宜博 / lemongraph

Found during Phase 1 real end-to-end verification (2026-08-12): 3
independent real runs, 3 different goals, all hit the same known,
unrelated-to-Phase-1 issue -- a self-planned benchmark/test_script node's
own judgment rejecting narrative summaries, exhausting loop_back's
max_attempts. One of the three ran against the real production
backend_server after the FK migration fix (bd1404d), confirming the new
Phase 1 status machine routes the failure correctly (blocked_pending_human
with a real diagnostic trail) even when the underlying pre-existing bug
fires before planner_reviewer is ever reached.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Updates the Phase 2 SDD and requirements doc to reflect that Phase 2a
(86fc0bb) and Phase 2b (7c46a2f) are done, not just designed. Records the
concrete deviations/fixes found during implementation that the original
design didn't anticipate: the run_id=None bug in the artifact-reuse resume
path, the missing needs_worktree=True on Coder's run_graph() call, why
§2.2's index narrowing needed to move from "maybe safe after 2b" to
"actually needs 2c", and the test-fixture check_same_thread=False gap
concurrent merged-graph layers exposed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Implements org-graph-unification-phase2-universal-self-planning-design.md
§2.3, §3, §6 -- Coder's implement_code() no longer runs one hardcoded
synthetic "implement" node; it self-plans via plan_work_graph(conn,
"coder", ..., append_to_run_id=run_id), appending its own nodes onto
Planner's existing work_graph_run instead of creating a separate one.

- work_graph_plan.py: per-org_node suggested node-type catalogs
  (_CODER_NODE_CATALOG/_VALIDATOR_NODE_CATALOG, "starting points, not
  requirements" same as _PLANNER_NODE_CATALOG), new judgment/on_fail/
  promotes_to_artifact fields in the generic planning prompt. New
  plan_work_graph(..., append_to_run_id=...) parameter: merges newly
  planned nodes into an existing run (node_id collision -> raise, never
  silent overwrite), returns new_node_ids so callers can avoid
  reprocessing nodes an earlier stage already promoted to artifacts. New
  shared dispatch_build_prompt() for graphs mixing Planner-shaped
  (artifact_type) and Coder-shaped (task_prompt) nodes side by side.

- e2e_pipeline.py: _write_completed_node_artifacts() now also promotes
  nodes declaring promotes_to_artifact (not just Planner's artifact_type
  nodes), with an only_node_ids scope so a merged-graph caller doesn't
  re-touch artifacts an earlier stage already wrote. implement_code()
  reworked around self-planning; code_diff stays Python-computed (a real
  git diff, not any node's own content -- no node can know the diff ahead
  of running it), test_report is promoted from whatever the self-planned
  graph declares, falling back to a synthesized concatenation if it
  declares none. needs_worktree=True now passed to run_graph() for Coder
  (found missing entirely during this rework -- harmless with the old
  single-node manifest, a real 03-C §3.6 gap once concurrent code-writing
  nodes are possible). Also fixed a real bug found while wiring this up:
  _review_planner_output_with_retries()'s "reuse existing artifacts"
  branch hardcoded run_id=None, even though every real artifact row
  already has a valid produced_by_run_id -- Coder had nothing to append
  into on that resume path.

- work_graph_fork.py: _reconstruct_build_prompt now dispatches per-node
  (via the new shared dispatch_build_prompt) instead of requiring the
  whole graph to be one uniform shape -- a real regression Phase 2b would
  otherwise have introduced silently, since a forked merged graph can now
  genuinely mix both node shapes.

Sequencing note (unchanged from Phase 2a's own finding): work_graph_run's
org_node column removal and the ux_work_graph_run_active index narrowing
(design doc §2.1/§2.2) stay deferred to Phase 2c -- Validator still
creates its own separate run until Validator also appends into the shared
one, so narrowing the index to task_id-only now would collide with it.

python3 -m unittest discover -s src (752 tests) + discover -s supervisor
-p "test_*.py" (126 tests) both green, zero regressions.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

migrate_add_reviewing_planner_output_status() rebuilds task (create-copy-
drop-rename, SQLite's only way to change a CHECK constraint), but task is a
parent table referenced by work_graph_run/artifact/execution_event/
bug_record. DROP TABLE task under PRAGMA foreign_keys=ON (schema.connect()'s
default) trips FK enforcement the instant any child row exists -- unit tests
never seeded a referencing child row, so this never surfaced until a real
restart against the live production database (months of real history).

Found and fixed live: no data loss (INSERT INTO task_new already succeeded
before the DROP failed; verified the two tables held byte-identical rows,
cleaned up the stray task_new, backed up the db, re-applied the fixed
migration, verified via PRAGMA foreign_key_check, then restarted the real
process against production and confirmed a real end-to-end task run through
the new Planner -> planner_reviewer -> Coder -> Validator flow).

Fix follows the migrate_relax_org_node_constraints() precedent already in
this file: PRAGMA foreign_keys=OFF around the rebuild, PRAGMA
foreign_key_check after, ON in a finally block. New regression test seeds
one referencing row per child table so this class of bug can't pass silently
again.

Also adds real (non-mocked) coverage for the planner_reviewer role in
test_e2e_pipeline_e2e.py: one real call confirming it flags real narrative-
text repro fixtures, one confirming it passes real structured content.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Implements org-graph-unification-phase2-universal-self-planning-design.md
§4 + §5, the engine-extension sub-phase (Phase 2a) -- no org-flow callers
changed yet, this is the underlying capability.

- _run_one_node() now resolves subagent_type/skill_ref per-node (node.get
  with the run-level org_node/skill_id as fallback), threaded through
  _ensure_node_row/_make_run_fn/_resolve_node_verify_fn -- a node's own
  judgment.kind="llm" call runs under its own declared identity, not
  always the graph-level default. Found and fixed a real gap surfaced by
  writing this: run_graph() only ensures the run-level default skill_id
  exists as a placeholder skill (work_node_execution.skill_ref's FK
  target) -- a node declaring its own skill_ref needs the same guarantee
  or the first INSERT for that skill_id fails FOREIGN KEY constraint.

- New on_fail.action="dynamic_loop_back": Reflection-review
  (_judge_root_cause_node) runs three real parallel perspectives (content/
  connectivity/history) under the Validator identity, each picking a
  target_node_id from the failing node's real ancestors plus a defect_kind
  (content_error vs skill_defect), majority-voted by _tally_reflection
  (own small Counter-based implementation, not imported from
  root_cause_trace.py -- that module already imports this one). A runtime
  ancestor check in _run_one_node backs up _tally_reflection's own
  degradation guarantee.

- skill_defect triggers Fix-Skill (_fix_skill_for_node) before the loop
  back fires: reads the target node's declared skill_ref, builds a
  rewrite prompt from what was asked/produced/why it failed/prior loop
  history, runs it under the Validator identity (user-confirmed via
  AskUserQuestion), then calls the existing but -- until now -- never
  actually invoked by any production path bug_record.create_bug_record()
  + skill_update.update_skill(), against skill_query._REPO_ROOT (never
  target_folder_path). Logs a real 'skill_iterated' execution_event (a
  CHECK-enum value that has existed since the original U-001 schema but
  was never written before). Rate-limited to
  _MAX_SKILL_FIXES_PER_RUN_PER_SKILL rewrites of the same Skill per run.

- New total-attempts-per-source-node loop_limit guard alongside the
  existing per-(target,source) one -- dynamic_loop_back can pick a
  different target each round, which would otherwise dodge the per-pair
  cap indefinitely. New settings_config key shape
  "{org_node}:{source_node_id}:total", no interface change needed there.

- New skills/skill-defect-remediation/SKILL.md (Validator-only), wired
  into roles/validator/role.json.

python3 -m unittest discover -s src (741 tests) + discover -s supervisor
-p "test_*.py" (126 tests) both green, zero regressions.

Deferred to Phase 2b (per design doc's own sequencing note): §2.1/§2.2
(work_graph_run.org_node removal + ux_work_graph_run_active index
narrowing) -- narrowing that index now, before the append-to-existing-run
mechanism lands, would break the current production flow, since Planner's
and Coder's work_graph_run rows both stay non-terminal indefinitely on
the happy path today (only Validator's own graph ever reaches 'done').

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Design for org-graph-unification-and-universal-self-planning-requirements.md
§3.1's step 3, previously flagged as the largest known gap in the Phase 2 SDD.

Extends §5.4's Reflection-review to judge both a target node AND a
defect_kind (content_error vs skill_defect), adds §5.5 Fix-Skill (a real
Validator-identity call rewriting the target node's skill_ref content, via
the existing but never-wired-up skill_update.py::update_skill() +
bug_record.create_bug_record()), and confirms Re-loop needs no new
mechanism -- the existing _LoopBackRequested path already re-runs the
target node, which picks up the new skill content automatically since
Claude Code loads Skill content by name at call time, not at agent
frontmatter deploy time.

Two findings during design that motivated/validated this work:
- org_level_loop.py's _ROUTE_FOR_CATEGORY has no 'skill_defect' key --
  skill_update.update_skill() has never been called by any production
  path despite root_cause_trace.py being able to classify skill_defect
  since U-015. Fix-Skill is the first time this dead capability gets wired
  up for real, via a new path, not by fixing the old one.
- execution_event.event_type's CHECK enum has had an unused 'skill_iterated'
  value since the original U-001 schema -- no new migration needed to log
  Fix-Skill events.

Also found and recorded a third work_graph_run.org_node call site
(root_cause_trace.judge_root_cause_via_work_graph) that §2.1's column-
removal missed.

Confirmed via AskUserQuestion: the Skill-rewrite call always runs under
the Validator identity, regardless of which org_node's skill is being
fixed -- avoids the self-correcting-its-own-blind-spot problem, and
matches skill_update.py's own "a Validator-triggered rewrite" docstring
intent from 03-C.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Phase 1 (planner_reviewer review gate + P0 resume-bug fix) shipped as
ea19c7d, matching org-graph-unification-phase1-review-gate-design.md
exactly (new task.status value, org role, _REQUIRED_ARTIFACTS narrowing,
both bugs fixed). Moving that design doc and the P0 bug doc it subsumed
to docs/done/, updating their status headers, and fixing the doc-path
references left pointing at their old docs/todo/ location across
agents/planner_reviewer/{SOUL,AGENTS}.md, src/schema.py migration
docstrings, and the other Phase 2/deblackbox docs. Full suite green
(731 tests) both before and after.

Also ran Phase 2 SDD's §9 interface-reconciliation checklist against the
real Phase 1 implementation now that it exists for real: all three items
check out (run_id is included in plan_and_review_documents()'s return
shape, the new task.status value is exactly reviewing_planner_output as
assumed, and planner_reviewer's role.json doesn't pre-reserve a skill
slot for Phase 2's new skill, which is fine -- a one-line addition when
Phase 2c lands, not an incompatibility). Updated §9 to reflect this.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

User's key insight, recorded as a goal in the requirements doc (new §3.1):
a failed node shouldn't just get a corrective retry (fix-bug, forgotten
after this run) -- when the root cause is a systemic Skill defect, the
Skill itself must be fixed (fix-skill, persists across all future tasks).
Four-step chain: judgment fails -> Reflection-review node does full-chain
root-cause diagnosis (one-off content error vs systemic skill defect) ->
if systemic, a Fix-skill node calls the already-existing skill iteration
machinery (skill_update.py::update_skill() + bug_record.py, real Git-
versioned commits, previously only reachable via org_level_loop.py's
coarse Org-level path, never from inside a Work Graph's own judgment/
loop_back cycle) -> loop back and re-run using the updated skill.

Cross-referenced into the Phase 2 design doc: its dynamic_loop_back (§5)
implements steps 1/2/4 of this chain but not step 3 (Fix-skill) -- flagged
as the largest known scope gap in §8, not a missed detail.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Inserts Planner -> planner_reviewer -> Coder -> Validator into the fixed Org
Graph flow (was Planner -> Coder -> Validator), per
docs/todo/org-graph-unification-phase1-review-gate-design.md. A new
planner_reviewer role independently judges whether Planner's BRD/PRD/SDD/
Benchmark output is real structured content (not narrative prose) before
Coder is allowed to start, with a 3-attempt retry loop and a narration
heuristic informed by the real narrative-output incident
(docs/todo/validator-test-script-narrative-output-issue.md).

Also fixes, in the same code path:
- The P0 bug in task-execution-resume-assumes-planner-artifacts-exist.md:
  resuming a task no longer assumes sdd/prd/benchmark artifacts exist --
  falls through to real replanning when they don't.
- A fresh-run KeyError (not resume-specific) when a self-planned graph omits
  the prd/benchmark node types.
- agent_profile.migrated_from_profile was NOT NULL, which broke as soon as a
  role with no legacy Hermes profile (planner_reviewer) was recorded.

org_node_lifecycle._REQUIRED_ARTIFACTS["coder"] is narrowed from
(brd,prd,sdd,benchmark) to (sdd,) -- the old 4-artifact gate never actually
blocked anything since artifact_write.py sets validation_status='passed'
unconditionally; planner_reviewer is the first real semantic gate.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Design for FR-2/FR-3/FR-4: extending self-planning to Coder/Validator,
per-node subagent/skill/tools binding, and node-level precise loop_back
replacing org_level_loop.py's coarse fast_lane/full_replan routing.

Three findings during design research that revise the requirements doc's
original FR-2 assumption ("just swap the call site"):
- _GENERIC_PROMPT_TEMPLATE never solicits judgment/on_fail today -- Coder/
  Validator switching to plan_work_graph() as-is would produce graphs with
  no judgment/loop-back capability at all.
- run_graph()'s subagent_type/skill_ref are run-level constants passed to
  every node identically, not node-level despite work_node_execution
  already having columns for it -- needs a real (bounded) engine extension.
- Today's on_fail.action="loop_back" target is statically declared at
  planning time via a single on_failure edge; it cannot express "a
  terminal validator dynamically diagnoses which of several ancestor
  nodes is the true root cause." New on_fail.action="dynamic_loop_back"
  designed for this, reusing root_cause_trace.py's jury/majority-vote
  structure with the vote target changed from a category to a node_id.

Also incorporates three requirements-doc §7 decisions that were made
(apparently concurrently) while this was being designed and overrule two
of this doc's initial drafts: work_graph_run.org_node is removed entirely
(not kept/sunk to node level) with concrete work_graph_run_query.py/
work_graph_fork.py rework; Coder/Validator get a suggested node-type
catalog (not fully free-form); the append interface is a parameter on
the existing plan_work_graph() (not a new function).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

… work, compress bloated incident log

- Delete org-graph-as-work-graph-unified-loop-requirements.md: fully
  superseded by org-graph-unification-and-universal-self-planning-
  requirements.md; folded its one non-duplicated detail (the 2084590a
  benchmark-narration trigger incident) into that doc's background instead.
- Split scheduler-production-polling-loop-{requirements,design}.md by
  completion status: FR-2 (in-flight task reconciliation, shipped) moves to
  docs/done/scheduler-task-reconciliation-{requirements,design}.md; FR-1
  (new-goal auto-dispatch, still undecided) becomes a small standalone
  docs/todo/scheduler-new-goal-dispatch-requirements.md instead of staying
  bundled with a doc that's mostly done.
- Compress validator-test-script-narrative-output-issue.md's six
  ad-hoc "第N轮更新" paragraphs crammed into one status line into a scannable
  timeline table; moved the task 2084590a benchmark evidence into §1 where
  the other repro examples live instead of leaving it stranded in the header.
- implementation-gap-analysis.md: logged two new gaps found today (no
  pre-Coder review of Planner's output; node execution still depends on
  native Dynamic Workflow) plus the architecture.md §10.1 staleness itself,
  per that doc's own "edit in place" maintenance convention.
- Updated the doc-path references left in src/task_execution.py and
  src/task_reconciliation.py docstrings to point at the new locations.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- org-graph-unification-phase1-review-gate-design.md: implementable SDD for
  inserting a planner_reviewer stage (new org role, since _PRE_STATE/
  _POST_STATE map org_node -> status 1:1 and can't reuse "validator" twice)
  between Planner and Coder. Folds in the P0 resume-artifact-assumption fix
  and a newly-found sibling KeyError in the fresh-run path.
- graphlemon_architecture.md §10.2: records that §10.1's "方案 A" (reuse
  Claude Code's native Dynamic Workflow for Work Graph execution) was
  superseded -- the graph-orchestration layer already diverged (REQ-06
  checkpoint/resume), and per today's decision the single-node execution
  layer is being migrated off it too, for controllability.
- work-graph-node-execution-deblackbox-requirements.md: requirements+design
  for that migration -- replace the 3 remaining write_workflow_script/
  execute_work_graph call sites with plan_work_graph()'s already-proven
  flat `claude --agent` + JSON-fence-extraction pattern.
- Cross-referenced the two new docs from each other and from the existing
  P0/P2 todo docs they fold into or relate to.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Merges the fixed-flow change (Planner -> Validator -> Coder -> Validator),
universal per-org-agent self-planning, node-level validator skill, and
frontend dynamic/historical graph asks into one requirements doc, folding
in the P0 resume-artifact bug and the P2 test_script structural-fix
placeholder that were blocking on the same design. Records the user's
2026-08-08 decision to merge all four org stages into one work_graph_run
(scheme A) rather than cross-graph routing (scheme B), plus the concrete
schema conflicts that decision surfaces (work_graph_run.org_node's single
value + unique-active-run index) for Phase 2's SDD to resolve.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

work-graph-partial-artifact-persistence and work-graph-self-planning-
and-loop-back (requirements + design) are all shipped and tested;
move them out of docs/todo/ and fix up the docs/todo/*.md and
src/*.py path references that pointed at their old location.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Real end-to-end verification of Work Graph self-planning + loop-back
(task 2084590a) hit the narrative-output problem again -- this time on a
self-planned benchmark node, not test_script, disproving the earlier
"BRD/PRD/SDD/Benchmark won't recur" hypothesis in validator-test-script-
narrative-output-issue.md. The judge caught it once (round 3) but couldn't
force a fix; the loop_back retry limit correctly exhausted and blocked the
task cleanly instead of hanging or crashing.

Also drafts org-graph-as-work-graph-unified-loop-requirements.md: extending
today's Work-Graph-internal judgment/on_fail/loop_back mechanism up to the
Org Graph itself, so Coder doesn't start from an unreviewed Planner output
and a Validator FAIL can route to a precise node instead of a whole phase.
Flags the real hard part (Planner/Coder each plan their own graph_manifest,
so node ids don't share an address space across the org boundary) as the
first open question, not yet implemented.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

v_task_board's task_id cell now links to #/graph?task_id=<id> for quick
navigation to a task's execution graph. v_graph_console reads that param
to preselect the task, and syncs the URL (via history.replaceState) on
every task load -- including the initial auto-preselect -- so the address
bar always reflects the task actually showing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…76ae-main-checkout-drift

…4843-main-checkout-drift

ConsistencyCheckFailedError is now raised by both the PRD-consistency
check and the test_script mechanical compile-check (07a0a27), but
scheduler._blocked_reason_for still labeled every instance
'prd_consistency_check_failed', misleadingly blaming the PRD for
test_script node failures. Distinguishes by node_id substring match
(see docstring for the ponytail ceiling/upgrade path).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Mitigates the recurring test_script/validator_test_script narration issue
(100% repro across 3 tasks, 6 nodes): the existing compile-error feedback
buries its "not a narrative description" note under raw tracebacks, which
wasn't enough to stop the model repeating narrative output on retry. Adds
_NARRATION_RETRY_HINT as a separate, directive feedback item alongside the
compiler detail. See docs/todo/validator-test-script-narrative-output-issue.md
§6-7 for the full root-cause analysis and rationale.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…9789-main-checkout-drift

…d4ef-main-checkout-drift