## Summary
- observe the injected executor dispatch seam in the orphan-resume lane
test
- make the lane guard non-vacuous and cover every renamed non-WIP lane
## Test plan
- `corepack pnpm --filter @fusion/engine exec vitest run
src/__tests__/executor-resume-lanes-resolved.test.ts
--silent=passed-only --reporter=dot` (12 passed)
- `corepack pnpm --filter @fusion/engine typecheck`
project-engine.test.ts hand-writes a factory for ../merge/merger-ai.js, and
it had drifted from the module: WorkspaceMergeDispatchSupersededError was
missing. Production imports that class, so the merge-queue drain threw "No
<export> is defined on the mock" before the code under test ran — the four
Phase C hardening cases then failed on a resolved promise and an absent
updateTask call, for a reason unrelated to what they assert.
No product change. All 114 tests in the file pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Auditing for repeats of the `pnpm dev --tunnel` bugs turned up the same
mistakes elsewhere.
Remote tunnels assumed 4040. ProjectEngine's Cloudflare quick tunnel
hardcoded http://localhost:4040, so a dashboard on an explicit --port, a PORT
override, or runDashboard's EADDRINUSE rebind published a PUBLIC tunnel to
whatever else held 4040. The dashboard now records its bound port
(setLocalDashboardPort, from both runDashboard and headless serve) and the
tunnel reads it, keeping 4040 only as the pre-report default.
register-discovery-routes already derived its port from req.socket.localPort
and is untouched.
Stopping the dev wrapper orphaned everything it started. It installed no
signal handlers, so teardown only ran from the child's close handler:
signalling the wrapper left the dev server AND its cloudflared alive —
observed twice, four surviving processes each time, including a public
trycloudflare URL still serving a dev server believed to be down. Ctrl-C hid
it by signalling the whole process group.
SessionTerminal appended scrollback instead of clearing first, though the
server sends it as a separate frame precisely so the client can clear. Latent
today because every reattach builds a fresh xterm; a duplicated-history bug
the moment an in-place reconnect appears.
And BackupManager's centralDbPath is gone: written, never read, and a
leftover of the removed SQLite backup — the same class of stale artifact that
onboarding was using as evidence about a Postgres install.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
**Problem:** Scheduler was re-reading each task's
`task_workflow_selection` once per park-resolution (sweep, hold-release,
moved, unpause/wake), causing a nonstop PostgreSQL query storm (~232
idx_scan/s) on idle polling — a major engine CPU hot-spot.
**Fix:** Memoize the workflow selection per scheduler tick/event —
thread a shared, per-event selection cache through
`resolveWorkflowIrForTask` and all park-resolution handlers, then throw
it away. Each task resolves its parked columns with at most one read of
`task_workflow_selection` per tick. A selection write is always observed
on the next event's fresh cache (never a global/infinite LRU).
**Includes:** regression test asserting the once-per-tick read
invariant, performance changeset + per-tick-cache solution doc,
deploy+verify handoff script, and the parallel quarantine-ledger merge
(origin FN-9125 + RUFU-072 OOM entries both retained).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Reduced repeated workflow-selection reads during scheduler ticks and
related event processing.
* Improved scheduler and health API responsiveness through per-operation
caching and read deduplication.
* Preserved existing behavior, including retry handling for failed reads
and synchronous data-store support.
* **Documentation**
* Added architectural guidance covering workflow-selection performance,
caching behavior, and verification criteria.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Fusion <noreply@runfusion.ai>
Auto-merge did nothing on a fresh container: tasks reached in-review, the merge
began, and FN-001 sat at status:merging forever with no error in the UI. The
cause was that git could not commit at all — `git commit` in the container dies
with "Author identity unknown ... Please tell me who you are", because a
container has no git identity and Fusion was borrowing the environment's.
Only workspace-fence-ref.ts ever passed an explicit identity. The merge commits,
the merger's --amend, and the experiment git-ops all inherited whatever
user.name/user.email the host happened to have. The existing commitAuthor*
settings only added a Co-authored-by TRAILER; they never set the author.
resolveCommitIdentity (packages/engine/src/git-identity.ts) now resolves:
operator commitAuthor* settings > the acting agent > Fusion. An agent-derived
identity is `<Agent Name> (Fusion) <slug@agents.fusion.local>`, so history
attributes a change to the agent that made it instead of one anonymous bot, per
the operator's request.
Applied at mergerCommitEnv — the single env all eight merger commit sites share
— and via `-c user.name/-c user.email` for merger-ai and experiment git-ops,
which build their own argv and bypass that env. Author AND committer are pinned:
git fails on a missing committer just as hard as on a missing author.
`commitAuthorEnabled: false` returns undefined and restores ambient git config,
so an operator who wants commits authored as themselves keeps that.
Verified: 9 new helper tests, 95 engine auth+identity tests, pnpm test:gate green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator could not log in to Anthropic or Codex on a fresh container: every
attempt ended "Login did not complete. Please try again.", while the same
providers worked flawlessly on their long-lived native install.
FusionAuthStorage.modify() is the seam pi persists a COMPLETED LOGIN through
(Models.login -> credentials.modify(provider.id, ...) in pi-ai models.js:198).
It resolved its write target with `creating: false` and returned before invoking
the callback whenever the provider had no credential row yet:
const target = this.resolveWriteTarget(provider, current, false);
if (!target || !this.credential(target, current)) return { changed: false };
So a first login completed its browser flow, exchanged the code, took and
released the lock file, wrote NOTHING, and resolved as success — leaving the
dashboard poll to see authenticated:false and report the generic failure.
It reproduces only on a store with no existing row, which is why it looked
environment-specific: an install that has logged in before takes the same path
as a refresh over an existing row and is fine, while every new container, new
machine, or wiped ~/.fusion can never complete a first login for ANY provider.
Evidence from the operator's container: flow ended with err=None (pi resolved,
no error), nothing logged, auth.json still {}, the agent directory's mtime
bumped when the lock was taken and released while auth.json itself never
changed, and an API-key write — which goes through set(), not modify() — landed
immediately.
modify() now creates when absent and updates when present; a callback returning
undefined still writes nothing, so pi's refresh-bails-out behaviour is unchanged.
auth-storage-instances.test.ts asserted the old behaviour, grouping modify() with
remove/logout/removeInstance as "non-creating". The removal guarantees are kept;
the modify() assertion is inverted, because it encoded the defect.
Also surfaces the server's own loginError through a new describeLoginFailure()
helper instead of the generic sentence, so an OAuth state mismatch reads as the
stale-tab instruction it is. Writing its test caught a bad regex of mine:
`code.*expired` matched "OpenAI Codex ... token_expired", a different failure.
Verified: the new first-login test fails against the old `creating: false` and
passes with the fix; 86 engine auth tests, 238 dashboard auth/dialog tests, and
pnpm test:gate all pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator report from a containerized dashboard: OpenAI Codex login never opened
a browser window at all, and floating windows still needed the FN-8015 follow-up.
- pi's `AuthPrompt` is a discriminated union — text, secret, select, manual_code —
and FusionAuthStorage.login's interaction shim flattened every variant into
`onPrompt({message, placeholder})`, discarding `type` and a select's `options`.
pi's Codex `login()` OPENS with `prompt({type:"select"})` (Browser vs Device
code) before emitting any auth URL, so the dashboard answered the method picker
with the promise that waits for a pasted code — input the UI never solicits,
because nothing had been surfaced yet. The flow hung until the route's 30s
kickoff timeout: "Login initiation timed out", no window. The route's
onSelect/selectOauthOption has had the right answer since FN-5917, but the
callback was dead code from the moment login moved to pi's ModelRuntime.
Verified against a real container: the login endpoint now returns Codex's
auth.openai.com URL in 0.03s instead of timing out after 30s.
- Promote FN-8766's outboard east/NE/SE resize targets from Task Detail to every
desktop window. With FN-8015's body gutter deleted, a hosted scrollbar sits
flush against the painted edge where those hit zones used to cover it (issue
#2140); moving the targets outside the shell keeps it grabbable without
insetting anything. That needs the host to stop clipping, so the body and its
direct child inherit the corner radius — only 8 of ~30 callers set that
themselves — and phones re-assert clipping since they hide every handle.
- Document the fixed OAuth callback ports (Anthropic 53692, Codex 1455) and
PI_OAUTH_CALLBACK_HOST for Docker: without them the browser callback cannot
reach the container's loopback listener, which is why subscription logins
appeared to fail there.
Verified: 14989 dashboard tests, 58 engine auth-storage tests (4 new, covering
each prompt type), pnpm test:gate, eslint, and both typechecks all pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Removes the dashboard's stuck-task tagging per operator request: the Stuck
card/status badges, stuck row styling, the footer Stuck segment and
stuckTaskCount stat, utils/taskStuck.ts, the isStuck agent-activity gate,
and the taskStuckTimeoutMs prop plumbing (App -> Board/Lane/Column/
WorktreeGroup/MainContent -> TaskCard/ListView/ExecutorStatusBar). Stuck-task
tests are deleted or reconciled. The taskStuckTimeoutMs setting and the
engine's recovery sweeps (including the stuck-killed status) are unchanged —
the setting is engine-side only now.
Also repoints the FN-6756 liveness-gate ratchet's facade scans at
executor/task-executor-session-facades.ts, where the wave20 extraction moved
hasLiveSessionSurface/clearPhantomExecutorBinding (the two pre-existing red
tests on main).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Ten self-healing rebounds passed preserveProgress without preserveWorktree, so
the reopen-into-planning move hook cleared task.worktree and the idle sweep
reaped the checkout (uncommitted work included) — the same loss mechanism as
the in-review branch-rebind incident. Those rebounds (stuck-loop park,
undeclared-column rehome, finalize-integrity blocks, stale-incomplete-review,
ghost-review, terminal-failure retry, legacy rehome, partial-progress) now pass
preserveWorktree: true; deliberate discards (branch proven merged, zero unique
commits, worktree already missing) carry an explicit worktree-discard-intended
marker.
A new static ratchet test requires every preserveProgress rebound in
self-healing.ts to either preserve the worktree or carry the marker.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
**Problem:** Self-healing repeatedly spawned git children
(status/rev-parse/for-each-ref) for paused/idle projects on every sweep,
and certain repair sweeps ran unbounded — a spawn/git storm that spiked
CPU and I/O on the production host.
**Fix:** Bound self-healing git work for paused projects (skip/cooldown)
and cap the repair sweeps so the engine stops churning git processes
when there is nothing actionable. Includes in-process-runtime pause-gate
+ self-healing pause-storm regression tests.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Paused projects no longer trigger Git-intensive self-healing
maintenance.
- Pause and unpause transitions now correctly stop and resume
maintenance scheduling.
- Global and engine-level pauses are handled consistently.
- **Improvements**
- Active-project Git maintenance is limited to an hourly cadence,
reducing unnecessary activity.
- Merge-metadata recovery is capped at 25 items per cycle for more
predictable processing.
- Database and filesystem housekeeping continues during pauses.
- **Documentation**
- Updated architecture and runtime documentation to describe pause-aware
maintenance behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The in-review branch-rebind sweep unconditionally nulled task.worktree while
repairing a broken branch binding, making the checkout invisible to
scanIdleWorktrees' active set so the idle sweep reaped it — the reported
"worktree lost between review and in-progress" incident. The rebind now keeps
the pointer when the directory exists and is checked out on the rebound branch,
and the applied audit event records preservedWorktree.
Adds a reliability-lane certification suite pinning that worktree metadata and
the on-disk directory survive in-progress ↔ in-review transitions and
idle-in-review maintenance ticks, and that severed metadata is exactly what
makes a directory reap-eligible.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
**Problem:** Scheduler writes assumed a full missionStore contract
(getSlice/getMilestone), aborting/pre-resolving mission reconciliation
when a minimal store or a genuine missing mission was present.
**Fix:** Resolve a missing `missionId` best-effort through
`missionStore.getSlice`/getMilestone when available, and make
reconciliation non-blocking — a partial missionStore must not gate the
completion advance. Includes scheduler + pre.json rebase resolution over
the latest origin.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added Grok 4.6 to the model catalog.
- Added archive and restore views for mailbox messages and chat
conversations.
- Added manager evaluation tools for reviewing agents and follow-up
actions.
- Updated the bundled Pi runtime.
- **Bug Fixes**
- Improved Quick Add model searching and dropdown toggling.
- Refined Quick Add merger labels and spacing.
- Recommendations now appear only for completed tasks with valid
recommendations.
- Improved scheduler resilience during mission updates and
reconciliation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
**Problem:** The FN-8953 pending-wedge-notification reconciliation
called getActiveNotificationService() unconditionally at its top (to
read the wedge settle window), even against a healthy/empty notification
service — leaving a narrow test wedge where the service getter was
expected never to be called.
**Fix:** Guard `reconcilePendingWedgeNotifications` so the wedge
settle-window read does not fire against a healthy/empty notification
service, closing the stub gap and making the reconciliation
side-effect-free when idle.
Co-authored-by: Fusion <noreply@runfusion.ai>
## Summary
- preserve the gridlock notification wall-clock cooldown across
transient detector clears
- add a regression test for clear-then-rediscover behavior during the
cooldown
- document the cooldown contract and add a patch changeset
## Test plan
- `corepack pnpm --filter @fusion/engine exec vitest run
src/__tests__/notifier.test.ts --project=engine-default
--reporter=verbose -t 'suppresses the same gridlock after a transient
resolution during cooldown'`
- `corepack pnpm --filter @fusion/engine typecheck`
- `corepack pnpm build`
- `corepack pnpm changeset status --output
/tmp/fusion-gridlock-changeset-status.json`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Gridlock notifications now remain suppressed during the 15-minute
cooldown, even if the condition temporarily clears and reappears.
- Prevents repeated notifications caused by transient detector-state
changes.
- **Documentation**
- Updated gridlock notification behavior documentation to reflect the
persistent cooldown.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
createFnAgent now delegates to createResolvedAgentSession — deriving the CLI
runtime hint (cursor/claude/grok/omp/hermes), mock/test-mode forcing, and
session:runtime-resolved visibility — using a host-registered default
PluginRunner keyed by project root (published by InProcessRuntime at plugin
init). DefaultPiRuntime re-enters via a __rawPiSession marker so the seam's
own pi bridge cannot recurse, and the raw constructor survives as
createPiAgentSessionRaw for that bridge and pi-internal tests.
Mission and milestone/slice interviews additionally pass their request-scoped
pluginRunner through the seam and prompt via the engine promptWithFallback
dispatcher (plugin CLI runtime sessions have no session.prompt()). This fixes
"Configured model cursor-cli/auto ... was not found in the pi model registry"
in mission planning while chat on the same model worked, and closes the same
gap for every remaining bare createFnAgent lane.
Also updates the pi skill-filtering test that still asserted pre-FN-9114
allow-list narrowing; requested skill names are ensure-present since FN-9114.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The FN-8923 drift guard was red on main: the fixture predated the FN-9047-9062
workspace wave and regeneration was blocked by 18 unclassified workspace
TaskStore methods. Classify the FN-9059 workspace coordination surface (lease
acquire/renew/release/reclaim/reconcile, land-intent record/resolve, fence-ref
recording, mergeWorkspaceWorktreeEntry, withValidWorkspaceLease as writers; the
inspect/list/find/validate reads as non-writers), regenerate the manifest, and
supply lifecycle verdicts for the 13 new call sites: lease/intent writes in the
land path are already-fenced by FN-9059 store-seam fence-token validation, the
land-failure note is benign-unfenced bookkeeping, and the remaining sites carry
their enclosing symbols' out-of-frontier verdicts. Also drops the deleted
diff-volume gate module from scannedModules.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The gate blocked approved clean-room squashes on per-file shrinkage with no
override path ("AI merge diff-volume gate blocked the approved squash").
Removed by operator decision: delete checkDiffVolume/DiffVolumeRegressionError,
the merge:diff-volume-blocked audit event, the runDiffVolumeGate call sites in
every legacy squash finalizer, the AI-merge pre-land check, and the
mergeDiffVolume* settings. File scope remains the pre-land guard; the
post-squash audit policy remains the shrinkage backstop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
## What
- Retry post-merge target pushes after recognized transient Git
transport failures.
- Use a bounded schedule: the initial attempt plus two retries after 2s
and 5s.
- Apply the same helper to the unified fast path and the shared push
path used by divergence recovery and the soft-deprecated merger.
- Keep retry sleeps and subsequent attempts cancellation-aware.
- Add a patch changeset and regression coverage, including a real bare
remote that rejects the first push.
## Why
Fusion already retries non-fast-forward races, and #1942 made terminal
push failures durable, but a temporary network failure still ended
post-merge delivery after one attempt. That can leave the local
integration branch ahead of the remote even though retrying seconds
later would succeed.
The retry is deliberately provider-neutral. It uses Git error
classification and normal Fusion logs only; it does not add Telegram,
OpenClaw, or any other notification-vendor dependency.
## Behavior and impact
- Retries only transient transport signatures such as connection resets,
DNS failures, unreachable networks, selected HTTP 429/5xx RPC failures,
and unexpected disconnects.
- Permission, authentication, configuration, and ref-rejection errors
keep their existing immediate handling.
- Exhausted retries remain non-fatal to the already-landed merge and
flow through the existing audit/task-log failure reporting.
- Existing non-fast-forward pull/rebase recovery is unchanged apart from
making its backoff cancellation-aware.
## Checks
- [x] `pnpm --filter @fusion/engine exec vitest run
src/__tests__/merger-ai-push-after-merge.test.ts
src/__tests__/merger-prompt-and-utils.test.ts --silent=passed-only
--reporter=dot` (48 tests)
- [x] `pnpm --filter @fusion/engine typecheck`
- [x] `pnpm lint` (0 errors; 2 pre-existing warnings)
- [x] `pnpm check:changesets --strict`
- [x] `pnpm check:fnxc-future-dates`
- [x] `pnpm test` (changed-test gate; static checks and 688 tests
passed)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved reliability of post-merge pushes by retrying temporary Git
transport failures.
* Added bounded backoff between retries to prevent excessive repeated
attempts.
* Push retries now stop promptly when an operation is canceled.
* Configuration, authentication, and ref-rejection errors continue to
fail immediately.
* Successful retries and canceled operations now report accurate
outcomes.
* **Tests**
* Added coverage for successful retries, cancellation, and non-retryable
failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: flexi767 <flexi767@users.noreply.github.com>
Co-authored-by: v <v@m5.speedport.ip>
## Summary
- replaces newly added future-dated FNXC metadata with the actual UTC
change time
- tightens the FNXC future-date baseline to zero known exceptions
## Test plan
- `pnpm check:fnxc-future-dates`
- `pnpm check:lifecycle-columns`
- `pnpm check:changesets`
- `pnpm --filter @runfusion/fusion exec vitest run
src/__tests__/staged-plugin-core-imports.test.ts --silent=passed-only
--reporter=dot`
- `pnpm --filter @fusion/engine typecheck`
- `pnpm lint`
Full-suite repair, engine harness cluster (~85 red suites). Two causes:
(1) graph dispatch now fails closed without options.agentStore
(FN-8764/FN-8821, intended) — the shared executor test harness now
provisions the workflow-routing agent-store fixture for bare
TaskExecutor constructions, with explicit opt-out for the two tests
asserting the fail-closed park; (2) the wave-18 'pure peel' (#3317)
rebuilt executor.ts from a stale base and silently deleted shipped
behaviors, restored here: FN-8864 agent-activity writers (task
started/handed-off, workflow gate pass/fail, gate principal attribution
via executor/workflow-gate-activity.ts), FN-8768 Plan Review group
recognition, convergence primer, and modified-file review scoping,
FN-6782's fire-time guard on transient resume-after-restart retries,
FN-8868 session usage telemetry boundaries, recommendation-route
withheld-tool guidance, and the per-instance worktree retry cap.
Stale expectations updated for intended changes (FN-8823 shared-member
hold, FN-9060 zero-acquire fail-closed, heartbeat tool inventory,
peeled-module seams, PG harness provisioning). Verified: 23 files /
711 tests green, engine typecheck clean, merge gate green.
Known follow-ups (not addressed here): step-session error routing may
still bypass FN-5866 non-continuable classification
(post-done-continuation-no-wedge red), scheduler mission-loop trigger
gap (mission-validation-trigger-gap red), and executeWorkflowStep lost
routed workflow-principal session identity threading (untested drop
from the same peel).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Full-suite repair, engine source-scan cluster. The package code
organization waves moved ~30 engine modules into subdirectories
(plugins/, execution/, scheduling/, healing/, worktree/, executor/
peels); the log-severity manifest, prompt carve-out, emit-surface,
failure-lane, and worktree-invariant scanners now read the moved
locations, verified per file via git log --follow. Two scans caught
real drift rather than moves: the lifecycle census had 12 unexamined
column guards (resolved with DELIBERATE-LITERAL markers for the mailbox
archived tab, the FN-9059 lease-owner terminality check, and the FN-9056
legacy done fallback — baseline re-recorded with zero absorbed debt),
and planning-claim gained a genuine second writer in self-healing's
FN-8998 transport-failure recovery, admitted to the allowlist with its
CAS-guarded justification. 9 files / 119 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Third incident of the same class (#1857/FN-7391, FN-9101, GitHub #3462):
Fusion's Anthropic auth-card/storage ids (anthropic-subscription,
anthropic-api-key) leaking into pi, which only registers the execution
provider 'anthropic'. FusionAuthStorage.login is the single seam that hands
a provider id to ModelRuntime.login; it now normalizes via
toExecutionModelProviderId so a future caller bug degrades to a correct
upstream anthropic login instead of a hard 'Unknown provider' failure, with
a regression test pinning the seam. The invariant, incident history, and
guard inventory are captured in
docs/solutions/integration-issues/anthropic-storage-ids-are-never-pi-provider-ids.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Authentication cards pass an explicit credential-instance id, which sent
dashboard subscription logins through loginInstance. That seam mapped the card
to the anthropic-subscription storage row id and passed it verbatim to
ModelRuntime.login, which pi rejects with 'Unknown provider:
anthropic-subscription' (GitHub #3462) — every subscription login failed while
the credential path itself was healthy. loginInstance now reuses the
Anthropic-aware login seam (upstream login as 'anthropic', credential relocated
to the anthropic-subscription row) with a regression test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
