feat(story,role): add retro ceremony -- closes the self-improvement loop (Phase 8)

The final mechanism the versioned role-config model (Phase 5) was built for:
when a story reaches DONE, StoryOrchestrator spawns a retro-role task that
reflects on the story's full history and proposes draft role_configs
versions for a human to review and activate via the existing (unchanged)
POST /api/roles/{role}/activate.

- AgentChannel gains a 6th method, ProposeRoleConfig(ctx, role.RoleConfig)
  (version, err), following ProposeEpic's precedent (Phase 7c): a structured
  tool call, not summary-parsing. storeChannel.ProposeRoleConfig calls the
  same Store.CreateRoleConfig the human-facing POST /api/roles/{role}/versions
  endpoint already uses (proposed_by: "retro"), landing a new draft row
  without touching whatever's currently active. Wired through both
  transports exactly like ProposeEpic: internal/agentloop/tools.go (native
  loop) and internal/executor/agentmcp.go (MCP).
- StoryOrchestrator.Tick now routes a story at status DONE to a new
  processRetro stage instead of processStory -- a sibling stage, not a
  continuation, since the Builder->Evaluators->Arbitration chain is long
  settled by then. processRetro only *reads* that settled pipeline
  (read-only findEvaluators/findArbitration counterparts to
  ensureEvaluators/ensureArbitration -- it never spawns/mutates
  Builder-pipeline tasks) to locate the Arbitration task the retro task
  depends on, then spawns (idempotently -- checks for an existing
  retro-role dependent first) one retro-role task with instructions
  assembled from the story's spec/acceptance-criteria, full task tree, per-
  task cost/escalation history, active role_configs per role encountered,
  and the story's own event stream (evaluator verdicts, arbitration
  decision).
- event.KindRetroCaptured (attached to the story's ID, matching
  KindEvalVerdict/KindArbitrationDecided's convention) fires once the retro
  task completes (auto-accepted like every other pipeline task), aggregating
  every event.KindRoleConfigProposed the retro task recorded (one per
  propose_role_config call) into {task_id, proposals: [{role, version}],
  summary} -- the summary is the "capturing lessons" half of this ceremony,
  the proposals are the versioned-config half.
- Human activation is completely untouched: drafts land through the
  identical CreateRoleConfig/config_json path Phase 5's endpoints already
  handle, confirmed via existing role-endpoint tests passing unmodified.

go build/vet/test -race -count=1 all pass, full suite (20 packages) -- one
run hit a known, pre-existing, intermittent flake under full-suite load
(unrelated to this phase's files) that did not reproduce on two immediate
reruns, both in isolation and full-suite.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1moSNCJRcP6kykA4tyUSs

1 files changed, 53 insertions, 7 deletions

diff --git a/internal/executor/agentmcp_test.go b/internal/executor/agentmcp_test.go
index c73d6db..18299e8 100644
--- a/internal/executor/agentmcp_test.go
+++ b/internal/executor/agentmcp_test.go
@@ -8,17 +8,20 @@ import (
 	"testing"
 
 	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"github.com/thepeterstone/claudomator/internal/role"
 )
 
 // recordingChannel is a fake AgentChannel that records tool invocations.
 type recordingChannel struct {
-	asked         string
-	summary       string
-	spawned       []SubtaskSpec
-	progress      []string
-	spawnID       string
-	proposedEpics []EpicProposal
-	epicID        string
+	asked               string
+	summary             string
+	spawned             []SubtaskSpec
+	progress            []string
+	spawnID             string
+	proposedEpics       []EpicProposal
+	epicID              string
+	proposedRoleConfigs []role.RoleConfig
+	roleConfigVersion   int
 }
 
 func (c *recordingChannel) AskUser(_ context.Context, q string) (string, error) {
@@ -41,6 +44,10 @@ func (c *recordingChannel) ProposeEpic(_ context.Context, spec EpicProposal) (st
 	c.proposedEpics = append(c.proposedEpics, spec)
 	return c.epicID, nil
 }
+func (c *recordingChannel) ProposeRoleConfig(_ context.Context, cfg role.RoleConfig) (int, error) {
+	c.proposedRoleConfigs = append(c.proposedRoleConfigs, cfg)
+	return c.roleConfigVersion, nil
+}
 
 func resultText(t *testing.T, res *mcp.CallToolResult) string {
 	t.Helper()
@@ -209,6 +216,45 @@ func TestAgentServer_ProposeEpic(t *testing.T) {
 	}
 }
 
+// TestAgentServer_ProposeRoleConfig proves the propose_role_config MCP tool
+// reaches AgentChannel.ProposeRoleConfig with the full role.RoleConfig shape
+// decoded correctly, including a nested escalation_ladder tier -- mirroring
+// TestAgentServer_ProposeEpic's coverage above for this phase's new tool.
+func TestAgentServer_ProposeRoleConfig(t *testing.T) {
+	ch := &recordingChannel{roleConfigVersion: 3}
+	cs := connectInMemory(t, newAgentServer(ch))
+	res, err := cs.CallTool(context.Background(), &mcp.CallToolParams{
+		Name: "propose_role_config",
+		Arguments: map[string]any{
+			"role":          "builder",
+			"system_prompt": "Double-check edge cases before finishing.",
+			"escalation_ladder": []map[string]any{
+				{
+					"candidates":  []map[string]any{{"provider": "anthropic", "model": "claude-sonnet-4-6"}},
+					"max_retries": 1,
+				},
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("CallTool: %v", err)
+	}
+	if len(ch.proposedRoleConfigs) != 1 {
+		t.Fatalf("expected 1 proposed role config, got %d", len(ch.proposedRoleConfigs))
+	}
+	cfg := ch.proposedRoleConfigs[0]
+	if cfg.Role != "builder" || cfg.SystemPrompt != "Double-check edge cases before finishing." {
+		t.Errorf("role config not propagated: %+v", cfg)
+	}
+	if len(cfg.EscalationLadder) != 1 || len(cfg.EscalationLadder[0].Candidates) != 1 ||
+		cfg.EscalationLadder[0].Candidates[0].Provider != "anthropic" || cfg.EscalationLadder[0].Candidates[0].Model != "claude-sonnet-4-6" {
+		t.Errorf("escalation_ladder not propagated: %+v", cfg.EscalationLadder)
+	}
+	if txt := resultText(t, res); !strings.Contains(txt, "builder") || !strings.Contains(txt, "3") {
+		t.Errorf("expected role name and version in result, got %q", txt)
+	}
+}
+
 type bearerRT struct {
 	token string
 	base  http.RoundTripper