code-coordinator 0.5.206__tar.gz → 0.5.207__tar.gz

{code_coordinator-0.5.206 → code_coordinator-0.5.207}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.206
+Version: 0.5.207
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.206 → code_coordinator-0.5.207}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.206
+Version: 0.5.207
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.206 → code_coordinator-0.5.207}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.206",
+  "tag": "0.5.207",
   "distance": 0,
-  "node": "g3c2392941a4c874655cc8ccc15a0ef5112a0d822",
+  "node": "gc33012740fef085a15f6c4a34f631d39225f18b3",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-21"

{code_coordinator-0.5.206 → code_coordinator-0.5.207}/coord/db.py

@@ -583,13 +583,35 @@ def _ensure_schema(conn: sqlite3.Connection) -> None:
         -- CHECK pins it to one row so "which cursor?" can never be a
         -- question).  `pull_cursor` is opaque to coord — it is whatever the
         -- portal handed back — and is the replay point on daemon restart.
+        --
+        -- `verdict_watermark_at` / `verdict_watermark_rowid` (#2509 review
+        -- fix): the verdict consumer's OWN read position into
+        -- `portal_events`, independent of the shared `handled_at` column.
+        -- `unhandled_events()`/`mark_event_handled()` are shared plumbing —
+        -- this consumer only stamps `handled_at` for a `changes_requested`
+        -- event it actually dispatched, leaving every other kind (a new
+        -- submission, an `approved` verdict, a Q&A answer) NULL by design so
+        -- a future consumer can still read it.  Scanning by `handled_at IS
+        -- NULL` therefore re-returns that growing, never-marked backlog
+        -- ahead of anything newer forever once it exceeds one page — a real
+        -- `changes-requested` event behind it would never surface.  A
+        -- private watermark sidesteps that: it advances past every event
+        -- this consumer has looked at, acted on or not, so a pile of
+        -- non-actionable events cannot block the ones behind it.
+        -- `(received_at, rowid)` mirrors `unhandled_events`'s own tiebreaker
+        -- ordering.
+        -- Both NULL until the first tick with this column runs (an empty
+        -- `~/.coord/coord.db` or one predating this migration), read as
+        -- `(0.0, 0)` — before every real event's `received_at`/`rowid`.
         CREATE TABLE IF NOT EXISTS portal_sync_state (
-            id                INTEGER PRIMARY KEY CHECK (id = 1),
-            pull_cursor       TEXT,
-            last_pull_at      REAL,
-            last_push_at      REAL,
-            last_heartbeat_at REAL,
-            last_error        TEXT NOT NULL DEFAULT ''
+            id                    INTEGER PRIMARY KEY CHECK (id = 1),
+            pull_cursor           TEXT,
+            last_pull_at          REAL,
+            last_push_at          REAL,
+            last_heartbeat_at     REAL,
+            last_error            TEXT NOT NULL DEFAULT '',
+            verdict_watermark_at    REAL,
+            verdict_watermark_rowid INTEGER
         );
 
         CREATE INDEX IF NOT EXISTS idx_assignments_status ON assignments(status);
@@ -942,6 +964,18 @@ def _migrate_add_columns(conn: sqlite3.Connection) -> None:
         # predating this migration, same as the column's own default for a
         # freshly-enqueued entry.
         "ALTER TABLE merge_queue ADD COLUMN ci_fix_dispatches INTEGER NOT NULL DEFAULT 0",
+        # #2509 review fix: the verdict consumer's own read position into
+        # `portal_events` — see the CREATE TABLE comment above for why it
+        # cannot reuse the shared `handled_at` column. NULL (read as
+        # `(0.0, 0)`, before every real event) for every database predating
+        # this migration, which replays the full existing inbox exactly once
+        # on upgrade — safe: re-scanning a non-actionable event is a no-op,
+        # and `_consume_verdicts` skips (never re-dispatches) any event
+        # whose `handled_at` is already set, so an already-consumed
+        # `changes_requested` event from before this migration is walked
+        # past, not re-sent — see `coord.portal_sync._consume_verdicts`.
+        "ALTER TABLE portal_sync_state ADD COLUMN verdict_watermark_at REAL",
+        "ALTER TABLE portal_sync_state ADD COLUMN verdict_watermark_rowid INTEGER",
     ]
     for sql in migrations:
         try:

{code_coordinator-0.5.206 → code_coordinator-0.5.207}/coord/gate_a.py

@@ -224,6 +224,19 @@ def make_record(
     ``verdict`` must be one of :data:`VERDICTS`; anything else is a
     programming error, not an operator error (the CLI's mutually-exclusive
     ``--approved``/``--changes`` flags already reject bad input).
+
+    **Open policy question (#2509, flagged for the operator, not resolved by
+    this call or any caller yet):** should an "approved" verdict on the
+    customer portal auto-call this with ``verdict=VERDICT_APPROVED`` — i.e.
+    does a client's portal sign-off record itself — or does an operator
+    still confirm separately via the existing CLI/TUI path? Today nothing
+    does the former: ``coord.portal_sync._consume_verdicts`` only acts on
+    `changes-requested` (auto-amending the contract) and deliberately leaves
+    `approved` events unconsumed rather than silently picking an answer here.
+    Whichever way this is eventually decided, an auto-recorded call MUST
+    pass ``actor="client via portal"`` (or similarly explicit) — never leave
+    ``actor`` to default such that a client's decision reads as if some
+    coord process made it.
     """
     if verdict not in VERDICTS:
         raise ValueError(f"unknown Gate A verdict {verdict!r}")

{code_coordinator-0.5.206 → code_coordinator-0.5.207}/coord/portal_store.py

@@ -206,6 +206,44 @@ def unhandled_events(limit: int = 100) -> list[PortalEvent]:
     return [_event_from_row(r) for r in rows]
 
 
+def events_after_verdict_watermark(
+    received_at: float, rowid: int, *, limit: int = 100
+) -> list[tuple[int, PortalEvent]]:
+    """Events strictly after ``(received_at, rowid)``, oldest first, with rowid.
+
+    The verdict consumer's (#2509) OWN scan, independent of the shared
+    ``handled_at`` column that :func:`unhandled_events` filters on. That
+    column is written by every consumer that ever gets added, but this one
+    only stamps it for a ``changes_requested`` event it actually dispatched —
+    every other kind is deliberately left ``handled_at IS NULL`` forever so a
+    future consumer can still read it. Scanning by ``handled_at IS NULL``
+    would therefore re-return that growing, never-marked backlog ahead of
+    anything newer on every call, and once it exceeds one page a genuinely
+    new ``changes_requested`` event behind it would never surface — see
+    :func:`coord.portal_sync._consume_verdicts`. A private, monotonic
+    watermark sidesteps that: it advances past every event this consumer has
+    *looked at*, whether or not it acted, so a pile of non-actionable events
+    cannot block the ones behind it.
+
+    Returns ``(rowid, event)`` pairs (not just events) so the caller can
+    advance the watermark to the exact row it stopped at without a second
+    query. ``rowid`` is SQLite's own implicit rowid — stable and unique
+    because ``portal_events``' primary key is the (non-integer) ``event_id``,
+    not ``rowid`` itself, so declaring the primary key never aliased it away.
+    """
+    rows = _conn().execute(
+        """
+        SELECT rowid, * FROM portal_events
+         WHERE received_at > ?
+            OR (received_at = ? AND rowid > ?)
+         ORDER BY received_at ASC, rowid ASC
+         LIMIT ?
+        """,
+        (received_at, received_at, rowid, limit),
+    ).fetchall()
+    return [(r["rowid"], _event_from_row(r)) for r in rows]
+
+
 def mark_event_handled(event_id: str, *, now: float | None = None) -> None:
     """Stamp an event as consumed. Idempotent — re-stamping is a plain UPDATE."""
     conn = _conn()
@@ -704,6 +742,8 @@ class SyncState:
     last_push_at: float | None = None
     last_heartbeat_at: float | None = None
     last_error: str = ""
+    verdict_watermark_at: float = 0.0
+    verdict_watermark_rowid: int = 0
 
 
 def get_sync_state() -> SyncState:
@@ -718,6 +758,8 @@ def get_sync_state() -> SyncState:
         last_push_at=row["last_push_at"],
         last_heartbeat_at=row["last_heartbeat_at"],
         last_error=row["last_error"] or "",
+        verdict_watermark_at=row["verdict_watermark_at"] or 0.0,
+        verdict_watermark_rowid=row["verdict_watermark_rowid"] or 0,
     )
 
 
@@ -748,6 +790,36 @@ def note_pull(*, now: float | None = None) -> None:
     _update_sync_state(last_pull_at=time.time() if now is None else now)
 
 
+def get_verdict_watermark() -> tuple[float, int]:
+    """The verdict consumer's own read position, ``(0.0, 0)`` if never set.
+
+    ``(0.0, 0)`` sorts before every real ``portal_events`` row (``received_at``
+    is a wall-clock epoch stamp, ``rowid`` starts at 1), so a fresh database
+    or one predating this column reads as "nothing scanned yet" and the next
+    scan starts from the very beginning of the inbox — see
+    :func:`events_after_verdict_watermark`.
+    """
+    row = _conn().execute(
+        "SELECT verdict_watermark_at, verdict_watermark_rowid "
+        "FROM portal_sync_state WHERE id = 1"
+    ).fetchone()
+    if row is None or row["verdict_watermark_at"] is None:
+        return (0.0, 0)
+    return (row["verdict_watermark_at"], row["verdict_watermark_rowid"] or 0)
+
+
+def set_verdict_watermark(received_at: float, rowid: int) -> None:
+    """Advance the verdict consumer's read position past ``(received_at, rowid)``.
+
+    Called after a scan has looked at that row — regardless of whether it was
+    acted on — so a run of non-actionable events cannot make this consumer
+    re-scan them forever (#2509 review fix). Independent of
+    :func:`mark_event_handled`, which is shared, per-event bookkeeping for
+    whatever future consumer looks at ``handled_at`` next.
+    """
+    _update_sync_state(verdict_watermark_at=received_at, verdict_watermark_rowid=rowid)
+
+
 def note_push(*, now: float | None = None) -> None:
     _update_sync_state(last_push_at=time.time() if now is None else now)
 
@@ -894,3 +966,21 @@ def list_milestone_links() -> list[PortalLink]:
 
     links = [PortalLink.from_dict(raw) for raw in state.list_portal_links()]
     return [link for link in links if link is not None]
+
+
+def get_link_by_submission(submission_id: str) -> PortalLink | None:
+    """Reverse lookup: the milestone link for a portal ``submission_id``, if any.
+
+    :func:`link_milestone` / :func:`get_milestone_link` only index the
+    forward direction (milestone → submission_id), which is all PDR-3's
+    auto-push needs. PDR-4's verdict consumer needs the other direction —
+    an inbound event carries only ``submission_id`` and must resolve back to
+    the ``(repo_name, milestone_number)`` coord dispatches against. Links are
+    few enough (one per submission a customer has ever been sent to) that a
+    linear scan of :func:`list_milestone_links` is simply the read path — no
+    new index, no new table.
+    """
+    for link in list_milestone_links():
+        if link.submission_id == submission_id:
+            return link
+    return None

{code_coordinator-0.5.206 → code_coordinator-0.5.207}/coord/portal_sync.py

@@ -10,9 +10,25 @@ One pass, in this order:
 1. **Pull** — customer-authored events since the stored cursor (new
    submissions · sign-off verdicts · answers to open questions) into the
    local inbox, then advance the cursor.
-2. **Push** — coord-authored facts from the outbox (design rounds · status ·
+2. **Consume verdicts** (#2509, PDR-4) — walk events pulled but not yet
+   *scanned by this consumer* (its own watermark —
+   :func:`coord.portal_store.events_after_verdict_watermark`, independent of
+   the shared ``handled_at`` column) and, for each ``changes-requested``
+   sign-off, resolve the linked ``(repo, milestone)`` (#2507, PDR-1) and
+   dispatch a targeted Gate-A contract amendment
+   (:func:`coord.mock_author.dispatch_acceptance_mock` with
+   ``amend_briefing`` set to the client's own comment) — the same
+   ``coord acceptance mock --amend`` path an operator would type by hand,
+   now triggered by the portal event instead. An event is marked consumed
+   (``handled_at``) only once the dispatch itself has succeeded, and the
+   watermark stops advancing at the first dispatch failure in a page, so a
+   crash — or a stuck dispatch (no idle machine, Gate A already claimed) —
+   re-processes that event next tick rather than dropping the client's
+   feedback or skipping past it. An ``approved`` verdict is deliberately
+   left alone here — see :func:`_consume_verdicts`.
+3. **Push** — coord-authored facts from the outbox (design rounds · status ·
    open questions), one row at a time, in per-submission FIFO order.
-3. **Heartbeat** — say the daemon is alive.
+4. **Heartbeat** — say the daemon is alive.
 
 Each phase is independently guarded: a portal outage, a rejected field, or a
 malformed event can never crash the tick or silence the other two phases (the
@@ -58,6 +74,7 @@ before can be confirmed that way.
 from __future__ import annotations
 
 import logging
+import re
 from dataclasses import dataclass, field
 from typing import Any
 
@@ -130,6 +147,29 @@ MAX_PUSH_PER_TICK = 25
 #: former freezes a customer's queue forever behind a request that will never
 #: succeed.
 MAX_PUSH_ATTEMPTS = 8
+#: Events walked per page by the verdict consumer (#2509). Bounded for the
+#: same reason as the push/pull budgets above — a large backlog must not make
+#: one tick unbounded.
+#:
+#: This consumer tracks its OWN watermark into `portal_events`
+#: (`portal_store.get_verdict_watermark` / `set_verdict_watermark`),
+#: independent of the shared `handled_at` column: a `changes-requested`
+#: sign-off is the only kind ever stamped `handled_at` here, so relying on
+#: `handled_at IS NULL` to decide what is left to scan would mean the
+#: never-marked backlog of every OTHER kind (new submissions, `approved`
+#: verdicts, Q&A answers) piles up ahead of anything newer forever, and once
+#: it exceeds one page a genuinely new `changes-requested` event behind it
+#: would never be seen again by ANY future tick. The watermark advances past
+#: every event this pass has looked at, acted on or not, so a backlog of
+#: non-actionable events cannot block the ones behind it. See
+#: :func:`_consume_verdicts`.
+MAX_VERDICTS_PER_TICK = 100
+#: Pages of `MAX_VERDICTS_PER_TICK` walked in one tick before leaving the
+#: rest for the next — the verdict-consumer counterpart to `MAX_PULL_PAGES`,
+#: for the same reason: a one-time backlog (e.g. the first tick after this
+#: consumer shipped) should drain in a handful of ticks, not one page a
+#: tick forever.
+MAX_VERDICT_PAGES = 10
 
 
 @dataclass(frozen=True)
@@ -138,6 +178,7 @@ class SyncResult:
 
     enabled: bool = True
     pulled: int = 0
+    verdicts_consumed: int = 0
     applied: int = 0
     rejected: int = 0
     held: int = 0
@@ -147,7 +188,9 @@ class SyncResult:
     @property
     def moved(self) -> bool:
         """True when this pass actually moved a row in either direction."""
-        return bool(self.pulled or self.applied or self.rejected)
+        return bool(
+            self.pulled or self.verdicts_consumed or self.applied or self.rejected
+        )
 
     def summary(self) -> str:
         if not self.enabled:
@@ -159,6 +202,7 @@ class SyncResult:
             return "portal sync: disabled"
         parts = [
             f"pulled={self.pulled}",
+            f"verdicts_consumed={self.verdicts_consumed}",
             f"applied={self.applied}",
             f"rejected={self.rejected}",
             f"held={self.held}",
@@ -326,11 +370,12 @@ def sync_tick(
     ``SyncResult(enabled=False)`` having sent nothing. Pass *client*
     explicitly to bypass config (tests, ``coord portal sync``).
 
-    The three phases are independently isolated, deliberately in this order:
+    The four phases are independently isolated, deliberately in this order:
     pull first (a sign-off verdict pulled now can be acted on this same
-    tick), push second, heartbeat last but unconditionally — a pass that
-    failed everything else still proves the daemon is alive, and that is
-    precisely the pass the portal most needs to hear about.
+    tick), then verdict consumption (#2509), then push, heartbeat last but
+    unconditionally — a pass that failed everything else still proves the
+    daemon is alive, and that is precisely the pass the portal most needs to
+    hear about.
     """
     if client is None:
         try:
@@ -353,6 +398,19 @@ def sync_tick(
         errors.append(f"pull: {exc}")
         logger.warning("portal sync: pull failed", exc_info=True)
 
+    # #2509 (PDR-4): act on whatever the pull above (or an earlier tick) left
+    # in the inbox. Isolated exactly like the other phases — a dispatch
+    # failure (no idle machine, GitHub down, the milestone's Gate A already
+    # claimed) must not silence push or heartbeat, and must not be mistaken
+    # for a portal-side problem.
+    verdicts_consumed = 0
+    try:
+        verdicts_consumed, verdict_errors = _consume_verdicts(config, now=now)
+        errors.extend(verdict_errors)
+    except Exception as exc:  # noqa: BLE001
+        errors.append(f"verdicts: {exc}")
+        logger.warning("portal sync: verdict consumption failed", exc_info=True)
+
     applied = rejected = held = 0
     try:
         applied, rejected, held, push_errors = _push(
@@ -391,6 +449,7 @@ def sync_tick(
     return SyncResult(
         enabled=True,
         pulled=pulled,
+        verdicts_consumed=verdicts_consumed,
         applied=applied,
         rejected=rejected,
         held=held,
@@ -505,6 +564,261 @@ def _mirror_event(event: dict[str, Any], *, now: float | None) -> None:
         portal_store.seed_revision(submission_id, revision, now=now)
 
 
+# ── consuming portal verdicts (#2509, PDR-4) ────────────────────────────────
+#
+# The counterpart to `enqueue_*` above: those put coord-owned facts on the
+# outbound queue, this acts on customer-owned ones the portal already sent.
+# `portal_store.unhandled_events()` / `mark_event_handled()` have existed as
+# pull-side plumbing since #1982 with zero callers — this consumer is the
+# first, but does NOT scan through `unhandled_events()` (see below).
+#
+# Scope, deliberately narrow: only a `changes-requested` sign-off is acted on
+# here. Every other event kind (a new submission, an `approved` sign-off, an
+# answer to an open question) never gets `handled_at` stamped by this
+# consumer — not lost, just not this ticket's job — so a future consumer can
+# still read it via `unhandled_events()`, and nothing here silently decides a
+# question it wasn't asked. See the "approved" branch below for the specific
+# open question this deliberately does not resolve.
+#
+# That is also exactly why this consumer cannot scan `unhandled_events()`
+# (`handled_at IS NULL`, oldest first) to find its own work: every kind above
+# piles up there FOREVER, always sorted ahead of anything newer, so once that
+# backlog exceeds one page a genuinely new `changes-requested` event behind
+# it would never be returned — not this tick, not any future one (found in
+# review; reproduced by seeding 150 non-actionable events ahead of one
+# `changes_requested` event and running 5 ticks: `consumed == 0` every time,
+# and the targeted event never appeared in `unhandled_events()`'s result at
+# all). Instead this consumer tracks its OWN watermark
+# (`portal_store.get_verdict_watermark` / `set_verdict_watermark`,
+# `events_after_verdict_watermark`) into `portal_events`, which advances past
+# every event it has looked at regardless of what it decided — so a pile of
+# events it will never mark `handled_at` cannot block it from reaching what
+# comes after them.
+
+
+def _signoff_verdict(event: "portal_store.PortalEvent") -> str | None:
+    """The sign-off verdict *event* carries, or ``None`` if it isn't one.
+
+    The portal's own event contract for a sign-off is not fully pinned down
+    yet, so this reads either shape that has been observed: the verdict as a
+    suffix on ``type`` (``"signoff.changes_requested"``) or nested in the
+    event's ``data``/``fields`` payload (``{"type": "signoff", "data":
+    {"verdict": "changes_requested"}}``). Never raises on a malformed event —
+    it just returns ``None``, and the event is left unhandled for a human to
+    look at rather than mis-filed as "not a sign-off".
+    """
+    kind = (event.kind or "").strip()
+    if not (kind == "signoff" or kind.startswith("signoff.")):
+        return None
+    if "." in kind:
+        suffix = kind.split(".", 1)[1].strip()
+        if suffix:
+            return suffix
+    payload = event.payload if isinstance(event.payload, dict) else {}
+    nested = payload.get("data")
+    if not isinstance(nested, dict):
+        nested = payload.get("fields")
+    verdict = nested.get("verdict") if isinstance(nested, dict) else None
+    if not isinstance(verdict, str) or not verdict.strip():
+        verdict = payload.get("verdict")
+    return verdict.strip() if isinstance(verdict, str) and verdict.strip() else None
+
+
+def _signoff_comment(event: "portal_store.PortalEvent") -> str:
+    """The client's own comment text on *event*, or ``""`` if it left none."""
+    payload = event.payload if isinstance(event.payload, dict) else {}
+    nested = payload.get("data")
+    if not isinstance(nested, dict):
+        nested = payload.get("fields")
+    for source in (nested, payload):
+        if not isinstance(source, dict):
+            continue
+        for key in ("comments", "comment", "message", "note"):
+            value = source.get(key)
+            if isinstance(value, str) and value.strip():
+                return value.strip()
+    return ""
+
+
+def _resolve_tracking_issue(repo_cfg: Any, milestone_number: int) -> int | None:
+    """The milestone's tracking (epic) issue number, or ``None`` if unresolved.
+
+    Every command that dispatches milestone work
+    (:func:`coord.mock_author.dispatch_acceptance_mock` included) is keyed by
+    tracking-issue number, resolving the milestone FROM it — but a
+    :class:`coord.portal_store.PortalLink` only carries the milestone number
+    the other direction, inbound events never see a tracking-issue number at
+    all. This is the reverse lookup, same approach
+    :func:`coord.plans.aggregate_repo_plans` already uses: open issues + the
+    closed-epics list, filtered to the one carrying the epic label under this
+    milestone (:func:`coord.plans.find_tracking_issue`).
+    """
+    from coord import github_ops  # noqa: PLC0415
+    from coord.plans import find_tracking_issue  # noqa: PLC0415
+
+    candidates = github_ops.get_open_issues(repo_cfg.github) + github_ops.get_closed_epics(
+        repo_cfg.github
+    )
+    tracking = find_tracking_issue(milestone_number, candidates)
+    return tracking["number"] if tracking is not None else None
+
+
+def _amend_from_verdict(config: Any, event: "portal_store.PortalEvent") -> None:
+    """Dispatch the targeted Gate-A amendment for one `changes-requested` event.
+
+    Raises on anything that stops the dispatch (no link recorded, unknown
+    repo, no resolvable tracking issue, Gate A already claimed, no idle
+    machine, ...) — the caller marks the event consumed only if this returns
+    normally, so any of these leaves the event to retry next tick rather than
+    dropping the client's feedback.
+    """
+    link = portal_store.get_link_by_submission(event.submission_id)
+    if link is None:
+        raise RuntimeError(
+            f"no milestone is linked to portal submission "
+            f"{event.submission_id!r} (coord portal link) — cannot resolve "
+            "where to dispatch the amendment"
+        )
+    repo_cfg = config.repo(link.repo_name)
+    if repo_cfg is None:
+        raise RuntimeError(
+            f"linked repo {link.repo_name!r} is not in coordinator.yml"
+        )
+
+    tracking_issue_number = _resolve_tracking_issue(repo_cfg, link.milestone_number)
+    if tracking_issue_number is None:
+        raise RuntimeError(
+            f"could not resolve a tracking (epic) issue for milestone "
+            f"{link.milestone_number} in {link.repo_name!r}"
+        )
+
+    comment = _signoff_comment(event)
+    amend_text = comment or (
+        "The client requested changes via the portal sign-off but left no "
+        f"comment text — check portal submission {event.submission_id!r} "
+        "directly for context."
+    )
+
+    from coord.mock_author import dispatch_acceptance_mock  # noqa: PLC0415
+
+    dispatch_acceptance_mock(
+        link.repo_name,
+        tracking_issue_number,
+        config,
+        amend_briefing=amend_text,
+    )
+
+
+#: Matches a sign-off verdict's separator, whichever the portal actually
+#: used — a literal hyphen (`"changes-requested"`) or a space
+#: (`"changes requested"`). The portal's own event contract for this field
+#: is not fully pinned down (see `_signoff_verdict`'s docstring), so both are
+#: folded to `_` before comparing against `"changes_requested"` rather than
+#: risking a silent no-match on a contract detail neither side has confirmed.
+_VERDICT_SEPARATOR_RE = re.compile(r"[-\s]+")
+
+
+def _normalize_verdict(verdict: str) -> str:
+    return _VERDICT_SEPARATOR_RE.sub("_", verdict.strip().lower()).strip("_")
+
+
+def _consume_verdicts(
+    config: Any,
+    *,
+    limit: int = MAX_VERDICTS_PER_TICK,
+    pages: int = MAX_VERDICT_PAGES,
+    now: float | None = None,
+) -> tuple[int, list[str]]:
+    """Walk the inbox from this consumer's own watermark, acting on every
+    `changes-requested` sign-off found.
+
+    Requires *config* (a real :class:`coord.config.Config`) to resolve the
+    linked repo and dispatch through — a bare *client* (the test/CLI bypass
+    :func:`sync_tick` also accepts) is not enough to dispatch anything, so
+    with no config this is a deliberate no-op rather than a crash.
+
+    Returns ``(consumed, errors)``. Never raises: every event is handled
+    inside its own try/except so one bad event (an unresolved link, a
+    machine-picking failure) cannot stop the rest of the *page* — mirroring
+    `_push`'s per-row isolation. It CAN, deliberately, stop the watermark: the
+    first dispatch failure freezes it at the position just before that event,
+    so a still-broken link or a still-claimed Gate A is retried every tick
+    rather than silently skipped — the same "an event is marked consumed only
+    once the dispatch itself has succeeded" guarantee this module's docstring
+    promises, just enforced by a cursor now instead of a shared flag. Events
+    already looked at earlier are still walked (and, if newly actionable,
+    still acted on) even while frozen — only the PERSISTED watermark holds
+    still, so isolation and no-silent-drop both hold at once.
+    """
+    if config is None:
+        return 0, []
+    consumed = 0
+    errors: list[str] = []
+
+    initial_at, initial_rowid = portal_store.get_verdict_watermark()
+    commit_at, commit_rowid = initial_at, initial_rowid
+    scan_at, scan_rowid = initial_at, initial_rowid
+    blocked = False
+
+    for _page_num in range(pages):
+        page = portal_store.events_after_verdict_watermark(
+            scan_at, scan_rowid, limit=limit
+        )
+        if not page:
+            break
+        for rowid, event in page:
+            scan_at, scan_rowid = event.received_at, rowid
+            if event.handled_at is not None:
+                # Already dispatched by an earlier pass — e.g. this tick's
+                # commit point is frozen behind a still-failing sibling from a
+                # PRIOR tick and this one was successfully handled back then,
+                # before that sibling ever failed. Nothing new to do; just
+                # let the scan move past it without re-dispatching.
+                if not blocked:
+                    commit_at, commit_rowid = scan_at, scan_rowid
+                continue
+            verdict = _signoff_verdict(event)
+            if verdict is None:
+                if not blocked:
+                    commit_at, commit_rowid = scan_at, scan_rowid
+                continue
+            if _normalize_verdict(verdict) != "changes_requested":
+                # Includes "approved". Whether an approved verdict should
+                # auto-record `coord gate-a --approved` (coord/gate_a.py) or
+                # wait for a separate operator confirmation is an open policy
+                # question (#2509) — deliberately not decided here. Leaving
+                # `handled_at` unset means a future consumer can still see it
+                # via `unhandled_events()`; advancing the watermark just means
+                # THIS consumer will not look at it again, which is separate.
+                if not blocked:
+                    commit_at, commit_rowid = scan_at, scan_rowid
+                continue
+            try:
+                _amend_from_verdict(config, event)
+            except Exception as exc:  # noqa: BLE001 — one bad event must not stop the page
+                errors.append(
+                    f"verdict {event.event_id} ({event.submission_id}): {exc}"
+                )
+                logger.warning(
+                    "portal sync: could not act on changes-requested verdict "
+                    "for submission %s",
+                    event.submission_id,
+                    exc_info=True,
+                )
+                blocked = True
+                continue
+            portal_store.mark_event_handled(event.event_id, now=now)
+            consumed += 1
+            if not blocked:
+                commit_at, commit_rowid = scan_at, scan_rowid
+        if blocked or len(page) < limit:
+            break
+
+    if (commit_at, commit_rowid) != (initial_at, initial_rowid):
+        portal_store.set_verdict_watermark(commit_at, commit_rowid)
+    return consumed, errors
+
+
 def _push(
     client: Any, *, limit: int, now: float | None
 ) -> tuple[int, int, int, list[str]]:

{code_coordinator-0.5.206 → code_coordinator-0.5.207}/coord/serve_app.py

@@ -777,6 +777,15 @@ def _portal_sync_tick(config: Config):  # noqa: ANN201 — coord.portal_sync.Syn
     internet and an outage there must never touch dispatch, merge, or any
     verdict.  The caller's try/except is the belt to that braces.
 
+    As of #2509 (PDR-4), one of `sync_tick`'s phases *is* a verdict: it
+    drains events pulled but not yet consumed
+    (``coord.portal_store.unhandled_events``) and, for each
+    `changes-requested` sign-off, dispatches a targeted Gate-A contract
+    amendment (``coord.mock_author.dispatch_acceptance_mock``) against the
+    milestone PDR-1's link (``coord portal link``) resolves — the same
+    ``coord acceptance mock --amend`` an operator would type by hand, now
+    triggered by the client's own portal comment instead.
+
     Extracted as a module-level function so tests can call it directly without
     wiring up the async ``_tick_loop`` infrastructure (mirrors
     ``_passive_tick`` / ``_sync_issues_tick``).