refactor(workflows): compaction-resilient recovery and risk-proportional validation (#4560) [DRAFT] - #4562
refactor(workflows): compaction-resilient recovery and risk-proportional validation (#4560) [DRAFT]#4562Yeachan-Heo wants to merge 6 commits into
Conversation
d85f2b5 to
5ebd709
Compare
|
Exact-head CI triage (fix-forward, signed):
— |
|
Terminal exact-head evidence for this Draft (signed): Head
The earlier event-head failures ( This Draft remains owner-controlled: not ready-for-review, not merged, no release/tag/publish. Next step is independent exact-head review and an owner readiness decision. — |
|
Draft hold maintained — owner-controlled reconcile receipt (signed): Submitted state (recorded before any action, unchanged): head Owner-readiness check (pre-mutation): no owner-ready evidence exists. Latest signed evidence on this PR (2026-08-14T17:26:46Z) states the Draft "remains owner-controlled: not ready-for-review, not merged" with next step "an owner readiness decision"; the Delta reconciliation against current dev
Bounded validation on the merged tree: 19 pass (3 new PR suites: workflow-recovery-projection, ultragoal-validation-lanes, agent-session-workflow-recovery-continuation), 258 pass/7 skip (ultragoal-runtime + compaction suites + sdk-kind-aware-reconciliation + notifications-inbound-acceptance), 55 pass (dev-side admission suites: contended-terminal-capture, midrun-maintenance, pre-admission-artifact-spill, sdk-steer-reconciliation, notifications-turn-ordering) — 0 fail; coding-agent typecheck clean ( Hold decision: DRAFT HOLD continues. This PR stays draft and owner-controlled. A rebase onto current dev is validated as clean but intentionally not pushed — exact-head discipline means a push would stale all existing CI/verdict evidence at — |
|
Stale-evidence notice + recomputed draft hold (signed): Base movement: current #4540 overlap inspection: the Recomputed onto exact Bounded validation on the recomputed tree (all fresh): 19 pass (3 new PR suites: workflow-recovery-projection, ultragoal-validation-lanes, agent-session-workflow-recovery-continuation), 258 pass/7 skip (ultragoal-runtime + compaction + sdk-kind-aware-reconciliation + notifications-inbound-acceptance), 57 pass/1 skip (#4540-side: agent-session-auto-compaction-continue, before-agent-start-attribution, manual-retry, sdk/host/session-runtime), 55 pass (admission/reconciliation suites: contended-terminal-capture, midrun-maintenance, pre-admission-artifact-spill, sdk-steer-reconciliation, notifications-turn-ordering) — 0 fail; coding-agent typecheck clean ( Hold decision: DRAFT HOLD continues at unchanged submitted head. No push, no ready-mark, no merge, no release mutation. Blocker remains the owner readiness decision; per exact-head discipline, any future rebase push would stale CI/verdict evidence at — |
|
Owner census — exact live state (2026-08-15):
Disposition in progress: reconstruct the intended change onto current — |
…validation (#4560) Long ralplan -> ultragoal runs compacted mid-flight with only a thin state projection (goal objective/status, phase, todos) plus a generic continuation prompt, losing the precise accepted scope/progress/evidence contract and inviting drift, duplicate review generations, and zero-progress continuation loops. Boundary validation also applied the full review cohort unconditionally, inflating token cost and failure surface on low-risk single-goal work. Add a structured workflow recovery projection derived from canonical durable state (Ralplan final/index.jsonl and Ultragoal goals.json/ledger.jsonl): bounded objective, accepted scope, non-goals, acceptance criteria, unresolved decisions, current goal, measurable progress, exact next action class, and digest. Compaction renders it into the state-aware context and the post-compaction auto-continue for active recognized workflows consumes it with scope-reload, user-intent-supremacy, no-silent-scope-expansion, unchanged-basis rerun-avoidance, and bounded zero-progress escalation rules. Malformed, stale, or tampered state degrades safely to the previous behavior, and paused/terminal/unknown workflows stay inert. Add a deterministic Ultragoal validation-applicability policy computed from durable facts (trusted change set, plan shape, open review blockers, joined-cohort source hash). Low-risk single-goal boundaries may omit redundant cleaner/architect ceremony and the duplicate terminal-critic read only through a validationLaneSelection proof that must exactly mirror the runtime-computed selection; QA, sourceHash binding, receipts, provenance, and join-before-repair stay mandatory. High-risk, multi-goal, computer/shared-registry, migration, and public-contract paths keep the full heavyweight cohort, and an unchanged immutable source/evidence basis permits reusing verified boundary evidence instead of forcing a full rerun. Co-authored-by: DoYunHa <102889891+HaD0Yun@users.noreply.github.com> Lore-id: 4a5f19c2 Constraint: preserve executor and cleaner||architect||qa cohort parallelism (#3473/#3474) Constraint: runtime-authoritative lane selection, never free-form model self-exemption Constraint: compaction reloads the durable contract; scope expansion must be classified, never silently accepted Rejected: model-declared lane skipping | prose cannot be validated fail-closed Rejected: second durable workflow-state store | projection is read-only over existing canonical state Confidence: high Scope-risk: moderate Reversibility: trivial Tested: 19 focused tests across projection, policy, gate selection, and compaction continuation Tested: regression suites for compaction, ultragoal runtime, review, critic gate, batch release (327 pass) Not-tested: live multi-run dogfood latency deltas (documented as follow-up evidence)
… recency (#4560) Adversarial exact-head self-review findings: priorVerifiedGeneration was declared on the applicability input but never consumed (dead contract surface), and the ralplan recovery run selection used a lexicographic name sort, which is arbitrary for non-monotonic run ids — recovery must project the run the session actually touched last, so select by newest run-directory mtime. Co-authored-by: DoYunHa <102889891+HaD0Yun@users.noreply.github.com> Lore-id: 77c3e8b1 Constraint: no dead contract surface on the validation policy input Confidence: high Scope-risk: narrow Reversibility: trivial Tested: focused recovery/policy/continuation + state-aware compaction suites (37 pass); coding-agent typecheck + biome clean
The reconstructed workflow refactor still trusted unconstrained plan paths, counted snapshot reads as separate compactions, and allowed self-authored cohort hashes to satisfy unchanged-basis critic reuse. It also left material intent reconciliation until after expensive Ralplan consensus. Confine and digest-check Ralplan artifacts, recover active consensus actions from durable state, bind cohort hashes to the captured source basis, classify workflow enforcement and credential surfaces as high risk, add a pre-consensus intent stage, and cover forced-compaction and blocker re-review paths. Co-authored-by: DoYunHa <102889891+HaD0Yun@users.noreply.github.com> Lore-id: 9e4b6c2a Constraint: QA, sourceHash, receipts, provenance, join-before-repair, recursion caps, and critic ceilings remain mandatory Constraint: workflow enforcement changes classify themselves as high risk Rejected: self-declared unchanged source hashes | cannot prove evidence freshness Rejected: post-consensus-only intent interview | spends review before resolving material scope Confidence: high Scope-risk: wide Reversibility: migration-needed Tested: 366 workflow tests plus 180 compaction tests; coding-agent typecheck; manifest/default/rebrand gates Not-tested: live multi-model latency distribution
Generation-two review found that the authoritative cohort digest was required but unavailable through a supported command, making honest quality-gate construction impossible. Recovery also still accepted Ralplan rows that omitted their recorded digest. Expose a read-only quality-gate source-hash command, require digest-bearing confined Ralplan rows, reject tampered mode/index state, hash untracked symlinks by link identity, preserve the legacy planner-to-architect edge, and make planning-stuck recovery terminal. Co-authored-by: DoYunHa <102889891+HaD0Yun@users.noreply.github.com> Lore-id: 3d8f7a11 Constraint: the leader must obtain sourceHash from the runtime on the frozen snapshot Constraint: current Ralplan writer receipts require matching SHA-256 provenance Rejected: diagnostic-only hash discovery | forces an edit/retry loop at the terminal gate Confidence: high Scope-risk: moderate Reversibility: trivial Tested: 147 focused workflow tests; coding-agent typecheck; live source-hash CLI invocation
6727450 to
59b3cd6
Compare
|
Owner-state update:
— |
Affected-task CI exports repository-wide CI_DEV_CHANGED_PATHS into every test process. Standalone temporary git repositories inherited those unrelated unknown-status paths, so the authoritative source-hash command correctly failed closed even though their own change sets were complete. Bind CI changed-path evidence only when the inspected repository is inside GITHUB_WORKSPACE, preserve known Git status over duplicate CI pathname-only rows, and cover both independent-repository isolation and canonical-workspace fail-closed participation. Co-authored-by: DoYunHa <102889891+HaD0Yun@users.noreply.github.com> Lore-id: 61af32d9 Constraint: unknown-status paths remain fail-closed in the authoritative workspace Rejected: deleting CI_DEV_CHANGED_PATHS only in the test | leaves production nested-repository hashing environment-dependent Confidence: high Scope-risk: narrow Reversibility: trivial Tested: validation-lanes under representative CI_DEV_CHANGED_PATHS/GITHUB_WORKSPACE; change-set tests; ultragoal runtime/review; coding-agent typecheck
The production workspace binding correctly ignored outer CI_DEV_CHANGED_PATHS for independent repositories, but several Ultragoal suites intentionally use that variable as synthetic change-set input for temporary repositories. GitHub's outer GITHUB_WORKSPACE made those fixtures indistinguishable from accidental environment leakage and caused the authoritative runtime shard to fail. Clear and restore GITHUB_WORKSPACE only around the suites that explicitly simulate CI_DEV_CHANGED_PATHS fallback, leaving production unknown-status and canonical-workspace behavior unchanged. Co-authored-by: DoYunHa <102889891+HaD0Yun@users.noreply.github.com> Lore-id: 7b149ac0 Constraint: test isolation must not alter production fail-closed hashing Rejected: weakening workspace equality in production | reintroduces the original nested-repository leak Confidence: high Scope-risk: narrow Reversibility: trivial Tested: ultragoal-runtime under representative GitHub CI env 181 pass; related synthetic CI suites 35 pass; scope suites 20 pass; coding-agent typecheck
|
@HaD0Yun exact-head review is now the only merge gate. Authoritative head/base: Please submit an — |
|
Exact-head disposition — owner-controlled hold with third-party review gate (signed): Exact live state (recomputed 2026-08-17):
Base movement & fresh trial merge (owner verification, this lane):
Blocker (owner-only, exact): Why no fix-forward push: the exact head is green and merge-clean against live dev; any new push would invalidate the verified exact-head CI/digest/evidence chain without fixing anything. Rebase would be pure churn. Terminal disposition: hold as owner-controlled DRAFT pending the exact-head — |
1 participant
Summary
Closes #4560 with the complete workflow-efficiency contract reconstructed onto current
dev:intentstage resolves material objective/scope/non-goal/acceptance/verification questions before Architect/Critic consensus. Post-consensus intent verification is delta-only, and the legacyplanner → architectedge remains for in-flight pre-upgrade runs.planning_stuckrecovery. Ultragoal restores goal progress, blockers, joined cohort generation/hash, and exact next actions. Zero-progress escalation increments once per compaction attempt, not per snapshot read.gjc ultragoal quality-gate source-hash --jsonexposes the same authoritative integration-base/merge-base/path/diff/untracked-content digest the checkpoint validator enforces. Untracked symlinks are hashed by link identity without following external targets.Design direction credit: @HaD0Yun.
Safety invariants preserved
sourceHashbinding; model-authored equal strings cannot prove unchanged evidence.Verification
Frozen reconstruction:
d332b7890ed95ff71d1a80e00bd4d31809558e69b488e239bb7b23f66d6e8e2d183e80fd8aebad95f6e8da7a60c4dc5e85b45c6f490cef1056e6ad8ae2e675404082e11ae46ea6aasha256:21ce0fde67443802b30e2ab17c6e2daf4f589a6d39932b1c9b5a5c5a33f842d4Executed evidence:
artifacts/pr4562-final-tests.xml).CI_DEV_CHANGED_PATHS+GITHUB_WORKSPACE: 9 pass, 0 fail; outer-workspace paths are ignored for an independent nested Git root while canonical workspace unknown-status evidence remains fail-closed.bun --cwd=packages/coding-agent run check:types— passed.bun scripts/check-visible-definitions.ts— passed.bun scripts/rebrand-inventory.ts --strict— passed.bun test packages/coding-agent/test/default-gjc-definitions.test.ts— 29 pass, 0 fail.Known repository-wide external defect:
bun run check:tsreaches the pre-existingscripts/telegram-daemon-generation-guard.test.tsfixture lookup failure forpackages/coding-agent/test/notifications-topic-registry.test.ts; the standalone guard passes from repository root. This PR does not suppress or work around it.Comparative / forced-compaction evidence
Deterministic regression fixtures cover low-risk lane reduction versus unchanged full-cohort high-risk paths, forced compaction during Ralplan review, Ultragoal execution, parallel review/executor work, and blocker-fix re-review. They assert durable contract/action recovery and fail-closed source/risk selection; they do not claim identical model outputs or measured live-provider latency.
Review state
The implementation cohort is clean at the exact local head. The PR remains Draft until a non-author repository reviewer approves this exact pushed head; the verdict line will be switched to
merge-approvedonly after that GitHub review exists.gajae.pr-review-verdict.v1 needs-human sha256:f6e8da7a60c4dc5e85b45c6f490cef1056e6ad8ae2e675404082e11ae46ea6aa reviewer:human reviewer-id:HaD0Yun evidence:Independent local cohort CLEAR/PASSED; exact-head GitHub approval requested before owner readiness and merge