valent-pipeline 0.19.21 → 0.19.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "valent-pipeline",
-  "version": "0.19.21",
+  "version": "0.19.23",
   "description": "v3 multi-agent AI pipeline for software development lifecycle",
   "type": "module",
   "bin": {

package/pipeline/orchestrators/claude-code/sprint.workflow.js

@@ -837,6 +837,13 @@ const gitBranchPrefix = (typeof (gitCfg.storyBranchPrefix ?? gitCfg.story_branch
 // plain ref-safe names stay bare so the composed commands read naturally in prompts.
 const refq = (s) => (/^[A-Za-z0-9._/-]+$/.test(s) ? s : shq(s))
 const gitFlags = (gitTargetBranch ? ` --target ${refq(gitTargetBranch)}` : '') + (gitBranchPrefix !== 'story/' ? ` --prefix ${refq(gitBranchPrefix)}` : '')
+// Ship-merge retry cap (review 2026-06-14): how many times a non-landed, non-conflict ship-story
+// result (a transient GIT-runner failure — the haiku transcriber dying / returning null, a momentary
+// index lock) is re-attempted before the story is declared merge-blocked. The merge is deterministic
+// and ship-story is idempotent (an already-merged branch returns already:true), so retrying is always
+// safe. A single hiccup used to drop a JUDGE-approved story to merge-blocked → requeued a whole sprint
+// later, silently. Default 3 (1 + 2 retries); pipeline-config.yaml git.ship_merge_attempts overrides.
+const shipMergeAttempts = Math.max(1, Number.isInteger(gitCfg.shipMergeAttempts ?? gitCfg.ship_merge_attempts) ? (gitCfg.shipMergeAttempts ?? gitCfg.ship_merge_attempts) : 3)
 const gitCommitCmd = (sid, phase, extra = '') =>
   `node .valent-pipeline/bin/cli.js git commit-phase --story ${sid} --phase ${phase}${extra}`
 
@@ -1423,6 +1430,16 @@ phase('Backlog')
 // outcomes) is also REQUEUED to `groomed` — the sweep that closes the `sprint-planned` black hole
 // (review #16): nothing the plan tagged may end the sprint still in-flight.
 const isMergeBlocked = (r) => r.verdict === 'blocked' && (r.reason === 'merge-conflict' || r.reason === 'git-ship-failed')
+// Surface merge-blocked stories LOUDLY (review 2026-06-14): a JUDGE-approved story whose merge did
+// not land is requeued to groomed (correct — an infra outcome, not a quality reject), but that
+// requeue used to be silent: a run could end with a green-looking ledger while a shipped-on-paper
+// story sat un-integrated and a later story merged ahead of it. Name them in the summary + return.
+const mergeBlocked = results
+  .filter((r) => !r.resumedSkip && isMergeBlocked(r))
+  .map((r) => ({ storyId: r.storyId, reason: r.reason }))
+if (mergeBlocked.length) {
+  log(`⚠ MERGE-BLOCKED: ${mergeBlocked.length} JUDGE-approved stor${mergeBlocked.length === 1 ? 'y' : 'ies'} did NOT reach the target after ${shipMergeAttempts} ship attempt(s) and ${mergeBlocked.length === 1 ? 'was' : 'were'} requeued to groomed for re-ship — ${mergeBlocked.map((m) => `${m.storyId} (${m.reason})`).join(', ')}. NOT lost, NOT integrated: a follow-up sprint re-ships from the retained branch, or ship manually.`)
+}
 const backlog = await persistBacklog(
   results.filter((r) => r.shipped),
   results.filter((r) => r.partial),
@@ -1439,6 +1456,7 @@ return {
   results,
   integration,
   post_merge_findings: postMergeFindings,
+  merge_blocked: mergeBlocked,
   backlog,
 }
 
@@ -1612,6 +1630,25 @@ async function runGitStep(sid, commands, label, stepPhase, dirPhrase = 'the proj
   return result
 }
 
+// runShipStep: runGitStep specialized for the terminal ship-story merge, with a retry (review
+// 2026-06-14). A single transient GIT-runner failure (null/agent-death, or a non-landed non-conflict
+// result) used to drop a JUDGE-approved story straight to merge-blocked — requeued a whole sprint
+// later, with the only trace a mid-run log line. ship-story is deterministic and idempotent (an
+// already-merged branch returns already:true; a never-merged one re-attempts the same merge), so a
+// non-terminal result is re-run up to shipMergeAttempts. A REAL conflict (conflict===true) is NOT
+// retried — a blind re-merge cannot clear it; that needs the --reship sync/resolve path.
+async function runShipStep(sid, commandStr, stepPhase) {
+  let res = null
+  for (let attempt = 1; attempt <= shipMergeAttempts; attempt++) {
+    res = await runGitStep(sid, [commandStr], 'ship', stepPhase)
+    if (res && (res.merged === true || res.skipped === true || res.conflict === true)) break
+    if (attempt < shipMergeAttempts) {
+      log(`${sid}: ship-story attempt ${attempt}/${shipMergeAttempts} did not land (${res ? 'transient git-runner failure' : 'GIT runner died'}) — retrying the deterministic, idempotent merge`)
+    }
+  }
+  return res
+}
+
 // ===========================================================================
 // runStory: the per-story pipeline (kept inline, not a nested workflow(), so the single
 // workflow() nesting level stays free for plan/retro — see reimplementation-plan §5b).
@@ -1785,8 +1822,8 @@ async function runStory(story) {
         }
       } else if (sync && (sync.synced === true || sync.skipped === true)) {
         // Clean (or non-repo skip): the standing JUDGE verdict still covers the tree — ship directly.
-        const ship = await withShipTurn(storyId, () => runGitStep(storyId,
-          [`node .valent-pipeline/bin/cli.js git ship-story --story ${storyId} --verdict ship${gitFlags}`], 'ship', 'QA'))
+        const ship = await withShipTurn(storyId, () => runShipStep(storyId,
+          `node .valent-pipeline/bin/cli.js git ship-story --story ${storyId} --verdict ship${gitFlags}`, 'QA'))
         const merged = ship && (ship.skipped === true || ship.merged === true)
         if (merged) {
           recordStage('ship', { verdict: 'pass' })
@@ -1855,8 +1892,8 @@ async function runStory(story) {
     if (gitFlowEnabled) {
       if (shipped || shippedPartial) {
         const mergeVerdict = shippedPartial ? 'ship-partial' : decision.verdict === 'ship-with-bugs' ? 'ship-with-bugs' : 'ship'
-        const ship = await withShipTurn(storyId, () => runGitStep(storyId,
-          [`node .valent-pipeline/bin/cli.js git ship-story --story ${storyId} --verdict ${mergeVerdict}${gitFlags}`], 'ship', 'Judge'))
+        const ship = await withShipTurn(storyId, () => runShipStep(storyId,
+          `node .valent-pipeline/bin/cli.js git ship-story --story ${storyId} --verdict ${mergeVerdict}${gitFlags}`, 'Judge'))
         const merged = ship && (ship.skipped === true || ship.merged === true)
         if (!merged) {
           const reason = ship && ship.conflict ? 'merge-conflict' : 'git-ship-failed'
@@ -2094,8 +2131,8 @@ async function runStory(story) {
       // Standalone bugs (no sourceStory — defects in already-shipped code) merge to target as before.
       const intoFlag = itemType === 'bug' && sourceStory ? ` --into ${gitBranchPrefix}${sourceStory}` : ''
       const ship = await withShipTurn(storyId, async () => {
-        const res = await runGitStep(storyId,
-          [`node .valent-pipeline/bin/cli.js git ship-story --story ${storyId} --verdict ${mergeVerdict}${intoFlag}${wtFlag}${gitFlags}`], 'ship', 'Judge')
+        const res = await runShipStep(storyId,
+          `node .valent-pipeline/bin/cli.js git ship-story --story ${storyId} --verdict ${mergeVerdict}${intoFlag}${wtFlag}${gitFlags}`, 'Judge')
         // Post-merge acceptance verify (parallel mode + atdd armed): the story was QA'd on its
         // PRE-merge SHA; other stories' merges may have landed since. Re-run its acceptance suite
         // against the merged target — still under the mutex, so nothing else moves the target

package/src/lib/crosscheck.js

@@ -55,11 +55,25 @@ export function crosscheckVerdict({ reported = null, bugsBlock = null, assertVer
   }
 
   const claim = (field) => reported && reported[field] !== undefined && reported[field] !== null;
+  // Counts of BAD things (failures, open blocking bugs): a self-report HIGHER than the machine
+  // recount is the SAFE, conservative direction — the gate was harder on itself than reality (e.g. a
+  // JUDGE that counted a pre-existing, baseline-excluded failure as testsFailed/openP1toP3). That is
+  // NOT the integrity breach this module exists to catch — a gate HIDING failures/bugs to sneak a
+  // ship is claimed < actual — and refusing it stranded genuinely shippable stories. So an
+  // over-report on these fields reconciles to the authoritative recount with a warning; an
+  // under-report stays a hard mismatch. (Prompt tightening alone did not hold — the LLM still
+  // over-counts; this is the mechanical backstop.) Good-thing counts (testsPassed) and exact-match
+  // fields keep strict equality, where over-claiming IS the unsafe direction.
+  const SAFE_IF_OVER_REPORTED = new Set(['testsFailed', 'openP1toP3']);
   const compare = (field, actual) => {
     recounted[field] = actual;
-    if (claim(field) && reported[field] !== actual) {
-      mismatches.push({ field, claimed: reported[field], actual });
+    if (!claim(field) || reported[field] === actual) return;
+    if (SAFE_IF_OVER_REPORTED.has(field) && typeof reported[field] === 'number'
+        && typeof actual === 'number' && reported[field] > actual) {
+      warnings.push(`${field}: self-reported ${reported[field]} but artifacts show ${actual} — over-report (safe, conservative direction), reconciled to the recount`);
+      return;
     }
+    mismatches.push({ field, claimed: reported[field], actual });
   };
 
   // Test counts — from the assert verdict (machine-derived twice over).

package/src/lib/git-flow.js

@@ -402,7 +402,19 @@ export function startStory({ root, story, targetBranch = '', prefix = 'story/',
     snapshotSha = snap.sha || null;
   }
 
-  const target = targetBranch || onBranch;
+  // An inline fix (--from-story) inherits its SOURCE story's recorded target — NOT the
+  // currently-checked-out branch. Running several fixes for one story back-to-back leaves HEAD on the
+  // previous fix's branch; defaulting `target` to onBranch made each later fix target (and, via the
+  // base check below, base on) its SIBLING fix branch — so the fixes silently chained onto the first
+  // fix's branch instead of the story, stranded off the real target (2026-06-14). An explicit
+  // --target still wins; onBranch stays the fallback for a plain story or a fix whose source has no
+  // flow record yet. With the right target, the base check (`!isMergedInto(source, target)`) also
+  // resolves correctly — the source story is unmerged into the REAL target, so the fix bases on it.
+  let inheritedTarget = null;
+  if (fromStory && !targetBranch) {
+    inheritedTarget = readFlowRecord(root, fromStory)?.target || null;
+  }
+  const target = targetBranch || inheritedTarget || onBranch;
   let base = target;
   let basedOnStory = false;
   if (fromStory) {