pan-wizard 3.36.0 → 3.37.0

package/pan-wizard-core/bin/lib/debug-cases.cjs

@@ -0,0 +1,104 @@
+'use strict';
+/**
+ * Debug sessions as evidence and as a case base (program P5).
+ *
+ * `debug repro <slug>` runs the reproduction a session recorded (its `## Reproduction`
+ * `command:`), so a gap or a debug session closes only when that command turns green,
+ * not when an agent says it is fixed. The reproduction may name the requirement it
+ * stands for (`requirement: REQ-n`): one reproduction per requirement a gap breaks.
+ *
+ * `debug similar "<symptom>"` ranks the resolved sessions in `.planning/debug/resolved/`
+ * by token overlap with the new symptom (their symptoms, errors and root cause), so a
+ * recurring bug starts from the root cause and fix that worked before.
+ */
+const fs = require('fs');
+const path = require('path');
+const { output, error, toLf } = require('./core.cjs');
+const TG = require('./test-gate.cjs');
+
+const DEBUG_DIR = path.join('.planning', 'debug');
+const RESOLVED_DIR = path.join(DEBUG_DIR, 'resolved');
+const SLUG_RE = /^[a-z0-9][a-z0-9._-]*$/i;
+const DEFAULT_REPRO_TIMEOUT_MS = 2 * 60 * 1000;
+const STOP = new Set(['the', 'and', 'for', 'with', 'that', 'this', 'when', 'after', 'before', 'from', 'into', 'are', 'was', 'not', 'but', 'its', 'every', 'right']);
+
+/** The `key: value` lines of one `## Heading` section. */
+function sectionFields(text, heading) {
+  const m = new RegExp(`^## ${heading}\\s*$([\\s\\S]*?)(?=^## |(?![\\s\\S]))`, 'm').exec(text);
+  const out = {};
+  if (!m) return out;
+  for (const line of m[1].split('\n')) {
+    const kv = /^([a-z_]+):\s*(.*)$/.exec(line.trim());
+    if (kv) out[kv[1]] = kv[2].trim();
+  }
+  return out;
+}
+
+/** Parse a debug session file. */
+function parseDebugSession(raw) {
+  const text = toLf(String(raw || ''));
+  const fm = /^---\n([\s\S]*?)\n---/.exec(text);
+  const status = fm ? ((/^status:\s*(.+)$/m.exec(fm[1]) || [])[1] || '').trim() : '';
+  return {
+    status,
+    symptoms: sectionFields(text, 'Symptoms'),
+    reproduction: sectionFields(text, 'Reproduction'),
+    resolution: sectionFields(text, 'Resolution'),
+  };
+}
+
+/** Run a session's reproduction. green | red | none (no command recorded). */
+function reproCheck(cwd, slug, opts = {}) {
+  if (!slug || !SLUG_RE.test(slug) || slug.includes('..')) return { error: 'invalid_slug', reason: 'a debug session slug is letters, digits, dots, dashes and underscores' };
+  const candidates = [path.join(cwd, DEBUG_DIR, `${slug}.md`), path.join(cwd, RESOLVED_DIR, `${slug}.md`)];
+  const file = candidates.find((f) => fs.existsSync(f));
+  if (!file) return { error: 'session_not_found', reason: `no .planning/debug/${slug}.md` };
+  const s = parseDebugSession(fs.readFileSync(file, 'utf8'));
+  const command = s.reproduction.command || '';
+  const requirement = s.reproduction.requirement || null;
+  if (!command || /^none\b/i.test(command) || /^\[/.test(command)) {
+    return { slug, result: 'none', closable: false, requirement, detail: 'the session records no reproduction command; its closing needs a human check' };
+  }
+  const r = TG.runCommand(cwd, command, opts.timeoutMs || DEFAULT_REPRO_TIMEOUT_MS);
+  const result = r.exit === 0 ? 'green' : 'red';
+  return { slug, result, closable: result === 'green', requirement, command, exit: r.exit, ...(r.timed_out ? { timed_out: true } : {}) };
+}
+
+function tokens(s) {
+  return new Set(String(s || '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').split(' ').filter((w) => w.length > 2 && !STOP.has(w)));
+}
+
+/** Rank resolved sessions by overlap with a symptom. */
+function similarCases(cwd, symptom, opts = {}) {
+  const want = tokens(symptom);
+  const dir = path.join(cwd, RESOLVED_DIR);
+  let files = [];
+  try { files = fs.readdirSync(dir).filter((f) => f.endsWith('.md')); } catch { /* none yet */ }
+  const cases = [];
+  for (const f of files) {
+    const s = parseDebugSession(fs.readFileSync(path.join(dir, f), 'utf8'));
+    const have = tokens([s.symptoms.expected, s.symptoms.actual, s.symptoms.errors, s.resolution.root_cause].join(' '));
+    let both = 0;
+    for (const t of want) if (have.has(t)) both++;
+    const score = want.size && have.size ? both / (want.size + have.size - both) : 0;
+    if (score <= 0) continue;
+    cases.push({ slug: f.replace(/\.md$/, ''), score: Number(score.toFixed(3)), root_cause: s.resolution.root_cause || null, fix: s.resolution.fix || null, reproduction: s.reproduction.command || null });
+  }
+  cases.sort((a, b) => b.score - a.score || a.slug.localeCompare(b.slug));
+  return { symptom, cases: cases.slice(0, opts.limit || 5) };
+}
+
+function cmdDebugRepro(cwd, slug, raw, opts = {}) {
+  if (!slug) error('Usage: debug repro <slug> [--timeout <ms>]');
+  const r = reproCheck(cwd, slug, { timeoutMs: opts.timeout ? Number(opts.timeout) : undefined });
+  if (r.error) { output(r, raw, 'error', 1); return; }
+  output(r, raw, r.result, r.result === 'green' ? 0 : 1);
+}
+
+function cmdDebugSimilar(cwd, symptom, raw, opts = {}) {
+  if (!symptom) error('Usage: debug similar "<symptom>" [--limit N]');
+  const r = similarCases(cwd, symptom, { limit: opts.limit ? Number(opts.limit) : undefined });
+  output(r, raw, r.cases.map((c) => c.slug).join('\n'));
+}
+
+module.exports = { parseDebugSession, reproCheck, similarCases, cmdDebugRepro, cmdDebugSimilar };

package/pan-wizard-core/bin/lib/failure-class.cjs

@@ -0,0 +1,81 @@
+'use strict';
+/**
+ * The failure-class router (program A4).
+ *
+ * When an autodev unit fails, what to do next depends on why. classifyFailure reads the
+ * exit, the output tail and whether it timed out; routeFailure gives the class's policy
+ * for this attempt. Breadth before depth (Olausson et al.): a cheap retry with the error
+ * in front of the model comes before a tier escalation, and anything a model cannot fix
+ * (a missing CLI or login, a merge conflict, the guard's deny, an undeclared file) goes
+ * to a human.
+ *
+ *   retry_with_tail  rerun the unit with the error tail in the prompt
+ *   fresh_restart    rerun the unit as it was
+ *   escalate_tier    rerun it at the next model tier (core.cjs escalateTier)
+ *   quarantine       record it as a flake and go on
+ *   ask              stop: human_needed
+ *   stop_budget      stop: budget_usd
+ */
+
+const { escalateTier } = require('./core.cjs');
+
+const FAILURE_CLASSES = Object.freeze(['compile', 'assertion', 'timeout', 'flake', 'missing_env', 'merge_conflict', 'integrity_violation', 'scope_violation', 'budget', 'unknown']);
+
+// First match wins: the specific, unfixable classes are checked before the generic ones.
+const PATTERNS = [
+  ['budget', /max-budget-usd|credit balance|usage limit|rate limit|quota exceeded|budget exceeded/i],
+  ['missing_env', /is not recognized as an internal or external command|command not found|ENOENT|invalid api key|not logged in|please run \/login|authenticat(e|ion) (failed|required)|missing (an )?api key/i],
+  ['integrity_violation', /PAN guard:|integrity (check|violation)|hash mismatch|tamper/i],
+  ['merge_conflict', /CONFLICT \(|merge conflict|Automatic merge failed/i],
+  ['scope_violation', /scope violation|undeclared (file|test)|not declared by any plan|outside the plan/i],
+  ['timeout', /ETIMEDOUT|timed out|timeout of \d+/i],
+  ['compile', /error TS\d+|SyntaxError|ReferenceError|Cannot find (module|name)|compilation failed|failed to compile|cannot compile/i],
+  ['assertion', /AssertionError|assert\w*\.\w+|expected .{1,80} (to|but)|\btests? failed\b|\d+ failing\b|^not ok /im],
+];
+
+/**
+ * @param {{exit?: number|null, stderr?: string, stdout?: string, timedOut?: boolean, flaky?: boolean}} f
+ * @returns {string} one of FAILURE_CLASSES
+ */
+function classifyFailure(f = {}) {
+  if (f.flaky) return 'flake';
+  if (f.timedOut) return 'timeout';
+  const text = `${f.stderr || ''}\n${f.stdout || ''}`;
+  for (const [cls, re] of PATTERNS) if (re.test(text)) return cls;
+  if (f.exit === 127) return 'missing_env';
+  return 'unknown';
+}
+
+const POLICIES = {
+  compile: ['retry_with_tail', 'escalate_tier'],
+  assertion: ['retry_with_tail', 'escalate_tier'],
+  timeout: ['fresh_restart'],
+  flake: ['quarantine'],
+  missing_env: [],
+  merge_conflict: [],
+  integrity_violation: [],
+  scope_violation: [],
+  budget: ['stop_budget'],
+  unknown: ['fresh_restart'],
+};
+
+/**
+ * The policy for the `attempt`th failure of a unit (1 = its first failure).
+ * @returns {{action: string, tier?: string}}
+ */
+function routeFailure(cls, attempt = 1) {
+  const ladder = POLICIES[cls] || POLICIES.unknown;
+  if (cls === 'flake') return { action: 'quarantine' };
+  if (cls === 'budget') return { action: 'stop_budget' };
+  const action = ladder[attempt - 1] || 'ask';
+  if (action === 'escalate_tier') return { action, tier: escalateTier('mid', attempt).tier };
+  return { action };
+}
+
+/** The last lines of a failure's output, for the retry prompt (one line, shell-safe). */
+function errorTail(f = {}, max = 300) {
+  const text = `${f.stderr || ''}\n${f.stdout || ''}`.trim().split(/\r?\n/).filter(Boolean).slice(-4).join(' / ');
+  return text.replace(/[\r\n&|<>%^"]/g, ' ').replace(/\s+/g, ' ').slice(-max).trim();
+}
+
+module.exports = { FAILURE_CLASSES, classifyFailure, routeFailure, errorTail, POLICIES };

package/pan-wizard-core/bin/lib/findings.cjs

@@ -92,6 +92,8 @@ function foldFindings(rows) {
         severity: r.severity, where: r.where || null, summary: r.summary, first_seen: r.ts,
         first_verdict_id: r.verdict_id || null, reports: 0, last_reported: null, _reportedSeq: -1,
         disposition: null, reason: null, disposed_at: null, auto: false, file_sha: null, _disposedSeq: -1, _returnedSeq: -1,
+        ...(r.pre_existing === true ? { pre_existing: true } : {}),
+        proof: null,
       });
     } else if (r.kind === 'verdict') {
       verdicts.push({ ...r, _seq: seq });
@@ -107,6 +109,10 @@ function foldFindings(rows) {
         const f = findings.get(id);
         if (f) f._returnedSeq = seq;
       }
+    } else if (r.kind === 'proof' && typeof r.id === 'string') {
+      // R5: the latest catching-test run for a finding.
+      const f = findings.get(r.id);
+      if (f) f.proof = { status: r.status, test: r.test };
     } else if (r.kind === 'disposition' && typeof r.id === 'string') {
       const f = findings.get(r.id);
       if (!f || !V.DISPOSITIONS.includes(r.disposition)) return;
@@ -130,7 +136,8 @@ function foldFindings(rows) {
 /** A finding as the CLI shows it (internal sequence fields removed). */
 function publicFinding(f) {
   const { _reportedSeq, _disposedSeq, _returnedSeq, ...rest } = f;
-  return rest;
+  // R5: confirmed only with a catching test that passed its proof; a candidate otherwise.
+  return { ...rest, confidence: f.proof && f.proof.status === 'confirmed' ? 'confirmed' : 'candidate' };
 }
 
 function countBy(list, key) {
@@ -324,6 +331,7 @@ function recordVerdict(cwd, input) {
   const supps = learnedSuppressions(cwd, fold);
   const suppressed = [];
   const returned = [];
+  const preExisting = [];
   let rematched = 0;
   for (const f of verdict.findings) {
     let id = V.findingId(phase, agent, f);
@@ -347,7 +355,8 @@ function recordVerdict(cwd, input) {
     }
     ids.push(id);
     if (!fold.findings.has(id)) {
-      findingRows.push({ v: LEDGER_V, kind: 'finding', ts, id, verdict_id: verdictId, phase, milestone, agent, class: f.class, severity: f.severity, where: f.where, summary: f.summary });
+      findingRows.push({ v: LEDGER_V, kind: 'finding', ts, id, verdict_id: verdictId, phase, milestone, agent, class: f.class, severity: f.severity, where: f.where, summary: f.summary, ...(f.pre_existing ? { pre_existing: true } : {}) });
+      if (f.pre_existing) preExisting.push(id);
     }
   }
 
@@ -395,11 +404,15 @@ function recordVerdict(cwd, input) {
     ...(suppressed.length ? { suppressed } : {}),
     by_severity: bySeverity, by_class: byClass, warnings: parsed.warnings,
     ...(notChecked.length ? { not_checked: notChecked } : {}),
+    ...(verdict.declined && verdict.declined.length ? { declined: verdict.declined } : {}),
     // A plan check is bound to the plans it checked (V7): exec-phase compares this
     // hash with the plans it is about to run.
     ...(agent === 'pan-plan-checker' ? { plans_sha: require('./verify-plan-set.cjs').plansShaFor(cwd, phase) } : {}),
   });
-  appendRows(cwd, [...findingRows, ...newRows, ...resolveRows]);
+  // A pre-existing finding (M52) is in code the phase did not change: debt the milestone
+  // audit reads, never a blocker for this phase.
+  const deferRows = preExisting.map((id) => ({ v: LEDGER_V, kind: 'disposition', ts, id, disposition: 'deferred', reason: `pre-existing: in code phase ${phase} did not change; recorded as debt, not a blocker`, auto: true, verdict_id: verdictId }));
+  appendRows(cwd, [...findingRows, ...newRows, ...resolveRows, ...deferRows]);
 
   const category = { pass: 'verdict_passed', fail: 'verdict_failed', needs_human: 'verdict_needs_human' }[verdict.outcome];
   const serious = (bySeverity.critical || 0) + (bySeverity.high || 0) > 0;
@@ -424,7 +437,7 @@ function recordVerdict(cwd, input) {
     });
   }
 
-  return { ...base, recorded: true, duplicate: false, verdict_id: verdictId, attempt, phase, findings: ids.length, new: findingRows.length, rematched, resolved: resolveRows.length, unaddressed, reopened, suppressed, returned: returned.length, ledger: planningRel(FINDINGS_FILE) };
+  return { ...base, recorded: true, duplicate: false, verdict_id: verdictId, attempt, phase, findings: ids.length, new: findingRows.length, rematched, resolved: resolveRows.length, unaddressed, reopened, suppressed, returned: returned.length, pre_existing: preExisting.length, ...(verdict.declined && verdict.declined.length ? { declined: verdict.declined } : {}), ledger: planningRel(FINDINGS_FILE) };
 }
 
 /**
@@ -577,6 +590,21 @@ function cmdFindingsSuppressions(cwd, opts, raw) {
   output(r, raw, String(r.active));
 }
 
+/**
+ * `findings prove <id> --test <file>` (program R5): run the catching test at the phase's
+ * base and at HEAD, and record the proof. Exit 1 unless it confirms the finding.
+ */
+function cmdFindingsProve(cwd, opts, raw) {
+  if (!requirePlanningTree(cwd)) { output({ error: 'not_a_pan_project', reason: 'no .planning/ directory here' }, raw); return; }
+  const id = opts.id;
+  if (!id || !FINDING_ID_RE.test(id) || !opts.test) error('Usage: findings prove <f_id> --test <test-file> [--timeout <ms>]');
+  const f = foldFindings(readLedger(cwd).rows).findings.get(id);
+  if (!f) { output({ error: 'finding_not_found', id }, raw, 'error', 1); return; }
+  const p = require('./verify-red.cjs').proveFinding(cwd, f.phase, opts.test, { timeoutMs: opts.timeout ? Number(opts.timeout) : undefined });
+  appendRows(cwd, [{ v: LEDGER_V, kind: 'proof', ts: new Date().toISOString(), id, test: p.test, status: p.status }]);
+  output({ id, ...p, confidence: p.status === 'confirmed' ? 'confirmed' : 'candidate' }, raw, p.status, p.status === 'confirmed' ? 0 : 1);
+}
+
 function cmdFindingsDebt(cwd, opts, raw) {
   const r = findingsDebt(cwd, opts);
   output(r, raw, `${r.deferred_count} deferred, ${r.open_count} open`);
@@ -589,6 +617,8 @@ function findingIdsIn(args) {
 
 module.exports = {
   FINDINGS_FILE,
+  sameFinding,
+  cmdFindingsProve,
   STATUSES,
   readLedger,
   foldFindings,

package/pan-wizard-core/bin/lib/focus.cjs

@@ -608,7 +608,7 @@ function listBatchFiles(cwd) {
  *
  * Newest, not oldest. v2.10.0 (E-12) sorted ascending so "older unfinished batches
  * execute before newer ones", but nothing ever marks a batch finished, so it returned
- * the first batch a project planned, every time. `/pan:focus-exec` executes the newest
+ * the first batch a project planned, every time. `/pan:focus-auto --step exec` executes the newest
  * batch, so its `classify-stages` step was classifying a different batch from the one it
  * ran. A batch is a snapshot of the backlog: a newer plan already carries whatever an
  * older one left undone.

package/pan-wizard-core/bin/lib/hosts.cjs

@@ -0,0 +1,88 @@
+'use strict';
+/**
+ * One host table (program A0): how PAN runs each host CLI.
+ *
+ *   runner    the autonomous runner (experiments; the autodev launch builds on it):
+ *             `buildArgs(prompt, opts)` for a run that acts on its own, and `shell`
+ *             ('win32' launches the npm .cmd shim through a shell on Windows, where
+ *             spawnSync cannot resolve it). null: no adapter is written yet.
+ *   family    the model family the host runs by default; the cross-family review lane
+ *             (R4) exists to get a second opinion from a different one. Copilot and
+ *             OpenCode route to several vendors, so theirs names the router.
+ *   review    the cross-family review lane (R4): a read-only run, `promptVia` and
+ *             `args(prompt)`. No flag that writes or auto-approves tools: the reviewer
+ *             reads the change it is given and answers with a verdict block.
+ *   headless  the harness's model steps: `promptVia` ('stdin' | 'arg'), `args(prompt)`
+ *             for hosts whose JSON is not parsed yet, and `parse: true` for the one
+ *             whose output and usage PAN reads (Claude Code; its argv is built by the
+ *             harness with the step's options).
+ *
+ * runner.cjs and harness/src/model.cjs used to keep their own tables, and a host change
+ * had to be made twice. tests/hosts.test.cjs pins the argv both produce.
+ */
+
+const HOSTS = Object.freeze({
+  claude: Object.freeze({
+    bin: 'claude',
+    family: 'anthropic',
+    review: Object.freeze({ promptVia: 'stdin', args: () => ['-p', '--allowedTools', 'Read,Grep,Glob', '--output-format', 'text'] }),
+    runner: Object.freeze({
+      bin: 'claude',
+      buildArgs: (prompt, opts) => {
+        const args = ['-p', '--dangerously-skip-permissions'];
+        if (opts && opts.captureMetrics) args.push('--output-format', 'json');
+        args.push(prompt);
+        return args;
+      },
+      shell: 'win32',
+    }),
+    headless: Object.freeze({ bin: 'claude', promptVia: 'stdin', parse: true }),
+  }),
+  codex: Object.freeze({
+    bin: 'codex',
+    family: 'openai',
+    review: Object.freeze({ promptVia: 'stdin', args: () => ['exec', '--sandbox', 'read-only', '--skip-git-repo-check', '-'] }),
+    runner: Object.freeze({ bin: 'codex', buildArgs: (prompt) => ['exec', prompt], shell: 'win32' }),
+    // `codex exec -` reads the prompt from stdin; --json streams JSONL events.
+    headless: Object.freeze({ bin: 'codex', promptVia: 'stdin', args: () => ['exec', '--json', '--skip-git-repo-check', '--dangerously-bypass-approvals-and-sandbox', '-'] }),
+  }),
+  copilot: Object.freeze({
+    bin: 'copilot',
+    family: 'github',
+    // No --allow-all-tools: a non-interactive run is refused any tool it would ask about.
+    review: Object.freeze({ promptVia: 'arg', args: (p) => ['-p', p] }),
+    // No autonomous adapter yet: `copilot -p` exists, but nothing is written around it.
+    runner: null,
+    // `-p` takes the prompt as an argument; --output-format json is JSONL.
+    headless: Object.freeze({ bin: 'copilot', promptVia: 'arg', args: (p) => ['-p', p, '--output-format', 'json', '--allow-all-tools', '--allow-all-paths'] }),
+  }),
+  gemini: Object.freeze({
+    bin: 'gemini',
+    family: 'google',
+    // Headless `-p` appends standard input to its prompt; default approval refuses writes.
+    review: Object.freeze({ promptVia: 'stdin', args: () => ['-p', 'Review the change on standard input. Reply with the pan-verdict block only.'] }),
+    runner: Object.freeze({ bin: 'gemini', buildArgs: (prompt) => ['-p', '--yolo', prompt], shell: 'win32' }),
+    // `-p` runs headless; -o json; --approval-mode yolo auto-approves tools.
+    headless: Object.freeze({ bin: 'gemini', promptVia: 'arg', args: (p) => ['-p', p, '-o', 'json', '--approval-mode', 'yolo'] }),
+  }),
+  opencode: Object.freeze({
+    bin: 'opencode',
+    family: 'opencode',
+    review: Object.freeze({ promptVia: 'arg', args: (p) => ['run', p] }),
+    runner: Object.freeze({ bin: 'opencode', buildArgs: (prompt) => [prompt], shell: 'win32' }),
+    // `run <message..>` with --format json (raw JSON events).
+    headless: Object.freeze({ bin: 'opencode', promptVia: 'arg', args: (p) => ['run', '--format', 'json', p] }),
+  }),
+});
+
+/** The runner adapters by host, as runner.cjs exposes them (RUNTIME_RUNNERS). */
+function runnerTable() {
+  return Object.freeze(Object.fromEntries(Object.entries(HOSTS).map(([k, h]) => [k, h.runner])));
+}
+
+/** The headless model-step entries by host, as the harness exposes them (MODEL_RUNTIMES). */
+function headlessTable() {
+  return Object.fromEntries(Object.entries(HOSTS).map(([k, h]) => [k, h.headless]));
+}
+
+module.exports = { HOSTS, runnerTable, headlessTable };

package/pan-wizard-core/bin/lib/init.cjs

@@ -71,6 +71,11 @@ function attachPhaseArtifactPaths(result, cwd, phaseDirectory) {
     if (uatFile) {
       result.uat_path = toPosix(path.join(phaseDirectory, uatFile));
     }
+    // L6b: the user's corrections to /pan:assumptions, which discuss and plan read.
+    const assumptionsFile = files.find((f) => f.endsWith('-assumptions.md') || f === 'assumptions.md');
+    if (assumptionsFile) {
+      result.assumptions_path = toPosix(path.join(phaseDirectory, assumptionsFile));
+    }
   } catch {
     // Phase directory may not exist yet or may be unreadable
   }
@@ -150,6 +155,8 @@ function cmdInitExecutePhase(cwd, phase, raw, opts) {
     // Config flags
     commit_docs: config.commit_docs,
     parallelization: config.parallelization,
+    // A3: each pan-exec-waves executor in its own git worktree (Claude Code's Workflow tool).
+    worktree_isolation: (require('./test-gate.cjs').rawConfig(cwd).workflow || {}).worktree_isolation === true,
     branching_strategy: config.branching_strategy,
     phase_branch_template: config.phase_branch_template,
     milestone_branch_template: config.milestone_branch_template,
@@ -337,7 +344,6 @@ function cmdInitNewProject(cwd, raw) {
   const result = {
     // Models
     researcher_model: resolveModelInternal(cwd, 'pan-project-researcher'),
-    synthesizer_model: resolveModelInternal(cwd, 'pan-research-synthesizer'),
     roadmapper_model: resolveModelInternal(cwd, 'pan-roadmapper'),
 
     // Config
@@ -386,7 +392,6 @@ function cmdInitNewMilestone(cwd, raw) {
   const result = {
     // Models
     researcher_model: resolveModelInternal(cwd, 'pan-project-researcher'),
-    synthesizer_model: resolveModelInternal(cwd, 'pan-research-synthesizer'),
     roadmapper_model: resolveModelInternal(cwd, 'pan-roadmapper'),
 
     // Config

package/pan-wizard-core/bin/lib/knowledge.cjs

@@ -51,6 +51,8 @@ const CITATION_ROOTS = [
   '.planning/phases',
   '.planning/milestones',
   '.planning/memory',
+  // P5: resolved debug sessions are evidence a later question can cite.
+  '.planning/debug/resolved',
   'docs',
   'CHANGELOG.md',
   'README.md',

package/pan-wizard-core/bin/lib/merge.cjs

@@ -0,0 +1,50 @@
+'use strict';
+/**
+ * The human merge gate on the CLI (program L6a): what `/pan:army`'s release step uses.
+ *
+ * `merge request <branch> [--phase N] [--ci-green]` stages a merge through the same
+ * gate the MCP bridge uses (mcp/merge-gate.cjs). With `--phase`, verify_pass is the
+ * phase gate's verdict, not the caller's word. The approval token is never printed: it
+ * is for a person, not for the agent that staged the merge.
+ *
+ * `merge confirm <branch>` performs the squash-merge only in an interactive terminal,
+ * after the person types the branch name. An agent runs commands without a TTY, so it
+ * can stage a merge but never approve one. There is deliberately no environment
+ * variable or flag that skips the terminal check: anything an agent can set, an agent
+ * can set to approve itself.
+ */
+const readline = require('readline');
+const { output, error, execGit } = require('./core.cjs');
+const gate = require('../../mcp/merge-gate.cjs');
+
+function cmdMergeRequest(cwd, branch, opts, raw) {
+  if (!branch) error('Usage: merge request <branch> [--phase N] [--ci-green]');
+  let rec;
+  try {
+    rec = gate.requestMerge(cwd, { branch, phase: opts.phase, ci_green: !!opts.ciGreen, now: new Date().toISOString() });
+  } catch (e) { output({ error: 'invalid_branch', reason: e.message }, raw, 'error', 1); return; }
+  const { approval_token: _token, ...shown } = rec;
+  output({ ...shown, next: `A person runs, in their own terminal: pan-tools merge confirm ${rec.branch}` }, raw, rec.status);
+}
+
+function cmdMergeConfirm(cwd, branch, raw) {
+  if (!branch) error('Usage: merge confirm <branch>');
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    output({ error: 'human_terminal_required', reason: 'merge confirm runs only in an interactive terminal: an agent can stage a merge, a person approves it', branch }, raw, 'error', 1);
+    return;
+  }
+  let record;
+  try { record = JSON.parse(require('fs').readFileSync(require('path').join(gate.approvalsDir(cwd), `${gate.slugify(gate.validateBranch(branch))}.json`), 'utf8')); } catch { record = null; }
+  if (!record) { output({ error: 'no_merge_request', branch }, raw, 'error', 1); return; }
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  rl.question(`Squash-merge ${record.branch} into the current branch? CI green: ${record.ci_green}, verified: ${record.verify_pass}. Type the branch name to approve: `, (answer) => {
+    rl.close();
+    if (answer.trim() !== record.branch) { output({ merged: false, reasons: ['not_confirmed'], branch: record.branch }, raw, 'not_confirmed', 1); return; }
+    const env = { ...process.env, PAN_MERGE_APPROVAL: record.approval_token };
+    const git = (argv) => { const r = execGit(cwd, argv); return { ok: r.exitCode === 0, stdout: r.stdout, stderr: r.stderr }; };
+    const r = gate.confirmMerge(cwd, { branch: record.branch }, env, git);
+    output(r, raw, r.merged ? 'merged' : 'refused', r.merged ? 0 : 1);
+  });
+}
+
+module.exports = { cmdMergeRequest, cmdMergeConfirm };

package/pan-wizard-core/bin/lib/mutate.cjs

@@ -17,7 +17,9 @@
  *             `{NN}-mutation.json`
  *
  * `workflow.mutation_gate`: `off` · `report` (the default: a report, never a refusal) ·
- * `gate` (reserved for V5G, which turns survivors into gaps). No coverage is collected:
+ * `gate` (V5G, opt-in: a score below `workflow.mutation_floor`, 0.6, fails the gate, and
+ * verify reconcile then treats a passed verification as a contradiction, so the phase gate
+ * refuses until the tests are stronger). No coverage is collected:
  * the full suite runs per mutant, so the sample is kept small.
  *
  * The operator table started as scripts/mutation-probe.cjs's, which PAN runs on itself;
@@ -29,6 +31,7 @@ const { execGit, findPhaseInternal, output, error, toPosix } = require('./core.c
 
 const MODES = Object.freeze(['off', 'report', 'gate']);
 const DEFAULT_MAX = 8;
+const DEFAULT_FLOOR = 0.6;
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
 
 const C_FAMILY_COMPARE = [
@@ -171,6 +174,12 @@ function mutationMode(cwd) {
  * @param {string} phase
  * @param {{max?: number, seed?: number, timeoutMs?: number}} [opts]
  */
+/** `workflow.mutation_floor`: the score gate mode needs, 0..1; 0.6 unless set. */
+function mutationFloor(cwd) {
+  const v = Number((require('./test-gate.cjs').rawConfig(cwd).workflow || {}).mutation_floor);
+  return Number.isFinite(v) && v >= 0 && v <= 1 ? v : DEFAULT_FLOOR;
+}
+
 function mutatePhase(cwd, phase, opts = {}) {
   const TG = require('./test-gate.cjs');
   const { phaseBase, withWorktree } = require('./verify-red.cjs');
@@ -231,16 +240,18 @@ function mutatePhase(cwd, phase, opts = {}) {
   const results = wt.value.results;
   const killed = results.filter((r) => r.killed).length;
   const survivors = results.filter((r) => !r.killed).map(({ file, line, op, before, after }) => ({ file: toPosix(file), line, op, before: before.trim(), after: after.trim() }));
+  const score = results.length ? Number((killed / results.length).toFixed(2)) : null;
+  const gate = mode === 'gate' && score !== null ? { floor: mutationFloor(cwd), failed: score < mutationFloor(cwd) } : undefined;
   return {
     ...base, checked: results.length > 0, base: b.base, head, command: suite.command,
     candidates: candidates.length, sampled: results.length, killed, survived: survivors.length,
-    score: results.length ? Number((killed / results.length).toFixed(2)) : null, survivors,
+    score, survivors, ...(gate ? { gate } : {}),
   };
 }
 
 /**
  * `pan-tools verify mutate --phase N [--max n] [--seed n] [--timeout ms]`: writes
- * `{NN}-mutation.json` and exits 0 (report mode; V5G adds the gate).
+ * `{NN}-mutation.json`. Exits 0, except in gate mode when the score is below the floor (V5G).
  */
 function cmdVerifyMutate(cwd, opts, raw) {
   if (!opts.phase) error('Usage: verify mutate --phase <N> [--max <n>] [--seed <n>] [--timeout <ms>]');
@@ -251,7 +262,7 @@ function cmdVerifyMutate(cwd, opts, raw) {
   const file = path.join(cwd, info.directory, `${prefix}-mutation.json`);
   fs.writeFileSync(file, JSON.stringify(r, null, 2) + '\n');
   r.record = toPosix(path.relative(cwd, file));
-  output(r, raw, r.aborted ? `aborted:${r.aborted}` : (r.checked ? `${r.killed}/${r.sampled} killed` : 'not_checked'));
+  output(r, raw, r.aborted ? `aborted:${r.aborted}` : (r.checked ? `${r.killed}/${r.sampled} killed${r.gate && r.gate.failed ? ' (gate failed)' : ''}` : 'not_checked'), r.gate && r.gate.failed ? 1 : 0);
 }
 
-module.exports = { OPERATORS, MODES, languageOf, mutableLine, mutationsFor, applyMutation, sample, changedLines, mutationMode, mutatePhase, cmdVerifyMutate };
+module.exports = { mutationFloor, DEFAULT_FLOOR, OPERATORS, MODES, languageOf, mutableLine, mutationsFor, applyMutation, sample, changedLines, mutationMode, mutatePhase, cmdVerifyMutate };