## What this PR does
Closes three lifecycle gaps in the Mission → Milestone → Slice →
**Feature** model, where a feature links to exactly one delivery task
(single-valued `feature.taskId`, one-feature-one-task):
1. **Reverse-lineage done-credit** — a terminal, non-failed task
carrying a feature's reverse `missionLineage`
(featureId/sliceId/missionId) now credits the feature as satisfying its
acceptance criteria, independent of where the forward `feature.taskId`
points (e.g. a newer follow-up task). Credit is only applied when
**none** of the feature's lineage candidates is live, so a live
follow-up keeps the feature active. Fixes features that otherwise sit
"in-progress" forever after their delivering task completes.
2. **Re-point / unlink surface** — new `fn_feature_repoint_task` /
`fn_feature_unlink_task` agent tools (engine + CLI) backed by an atomic
`repointFeatureToTask` store primitive, so a mis-linked feature can be
re-attached to the correct delivery task or unlinked — without a manual
DB edit. Single-valued `feature.taskId` and one-feature-one-task
invariants are preserved; unlinking an already-unlinked feature errors
clearly. Classified as mutation tools, same class as the existing
`fn_feature_link_task`.
3. **Live SSE update** — the `feature:unlinked` store event is now
emitted over SSE (`event: feature:unlinked`) so the dashboard refreshes
immediately after a re-point/unlink instead of waiting for the next
poll.
## Why
The forward-only `feature.taskId` link made three real failure modes
unrecoverable from the product surface: stale done-features after task
replacement, permanently mis-linked features, and a stale dashboard
after a repair. This closes the feature lifecycle end-to-end.
## Invariants
- `feature.taskId` stays single-valued; one feature is linked to at most
one task at any time (atomic store primitive).
- Done-credit requires: terminal column, non-failed, and no live lineage
candidate.
- No new run-audit prose; store events carry ids/counts/outcomes only.
## Tests
- `mission-state-reconcile.test.ts` — reverse-lineage credit matrix
(live vs. terminal vs. failed candidates)
- `mission-store.pg.test.ts` — `repointFeatureToTask` atomicity +
invariants (PG; gate-safe auto-skip without Postgres)
- `agent-mission-tools.test.ts` — tool delegation (unlink / re-point
exactly once)
- `heartbeat-executor.test.ts`, `extension.test.ts` — tool exposure and
heartbeat interaction
- Changeset: `@runfusion/fusion: minor`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added tools to reassign a feature to another live task or remove its
task link.
- Unlinking resets the feature to a defined state and provides clear
errors when applicable.
- Added live updates for feature unlink events.
- Improved reconciliation to recognize completed reverse-lineage work
while respecting active follow-up tasks and failures.
- Improved relationship consistency when concurrent task-link operations
occur.
- **Documentation**
- Documented feature linking, unlinking, reassignment, lifecycle events,
and reconciliation behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Fusion <noreply@runfusion.ai>
Short untitled task descriptions now receive stable planning titles instead of an empty placeholder.
- Derive short-task titles from the first meaningful description line with shared normalization and length safety.
- Preserve explicit titles and leave long or empty descriptions on existing AI/none behavior.
- Persist the planning heading title through normal task metadata finalization and document the threshold.
Files changed:
.changeset/fn-032-short-description-title.md | 7 ++
docs/settings-reference.md | 2 +-
docs/task-management.md | 4 +-
packages/engine/src/__tests__/triage.test.ts | 115 ++++++++++++++++++++++++---
packages/engine/src/triage.ts | 23 +++++-
5 files changed, 137 insertions(+), 14 deletions(-)
Fusion-Task-Id: FN-032
Fusion-Task-Lineage: 886f5a32-7eb5-460d-bf1a-93ebf5dc0b93
Co-authored-by: Fusion <noreply@runfusion.ai>
## Summary
- observe the injected executor dispatch seam in the orphan-resume lane
test
- make the lane guard non-vacuous and cover every renamed non-WIP lane
## Test plan
- `corepack pnpm --filter @fusion/engine exec vitest run
src/__tests__/executor-resume-lanes-resolved.test.ts
--silent=passed-only --reporter=dot` (12 passed)
- `corepack pnpm --filter @fusion/engine typecheck`
project-engine.test.ts hand-writes a factory for ../merge/merger-ai.js, and
it had drifted from the module: WorkspaceMergeDispatchSupersededError was
missing. Production imports that class, so the merge-queue drain threw "No
<export> is defined on the mock" before the code under test ran — the four
Phase C hardening cases then failed on a resolved promise and an absent
updateTask call, for a reason unrelated to what they assert.
No product change. All 114 tests in the file pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Auditing for repeats of the `pnpm dev --tunnel` bugs turned up the same
mistakes elsewhere.
Remote tunnels assumed 4040. ProjectEngine's Cloudflare quick tunnel
hardcoded http://localhost:4040, so a dashboard on an explicit --port, a PORT
override, or runDashboard's EADDRINUSE rebind published a PUBLIC tunnel to
whatever else held 4040. The dashboard now records its bound port
(setLocalDashboardPort, from both runDashboard and headless serve) and the
tunnel reads it, keeping 4040 only as the pre-report default.
register-discovery-routes already derived its port from req.socket.localPort
and is untouched.
Stopping the dev wrapper orphaned everything it started. It installed no
signal handlers, so teardown only ran from the child's close handler:
signalling the wrapper left the dev server AND its cloudflared alive —
observed twice, four surviving processes each time, including a public
trycloudflare URL still serving a dev server believed to be down. Ctrl-C hid
it by signalling the whole process group.
SessionTerminal appended scrollback instead of clearing first, though the
server sends it as a separate frame precisely so the client can clear. Latent
today because every reattach builds a fresh xterm; a duplicated-history bug
the moment an in-place reconnect appears.
And BackupManager's centralDbPath is gone: written, never read, and a
leftover of the removed SQLite backup — the same class of stale artifact that
onboarding was using as evidence about a Postgres install.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
**Problem:** Scheduler was re-reading each task's
`task_workflow_selection` once per park-resolution (sweep, hold-release,
moved, unpause/wake), causing a nonstop PostgreSQL query storm (~232
idx_scan/s) on idle polling — a major engine CPU hot-spot.
**Fix:** Memoize the workflow selection per scheduler tick/event —
thread a shared, per-event selection cache through
`resolveWorkflowIrForTask` and all park-resolution handlers, then throw
it away. Each task resolves its parked columns with at most one read of
`task_workflow_selection` per tick. A selection write is always observed
on the next event's fresh cache (never a global/infinite LRU).
**Includes:** regression test asserting the once-per-tick read
invariant, performance changeset + per-tick-cache solution doc,
deploy+verify handoff script, and the parallel quarantine-ledger merge
(origin FN-9125 + RUFU-072 OOM entries both retained).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Reduced repeated workflow-selection reads during scheduler ticks and
related event processing.
* Improved scheduler and health API responsiveness through per-operation
caching and read deduplication.
* Preserved existing behavior, including retry handling for failed reads
and synchronous data-store support.
* **Documentation**
* Added architectural guidance covering workflow-selection performance,
caching behavior, and verification criteria.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Fusion <noreply@runfusion.ai>
Auto-merge did nothing on a fresh container: tasks reached in-review, the merge
began, and FN-001 sat at status:merging forever with no error in the UI. The
cause was that git could not commit at all — `git commit` in the container dies
with "Author identity unknown ... Please tell me who you are", because a
container has no git identity and Fusion was borrowing the environment's.
Only workspace-fence-ref.ts ever passed an explicit identity. The merge commits,
the merger's --amend, and the experiment git-ops all inherited whatever
user.name/user.email the host happened to have. The existing commitAuthor*
settings only added a Co-authored-by TRAILER; they never set the author.
resolveCommitIdentity (packages/engine/src/git-identity.ts) now resolves:
operator commitAuthor* settings > the acting agent > Fusion. An agent-derived
identity is `<Agent Name> (Fusion) <slug@agents.fusion.local>`, so history
attributes a change to the agent that made it instead of one anonymous bot, per
the operator's request.
Applied at mergerCommitEnv — the single env all eight merger commit sites share
— and via `-c user.name/-c user.email` for merger-ai and experiment git-ops,
which build their own argv and bypass that env. Author AND committer are pinned:
git fails on a missing committer just as hard as on a missing author.
`commitAuthorEnabled: false` returns undefined and restores ambient git config,
so an operator who wants commits authored as themselves keeps that.
Verified: 9 new helper tests, 95 engine auth+identity tests, pnpm test:gate green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator could not log in to Anthropic or Codex on a fresh container: every
attempt ended "Login did not complete. Please try again.", while the same
providers worked flawlessly on their long-lived native install.
FusionAuthStorage.modify() is the seam pi persists a COMPLETED LOGIN through
(Models.login -> credentials.modify(provider.id, ...) in pi-ai models.js:198).
It resolved its write target with `creating: false` and returned before invoking
the callback whenever the provider had no credential row yet:
const target = this.resolveWriteTarget(provider, current, false);
if (!target || !this.credential(target, current)) return { changed: false };
So a first login completed its browser flow, exchanged the code, took and
released the lock file, wrote NOTHING, and resolved as success — leaving the
dashboard poll to see authenticated:false and report the generic failure.
It reproduces only on a store with no existing row, which is why it looked
environment-specific: an install that has logged in before takes the same path
as a refresh over an existing row and is fine, while every new container, new
machine, or wiped ~/.fusion can never complete a first login for ANY provider.
Evidence from the operator's container: flow ended with err=None (pi resolved,
no error), nothing logged, auth.json still {}, the agent directory's mtime
bumped when the lock was taken and released while auth.json itself never
changed, and an API-key write — which goes through set(), not modify() — landed
immediately.
modify() now creates when absent and updates when present; a callback returning
undefined still writes nothing, so pi's refresh-bails-out behaviour is unchanged.
auth-storage-instances.test.ts asserted the old behaviour, grouping modify() with
remove/logout/removeInstance as "non-creating". The removal guarantees are kept;
the modify() assertion is inverted, because it encoded the defect.
Also surfaces the server's own loginError through a new describeLoginFailure()
helper instead of the generic sentence, so an OAuth state mismatch reads as the
stale-tab instruction it is. Writing its test caught a bad regex of mine:
`code.*expired` matched "OpenAI Codex ... token_expired", a different failure.
Verified: the new first-login test fails against the old `creating: false` and
passes with the fix; 86 engine auth tests, 238 dashboard auth/dialog tests, and
pnpm test:gate all pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator report from a containerized dashboard: OpenAI Codex login never opened
a browser window at all, and floating windows still needed the FN-8015 follow-up.
- pi's `AuthPrompt` is a discriminated union — text, secret, select, manual_code —
and FusionAuthStorage.login's interaction shim flattened every variant into
`onPrompt({message, placeholder})`, discarding `type` and a select's `options`.
pi's Codex `login()` OPENS with `prompt({type:"select"})` (Browser vs Device
code) before emitting any auth URL, so the dashboard answered the method picker
with the promise that waits for a pasted code — input the UI never solicits,
because nothing had been surfaced yet. The flow hung until the route's 30s
kickoff timeout: "Login initiation timed out", no window. The route's
onSelect/selectOauthOption has had the right answer since FN-5917, but the
callback was dead code from the moment login moved to pi's ModelRuntime.
Verified against a real container: the login endpoint now returns Codex's
auth.openai.com URL in 0.03s instead of timing out after 30s.
- Promote FN-8766's outboard east/NE/SE resize targets from Task Detail to every
desktop window. With FN-8015's body gutter deleted, a hosted scrollbar sits
flush against the painted edge where those hit zones used to cover it (issue
#2140); moving the targets outside the shell keeps it grabbable without
insetting anything. That needs the host to stop clipping, so the body and its
direct child inherit the corner radius — only 8 of ~30 callers set that
themselves — and phones re-assert clipping since they hide every handle.
- Document the fixed OAuth callback ports (Anthropic 53692, Codex 1455) and
PI_OAUTH_CALLBACK_HOST for Docker: without them the browser callback cannot
reach the container's loopback listener, which is why subscription logins
appeared to fail there.
Verified: 14989 dashboard tests, 58 engine auth-storage tests (4 new, covering
each prompt type), pnpm test:gate, eslint, and both typechecks all pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Removes the dashboard's stuck-task tagging per operator request: the Stuck
card/status badges, stuck row styling, the footer Stuck segment and
stuckTaskCount stat, utils/taskStuck.ts, the isStuck agent-activity gate,
and the taskStuckTimeoutMs prop plumbing (App -> Board/Lane/Column/
WorktreeGroup/MainContent -> TaskCard/ListView/ExecutorStatusBar). Stuck-task
tests are deleted or reconciled. The taskStuckTimeoutMs setting and the
engine's recovery sweeps (including the stuck-killed status) are unchanged —
the setting is engine-side only now.
Also repoints the FN-6756 liveness-gate ratchet's facade scans at
executor/task-executor-session-facades.ts, where the wave20 extraction moved
hasLiveSessionSurface/clearPhantomExecutorBinding (the two pre-existing red
tests on main).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Ten self-healing rebounds passed preserveProgress without preserveWorktree, so
the reopen-into-planning move hook cleared task.worktree and the idle sweep
reaped the checkout (uncommitted work included) — the same loss mechanism as
the in-review branch-rebind incident. Those rebounds (stuck-loop park,
undeclared-column rehome, finalize-integrity blocks, stale-incomplete-review,
ghost-review, terminal-failure retry, legacy rehome, partial-progress) now pass
preserveWorktree: true; deliberate discards (branch proven merged, zero unique
commits, worktree already missing) carry an explicit worktree-discard-intended
marker.
A new static ratchet test requires every preserveProgress rebound in
self-healing.ts to either preserve the worktree or carry the marker.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
**Problem:** Self-healing repeatedly spawned git children
(status/rev-parse/for-each-ref) for paused/idle projects on every sweep,
and certain repair sweeps ran unbounded — a spawn/git storm that spiked
CPU and I/O on the production host.
**Fix:** Bound self-healing git work for paused projects (skip/cooldown)
and cap the repair sweeps so the engine stops churning git processes
when there is nothing actionable. Includes in-process-runtime pause-gate
+ self-healing pause-storm regression tests.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Paused projects no longer trigger Git-intensive self-healing
maintenance.
- Pause and unpause transitions now correctly stop and resume
maintenance scheduling.
- Global and engine-level pauses are handled consistently.
- **Improvements**
- Active-project Git maintenance is limited to an hourly cadence,
reducing unnecessary activity.
- Merge-metadata recovery is capped at 25 items per cycle for more
predictable processing.
- Database and filesystem housekeeping continues during pauses.
- **Documentation**
- Updated architecture and runtime documentation to describe pause-aware
maintenance behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The in-review branch-rebind sweep unconditionally nulled task.worktree while
repairing a broken branch binding, making the checkout invisible to
scanIdleWorktrees' active set so the idle sweep reaped it — the reported
"worktree lost between review and in-progress" incident. The rebind now keeps
the pointer when the directory exists and is checked out on the rebound branch,
and the applied audit event records preservedWorktree.
Adds a reliability-lane certification suite pinning that worktree metadata and
the on-disk directory survive in-progress ↔ in-review transitions and
idle-in-review maintenance ticks, and that severed metadata is exactly what
makes a directory reap-eligible.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
**Problem:** Scheduler writes assumed a full missionStore contract
(getSlice/getMilestone), aborting/pre-resolving mission reconciliation
when a minimal store or a genuine missing mission was present.
**Fix:** Resolve a missing `missionId` best-effort through
`missionStore.getSlice`/getMilestone when available, and make
reconciliation non-blocking — a partial missionStore must not gate the
completion advance. Includes scheduler + pre.json rebase resolution over
the latest origin.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added Grok 4.6 to the model catalog.
- Added archive and restore views for mailbox messages and chat
conversations.
- Added manager evaluation tools for reviewing agents and follow-up
actions.
- Updated the bundled Pi runtime.
- **Bug Fixes**
- Improved Quick Add model searching and dropdown toggling.
- Refined Quick Add merger labels and spacing.
- Recommendations now appear only for completed tasks with valid
recommendations.
- Improved scheduler resilience during mission updates and
reconciliation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
**Problem:** The FN-8953 pending-wedge-notification reconciliation
called getActiveNotificationService() unconditionally at its top (to
read the wedge settle window), even against a healthy/empty notification
service — leaving a narrow test wedge where the service getter was
expected never to be called.
**Fix:** Guard `reconcilePendingWedgeNotifications` so the wedge
settle-window read does not fire against a healthy/empty notification
service, closing the stub gap and making the reconciliation
side-effect-free when idle.
Co-authored-by: Fusion <noreply@runfusion.ai>
## Summary
- preserve the gridlock notification wall-clock cooldown across
transient detector clears
- add a regression test for clear-then-rediscover behavior during the
cooldown
- document the cooldown contract and add a patch changeset
## Test plan
- `corepack pnpm --filter @fusion/engine exec vitest run
src/__tests__/notifier.test.ts --project=engine-default
--reporter=verbose -t 'suppresses the same gridlock after a transient
resolution during cooldown'`
- `corepack pnpm --filter @fusion/engine typecheck`
- `corepack pnpm build`
- `corepack pnpm changeset status --output
/tmp/fusion-gridlock-changeset-status.json`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Gridlock notifications now remain suppressed during the 15-minute
cooldown, even if the condition temporarily clears and reappears.
- Prevents repeated notifications caused by transient detector-state
changes.
- **Documentation**
- Updated gridlock notification behavior documentation to reflect the
persistent cooldown.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
createFnAgent now delegates to createResolvedAgentSession — deriving the CLI
runtime hint (cursor/claude/grok/omp/hermes), mock/test-mode forcing, and
session:runtime-resolved visibility — using a host-registered default
PluginRunner keyed by project root (published by InProcessRuntime at plugin
init). DefaultPiRuntime re-enters via a __rawPiSession marker so the seam's
own pi bridge cannot recurse, and the raw constructor survives as
createPiAgentSessionRaw for that bridge and pi-internal tests.
Mission and milestone/slice interviews additionally pass their request-scoped
pluginRunner through the seam and prompt via the engine promptWithFallback
dispatcher (plugin CLI runtime sessions have no session.prompt()). This fixes
"Configured model cursor-cli/auto ... was not found in the pi model registry"
in mission planning while chat on the same model worked, and closes the same
gap for every remaining bare createFnAgent lane.
Also updates the pi skill-filtering test that still asserted pre-FN-9114
allow-list narrowing; requested skill names are ensure-present since FN-9114.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The FN-8923 drift guard was red on main: the fixture predated the FN-9047-9062
workspace wave and regeneration was blocked by 18 unclassified workspace
TaskStore methods. Classify the FN-9059 workspace coordination surface (lease
acquire/renew/release/reclaim/reconcile, land-intent record/resolve, fence-ref
recording, mergeWorkspaceWorktreeEntry, withValidWorkspaceLease as writers; the
inspect/list/find/validate reads as non-writers), regenerate the manifest, and
supply lifecycle verdicts for the 13 new call sites: lease/intent writes in the
land path are already-fenced by FN-9059 store-seam fence-token validation, the
land-failure note is benign-unfenced bookkeeping, and the remaining sites carry
their enclosing symbols' out-of-frontier verdicts. Also drops the deleted
diff-volume gate module from scannedModules.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The gate blocked approved clean-room squashes on per-file shrinkage with no
override path ("AI merge diff-volume gate blocked the approved squash").
Removed by operator decision: delete checkDiffVolume/DiffVolumeRegressionError,
the merge:diff-volume-blocked audit event, the runDiffVolumeGate call sites in
every legacy squash finalizer, the AI-merge pre-land check, and the
mergeDiffVolume* settings. File scope remains the pre-land guard; the
post-squash audit policy remains the shrinkage backstop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
