feat(workflows): author checks, typed decisions, and bounded rework

[Igloczek]

Closes #27 · Parent spec #3 · Stack layer 3/5 (base: #31 workflows/26-run-experience)

Problem

The editor could only author agent sequences. Checks, typed decisions, bounded rework, and human gates were read-only, and the run view inferred which repeat route fired from its destination.

What this adds

• Check, Decision, and Human gate authoring in the same editor, enabled only for kinds the backend advertises. The palette stays closed until capabilities load. Checks configure command, arguments, timeout, and next/unresolved routes; unsupported workspace and retry policies are shown as unavailable, not invented.
• Typed decisions:
  • Ordered rule cards with typed field/operator/value/destination.
  • Match all / Match any with nested groups, and a visible first-match order.
  • A required Otherwise.
  • Fields come only from steps upstream of the decision and their declared report/check contracts.
  • "Reads as" explains the saved predicate, including absence semantics.
  • Backend depth and term bounds are respected, and problems are located at the exact condition (rules.N.when…).
• Bounded rework:
  • Repeat a previous step needs Return to, Maximum repeats ("1 repeat (2 visits in total)"), and a separate At limit.
  • The flow, Route list, and run view say "↩ repeats back to X up to 1 time (first visit + 1 repeat = 2 visits), then At limit → Y".
  • Dangling targets, unbounded cycles, and a second repeat route to the same Return to are blocking, located errors.
• Engine truthfulness:
  • The persisted trace now records which route fired and its repeat bound and outcome: admitted, limit, visit-limit, or automation-stopped.
  • A repeat counter is spent only when the repeat actually runs.
  • A single settleRoute drives both transition and allowedActions. Gates therefore offer only decisions the engine would admit as authored, and explain withheld ones (Run.withheld).
  • A crashed check without a retained result shows as unresolved, is never auto-replayed, and reruns only on explicit Retry.

Validation

• Server (Bun):
  • WorkflowsDecisions.test.ts: check-driven repeat, At limit, and request-changes across restarts; nested first match and approve; whole-run bound; diverted repeats; gate offers at the visit limit; located validation.
  • Workflows, WorkflowsRun, WorkflowsValidation, and WorkflowsAuthoring tests pass.
  • The 6 known failures (WorkflowsMissingReportTime lostack-*, WorkflowsTimeout committed-crash) are pre-existing at the Run workflows with native threads, evidence, and recovery #26 base.
• Plugin unit: graph.test.ts, editing.test.ts.
• Web integration (Bun, real servers, authenticated session): WorkflowDecisions.integration.test.tsx authors the whole graph without dragging, saves the canonical predicate, starts the run, and checks repeat/At-limit route history, the crashed-check unresolved state, gate withholding, and Approve. WorkflowRun and WorkflowAuthoring still pass.
• Typecheck, lint, and fmt are clean for touched packages.

Independent review

Three rounds by a separate Claude Opus 5.5 reviewer. MAJORs fixed:

• diverted repeats spending counters
• the shared repeat counter
• a gate offering "Request changes" that the visit limit would divert

The reviewer also probed settleRoute against the previous settlement logic: 1,280 cases, 0 differences. Final verdict: APPROVED e6eb0546e09a3091df59dbc97f6e0c34b1be2e20.

Pending

• Maintainer comprehension check (AC7): a person must identify "Repeat implementation once" and explain its At limit destination without coaching. This is pending with the maintainer, and the result will be recorded here.
• UI evidence: the real-browser pass is pending because the T3 preview host was unavailable.

Limitations

• Old runs show "Repeat N" without a limit, since the new trace fields are optional.
• At the whole-run visit limit, a gate decision that would lead to an automated step is withheld (with an explanation) rather than redirected.
• A decision source that runs only later inside the decision's own loop passes validation; it ends unresolved at runtime, with an honest message.

Implemented by Claude Opus 5.5 implementation agents and reviewed by an independent Claude Opus 5.5 agent (gilfoyle), orchestrated in Claude Code running in T3 Code.

🤖 Generated with Claude Code