sequant 2.9.0 → 2.10.0

package/dist/src/lib/workflow/platforms/github.d.ts

@@ -9,6 +9,7 @@
  * Async interface methods delegate to the sync implementations.
  */
 import type { PlatformProvider, Issue, CreatePROptions, PRInfo, PRStatus, Comment } from "./platform-provider.js";
+import type { AnnotatedCheck } from "../../qa/infra-blocked-ci.js";
 /**
  * PR merge status values (matches the casing returned by `gh pr view`).
  */
@@ -55,6 +56,30 @@ export interface BatchGitHubResult {
     pullRequests: Record<number, BatchPRInfo>;
     error?: string;
 }
+/**
+ * A single entry in a PR's `statusCheckRollup`.
+ *
+ * `gh pr view N --json statusCheckRollup` returns a heterogeneous array of two
+ * shapes, discriminated by `__typename`:
+ *  - `CheckRun` (GitHub Actions / Checks API): progress in `status`
+ *    (QUEUED | IN_PROGRESS | COMPLETED) with the outcome in `conclusion`.
+ *  - `StatusContext` (legacy commit statuses): combined state in `state`
+ *    (EXPECTED | PENDING | SUCCESS | FAILURE | ERROR).
+ * Only the fields the watch loop consumes are typed; unknown fields are ignored.
+ */
+export interface RollupEntry {
+    __typename?: string;
+    name?: string;
+    context?: string;
+    /** CheckRun progress. */
+    status?: string;
+    /** CheckRun outcome. */
+    conclusion?: string;
+    /** StatusContext combined state. */
+    state?: string;
+}
+/** PR mergeability as reported by `gh pr view --json mergeable`. */
+export type MergeableState = "MERGEABLE" | "CONFLICTING" | "UNKNOWN";
 export declare class GitHubProvider implements PlatformProvider {
     name: string;
     /**
@@ -151,6 +176,45 @@ export declare class GitHubProvider implements PlatformProvider {
      * Used by upstream/issues.ts.
      */
     commentOnIssueWithBodyFileSync(repo: string, issueNumber: number, bodyFile: string): boolean;
+    /**
+     * Fetch a PR's status-check rollup via `statusCheckRollup`.
+     *
+     * Uses `statusCheckRollup`, NOT the known-broken `--json checks` field
+     * (#443 / #818). Returns the raw heterogeneous entries; callers classify
+     * terminal-ness with the helpers in `merge-check/watch.ts`. Returns `[]` on
+     * any error so a transient `gh` failure degrades to "no checks yet" rather
+     * than crashing a poll loop.
+     */
+    getStatusCheckRollupSync(prNumber: number): RollupEntry[];
+    /**
+     * Fetch a PR's mergeability state via `--json mergeable`.
+     *
+     * Right after a push GitHub reports `UNKNOWN` while it recomputes, then
+     * settles to `MERGEABLE` or `CONFLICTING`. `merge --watch` treats
+     * `CONFLICTING` as a dispatch block: CI never starts against an unmergeable
+     * ref. Returns `UNKNOWN` on any error — the safe default that keeps the loop
+     * polling rather than falsely reporting a conflict.
+     */
+    getMergeableStateSync(prNumber: number): MergeableState;
+    /**
+     * Get a PR's head commit SHA via `--json headRefOid`.
+     *
+     * Needed to query the commit's check-run annotations for the billing-lockout
+     * signature. Returns `null` on error.
+     */
+    getPRHeadShaSync(prNumber: number): string | null;
+    /**
+     * Fetch check-run annotations for a commit, shaped for `detectInfraBlockedCi`.
+     *
+     * Lists the commit's check runs (per_page=100, no pagination needed for the
+     * billing-lockout case — every run carries the same annotation, so the first
+     * page is representative), then fetches annotations for each run that reports
+     * any. Used only when the whole board is failing, to recognise the "job was
+     * not started" signature (#820). Degrades to `[]` on any error (404, rate
+     * limit, revoked token) so a broken-CI situation never crashes the watch
+     * loop — `detectInfraBlockedCi` then reads that as "not infra-blocked".
+     */
+    getCheckRunAnnotationsSync(headSha: string): AnnotatedCheck[];
     fetchIssue(id: string): Promise<Issue>;
     postComment(issueId: string, body: string): Promise<void>;
     addLabel(issueId: string, label: string): Promise<void>;

package/dist/src/lib/workflow/platforms/github.js

@@ -414,6 +414,158 @@ export class GitHubProvider {
             return false;
         }
     }
+    // ─── Watch / CI-rollup helpers (for `merge --watch`, #818) ─────────
+    /**
+     * Fetch a PR's status-check rollup via `statusCheckRollup`.
+     *
+     * Uses `statusCheckRollup`, NOT the known-broken `--json checks` field
+     * (#443 / #818). Returns the raw heterogeneous entries; callers classify
+     * terminal-ness with the helpers in `merge-check/watch.ts`. Returns `[]` on
+     * any error so a transient `gh` failure degrades to "no checks yet" rather
+     * than crashing a poll loop.
+     */
+    getStatusCheckRollupSync(prNumber) {
+        try {
+            const result = spawnSync("gh", [
+                "pr",
+                "view",
+                String(prNumber),
+                "--json",
+                "statusCheckRollup",
+                "-q",
+                ".statusCheckRollup",
+            ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 15000 });
+            if (result.status !== 0 || !result.stdout)
+                return [];
+            const parsed = JSON.parse(result.stdout);
+            return Array.isArray(parsed) ? parsed : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Fetch a PR's mergeability state via `--json mergeable`.
+     *
+     * Right after a push GitHub reports `UNKNOWN` while it recomputes, then
+     * settles to `MERGEABLE` or `CONFLICTING`. `merge --watch` treats
+     * `CONFLICTING` as a dispatch block: CI never starts against an unmergeable
+     * ref. Returns `UNKNOWN` on any error — the safe default that keeps the loop
+     * polling rather than falsely reporting a conflict.
+     */
+    getMergeableStateSync(prNumber) {
+        try {
+            const result = spawnSync("gh", [
+                "pr",
+                "view",
+                String(prNumber),
+                "--json",
+                "mergeable",
+                "-q",
+                ".mergeable",
+            ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 10000 });
+            if (result.status === 0 && result.stdout) {
+                const state = result.stdout.toString().trim().toUpperCase();
+                if (state === "MERGEABLE" ||
+                    state === "CONFLICTING" ||
+                    state === "UNKNOWN") {
+                    return state;
+                }
+            }
+        }
+        catch {
+            // fall through to UNKNOWN
+        }
+        return "UNKNOWN";
+    }
+    /**
+     * Get a PR's head commit SHA via `--json headRefOid`.
+     *
+     * Needed to query the commit's check-run annotations for the billing-lockout
+     * signature. Returns `null` on error.
+     */
+    getPRHeadShaSync(prNumber) {
+        try {
+            const result = spawnSync("gh", [
+                "pr",
+                "view",
+                String(prNumber),
+                "--json",
+                "headRefOid",
+                "-q",
+                ".headRefOid",
+            ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 10000 });
+            if (result.status === 0 && result.stdout) {
+                const sha = result.stdout.toString().trim();
+                return sha || null;
+            }
+        }
+        catch {
+            // fall through to null
+        }
+        return null;
+    }
+    /**
+     * Fetch check-run annotations for a commit, shaped for `detectInfraBlockedCi`.
+     *
+     * Lists the commit's check runs (per_page=100, no pagination needed for the
+     * billing-lockout case — every run carries the same annotation, so the first
+     * page is representative), then fetches annotations for each run that reports
+     * any. Used only when the whole board is failing, to recognise the "job was
+     * not started" signature (#820). Degrades to `[]` on any error (404, rate
+     * limit, revoked token) so a broken-CI situation never crashes the watch
+     * loop — `detectInfraBlockedCi` then reads that as "not infra-blocked".
+     */
+    getCheckRunAnnotationsSync(headSha) {
+        try {
+            const listResult = spawnSync("gh", [
+                "api",
+                `repos/{owner}/{repo}/commits/${headSha}/check-runs?per_page=100`,
+                "-q",
+                ".check_runs",
+            ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 15000 });
+            if (listResult.status !== 0 || !listResult.stdout)
+                return [];
+            const runs = JSON.parse(listResult.stdout);
+            if (!Array.isArray(runs))
+                return [];
+            const annotated = [];
+            for (const run of runs) {
+                const checkName = typeof run?.name === "string" ? run.name : "unknown";
+                const id = run?.id;
+                if (typeof id !== "number" && typeof id !== "string")
+                    continue;
+                // Skip runs that explicitly report zero annotations; keep fetching when
+                // the count is unknown, so a missing field never hides the signature.
+                const count = run?.output?.annotations_count;
+                if (typeof count === "number" && count === 0)
+                    continue;
+                const annResult = spawnSync("gh", ["api", `repos/{owner}/{repo}/check-runs/${id}/annotations`], {
+                    encoding: "utf-8",
+                    stdio: ["pipe", "pipe", "pipe"],
+                    timeout: 15000,
+                });
+                if (annResult.status !== 0 || !annResult.stdout) {
+                    annotated.push({ checkName, annotations: [] });
+                    continue;
+                }
+                try {
+                    const annotations = JSON.parse(annResult.stdout);
+                    annotated.push({
+                        checkName,
+                        annotations: Array.isArray(annotations) ? annotations : [],
+                    });
+                }
+                catch {
+                    annotated.push({ checkName, annotations: [] });
+                }
+            }
+            return annotated;
+        }
+        catch {
+            return [];
+        }
+    }
     // ─── Async interface methods (PlatformProvider) ────────────────────
     async fetchIssue(id) {
         const result = spawnSync("gh", ["issue", "view", id, "--json", "number,title,body,labels,state"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 15000 });

package/dist/src/lib/workflow/qa-cache.d.ts

@@ -130,6 +130,8 @@ export interface QACacheOptions {
     defaultTtl?: number;
     /** Enable verbose logging */
     verbose?: boolean;
+    /** Repository directory for git operations (default: process.cwd()) */
+    cwd?: string;
 }
 /**
  * Result of cache lookup
@@ -153,6 +155,7 @@ export declare class QACache {
     private cacheDir;
     private defaultTtl;
     private verbose;
+    private cwd;
     private cachedState;
     constructor(options?: QACacheOptions);
     /**
@@ -160,9 +163,11 @@ export declare class QACache {
      */
     getCachePath(): string;
     /**
-     * Compute hash of git diff between main and HEAD
+     * Compute hash of git diff between the resolved base and HEAD
      *
      * This provides a content-based cache key that changes when code changes.
+     * The base is resolved via resolveDiffBase so a stale local main does not
+     * leak merged-upstream content into the cache key (#890).
      */
     computeDiffHash(): string;
     /**

package/dist/src/lib/workflow/qa-cache.js

@@ -27,8 +27,9 @@
 import * as fs from "fs";
 import * as path from "path";
 import * as crypto from "crypto";
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { z } from "zod";
+import { resolveDiffBase } from "./git-diff-utils.js";
 /**
  * Check types that can be cached
  */
@@ -74,7 +75,7 @@ export const CachedCheckResultSchema = z.object({
 export const QARunContextSchema = z.object({
     /** Git HEAD SHA at the time of QA completion */
     lastQACommitSHA: z.string(),
-    /** Diff hash (main...HEAD) at the time of QA */
+    /** Diff hash (resolved base...HEAD) at the time of QA */
     lastQADiffHash: z.string(),
     /** Map of AC ID → status from the last QA run */
     acStatuses: z.record(z.string(), z.enum(["met", "not_met", "partially_met", "pending", "blocked"])),
@@ -139,11 +140,13 @@ export class QACache {
     cacheDir;
     defaultTtl;
     verbose;
+    cwd;
     cachedState = null;
     constructor(options = {}) {
         this.cacheDir = options.cacheDir ?? DEFAULT_CACHE_DIR;
         this.defaultTtl = options.defaultTtl ?? DEFAULT_TTL;
         this.verbose = options.verbose ?? false;
+        this.cwd = options.cwd ?? process.cwd();
     }
     /**
      * Get the cache file path
@@ -152,14 +155,18 @@ export class QACache {
         return path.join(this.cacheDir, "cache.json");
     }
     /**
-     * Compute hash of git diff between main and HEAD
+     * Compute hash of git diff between the resolved base and HEAD
      *
      * This provides a content-based cache key that changes when code changes.
+     * The base is resolved via resolveDiffBase so a stale local main does not
+     * leak merged-upstream content into the cache key (#890).
      */
     computeDiffHash() {
         try {
-            // Get the diff content between main and HEAD
-            const diff = execSync("git diff main...HEAD", {
+            // Get the diff content between the resolved base and HEAD
+            const base = resolveDiffBase(this.cwd, "main");
+            const diff = execFileSync("git", ["diff", `${base}...HEAD`], {
+                cwd: this.cwd,
                 encoding: "utf-8",
                 maxBuffer: 10 * 1024 * 1024, // 10MB buffer
             });
@@ -236,7 +243,9 @@ export class QACache {
      */
     async checkGlobalInvalidation() {
         try {
-            const changedFiles = execSync("git diff main...HEAD --name-only", {
+            const base = resolveDiffBase(this.cwd, "main");
+            const changedFiles = execFileSync("git", ["diff", `${base}...HEAD`, "--name-only"], {
+                cwd: this.cwd,
                 encoding: "utf-8",
             })
                 .trim()
@@ -263,7 +272,9 @@ export class QACache {
             return false;
         }
         try {
-            const changedFiles = execSync("git diff main...HEAD --name-only", {
+            const base = resolveDiffBase(this.cwd, "main");
+            const changedFiles = execFileSync("git", ["diff", `${base}...HEAD`, "--name-only"], {
+                cwd: this.cwd,
                 encoding: "utf-8",
             })
                 .trim()
@@ -432,7 +443,8 @@ export class QACache {
             return null;
         }
         try {
-            const diff = execSync(`git diff ${sinceCommit}...HEAD`, {
+            const diff = execFileSync("git", ["diff", `${sinceCommit}...HEAD`], {
+                cwd: this.cwd,
                 encoding: "utf-8",
                 maxBuffer: 10 * 1024 * 1024,
             });
@@ -460,7 +472,8 @@ export class QACache {
             return null;
         }
         try {
-            const output = execSync(`git diff ${sinceCommit}...HEAD --name-only`, {
+            const output = execFileSync("git", ["diff", `${sinceCommit}...HEAD`, "--name-only"], {
+                cwd: this.cwd,
                 encoding: "utf-8",
             });
             return output.trim().split("\n").filter(Boolean);

package/dist/src/lib/workflow/ready-gate.d.ts

@@ -26,6 +26,7 @@ import type { QaVerdict } from "./run-log-schema.js";
 import type { ReadyPolicy } from "../settings.js";
 import type { IssueStatus } from "./state-schema.js";
 import { type LoopProgressSnapshot } from "./qa-stagnation.js";
+import { type ExecChangeState } from "./phase-executor.js";
 export type { ReadyPolicy } from "../settings.js";
 /**
  * Why the gate stopped. Drives `ready`, the persisted issue status, and the
@@ -44,8 +45,20 @@ export type ReadyTerminalReason =
  | "LOOP_NO_DIFF"
 /** Guard: `/loop` phase itself failed. Needs human. */
  | "LOOP_FAILED"
-/** #534: zero-diff exec or null/unparseable QA verdict. Not ready. */
- | "NO_IMPLEMENTATION";
+/** #534: zero-diff exec worktree — nothing was built. Not ready. */
+ | "NO_IMPLEMENTATION"
+/**
+ * #879: the worktree is dirty but has no commits. Distinct from
+ * NO_IMPLEMENTATION — work exists, but uncommitted work cannot rebase, push,
+ * or become a PR, so it is not certifiable as-is. Re-run once it is committed.
+ */
+ | "UNCOMMITTED_ONLY"
+/**
+ * #853: QA ran but produced no verdict (deferred its one-shot turn, or
+ * output was unparseable). Distinct from NO_IMPLEMENTATION — the
+ * implementation may be complete; it is the *review* that is missing.
+ */
+ | "NO_VERDICT";
 /** A single gap surfaced by QA, classified for the report. */
 export interface ReadyGapItem {
     /** Gap description as surfaced by QA. */
@@ -110,8 +123,8 @@ export interface RunReadyGateOptions {
     onProgress?: ProgressCallback;
     /** Injectable token reader — defaults to reading `<worktree>/.sequant`. */
     readTokensUsed?: (worktreePath: string) => number;
-    /** Injectable change detector — defaults to {@link hasExecChanges}. */
-    hasChangesFn?: (cwd: string) => boolean;
+    /** Injectable change classifier — defaults to {@link classifyExecChanges}. */
+    classifyChangesFn?: (cwd: string) => ExecChangeState;
     /** Injectable loop-progress snapshot — defaults to {@link snapshotLoopProgress}. */
     snapshotFn?: (cwd: string) => LoopProgressSnapshot;
 }

package/dist/src/lib/workflow/ready-gate.js

@@ -22,7 +22,7 @@
  * lives in `src/commands/ready.ts`.
  */
 import { snapshotLoopProgress, compareLoopProgress, } from "./qa-stagnation.js";
-import { hasExecChanges } from "./phase-executor.js";
+import { classifyExecChanges } from "./phase-executor.js";
 import { readTokenUsageFiles, aggregateTokenUsage, TOKEN_USAGE_DIR, } from "./token-utils.js";
 import * as path from "path";
 /**
@@ -180,7 +180,11 @@ export function formatReadyReport(result) {
         ? "✅ READY — awaiting human merge decision"
         : result.reason === "NO_IMPLEMENTATION"
             ? "⛔ NOT READY — no implementation detected"
-            : "⚠️ NOT READY — needs human intervention";
+            : result.reason === "UNCOMMITTED_ONLY"
+                ? "⛔ NOT READY — work is uncommitted"
+                : result.reason === "NO_VERDICT"
+                    ? "⛔ NOT READY — QA produced no verdict"
+                    : "⚠️ NOT READY — needs human intervention";
     const reasonText = {
         AC_MET: "Acceptance Criteria are objectively met (no AC_NOT_MET). Remaining gaps are quality-only and reported below (policy `ac` does not auto-fix them).",
         READY_FOR_MERGE: "QA returned READY_FOR_MERGE.",
@@ -188,7 +192,9 @@ export function formatReadyReport(result) {
         TOKEN_BUDGET: "Token budget exhausted before reaching the policy threshold. A human should review the remaining gaps.",
         LOOP_NO_DIFF: "The fix loop made no diff (stagnation guard). Manual intervention required.",
         LOOP_FAILED: "The fix loop phase failed. A human should investigate before merging.",
-        NO_IMPLEMENTATION: "Zero-diff worktree or null/unparseable QA verdict — there is nothing to certify (#534 guard).",
+        NO_IMPLEMENTATION: "Zero-diff worktree — there is nothing to certify (#534 guard).",
+        UNCOMMITTED_ONLY: "The worktree has uncommitted changes but no commits (#879 guard). Uncommitted work cannot rebase, push, or become a PR — commit it, then re-run the gate.",
+        NO_VERDICT: "QA ran but produced no verdict (deferred one-shot turn or unparseable output) — there is nothing to certify (#534/#853 guard). The implementation may exist; re-run the gate once QA emits a verdict.",
     };
     const lines = [];
     lines.push(`## sequant ready — Issue #${result.issueNumber}`);
@@ -231,7 +237,7 @@ export function formatReadyReport(result) {
 export async function runReadyGate(opts) {
     const { issueNumber, worktreePath, policy, maxIterations, tokenBudget, nonGoals = [], } = opts;
     const readTokensUsed = opts.readTokensUsed ?? defaultReadTokensUsed;
-    const hasChangesFn = opts.hasChangesFn ?? hasExecChanges;
+    const classifyChangesFn = opts.classifyChangesFn ?? classifyExecChanges;
     const snapshotFn = opts.snapshotFn ?? snapshotLoopProgress;
     // #697: run a phase while emitting live-progress events around it. `iteration`
     // is the 1-based QA-pass index so the renderer can render `loop N/M`. Emits
@@ -296,15 +302,25 @@ export async function runReadyGate(opts) {
         const qaResult = await runPhaseTracked("qa", buildPhaseConfig(opts, { fullQa: true }), iterations);
         tokensUsed = readTokensUsed(worktreePath);
         const verdict = qaResult.verdict ?? null;
-        // #534 guard: a null/unparseable verdict is never "ready".
+        // #534 guard: a null verdict is never "ready". #853: report it as
+        // NO_VERDICT, not NO_IMPLEMENTATION — a deferred/unparseable QA turn says
+        // nothing about whether an implementation exists, and the misleading label
+        // sent debuggers to the wrong place (same class as the phase-executor
+        // "unparseable verdict" split).
         if (!verdict) {
-            return finish("NO_IMPLEMENTATION");
+            return finish("NO_VERDICT");
         }
-        // #534 guard: an empty worktree (no commits, no uncommitted work) is never
-        // "ready" — replays the #529/#570 empty-branch class.
-        if (!hasChangesFn(worktreePath)) {
+        // #534/#879 guard: a worktree with no commits is never "ready". Split by
+        // cause so the report is not misleading: `none` is the empty-branch class
+        // (#529/#570), `uncommitted` is a dirty tree whose work cannot become a PR
+        // until committed (#879). `commits`/`unknown` continue (unknown fails open).
+        const changes = classifyChangesFn(worktreePath);
+        if (changes.kind === "none") {
             return finish("NO_IMPLEMENTATION");
         }
+        if (changes.kind === "uncommitted") {
+            return finish("UNCOMMITTED_ONLY");
+        }
         finalVerdict = verdict;
         const gaps = qaResult.summary?.gaps ?? [];
         remaining = classifyGaps(gaps, nonGoals);

package/dist/src/lib/workflow/run-log-schema.d.ts

@@ -260,6 +260,8 @@ export declare const IssueLogSchema: z.ZodObject<{
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     totalDurationSeconds: z.ZodNumber;
+    aborted: z.ZodOptional<z.ZodBoolean>;
+    abortReason: z.ZodOptional<z.ZodString>;
     prNumber: z.ZodOptional<z.ZodNumber>;
     prUrl: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -284,6 +286,7 @@ export declare const RunSummarySchema: z.ZodObject<{
     passed: z.ZodNumber;
     failed: z.ZodNumber;
     partial: z.ZodDefault<z.ZodNumber>;
+    aborted: z.ZodDefault<z.ZodNumber>;
     totalDurationSeconds: z.ZodNumber;
 }, z.core.$strip>;
 export type RunSummary = z.infer<typeof RunSummarySchema>;
@@ -381,6 +384,8 @@ export declare const RunLogSchema: z.ZodObject<{
             }, z.core.$strip>>;
         }, z.core.$strip>>;
         totalDurationSeconds: z.ZodNumber;
+        aborted: z.ZodOptional<z.ZodBoolean>;
+        abortReason: z.ZodOptional<z.ZodString>;
         prNumber: z.ZodOptional<z.ZodNumber>;
         prUrl: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
@@ -389,10 +394,12 @@ export declare const RunLogSchema: z.ZodObject<{
         passed: z.ZodNumber;
         failed: z.ZodNumber;
         partial: z.ZodDefault<z.ZodNumber>;
+        aborted: z.ZodDefault<z.ZodNumber>;
         totalDurationSeconds: z.ZodNumber;
     }, z.core.$strip>;
     startCommit: z.ZodOptional<z.ZodString>;
     endCommit: z.ZodOptional<z.ZodString>;
+    abortedBy: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type RunLog = z.infer<typeof RunLogSchema>;
 /**
@@ -421,6 +428,7 @@ export declare function generateLogFilename(runId: string, startTime: Date): str
  */
 export declare function createEmptyRunLog(config: RunConfig, options?: {
     startCommit?: string;
+    startTime?: Date;
 }): Omit<RunLog, "endTime">;
 /**
  * Create a phase log entry
@@ -448,6 +456,7 @@ export declare function completePhaseLog(phaseLog: Omit<PhaseLog, "endTime" | "d
  */
 export declare function finalizeRunLog(runLog: Omit<RunLog, "endTime">, options?: {
     endCommit?: string;
+    abortedBy?: string;
 }): RunLog;
 /**
  * Derive an issue's overall log status from its phase log entries (#766).
@@ -460,5 +469,10 @@ export declare function finalizeRunLog(runLog: Omit<RunLog, "endTime">, options?
  * verdict (mirrors the live-card rule); an unrecovered failure still leaves a
  * non-loop phase failed. Priority among latest attempts: failure > timeout >
  * success.
+ *
+ * An issue with no phase entries is a `failure`, not a `success` (#856). The
+ * only way to reach that state is for `startIssue` to have run while no phase
+ * ever completed — i.e. the run was cut short. Returning `success` there is
+ * what let a SIGTERM'd run persist as a pass with an empty `phases[]`.
  */
 export declare function deriveIssueLogStatus(phases: PhaseLog[]): IssueStatus;

package/dist/src/lib/workflow/run-log-schema.js

@@ -180,6 +180,20 @@ export const IssueLogSchema = z.object({
     phases: z.array(PhaseLogSchema),
     /** Total execution time in seconds */
     totalDurationSeconds: z.number().nonnegative(),
+    /**
+     * Set when this issue never finished because the run was terminated from
+     * outside (#856). Reuses the `"failure"` status — additive boolean rather
+     * than a new `IssueStatus` enum value, matching the `capped` precedent
+     * above, so the persisted-log schema stays stable at `version: 1`.
+     *
+     * Without this, a run killed mid-flight persisted as `success`: `startIssue`
+     * seeds `status: "success"` and only `logPhase` ever revises it, so an issue
+     * whose first phase never completed was written out as a pass with an empty
+     * `phases[]`.
+     */
+    aborted: z.boolean().optional(),
+    /** Human-readable cause of the abort (e.g. `terminated by SIGTERM`). */
+    abortReason: z.string().optional(),
     /** PR number if created after successful QA */
     prNumber: z.number().int().positive().optional(),
     /** PR URL if created after successful QA */
@@ -219,6 +233,14 @@ export const RunSummarySchema = z.object({
      * `.default(0)` keeps logs written before this field parseable.
      */
     partial: z.number().int().nonnegative().default(0),
+    /**
+     * Number of issues cut short by an external signal (#856). A sub-count of
+     * `failed`, not a fourth disjoint bucket — aborted issues carry
+     * `status: "failure"` so existing consumers keep working, and this field
+     * says whether the failure was the run's own or something killing it.
+     * `.default(0)` keeps logs written before this field parseable.
+     */
+    aborted: z.number().int().nonnegative().default(0),
     /** Total execution time in seconds */
     totalDurationSeconds: z.number().nonnegative(),
 });
@@ -246,6 +268,11 @@ export const RunLogSchema = z.object({
     startCommit: z.string().optional(),
     /** Git commit SHA at run end (AC-2) */
     endCommit: z.string().optional(),
+    /**
+     * Signal that terminated the run, when it ended by external signal rather
+     * than by finishing (#856). Present iff at least one issue is `aborted`.
+     */
+    abortedBy: z.string().optional(),
 });
 /**
  * Default log directory paths
@@ -276,7 +303,9 @@ export function generateLogFilename(runId, startTime) {
  */
 export function createEmptyRunLog(config, options) {
     const runId = randomUUID();
-    const startTime = new Date().toISOString();
+    // #867: use the caller-supplied run origin when provided so the log's wall
+    // clock shares the orchestrator's start; fall back to now for standalone use.
+    const startTime = (options?.startTime ?? new Date()).toISOString();
     return {
         version: 1,
         runId,
@@ -288,6 +317,7 @@ export function createEmptyRunLog(config, options) {
             passed: 0,
             failed: 0,
             partial: 0,
+            aborted: 0,
             totalDurationSeconds: 0,
         },
         startCommit: options?.startCommit,
@@ -343,6 +373,11 @@ export function finalizeRunLog(runLog, options) {
     // #766: `partial` gets its own bucket so an all-partial run isn't counted as
     // `0 passed · 0 failed` — it landed in neither before.
     const partial = runLog.issues.filter((i) => i.status === "partial").length;
+    // #856: aborted issues are also counted in `failed` (they carry
+    // `status: "failure"`); this is the sub-count that says *why* they failed,
+    // so a run killed from outside is distinguishable from one whose phases
+    // genuinely failed.
+    const aborted = runLog.issues.filter((i) => i.aborted).length;
     return {
         ...runLog,
         endTime: endTime.toISOString(),
@@ -351,9 +386,13 @@ export function finalizeRunLog(runLog, options) {
             passed,
             failed,
             partial,
+            aborted,
             totalDurationSeconds,
         },
         endCommit: options?.endCommit ?? runLog.endCommit,
+        ...((options?.abortedBy ?? runLog.abortedBy) && {
+            abortedBy: options?.abortedBy ?? runLog.abortedBy,
+        }),
     };
 }
 /**
@@ -367,6 +406,11 @@ export function finalizeRunLog(runLog, options) {
  * verdict (mirrors the live-card rule); an unrecovered failure still leaves a
  * non-loop phase failed. Priority among latest attempts: failure > timeout >
  * success.
+ *
+ * An issue with no phase entries is a `failure`, not a `success` (#856). The
+ * only way to reach that state is for `startIssue` to have run while no phase
+ * ever completed — i.e. the run was cut short. Returning `success` there is
+ * what let a SIGTERM'd run persist as a pass with an empty `phases[]`.
  */
 export function deriveIssueLogStatus(phases) {
     const latest = new Map();
@@ -376,6 +420,8 @@ export function deriveIssueLogStatus(phases) {
         latest.set(p.phase, p.status);
     }
     const statuses = [...latest.values()];
+    if (statuses.length === 0)
+        return "failure";
     if (statuses.some((s) => s === "failure"))
         return "failure";
     if (statuses.some((s) => s === "timeout"))