feat(01KVS13C): On a red PR CI the run drives a bounded fix-and-recheck round before blocking

[jackmcintyre]

What this does

On a red PR CI, /flow:run now drives a bounded dev fix-and-recheck round before giving up, instead of routing straight to blocked/ on the first red.

When the auto-merge gate returns ci-not-green for a story whose reviewer verdict was READY FOR MERGE and a CI-fix round still remains, the run:

1. re-spawns the SAME builder, seeded with the failing-check context (the gate's chatLog),
2. the dev pushes to the SAME existing PR branch (branch reuse is owned by runDevTerminalAction),
3. re-runs runAutoMergeGate to re-poll CI.

On green it proceeds to completeStory/done as today; on exhausted-still-red it blocks ci-not-green exactly as today.

How each AC is met

• AC1 — The gate call + not-confirmed-green handling are wrapped in a for (;;) loop. On gateReason === 'ci-not-green' && ciFixRoundsLeft > 0, the run drives a fix round via the extracted runDevRound closure (seeded with the gate's chatLog failing-check context, pushing to the same PR branch) and continues to re-run the gate — all before routing to blocked/.
• AC2 — When MAX_CI_FIX_ROUNDS is exhausted and the gate is still ci-not-green, the loop breaks and the existing not-confirmed-green handler blocks the story with reason ci-not-green. completeStory (the done/ move) runs only after that guard, so a still-red story never reaches done/.
• AC3 — The fix-round branch keys on ci-not-green exactly. A confirmed-green outcome (auto-merge / pause on green CI), an ci-status-unreadable block, or a verdict-failed/garbled gate all break out of the loop immediately and route exactly as before — no fix round.

Safety

The new MAX_CI_FIX_ROUNDS cap (default 1, from A.maxCiFixRounds) is independent of MAX_REWORK and bounds the re-spawn loop — the story's highest risk (an unbounded dev re-spawn loop) cannot occur. ciFixRoundsLeft is decremented each round and gates the re-spawn.

Structure

The long dev-spawn block was extracted into a reusable runDevRound closure that returns a discriminated outcome (spawn-reviewer / needs-human / no-handoff / pd-failed); both the reviewer-rework loop and the CI-fix round call it, and a shared handleDevFailure keeps the block-on-dev-failure semantics identical regardless of which path spawned the dev. Faithful to the original: isolation:'worktree', the runDevTerminalAction handoff path, and the parse/blocking behaviour all live inside the closure.

Build & tests

• run.workflow.js is shipped as-is (NOT bundled into dist) and run-auto-merge-gate.ts was left unchanged (the gate already returns the failing-check detail in chatLog), so no dist rebuild was needed — no dist drift.
• Target test tests/run-workflow.test.ts: 61 passed (8 new structural anchors for this story's ACs + the bound).
• Full suite: 251 test files passed; overall line coverage 86.11% (>= 86% gate).

https://claude.ai/code/session_01E5VyKQMGJSL6fRfRmCzuvs