Merge branch 'fix/lv-review-blockers' into lv-merge-blockers

# Conflicts:
#	agent/tests/test_post_hooks.py
#	cdk/src/handlers/fanout-task-events.ts
#	cdk/src/handlers/linear-webhook-processor.ts
#	cdk/src/handlers/shared/linear-subissue-fetch.ts
#	cdk/src/handlers/shared/orchestration-release.ts
#	cdk/test/handlers/fanout-task-events.test.ts

Author: isadeks

agent/src/pipeline.py

@@ -1448,13 +1448,26 @@ def _on_trace_truncated(max_bytes: int, first_dropped: int) -> None:
             if pr_url:
                 progress.write_agent_milestone("pr_created", pr_url)
                 # Move the Jira card In Progress → In Review now that a PR is
-                # open (issue #572). Only fires when a PR was actually opened —
-                # failed / no-PR tasks leave the card where humans can see the
-                # failure comment. No-op for non-Jira tasks; best-effort.
-                transition_pr_opened(
-                    config.channel_source,
-                    config.channel_metadata,
-                )
+                # open (issue #572) — but ONLY when the build passed. ensure_pr
+                # deliberately opens a PR even on a FAILED build (so the human
+                # sees the broken diff), so gating on pr_url alone moved the card
+                # to In Review on a red build, telling the board the work is ready
+                # for review when it isn't (review blocker #9a). Gate on build_ok
+                # to mirror the Linear twin, which only transitions on success
+                # (react_task_finished: `if transition_state and success`). A
+                # build-failed PR leaves the card In Progress with the failure
+                # comment. No-op for non-Jira tasks; best-effort.
+                if build_passed:
+                    transition_pr_opened(
+                        config.channel_source,
+                        config.channel_metadata,
+                    )
+                else:
+                    log(
+                        "TASK",
+                        "Jira card NOT moved to In Review — PR opened with a FAILED build "
+                        "(build_ok=False); leaving it In Progress with the failure comment (#9a).",
+                    )
 
             # Memory write — capture task episode and repo learnings
             memory_written = False

agent/src/post_hooks.py

@@ -489,6 +489,79 @@ def _note_unpushed_commits(repo_dir: str, branch: str, config: TaskConfig) -> No
         log("WARN", f"Failed to post un-pushed-commits note: {type(e).__name__}: {e}")
 
 
+def _reconcile_pr_base(repo_dir: str, branch: str, config: TaskConfig, expected_base: str) -> None:
+    """Deterministically retarget an existing PR onto ``expected_base``.
+
+    The PR is created by the AGENT (its own ``gh pr create`` in the prompt
+    workflow), so the ``--base`` it chose is a model judgment call, not the
+    orchestrator's. Live-caught on the #247 chain stress test (2026-07-18):
+    a stacked child that branched off its predecessor's branch STILL opened
+    its PR against ``main`` — the agent reasoned "this was based off the
+    chain-Y branch, let me open the PR against main" and even a root whose
+    ``detect_default_branch`` correctly returned ``linear-vercel`` was pointed
+    at ``main``. Wrong base ⇒ the PR shows the whole default-branch divergence
+    (100s of files) instead of the child's real delta, and a stacked child's
+    PR merges onto the wrong branch.
+
+    ``expected_base`` is ``setup.default_branch`` — which is the orchestrator's
+    ``base_branch`` for a stacked child (the predecessor's branch, or ``main``
+    for a diamond) and ``detect_default_branch`` for a root. This post-hook
+    reads the PR's current base and, if it disagrees, retargets it via
+    ``gh pr edit --base`` — removing the agent's discretion without forbidding
+    it from opening the PR (which keeps the agent-authored title/body).
+
+    Best-effort: any failure is logged, never fatal — a mis-based PR is a
+    presentation/merge-target defect, not a reason to fail the whole task.
+    """
+    try:
+        view = subprocess.run(
+            [
+                "gh",
+                "pr",
+                "view",
+                branch,
+                "--repo",
+                config.repo_url,
+                "--json",
+                "baseRefName",
+                "-q",
+                ".baseRefName",
+            ],
+            cwd=repo_dir,
+            capture_output=True,
+            text=True,
+            timeout=60,
+        )
+    except (OSError, subprocess.SubprocessError) as exc:
+        log("WARN", f"Could not read PR base to reconcile ({type(exc).__name__}) — leaving as-is")
+        return
+    if view.returncode != 0 or not view.stdout.strip():
+        # No PR / unreadable base — nothing to reconcile (creation path handles
+        # the no-PR case; a transient read error just leaves the base as-is).
+        return
+    current_base = view.stdout.strip()
+    if current_base == expected_base:
+        return
+    log(
+        "POST",
+        f"Retargeting PR base '{current_base}' → '{expected_base}' "
+        f"(deterministic; agent chose the wrong base)",
+    )
+    result = run_cmd(
+        ["gh", "pr", "edit", branch, "--repo", config.repo_url, "--base", expected_base],
+        label="reconcile-pr-base",
+        cwd=repo_dir,
+        check=False,
+    )
+    if result.returncode != 0:
+        stderr_msg = result.stderr.strip()[:200] if result.stderr else "(no stderr)"
+        log(
+            "WARN",
+            f"Failed to retarget PR base to '{expected_base}' (gh exit {result.returncode}): "
+            f"{stderr_msg} — PR remains based on '{current_base}'",
+        )
+
+
 def ensure_pr(
     config: TaskConfig,
     setup: RepoSetup,
@@ -582,6 +655,10 @@ def ensure_pr(
     if result.returncode == 0 and result.stdout.strip():
         pr_url = result.stdout.strip()
         log("POST", f"PR already exists: {pr_url}")
+        # The agent opened this PR and picked its own --base; correct it to the
+        # orchestrator-supplied / detected base if it disagrees (stacked-child
+        # + root wrong-base fix, 2026-07-18).
+        _reconcile_pr_base(repo_dir, branch, config, default_branch)
         return pr_url
 
     # Check if there are any commits on this branch beyond the default branch

agent/src/prompts/new_task.py

@@ -85,7 +85,12 @@
    - Any patterns or conventions you discovered about this repo
    - Suggestions for future tasks on this repo
 
-   Run:
+   Run this EXACTLY — the `--base` value is chosen for you (for a stacked \
+sub-issue it is the predecessor's branch so the PR shows only your delta; for \
+a normal task it is the repo default). Do NOT substitute a different base such \
+as `main`/`master` even if this branch was cut from another branch — targeting \
+the wrong base makes the PR show the whole branch divergence instead of your \
+change:
    ```
    gh pr create --repo {repo_url} --head {branch_name} --base {default_branch} --title "<type>(<module>): <description>" --body "<body>"
    ```

agent/tests/test_pipeline.py

@@ -876,6 +876,129 @@ async def fake_run_agent(_prompt, _system_prompt, _config, cwd=None, trajectory=
 
         mock_ensure_pr.assert_called_once()
 
+    @patch("runner.run_agent")
+    @patch("pipeline.build_system_prompt")
+    @patch("pipeline.discover_project_config")
+    @patch("repo.setup_repo")
+    @patch("pipeline.task_span")
+    def test_jira_card_not_moved_to_in_review_on_build_failure(
+        self,
+        mock_task_span,
+        mock_setup_repo,
+        _mock_discover,
+        _mock_build_prompt,
+        mock_run_agent,
+        monkeypatch,
+    ):
+        """review blocker #9a: ensure_pr opens a PR even on a FAILED build (so the
+        human sees the broken diff), so the Jira In Progress → In Review transition
+        must gate on build_passed — not merely on pr_url — or the board lies that
+        the work is ready for review. Mirrors the Linear success-only twin."""
+        monkeypatch.setenv("GITHUB_TOKEN", "ghp_test")
+        monkeypatch.setenv("AWS_REGION", "us-east-1")
+        mock_setup_repo.return_value = RepoSetup(
+            repo_dir="/workspace/repo",
+            branch="bgagent/test/branch",
+            build_before=True,
+        )
+
+        async def fake_run_agent(_prompt, _system_prompt, _config, cwd=None, trajectory=None):
+            return AgentResult(status="success", turns=2, cost_usd=0.01, num_turns=2)
+
+        mock_run_agent.side_effect = fake_run_agent
+
+        mock_span = MagicMock()
+        mock_span.__enter__ = MagicMock(return_value=mock_span)
+        mock_span.__exit__ = MagicMock(return_value=False)
+        mock_task_span.return_value = mock_span
+
+        mock_transition = MagicMock()
+        with (
+            patch("pipeline.ensure_committed", return_value=False),
+            # FAILED build — ensure_pr still opens the PR below.
+            patch("pipeline.verify_build", return_value=VerifyOutcome(passed=False)),
+            patch("pipeline.verify_lint", return_value=VerifyOutcome(passed=True)),
+            patch("pipeline.ensure_pr", return_value="https://github.com/o/r/pull/9"),
+            patch("pipeline.transition_pr_opened", mock_transition),
+            patch("pipeline.get_disk_usage", return_value=0),
+            patch("pipeline.print_metrics"),
+            patch("pipeline.task_state") as mock_task_state_mod,
+        ):
+            mock_task_state_mod.get_task = MagicMock(return_value={"status": "RUNNING"})
+            mock_task_state_mod.TaskFetchError = Exception  # type: ignore[attr-defined]
+            from pipeline import run_task
+
+            run_task(
+                repo_url="o/r",
+                task_description="x",
+                github_token="ghp_test",
+                aws_region="us-east-1",
+                task_id="t-jira-failbuild",
+                channel_source="jira",
+                channel_metadata={"jira_issue_key": "ABC-1"},
+            )
+        # PR opened, but the Jira card was NOT advanced to In Review on the red build.
+        mock_transition.assert_not_called()
+
+    @patch("runner.run_agent")
+    @patch("pipeline.build_system_prompt")
+    @patch("pipeline.discover_project_config")
+    @patch("repo.setup_repo")
+    @patch("pipeline.task_span")
+    def test_jira_card_moved_to_in_review_on_build_success(
+        self,
+        mock_task_span,
+        mock_setup_repo,
+        _mock_discover,
+        _mock_build_prompt,
+        mock_run_agent,
+        monkeypatch,
+    ):
+        """The positive twin: a PASSING build DOES move the Jira card to In Review."""
+        monkeypatch.setenv("GITHUB_TOKEN", "ghp_test")
+        monkeypatch.setenv("AWS_REGION", "us-east-1")
+        mock_setup_repo.return_value = RepoSetup(
+            repo_dir="/workspace/repo",
+            branch="bgagent/test/branch",
+            build_before=True,
+        )
+
+        async def fake_run_agent(_prompt, _system_prompt, _config, cwd=None, trajectory=None):
+            return AgentResult(status="success", turns=2, cost_usd=0.01, num_turns=2)
+
+        mock_run_agent.side_effect = fake_run_agent
+
+        mock_span = MagicMock()
+        mock_span.__enter__ = MagicMock(return_value=mock_span)
+        mock_span.__exit__ = MagicMock(return_value=False)
+        mock_task_span.return_value = mock_span
+
+        mock_transition = MagicMock()
+        with (
+            patch("pipeline.ensure_committed", return_value=False),
+            patch("pipeline.verify_build", return_value=VerifyOutcome(passed=True)),
+            patch("pipeline.verify_lint", return_value=VerifyOutcome(passed=True)),
+            patch("pipeline.ensure_pr", return_value="https://github.com/o/r/pull/9"),
+            patch("pipeline.transition_pr_opened", mock_transition),
+            patch("pipeline.get_disk_usage", return_value=0),
+            patch("pipeline.print_metrics"),
+            patch("pipeline.task_state") as mock_task_state_mod,
+        ):
+            mock_task_state_mod.get_task = MagicMock(return_value={"status": "RUNNING"})
+            mock_task_state_mod.TaskFetchError = Exception  # type: ignore[attr-defined]
+            from pipeline import run_task
+
+            run_task(
+                repo_url="o/r",
+                task_description="x",
+                github_token="ghp_test",
+                aws_region="us-east-1",
+                task_id="t-jira-okbuild",
+                channel_source="jira",
+                channel_metadata={"jira_issue_key": "ABC-1"},
+            )
+        mock_transition.assert_called_once()
+
     @patch("runner.run_agent")
     @patch("pipeline.build_system_prompt")
     @patch("pipeline.discover_project_config")