Fix/review gate idempotency key

.github/zizmor.yml

@@ -8,10 +8,19 @@ rules:
       # Approve-only job: never checks out or runs PR code, only calls the
       # review API; gated on the 'auto-approve' label.
       - auto-approve.yml
+      # Comments-only PR gate: never checks out or runs PR code (pure gh
+      # api/curl); workflow_run is required for the trusted base-repo context
+      # so secrets/PAT are available for fork PRs. Untrusted event fields flow
+      # through env only.
+      - review-gate.yml
   # These secrets are intentionally repo-level, not environment-scoped:
   # CODECOV_TOKEN is an upload-only token; AUTOMATION_GITHUB_TOKEN is the PAT
   # the upgrade-main PR job needs so its PRs trigger the build workflow.
   secrets-outside-env:
     ignore:
       - build.yml
       - upgrade-main.yml
+      # ABCA_WEBHOOK_SECRET + AUTOMATION_GITHUB_TOKEN are intentionally repo-level:
+      # the gate has no environment/approval boundary (it only reads state, posts
+      # comments, and fires the review webhook).
+      - review-gate.yml

.gitleaks.toml

@@ -20,11 +20,11 @@ description = "Test fixture signing secret in Slack verification unit test (not
 stopwords = ["test-signing-secret-abc123"]
 
 [[allowlists]]
-# Test idempotency-key fixture in orchestration-release.test.ts (not a real
-# credential). Suppressed by stopword rather than a .gitleaksignore commit-SHA
-# fingerprint: the finding lives in history and SHA fingerprints break whenever
-# history is rewritten (rebases / dep-bump merges), which is exactly how #530's
-# baseline regressed. A stopword is SHA-independent. See #537 (regression of #530).
+# Test idempotency-key fixture in orchestration tests (not a real credential).
+# Suppressed by stopword rather than a .gitleaksignore commit-SHA fingerprint:
+# the finding lives in history and SHA fingerprints break whenever history is
+# rewritten (rebases / dep-bump merges), which is exactly how #530's baseline
+# regressed. A stopword is SHA-independent. See #537 (regression of #530).
 description = "Test idempotency-key fixture 'orch_abc_SUB-1' (not a real credential)."
 stopwords = ["orch_abc_SUB-1"]
 

agent/Dockerfile

@@ -44,6 +44,15 @@ RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
+# Enable Corepack so ``yarn`` / ``pnpm`` resolve out of the box. Many target
+# repos (including ABCA itself) drive installs with ``yarn install`` via their
+# build command; without this, ``yarn`` is "command not found" (exit 127) and
+# the build-verification GATE runs inert — a green build is reported for a repo
+# we never actually built (live-caught 2026-06-29 dogfooding ABCA-on-ABCA: the
+# agent had to hand-build a ``~/bin/yarn`` shim every run). Corepack ships with
+# Node 24; ``enable`` installs the yarn/pnpm shims onto PATH.
+RUN corepack enable && corepack prepare yarn@stable --activate 2>/dev/null || corepack enable
+
 # Install Claude Code CLI (the Python SDK requires this binary)
 # Then update known vulnerable transitive packages where fixed versions exist.
 # Pinned 2.1.191 to match the CLI bundled by claude-agent-sdk 0.2.110 (see
@@ -52,10 +61,19 @@ RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && \
 # returned creds are cached until 5 min before the JSON's `Expiration`, so an
 # 8 h task re-assumes the 1 h-capped SessionRole before expiry. Older builds
 # only refreshed hourly on a timer, racing the role-chaining cap.
+# claude-code@2.1.x ships an error-shim at bin/claude.exe that its postinstall
+# (install.cjs) replaces with the platform-native ELF binary. That postinstall
+# can silently fall back (leaving the shim in place) — the shim then dies at
+# runtime with "Exec format error: 'claude'" even though the native binary is
+# present as an optional dep, just never wired up. Re-run install.cjs explicitly
+# after the install so the native binary is placed at build time, and hard-verify
+# it exec's (``claude --version`` fails the build if the shim is still on PATH).
 RUN npm install -g npm@latest && \
     npm install -g @anthropic-ai/claude-code@2.1.191 && \
     CLAUDE_NPM_ROOT="$(npm root -g)/@anthropic-ai/claude-code" && \
-    npm --prefix "${CLAUDE_NPM_ROOT}" update tar minimatch glob cross-spawn picomatch
+    npm --prefix "${CLAUDE_NPM_ROOT}" update tar minimatch glob cross-spawn picomatch && \
+    node "${CLAUDE_NPM_ROOT}/install.cjs" && \
+    claude --version
 
 # Install uv (fast Python package manager) — pinned for reproducibility
 COPY --from=ghcr.io/astral-sh/uv:0.11.14 /uv /usr/local/bin/uv

agent/pyproject.toml

@@ -89,6 +89,7 @@ dev = [
     "pytest",
     "pygments==2.20.0",
     "pytest-cov==7.1.0",
+    "pytest-timeout==2.4.0",  # per-test wall-clock cap: a single hung test (network/subprocess/Bedrock without its own timeout) must fail LOUDLY with a traceback, not silently burn the whole build-verify budget (ABCA-684/686: one hang stalled the baseline build past its 3600s ceiling)
     "vulture==2.16",  # dead-code detection (#282): unused functions/classes ruff F can't see
 ]
 
@@ -130,6 +131,39 @@ ignore = [
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 pythonpath = ["src"]
+# Non-TTY output ergonomics. In a captured/piped context (the ECS build gate, CI,
+# an agent's Bash tool) pytest's default is a wall of featureless progress dots
+# with the "N passed" summary easy to lose in a tail — live-caught on ABCA-691,
+# where an agent burned ~6 turns re-running the full suite with different flags
+# because it couldn't confirm the result from the dots. ``count`` renders progress
+# as an explicit "N/M passed" so a captured log always shows how far it got and how
+# many passed; ``-ra`` appends a short summary of every non-passing outcome (with
+# reasons) at the end. Both are display-only — they never change test results.
+addopts = "-ra"
+console_output_style = "count"
+# pytest-timeout: hard wall-clock cap PER TEST. A unit test that blocks (an
+# unmocked network/subprocess/Bedrock call with no timeout of its own) otherwise
+# hangs the whole `mise run build` until the 3600s build-verify ceiling kills it,
+# turning one flaky test into an un-diagnosable 60-min stall (ABCA-684/686). With
+# this, the offending test fails with a dumped stack in 120s and the suite moves on.
+# method="signal" (SIGALRM) actually ABORTS the hung test — pytest runs
+# single-threaded in the main thread here, so the alarm interrupts even a blocked
+# C-level/socket call. method="thread" only PRINTS the stack and cannot interrupt a
+# syscall-blocked test (proven live on ABCA-688: the thread method dumped the stack
+# but the build kept hanging ~55 min until the 3600s ceiling). signal is the real fix.
+timeout = 120
+timeout_method = "signal"
+# faulthandler backstop for hangs signal-timeout CANNOT interrupt. SIGALRM only
+# fires in the MAIN thread during a test's call phase, so a hang in a WORKER
+# thread (a deadlocked Barrier/join), a fixture, or a C-level socket read the
+# main thread never returns from is invisible to it — exactly the ECS-only stall
+# chased across ABCA-684/686/688 and again on the warm-cache run (53 min of
+# silence, signal never fired). This arms faulthandler's dedicated C watchdog
+# thread (immune to the GIL and blocked syscalls) to dump EVERY thread's Python
+# stack after 300s in a test, so the next hang self-reports the exact file:line
+# instead of stalling blind to the 3600s build ceiling. A session-level
+# hard-exit watchdog for hangs OUTSIDE any test lives in tests/conftest.py.
+faulthandler_timeout = 300
 
 [tool.coverage.run]
 branch = true

agent/src/clarification_tool.py

@@ -0,0 +1,74 @@
+"""In-process ``request_clarification`` SDK tool (clarify-before-spend, UX #4).
+
+The customer-caught problem: a vague request like "make it faster" was answered
+by GUESSING (shipping a plausible PR and charging for it) instead of asking what
+was meant. The fix asks the agent to STOP and pose a question when a request is
+too underspecified to implement without guessing.
+
+An earlier cut used a text sentinel the agent had to reproduce verbatim on its
+final line. That proved unreliable live — the model either shipped a guess or
+finished silently without emitting the exact string. A **tool call** is a
+discrete, deterministic event: the model either invokes ``request_clarification``
+or it doesn't, and the runner sees the ``ToolUseBlock`` in the message stream (no
+string-matching, no reproduction). This module defines that tool as an in-process
+SDK MCP server; the runner registers it and captures the question, and the
+pipeline treats a captured question as a hold-and-ask (no build, no PR).
+
+Kept tiny and side-effect-free: the tool just acknowledges the call. The
+authoritative signal is the runner observing the call + its ``question`` arg.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+#: The in-process MCP server name. The SDK exposes each tool as
+#: ``mcp__<server>__<tool>``, so the fully-qualified tool name the runner matches
+#: on is :data:`CLARIFICATION_TOOL_NAME`.
+CLARIFICATION_SERVER_NAME = "abca"
+CLARIFICATION_TOOL_NAME = f"mcp__{CLARIFICATION_SERVER_NAME}__request_clarification"
+
+
+def build_clarification_server() -> Any:
+    """Build the in-process SDK MCP server exposing ``request_clarification``.
+
+    Returns the SDK server config dict for ``ClaudeAgentOptions(mcp_servers=...)``,
+    or ``None`` if the SDK is unavailable (defensive — the runner then simply
+    doesn't register it and the marker-based fallback still works).
+    """
+    try:
+        from claude_agent_sdk import create_sdk_mcp_server, tool
+    except ImportError:  # pragma: no cover - SDK always present in the container
+        return None
+
+    @tool(
+        "request_clarification",
+        (
+            "Ask the requester ONE clarifying question and STOP, instead of guessing, "
+            "when the task is too underspecified to implement without picking among "
+            "materially different interpretations (e.g. 'make it faster' with no target "
+            "or slow path named). Calling this opens NO pull request and charges nothing "
+            "for a guess — the platform surfaces your question to the requester. Only "
+            "call it for genuinely ambiguous goal-without-substance requests; a task that "
+            "names what to change is actionable, so just do it."
+        ),
+        {"question": str},
+    )
+    async def request_clarification(args: dict[str, Any]) -> dict[str, Any]:
+        question = str(args.get("question", "")).strip()
+        # The tool's own return is only feedback to the agent; the runner captures
+        # the question from the ToolUseBlock. Tell the agent to stop here.
+        return {
+            "content": [
+                {
+                    "type": "text",
+                    "text": (
+                        "Clarifying question recorded and will be posted to the requester. "
+                        "Do not make code changes or open a PR — end your turn now."
+                        + (f" (question: {question})" if question else "")
+                    ),
+                }
+            ]
+        }
+
+    return create_sdk_mcp_server(name=CLARIFICATION_SERVER_NAME, tools=[request_clarification])

agent/src/config.py

@@ -17,14 +17,28 @@
 # id whose ``requires_repo`` is false. Used by the load-failure fallback to
 # decide repo-optionality without loading the file.
 REPO_LESS_DEFAULT_WORKFLOW_ID = "default/agent-v1"
-# First-party workflow ids that operate on an existing pull request.
-PR_WORKFLOW_IDS = frozenset(("coding/pr-iteration-v1", "coding/pr-review-v1"))
+# First-party workflow ids that operate on an existing pull request — they
+# check out the existing PR branch instead of creating a fresh one. restack-v1
+# (#305 A6) re-merges a changed predecessor into an existing stacked-child PR.
+PR_WORKFLOW_IDS = frozenset(("coding/pr-iteration-v1", "coding/pr-review-v1", "coding/restack-v1"))
+# Clarify-before-spend (customer UX #4): the exact marker a coding/new-task agent
+# puts on the FIRST line of its final message when a request is too ambiguous to
+# implement without guessing. Its presence tells the pipeline to hold — post the
+# question, open NO PR, and surface it as "needs input" rather than a finished
+# task. Kept as an unusual sentinel so it can't collide with ordinary prose.
+NEEDS_INPUT_MARKER = "[[ABCA_NEEDS_INPUT]]"
 # First-party workflow ids that are writeable (NOT read-only). Used only by the
 # load-failure fallback to bias an unrecognised id toward read-only (fail closed
 # on the write-deny invariant). pr-review-v1 is intentionally excluded (it is
 # read-only); default/agent-v1 is excluded because its conservative posture
 # should fail closed too.
-_KNOWN_WRITEABLE_WORKFLOW_IDS = frozenset(("coding/new-task-v1", "coding/pr-iteration-v1"))
+_KNOWN_WRITEABLE_WORKFLOW_IDS = frozenset(
+    (
+        "coding/new-task-v1",
+        "coding/pr-iteration-v1",
+        "coding/restack-v1",
+    )
+)
 
 
 def resolve_github_token() -> str:
@@ -460,9 +474,13 @@ def build_config(
     dry_run: bool = False,
     task_id: str = "",
     system_prompt_overrides: str = "",
+    build_command: str = "",
+    lint_command: str = "",
     resolved_workflow: dict | None = None,
     branch_name: str = "",
     pr_number: str = "",
+    base_branch: str | None = None,
+    merge_branches: list[str] | None = None,
     channel_source: str = "",
     channel_metadata: dict[str, str] | None = None,
     trace: bool = False,
@@ -483,7 +501,7 @@ def build_config(
     resolved_github_token = github_token or resolve_github_token()
     resolved_aws_region = aws_region or os.environ.get("AWS_REGION", "")
     resolved_anthropic_model = anthropic_model or os.environ.get(
-        "ANTHROPIC_MODEL", "us.anthropic.claude-sonnet-4-6"
+        "ANTHROPIC_MODEL", "us.anthropic.claude-opus-4-8"
     )
     # Small/fast auxiliary model (WebFetch summarization etc.). Falls back to the
     # deployed ANTHROPIC_DEFAULT_HAIKU_MODEL env, then the platform default. Must
@@ -573,6 +591,8 @@ def build_config(
         max_turns=max_turns,
         max_budget_usd=max_budget_usd,
         system_prompt_overrides=system_prompt_overrides,
+        build_command=build_command,
+        lint_command=lint_command,
         resolved_workflow=workflow,
         policy_principal=policy_principal,
         read_only=workflow_read_only,
@@ -581,6 +601,8 @@ def build_config(
         is_pr_workflow=is_pr_workflow,
         branch_name=branch_name,
         pr_number=pr_number,
+        base_branch=base_branch,
+        merge_branches=merge_branches or [],
         task_id=task_id or uuid.uuid4().hex[:12],
         channel_source=channel_source,
         channel_metadata=channel_metadata or {},
@@ -603,7 +625,7 @@ def get_config() -> TaskConfig:
             issue_number=os.environ.get("ISSUE_NUMBER", ""),
             github_token=os.environ.get("GITHUB_TOKEN", ""),
             anthropic_model=os.environ.get("ANTHROPIC_MODEL", ""),
-            max_turns=int(os.environ.get("MAX_TURNS", "100")),
+            max_turns=int(os.environ.get("MAX_TURNS", "200")),
             max_budget_usd=float(os.environ.get("MAX_BUDGET_USD", "0")) or None,
             aws_region=os.environ.get("AWS_REGION", ""),
             dry_run=os.environ.get("DRY_RUN", "").lower() in ("1", "true", "yes"),

agent/src/entrypoint.py

@@ -31,7 +31,7 @@
     TaskResult,
     TokenUsage,
 )
-from pipeline import main, run_task  # noqa: F401
+from pipeline import main, run_task, run_task_from_payload  # noqa: F401
 from post_hooks import (  # noqa: F401
     ensure_committed,
     ensure_pr,