mindforge-cc 10.7.0 → 11.2.0

package/bin/autonomous/auto-runner.js

@@ -19,9 +19,9 @@ const progressStream = require('./progress-stream');
 const ContextRefactorer = require('./context-refactorer');
 
 // Extracted modules (lightweight, always needed)
-const { createAuditWriter } = require('./audit-writer');
+const { appendAuditEntrySync } = require('./audit-writer');
 const { createStateManager } = require('./state-manager');
-const { createWaveExecutor } = require('./wave-executor');
+const { createWaveExecutor, Semaphore } = require('./wave-executor');
 
 // ── Lazy-loaded heavy modules ────────────────────────────────────────────────
 // These are only required at the point of first use to reduce startup cost.
@@ -44,6 +44,68 @@ function lazyRequire(cached, modulePath) {
   return cached;
 }
 
+/**
+ * UC-14: Pure timeout predicate evaluated at wave boundaries.
+ *
+ * Three cases:
+ *   1. falsy `timeoutAt` (null / undefined / '') → NO timeout is configured →
+ *      false. Autonomous mode never times out in that case.
+ *   2. truthy but UNPARSEABLE deadline (`Date.parse` → NaN, e.g. 'garbage') → a
+ *      MALFORMED deadline. We FAIL CLOSED: warn to stderr AND return true (treat
+ *      as expired). For a stability/bounding feature, a broken deadline silently
+ *      never firing would let a run proceed UNBOUNDED — the wrong direction. A
+ *      malformed deadline must be VISIBLE and must HALT, not silently fail open.
+ *   3. valid date → `now > parsed` (timed out once `now` strictly exceeds it).
+ *
+ * `Date.now()` is the sane default for a RUNTIME comparison (unlike the council
+ * UC, which avoided `Date.now()` only for deterministic/resumable FILENAMES — a
+ * wall-clock read here is exactly what a timeout check wants). Callers inside the
+ * run-loop should still pass an explicit `now` for testability/consistency within
+ * a single iteration.
+ *
+ * NOTE: this is otherwise a PURE function (used directly in tests). The only
+ * side-effect is the diagnostic stderr write on the malformed branch — never on
+ * the falsy or valid-date paths — so existing pure assertions are unaffected.
+ *
+ * @param {string|null|undefined} timeoutAt — ISO-8601 deadline, or falsy for "no timeout"
+ * @param {number} [now=Date.now()] — Epoch ms to compare against
+ * @returns {boolean} true iff a deadline is set AND it has passed (or is malformed)
+ */
+function isTimedOut(timeoutAt, now = Date.now()) {
+  if (!timeoutAt) return false;
+  const parsed = Date.parse(timeoutAt);
+  if (Number.isNaN(parsed)) {
+    // Malformed deadline → fail CLOSED (visible + halt), never silently fail open.
+    process.stderr.write(`[auto-runner] malformed timeout_at "${timeoutAt}" — treating as expired to fail closed\n`);
+    return true;
+  }
+  return now > parsed;
+}
+
+/**
+ * UC-14: Pure decision for the opt-in terminal-ESCALATE rollback hook.
+ *
+ * SAFE BY DEFAULT: rollback-on-escalate is opt-in via
+ * `wave_execution.rollback_on_escalate` (default false). Even when enabled, an
+ * actual destructive `git reset` is gated on the runner tracking per-wave commit
+ * SHAs — which it does NOT today. So `gitReset` is always false until commit
+ * tracking exists; we only ever RECORD the rollback point.
+ *
+ * @param {object} config — Parsed .mindforge/config.json (or {})
+ * @param {boolean} [hasCommitTracking=false] — Whether per-wave commit SHAs are tracked
+ * @returns {{ record: boolean, gitReset: boolean, reason: string }}
+ */
+function decideRollback(config, hasCommitTracking = false) {
+  const enabled = config?.wave_execution?.rollback_on_escalate === true;
+  if (!enabled) {
+    return { record: true, gitReset: false, reason: 'rollback_on_escalate disabled (default) — recording intent only' };
+  }
+  if (!hasCommitTracking) {
+    return { record: true, gitReset: false, reason: 'rollback_on_escalate enabled but per-wave commit tracking unavailable — recording intent only, actual git reset deferred' };
+  }
+  return { record: true, gitReset: true, reason: 'rollback_on_escalate enabled and commit tracking available' };
+}
+
 class AutoRunner {
   constructor(options = {}) {
     if (options.phase != null && !/^[a-zA-Z0-9_-]+$/.test(String(options.phase))) {
@@ -61,7 +123,6 @@ class AutoRunner {
 
     // Extracted module instances
     this.stateManager = createStateManager(planningDir);
-    this.auditWriter = createAuditWriter(this.auditPath);
     this.waveExecutor = createWaveExecutor({
       onTaskStart: ({ task, wave }) => this.writeAudit({ event: 'task_started', phase: this.phase, wave: wave + 1, task_id: task.id, task_name: task.name }),
       onTaskComplete: ({ task, wave, duration_ms }) => this.writeAudit({ event: 'task_completed', phase: this.phase, wave: wave + 1, task_id: task.id, task_name: task.name, duration_ms }),
@@ -173,6 +234,10 @@ class AutoRunner {
 
     while (await this.hasNextWave()) {
       if (this.isPaused) break;
+      // UC-14: enforce the wave-boundary timeout BEFORE dispatching this wave.
+      // Re-read auto-state each iteration so an externally-updated timeout_at is
+      // honored; stop cleanly (status 'timeout' + resumable state) when passed.
+      if (this._enforceWaveTimeout()) return;
       const permit = await this.evaluateWavePolicy();
       if (!permit) { this.writeAudit({ event: 'auto_mode_denied', reason: 'Policy violation detected' }); break; }
       const isReliable = await this.checkArbitrage();
@@ -188,10 +253,77 @@ class AutoRunner {
     await this.complete();
   }
 
+  /**
+   * UC-14: Wave-boundary timeout enforcement.
+   *
+   * Re-reads the current `timeout_at` from auto-state.json (V9 design field) and,
+   * if the deadline has passed, stops the run CLEANLY:
+   *   1. persists resumable state (currentWaveIndex + completedTasks) so a later
+   *      `/mindforge:auto` resumes exactly where it left off,
+   *   2. sets status to 'timeout' (a VALID_STATUS), keeping the resumable fields,
+   *   3. writes an `auto_mode_timeout` audit event,
+   *   4. logs the resume command and returns true so the caller stops the loop.
+   *
+   * Returns false (no-op) when no timeout is set or the deadline hasn't passed.
+   * @returns {boolean} true iff the run timed out and the loop should stop
+   */
+  _enforceWaveTimeout() {
+    const autoState = this.stateManager.getState();
+    if (!isTimedOut(autoState.timeout_at)) return false;
+
+    const waveNum = this.currentWaveIndex + 1;
+
+    // 1 + 2: persist resumable progress AND flip status to 'timeout' in one write.
+    this.updateState({
+      status: 'timeout',
+      currentWaveIndex: this.currentWaveIndex,
+      completedTasks: Array.from(this.completedTasks),
+      timedOutAt: new Date().toISOString(),
+    });
+
+    // 3: audit the clean stop.
+    this.writeAudit({
+      event: 'auto_mode_timeout',
+      phase: this.phase,
+      wave: waveNum,
+      timeout_at: autoState.timeout_at,
+      completed_tasks: this.completedTasks.size,
+      timestamp: new Date().toISOString(),
+    });
+
+    // 4: clear operator-facing message including the resume command.
+    console.warn(
+      `\n⏲️  TIMEOUT at wave boundary ${waveNum}/${this.waves.length} ` +
+      `(deadline ${autoState.timeout_at}). Stopped cleanly with ${this.completedTasks.size} task(s) completed.\n` +
+      `   Resume with: /mindforge:auto --phase ${this.phase}`
+    );
+    return true;
+  }
+
   runPreFlight() {
     console.log('🔍 Running pre-flight checks...');
+
+    // UC-01: fail closed on version drift before any wave executes
+    try {
+      const { assertVersionConsistency } = require('../utils/version-check');
+      assertVersionConsistency(process.cwd());
+    } catch (e) {
+      throw new Error(`[pre-flight] ${e.message}`);
+    }
+
     const handoff = this.stateManager.readHandoff();
-    this.waves = this._buildWaves(handoff.handoffs);
+
+    // FIX 3.2: read config ONCE for the whole pre-flight path and thread the
+    // resolved useDag boolean into both _assertNoCycles and _buildWaves, instead
+    // of each method re-reading + re-parsing .mindforge/config.json.
+    const useDag = this._useDagMode();
+
+    // UC-03: when DAG ordering is enabled (opt-in via config), detect cycles
+    // BEFORE any wave executes and HALT LOUD. Default OFF — legacy behavior
+    // (single-wave / explicit .wave grouping) is untouched.
+    this._assertNoCycles(handoff.handoffs, useDag);
+
+    this.waves = this._buildWaves(handoff.handoffs, useDag);
     this.currentWaveIndex = 0;
 
     const savedState = this.stateManager.getState();
@@ -218,24 +350,47 @@ class AutoRunner {
     const wave = this.waves[this.currentWaveIndex];
     const waveNum = this.currentWaveIndex + 1;
     const pending = wave.tasks.filter(t => !this.completedTasks.has(t.id));
+    const maxConcurrency = this._getWaveConcurrency();
 
-    console.log(`\n⚡ Wave ${waveNum}/${this.waves.length}: ${pending.length} tasks`);
+    console.log(`\n⚡ Wave ${waveNum}/${this.waves.length}: ${pending.length} tasks (concurrency: ${maxConcurrency})`);
     if (idcStatus.action === 'UPGRADE_MIR') console.log(`  [IDC-ACTIVE] MIR Override: ${idcStatus.new_mir}`);
     this.writeAudit({ event: 'wave_started', phase: this.phase, wave: waveNum, task_count: pending.length });
 
-    for (const task of pending) {
-      const taskStart = Date.now();
-      console.log(`  → Task: ${task.name || task.id}`);
-      try {
-        this.writeAudit({ event: 'task_started', phase: this.phase, wave: waveNum, task_id: task.id, task_name: task.name || task.id });
-        this.writeAudit({ event: 'task_completed', phase: this.phase, wave: waveNum, task_id: task.id, task_name: task.name || task.id, duration_ms: Date.now() - taskStart });
-        this.completedTasks.add(task.id);
-      } catch (err) {
-        console.error(`  Task failed: ${task.id} — ${err.message}`);
-        this.writeAudit({ event: 'task_failed', phase: this.phase, wave: waveNum, task_id: task.id, error: err.message, duration_ms: Date.now() - taskStart });
-        const strategy = repairOperator.determineRepairStrategy({ planId: task.plan || task.id, phase: this.phase, attemptNumber: 1, errorOutput: err.message, isTier3Change: false, isOnCriticalPath: (task.depends_on || []).length > 0 });
-        if (strategy === 'RETRY') { console.log(`  Repair: retrying ${task.id}`); continue; }
-        if (strategy === 'ESCALATE') { this.writeAudit({ event: 'auto_mode_escalated', reason: `Task ${task.id} unrecoverable` }); this.isPaused = true; return; }
+    const semaphore = new Semaphore(maxConcurrency);
+
+    const settled = await Promise.allSettled(
+      pending.map(async (task) => {
+        await semaphore.acquire();
+        const taskStart = Date.now();
+        console.log(`  → Task: ${task.name || task.id}`);
+        try {
+          this.writeAudit({ event: 'task_started', phase: this.phase, wave: waveNum, task_id: task.id, task_name: task.name || task.id });
+          this.writeAudit({ event: 'task_completed', phase: this.phase, wave: waveNum, task_id: task.id, task_name: task.name || task.id, duration_ms: Date.now() - taskStart });
+          this.completedTasks.add(task.id);
+          return { taskId: task.id, status: 'fulfilled' };
+        } catch (err) {
+          console.error(`  Task failed: ${task.id} — ${err.message}`);
+          this.writeAudit({ event: 'task_failed', phase: this.phase, wave: waveNum, task_id: task.id, error: err.message, duration_ms: Date.now() - taskStart });
+          throw { taskId: task.id, error: err, task };
+        } finally {
+          semaphore.release();
+        }
+      })
+    );
+
+    const failures = settled.filter(r => r.status === 'rejected');
+    if (failures.length > 0) {
+      for (const failure of failures) {
+        const { taskId, error, task } = failure.reason;
+        const strategy = repairOperator.determineRepairStrategy({ planId: task.plan || taskId, phase: this.phase, attemptNumber: 1, errorOutput: error.message, isTier3Change: false, isOnCriticalPath: (task.depends_on || []).length > 0 });
+        if (strategy === 'ESCALATE') {
+          this.writeAudit({ event: 'auto_mode_escalated', reason: `Task ${taskId} unrecoverable` });
+          // UC-14: opt-in rollback hook on terminal ESCALATE. SAFE DEFAULT —
+          // records the rollback point only; never mutates git (see decideRollback).
+          this._recordRollbackPoint(waveNum, taskId);
+          this.isPaused = true;
+          return;
+        }
       }
     }
 
@@ -244,12 +399,171 @@ class AutoRunner {
     this.currentWaveIndex++;
   }
 
+  _getWaveConcurrency() {
+    try {
+      const configPath = path.join(process.cwd(), '.mindforge', 'config.json');
+      if (fs.existsSync(configPath)) {
+        const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        if (typeof config.wave_concurrency === 'number' && config.wave_concurrency > 0) {
+          return config.wave_concurrency;
+        }
+      }
+    } catch (e) { /* Fall through to default */ }
+    return 3;
+  }
+
+  /**
+   * UC-14: Rollback-on-escalate is OPT-IN. Reads
+   * `wave_execution.rollback_on_escalate` from config; defaults to false so the
+   * SAFE behavior (record rollback intent only — NO git mutation) is the default.
+   * Even when true, an actual git reset is further gated on per-wave commit
+   * tracking, which the runner does not yet have (see decideRollback).
+   * @returns {boolean}
+   */
+  _rollbackOnEscalate() {
+    try {
+      const configPath = path.join(process.cwd(), '.mindforge', 'config.json');
+      if (fs.existsSync(configPath)) {
+        const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        return config.wave_execution?.rollback_on_escalate === true;
+      }
+    } catch (e) { /* Fall through to default */ }
+    return false;
+  }
+
+  /**
+   * UC-14: Records the rollback point on terminal ESCALATE WITHOUT mutating git.
+   *
+   * The runner does NOT track per-wave commit SHAs, so even with
+   * `rollback_on_escalate` enabled the actual `git reset --hard` is deferred —
+   * we never run a destructive reset against untracked commit boundaries. We
+   * emit a `rollback_point_recorded` audit event (and a clear log) recording the
+   * intended rollback wave so a human can act on it.
+   *
+   * @param {number} waveNum — 1-based wave number that hit terminal escalation
+   * @param {string} taskId — The task id whose repair was exhausted
+   */
+  _recordRollbackPoint(waveNum, taskId) {
+    const config = (() => {
+      try {
+        const configPath = path.join(process.cwd(), '.mindforge', 'config.json');
+        if (fs.existsSync(configPath)) return JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      } catch (e) { /* ignore — treat as no config */ }
+      return {};
+    })();
+
+    // hasCommitTracking is hard-false: no per-wave SHA tracking exists yet.
+    const decision = decideRollback(config, /* hasCommitTracking */ false);
+
+    // DRY: derive the flag from the `config` we ALREADY read above instead of
+    // calling _rollbackOnEscalate(), which would re-read + re-parse the SAME
+    // config.json a second time within this single escalation path.
+    const rollbackEnabled = config?.wave_execution?.rollback_on_escalate === true;
+
+    this.writeAudit({
+      event: 'rollback_point_recorded',
+      phase: this.phase,
+      wave: waveNum,
+      task_id: taskId,
+      commits: [], // none tracked yet — rollback target is the prior wave boundary
+      git_reset_performed: decision.gitReset,
+      reason: decision.reason,
+      timestamp: new Date().toISOString(),
+    });
+    console.warn(`↩️  ROLLBACK POINT recorded at wave ${waveNum} (task ${taskId}): ${decision.reason}`);
+    if (rollbackEnabled && !decision.gitReset) {
+      console.warn('   (rollback_on_escalate is ON, but actual git reset is deferred until per-wave commit tracking exists.)');
+    }
+    return decision;
+  }
+
+  /**
+   * UC-03: DAG wave ordering is OPT-IN. Reads `wave_execution.use_dag` from
+   * config; defaults to false so legacy single-wave / explicit-.wave behavior
+   * is untouched. Enabling this reorders tasks by `depends_on` topology.
+   * @returns {boolean}
+   */
+  _useDagMode() {
+    try {
+      const configPath = path.join(process.cwd(), '.mindforge', 'config.json');
+      if (fs.existsSync(configPath)) {
+        const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        return config.wave_execution?.use_dag === true;
+      }
+    } catch (e) { /* Fall through to default */ }
+    return false;
+  }
+
+  /**
+   * UC-03: Pre-flight cycle detection. ONLY active when DAG mode is enabled
+   * (opt-in) AND no explicit numeric `.wave` field is present (DAG would be the
+   * active strategy). Throws `[pre-flight] Circular dependency...` to HALT LOUD
+   * before any wave executes — never warn-and-continue. No-op when DAG is off.
+   *
+   * FIX 1: the pre-flight graph must NOT differ from the graph planWaves
+   * actually executes. planWaves builds its graph from normalizeTask, which
+   * SYNTHESIZES a random id (`task_<rand>`) for any handoff lacking both id and
+   * task_id. A random id can't be matched between two separate calls, AND a task
+   * with no stable id can never be a `depends_on` TARGET (nothing can reference
+   * an id that doesn't exist until it's randomly minted). So we cycle-check the
+   * SUBSET of handoffs that carry a real, stable id (id || task_id) — a subset
+   * guaranteed consistent with execution — and log a warning for any id-less
+   * handoff excluded from the check.
+   *
+   * @param {Array} handoffs — Raw handoffs array from HANDOFF.json
+   * @param {boolean} [useDag] — Resolved DAG mode (threaded from runPreFlight to
+   *   avoid re-reading config). Falls back to _useDagMode() for direct callers.
+   */
+  _assertNoCycles(handoffs, useDag = this._useDagMode()) {
+    if (!Array.isArray(handoffs) || handoffs.length === 0) return;
+    if (!useDag) return;
+
+    // Explicit .wave field wins over DAG, so cycle check is irrelevant there.
+    const hasWaveField = handoffs.some(h => typeof h.wave === 'number');
+    if (hasWaveField) return;
+
+    // Only handoffs with a STABLE id participate in cycle-checking (see above).
+    const stable = handoffs.filter(h => h.id || h.task_id);
+    const idless = handoffs.length - stable.length;
+    if (idless > 0) {
+      console.warn(
+        `[pre-flight] ${idless} handoff(s) lack a stable id (id/task_id) and are ` +
+        'excluded from cycle-checking; an id-less task cannot be a dependency target.'
+      );
+    }
+    if (stable.length === 0) return;
+
+    const { buildGraph, groupIntoWaves } = require('./dependency-dag');
+    let graph;
+    try {
+      graph = buildGraph(stable.map(h => ({
+        id: h.id || h.task_id,
+        depends_on: Array.isArray(h.depends_on) ? h.depends_on : [],
+      })));
+    } catch (e) {
+      // Unknown-dependency reference — also a planning error; fail loud.
+      throw new Error(`[pre-flight] ${e.message}`);
+    }
+    // FIX 3.1: hasCircularDependency() is itself `try{groupIntoWaves}catch`, so
+    // running it then groupIntoWaves again ran Kahn 2-3 times and left an
+    // unreachable defensive throw. Run Kahn ONCE here; on throw, rethrow with the
+    // descriptive (circular OR unknown-dep) message prefixed for pre-flight.
+    try {
+      groupIntoWaves(graph);
+    } catch (e) {
+      throw new Error(`[pre-flight] ${e.message}`);
+    }
+  }
+
   /**
    * Build wave groups from HANDOFF handoffs array.
    * Kept as instance method for backward compatibility with tests.
+   * @param {Array} handoffs — Raw handoffs array from HANDOFF.json
+   * @param {boolean} [useDag] — Resolved DAG mode (threaded from runPreFlight).
+   *   Falls back to _useDagMode() for direct callers (e.g. tests).
    */
-  _buildWaves(handoffs) {
-    return this.waveExecutor.planWaves(handoffs);
+  _buildWaves(handoffs, useDag = this._useDagMode()) {
+    return this.waveExecutor.planWaves(handoffs, { useDag });
   }
 
   async checkIntelligenceDrift() {
@@ -316,28 +630,33 @@ class AutoRunner {
       if (captured.length + stability.length > 0) console.log(`🧠 Knowledge Graph: Captured ${captured.length + stability.length} insights.`);
     } catch (err) { console.error('⚠️ Knowledge Capture failed:', err.message); }
 
+    try {
+      _TemporalHub = lazyRequire(_TemporalHub, '../engine/temporal-hub');
+      const gcConfig = this._loadTemporalGcConfig();
+      const gcResult = await _TemporalHub.gc(gcConfig);
+      if (gcResult.deleted > 0) {
+        this.writeAudit({ event: 'temporal_gc_completed', deleted: gcResult.deleted, remaining: gcResult.remaining });
+      }
+    } catch (e) { /* GC failure is non-critical */ }
+
     this.writeAudit({ event: 'auto_mode_completed', timestamp: new Date().toISOString() });
-    await this.auditWriter.close();
   }
 
   writeAudit(event) {
-    const crypto = require('crypto');
-    if (!event.id) event = Object.assign({}, event, { id: crypto.randomBytes(8).toString('hex') });
-    if (!event.timestamp) event = Object.assign({}, event, { timestamp: new Date().toISOString() });
-
-    // Synchronous write for backward compat (monitor needs immediate data)
-    fs.appendFileSync(this.auditPath, JSON.stringify(event) + '\n');
-
-    // Also buffer in async writer for future async consumers
-    this.auditWriter.write(event);
+    // UC-04b: single unified, hash-chained, synchronous-DURABLE append. The sync
+    // fsync'd write means in-process consumers (StuckMonitor reads the event
+    // object directly below; any file re-readers see it immediately) get durable
+    // data at once — replacing the old dual raw-appendFileSync + async-buffer write
+    // that left the live AUDIT.jsonl chain unverifiable.
+    const stamped = appendAuditEntrySync(this.auditPath, event);
 
     const STATE_CHANGING_EVENTS = ['auto_mode_started', 'phase_planned', 'phase_execution_started', 'task_completed', 'hindsight_injected', 'auto_mode_completed'];
-    if (STATE_CHANGING_EVENTS.includes(event.event)) {
+    if (STATE_CHANGING_EVENTS.includes(stamped.event)) {
       _TemporalHub = lazyRequire(_TemporalHub, '../engine/temporal-hub');
-      _TemporalHub.captureState(event.id, { agent: event.agent || 'auto-runner', event: event.event, phase: this.phase });
+      _TemporalHub.captureState(stamped.id, { agent: stamped.agent || 'auto-runner', event: stamped.event, phase: this.phase }).catch(() => {});
     }
 
-    const result = this.monitor.analyze(event);
+    const result = this.monitor.analyze(stamped);
     if (result) this.handleStuck(result);
   }
 
@@ -370,7 +689,7 @@ class AutoRunner {
 
   async evaluateWavePolicy() {
     _ZTAIManager = lazyRequire(_ZTAIManager, '../governance/ztai-manager');
-    const manager = new _ZTAIManager();
+    const manager = _ZTAIManager;
     const identity = await manager.getIdentity();
     const intent = { did: identity.did, action: 'process_phase_wave', resource: `projects/${process.env.MF_PROJECT_ID || 'MF-ALPHA'}/phases/${this.phase}/*`, tier: identity.tier || 1, metadata: { engine: 'Nimbus-S4', mode: 'autonomous', wave_timestamp: new Date().toISOString() } };
     const result = this.policyEngine.evaluate(intent);
@@ -444,6 +763,30 @@ class AutoRunner {
     const lines = buf.toString('utf8').trim().split('\n');
     return lines.slice(-count).map(l => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
   }
+
+  _loadTemporalGcConfig() {
+    try {
+      const configPath = path.join(process.cwd(), '.mindforge', 'config.json');
+      if (fs.existsSync(configPath)) {
+        const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        if (config.temporal) {
+          return {
+            maxSnapshots: config.temporal.max_snapshots || 50,
+            maxAgeDays: config.temporal.max_age_days || 7
+          };
+        }
+      }
+    } catch (e) { /* Fall through to defaults */ }
+    return { maxSnapshots: 50, maxAgeDays: 7 };
+  }
 }
 
+// Primary export remains the AutoRunner class (back-compat with all callers/tests
+// that do `const AutoRunner = require('./auto-runner')`). UC-14 pure helpers are
+// attached as named properties so `require('./auto-runner').isTimedOut` works too.
+AutoRunner.isTimedOut = isTimedOut;
+AutoRunner.decideRollback = decideRollback;
+
 module.exports = AutoRunner;
+module.exports.isTimedOut = isTimedOut;
+module.exports.decideRollback = decideRollback;

package/bin/autonomous/context-refactorer.js

@@ -14,18 +14,15 @@ class ContextRefactorer {
     this.history = [];
   }
 
-  /**
-   * Analyze the current context density.
-   * Density = (Implementation Events) / (Total Events)
-   */
   analyzeDensity(events) {
-    this.history = events.slice(-this.windowSize);
-    
-    if (this.history.length < 5) return { density: 1.0, shouldRefactor: false };
+    const windowSize = this._getAdaptiveWindow(events);
+    this.history = events.slice(-windowSize);
 
-    const implementationEvents = this.history.filter(h => 
-      h.tool === 'run_command' || 
-      h.tool === 'replace_file_content' || 
+    if (this.history.length < 5) return { density: 1.0, shouldRefactor: false, windowSize };
+
+    const implementationEvents = this.history.filter(h =>
+      h.tool === 'run_command' ||
+      h.tool === 'replace_file_content' ||
       h.tool === 'multi_replace_file_content' ||
       h.event === 'task_completed'
     );
@@ -35,10 +32,28 @@ class ContextRefactorer {
 
     return {
       density: parseFloat(density.toFixed(2)),
-      shouldRefactor: density < this.threshold
+      shouldRefactor: density < this.threshold,
+      windowSize
     };
   }
 
+  _getAdaptiveWindow(events) {
+    const recent = events.slice(-10);
+    if (recent.length === 0) return 20;
+
+    const implEvents = recent.filter(e =>
+      e.event === 'run_command' ||
+      e.event?.includes('replace_file') ||
+      e.event === 'task_completed'
+    ).length;
+
+    const velocity = implEvents / recent.length;
+
+    if (velocity > 0.6) return 10;
+    if (velocity < 0.3) return 30;
+    return 20;
+  }
+
   /**
    * Generates a "Context Refactor" recommendation.
    */

package/bin/autonomous/dependency-dag.js

@@ -0,0 +1,59 @@
+'use strict';
+/**
+ * MindForge — Dependency DAG (UC-03).
+ * Kahn topological sort + cycle detection.
+ * Ported from the previously test-only implementation into the real engine.
+ *
+ * TODO(UC-xx): same-wave file-conflict detection once tasks carry file lists.
+ *   Handoff tasks (see normalizeTask in wave-executor.js and validateHandoff in
+ *   state-manager.js) currently expose only id/name/plan/depends_on — there is
+ *   no `files` field to compare. A `findFileConflicts(plans)` check (two tasks
+ *   in the SAME wave writing the same file -> warn) cannot be wired meaningfully
+ *   until the handoff schema captures per-task file lists, so it is intentionally
+ *   not implemented here rather than left as dead exported surface.
+ */
+function groupIntoWaves(graph) {
+  // Self-defense: every dependency target must be a known graph node. Throw a
+  // DISTINCT "unknown dependency" error (not the misleading "Circular" message)
+  // so callers that invoke groupIntoWaves standalone still fail descriptively.
+  for (const id of Object.keys(graph)) {
+    const deps = graph[id].dependsOn || [];
+    for (const d of deps) {
+      if (!(d in graph)) {
+        throw new Error(`Unknown dependency "${d}" referenced by "${id}"`);
+      }
+    }
+  }
+  const remaining = new Set(Object.keys(graph));
+  const completed = new Set();
+  const waves = [];
+  while (remaining.size > 0) {
+    const wave = [];
+    for (const id of remaining) {
+      const deps = graph[id].dependsOn || [];
+      if (deps.every(d => completed.has(d))) wave.push(id);
+    }
+    if (wave.length === 0 && remaining.size > 0) {
+      throw new Error(`Circular dependency detected among: ${[...remaining].join(', ')}`);
+    }
+    waves.push(wave.sort());
+    wave.forEach(id => { completed.add(id); remaining.delete(id); });
+  }
+  return waves;
+}
+function hasCircularDependency(graph) {
+  try { groupIntoWaves(graph); return false; } catch { return true; }
+}
+function buildGraph(tasks) {
+  const ids = new Set(tasks.map(t => t.id));
+  const graph = {};
+  for (const t of tasks) {
+    const deps = Array.isArray(t.depends_on) ? t.depends_on : [];
+    for (const d of deps) {
+      if (!ids.has(d)) throw new Error(`Task "${t.id}" depends on unknown task "${d}"`);
+    }
+    graph[t.id] = { dependsOn: deps };
+  }
+  return graph;
+}
+module.exports = { groupIntoWaves, hasCircularDependency, buildGraph };