metheus-governance-mcp-cli 0.2.147 → 0.2.148

package/cli.mjs

@@ -12,6 +12,7 @@ import https from "node:https";
 import {
   DEFAULT_LOCAL_AI_CLIENT,
   analyzeHumanConversationIntentWithAI,
+  auditRoleExecutionPlanWithAI,
   auditDirectHumanReplyWithAI,
   normalizeExecutionArtifacts,
   planRoleExecutionWithAI,
@@ -3001,6 +3002,7 @@ function buildRunnerDeliveryDeps() {
 function buildRunnerExecutionDeps() {
   return {
     analyzeHumanConversationIntentWithAI,
+    auditRoleExecutionPlanWithAI,
     auditDirectHumanReplyWithAI,
     planRoleExecutionWithAI,
     normalizeRunnerRoleProfileName,

package/lib/local-ai-adapters.mjs

@@ -1513,6 +1513,7 @@ function buildRoleExecutionPlanPrompt({
   currentAssignmentTasks = [],
   contextComments = [],
   conversationMode = "",
+  planningGuardrail = null,
 }) {
   const bots = ensureArray(managedBots).map((item) => {
     const bot = safeObject(item);
@@ -1524,6 +1525,7 @@ function buildRoleExecutionPlanPrompt({
   const normalizedContext = ensureArray(contextComments)
     .slice(0, 10)
     .map((item) => formatContextCommentLine(item));
+  const guardrail = safeObject(planningGuardrail);
   return [
     "You are an execution planner for managed local Telegram bots.",
     "Read the human request and recent room context, then decide whether actual project execution is required now.",
@@ -1543,6 +1545,15 @@ function buildRoleExecutionPlanPrompt({
     "Return strict JSON only with this shape:",
     "{\"requires_execution\":true|false,\"summary_role\":\"monitor|worker|review|approval\",\"reason\":\"short explanation\",\"steps\":[{\"role\":\"monitor|worker|review|approval\",\"goal\":\"short goal\",\"artifacts_required\":true|false}]}",
     "",
+    guardrail.require_worker_step === true
+      ? "Guardrail: the final plan must include a worker step that produces or updates project artifacts now."
+      : "",
+    guardrail.reject_monitor_only_execution === true
+      ? "Guardrail: do not return a monitor-only plan for this request."
+      : "",
+    String(guardrail.reason || "").trim()
+      ? `Guardrail Reason: ${String(guardrail.reason || "").trim()}`
+      : "",
     `current_bot_username=${JSON.stringify(String(currentBotUsername || "").trim().replace(/^@+/, ""))}`,
     `current_bot_route_role=${JSON.stringify(String(currentBotRole || "").trim().toLowerCase())}`,
     `conversation_mode=${JSON.stringify(String(conversationMode || "").trim())}`,
@@ -1555,6 +1566,52 @@ function buildRoleExecutionPlanPrompt({
   ].join("\n");
 }
 
+function buildRoleExecutionPlanAuditPrompt({
+  messageText,
+  currentBotUsername,
+  currentBotRole,
+  managedBots,
+  workspaceDir,
+  currentAssignmentTasks = [],
+  contextComments = [],
+  conversationMode = "",
+  executionPlan = null,
+}) {
+  const bots = ensureArray(managedBots).map((item) => {
+    const bot = safeObject(item);
+    return {
+      username: String(bot.username || "").trim().replace(/^@+/, ""),
+      display_name: String(bot.display_name || bot.displayName || bot.username || "").trim(),
+    };
+  }).filter((item) => item.username);
+  const normalizedContext = ensureArray(contextComments)
+    .slice(0, 10)
+    .map((item) => formatContextCommentLine(item));
+  return [
+    "You are an execution plan adequacy auditor for managed local Telegram bots.",
+    "Judge by meaning, not by keywords or @mentions alone.",
+    "Decide whether the human request requires actual project execution now.",
+    "Then decide whether the proposed execution plan is sufficient to satisfy that request.",
+    "A plan that only inspects, analyzes, checks status, or says it will plan later does NOT satisfy an execution request that should produce concrete project work now.",
+    "If satisfying the request requires creating/updating/deleting project files now, then requires_worker_step must be true.",
+    "If the request is informational only, requires_execution should be false and requires_worker_step should be false.",
+    "",
+    "Return strict JSON only with this shape:",
+    "{\"requires_execution\":true|false,\"requires_worker_step\":true|false,\"plan_satisfies_request\":true|false,\"reason\":\"short explanation\"}",
+    "",
+    `current_bot_username=${JSON.stringify(String(currentBotUsername || "").trim().replace(/^@+/, ""))}`,
+    `current_bot_route_role=${JSON.stringify(String(currentBotRole || "").trim().toLowerCase())}`,
+    `conversation_mode=${JSON.stringify(String(conversationMode || "").trim())}`,
+    `workspace_dir=${JSON.stringify(String(workspaceDir || "").trim())}`,
+    `managed_bots=${JSON.stringify(bots)}`,
+    `current_assignment_tasks=${JSON.stringify(ensureArray(currentAssignmentTasks).map((item) => String(item || "").trim()).filter(Boolean))}`,
+    `human_message=${JSON.stringify(String(messageText || "").trim())}`,
+    `candidate_execution_plan=${JSON.stringify(safeObject(executionPlan))}`,
+    "recent_context=",
+    normalizedContext.length ? normalizedContext.join("\n") : "- none",
+  ].join("\n");
+}
+
 function buildDirectReplyGuardrailPrompt({
   humanMessageText,
   botReplyText,
@@ -1695,6 +1752,7 @@ export function planRoleExecutionWithAI({
   currentAssignmentTasks = [],
   contextComments = [],
   conversationMode = "",
+  planningGuardrail = null,
   client = "",
   model = "",
   env = process.env,
@@ -1725,6 +1783,7 @@ export function planRoleExecutionWithAI({
       currentAssignmentTasks,
       contextComments,
       conversationMode,
+      planningGuardrail,
     }),
     workspaceDir,
     model: plannerModel,
@@ -1739,6 +1798,66 @@ export function planRoleExecutionWithAI({
   return normalizeRoleExecutionPlan(parsed);
 }
 
+export function auditRoleExecutionPlanWithAI({
+  messageText,
+  currentBotUsername,
+  currentBotRole = "",
+  managedBots,
+  workspaceDir,
+  currentAssignmentTasks = [],
+  contextComments = [],
+  conversationMode = "",
+  executionPlan = null,
+  client = "",
+  model = "",
+  env = process.env,
+}) {
+  const bots = ensureArray(managedBots);
+  if (!bots.length) {
+    return null;
+  }
+  const plannerClient = normalizeLocalAIClientName(
+    String(client || env?.METHEUS_ROLE_PLANNER_CLIENT || env?.METHEUS_INTENT_PARSER_CLIENT || "").trim(),
+    "gpt",
+  );
+  const plannerModel = String(
+    model
+    || env?.METHEUS_ROLE_PLANNER_MODEL
+    || env?.METHEUS_INTENT_PARSER_MODEL
+    || suggestLocalAIModelDisplayName(plannerClient, "")
+    || "",
+  ).trim();
+  const rawText = runLocalAIPromptRawText({
+    client: plannerClient,
+    promptText: buildRoleExecutionPlanAuditPrompt({
+      messageText,
+      currentBotUsername,
+      currentBotRole,
+      managedBots: bots,
+      workspaceDir,
+      currentAssignmentTasks,
+      contextComments,
+      conversationMode,
+      executionPlan,
+    }),
+    workspaceDir,
+    model: plannerModel,
+    permissionMode: "read_only",
+    reasoningEffort: String(env?.METHEUS_ROLE_PLANNER_REASONING_EFFORT || "medium").trim() || "medium",
+    env,
+  });
+  const parsed = tryJsonParse(rawText) || tryParseEmbeddedJsonObject(rawText);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("role execution plan auditor did not return a JSON object");
+  }
+  return {
+    requires_execution: parsed.requires_execution === true || parsed.requiresExecution === true,
+    requires_worker_step: parsed.requires_worker_step === true || parsed.requiresWorkerStep === true,
+    plan_satisfies_request: parsed.plan_satisfies_request === true || parsed.planSatisfiesRequest === true,
+    reason: String(parsed.reason || "").trim(),
+  };
+}
+
 export function runLocalAIClient({
   client,
   inputPayload,

package/lib/runner-orchestration.mjs

@@ -447,6 +447,32 @@ function requiresArtifactsForExecutionStep(step) {
   return safeObject(step).artifactsRequired === true || role === "worker";
 }
 
+function executionPlanIncludesWorkerStep(plan) {
+  return ensureArray(safeObject(plan).steps).some((item) => requiresArtifactsForExecutionStep(item));
+}
+
+function describeExecutionPlanAdequacyFailure(plan, audit) {
+  const normalizedPlan = safeObject(plan);
+  const normalizedAudit = safeObject(audit);
+  const steps = ensureArray(normalizedPlan.steps).filter((item) => String(safeObject(item).role || "").trim());
+  if (normalizedAudit.requires_execution === true && normalizedPlan.requiresExecution !== true) {
+    return String(normalizedAudit.reason || "").trim()
+      || "execution planner did not return an executable plan for a request that requires project work";
+  }
+  if (normalizedPlan.requiresExecution === true && !steps.length) {
+    return "execution planner required execution but did not return any executable steps";
+  }
+  if (normalizedAudit.requires_worker_step === true && !executionPlanIncludesWorkerStep(normalizedPlan)) {
+    return String(normalizedAudit.reason || "").trim()
+      || "execution planner returned a monitor-only plan for a request that requires worker execution";
+  }
+  if (normalizedAudit.plan_satisfies_request === false) {
+    return String(normalizedAudit.reason || "").trim()
+      || "execution plan auditor rejected the candidate execution plan";
+  }
+  return "";
+}
+
 function summarizeExecutedRolePlan(plan, stepResults) {
   return {
     requires_execution: safeObject(plan).requiresExecution === true,
@@ -560,6 +586,9 @@ async function maybeExecuteDynamicRolePlan({
   const planner = typeof executionDeps.planRoleExecutionWithAI === "function"
     ? executionDeps.planRoleExecutionWithAI
     : null;
+  const plannerAuditor = typeof executionDeps.auditRoleExecutionPlanWithAI === "function"
+    ? executionDeps.auditRoleExecutionPlanWithAI
+    : null;
   const resolveRunnerExecutionPlanForRole = typeof executionDeps.resolveRunnerExecutionPlanForRole === "function"
     ? executionDeps.resolveRunnerExecutionPlanForRole
     : null;
@@ -579,23 +608,87 @@ async function maybeExecuteDynamicRolePlan({
     ? humanIntentContext.peerMap
     : buildConversationPeerMap(bot, normalizedRoute, executionDeps);
   const managedBots = buildConversationParticipantViews(Array.from(peerMap.keys()), peerMap);
+  const invokePlanner = async (planningGuardrail = null) => planner({
+    messageText: String(safeObject(selectedRecord?.parsedArchive).body || "").trim(),
+    currentBotUsername: String(bot?.username || bot?.name || "").trim(),
+    currentBotRole: String(executionPlan.roleProfileName || normalizedRoute.role || "").trim(),
+    managedBots,
+    workspaceDir: String(executionPlan.workspaceDir || process.cwd()).trim() || process.cwd(),
+    currentAssignmentTasks: assignmentTasks,
+    contextComments: buildRunnerContextWindow(pendingOrdered, selectedRecord, normalizedRoute.contextComments),
+    conversationMode: String(conversationContext?.mode || "").trim(),
+    planningGuardrail,
+    client: String(executionPlan.roleProfile?.client || "").trim(),
+    model: String(executionPlan.roleProfile?.model || "").trim(),
+  });
+  const auditPlannedExecution = async (candidatePlan) => {
+    if (!plannerAuditor) {
+      return null;
+    }
+    try {
+      return await plannerAuditor({
+        messageText: String(safeObject(selectedRecord?.parsedArchive).body || "").trim(),
+        currentBotUsername: String(bot?.username || bot?.name || "").trim(),
+        currentBotRole: String(executionPlan.roleProfileName || normalizedRoute.role || "").trim(),
+        managedBots,
+        workspaceDir: String(executionPlan.workspaceDir || process.cwd()).trim() || process.cwd(),
+        currentAssignmentTasks: assignmentTasks,
+        contextComments: buildRunnerContextWindow(pendingOrdered, selectedRecord, normalizedRoute.contextComments),
+        conversationMode: String(conversationContext?.mode || "").trim(),
+        executionPlan: candidatePlan,
+        client: String(executionPlan.roleProfile?.client || "").trim(),
+        model: String(executionPlan.roleProfile?.model || "").trim(),
+      });
+    } catch {
+      return null;
+    }
+  };
   let executedPlan;
+  let executedPlanAudit = null;
   try {
-    executedPlan = await planner({
-      messageText: String(safeObject(selectedRecord?.parsedArchive).body || "").trim(),
-      currentBotUsername: String(bot?.username || bot?.name || "").trim(),
-      currentBotRole: String(executionPlan.roleProfileName || normalizedRoute.role || "").trim(),
-      managedBots,
-      workspaceDir: String(executionPlan.workspaceDir || process.cwd()).trim() || process.cwd(),
-      currentAssignmentTasks: assignmentTasks,
-      contextComments: buildRunnerContextWindow(pendingOrdered, selectedRecord, normalizedRoute.contextComments),
-      conversationMode: String(conversationContext?.mode || "").trim(),
-      client: String(executionPlan.roleProfile?.client || "").trim(),
-      model: String(executionPlan.roleProfile?.model || "").trim(),
-    });
+    executedPlan = await invokePlanner();
   } catch {
     return null;
   }
+  executedPlanAudit = await auditPlannedExecution(executedPlan);
+  let adequacyFailure = describeExecutionPlanAdequacyFailure(executedPlan, executedPlanAudit);
+  if (adequacyFailure) {
+    try {
+      executedPlan = await invokePlanner({
+        require_worker_step: safeObject(executedPlanAudit).requires_worker_step === true,
+        reject_monitor_only_execution: safeObject(executedPlanAudit).requires_execution === true,
+        reason: adequacyFailure,
+      });
+      executedPlanAudit = await auditPlannedExecution(executedPlan);
+      adequacyFailure = describeExecutionPlanAdequacyFailure(executedPlan, executedPlanAudit);
+    } catch {
+      executedPlan = null;
+    }
+  }
+  if (adequacyFailure) {
+    saveRunnerRouteState(
+      routeKey,
+      buildRunnerRouteStateFromComment(selectedRecord, {
+        last_action: "execution_failed",
+        last_reason: adequacyFailure,
+        last_conversation_id: String(conversationContext?.id || "").trim(),
+        last_conversation_stage: String(conversationContext?.stage || "").trim(),
+        last_workspace_dir: String(executionPlan.workspaceDir || "").trim(),
+      }),
+    );
+    return {
+      kind: "error",
+      result: {
+        route_key: routeKey,
+        route_name: normalizedRoute.name,
+        outcome: "execution_failed",
+        detail: adequacyFailure,
+        thread_id: archiveThread.threadID,
+        comment_id: selectedRecord.id,
+        trigger_kind: String(triggerDecision.trigger || "").trim(),
+      },
+    };
+  }
   if (!safeObject(executedPlan).requiresExecution) {
     return null;
   }

package/lib/selftest-runner-scenarios.mjs

@@ -3080,6 +3080,378 @@ export async function runSelftestRunnerScenarios(push, deps) {
     push("single_bot_worker_step_requires_artifacts_in_multi_role_plan", false, String(err?.message || err));
   }
 
+  try {
+    let deliveryCalls = 0;
+    let plannerCalls = 0;
+    let auditCalls = 0;
+    let aiCalls = 0;
+    const workspaceDir = fs.mkdtempSync(path.join(os.tmpdir(), "metheus-runner-selftest-multi-step-replan-"));
+    const processed = await processRunnerSelectedRecord({
+      routeKey: "single-bot-multi-step-replan-key",
+      normalizedRoute: normalizeRunnerRoute({
+        name: "telegram-monitor-single-bot-multi-step-replan",
+        project_id: selftestProjectID,
+        provider: "telegram",
+        role: "monitor",
+        role_profile: "monitor",
+        destination_id: "dest-1",
+        destination_label: "Main Room",
+        server_bot_name: "RyoAI_bot",
+        server_bot_id: "bot-lead-1",
+        trigger_policy: {
+          mentions_only: true,
+          direct_messages: true,
+          reply_to_bot_messages: true,
+        },
+        archive_policy: {
+          mirror_replies: true,
+          dedupe_inbound: true,
+          dedupe_outbound: true,
+          skip_bot_messages: true,
+        },
+        dry_run_delivery: true,
+      }),
+      selectedRecord: {
+        id: "comment-single-bot-multi-step-replan",
+        createdAt: "2026-03-17T01:00:02.000Z",
+        parsedArchive: {
+          kind: "telegram_message",
+          chatID: "-100123",
+          chatType: "supergroup",
+          senderIsBot: false,
+          body: "@RyoAI_bot redo the project work and create the README file now.",
+          mentionUsernames: ["RyoAI_bot"],
+          messageID: 1303,
+        },
+      },
+      pendingOrdered: [],
+      bot: {
+        id: "bot-lead-1",
+        name: "RyoAI_bot",
+        username: "RyoAI_bot",
+        role: "monitor",
+        provider: "telegram",
+      },
+      destination: {
+        id: "dest-1",
+        label: "Main Room",
+        provider: "telegram",
+        chatID: "-100123",
+      },
+      archiveThread: {
+        threadID: "thread-1",
+        workItemID: "work-item-1",
+      },
+      executionPlan: {
+        mode: "role_profile",
+        roleProfileName: "monitor",
+        roleProfile: {
+          client: "sample",
+          model: "",
+          permissionMode: "read_only",
+          reasoningEffort: "low",
+        },
+        workspaceDir,
+        workspaceSource: "selftest",
+        usedCommandFallback: false,
+      },
+      runtime: {
+        baseURL: "https://example.test",
+        token: "selftest-token",
+        timeoutSeconds: 30,
+        actor: { user_id: "user-1" },
+      },
+      deps: {
+        saveRunnerRouteState: () => {},
+        startRunnerTypingHeartbeat: () => ({ async stop() {} }),
+        runRunnerAIExecution: async ({ inputPayload }) => {
+          aiCalls += 1;
+          const stepRole = String(inputPayload?.execution_step?.role || "").trim();
+          if (stepRole === "monitor") {
+            return {
+              skip: false,
+              reply: "Inspected the project requirements and identified the missing README work.",
+            };
+          }
+          if (stepRole === "worker") {
+            const readmePath = path.join(workspaceDir, "README.md");
+            fs.writeFileSync(readmePath, "# README\n", "utf8");
+            return {
+              skip: false,
+              reply: "Created the README document.",
+              artifacts: [{ path: "README.md", kind: "document", operation: "create" }],
+            };
+          }
+          throw new Error(`unexpected step role ${stepRole}`);
+        },
+        performLocalBotDelivery: async () => {
+          deliveryCalls += 1;
+          return {
+            delivery: { dryRun: true, body: {} },
+            archive: {},
+          };
+        },
+        serializeRunnerTriggerPolicy: (value) => value,
+        serializeRunnerArchivePolicy: (value) => value,
+        buildRunnerExecutionDeps: () => ({
+          validateWorkspaceArtifacts,
+          analyzeHumanConversationIntentWithAI: async () => ({
+            mode: "single_bot",
+            lead_bot: "ryoai_bot",
+            participants: ["ryoai_bot"],
+            initial_responders: ["ryoai_bot"],
+            allowed_responders: ["ryoai_bot"],
+            summary_bot: "",
+            allow_bot_to_bot: false,
+            reply_expectation: "actionable",
+          }),
+          planRoleExecutionWithAI: async ({ planningGuardrail } = {}) => {
+            plannerCalls += 1;
+            if (safeObject(planningGuardrail).require_worker_step === true) {
+              return {
+                requiresExecution: true,
+                summaryRole: "worker",
+                steps: [
+                  { role: "monitor", goal: "Inspect the request" },
+                  { role: "worker", goal: "Create the README", artifactsRequired: true },
+                ],
+              };
+            }
+            return {
+              requiresExecution: true,
+              summaryRole: "monitor",
+              steps: [
+                { role: "monitor", goal: "Inspect the request" },
+              ],
+            };
+          },
+          auditRoleExecutionPlanWithAI: async ({ executionPlan }) => {
+            auditCalls += 1;
+            const steps = ensureArray(safeObject(executionPlan).steps).map((item) => String(safeObject(item).role || "").trim().toLowerCase());
+            const hasWorker = steps.includes("worker");
+            return {
+              requires_execution: true,
+              requires_worker_step: true,
+              plan_satisfies_request: hasWorker,
+              reason: hasWorker
+                ? "worker step present"
+                : "execution request must include a worker step that creates project artifacts",
+            };
+          },
+          resolveRunnerExecutionPlanForRole: (_route, _bot, roleName) => ({
+            mode: "role_profile",
+            roleProfileName: String(roleName || "").trim(),
+            roleProfile: {
+              client: "sample",
+              model: "",
+              permissionMode: String(roleName || "").trim() === "worker" ? "workspace_write" : "read_only",
+              reasoningEffort: String(roleName || "").trim() === "worker" ? "medium" : "low",
+            },
+            workspaceDir,
+            workspaceSource: "selftest",
+            usedCommandFallback: false,
+          }),
+          loadBotRunnerConfig: () => ({
+            roleProfiles: {},
+            botBindings: {},
+            routes: [],
+            projectMappings: {},
+          }),
+        }),
+        buildRunnerDeliveryDeps: () => ({}),
+        buildRunnerRuntimeDeps: () => ({}),
+        resolveConversationPeerBots: () => [
+          { id: "bot-lead-1", name: "RyoAI_bot" },
+        ],
+      },
+    });
+    push(
+      "single_bot_execution_request_replans_monitor_only_plan_into_worker_plan",
+      processed.kind === "replied"
+        && plannerCalls === 2
+        && auditCalls >= 2
+        && aiCalls === 2
+        && deliveryCalls === 1
+        && ensureArray(processed.result?.artifact_paths).includes("README.md"),
+      `kind=${String(processed.kind || "(none)")} planner_calls=${plannerCalls} audit_calls=${auditCalls} ai_calls=${aiCalls} delivery_calls=${deliveryCalls} artifacts=${ensureArray(processed.result?.artifact_paths).join(",")}`,
+    );
+  } catch (err) {
+    push("single_bot_execution_request_replans_monitor_only_plan_into_worker_plan", false, String(err?.message || err));
+  }
+
+  try {
+    let deliveryCalls = 0;
+    let plannerCalls = 0;
+    let auditCalls = 0;
+    let aiCalls = 0;
+    const workspaceDir = fs.mkdtempSync(path.join(os.tmpdir(), "metheus-runner-selftest-multi-step-replan-fail-"));
+    const processed = await processRunnerSelectedRecord({
+      routeKey: "single-bot-multi-step-replan-fail-key",
+      normalizedRoute: normalizeRunnerRoute({
+        name: "telegram-monitor-single-bot-multi-step-replan-fail",
+        project_id: selftestProjectID,
+        provider: "telegram",
+        role: "monitor",
+        role_profile: "monitor",
+        destination_id: "dest-1",
+        destination_label: "Main Room",
+        server_bot_name: "RyoAI_bot",
+        server_bot_id: "bot-lead-1",
+        trigger_policy: {
+          mentions_only: true,
+          direct_messages: true,
+          reply_to_bot_messages: true,
+        },
+        archive_policy: {
+          mirror_replies: true,
+          dedupe_inbound: true,
+          dedupe_outbound: true,
+          skip_bot_messages: true,
+        },
+        dry_run_delivery: true,
+      }),
+      selectedRecord: {
+        id: "comment-single-bot-multi-step-replan-fail",
+        createdAt: "2026-03-17T01:00:03.000Z",
+        parsedArchive: {
+          kind: "telegram_message",
+          chatID: "-100123",
+          chatType: "supergroup",
+          senderIsBot: false,
+          body: "@RyoAI_bot redo the project work and create the README file now.",
+          mentionUsernames: ["RyoAI_bot"],
+          messageID: 1304,
+        },
+      },
+      pendingOrdered: [],
+      bot: {
+        id: "bot-lead-1",
+        name: "RyoAI_bot",
+        username: "RyoAI_bot",
+        role: "monitor",
+        provider: "telegram",
+      },
+      destination: {
+        id: "dest-1",
+        label: "Main Room",
+        provider: "telegram",
+        chatID: "-100123",
+      },
+      archiveThread: {
+        threadID: "thread-1",
+        workItemID: "work-item-1",
+      },
+      executionPlan: {
+        mode: "role_profile",
+        roleProfileName: "monitor",
+        roleProfile: {
+          client: "sample",
+          model: "",
+          permissionMode: "read_only",
+          reasoningEffort: "low",
+        },
+        workspaceDir,
+        workspaceSource: "selftest",
+        usedCommandFallback: false,
+      },
+      runtime: {
+        baseURL: "https://example.test",
+        token: "selftest-token",
+        timeoutSeconds: 30,
+        actor: { user_id: "user-1" },
+      },
+      deps: {
+        saveRunnerRouteState: () => {},
+        startRunnerTypingHeartbeat: () => ({ async stop() {} }),
+        runRunnerAIExecution: async () => {
+          aiCalls += 1;
+          return {
+            skip: false,
+            reply: "This path should not execute because the monitor-only plan must fail first.",
+          };
+        },
+        performLocalBotDelivery: async () => {
+          deliveryCalls += 1;
+          return {
+            delivery: { dryRun: true, body: {} },
+            archive: {},
+          };
+        },
+        serializeRunnerTriggerPolicy: (value) => value,
+        serializeRunnerArchivePolicy: (value) => value,
+        buildRunnerExecutionDeps: () => ({
+          validateWorkspaceArtifacts,
+          analyzeHumanConversationIntentWithAI: async () => ({
+            mode: "single_bot",
+            lead_bot: "ryoai_bot",
+            participants: ["ryoai_bot"],
+            initial_responders: ["ryoai_bot"],
+            allowed_responders: ["ryoai_bot"],
+            summary_bot: "",
+            allow_bot_to_bot: false,
+            reply_expectation: "actionable",
+          }),
+          planRoleExecutionWithAI: async () => {
+            plannerCalls += 1;
+            return {
+              requiresExecution: true,
+              summaryRole: "monitor",
+              steps: [
+                { role: "monitor", goal: "Inspect the request" },
+              ],
+            };
+          },
+          auditRoleExecutionPlanWithAI: async () => {
+            auditCalls += 1;
+            return {
+              requires_execution: true,
+              requires_worker_step: true,
+              plan_satisfies_request: false,
+              reason: "execution request must include a worker step that creates project artifacts",
+            };
+          },
+          resolveRunnerExecutionPlanForRole: (_route, _bot, roleName) => ({
+            mode: "role_profile",
+            roleProfileName: String(roleName || "").trim(),
+            roleProfile: {
+              client: "sample",
+              model: "",
+              permissionMode: "read_only",
+              reasoningEffort: "low",
+            },
+            workspaceDir,
+            workspaceSource: "selftest",
+            usedCommandFallback: false,
+          }),
+          loadBotRunnerConfig: () => ({
+            roleProfiles: {},
+            botBindings: {},
+            routes: [],
+            projectMappings: {},
+          }),
+        }),
+        buildRunnerDeliveryDeps: () => ({}),
+        buildRunnerRuntimeDeps: () => ({}),
+        resolveConversationPeerBots: () => [
+          { id: "bot-lead-1", name: "RyoAI_bot" },
+        ],
+      },
+    });
+    push(
+      "single_bot_execution_request_fails_when_replanned_plan_still_lacks_worker_step",
+      processed.kind === "error"
+        && String(processed.result?.outcome || "") === "execution_failed"
+        && plannerCalls === 2
+        && auditCalls >= 2
+        && aiCalls === 0
+        && deliveryCalls === 0
+        && /worker step/i.test(String(processed.result?.detail || "")),
+      `kind=${String(processed.kind || "(none)")} outcome=${String(processed.result?.outcome || "(none)")} planner_calls=${plannerCalls} audit_calls=${auditCalls} ai_calls=${aiCalls} delivery_calls=${deliveryCalls} detail=${String(processed.result?.detail || "(none)")}`,
+    );
+  } catch (err) {
+    push("single_bot_execution_request_fails_when_replanned_plan_still_lacks_worker_step", false, String(err?.message || err));
+  }
+
   try {
     let aiCalls = 0;
     const processed = await processRunnerSelectedRecord({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "metheus-governance-mcp-cli",
-  "version": "0.2.147",
+  "version": "0.2.148",
   "description": "Metheus Governance MCP CLI (setup + stdio proxy)",
   "type": "module",
   "files": [