- db.ts: restrict migration-105 orphan-step cleanup to JSON arrays
(json_type guard so json_each can't expand objects/strings)
- project-engine.ts: requestInterpreterMerge throws on null task lookup
instead of casting null into MergeResult (seam converts to clean failure)
- executor.ts: truncate dual-observe shadow stage walk at the live terminal
stage so healthy in-review tasks don't record a phantom merge transition
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migration 102 defers the destructive agentLogEntries drop until TaskStore
copies legacy rows to JSONL and writes the __meta guard, then relies on a
second init() pass gated on schemaVersion < SCHEMA_VERSION. Migrations
103-105 bump the version to 105 on the first pass, so the second pass never
fired and the legacy table survived forever. Make the drop version-independent
in migrate() and trigger the re-init whenever the legacy table remains.
Also pin secrets-schema.test.ts to String(SCHEMA_VERSION) instead of the
hardcoded "102" string the schema bump invalidated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Extends the test-setup git hardening. The engine --shard=2/2 worktree-heavy
reliability suite was hanging in CI (progressing healthily, then ~2 min of
silence before the job timeout killed it with no test failure) — the signature
of a git command blocking on an interactive prompt. A dev macOS git config
suppresses these; a bare Linux CI git does not. Disable terminal credential
prompts (GIT_TERMINAL_PROMPT=0), the editor (GIT_EDITOR=true), and the pager
(GIT_PAGER=cat) for every test process so no git invocation can block on a TTY.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Git defaults the initial branch to 'master' unless init.defaultBranch is set —
true on Linux CI runners but typically overridden to 'main' on developer macOS
machines. That host gap made git-worktree tests assuming 'main' (the
shared-branch-group reliability suite in engine shard 2/2) pass locally but
fail only in CI with 'fatal: path ... does not exist in main'.
Set init.defaultBranch=main for every test process via GIT_CONFIG_* env vars in
the shared core test setup (inherited by all child git invocations, without
mutating the developer's global config). Appends rather than clobbers any
pre-existing GIT_CONFIG_COUNT.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Settings → Experimental gains a 'Workflow Graph Engine — dual-observe parity
(diagnostic)' toggle for the workflowInterpreterDualObserve flag.
- store.getWorkflowParitySummary() aggregates the workflow:parity-observed /
workflow:parity-drift run-audit events into the graduation signal: agree-rate,
per-field drift counts, and recent drift samples. Covered by
workflow-parity-summary.test.ts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add buildWorkflowObservationFromTask (legacy authoritative side, from a task's
terminal column/status/review/mergeDetails + recorded column history) and
buildWorkflowObservation (interpreter/shadow side, from explicit parts), plus
deriveStageTransitions (maps the task-move column history to execute/review/
merge stages) and DEFAULT_WORKFLOW_INVARIANTS. These let both sides of the
dual-observe seam produce a comparable WorkflowRunObservation without
hand-rolling the shape. Covered by workflow-parity.test.ts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This PR advanced @fusion/core's SCHEMA_VERSION 102 → 105 (migrations 103
workflows, 104 task_workflow_selection, 105 orphaned-selection cleanup) but
the "reaches current version after init/migrate" assertions across the core
test suite — and the roadmap plugin's mirror test — still hardcoded 102. The
dashboard build break was masking this: the test shards never ran until the
build was fixed, then all four failed on `expected 105 to be 102`.
Updated every getSchemaVersion()).toBe(102) current-version assertion to 105
(db, db-migrate, goals-schema, insight-store, mission-store, run-audit,
store-merge-queue, merge-request-record, task-documents) plus the roadmap
plugin. agent-log-migration already asserts against the imported SCHEMA_VERSION
constant (the robust pattern); central-db asserts its own version 13 and is
unaffected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Resolve the two needs-human findings from PR #1363 review, plus surface the flag.
Merge seam (project-engine.ts):
- manualMergeResolvers is now a per-task LIST of waiters. Both the dashboard
"merge now" path and the interpreter merge seam call onMerge, so a single
resolver per task let the second caller overwrite (and strand) the first.
All resolve/reject/requeue/late-resolver/shutdown sites drain the whole list.
- New requestInterpreterMerge() honors auto-merge eligibility: when autoMerge
is off (or the task isn't merge-ready) it returns merged:false instead of
forcing the merge, so a graph merge node can't override an autoMerge-off
project — it parks the task in review for a human. setMergeRequester now wires
the interpreter to this gate rather than the human bypass.
Selection race (store.ts):
- selectTaskWorkflow/clearTaskWorkflowSelection now hold one withTaskLock across
their whole mutate sequence. Extracted updateTaskUnlocked() (the per-task lock
is non-reentrant, so they couldn't wrap the public updateTask without
deadlocking) and call that inside the lock.
Settings:
- Add "Workflow Graph Engine (run custom workflows)" to the Experimental
Features list so the workflowGraphExecutor flag is a labeled toggle in
Settings → Experimental, not just a raw key.
Tests: interpreter-merge-seam.test.ts (multi-waiter resolve/reject + autoMerge
eligibility gate); existing merge lifecycle/bypass/selection suites still pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- needsPrRepair no longer short-circuited by the open-state guard: legacy
fallback rows (finalized + prState open + prNumber null) now repair by
creating the real PR on re-promotion; regression test added
- no-PR abandon route test asserts last persisted call + response body
- goal-provenance fallback test clears missionId on its own in-memory store
so the feature-linkage path is genuinely exercised
- ko added to SUPPORTED_LOCALES and every enumeration site (config,
settings enum, help text, tests); Korean catalogs authored for all
current keys; CLI bundles regenerated for 6 locales; 한국어 endonym
- README translated into zh-CN, zh-TW, fr, es, ko; every README carries
a language-switcher line and the localized ones note that English is
canonical
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Greptile + CodeRabbit findings across core/engine/dashboard. Stale findings
(written against earlier commits) verified and skipped; valid ones fixed.
Engine:
- await-input: do not clear pausedReason in the /input route (the node's
marker must survive unpause); the node clears it after consuming input.
Embed a colon-free epoch watermark in the marker so only post-pause steering
comments count as the reply (ISO timestamps collided with the colon
separator and the dashboard question parser).
- gate nodes without a registered runner now fail closed (throw) instead of
silently passing.
- a thrown interpreter error in maybeExecuteWorkflowGraph now falls back to the
legacy pipeline instead of stranding the task in-progress.
- approved-CLI path clears the stale awaiting-cli-approval status/marker.
Core:
- persist+cascade workflow selection: purge task_workflow_selection rows and
compiled workflow_steps on physical task deletes; migration 105 cleans
already-orphaned rows; catch-cleanup for materialized steps when the owner
write fails; WF-id allocation now in a BEGIN IMMEDIATE transaction.
- compiler validates the canonical execute->review->merge seam order (rejects
duplicate/misordered seams).
- disk-backed reopen round-trip + tightened updatedAt/list assertions.
Dashboard:
- WorkflowSelector clears stale default/options across project changes and on
fetch failure; InlineCreateCard/NewTaskModal reset the workflow on all
clear/discard paths and include it in dirty-state.
- WorkflowNodeEditor: config-key deletion now persists; removed an invalid
eslint-disable that was itself a hard lint error.
- TaskCard: single status badge for awaiting-input (no duplicate).
- WorkflowResultsTab: reset paused-action UI between pauses; surface
resume/approve failures inline.
- TaskDetailModal: treat awaiting-user-input/awaiting-cli-approval/paused as
not-in-progress for the live-log subscription.
- workflow-flow-mapping: don't write synthetic node names back into IR.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Main independently landed the same pausedReason persistence fix (column in
the task INSERT/upsert, TaskRow type, rowToTask mapping) with the column
ordered between paused and userPaused; adopt main's ordering and drop this
branch's duplicate entries so the values array stays aligned. Union the
dashboard package.json deps (main's compound-engineering plugin alongside
this branch's sorted pi-coding-agent/cli-printing-press/cursor-runtime).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Both sides bootstrapped CONCEPTS.md — kept main's broader structure (Missions,
Merge lifecycle, CE sessions) and folded the branch-group vocabulary into its
Merge-lifecycle cluster (enriched Shared branch group + Self-healing sweep;
added Branch assignment mode, Landed, Group promotion). Union-merged core
index/store imports; took main's AGENTS.md discoverability wording. Also adds
execFile to the two child_process test mocks that only stubbed exec (the
coordinator's argv-based git calls now require it).
- syncGroupPrCallback forwards owner/repo to updatePr (multi-project daemons
could 404 or edit an unrelated same-numbered PR via process-cwd fallback)
- merger background reconcile re-reads the group before persisting and skips
the write when the PR snapshot changed (stale-write race vs newer open PR)
- branchContext.groupId trimmed on metadata emit/parse round-trip
- triageSlice non-shared invariant assertions (no groupId, no group row)
Address PR #1363 review findings:
- core: pausedReason was written in-memory and read by SELECT but never
persisted by the task upsert (missing column/value) nor mapped back in
rowToTask — so it was lost on every reload. Add it to both. This is the
root cause behind the workflow CLI-approval / await-input pause cycle and
also fixes token-budget / worktrunk pause reasons silently vanishing.
- dashboard: approve-cli now derives the approved command exclusively from
the task's pausedReason; a caller-supplied body.command is ignored, closing
a trust-on-first-use bypass.
- engine: await-input nodes resume only when THIS node paused the task (its
marker on pausedReason), not on any pre-existing steering comment.
- engine: write-capable custom nodes (coding/script/CLI) are refused until a
task worktree exists, so they never mutate the shared repo root before the
execute seam.
- engine: document cliSkipApproval as an intentional workflow-author-only
escape hatch; scriptName is now const (ESLint).
- tests: pausedReason round-trip coverage in store-persistence; approve-cli
body-command-ignored + no-pending-command coverage; built-in-aware list
assertion in workflow-routes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Users can now watch everything the agent does while a CE stage works, steer
it mid-stage, and read the whole conversation as a proper chat surface.
Live output:
- New host capability: CreateInteractiveAiSessionOptions.onProgress — the
engine adapter streams thinking/text deltas + tool start/end markers from
the pi agent hooks (any plugin can use this).
- Orchestrator buffers per-session live activity (merged deltas, discrete
tool lines, capped), emits throttled progress events over SSE, and
GET /sessions/:id attaches it as liveActivity for the polling fallback.
- Routes detach turn execution: start/answer/resume return immediately
(status active) and clients converge via push/poll — the turn is watchable
instead of hidden inside a blocking POST.
- Turn timeout is now INACTIVITY-based: an actively-working long turn is
never killed; a quiet one interrupts with its working trace preserved.
- On settle the trace persists into history as a condensed record.
Steering:
- Stage protocol: responses may be a direct answer, {value, comment}
(answer + guidance), or {feedback} (guidance without answering); the
system prompt instructs agents to treat steering as first-class input.
- CeFlow: guidance textarea alongside selectable questions — attach to the
clicked answer, or "Send guidance" on its own.
Q&A UI:
- Transcript no longer hides control records: past questions/answers render
as chat bubbles (option ids → labels), steering turns marked, working
traces as collapsible "Agent work" blocks, completion marker.
- Live working pane (pulse + streaming thinking/tool lines) while a turn runs.
Tests: 130 plugin tests green (14 new: live buffer/flush ordering, inactivity
watchdog survives active work, detached convergence, steering payload shapes,
transcript rendering, live pane). Engine seam tests green; plugin/core/
engine/dashboard tsc clean. Core full suite OOMs locally (known orchestrator-
shell issue) — covered by CI shards.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ship read-only built-in workflows surfaced in the workflow list and selectable
like any workflow: 'Coding' (the existing execute->review->merge pipeline as a
graph), 'Quick fix' (no review), 'Review-heavy' (extra security gate), and
'Compound engineering' (plan -> implement -> review -> code-review gate ->
merge -> document, invoking ce-plan/ce-code-review/ce-compound skills). Built-ins
lead the list, resolve by id for selection, and reject edit/delete.
CLI prompt nodes now accept a raw cliCommand (any command + args), not just
named scripts. A raw command must be explicitly approved by the user before it
runs: an unapproved command pauses the task (status awaiting-cli-approval) with
the command shown; the user approves via POST /tasks/:id/workflow/approve-cli,
which records the exact command string in settings.approvedWorkflowCliCommands
and resumes. Named scripts (settings.scripts) still never require approval.
Adds POST /tasks/:id/workflow/input to answer await-input nodes (records a
steering comment + resumes).
Two compounding bugs made the memory-pressure vitest auto-kill a
30-second SIGKILL sweep of anything mentioning vitest:
1. False pressure: getAvailableMemory probed os.availableMemory, which
does not exist, and silently fell back to os.freemem() — on macOS
that reads ~99% used on an idle 256GB machine, permanently above the
90% threshold. Now reads process.availableMemory() (Node 22+) and
refuses to auto-kill when only the unreliable freemem fallback is
available.
2. Overbroad targeting: pgrep -f vitest matches full command lines, so
the sweep also killed wrapper shells (zsh -c '... npx vitest run'),
monitor loops, and anything else whose argv mentions vitest —
stranding exit handlers and taking out unrelated process trees.
New shared findVitestProcessIds (@fusion/core) filters matches to
actual node executables.
Surface enumeration (all vitest-process kill/count surfaces):
- TUI memory-pressure auto-kill (controller.killVitestProcesses)
- TUI manual kill-vitest command (same method)
- dashboard POST /api/kill-vitest
- dashboard GET /api/system-stats vitestProcessCount (display)
All four now route through findVitestProcessIds.
- liveness: graph-routed tasks count as executing in getExecutingTaskIds/
isTaskActive and are skipped by recoverCompletedTask + the completed-task
resume fast-path — recovery can no longer drive a parallel lifecycle (P0)
- handleGraphFailure: sets status 'failed' (self-healing revival exemption,
prevents FN-5704-style re-run loop) and leaves paused tasks untouched
- execute seam distinguishes pause/abort from implementation failure
- merge seam: 30-minute timeout so a wedged queue cannot strand the run
- awaitAbortInFlightTaskWork: defensive interceptor/routing cleanup
- deleteWorkflowDefinition: cascades to selections, materialized steps,
affected tasks' enabledWorkflowSteps, and the project default
Expose operational log retention as a project setting in the dashboard.
- add an Operational log retention selector to the Project General settings section with supported retention options
- validate operationalLogRetentionDays in the settings API and cover accepted and rejected values in tests
- document the constrained retention values and assert project-scope/default parity for the setting
Files changed:
docs/settings-reference.md | 2 +-
packages/core/src/__tests__/settings-parity.test.ts | 7 ++++
packages/dashboard/app/components/SettingsModal.tsx | 47 ++++++++++------------
packages/dashboard/app/components/__tests__/SettingsModal.test.tsx | 8 ++++
packages/dashboard/src/__tests__/routes-settings.test.ts | 21 ++++++++++
packages/dashboard/src/routes/register-settings-memory-routes.ts | 10 +++++
6 files changed, 69 insertions(+), 26 deletions(-)
Fusion-Task-Id: FN-5939
Fusion-Task-Lineage: 2148dd88-1cef-4c6d-9696-31148fce97d3
Resolves the remaining review threads:
- Reset to auto-detect across all three layers (Greptile): store passes
language:null through as null-as-delete; dashboard gains an Auto option
(clearLanguage + hasExplicitChoice in useLanguage, re-detects from
navigator, syncs cross-tab); CLI accepts 'fn settings set language auto'.
Catalog keys added for all five locales; tests at every layer.
- CLI i18n test singleton: afterEach locale restore so zh-CN/fr switches
can't leak across cases (CodeRabbit nitpick)
- useLocaleFormat memoized per locale for stable formatter identities
(CodeRabbit nitpick)
- settings-reference.md documents the auto reset path
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Review residuals #5/#7/#8/#11/#12 + #3 wiring: forward the configured GitHub
token to the abandon route's client; guard abandon against finalized/merged
groups; reconcile an open group PR's state from GitHub on single-group reads
(merged out-of-band now flips prState); add fn branch-group abandon for
agent-native parity; block branchName shell injection (execFile argv push +
core-side branch-name validation at group creation); and collapse the
branch-groups list N+1 to a single task fetch via a shared
filterTasksByBranchGroup helper.
Engine half: real-git E2E covering planning- and mission-sourced groups —
members land on the group branch (never main/sibling), completion-gated single
PR via injected callback, re-promote idempotency, sync on later landing,
abandon→closed, and a self-healing finalize mid-flow staying group-anchored.
Core half: real triageFeature stamps the BG- id, member enumeration, and the
canonical completion gate flipping on landing.
Tasks with autoMerge explicitly enabled never auto-merged when the
project-level setting was disabled: the merge enqueue gate
(allowInReviewMergeProcessing) and all 19 in-review self-healing sweeps
checked only settings.autoMerge, and the board stall-signal hydration
passed the raw global into the diagnostic gates.
Introduce allowsAutoMergeProcessing(task, settings) in core — additive
relative to the global setting so configs with global auto-merge ON are
unchanged (explicit autoMerge:false tasks still flow to the merger's
manual-required parking) — and use it at the enqueue gate, every
self-healing sweep, and the store's stall/stalled signal contexts.
- selectTaskWorkflow: compile once, materialize the new steps and repoint the
task before deleting prior rows, so a mid-flight failure never leaves the
task referencing deleted step ids
- createTaskWithReservedId: inherit the project default workflow like
createTask (imports/reserved-id creations were skipping it)
- setDefaultWorkflowId: use null (updateSettings' delete sentinel) to clear
- parseWorkflowLayout: reject JSON arrays
- editor inspector: gate-mode default display now matches the compiler
(script/gate block by default, prompt is advisory)
Consolidate the duplicated step-materialization loop; validate by compiling
before any mutation so a non-linear graph still aborts with nothing written.
Add WorkflowSelector: a per-task picker in the task detail workflow tab that
applies a workflow (selection returns the resulting enabledWorkflowSteps so the
controlled steps list refreshes in place), and a ProjectDefaultWorkflowField in
Project General settings for the default new tasks inherit.
Selecting a workflow compiles it, materializes WorkflowStep rows (tagged and
hidden from the step manager), and writes their ids into the task's existing
enabledWorkflowSteps — the executor's read path is untouched. Re-selection
replaces prior steps with no orphans; non-linear graphs abort before any write.
New tasks inherit a project default workflow (settings.defaultWorkflowId) ahead
of legacy default-on steps. Adds task_workflow_selection table (migration 104).
No scheduler/executor/merger changes.
Add compileWorkflowToSteps + validateLinearity: walk the linear main path of a
WorkflowIr, emit prompt/script/gate user nodes as ordered WorkflowStep inputs,
skip the execute/review seams, and use the merge seam as the pre-/post-merge
boundary. Non-linear graphs (branching beyond canonical seam success/failure)
throw WorkflowCompileError so they route to the deferred interpreter instead of
mis-executing.
Route and coordinator disagreed on landed/complete: the route required
mergeConfirmed + matching mergeTargetBranch, the coordinator accepted bare
column===done/in-review and never checked the branch. Extract canonical
isBranchGroupMemberLanded/isBranchGroupComplete in @fusion/core (stricter
route semantics win — load-bearing for merge-target safety) and consume from
both sides. Tightens promotion gating to fire only when all members are
merge-confirmed onto the group branch.
Add a workflows table (migration 103) storing WorkflowIr graphs plus editor
layout, with CRUD on TaskStore (create/list/get/update/delete) that validates
the IR via parseWorkflowIr on write. IDs (WF-001…) use a monotonic __meta
counter that never reuses across deletes.
Planning and mission entry points discarded the BranchGroup returned by
ensureBranchGroupForSource and stamped a synthetic planning:/mission: string
that never resolved against getBranchGroup, breaking member enumeration.
Capture and stamp the real BG- id; stop setTaskBranchGroup hardcoding
assignmentMode; add a removable legacy read-side shim. Export TaskBranchContext.
