refactor(workflows): make Ralplan and Ultragoal validation compaction-resilient and risk-proportional

[Yeachan-Heo]

Problem

The current ralplan -> ultragoal path can apply multiple overlapping LLM review layers to the same plan or frozen change set. Ultragoal already parallelizes independent executor work and its boundary cohort (cleaner || architect || QA), so reviewer-count reduction does not translate linearly into wall-clock gains; however, excessive review still increases token cost, failure surface, and the probability of compaction during long runs.

When compaction happens during a long planning/execution/review loop, the runtime currently preserves only a thin best-effort state projection (active goal objective/status, workflow phase, and open todos) and then emits a generic continuation prompt. The durable Ralplan/Ultragoal contracts contain more precise scope and evidence than this projection. Reconstructing work from a lossy summary can therefore increase scope drift, duplicate review generations, or produce long zero-progress continuation loops.

Maintainer-defined direction

Implement the smallest coherent improvement that follows the repository's existing direction:

• preserve the recent simplification trajectory: small single-domain/single-PR work should not be forced through Ralplan;
• retain Ultragoal's executor and boundary-cohort parallelism;
• make expensive LLM validation proportional to task/change risk rather than unconditional ceremony;
• avoid duplicate reruns when the reviewed source has not changed;
• preserve deterministic safety mechanisms (sourceHash, receipts, provenance, join, bounded iteration/recursion);
• make compaction/recovery consume a durable, structured workflow scope/progress contract instead of relying only on generated summary prose;
• treat compaction as reloading the current work contract, not reopening product scope;
• bound zero-progress review/continuation cycles without claiming perfect determinism.

Expected implementation areas

Ralplan

• Move material intent/scope reconciliation before expensive consensus where possible.
• Keep Architect/Critic consensus for genuinely ambiguous, cross-domain, cross-cutting, or high-risk plans.
• Produce a durable structured handoff containing objective, accepted scope, non-goals, acceptance criteria, unresolved decisions, and verification obligations for Ultragoal/compaction recovery.

Ultragoal

• Keep independent executor work and cleaner || architect || QA concurrency.
• Introduce explicit, deterministic risk/applicability selection for expensive boundary lanes; do not delegate the decision to free-form model prose.
• Require rerun only when source/evidence-invalidating state changed.
• Make terminal critic proportional to aggregate complexity/risk/evidence uncertainty rather than universally duplicating already-joined proof.
• Persist enough active goal, scope, progress, evidence, and exact-next-action state for compaction recovery.
• Reject or explicitly classify post-compaction scope expansion instead of silently accepting it.
• Bound repeated compaction/review generations that produce no measurable progress.

Evidence standard

This is an improvement claim, not a perfect-equivalence claim. Do not require identical outputs or zero scope drift.

Compare baseline and candidate workflows across small, medium/multi-goal, and high-risk fixtures, with no forced compaction, one forced compaction, and repeated forced compaction. Use multiple runs where model behavior is involved.

A successful candidate should demonstrate:

• ordinary-task success and high-risk defect detection are non-inferior within a predeclared tolerance;
• reduced reviewer invocations, token use, mean/P95 runtime, and zero-progress generations;
• improved correct-goal/next-action resumption after compaction;
• reduced frequency and magnitude of scope drift;
• preserved high-risk QA, real-surface evidence, sourceHash, receipt, provenance, and join guarantees;
• no loss of existing executor/cohort parallelism.

Tests must include forced compaction during Ralplan review, Ultragoal implementation, parallel executor work, parallel boundary cohort review, and blocker-fix/re-review.

Delivery constraint

This is a large workflow/architecture change. Present it as one Draft PR targeting dev; do not mark ready or merge without fresh owner direction.

Credit the originating design direction to @HaD0Yun in the commit trailer and Draft PR description.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Accepted as maintainer-owned architecture work. A dedicated current-dev GJC lane is being opened for one Draft PR; the scope is risk-proportional validation plus durable compaction recovery without removing executor/cohort parallelism.\n\n—\n*[repo owner's gaebal-gajae (clawdbot) 🦞]*

[Yeachan-Heo]

Progress evidence for #4560 (signed):

Draft PR #4562 → #4562 (targets dev, owner-controlled, never marked ready, never merged; design credit to @HaD0Yun).

Delivered on branch refactor/issue-4560-workflow-efficiency (head 6727450718, base 21d0a44209):

1. Compaction-resilient recovery — new read-only workflow-recovery-projection derives a bounded structured contract from canonical durable state (Ralplan final/index.jsonl; Ultragoal goals.json + ledger.jsonl): objective, accepted scope + non-goals, acceptance criteria, unresolved decisions, current goal, measurable progress (incl. latest joined-cohort sourceHash), exact next action class, digest. Compaction renders it into the state-aware context and the post-compaction auto-continue for active recognized workflows consumes it with reload-contract, user-intent supremacy, no-silent-scope-expansion, unchanged-basis rerun-avoidance, and bounded zero-progress escalation rules. Malformed/stale/tampered state and unrecognized/paused/terminal workflows degrade safely to prior behavior.

2. Risk-proportional validation — new deterministic ultragoal-validation-policy selects expensive boundary lanes from durable facts, fail-closed. Low-risk single-goal boundaries may omit redundant cleaner/architect ceremony and the duplicate terminal-critic read only via a validationLaneSelection proof that must exactly mirror the runtime selection; QA/verification, sourceHash, receipts, provenance, join-before-repair stay mandatory. High-risk, multi-goal, computer/shared-registry, migration, security/public-contract paths and incomplete capture keep the full heavyweight cohort. Unchanged immutable source basis reuses verified evidence instead of forcing a full rerun.

Evidence (deterministic proxies; no identical-output/zero-drift claim): 19 focused tests (projection + tamper-degradation + zero-progress bounding; gate selection low/high risk, no-proof, QA-omission, multi-goal; forced-compaction continuation consuming the structured contract vs generic without durable state) plus 328 regression passes (ultragoal runtime/review/critic-gate/batch/state-aware compaction); coding-agent typecheck + biome clean; check-visible-definitions, rebrand-inventory --strict, default-gjc-definitions all pass. Exact-head CI: all implementation checks green at 5ebd709530 (affected-path matrix incl. the three new suites, ts build, native build, evidence producer, virtual integration); the only red check is PR contract bootstrap rejecting the intentionally non-merge-approved needs-human verdict — the merge-blocker gate working as designed for a Draft that must not merge. CI is re-running on 6727450718 after two adversarial self-review fixes (dead policy input removed; ralplan run selection now by recency, not name sort).

Adversarial exact-head assessment and bounded follow-ups (Ralplan pre-consensus intent lane, restart-persistent zero-progress memory, dogfood latency harness) are recorded on the PR. Remaining work is independent review + owner readiness decision.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Disposition recovery for #4560 — implementation ownership remains exclusively with Draft PR #4562 and its recovered worktree /home/bellman/Workspace/gajae-code-issue-4560-workflow-efficiency on refactor/issue-4560-workflow-efficiency.

Current PR evidence:

• OPEN Draft, base dev at 21d0a44209, head 6727450718 (672745071871b3ea1a82ba7a06dd59fba67cc44c); no reviews and no review decision; GitHub reports MERGEABLE but UNSTABLE.
• The head is exact to the recovered lane, but it is 2 commits ahead and 5 commits behind current origin/dev 9d2a2d2f2d8f074333bba92fe1fc4d6902f5b2df. Rebase/integration and a fresh exact-head CI run are therefore terminal prerequisites.
• The latest implementation-path checks are green, including the three refactor(workflows): make Ralplan and Ultragoal validation compaction-resilient and risk-proportional #4560 suites, coding-agent typecheck, native build, CLI smoke, affected-path evidence/aggregate, and virtual integration. PR contract bootstrap remains red because the Draft deliberately carries the required needs-human verdict; that is a merge-blocking disposition gate, not implementation-pass evidence.

Acceptance reconciliation: the PR covers read-only canonical durable recovery projection, compaction continuation, fail-closed risk-proportional lane selection, QA-mandatory/high-risk full-cohort preservation, and focused tests. It does not complete the issue's required Ralplan pre-consensus material-intent reconciliation, nor the requested comparative multi-run/forced-compaction evidence across Ralplan review, Ultragoal implementation, executor parallelism, cohort review, and blocker re-review. The PR itself records these as bounded follow-ups; they are remaining contract gaps, not silently accepted scope reductions.

Exact blocker and terminal dependency: #4560 must remain open. The existing recovered PR lane must first reconcile those contract gaps, rebase onto current dev, obtain independent review and owner readiness, then merge. Only after merged-dev product and CI evidence identifies the merge commit may this issue be closed. No duplicate implementation lane has been created.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Successor/blocker status — 2026-08-15 (exact head):

• Successor Draft PR refactor(workflows): compaction-resilient recovery and risk-proportional validation (#4560) [DRAFT] #4562 remains OPEN / DRAFT, targets dev, and is still at 672745071871b3ea1a82ba7a06dd59fba67cc44c.
• GitHub currently reports CONFLICTING / DIRTY; review decision is unset and the PR is not merge-ready.
• Current failing checks are PR contract bootstrap, gjc-state-gates, Affected path validation / evidence producer, and Affected path validation; no checks are currently pending.
• The remaining issue-contract gaps recorded by the owner are Ralplan pre-consensus material-intent reconciliation plus comparative multi-run/forced-compaction evidence across planning, Ultragoal execution, executor parallelism, cohort review, and blocker re-review.

Ownership/coordination boundary: the dedicated #4562 PR owner lane is the sole code/fix-forward lane. This #4560 terminal-owner lane will not implement, rebase, push, or otherwise duplicate that code. It owns only exact status, blocker visibility, merge-on-dev verification, and immediate issue closure.

Disposition: active successor coordination; no terminal hold is declared. #4560 remains open while #4562 is repaired against current dev, the recorded contract gaps are reconciled, review/CI are clean, and the owner marks it ready. Closure trigger is #4562 merge followed by evidence that the merge commit is present on dev; I will close #4560 immediately on that evidence. If #4562 is superseded or deferred, this issue will receive an owner-authorized bounded disposition and explicit resume condition rather than being left silently open.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Current linkage + readiness disposition — fresh full-census reconciliation (signed, 2026-08-18):

Linkage (sole fix lane, unchanged): Draft PR #4562 → #4562 (refactor/issue-4560-workflow-efficiency → dev). No other open PR owns this fix; no duplicate implementation lane exists. This issue lane remains evidence/closure owner only.

Exact live PR facts (recomputed this run, superseding all stale receipts):

• State: OPEN / DRAFT. Head b488e239bb7b23f66d6e8e2d183e80fd8aebad95 (remote branch ref matches exactly); recorded base dev @ d332b7890ed95ff71d1a80e00bd4d31809558e69; 6 commits, 24 files, +2522/−119; declared verdict digest sha256:f6e8da7a60c4dc5e85b45c6f490cef1056e6ad8ae2e675404082e11ae46ea6aa (unchanged).
• Base drift: live dev is now 2bd7b4a48cd4eb196388744bf0f17f466bd4afa5 — 133 commits past the recorded base. GitHub reports mergeable:false / dirty.
• Conflict is real, not procedural: a fresh trial merge of the exact head into live dev on a throwaway local branch (aborted, never pushed) produces content conflicts in packages/coding-agent/src/session/agent-session.ts and packages/coding-agent/test/gjc-runtime/workflow-manifest-phase-sets.test.ts. This supersedes the 2026-08-17 owner receipt claiming a clean ort merge at then-dev 8711c555da — that receipt is stale for terminal merge.
• Exact-head CI (Dev CI run 31895238136, head b488e239bb): product-green — native-build, package check, ts-build, cli-smoke, evidence producer + aggregate, gjc-state-gates (static/runtime/integrity/read), virtual integration, and all affected workflow suites including workflow-recovery-projection, ultragoal-validation-lanes, agent-session-workflow-recovery-continuation. Sole red check: PR contract bootstrap, failing on the honest needs-human verdict line — the merge-blocker gate working as designed for a Draft that must not merge.
• Reviews: none (0). Review decision unset. Requested reviewers: HaD0Yun (since 2026-08-15T16:20:27Z) and snowykr (alternate). No merge-approved verdict, no ready transition, no merge.
• Merge evidence: the PR head exists only on origin/refactor/issue-4560-workflow-efficiency and pull/4562/head; it is not on dev (branch containment and dev log search both negative). No resolving merge exists, so refactor(workflows): make Ralplan and Ultragoal validation compaction-resilient and risk-proportional #4560 cannot be closed on merged evidence.

Owner-controlled readiness disposition — explicit DRAFT HOLD:

1. Owner-only blocker (unchanged, now 3+ days): a non-author APPROVED GitHub review at the exact head from HaD0Yun or snowykr; the author cannot self-approve (contract rejects it).
2. New prerequisite created by base drift: the refactor(workflows): compaction-resilient recovery and risk-proportional validation (#4560) [DRAFT] #4562 lane must reconcile the two real conflicts against current dev (2bd7b4a48c) and re-earn exact-head CI before any review/verdict/merge step; per exact-head discipline that push also stales the current CI/digest chain.
3. Contract gaps still open on the issue acceptance list: Ralplan pre-consensus material-intent reconciliation, and comparative multi-run/forced-compaction evidence across Ralplan review, Ultragoal implementation, executor parallelism, cohort review, and blocker re-review.

Hold semantics: #4562 stays Draft and owner-controlled; this lane performs no push, rebase, ready-mark, verdict change, or merge, and creates no duplicate implementation. #4560 stays open as the closure owner and closes only on verified evidence that the covering PR is merged into dev (exact merge commit posted here); if the PR is superseded or deferred instead, this issue gets an owner-authorized bounded disposition with an explicit resume condition rather than a silent open state. No release/tag/publish in any path.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]