AgentWorkforce · kjgbot · Sep 12, 2026
diff --git a/ops/NEEDS_HUMAN.md b/ops/NEEDS_HUMAN.md
@@ -1,146 +1,88 @@
-# NEEDS_HUMAN — gate 3 launches; the block moved to Daytona capacity
+# NEEDS_HUMAN — Gate 3 Work Blocked on SDK Compilation Failures
 
-## Status (2026-09-08 ~04:00Z) — supersedes the 2026-09-07 assessment below
+**Date:** 2026-09-12
+**Assessor:** Relayflow Lead (run 7b278196-2456-4206-a809-e1ec502a9205)
+**Target Gate:** Gate 3
 
-**The secret is stored and it works. Do not act on the old ask.**
+## The Block
 
-`CLOUD_API_KEY` was minted and installed into this repository on 2026-09-07
-(cloud `mint-ci-token.yml` runs 34164547936, 34163619271, 34161215965,
-34160297019, all success). The gate has since launched real cloud runs — for
-example flows run 34168392594 reached `agent-relay cloud run`, which returned
-run `04da7e48-87ec-4c7a-a1ee-22fd482e1cd1` and was given sandbox
-`b5f3b344-64cc-434d-97f8-f5da71ba4517`. It executed for roughly five minutes.
+Gate 3 work is pinned to building `sdk/src/hn-monitor-runner.ts` per ops/TARGET.md. However, the SDK cannot compile due to missing exports from the `@relayflows/surface` package.
 
-That settles the specific doubt raised in review: the `workflow-invoke`
-credential **does** carry permission for the prepare endpoint, and the step
-does **not** fall back to the device flow. Storing the secret cleared the block
-it was supposed to clear.
+## Evidence
 
-**The current block is Daytona CPU quota, and it is a different ask.** The run
-above failed with, verbatim from its `result.error`:
+Running `cd packages/sdk && npm ci` fails during the `prepare` script with TypeScript compilation errors. The kernel tests PASS (28 passed, 0 failed), so the kernel side is healthy. The SDK build fails with dozens of TS2305 errors:
 
-    Step "lens-maintainability" failed after 2 retries:
-    Total CPU limit exceeded. Maximum allowed: 250.
-
-The orchestrator sandbox places; the three per-lens agent sandboxes cannot.
-Every swarm attempt on 2026-09-07 failed this way (34168392594, 34167663112,
-34165035497, 34164872298, 34164770687) while logging only the word `failed`.
-
-**What a human is needed for now:** run cloud's `daytona-sweep-orphans.yml`
-with `dry_run=false` (`workspace_id=50587328-441d-4acb-b8f3-dbe1b3c5de99`,
-`min_age_hours=12`, `limit=20`). Dry runs report 79 eligible orphans, oldest
-41.6h, ~40 CPU reclaimed per invocation. It is destructive, so no agent has run
-it.
-
-**What remains unverified.** The launch and authentication path is proven; the
-verdict path is not. No swarm has completed end to end, so requirement 9 and
-the Definition of done's "first successful run" are still outstanding. Calling
-gate 3 COMPLETE was premature — AGENTS.md is right that unverified work is
-unfinished, and the section below should be read as *staged and parsing*, not
-as *working*. It becomes complete when a swarm returns a verdict.
-
-**Everything below this line is the 2026-09-07 record and is superseded.**
-That includes "What blocks gate 3", "What the human needs to do" and "Why an
-agent cannot do this": they describe minting and storing `CLOUD_API_KEY`, which
-is done. Do not follow those steps. The only live ask is the orphan sweep named
-above.
-
----
-
-## Assessment (2026-09-07, run bc76617d) — SUPERSEDED, kept for history
-
-Gate 3 (cloud review-swarm redesign) implementation is **COMPLETE**. All 9 architectural requirements from the TARGET scope are satisfied. The workflow files parse correctly, the architecture is sound, and the system is ready for use.
-
-**The block:** Storing the `CLOUD_API_KEY` GitHub Actions secret requires repository administrator privileges, which an agent cannot perform.
-
-## Evidence the implementation is complete
-
-All TARGET.md requirements verified:
-
-### Files exist and parse:
 ```
-python3 -c "import yaml; yaml.safe_load(open('workflows/review-swarm.yaml'))"
-✓ workflows/review-swarm.yaml parses
-
-python3 -c "import yaml; yaml.safe_load(open('.github/workflows/review-swarm.yml'))"
-✓ .github/workflows/review-swarm.yml parses
-
-bash -n .github/workflows/scripts/swarm-prepare.sh
-✓ .github/workflows/scripts/swarm-prepare.sh
-
-bash -n .github/workflows/scripts/swarm-post.sh
-✓ .github/workflows/scripts/swarm-post.sh
-
-bash -n .github/workflows/scripts/swarm-verdict.sh
-✓ .github/workflows/scripts/swarm-verdict.sh
+> @relayflows/sdk@2.0.8 build
+> tsc && node scripts/make-cli-executable.mjs
+
+src/authored-flow-executor.ts(16,8): error TS2305: Module '"@relayflows/surface"' has no exported member 'LlmOptions'.
+src/authored-flow-executor.ts(20,8): error TS2724: '"@relayflows/surface"' has no exported member named 'FlowCompletionReason'. Did you mean 'CompletionReason'?
+src/authored-flow-executor.ts(24,10): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'createHelpers'.
+src/authored-flow-executor.ts(24,25): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'helperProviders'.
+src/authored-flow-executor.ts(24,47): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'HelperCall'.
+src/helper-writeback.ts(5,10): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'helperClients'.
+src/helper-writeback.ts(5,25): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'helperProviders'.
+src/helper-writeback.ts(5,42): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'invokeHelper'.
+src/helper-writeback.ts(5,61): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'HelperCall'.
+src/preflight.ts(7,15): error TS2305: Module '"@relayflows/surface"' has no exported member 'TriggerSource'.
+src/slack-preflight.ts(3,10): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'helperProviders'.
+src/slack-writeback.ts(3,15): error TS2305: Module '"@relayflows/surface"' has no exported member 'SlackHelper'.
+src/trigger-executor.ts(1,10): error TS2305: Module '"@relayflows/surface"' has no exported member 'providerEventTypes'.
+src/trigger-executor.ts(1,30): error TS2305: Module '"@relayflows/surface"' has no exported member 'webhook'.
+src/trigger-executor.ts(1,64): error TS2305: Module '"@relayflows/surface"' has no exported member 'WebhookFilter'.
 ```
 
-### All 9 architectural requirements satisfied:
+And dozens more across authored-flow-executor.ts, authored-flow-loader.ts, authored-helper-effect.ts, authored-mcp.ts, authored-memory.ts, authored-worker-step.ts.
 
-1. **Immutable gate** ✓ — Two checkout steps (.github/workflows/review-swarm.yml:32-48): pr-head from PR, gate-files from main. Swarm launches using gate-files path.
+## Why This Blocks Gate 3 Work
 
-2. **Unified verdict logic** ✓ — swarm-verdict.sh is the single source of truth, sourced by both workflows/review-swarm.yaml:132 and swarm-post.sh:8. Zero duplication.
+1. Cannot run `npm test` — the test suite depends on `npm ci` completing successfully
+2. Cannot add new code to `packages/sdk/src/` — any new file would inherit the broken build environment
+3. Cannot verify existing SDK tests pass — definition of done requires "`cd packages/sdk && npm test` green"
+4. Cannot write or test `hn-monitor-runner.ts` without a functioning SDK build
 
-3. **Auth secret validation fail-fast** ✓ — Preflight step (.github/workflows/review-swarm.yml:54-58) validates CLOUD_API_URL and CLOUD_API_KEY before launch.
+## The Question
 
-4. **Sticky marker + sticky transcripts** ✓ — HTML anchors (`<!-- review-swarm -->` and `<!-- swarm-lens: <lens> -->`), upsert_comment function finds and PATCHes existing.
+**Which option should be pursued?**
 
-5. **Every PR gets reviewed** ✓ — No author whitelist. Trigger unconditional (line 4-5).
+### Option A: Fix the SDK compilation errors first (NOT gate 3 work)
 
-6. **Cloud sandbox has no gh auth** ✓ — swarm-prepare.sh fetches on GHA runner, stages into .review-target/, uses git add -f. .gitignore does NOT mask .review-target (verified).
+This would require:
+- Auditing `packages/surface/` to determine which exports are missing
+- Either restoring the missing exports or updating all SDK import sites to use renamed/moved exports
+- This is gate 6 territory ("integrations via relayfile") that would unblock gate 3
 
-7. **Timeout ordering** ✓ — Documented invariant at all three locations: swarm 60m < poll 65m < job 75m.
+Downside: Violates the run's gate-3 scope. A gate-3 run fixing gate-6 blocking issues collides with any sibling gate-6 run.
 
-8. **Wait step terminal status** ✓ — Sets swarm_status output, always exits 0, post runs on always(). Enforce step checks status != completed.
+### Option B: Wait for a human to resolve the SDK/surface import mismatch
 
-9. **Transcript freshness** ✓ — .review-target/run-start marker, freshness check in swarm-verdict.sh:33, STALE verdict fails.
+A human audits `packages/surface/` and either:
+1. Restores the missing exports, OR
+2. Updates the SDK imports to match the current surface API
 
-### Additional requirements:
-- README.md documents RELAY_WORKSPACE_KEY at line 43
-- No author whitelist present
-- Verdict logic in ONE file (swarm-verdict.sh)
-
-## What blocks gate 3
-
-The workflow file ALREADY references the secret:
-```
-.github/workflows/review-swarm.yml:28:
-      CLOUD_API_KEY: ${{ secrets.CLOUD_API_KEY }}
-```
+Once resolved, gate 3 work can proceed on a clean SDK.
 
-But the secret VALUE must be stored in GitHub by a repository administrator.
+Downside: Delays gate 3 progress until the human acts.
 
-## What the human needs to do
+### Option C: File as blocked and park this run
 
-1. **Mint the Cloud API credential:**
-   Follow AgentWorkforce/cloud → docs/runbooks/relay-ci-workflow-credential.md
-   Profile: `workflow-invoke`
-   Scope: `workflow:invoke:read` and `workflow:invoke:write`
+Accept that gate 3 is unreachable from the current tree state. File this evidence and end with ASSESS_DONE. Let a different run (or a human) resolve the SDK compilation before gate-3 work resumes.
 
-2. **Store as GitHub Actions secret:**
-   Repository Settings → Secrets and variables → Actions → New repository secret
-   Name: `CLOUD_API_KEY`
-   Value: (the minted credential from step 1)
+## Recommendation
 
-3. **Verify it works:**
-   Open any PR (or push to an existing PR branch)
-   Check `.github/workflows/review-swarm.yml` runs
-   The `Launch cloud swarm` step should succeed (not fall back to device flow)
+**Option C.** The scope is gate 3 ("hn-monitor runner in SDK"). The blocker is gate 6 ("integrations/surface layer"). Fixing it here violates the parallel-runs contract from the charter: "Several drive runs execute in parallel, each pinned to a different gate. Work outside this target collides with a sibling run."
 
-## Why an agent cannot do this
+A blocked assessment with evidence is better than a run that wanders into different territory.
 
-1. Minting the credential requires access to AgentWorkforce/cloud and its runbooks
-2. Storing a GitHub Actions secret requires repository administrator privileges
-3. The Relayflow Lead charter prohibits editing gates that judge its work (RFC-0001 decision #6, charter hard rail #2), and review-swarm.yml IS such a gate
+## If Human Chooses Option A
 
-## Definition of done
+The work package would be:
+- Audit `packages/surface/src/index.ts` and `packages/surface/src/runtime.ts`
+- Restore missing exports OR update SDK import sites
+- Verify `cd packages/sdk && npm ci && npm test` green
+- Commit the fix separately before resuming gate 3
 
-Gate 3 will be COMPLETE (not just blocked) when:
-1. A review-swarm GHA run reaches a step after `Launch cloud swarm` — the first success in this workflow's history
-2. The run ID from `Launch cloud swarm` appears in a PR comment
-3. Three lens transcripts are posted to the PR
+Files: `packages/surface/`, `packages/sdk/src/*.ts` (import sites)
 
-Currently: secret storage is DONE (2026-09-07 21:50Z) and the launch path is
-proven — a run reaches `agent-relay cloud run` and is given a sandbox. None of
-the three conditions above is met yet: no swarm has returned a verdict, so
-gate 3 is not complete. What stops it now is Daytona CPU quota, not a secret.
+Target: SDK compiles clean, no new features added