From dddbbb56d635d41b312a0f8b754301dc68d341b0 Mon Sep 17 00:00:00 2001 From: Dotta Date: Mon, 26 Oct 2026 01:55:16 -0500 Subject: [PATCH] docs: audit native status reassessment recovery ownership Co-Authored-By: Paperclip --- ...2026-10-24-recurring-server-sleep-stack.md | 18 ++++ ...-native-status-reassessment-sleep-audit.md | 98 +++++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 doc/plans/2026-10-26-native-status-reassessment-sleep-audit.md diff --git a/doc/plans/2026-10-24-recurring-server-sleep-stack.md b/doc/plans/2026-10-24-recurring-server-sleep-stack.md index 57c854ee05a..634511fdeb5 100644 --- a/doc/plans/2026-10-24-recurring-server-sleep-stack.md +++ b/doc/plans/2026-10-24-recurring-server-sleep-stack.md @@ -2425,3 +2425,21 @@ between pages on drain. Fresh migration and interrupted/concurrent replay pass. The audit preserves the initial query, migration and test-clock failures. Full local tests are running; remote acceptance, older stack findings, master reconciliation and every remaining original duty are still open. Nothing merged. + + +## Slice 49 publication; slice 50 owner audit + +Draft #17702 at `be6ca6151b` is open on #17696. Greptile reviewed that head +at 5/5 with zero unresolved threads. CI remains in progress. The full local +suite was stopped after repeated embedded PostgreSQL bootstrap failures and +many skipped DB suites. One isolated native-session-executor failure reproduces +in startEmbeddedPostgresTestDatabase before recovery behavior runs; logs are +/tmp/sleep49-full-tests.log and /tmp/sleep49-full-failure-isolated.log. The +255-case real-PostgreSQL owner/startup selection, workspace types/build and +migration replay remain passing. This does not make full local acceptance green. + +Slice 50 audits native status reassessment: changed evidence, authoritative task +state and retired automatic reviews all feed the existing append-only assessment +and decision owner. Its producer/guard inventory is in the dated reassessment +audit. No implementation or periodic removal is claimed for slice 50 yet. Earlier +stack gates, master reconciliation and the full remaining scope remain open. diff --git a/doc/plans/2026-10-26-native-status-reassessment-sleep-audit.md b/doc/plans/2026-10-26-native-status-reassessment-sleep-audit.md new file mode 100644 index 00000000000..5bec68fc4cb --- /dev/null +++ b/doc/plans/2026-10-26-native-status-reassessment-sleep-audit.md @@ -0,0 +1,98 @@ +# Native status reassessment sleep audit + +Parent: governed-review response recovery, draft #17702 at `be6ca6151b`. +This audit starts the next reason in the recurring-server migration stack. +Parent CI remains in progress; Greptile is 5/5 with no unresolved threads. + +## Obligation and ownership + +After a native result is assessed, changed durable facts can require a new status +assessment and decision. The current native-finalization reconciler discovers +that change by revisiting committed runs, including its rotating settled-history +page. Response publication and pending-effect delivery have separate owners in +the preceding slices. Workspace/result settlement and retained session cleanup +remain separate duties and must not disappear with this migration. + +The existing reassessment block has three activation conditions: + +- A work product was created or updated after the selected assessment. The + classifier must actually establish newly satisfied criteria and verification + before this condition changes task disposition. +- The authoritative task status/version differs from the previous assessment, + after accounting for the selected decision's projected version and preserve + semantics. A superseding decision can make the old run ineligible. +- The selected automatic review has been retired. Reassessment then checks the + latest contract, current task/run, pending child completion, dependencies, + governance and any later workspace-finalization barrier. + +These are triggers for the same append-only status reassessment operation. +Keep classification and status arbitration with native runtime. Keep task locks, +version comparison, current authority and effect creation in the status-decision +committer. Do not put evidence parsing or policy branches in startup or the shared +scheduler. Do not use the combined reconciler as a worker callback: that would +also run unrelated response, workspace and retention work. + +## Existing facts and guards + +The coordinator binds run, task, selected result, assessment and decision. The +assessment retains prior task status/version/decision and its input digest. The +result and contract are selected by matching company/task/run identities. The +committer appends the new decision and guards concurrent task changes. A +NativeStatusRaceError currently defers to later reconciliation; the new worker +must retain or receive the corresponding wake instead of silently losing it. + +The outer candidate scan respects next_attempt_at and live finalization leases. +The extracted owner must recheck these under its transaction/claim boundary; +a stale scheduler entry cannot bypass a newly acquired lease or delayed retry. +The worker must distinguish dormant changed evidence that is still insufficient +from retryable I/O or contention. Existing durable rows remain truth; no new queue +table is justified by this timer migration. + +## Producer audit to complete + +Work-product writers found in current source: + +- work-products.ts: create, update, primary replacement, batch import and removal. + Current notifications cover pull-request retention/approval work only. +- issues.ts: attachment work-product insertion. +- routes/issues.ts: trusted-source promotion changes an existing product and + inserts its promoted product inside an owned transaction. +- native-runtime/chat-attachment-reuse.ts and native-runner-file-handoff.ts: + direct metadata/title updates on existing products. + +The classifier reads more than work products: case handoffs, accepted/rejected +control-plane run events, linked approvals, resolved interactions and attachments. +Determine which mutations activate existing reassessment behavior and preserve +that contract. Do not assume that work-product notifications cover all evidence +or introduce inferred completion merely because a source row changed. + +Also audit task status/version producers; decision/effect settlement; automatic +review retirement; latest-contract changes; workspace barrier settlement; child +completion; dependency/blocker changes; agent/task authority and process claims. +Use the existing mutation/transaction owners. Reuse task/run-scoped notification +boundaries where their semantics match. Broad configuration changes may justify +broader scopes; ordinary writes must not reload every company run. + +## Acceptance before periodic removal + +- Extract and exercise the actual reassessment owner without invoking other + native recovery duties. Preserve fresh finalization and explicit recovery. +- Reproduce each missing producer wake before wiring it. Cover alternate writers, + nested outer commit/rollback and relevant uncertainty settlement. +- Verify superseding decisions, changed versions, current contract, ownership, + governance, pending children and workspace barriers with real DB state. +- Prove no duplicate decisions/effects under competing recovery and producer + changes during a sweep. A rejected or no-longer-current assessment cannot + authorize completion. +- Prove no recurring SQL for configured-idle and retained settled history, + including changed but insufficient evidence. Verify genuine deadlines, + failures, startup/resume, drain and shutdown. +- Measure selected-history and outstanding-backlog discovery before wiring it. + Bound individual queries and support interruption; disclose total reconstruction + cost and retain exact scope on ordinary changes. +- Register through existing maintenance lifecycle, disable only this periodic + duty, run relevant consumers and required checks, then obtain latest-head CI + and review acceptance on its own stacked PR. + +This is an audit, not an implemented migration. No polling entrance is removed +by this document. No Cloud alarm coverage or host sleep eligibility changes.