fix: per-PR workspaces, realistic duration default, honest timeout message; restore the pipeline DAG in the Go port

[AbirAbbas]

What

Four reliability fixes found by running pr-af-go in production against Agent-Field/agentfield's open PRs on Windows, applied to both ports (Python + Go, byte-identical behavior per the parity contract) — plus the restoration of the pipeline DAG in the Go port (item 5).

1. Per-PR workspaces — parallel reviews no longer clobber each other. Both ports resolved every PR of a repo into ONE shared dir ($PR_AF_WORKDIR/<repoName>) whose pr-review branch was re-pointed per review, so concurrent reviews of different PRs silently explored the wrong checkout. The workspace is now keyed <repoName>-pr<N> when the PR number is known (plain <repoName> otherwise, preserving repo_path/diff_text flows). New tests in both ports pin two PRs of one repo → two dirs, each at its own PR head.

2. PR_AF_MAX_DURATION_SECONDS default 300 → 3600. Real reviews measure 60–70 minutes; at the old 5-minute default every fresh install died mid-pipeline. Updated in code defaults, both manifests, .env.example, and both README env tables.

3. Honest budget-exhaustion message. "Budget exhausted before " fired whether the cost cap or the wall-clock cap tripped — and in the Go port cost never accrues, so it was always wall-clock and the message was actively misleading. Duration trips now say Review time budget exceeded (max_duration_seconds=<N>) before <phase>; cost trips keep the old wording. Strings byte-identical across ports, pinned by new tests in both.

4. Manifests declare AGENTFIELD_HARNESS_IDLE_SECONDS (default 360). Harness CLIs in JSON mode emit events only at completion boundaries, so one long reasoning completion is minutes of legitimate silence; the SDKs' old 120s idle watchdog killed healthy runs (observed live at 8–19 minutes into progressing pipelines).

5. Go port: pipeline phases are tracked executions again — the review DAG is restored. The Python node reports every phase (intake_phase, anatomy_phase, the meta_* selectors, each parallel review_dimension, adversary_phase, evidence_verifier, the obligation/compound reasoners, coverage_gate) as a child execution of the parent review, and the control-plane UI renders the run as that orchestration DAG. The Go port invoked the same phase functions directly in-process, so the control plane only ever saw a single review node — the architecture's DAG had collapsed in the port. The orchestrator's phase seams now route through the SDK's Agent.CallLocal (under the registered reasoner names, shared as reasoners.Name* constants with register.go so they cannot drift): each call builds a child execution context and emits running/succeeded/failed workflow events that the control plane mirrors into the executions table — one DAG node per phase, parented under review, same graph shape as Python. Behavior is otherwise unchanged: a routed phase runs the same reasoners.* function with the same deps via the registered handler; the new afx.ToMap keeps nested values typed so OrderedPatches' insertion-ordered diff_patches survives the round trip byte-for-byte (a naive JSON round trip re-sorts it — caught by the new round-trip tests); events are fire-and-forget, so an unreachable control plane never fails a review; and orch.Deps.Local stays nil in unit tests/stub harnesses, preserving the direct-call seams there.

Plus: Go SDK bumped to v0.0.0-20260714191100-2cc5fe2adcf4, which carries the Windows fix where opencode prompts went over argv and blew cmd.exe's ~8k cap — on Windows that silently produced zero-dimension "Safe to merge" reviews (Agent-Field/agentfield#774 has the full story). Re-bump to a tagged SDK once #774 merges if preferred.

Validation

• Go: go build / go vet / gofmt clean; full go test ./... green, including the new DAG-routing suites (internal/orch/calllocal_test.go, internal/node/calllocal_wiring_test.go, afx.ToMap tests) which pin: every phase seam calls CallLocal under its registered name; the input map binds back into the identical typed input (including deliberate zero values on fields with non-zero bind-side defaults, and diff_patches insertion order); errors propagate unchanged; nil Deps.Local keeps the direct seams.
• Python: full suite 73 passed including the 4 new tests; ruff check clean.

Field data behind the defaults

From the production run that motivated this: reviews of 335–2100-line PRs took 60–70 min end-to-end on kimi-k2.5/deepseek-v4-pro via opencode; the 300s cap killed 100% of attempts; the 120s idle watchdog killed 4 runs 8–19 minutes in; two concurrent same-repo reviews raced the shared workspace until isolated manually.

🤖 Generated with Claude Code