Preserve work and native identity when recovering a writer

VERSION

@@ -1 +1 @@
-0.1.10
+0.1.11

agent-ops/factory-agent-ops/SKILL.md

@@ -3,8 +3,8 @@ name: factory-agent-ops
 description: Act as a project's lead for ideas, research, accepted tasks or an approved backlog; coordinate native workers, independent review and authorized delivery.
 license: MIT
 metadata:
-  version: "0.1.10"
-  updated: "2026-10-10"
+  version: "0.1.11"
+  updated: "2026-10-11"
 ---
 
 # Factory Agent Ops

agent-ops/factory-agent-ops/references/t3.md

@@ -1,6 +1,6 @@
 # Operating through T3 Code
 
-Revision: 0.1.10 · Updated: 2026-10-10
+Revision: 0.1.11 · Updated: 2026-10-11
 
 Use the tools actually exposed by the installed T3/provider versions. This guide
 was written for **0.0.46-nightly.20261009.2861** (V2), with upstream source checked
@@ -87,6 +87,45 @@ has no retry key. It cannot broaden the caller's runtime or interaction mode.
 Do not widen permissions merely to expose a tool: use the established native route
 or resolve the missing setup. After a lost launch response, inspect threads first.
 
+When a running writer discovers upstream or instruction drift, stop before writes.
+Reconcile terminal runs, background work and pending requests. Preserve the original
+tracked, staged, unstaged, untracked and ignored task evidence, including file
+bytes, modes and index; retain the original checkout and recovery material.
+Obtain or confirm and retain the accepted reconciliation and target base within
+existing authority before integration; drift does not authorize new scope.
+
+For existing-worktree recovery, select an existing clean target checkout through
+a supported native UI/operator route, guarded by the expected current worktree
+binding. The pinned [Nightly 2873 UI branch selector](https://github.com/pingdotgg/t3code/blob/ec80933ac8cd02fec5c97b342462ccc9567cdb1e/apps/web/src/components/BranchToolbarBranchSelector.tsx#L433)
+can select an existing worktree. The observed assisted recovery used the supported
+client RPC [`thread.metadata.update`](https://github.com/pingdotgg/t3code/blob/ec80933ac8cd02fec5c97b342462ccc9567cdb1e/packages/contracts/src/orchestrationV2.ts#L2739)
+with `expectedWorktreePath`; this was an operator-assisted client operation, not
+an exposed MCP operation. Exposed [`t3_worktree_handoff`](https://github.com/pingdotgg/t3code/blob/ec80933ac8cd02fec5c97b342462ccc9567cdb1e/apps/server/src/mcp/WorktreeMcpService.ts#L145)
+rejects an already attached worktree and cannot move a thread between existing
+worktrees. `t3_thread_launch` binds a new ordinary top-level writer; it does not
+recover the same thread.
+
+Make the first resumed turn read-only: reread the actual native binding, cwd,
+Git root, branch and HEAD against the accepted target, then read its new canonical
+instructions and needed skills before any integration. Compare the actual strong
+provider-native thread identity and provider record/session before and after the
+move. The same T3 conversation ID alone is insufficient: provider resume can
+[fall back to a fresh context](https://github.com/pingdotgg/t3code/blob/ec80933ac8cd02fec5c97b342462ccc9567cdb1e/apps/server/src/orchestration-v2/ProviderTurnStartService.ts#L672).
+If native identity changes or cannot be established, report a fresh/handoff
+context rather than same-worker continuity. If the accepted task requires
+same-worker continuity, stop integration and return the explicit handoff/replacement
+decision; labeling a context fresh does not authorize a replacement. Honor existing
+scoped owner authorization for handoffs or replacements where it applies.
+
+After reconciliation and readback, integrate only the accepted task intent,
+keeping current upstream-owned fields, instructions and unrelated files intact.
+Verify that the original files, modes and index still match the retained evidence;
+never silently replay a stale patch or discard evidence. If the supported route
+or required evidence is unavailable, leave recovery pending with the concrete
+operator gap. Do not add a bridge, runtime, self-approval or duplicate writer.
+The 2026-10-11 observation demonstrated assisted same-worker recovery in one local
+synthetic fixture; it does not qualify universal autonomous recovery or delivery.
+
 Provider handoff carries bounded history and omits native tool state and
 attachments. Give the receiving agent explicit task/candidate/evidence pointers;
 do not promise transparent shared memory or cross-host execution.

docs/qualification.md

@@ -1,6 +1,6 @@
 # Qualification
 
-Revision: 0.1.10 · Updated: 2026-10-10
+Revision: 0.1.11 · Updated: 2026-10-11
 
 This record distinguishes source review, disposable exercises and observed native
 operation. A package release does not qualify another host, every future update
@@ -13,6 +13,7 @@ remain with the installation; public issues track the remaining acceptance work.
 | Persistent choices (0.1.10 candidate) | 2026-10-10: a fresh native Astra xhigh context answered four textual cases against `7f846946`: hypothetical settings stayed unauthorized; external read access retained scope and removal; provider-wide controls did not become project isolation; uncertain application, upgrade drift and expired exceptions required reconciliation | Method rehearsal, not live grant/revocation or a reliability measurement. Independent review of the combined source/presentation is tracked in the delivery PR |
 | Engineering Foundation (0.1.9) | 2026-10-10: [PR #24](https://github.com/arcitai/factory/pull/24) and release passed checks and independent review. The selected native scopes matched all 48 staged files; AgentOps explicitly reread the five changed Foundation files. AIOS' own AgentOps assessed its repository against the adopted method and actual build/review/pilot evidence | Explicit source loading is distinct from automatic instruction discovery. The optional three-hour CI profile has not been deployed or observed as a schedule; it enables no schedule itself |
 | Writer workspace selection (Nightly 2873) | 2026-10-10: native worktree-bound launch started a Factory writer at the expected revision and workspace. An AIOS child created through ordinary delegation remained on main with no worktree; it was stopped before edits, its stale command approval declined, and a separate native-bound writer was verified before implementation | Assisted recovery exposed ambiguous launch guidance, now clarified. A prompt is not a native binding; this does not prove automated recovery for every failed launch or OS isolation between roles |
+| Existing-worktree recovery (0.1.11 candidate) | 2026-10-11 (Europe/Copenhagen), T3 2873, Codex 0.162.0/Astra xhigh: [AIOS’s bounded replay](https://github.com/onlinesourdough/AIOS-plugin/issues/1#issuecomment-6102939579) passed independent review and was accepted. Strong provider-native identity persisted across five runs; accepted intent integrated with upstream content preserved. Conflict, provenance, authority and failed-verifier stops were verified | Operator-assisted rebinding on fixed-revision branches, not detached HEAD. File bytes/modes restored and index preserved; administrative Git-index restore untested. Deliberate synthetic verifier failure, not a real outage. No autonomous MCP, all-harness, automatic-loading or future-reliability guarantee. Factory candidate review remains pending; [Factory #3](https://github.com/arcitai/factory/issues/3) decision/uncertain-launch proof stays separate |
 | Model profile, scope and skill improvement (0.1.6) | 2026-10-09: two fresh Astra High contexts each answered four textual cases against baseline and candidate; both preserved scope, useful knowledge placement, reviewed skill adoption and visible quota limits. Candidate decisions made worker-option readback more explicit | No measured reliability or cost improvement, application delivery or installed-discovery claim. Concrete role presets remain proposals; see the delivery PR for independent source review |
 | Checker in Claude's native sandbox (0.1.6) | An initial metadata check failed on a masked `.claude` path. The fix prunes private harness directories before traversal; the direct check then passed for 8 skills, with 11 tests passing. Independent review reproduced the regression against both earlier variants and checked that maintained-source errors still propagate | This validates the package checker, not additional agent permissions or isolation |
 | Revision/access guidance (0.1.4 candidate) | Four fresh-context Codex textual cases kept least privilege, edit dates versus restore proof, genuine attribution and bounded native maintenance | Text-only decisions; not an application delivery or live deployment |