vinta-ai-workflows 0.7.0-alpha34 → 0.7.0-alpha36

package/CHANGELOG.md

@@ -7,6 +7,8 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [0.7.0] — YYYY-MM-DD
 
+<!-- pre-release: 0.7.0-alpha36 on 2026-10-18 -->
+<!-- pre-release: 0.7.0-alpha35 on 2026-10-16 -->
 <!-- pre-release: 0.7.0-alpha34 on 2026-10-16 -->
 <!-- pre-release: 0.7.0-alpha33 on 2026-10-16 -->
 <!-- pre-release: 0.7.0-alpha31 on 2026-10-09 -->
@@ -34,6 +36,208 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- **`amend-plan` amends a live `vinta-ai-maestro` run instead of rewriting
+  its branches.** When a run of the plan is running, paused, interrupted or
+  failed, the skill asks whether to amend it, then edits the plan and the
+  run's own workflow copy (`vinta-ai-maestro workflow`, so earlier operator and
+  coordinator amendments survive), commits both on `plan/<workflow-id>/base`
+  and applies them with `vinta-ai-maestro amend`, which rebases the done
+  phases the change reaches. Before, the plan file changed and the run went on
+  building its snapshot. The skill also carries operator recipes for a live
+  run: switching harness or model, switching the account a harness runs as,
+  resuming with the same policy flags, and moving the base forward. New
+  partial `plan-execution/partials/maestro-live-run.md`; re-run
+  `vinta-derive-skills` to pick it up.
+- **`vinta-ai-maestro`: a phase the review keeps rejecting moves up a crew
+  tier.** One run left a Tier 1 phase on its desk through 16 review rejections
+  over six hours until the coordinator moved it by hand. New
+  `defaults.escalate_after_rejections` (default `3`, `0` turns it off): when a
+  phase's review has failed to approve that many times on one desk, counted
+  across attempts, the scheduler amends the run. The phase moves to the
+  cheapest member of the next tier up and takes the new desk from its next
+  attempt. The amendment is journalled as `workflow_amended` with the new
+  author `scheduler`, a one-line `reason` and a new `rule` field
+  (`review_rejections`, the members, the tiers and the count). A phase already at the top tier stays
+  where it is. Amendments may now leave a member the run already had with no
+  phase, so moving a member's last phase is no longer refused.
+- **`vinta-ai-maestro`: `purge` drops lane rescues whose work landed.** The
+  `refs/vinta-ai-maestro/wip/*` commits a recycled lane keeps of a phase's
+  uncommitted files piled up (~80 in one project). A purge now drops those of
+  the runs it purges whose phase is done and merged into a branch outside
+  `plan/` and `wt/`, and those of already-purged runs whose rescued files read
+  the same at `HEAD`. Every other rescue is kept, and `--dry-run` lists them.
+- **`vinta-ai-maestro`: a `ui` left up across an upgrade says so.** It warns
+  once when the installed package's version no longer matches the one it
+  loaded, and `run` and `status` warn about a live `ui` serving another
+  release. A `ui` started days earlier used to keep serving pre-upgrade code
+  without a word.
+- **`vinta-ai-maestro`: a resume remembers how the run was started.** Every
+  job records its `--permission`, `--system-one`, `--on-failure`, `--retries`,
+  `--retry-after`, `--no-coordinator`, `--host` and `--harness-profile` in
+  `runs/<id>/policy.json`, and `run --resume` (and the UI's Resume) reuses
+  them, saying which; a flag given on the command line still wins. Each resume
+  used to need all of them restated.
+- **`vinta-ai-maestro`: harness profiles.** `--harness-profile <name>` on `run`
+  and `ui` picks a named binary and environment for one harness — a second
+  Claude account's `CLAUDE_CONFIG_DIR`, say — from the operator's
+  `~/.config/vinta-ai-maestro/profiles.yaml` (or `$VINTA_AI_MAESTRO_PROFILES`).
+  The run keeps the name, so a resume picks the same account.
+- **`vinta-ai-maestro`: `propagate` works on a live run.** It refused one, so
+  a fix on a phase could not reach older `integ-*` branches until the run
+  ended, and their PRs stayed red. On a live run the run's job now makes the
+  merges, holding the integration worktree's queue, so none of the run's own
+  merges interleave with them.
+- **`vinta-ai-maestro`: `sync-base <run>` brings a moved `base_branch` into a
+  running plan.** It merges the base (the remote's, when ahead) into
+  `plan/<id>/base`, then the plan branch into the lowest wave and each wave
+  into the one above. On a live run a wave's conflict goes to the run's
+  conflict fixer, gated as a phase merge is; the plan branch's own conflict,
+  and any conflict on a run that is not live, stops it with the branch as it
+  was. Both commands journal `branches_moved` on a live run.
+- **`vinta-ai-maestro`: a list of what the run decided without you.** One
+  run answered 79 of its 125 questions unattended — review loops stopped,
+  agents' design questions given their first option, one of which added a
+  migration — and none of it was anywhere a person would look. Every question
+  a `--retry-after` timer or the run coordinator answered, and everything the
+  coordinator did on its own (steering, pauses, aborts, amendments, `exec`),
+  is now listed in:
+  - `status <run>` (*Decided without you*; `unattended` in `--json`), with an
+    agent question's header and the option it got;
+  - the run view's **Decided without you** panel (`GET /api/runs/:runId/unattended`);
+  - the plan PR's *Decided without a person* section;
+  - the post-mortem's new optional `unattended_decisions` finding
+    (`schemas/postmortem.v1.schema.json`, additive), which `plan-feature`
+    now reads: an agent question answered unattended is a decision the plan
+    left open.
+- **`vinta-ai-maestro`: merge resolutions that undo a phase's deletion are
+  flagged.** One run's phase deleted an unused notification kind; the
+  conflict fixer kept "both sides" and every gate passed, so the deletion
+  never landed. After every merge in the integration worktree — a fixer's
+  resolution, or the `append_only` union driver, which re-adds lines one side
+  removed — the integrator counts lines one side deleted that the result
+  kept (codegen outputs excluded). Each is recorded as path, phase and line
+  count, never the lines: on the `node_conflict` journal row
+  (`reverted_deletions`), in the post-mortem's `wave_conflicts` and new
+  optional `unattended_decisions.reverted_deletions`
+  (`schemas/postmortem.v1.schema.json`, additive), and in the list of what
+  was decided without you (`status`, the run view, the plan PR body). It
+  flags; it does not block the merge. The conflict-fixer prompt now says a
+  phase's intent includes what it deleted.
+- **`vinta-ai-maestro`: `--agent-answer-after` on `run` and `ui`.** How long an
+  agent's own question waits before it takes the recommended options. It
+  used to be `--retry-after`, so a one-minute retry interval answered design
+  questions in a minute. Unset, it is twice `--retry-after` and never under 30
+  minutes; set alone, agents' questions are answered while failures still
+  wait for a person.
+- **`vinta-ai-maestro`: `doctor` checks the gates against CI.** It reads
+  `.github/workflows/*.yml` and warns about each `run:` command no gate runs,
+  or runs without a flag CI passes (`manage.py check` for CI's `check
+  --deploy`) — the reason every gate passed while CI failed on twenty review
+  PRs of one run. Matching is heuristic (tool and subcommand after `uv run`,
+  `npx`, `docker compose run`, …; `uses:` steps are not read) and it is always
+  a warning.
+- **`vinta-ai-maestro`: project-wide custom gates.** `maestro.gates` in
+  `.vinta-ai-workflows.yaml` now takes ids of your own beside the four types —
+  `django-check: { cmd: uv run python manage.py check --fail-level WARNING }`,
+  `api-client-fresh: { cmd: make api_client && git diff --exit-code … }` —
+  with the fields a type takes (`cmd`, `scoped_cmd`, `requires`, `timeout_s`,
+  `tuning`). Every plan has each one under its id without declaring it, and
+  `maestro.defaults.gates` names it like a type, so a check CI runs is
+  declared once and keeps its own verdict instead of being chained onto
+  `typecheck` or repeated in every plan. A plan's gate of the same id replaces
+  it whole. `validate` refuses an id that is not lowercase kebab-case, the
+  reserved `codegen`, and a custom gate with no `cmd`. Previously any key but
+  a type failed with "Unrecognized keys". Additive in the config schema.
+  `plan-feature` and the Django stack notes now point CI-mirroring checks at
+  `maestro.gates.<id>`.
+- **`vinta-ai-maestro`: codegen steps — generated files are regenerated, not
+  merged.** A workflow (or `maestro.codegen` in `.vinta-ai-workflows.yaml`)
+  declares `codegen.<id>`: a deterministic command, the files it writes
+  (`outputs`), the files they are a function of (`inputs`), and `after` for the
+  chain (schema, then client). The steps run in every lane before the gates
+  and their outputs are committed there; in the integration worktree a
+  conflict confined to their outputs is settled by taking either side and
+  running them, with no conflict fixer, and every merge is regenerated before
+  it is committed. A failing step is a red gate. `inputs` skip a step whose
+  inputs and outputs match a recorded run, a step that writes different
+  outputs from the same inputs is journalled `nondeterministic`, and a
+  `format: true` step formats only the files the phase changed. Agents are told
+  which files are generated and regenerate them mid-turn with
+  `vinta-ai-maestro codegen [<step>]`; `doctor --codegen` runs each step twice
+  to flag non-deterministic or stale output. Generated files caused most of one
+  run's 37 wave conflicts. `workflow.v1` and the config schema gain the
+  additive `codegen` field.
+
+- **`vinta-ai-maestro`: append-only files merge as a union.** `append_only` (or
+  `maestro.append_only`) lists files phases only add entries to — DI
+  containers, URL routes, notification kinds, beat schedules — and merges in
+  the integration worktree use git's `union` driver for them, so two phases
+  each adding an entry no longer needs a fixer round. The merged tree is gated
+  as before. Additive in `workflow.v1` and the config schema.
+
+- **`plan-feature`: emits codegen steps and append-only files** detected from the
+  project — the OpenAPI schema, generated API clients, route trees and
+  file-modifying pre-commit hooks as `codegen`; DI containers, URL routes and
+  beat schedules as `append_only` — preferring `maestro.codegen` /
+  `maestro.append_only` in the project file. `vinta-bootstrap-ai-tools` offers
+  to record them there once.
+- **`vinta-ai-maestro`: take a phase over without failing it.** Moving a phase
+  to another agent took abort, amend and retry, and the retry restarted its
+  pipeline from the top — one phase went from review back to implementing.
+  `node interrupt <run> <phase>` stops the turn now and **holds** the phase,
+  lane, branch, commits and uncommitted work kept, until `resume`, `reassign`
+  or `step` releases it; the cut step runs again then. `node reassign <run>
+  <phase> --crew <member> | --harness <h> --model <m>` is interrupt, amend and
+  resume in one (`--after-turn` lets the turn finish): the phase carries on at
+  the same step, keeps its session when only the model changes, and otherwise
+  starts fresh with a handoff — the last report, the work in the lane, the red
+  gate. `node step <run> <phase> <state>` moves the pipeline by hand, never
+  into a final state. Journalled as `node_reassigned` and `node_operation`.
+- **`vinta-ai-maestro`: `amend` accepts a held phase, or one waiting on a
+  question.** Its harness, model or crew member (`crew_changed`, a new
+  amendment kind) may change while it is parked, and it carries on at its
+  step. A brief, a gate list or a base still waits for the phase to stop.
+- **`vinta-ai-maestro`: `switch-harness <run> --from --to --model` and
+  `defaults.harness_fallbacks`.** A live run moves off a harness — an account
+  out of credits — without a pause and resume: phases in flight are
+  reassigned at their step, later phases run on the new harness, and the
+  conflict fixer moves too. With `harness_fallbacks` the run does it by
+  itself when a harness parks on a quota refusal, the refused turn going
+  again at once on the fallback. Journalled `harness_switched`.
+- **`vinta-ai-maestro`: `fixer interrupt|reassign <run>`.** End the conflict
+  fixer's running round as a round spent (what it left stays), or hand later
+  rounds to another harness and model. Journalled `fixer_operation`.
+- **`vinta-ai-maestro`: one API for the operator and the coordinator, and every
+  act says why.** Every acting request takes a reason (`--reason` on every
+  verb, the `X-Maestro-Reason` header on the API), journalled with what it
+  explains; the coordinator is refused without one (`reason_required`). The
+  coordinator gains `interrupt`, `reassign`, `switch-harness`, `fixer`,
+  `resume` of its own holds, and `pause` of the run (`run_halt_requested`).
+  `run --coordinator-authority full` also lets it change the plan's shape —
+  phases, dependency edges, briefs, touch lists, deferrals — answer any
+  question you are not holding, `node step`, and stop the run. A check is
+  never weakened under either authority.
+
+- **`vinta-ai-maestro`: integration is visible while it happens.** A phase in
+  `integrate` — a merge, a suite on the merged tree, a push, none with an
+  agent — showed `running` over a silent transcript, and one queued behind it
+  looked the same. Now:
+  - The phase view has an **Integration** timeline: each merge, conflict fix
+    round, `verify`, wave gate, push and PR of this attempt, a live clock on
+    the one in progress, and the log of every step that has one.
+  - The run view has an **Integration worktree** panel: who holds it, the step
+    it is on and for how long, and who is queued behind it. The roster and
+    the phase header show each running phase's pipeline step.
+  - `status` prints the step beside each running phase and an `integration`
+    line (`a · wave 1 gate unit · 6m 13s · 1 queued (b)`); `status --json`
+    carries `nodes[].step` and `integration`.
+  - A conflict fixer's turn is also written to the transcript of the phase
+    being based or building the wave, not only to the incoming phase's.
+
+  Two additive journal events back it: `node_step` (the pipeline state an
+  attempt entered) and `integration_step` (a step started or finished in the
+  worktree, identifiers and a log path only). Older runs have neither and
+  show no timeline.
 - **`vinta-ai-maestro`: `accept` on an unapproved review.** The review-budget
   question offered `continue` or `stop`, and operators answered `stop` meaning
   "take it as it is" — which fails the attempt and, under `--on-failure
@@ -638,6 +842,91 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Changed
 
+- **`plan-feature`: a rename of a shared symbol is an interface change.** A
+  phase that renames something a same-wave sibling also uses does it in the
+  foundation phase or keeps the old name as an alias until the wave lands.
+  One run had a phase call a helper its sibling renamed; each passed alone and
+  the merged wave failed the typecheck.
+- **`plan-feature`: gates cover what CI runs.** The workflow rules now tell the
+  author to read the CI config and give every locally runnable CI job a gate,
+  naming the checks plans miss: a deploy check at warning level, a
+  migrations-complete check, a "generated client is up to date" check. The
+  Django stack notes suggest `manage.py check --deploy --fail-level WARNING`,
+  `makemigrations --check` and a regenerate-and-diff gate for the schema or
+  client. One run's regex-style routes passed every gate and failed CI.
+- **`write-unit-test`: time-independent tests and deterministic generated
+  output.** Rule 8 now requires a frozen clock and an explicit timezone on any
+  test touching dates, and host-independent schema or client generation
+  (values from a locked package such as `tzdata`, sorted). The Django pack and
+  stack notes spell out `freezegun` / `time-machine` with
+  `override_settings(TIME_ZONE=...)` and `tzdata`-sourced timezone choices.
+  One run had a date test fail only near midnight UTC, and a timezone enum
+  differ by machine.
+- **`vinta-bootstrap-ai-tools`: test-tool caches are ignored before lanes run.**
+  The maestro defaults step reads `.gitignore` for the selected runners'
+  caches and reports (`.testmondata*`, `junit/`, coverage outputs, …),
+  checks for the `check-added-large-files` pre-commit hook, which a committed
+  testmon database trips on every lane and merge commit, and offers to append
+  the missing entries.
+- **`vinta-ai-maestro`: a review that stated no verdict is no longer reported
+  as a rejection.** One run recorded 22 attempts as `review verdict "fail"; 0
+  fix rounds spent`. None had rejected anything: each was a review turn that
+  ended before its reviewer answered (fixed in alpha33 and alpha34). The
+  pipeline still treats silence as `fail`, but the failure reason now says
+  `the review turn stated no verdict`, and the `review` fact carries
+  `stated: false`. The budget clause is renamed to `gate fix rounds spent`,
+  since a review's findings are fixed inside its own turn and never in a
+  separate fix round.
+
+- **`vinta-ai-maestro`: two empty turns in a row park the phase instead of
+  burning its retries.** Right after one run moved its desks to codex, "codex
+  ended the turn without the agent doing anything" failed 20 attempts across 4
+  phases in about two minutes. When one harness ends two turns in a row
+  without the agent doing anything, across attempts, the phase now skips its
+  automatic retries and asks: the question says the harness is failing and
+  suggests `retry with` a member on another harness. `--retry-after` still
+  answers it, and backs off from the first question.
+
+- **`vinta-ai-maestro`: a red gate on a merged base is re-run on retry.** One
+  run's base test gate failed once on a test that broke only near midnight.
+  Seven retries replayed the cached verdict, each reported as "failed during
+  setup, before any agent ran", and the unattended retry was withheld until an
+  operator ran `gate-cache invalidate`. The base gates now replay only a green
+  verdict and re-run a red one, and a red base gate no longer counts as a
+  setup failure, so `--retry-after` keeps retrying it with its usual backoff.
+
+- **`vinta-ai-maestro`: a lane that will not recycle says why.** One run
+  failed 20 attempts with only "could not be recycled (worktree)" or
+  "(database)" in the journal and the daemon log. The failure now carries the
+  failing step's exit code and the tail of its stderr, the way a failed
+  `setup_cmd` already did, and a `reset_cmd`, `setup_cmd` or `prepare_cmd`
+  failing during a recycle reports that command's own error instead of
+  `LaneSetupError`. Command lines are still left out.
+
+- **`vinta-ai-maestro`: the full suite runs before a PR, and on every merged
+  tree.** Under `gate_scope: scoped`, a phase's gates ran their scoped form
+  everywhere, so a PR could carry a suite only a scoped run had seen, and most
+  phases were `done` before any full suite touched their code.
+  - A phase's gates run scoped until its review approves; `verify`, after the
+    review, runs every gate's full `cmd` on the phase branch. A red full run
+    goes back to a fixer and through the review again — more review rounds,
+    no failing suite in a PR. The fixer is told the gate failed in full, and
+    `vinta-ai-maestro gate <id> --full` runs the whole command for an agent.
+  - `defaults.wave_gates` now defaults to `every`: each wave's gates run in
+    full on the merged tree, so the next wave builds on a passing one. Set
+    `final` for the previous behaviour.
+  - A multi-dependency phase's `integ-<id>` base runs its dependencies' gates
+    in full before the phase starts, cached on the merged tree; red fails the
+    phase's setup with `BaseGateError`. A clean base merge used to run nothing.
+  - Wave and base gate failures now reach the journal with their gate and log,
+    not just their error name.
+  - Each full run can be skipped in a plan's `defaults` or the project's
+    `maestro.defaults` (`.vinta-ai-workflows.yaml`): `verify_gates: scoped`
+    keeps `verify` on the scoped form, `base_gates: off` leaves merged bases
+    unchecked, and `wave_gates: final` / `off` as before. Both new fields are
+    in `vinta-ai-workflows-config.v1.schema.json`, and the bootstrap asks when
+    the full suite should run. The run coordinator may tighten them, never
+    loosen them.
 - **`vinta-ai-maestro`: a recycled lane no longer keeps the last phase's
   ignored files.** A lane handed to the next phase kept everything gitignored,
   and one kept `apps/api/.mypy_cache` and a deleted package's `__pycache__`,
@@ -986,6 +1275,40 @@ the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- **`vinta-ai-maestro`: the integrator no longer stages untracked files into
+  a merge resolution.** It stages tracked paths and the merge's own paths
+  instead of `git add --all`, so a gate's leftovers in the integration
+  worktree (a `.testmondata-wal`, say) stay out of the merge commit. A kept
+  resolution that changes paths outside the merge, or whose commit is refused
+  again, is dropped instead of replayed on every retry. A conflict fixer now
+  stages any new file it creates itself, and its prompt says so.
+- **`vinta-ai-maestro`: an amendment reaches the conflict fixer.** The fixer
+  is rebuilt from the amended crew when the plan is amended, so a run whose
+  desks moved to another harness stops failing on "conflict fixer spawn
+  refused" for the harness it left.
+- **`vinta-ai-maestro`: a conflict fixer stopped by its time limit keeps its
+  work.** What the round had is kept under `refs/vinta-ai-maestro/abandoned/`
+  (an interrupted round's too), and the retry's fixer is pointed at it to
+  continue instead of redoing the resolution from scratch.
+- **`vinta-ai-maestro`: an amended harness reaches every phase it moved.** An
+  amendment changed the harness only on phases still `pending`; a failed or
+  blocked one waiting on a retry kept naming the old harness in `status` and
+  the run view, and once the job loaded only the new harness's adapter the
+  run view answered 500 `unknown harness`. Phases past `pending` now take the
+  new harness without losing their status, and the run view leaves out the
+  capacity of a harness the live run loaded no adapter for.
+- **`vinta-ai-maestro`: `land` decides "already in the base" by content.** A
+  review PR is landed when merging it into the base would leave the base's
+  tree unchanged. The ancestry test it used alone kept an `integ-*` PR open
+  after its plan PR merged: three bookkeeping merges were not in `main`, though
+  every branch they merged was. A draft plan PR is now named as one (GitHub
+  will not merge a draft), and `land <run> --ready` marks it ready for review.
+- **`vinta-ai-maestro`: a hook that rewrites files no longer refuses the
+  commit outright.** When a commit fails having left modified files behind — a
+  `pre-commit` formatter or schema generator — they are staged and the commit
+  is tried once more before the operator is asked, in lanes and in the
+  integration worktree. One run had seven merge commits refused this way.
+
 - **`vinta-ai-maestro`: a claude-code turn the CLI calls "blocked" no longer
   fails unless a tool was refused in it.** The CLI's own turn summary marks a
   turn `blocked` whenever its last message names a next step for a person —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vinta-ai-workflows",
-  "version": "0.7.0-alpha34",
+  "version": "0.7.0-alpha36",
   "description": "Bootstrap AI tooling (AGENTS.md, skills, sub-agents) across Claude Code, Codex, Cursor, and VS Code + GitHub Copilot.",
   "type": "module",
   "bin": {

package/schemas/postmortem.v1.schema.json

@@ -199,6 +199,37 @@
                 "minimum": 0,
                 "maximum": 9007199254740991,
                 "description": "Conflict-fixer rounds the resolution took. High is a strong split signal."
+              },
+              "reverted_deletions": {
+                "description": "Paths where the resolution kept lines one side had deleted — a fixer keeping “both sides”, or the `append_only` union driver. Flagged, not refused: check each deletion reached the branch. Absent when there were none.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "path": {
+                      "type": "string",
+                      "maxLength": 500
+                    },
+                    "node": {
+                      "type": "string",
+                      "maxLength": 200,
+                      "description": "The phase whose deletion was reverted, or the branch standing in when no phase on that side touched the path."
+                    },
+                    "lines": {
+                      "type": "integer",
+                      "minimum": 1,
+                      "maximum": 9007199254740991,
+                      "description": "Lines that side deleted and the resolution kept. A count, never the lines."
+                    }
+                  },
+                  "required": [
+                    "path",
+                    "node",
+                    "lines"
+                  ],
+                  "additionalProperties": false,
+                  "description": "A deletion a merge resolution undid. Identifiers and a count only."
+                }
               }
             },
             "required": [
@@ -651,7 +682,8 @@
                       "operator",
                       "monitor",
                       "coordinator",
-                      "config"
+                      "config",
+                      "scheduler"
                     ]
                   }
                 },
@@ -680,8 +712,13 @@
                       "add_context",
                       "redirect",
                       "pause",
+                      "resume",
                       "abort",
-                      "fresh"
+                      "fresh",
+                      "interrupt",
+                      "reassign",
+                      "step",
+                      "retry"
                     ]
                   },
                   "by": {
@@ -840,6 +877,180 @@
             "additionalProperties": false,
             "description": "A gate that every phase passed on its own branch and that failed on the merged wave: two of `members` (or one of them and an earlier wave) disagree. The evidence of a missing dependency or a missing contract test that `missing_dependencies`’ ordering cannot see."
           }
+        },
+        "unattended_decisions": {
+          "type": "object",
+          "properties": {
+            "answers": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "node": {
+                    "type": "string",
+                    "minLength": 1,
+                    "pattern": "^[a-z0-9][a-z0-9-]*$"
+                  },
+                  "at_ms": {
+                    "type": "integer",
+                    "minimum": -9007199254740991,
+                    "maximum": 9007199254740991
+                  },
+                  "category": {
+                    "type": "string",
+                    "enum": [
+                      "retry",
+                      "agent_question",
+                      "plan_question",
+                      "merge_commit",
+                      "other"
+                    ],
+                    "description": "`retry`: a failed attempt retried or stopped. `agent_question`: a design question the agent stopped to ask, given its recommended options. `plan_question`: a pipeline question such as an exhausted review budget, given the plan’s `unattended_answer`. `merge_commit`: a merge commit git refused."
+                  },
+                  "by": {
+                    "type": "string",
+                    "enum": [
+                      "unattended",
+                      "coordinator"
+                    ]
+                  },
+                  "answer": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "maxLength": 200
+                      },
+                      {
+                        "type": "number"
+                      },
+                      {
+                        "type": "boolean"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "The answer’s value: a choice, or an agent question’s picked option indices as JSON."
+                  },
+                  "waited_ms": {
+                    "description": "How long the question stood unanswered.",
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 9007199254740991
+                  }
+                },
+                "required": [
+                  "node",
+                  "at_ms",
+                  "category",
+                  "by",
+                  "answer"
+                ],
+                "additionalProperties": false
+              },
+              "description": "Questions a `--retry-after` timer or the run coordinator answered, oldest first."
+            },
+            "coordinator_actions": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "at_ms": {
+                    "type": "integer",
+                    "minimum": -9007199254740991,
+                    "maximum": 9007199254740991
+                  },
+                  "node": {
+                    "type": "string",
+                    "minLength": 1,
+                    "pattern": "^[a-z0-9][a-z0-9-]*$"
+                  },
+                  "action": {
+                    "type": "string",
+                    "enum": [
+                      "add_context",
+                      "redirect",
+                      "pause",
+                      "abort",
+                      "fresh",
+                      "amend",
+                      "exec",
+                      "gate_cache_invalidate",
+                      "interrupt",
+                      "reassign",
+                      "retry",
+                      "step"
+                    ]
+                  },
+                  "target": {
+                    "description": "An amendment’s targets, an `exec` target or a gate id.",
+                    "type": "string",
+                    "maxLength": 500
+                  }
+                },
+                "required": [
+                  "at_ms",
+                  "action"
+                ],
+                "additionalProperties": false
+              },
+              "description": "What the coordinator did on its own, oldest first. Its reasons are in its conversation and, for steering, in the phase’s decisions — not here."
+            },
+            "reverted_deletions": {
+              "description": "Merge resolutions that kept lines a phase deliberately deleted, oldest first: flagged, not refused. Unused code breaks no gate, so check each deletion reached the branch. Absent when there were none, and on post-mortems written before it was checked.",
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "at_ms": {
+                    "type": "integer",
+                    "minimum": -9007199254740991,
+                    "maximum": 9007199254740991
+                  },
+                  "node": {
+                    "type": "string",
+                    "maxLength": 200,
+                    "description": "The phase whose deletion was reverted, or the branch standing in when no phase on that side touched the path."
+                  },
+                  "path": {
+                    "type": "string",
+                    "maxLength": 500
+                  },
+                  "lines": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 9007199254740991,
+                    "description": "Lines that side deleted and the resolution kept. A count, never the lines."
+                  },
+                  "branch": {
+                    "type": "string",
+                    "description": "The branch the merge was made on."
+                  },
+                  "fix_rounds": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 9007199254740991,
+                    "description": "Conflict-fixer rounds the resolution took; 0 is git’s own merge, the `append_only` union driver."
+                  }
+                },
+                "required": [
+                  "at_ms",
+                  "node",
+                  "path",
+                  "lines",
+                  "branch",
+                  "fix_rounds"
+                ],
+                "additionalProperties": false
+              }
+            }
+          },
+          "required": [
+            "answers",
+            "coordinator_actions"
+          ],
+          "additionalProperties": false,
+          "description": "Every decision made with nobody watching. A plan whose run decided much on its own left those choices to chance: a design question answered unattended belonged in the plan."
         }
       },
       "required": [