specrails-desktop 2.64.2 → 2.65.0

package/server/dist/modules/loops/runtime/loop-run-manager.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoopRunManager = void 0;
+exports.LoopRunManager = exports.BUDGET_PAUSED = void 0;
 exports.truncate = truncate;
 exports.resolveRunVars = resolveRunVars;
 exports.seedChangeId = seedChangeId;
@@ -11,6 +11,7 @@ exports.openspecChangeState = openspecChangeState;
 exports.extractChangeId = extractChangeId;
 exports.recoverOrphanLoopStepAccounting = recoverOrphanLoopStepAccounting;
 const crypto_1 = require("crypto");
+const audit_1 = require("../../audit");
 const loop_definition_events_1 = require("./loop-definition-events");
 const legacy_launch_telemetry_1 = require("./legacy-launch-telemetry");
 const loop_definition_run_1 = require("./loop-definition-run");
@@ -30,7 +31,9 @@ const loop_step_idle_1 = require("./loop-step-idle");
 const loop_decider_1 = require("./loop-decider");
 const loop_runs_store_1 = require("./loop-runs-store");
 const ai_invocations_1 = require("../../accounting/runtime/ai-invocations");
+const execution_1 = require("../../execution");
 const provider_limit_1 = require("../../../provider-limit");
+const recovery_1 = require("../../recovery");
 const ids_1 = require("../../../ids");
 const providers_1 = require("../../../providers");
 const agent_runtime_accounting_1 = require("../../agent-runtime/runtime/agent-runtime-accounting");
@@ -205,6 +208,9 @@ function extractChangeId(text) {
     const m = CHANGE_ID_RE.exec(text);
     return m ? m[1] : undefined;
 }
+/** Pause kind recorded on `loop_runs.restart_reason` and the paused event for a
+ *  run stopped between AI steps by the daily budget. Resumable in place. */
+exports.BUDGET_PAUSED = 'budget_paused';
 function programmaticUsageAvailability(db, runId) {
     const row = db.prepare(`SELECT COUNT(*) AS count,
     MAX(total_cost_usd IS NULL) AS cost_unknown,
@@ -467,7 +473,9 @@ class LoopRunManager {
     _pausedHumanDecisions = new Map();
     constructor(db, broadcast, executors, now = () => Date.now(), 
     /** `idleTimeoutMs`: override the env-resolved loop-step idle watchdog
-     *  (tests). Undefined ⇒ resolveLoopStepIdleTimeoutMs() per run. */
+     *  (tests). Undefined ⇒ resolveLoopStepIdleTimeoutMs() per run.
+     *  `dailyBudget`: the project/app-wide daily budget gate (null = within
+     *  budget). Consulted between AI steps; absent ⇒ no budget guard. */
     options = {}) {
         this.db = db;
         this.broadcast = broadcast;
@@ -475,6 +483,57 @@ class LoopRunManager {
         this.now = now;
         this.options = options;
     }
+    /** Live per-run soft cap state of the runs this manager is executing. */
+    _runCaps = new Map();
+    /** Best-effort budget read: an unreadable budget never stops a run. */
+    _dailyBudgetBreach() {
+        try {
+            return this.options.dailyBudget?.() ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The per-run soft cap, when this run's provider-reported cost has reached it. */
+    _runCapBreach(runId) {
+        const state = this._runCaps.get(runId);
+        if (!state || !(0, execution_1.isRunCapCrossed)(state.capUsd, state.cost()))
+            return null;
+        return (0, execution_1.runCapRejection)(state.capUsd, state.cost());
+    }
+    /** Daily/weekly/monthly cap first (refuses outright), then the run's soft cap. */
+    _budgetBreach(runId) {
+        return this._dailyBudgetBreach() ?? this._runCapBreach(runId);
+    }
+    /** The budget a run is paused on (`budget_paused`), else null. */
+    budgetPause(runId) {
+        const budget = this._pausedHumanDecisions.get(runId)?.budget;
+        return budget ? structuredClone(budget) : null;
+    }
+    /** Resume a `budget_paused` run once the budget allows the next step. While
+     *  still exhausted the run stays paused and the caller gets the 409 body. */
+    resumeBudgetPause(runId, choice) {
+        const paused = this._pausedHumanDecisions.get(runId);
+        if (!paused?.budget)
+            return { status: 'not_budget_paused' };
+        // The person's answer to a per-run soft cap: waive it for this run, or move it up.
+        const state = this._runCaps.get(runId);
+        if (state && choice) {
+            state.capUsd = 'ignore' in choice ? null : choice.raiseTo;
+            try {
+                (0, loop_runs_store_1.writeLoopRunCap)(this.db, runId, state.capUsd ?? 0);
+            }
+            catch { /* the in-memory choice still applies */ }
+        }
+        const rejection = this._budgetBreach(runId);
+        if (rejection) {
+            paused.budget = rejection;
+            return { status: 'over_budget', rejection: structuredClone(rejection) };
+        }
+        this._pausedHumanDecisions.delete(runId);
+        paused.resolve({ action: 'resume', text: '' });
+        return { status: 'resumed' };
+    }
     /** WebSocket delivery is advisory. A disconnected/misbehaving listener must
      * never change launch, accounting, traversal, or terminal outcomes. */
     _emit(msg) {
@@ -585,6 +644,8 @@ class LoopRunManager {
         if (this.definitionForkOwnsRun(jobId))
             return false;
         const paused = this._pausedHumanDecisions.get(jobId);
+        if (paused?.budget)
+            return this.resumeBudgetPause(jobId).status === 'resumed';
         if (paused) {
             if (paused.pending?.length) {
                 const selected = control?.interruptId ? paused.pending.find(item => item.id === control.interruptId) : paused.pending.length === 1 ? paused.pending[0] : undefined;
@@ -811,7 +872,7 @@ class LoopRunManager {
         const maxIterations = req.graph.config.maxIterations;
         // 0 ⇒ no whole-run deadline (built-in pipeline loops opt out of the wall
         // clock; maxIterations / maxCostUsd remain the runaway guards).
-        const deadline = req.graph.config.timeoutMinutes > 0
+        let deadline = req.graph.config.timeoutMinutes > 0
             ? this.now() + req.graph.config.timeoutMinutes * 60_000
             : Infinity;
         // Per-step AI timeout (ms) — undefined falls back to the executor default,
@@ -941,6 +1002,8 @@ class LoopRunManager {
         const emitStepEnd = (input) => {
             if (!openStep)
                 return;
+            if (input.status === 'failed')
+                failedStepId = openStep.nodeId;
             const payload = {
                 index: openStep.index,
                 nodeId: openStep.nodeId,
@@ -968,6 +1031,9 @@ class LoopRunManager {
         // identical to QueueManager — so JobStatusPanel parses real activity
         // (thinking/reading/editing/tool steps) instead of staying on "Connecting…".
         // Non-JSON lines fall back to a plain log line.
+        // Agent actions audit for one-shot AI steps (provider JSONL) and Core
+        // agent-event tool lines. Observing only: a tap failure never reaches the run.
+        const auditTap = this.options.agentAudit ? (0, audit_1.createStreamAuditTap)(this.options.agentAudit, { runId, jobId: runId, role: 'loop' }) : null;
         const onRawLine = (line) => {
             if (!line)
                 return;
@@ -978,6 +1044,7 @@ class LoopRunManager {
                     eventType = parsed.type;
                 else if (typeof parsed.role === 'string')
                     eventType = parsed.role;
+                auditTap?.(parsed);
             }
             catch { /* not JSON */ }
             if (!eventType) {
@@ -1040,10 +1107,38 @@ class LoopRunManager {
         let outcome = 'failed';
         let stallReason;
         let providerLimitHit;
+        // Failure diagnosis inputs (recovery module): the last failing step, its error text, Core's own record.
+        let failedStepId;
+        let failureText;
+        let coreFailure;
         let iteration = 0;
         let totalCost = 0;
         let totalTokens = 0;
         let totalDuration = 0;
+        // Per-run soft cap ("pause and ask at $X"): this launch's override, else what
+        // the run was already given (a restart keeps the person's choice), else the
+        // project/app default. The cost read is the run's provider-reported total.
+        {
+            let cap = null;
+            try {
+                const stored = (0, loop_runs_store_1.readLoopRunCap)(this.db, runId);
+                // A resumed run keeps what it was given (and what the person decided
+                // since): the frozen request's override applies to a FRESH launch only.
+                const override = !continuation && req.runCapUsd !== undefined ? req.runCapUsd : undefined;
+                if (override !== undefined)
+                    cap = override > 0 ? override : null;
+                else if (stored !== undefined)
+                    cap = stored > 0 ? stored : null;
+                else
+                    cap = this.options.runCapDefault?.() ?? null;
+                if (override !== undefined || stored === undefined)
+                    (0, loop_runs_store_1.writeLoopRunCap)(this.db, runId, cap ?? 0);
+            }
+            catch {
+                cap = null;
+            }
+            this._runCaps.set(runId, { capUsd: cap, cost: () => totalCost });
+        }
         let finalJobUsage = {
             tokensIn: usageTelemetryAvailable ? 0 : null,
             tokensOut: usageTelemetryAvailable ? 0 : null,
@@ -1286,6 +1381,81 @@ class LoopRunManager {
             });
             return decision;
         };
+        // rail-loop-budget-guard: the daily budget ran out between AI steps. The run
+        // parks as `paused` (restart_reason `budget_paused`) on the same in-process
+        // pause the human-decision path uses — no new lifecycle. Resume re-checks the
+        // budget and continues from the next step; Stop settles 'stopped'. The pause
+        // does not consume the run's wall-clock deadline.
+        const awaitBudget = async (breach) => {
+            let current = breach;
+            for (;;) {
+                const reason = `${current.detail} ${current.action}`;
+                const decisionPromise = new Promise((resolve) => {
+                    this._pausedHumanDecisions.set(runId, { reason, budget: current, resolve });
+                });
+                logLine(`\n■ Loop paused (${exports.BUDGET_PAUSED}) — ${current.detail} Raise the budget, then resume: the run continues from the next step.`, 'stderr');
+                const pausedAtMs = this.now();
+                (0, loop_runs_store_1.pauseLoopRun)(this.db, runId, {
+                    iterationCount: iteration,
+                    totalCostUsd: totalCost,
+                    totalTokens,
+                    totalDurationMs: totalDuration,
+                }, exports.BUDGET_PAUSED);
+                this._emit({
+                    type: 'loop.run_paused',
+                    projectId: req.projectId,
+                    loopRunId: runId,
+                    railIndex: req.railIndex ?? null,
+                    reason,
+                    ticketIds: exactTicketIds,
+                    pauseKind: exports.BUDGET_PAUSED,
+                    budget: { scope: current.scope, ...(current.period ? { period: current.period } : {}), budgetUsd: current.budgetUsd, spentUsd: current.spentUsd, resetsAt: current.resetsAt },
+                });
+                this._emit({
+                    type: 'job.interactive',
+                    projectId: req.projectId,
+                    jobId: runId,
+                    acceptingTurns: true,
+                    pendingInterrupts: [],
+                    settleMode: 'auto',
+                    timestamp: new Date(pausedAtMs).toISOString(),
+                });
+                const decision = await decisionPromise;
+                if (this._disposed)
+                    return new Promise(() => { });
+                if (decision.action === 'stop' || this._cancelled.has(runId)) {
+                    logLine(`\n■ Loop stop requested while paused on the daily budget.`, 'stderr');
+                    return 'stop';
+                }
+                if (Number.isFinite(deadline))
+                    deadline += Math.max(0, this.now() - pausedAtMs);
+                const still = this._budgetBreach(runId);
+                if (still) {
+                    current = still;
+                    continue;
+                }
+                (0, loop_runs_store_1.resumeLoopRun)(this.db, runId);
+                const resumedAt = new Date(this.now()).toISOString();
+                logLine(`\n▶ Loop resumed — the daily budget allows the next step.`);
+                this._emit({
+                    type: 'loop.run_resumed',
+                    projectId: req.projectId,
+                    loopRunId: runId,
+                    railIndex: req.railIndex ?? null,
+                    ticketIds: exactTicketIds,
+                });
+                this._emit({
+                    type: 'job.interactive',
+                    projectId: req.projectId,
+                    jobId: runId,
+                    acceptingTurns: false,
+                    pendingInterrupts: [],
+                    settleMode: 'auto',
+                    timestamp: resumedAt,
+                });
+                return 'continue';
+            }
+        };
         const recoveryCounts = new Map();
         let phaseRecovery;
         const recoverPhase = (node, detail, previousFailure) => {
@@ -1316,26 +1486,96 @@ class LoopRunManager {
                 outcome = 'failed';
             if (definitionEngine) {
                 settled = true;
+                // rail-loop-budget-guard (mid-run): Core schedules every step inside one
+                // invocation, so a budget crossed by a role's spend is enforced with
+                // Core's cooperative pause (`pauseRuns`): the current step finishes, Core
+                // records `paused` (reason `budget`) and exits 2, and the run parks on
+                // the same resumable `budget_paused` pause. One request per invocation;
+                // a Core without the capability keeps the between-invocation guard.
+                let budgetPauseRequested = false, budgetPauseUnsupported = false, budgetPauseEpisode = 0, budgetCheckedCost = totalCost;
+                const requestBudgetPause = () => {
+                    if (budgetPauseRequested || budgetPauseUnsupported || !this.executors.pauseDefinition || this._cancelled.has(runId) || this._disposed)
+                        return;
+                    const breach = this._budgetBreach(runId);
+                    const contextPath = breach ? (0, loop_runs_store_1.readDefinitionRun)(this.db, runId)?.metadata.contextPath : undefined;
+                    if (!breach || !contextPath)
+                        return;
+                    budgetPauseRequested = true;
+                    const requestId = `desktop-budget-pause:${runId}:${++budgetPauseEpisode}`;
+                    logLine(`\n■ Daily budget reached mid-run — ${breach.detail} Pausing the workflow after its current step.`, 'stderr');
+                    void this.executors.pauseDefinition({ runId, contextPath, requestId, reason: 'budget' }).catch((error) => {
+                        const message = error instanceof Error ? error.message : String(error);
+                        if (message.startsWith('engine_unsupported')) {
+                            budgetPauseUnsupported = true;
+                            logLine(`\n■ This run's Core cannot pause mid-run; the daily budget applies before its next continuation.`, 'stderr');
+                        }
+                        else {
+                            budgetPauseRequested = false;
+                            console.error(`[loop-run] budget pause request failed for ${runId}: ${message}`);
+                        }
+                    });
+                };
                 const projectEvent = (0, loop_definition_events_1.createDefinitionEventProjection)({ db: this.db, runId, projectId: req.projectId, ticketIds: exactTicketIds, nextSequence: takeSeq,
                     broadcast: event => this._emit({ type: 'event', jobId: runId, event_type: event.eventType, source: 'stdout', payload: event.payload, seq: event.seq, timestamp: event.timestamp }),
-                    onProgress: (count, usage) => { stepNum = count; totalCost = usage.cost; totalTokens = usage.tokensIn + usage.tokensOut; totalDuration = usage.duration; costUncertain = usage.costUnknown; usageTelemetryAvailable = usage.present; },
+                    onProgress: (count, usage) => {
+                        stepNum = count;
+                        totalCost = usage.cost;
+                        totalTokens = usage.tokensIn + usage.tokensOut;
+                        totalDuration = usage.duration;
+                        costUncertain = usage.costUnknown;
+                        usageTelemetryAvailable = usage.present;
+                        // Only new recorded spend can cross the budget: check on a cost change.
+                        if (totalCost > budgetCheckedCost) {
+                            budgetCheckedCost = totalCost;
+                            requestBudgetPause();
+                        }
+                    },
                 });
                 let activeDurationMs = continuation ? (0, loop_runs_store_1.getLoopRun)(this.db, runId)?.total_duration_ms ?? 0 : 0;
                 const result = await (0, loop_definition_run_1.runDefinitionLoop)(req, runId, { continuation, contextPath: () => (0, loop_runs_store_1.readDefinitionRun)(this.db, runId)?.metadata.contextPath,
                     onPrepared: metadata => { (0, loop_runs_store_1.saveDefinitionRun)(this.db, runId, metadata); },
                     invoke: input => { this.claimDefinition({ ...req, runId }); return this.executors.runDefinition(input); }, isCancelled: () => this._cancelled.has(runId),
                     remainingMs: () => req.graph.config.timeoutMinutes > 0 ? Math.max(1, req.graph.config.timeoutMinutes * 60_000 - activeDurationMs) : undefined,
-                    onLine: logLine, onRuntimeEvent: projectEvent, onSpawn: child => {
+                    onLine: logLine, onRuntimeEvent: auditTap ? event => { auditTap(event); return projectEvent(event); } : projectEvent, onSpawn: child => {
                         this._activeChild.set(runId, child);
                         if (this._cancelled.has(runId))
                             this.cancelResident(runId, false);
                     },
-                    onInvocationEnd: result => { this._activeChild.delete(runId); if (result.runtimeStatus === 'paused')
-                        this.releaseDefinition(runId); if (result.durationMs !== undefined) {
-                        activeDurationMs = result.durationMs;
-                        totalDuration = result.durationMs;
-                    } }, awaitHumanDecision, });
+                    onInvocationEnd: result => {
+                        this._activeChild.delete(runId);
+                        budgetPauseRequested = false;
+                        if (result.runtimeStatus === 'paused')
+                            this.releaseDefinition(runId);
+                        if (result.durationMs !== undefined) {
+                            activeDurationMs = result.durationMs;
+                            totalDuration = result.durationMs;
+                        }
+                        try {
+                            this.options.onDefinitionInvocationEnd?.(runId, exactTicketIds, result.runtimeStatus);
+                        }
+                        catch { /* advisory observer */ }
+                    }, awaitHumanDecision,
+                    // Core schedules every step inside one invocation; the only boundary
+                    // Desktop owns is the re-invocation after a human decision.
+                    beforeContinuation: async () => {
+                        const breach = this._budgetBreach(runId);
+                        return breach ? awaitBudget(breach) : 'continue';
+                    },
+                    // Core exited 2 on the budget pause requested above. A budget raised
+                    // meanwhile resumes at once; otherwise the run waits like any budget pause.
+                    awaitHostPause: async (pause) => {
+                        if (pause.reason !== 'budget')
+                            throw new Error(`Core paused (${pause.reason}) without an addressable interrupt`);
+                        const breach = this._budgetBreach(runId);
+                        if (breach)
+                            return awaitBudget(breach);
+                        logLine(`\n▶ The daily budget allows the next step — resuming the workflow.`);
+                        return 'continue';
+                    }, });
                 definitionCompletion = result.completion;
+                coreFailure = result.failure;
+                if (result.errorText)
+                    failureText = result.errorText;
                 if (result.durationMs !== undefined)
                     totalDuration = result.durationMs;
                 if (result.errorText)
@@ -1366,6 +1606,16 @@ class LoopRunManager {
                     outcome = 'failed';
                     break;
                 }
+                // Daily budget: checked BETWEEN AI steps (the launch gate covered the
+                // first one). The current step always finishes; the next AI-bearing
+                // node waits on a resumable `budget_paused` pause.
+                if ((node.type === 'ai-step' || node.type === 'decider') && stepNum > 0) {
+                    const breach = this._budgetBreach(runId);
+                    if (breach && (await awaitBudget(breach)) === 'stop') {
+                        outcome = 'stopped';
+                        break;
+                    }
+                }
                 const succs = (0, loop_graph_1.successors)(req.graph, node.id);
                 // The RAIL governs provider/model/effort for the whole run — nodes do
                 // NOT override (decided in design: "lo que pongamos en el rail manda").
@@ -1610,6 +1860,7 @@ class LoopRunManager {
                             logLine(`✖ Zero work performed — the command never ran${res.text.trim() ? `: ${res.text.trim()}` : ''}`, 'stderr');
                         }
                         else if (stepFailed && stepErrorText) {
+                            failureText = stepErrorText;
                             // Executors can return a structured failure without streaming any
                             // text (configuration rejection, missing CLI, provider startup).
                             // Persist its reason before the step closes, including early stops.
@@ -2068,6 +2319,7 @@ class LoopRunManager {
         if (coreCompletion)
             logLine(`Core result: implementation=${coreCompletion.completion.implementation}; validation=${coreCompletion.completion.validation}; archive=${coreCompletion.completion.archive}; delivery=${coreCompletion.completion.delivery}`);
         const finishedAt = new Date(this.now()).toISOString();
+        this._runCaps.delete(runId);
         (0, loop_runs_store_1.finishLoopRunAndJob)(this.db, runId, {
             outcome,
             finishedAt,
@@ -2092,6 +2344,10 @@ class LoopRunManager {
             },
             callbackOutcome: req.deferTerminalOutcome ? 'failed' : outcome,
             outcomeFinalized: !req.deferTerminalOutcome,
+            failureDiagnosis: (0, recovery_1.isDiagnosableOutcome)(outcome)
+                ? (0, recovery_1.serializeDiagnosis)((0, recovery_1.deriveFailureDiagnosis)({ outcome, stallReason: stallReason ?? null, providerLimit: providerLimitHit ?? null, errorText: failureText ?? null, stepId: failedStepId ?? null, core: coreFailure, hostBlocker: definitionCompletion?.blocker ?? null,
+                    blockedReason: definitionCompletion && !definitionCompletion.ok ? definitionCompletion.reasons.join('; ') : coreCompletion && outcome === 'blocked' ? `validation ${coreCompletion.completion.validation}, implementation ${coreCompletion.completion.implementation}` : null }))
+                : null,
         });
         this._emit({
             type: 'job.finalized',
@@ -2172,6 +2428,7 @@ class LoopRunManager {
                 zombieTimeoutMs: input.plan.idleTimeoutMs ?? input.plan.inactivityTimeoutMs ?? 0,
                 onZombieTimeout: () => { stalled = true; },
                 nextEventSeq: input.nextEventSeq,
+                ...(this.options.agentAudit ? { onProviderEvent: (0, audit_1.createStreamAuditTap)(this.options.agentAudit, { runId: input.runId, jobId: input.runId, role: 'loop' }) } : {}),
                 persistTurnUsage: (usage, completedEventSeq, checkpoint) => {
                     const checkpointTurn = this.db.transaction(() => {
                         (0, db_1.accumulateInteractiveTurn)(this.db, input.runId, usage);

package/server/dist/modules/loops/runtime/loop-runs-store.js

@@ -33,6 +33,8 @@ exports.finishLoopRun = finishLoopRun;
 exports.pauseLoopRun = pauseLoopRun;
 exports.resumeLoopRun = resumeLoopRun;
 exports.getLoopRun = getLoopRun;
+exports.readLoopRunCap = readLoopRunCap;
+exports.writeLoopRunCap = writeLoopRunCap;
 exports.getRunEventCounts = getRunEventCounts;
 exports.listRunningLoopRuns = listRunningLoopRuns;
 exports.listActiveLoopRuns = listActiveLoopRuns;
@@ -49,6 +51,7 @@ const agent_runtime_retention_records_1 = require("../../agent-runtime/runtime/a
  */
 const path_1 = __importDefault(require("path"));
 const node_fs_1 = require("node:fs");
+const job_search_1 = require("../../../db/job-search");
 function frozenJson(value) {
     const serialized = JSON.stringify(value, (_key, item) => {
         if (typeof item === 'function' || typeof item === 'symbol' || typeof item === 'bigint' || typeof item === 'number' && !Number.isFinite(item))
@@ -260,6 +263,7 @@ function createLoopRun(db, input) {
       iteration_limit, started_at
     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', ?, ?)
   `).run(input.id, input.projectId, input.loopId, input.loopName ?? null, input.railIndex ?? null, input.ticketId ?? null, input.provider ?? null, input.model ?? null, input.reasoningEffort ?? null, JSON.stringify([...new Set(input.ticketIds ?? (input.ticketId == null ? [] : [input.ticketId]))]), input.ticketCompletionStatus ?? 'done', input.causalOwnership ? 1 : 0, input.iterationLimit, input.startedAt);
+    (0, job_search_1.safeIndexJob)(db, input.id);
     return getLoopRun(db, input.id);
 }
 function parseTicketIdsJson(raw) {
@@ -284,9 +288,9 @@ function finishLoopRunAndJob(db, id, opts) {
         updateLoopRunCounters(db, id, opts.counters);
         db.prepare(`
       UPDATE loop_runs
-         SET status = 'completed', final_outcome = ?, finished_at = ?
+         SET status = 'completed', final_outcome = ?, finished_at = ?, failure_diagnosis = ?
        WHERE id = ?
-    `).run(opts.outcome, opts.finishedAt, id);
+    `).run(opts.outcome, opts.finishedAt, opts.failureDiagnosis ?? null, id);
         db.prepare(`
       UPDATE jobs
          SET exit_code = ?, status = ?, finished_at = ?,
@@ -313,6 +317,7 @@ function finishLoopRunAndJob(db, id, opts) {
              ) THEN num_turns ELSE ? END
        WHERE id = ? AND owner = 'loop'
     `).run(opts.job.exitCode, opts.job.status, opts.finishedAt, id, opts.job.totalCostUsd, id, opts.job.tokensIn, id, opts.job.tokensOut, id, opts.job.tokensCacheRead, id, opts.job.tokensCacheCreate, id, opts.job.durationMs, id, opts.job.numTurns, id);
+        (0, job_search_1.safeIndexJob)(db, id);
         const payload = {
             version: 1,
             runId: id,
@@ -471,13 +476,16 @@ function updateLoopRunCounters(db, id, counters) {
 function finishLoopRun(db, id, opts) {
     if (opts.counters)
         updateLoopRunCounters(db, id, opts.counters);
-    db.prepare(`UPDATE loop_runs SET status = 'completed', final_outcome = ?, finished_at = ? WHERE id = ?`).run(opts.outcome, opts.finishedAt, id);
+    db.prepare(`UPDATE loop_runs SET status = 'completed', final_outcome = ?, finished_at = ?, failure_diagnosis = ? WHERE id = ?`).run(opts.outcome, opts.finishedAt, opts.failureDiagnosis ?? null, id);
+    (0, job_search_1.safeIndexJob)(db, id);
     return getLoopRun(db, id);
 }
-function pauseLoopRun(db, id, counters) {
+/** `reason` marks a non-decision pause on `restart_reason` (e.g. `budget_paused`);
+ *  resumeLoopRun clears it. A human-decision pause leaves it untouched. */
+function pauseLoopRun(db, id, counters, reason) {
     if (counters)
         updateLoopRunCounters(db, id, counters);
-    db.prepare(`UPDATE loop_runs SET status = 'paused' WHERE id = ? AND status = 'running'`).run(id);
+    db.prepare(`UPDATE loop_runs SET status = 'paused', restart_reason = COALESCE(?, restart_reason) WHERE id = ? AND status = 'running'`).run(reason ?? null, id);
     return getLoopRun(db, id);
 }
 function resumeLoopRun(db, id) {
@@ -487,6 +495,14 @@ function resumeLoopRun(db, id) {
 function getLoopRun(db, id) {
     return db.prepare('SELECT * FROM loop_runs WHERE id = ?').get(id);
 }
+/** The run's own per-run soft cap: undefined = never set, 0 = waived, > 0 = the cap. */
+function readLoopRunCap(db, id) {
+    const row = db.prepare('SELECT run_cap_usd FROM loop_runs WHERE id = ?').get(id);
+    return row?.run_cap_usd == null ? undefined : row.run_cap_usd;
+}
+function writeLoopRunCap(db, id, capUsd) {
+    db.prepare('UPDATE loop_runs SET run_cap_usd = ? WHERE id = ?').run(capUsd, id);
+}
 /** Activity-step count for one event, mirroring the client's deriveFrameActivity
  *  (../../client/src/features/browser/lib/frame-activity.ts) so the seeded count matches the live
  *  "pasos" the Job panel shows. A single assistant frame may carry several

package/server/dist/modules/loops/runtime/loop-templates.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LEGACY_LOOP_TEMPLATES = exports.LOOP_TEMPLATES = exports.CORE_STARTER_TEMPLATE_IDS = exports.LOOP_CATEGORIES = void 0;
+exports.DRIFT_SWEEP_TEMPLATE = exports.DRIFT_SWEEP_TEMPLATE_ID = exports.LEGACY_LOOP_TEMPLATES = exports.LOOP_TEMPLATES = exports.CORE_STARTER_TEMPLATE_IDS = exports.LOOP_CATEGORIES = void 0;
 exports.aiLoopGraph = aiLoopGraph;
 exports.fixLoopGraph = fixLoopGraph;
 exports.opsxLifecycleGraph = opsxLifecycleGraph;
 exports.coreStarterGraph = coreStarterGraph;
 exports.supportsCoreTemplates = supportsCoreTemplates;
 exports.loopTemplatesForCapabilities = loopTemplatesForCapabilities;
+exports.driftSweepGraph = driftSweepGraph;
 exports.getLoopTemplate = getLoopTemplate;
 const loop_core_factory_1 = require("./loop-core-factory");
 const loop_agents_1 = require("./loop-agents");
@@ -430,17 +431,59 @@ function supportsCoreTemplates(capabilities) {
 function loopTemplatesForCapabilities(capabilities) {
     if (!supportsCoreTemplates(capabilities))
         return exports.LOOP_TEMPLATES;
-    return exports.LOOP_TEMPLATES.map((template) => {
-        if (!isCoreStarterId(template.id))
-            return template;
-        const readOnly = CORE_STARTER_SHAPES[template.id] === 'watch';
-        return {
-            ...template,
-            description: CORE_STARTER_DESCRIPTIONS[template.id],
-            ...(readOnly ? { readOnly: true } : {}),
-            graph: coreStarterGraph(template.id, capabilities?.implementationSteps === 1, capabilities?.workflowAgentSteps === 1, capabilities),
-        };
-    });
+    return [...exports.LOOP_TEMPLATES.map((template) => {
+            if (!isCoreStarterId(template.id))
+                return template;
+            const readOnly = CORE_STARTER_SHAPES[template.id] === 'watch';
+            return {
+                ...template,
+                description: CORE_STARTER_DESCRIPTIONS[template.id],
+                ...(readOnly ? { readOnly: true } : {}),
+                graph: coreStarterGraph(template.id, capabilities?.implementationSteps === 1, capabilities?.workflowAgentSteps === 1, capabilities),
+            };
+        }), ...phase3Templates(capabilities)];
+}
+/** Drift sweep (feedback-2026-10 task 3.3): the reviewer's check 9 ("the spec
+ *  of a capability against its code") run on demand across every capability.
+ *  Read-only; listed only when Core announces `specTrace: 1`. */
+exports.DRIFT_SWEEP_TEMPLATE_ID = 'drift-sweep';
+const DRIFT_SWEEP_PROMPT = [
+    'Drift sweep. Read-only: do not modify any file, branch, pull request or ticket.',
+    'For every capability under `openspec/specs/<capability>/spec.md`, read each `### Requirement:` and its scenarios, then read the code that implements it. A requirement id is `<capability>/<slug>` (the heading, lowercased, every run of non-alphanumerics one `-`).',
+    'Report every claim the code contradicts as a divergence: the requirement id, what the spec says and what the code does instead, with `file:line`. Do not report style, missing tests or wishes: only behaviour the spec states and the code does not have. List the capabilities you could not check and why.',
+    'End with a short table: capability, requirements checked, divergences.',
+    'Finish with exactly `{{const:VERIFICATION_PASS}}` when no divergence was found, otherwise `{{const:VERIFICATION_FAIL}} — <n> divergences in <capabilities>`.',
+].join('\n\n');
+/** One read-only pass; both verdicts end the run (the report is the output). */
+function driftSweepGraph() {
+    return {
+        nodes: [
+            { id: 'start', type: 'start', position: { x: COL_X, y: 0 } },
+            { id: 'sweep', type: 'core', position: { x: COL_X, y: ROW_GAP }, data: { kind: 'prompt', params: { text: DRIFT_SWEEP_PROMPT, access: 'read', sentinel: 'verification' } } },
+            { id: 'done', type: 'end', position: { x: COL_X, y: ROW_GAP * 2 }, data: { outcome: 'success', requiresVerified: false } },
+            { id: 'failed', type: 'end', position: { x: COL_RIGHT_X, y: ROW_GAP * 2 }, data: { outcome: 'failure' } },
+        ],
+        edges: [
+            { id: 'e-start', source: 'start', target: 'sweep' },
+            { id: 'e-sweep-pass', source: 'sweep', target: 'done', label: 'pass' },
+            { id: 'e-sweep-fail', source: 'sweep', target: 'done', label: 'fail' },
+            { id: 'e-sweep-failed', source: 'sweep', target: 'failed', label: 'failed' },
+        ],
+        config: { maxIterations: 1, timeoutMinutes: STARTER_TIMEOUT_MIN, journal: 'ledger-only', change: 'none' },
+    };
+}
+exports.DRIFT_SWEEP_TEMPLATE = {
+    id: exports.DRIFT_SWEEP_TEMPLATE_ID,
+    name: 'Drift sweep',
+    description: 'Read-only: compares what every capability\'s spec claims with what the code does and lists each contradiction with file:line. Changes nothing; run it on demand.',
+    category: 'Quality',
+    tags: ['specs', 'drift', 'read-only'],
+    readOnly: true,
+    graph: driftSweepGraph(),
+};
+/** Templates gated on phase-3 Core capabilities (appended after the catalog). */
+function phase3Templates(capabilities) {
+    return supportsCoreTemplates(capabilities) && capabilities?.specTrace === 1 ? [{ ...exports.DRIFT_SWEEP_TEMPLATE, graph: driftSweepGraph() }] : [];
 }
 function getLoopTemplate(id, capabilities) {
     return loopTemplatesForCapabilities(capabilities).find((t) => t.id === id);