) {
-    const { phases, phaseOutputs: outputs, triggerId, githubAccess, notifyMessage, onStart, onEnd, modelFor, renderPrompt, persistPhase, failWorkflow, gateEnabled, } = runnerCtx;
-    const { taskId } = ctx;
-    const dag = buildDag(definition.phases);
-    const phaseMap = new Map(definition.phases.map((p) => [p.name, p]));
-    /**
-     * Execute a single standard agent phase (no loop). Returns PhaseResult and
-     * whether the workflow should pause (approval gate).
-     */
-    async function executeSinglePhase(phase, phaseName) {
-        await notifyMessage(phase.messages?.on_start);
-        const phaseCtx = { phaseOutputs: { ...outputs } };
-        const prompt = buildPhasePrompt(phase, ctx, phaseCtx);
-        const modelRaw = phase.model ? renderTemplate(phase.model, ctx) : undefined;
-        const model = modelRaw || modelFor(phaseName);
-        const pr = await runPhase(definition.name, phaseName, `${taskId}-${phaseName}`, triggerId, prompt, config, db, model, workflowId, githubAccess);
-        if (pr.skipped) {
-            return { result: { phase: phaseName, success: true, output: "Already completed" } };
-        }
-        const result = { phase: phaseName, ...pickResult(pr.result) };
-        if (!pr.result.success) {
-            await notifyMessage(phase.messages?.on_failure);
-            return { result };
-        }
-        // Check on_output rules
-        if (phase.on_output?.contains_BLOCKED && (pr.result.output?.toUpperCase() || "").includes("BLOCKED")) {
-            const rule = phase.on_output.contains_BLOCKED;
-            const hasUnlessLabel = rule.unless_label && ctx.issueLabels.includes(rule.unless_label);
-            const titleMatches = !!rule.unless_title_matches &&
-                new RegExp(rule.unless_title_matches, "i").test(ctx.issueTitle || "");
-            if (hasUnlessLabel || titleMatches) {
-                await notifyMessage(rule.bypass_message || phase.messages?.on_blocked_bypassed);
-            }
-            else if (rule.action === "fail") {
-                db?.markLatestAsFailed(`${definition.name}:${phaseName}`, triggerId, rule.message || "BLOCKED", workflowId);
-                failWorkflow(rule.message || "BLOCKED");
-                await notifyMessage(rule.message || phase.messages?.on_blocked);
-                return { result: { phase: phaseName, success: false, output: pr.result.output ?? "", error: "BLOCKED" } };
-            }
+    // Single final update: render the workflow's `final_message` against the
+    // accumulated outputs and deliver it once — folded into the checklist comment
+    // as its footer when the in-place reporter is active, else posted as one
+    // standalone comment. Empty render ⇒ no-op (e.g. the synthesizing phase was
+    // skipped). This is what lets verify/qa-test end with a single combined
+    // verdict instead of a comment per phase.
+    if (success && definition.final_message) {
+        const finalRendered = renderTemplate(definition.final_message, {
+            ...ctx,
+            phaseOutputs: outputs,
+        }).trim();
+        if (finalRendered) {
+            if (reporter)
+                await reporter.footer(finalRendered);
+            else
+                await notify(finalRendered);
         }
-        // Approval gate
-        if (phase.approval_gate && gateEnabled(phase.approval_gate) && db && workflowId) {
-            const gateKey = phase.approval_gate;
-            const approvalId = randomUUID();
-            db.createApproval({
-                id: approvalId,
-                workflowRunId: workflowId,
-                gate: gateKey,
-                summary: `${phaseName} complete — awaiting ${gateKey} approval.`,
-                requestedBy: ctx.sender,
-                createdAt: new Date().toISOString(),
-            });
-            db.updateWorkflowPhase(workflowId, "waiting_approval", {
-                phase: "waiting_approval",
-                timestamp: new Date().toISOString(),
-                success: true,
-                summary: `Waiting for approval: ${gateKey} (${approvalId})`,
-            });
-            db.pauseWorkflowRun(workflowId);
-            await notifyMessage(phase.approval_gate_message, { gateKey });
-            return { result, paused: true };
-        }
-        persistPhase(phaseName);
-        await notifyMessage(phase.messages?.on_success);
-        return { result };
     }
-    // ── Main DAG execution loop ────────────────────────────────────────────────
-    while (!isComplete(dag)) {
-        // First, mark nodes that should be skipped (trigger rule fails but deps are terminal)
-        const toSkip = getNodesToSkip(dag);
-        for (const node of toSkip) {
-            node.status = "skipped";
-            phases.push({ phase: node.name, success: true, output: "Skipped (trigger rule not satisfied)" });
-            if (db && workflowId) {
-                db.updateNodeStatus(workflowId, node.name, "skipped");
-            }
-        }
-        const ready = getReadyNodes(dag);
-        if (ready.length === 0) {
-            if (toSkip.length === 0)
-                break; // stuck (shouldn't happen in a valid DAG)
-            continue; // only had skips — loop to process downstream
-        }
-        // Mark all ready nodes as running before dispatching
-        for (const node of ready) {
-            node.status = "running";
-            if (db && workflowId) {
-                db.updateNodeStatus(workflowId, node.name, "running");
-            }
-        }
-        // Dispatch all ready nodes concurrently
-        const nodePromises = ready.map(async (node) => {
-            try {
-                const phase = phaseMap.get(node.name);
-                await onStart(node.name);
-                // Context phase — immediate
-                if (phase.type === "context" || !phase.type) {
-                    const r = { phase: node.name, success: true, output: "Context assembled" };
-                    // Same persist-history fix as the linear runner so the dashboard
-                    // marks context nodes done.
-                    persistPhase(node.name, "Context assembled");
-                    await onEnd(node.name, r);
-                    return { node, result: r, paused: false, alreadyPushed: false };
-                }
-                // Phase with neither prompt nor skill — skip
-                if (!phase.prompt && !phase.skill) {
-                    console.warn(`[dag] Phase "${node.name}" has type=agent but neither prompt: nor skill: — skipping`);
-                    const r = { phase: node.name, success: true, output: "Skipped (no prompt or skill)" };
-                    return { node, result: r, paused: false, alreadyPushed: false };
-                }
-                // Loop phase (reviewer-style) — run sequentially as a single DAG node
-                if (phase.loop) {
-                    const loop = phase.loop;
-                    const MAX_CYCLES = loop.max_cycles;
-                    let approved = false;
-                    let fixCycles = 0;
-                    while (!approved && fixCycles <= MAX_CYCLES) {
-                        const reviewLabel = fixCycles === 0 ? node.name : `${node.name}_${fixCycles + 1}`;
-                        const reviewPrompt = fixCycles === 0
-                            ? buildPhasePrompt(phase, ctx, { phaseOutputs: { ...outputs }, fixCycle: fixCycles })
-                            : renderPrompt(loop.on_request_changes.re_review_prompt, { phaseOutputs: { ...outputs }, fixCycle: fixCycles });
-                        const reviewModelRaw = phase.model ? renderTemplate(phase.model, ctx) : undefined;
-                        const reviewModel = reviewModelRaw || modelFor(node.name);
-                        const rr = await runPhase(definition.name, reviewLabel, `${taskId}-${reviewLabel}`, triggerId, reviewPrompt, config, db, reviewModel, workflowId, githubAccess);
-                        if (rr.skipped) {
-                            approved = true;
-                            phases.push({ phase: reviewLabel, success: true, output: "Already completed" });
-                            break;
-                        }
-                        phases.push({ phase: reviewLabel, ...pickResult(rr.result) });
-                        await onEnd(reviewLabel, phases[phases.length - 1]);
-                        const reviewerOutput = (rr.result.output || "").trim();
-                        const verdictMarker = reviewerOutput.match(/^\s*VERDICT:\s*(APPROVED|REQUEST_CHANGES)\s*$/im);
-                        const isApproved = verdictMarker
-                            ? verdictMarker[1].toUpperCase() === "APPROVED"
-                            : !(/\bREQUEST_CHANGES\b/.test(reviewerOutput.toUpperCase())) && /^APPROVED\b/.test(reviewerOutput.toUpperCase());
-                        if (isApproved) {
-                            approved = true;
-                        }
-                        else if (fixCycles < MAX_CYCLES) {
-                            fixCycles++;
-                            const fixLabel = `${node.name}_fix_${fixCycles}`;
-                            const fixPromptRendered = renderPrompt(loop.on_request_changes.fix_prompt, { phaseOutputs: { ...outputs }, fixCycle: fixCycles });
-                            const fixModelRaw = loop.on_request_changes.fix_model ? renderTemplate(loop.on_request_changes.fix_model, ctx) : undefined;
-                            const fixModel = fixModelRaw || modelFor(`${node.name}_fix`) || modelFor(node.name);
-                            const fr = await runPhase(definition.name, fixLabel, `${taskId}-fix${fixCycles}`, triggerId, fixPromptRendered, config, db, fixModel, workflowId, githubAccess);
-                            if (!fr.skipped) {
-                                phases.push({ phase: fixLabel, ...pickResult(fr.result) });
-                                await onEnd(fixLabel, phases[phases.length - 1]);
-                            }
-                        }
-                        else {
-                            break;
-                        }
-                    }
-                    const loopResult = { phase: node.name, success: approved, output: approved ? "Approved" : "Request changes" };
-                    if (phase.output_var) {
-                        outputs[phase.output_var] = { approved, cycles: fixCycles };
-                    }
-                    return { node, result: loopResult, paused: false, alreadyPushed: true };
-                }
-                // Generic loop phase
-                if (phase.generic_loop) {
-                    const loop = phase.generic_loop;
-                    const MAX_ITER = loop.max_iterations;
-                    const MAX_PREV_OUTPUT_BYTES = 10 * 1024;
-                    let iteration = 0;
-                    let complete = false;
-                    let previousOutput = "";
-                    while (!complete && iteration < MAX_ITER) {
-                        iteration++;
-                        const iterLabel = `${node.name}_iter_${iteration}`;
-                        const iterCtx = {
-                            iteration,
-                            maxIterations: MAX_ITER,
-                            previousOutput: loop.fresh_context ? "" : previousOutput,
-                            phaseOutputs: { ...outputs },
-                        };
-                        const iterPrompt = buildPhasePrompt(phase, ctx, iterCtx);
-                        const modelRaw = phase.model ? renderTemplate(phase.model, ctx) : undefined;
-                        const model = modelRaw || modelFor(node.name);
-                        const ir = await runPhase(definition.name, iterLabel, `${taskId}-${iterLabel}`, triggerId, iterPrompt, config, db, model, workflowId, githubAccess);
-                        if (ir.skipped) {
-                            complete = true;
-                            break;
-                        }
-                        phases.push({ phase: iterLabel, ...pickResult(ir.result) });
-                        await onEnd(iterLabel, phases[phases.length - 1]);
-                        if (!ir.result.success) {
-                            failWorkflow(ir.result.error);
-                            return { node, result: { phase: node.name, success: false, output: "", error: ir.result.error }, paused: false, alreadyPushed: true };
-                        }
-                        const iterOutput = ir.result.output || "";
-                        if (!loop.fresh_context) {
-                            const combined = previousOutput ? `${previousOutput}\n${iterOutput}` : iterOutput;
-                            previousOutput = combined.length > MAX_PREV_OUTPUT_BYTES ? combined.slice(-MAX_PREV_OUTPUT_BYTES) : combined;
-                        }
-                        let conditionMet = false;
-                        if (loop.until) {
-                            conditionMet = evalUntilExpression(loop.until, { output: iterOutput, ...Object.fromEntries(Object.entries(ctx).filter(([, v]) => typeof v === "string").map(([k, v]) => [k, v])) });
-                        }
-                        if (!conditionMet && loop.until_bash) {
-                            try {
-                                execSync(loop.until_bash, { timeout: 30_000, stdio: "pipe", cwd: config.sandboxDir ?? config.cwd });
-                                conditionMet = true;
-                            }
-                            catch {
-                                conditionMet = false;
-                            }
-                        }
-                        if (conditionMet) {
-                            complete = true;
-                        }
-                    }
-                    if (!complete) {
-                        await notifyMessage(phase.messages?.on_failure, { iteration, maxIterations: MAX_ITER });
-                    }
-                    if (phase.output_var) {
-                        outputs[phase.output_var] = { completed: complete, iterations: iteration };
-                    }
-                    return { node, result: { phase: node.name, success: true, output: previousOutput || "" }, paused: false, alreadyPushed: true };
-                }
-                // Standard agent phase
-                const { result, paused } = await executeSinglePhase(phase, node.name);
-                await onEnd(node.name, result);
-                return { node, result, paused: paused ?? false, alreadyPushed: false };
-            }
-            catch (err) {
-                console.error(`[dag] Phase "${node.name}" threw unexpectedly:`, err);
-                const result = { phase: node.name, success: false, error: String(err), output: "" };
-                return { node, result, paused: false, alreadyPushed: false };
-            }
-        });
-        const settled = await Promise.allSettled(nodePromises);
-        let anyPaused = false;
-        for (const settledItem of settled) {
-            if (settledItem.status === "rejected") {
-                console.error("[dag] Phase promise rejected:", settledItem.reason);
-                continue;
-            }
-            const { node, result, paused, alreadyPushed } = settledItem.value;
-            if (!alreadyPushed) {
-                phases.push(result);
-            }
-            if (paused) {
-                anyPaused = true;
-                node.status = "succeeded"; // treat paused as succeeded so downstream trigger rules fire correctly — the workflow will resume from this node's successors after approval
-                continue;
-            }
-            node.status = result.success ? "succeeded" : "failed";
-            if (db && workflowId) {
-                db.updateNodeStatus(workflowId, node.name, node.status);
-            }
-            // Always record the raw phase output (both by phase name and any
-            // configured output_var alias) so downstream prompts can interpolate via
-            // ${phaseName.output} or {{alias}}. Loop phases that emit structured
-            // objects set their output_var themselves above — don't clobber those.
-            const phaseDef = phaseMap.get(node.name);
-            if (result.output != null) {
-                if (outputs[node.name] === undefined || typeof outputs[node.name] === "string") {
-                    outputs[node.name] = result.output;
-                }
-                if (phaseDef.output_var && outputs[phaseDef.output_var] === undefined) {
-                    outputs[phaseDef.output_var] = result.output;
-                }
-            }
-        }
-        if (anyPaused) {
-            return { success: true, phases, paused: true };
+    if (reporter) {
+        if (success && prNumber && terminalPhase) {
+            const link = prUrl ? `[PR #${prNumber}](${prUrl})` : `PR #${prNumber}`;
+            await reporter.step(terminalPhase.name, "done", link);
         }
+        const prSuffix = prNumber ? ` — PR #${prNumber}` : "";
+        await reporter.noteTerminal(success
+            ? `✅ **${definition.name} complete**${prSuffix}.`
+            : `❌ **${definition.name} failed** — see the checklist above for the failing step.`);
     }
-    // Determine overall success
-    const anyFailed = phases.some((p) => !p.success);
-    return { success: !anyFailed, phases };
+    return { success, phases, prNumber };
 }
 //# sourceMappingURL=runner.js.map