Repository navigation
Conversation
* feat(orchestrator): add hierarchy generations and durable leases Summary: - Persist scheduler-owned child-edge generations and owner-identified lease records. - Gate parent dispatch on provider evidence and retained checkout resources. - Reconcile restart cleanup and terminal conversation retention through atomic state. Rationale: - Parent scope must be versioned and frozen before integration preparation. - Lease ownership must survive restart and prevent cleanup from deleting evidence. Tests: - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb --test workspace_manager - cargo test-system-duckdb --lib opensymphony_workspace::manager::tests - cargo clippy-system-duckdb - git diff --check * fix(orchestrator): close hierarchy lease review gaps Summary: - Add provider-backed merge evidence and durable dispatch intents. - Fence lease recovery, expiry, cleanup, and hierarchy reconciliation. Rationale: - Prevent parent dispatch from depending on tracker terminal state alone. - Preserve retained child evidence across launch failures and restarts. Tests: - cargo test-system-duckdb hierarchy:: --lib - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb --test workspace_manager - cargo test-system-duckdb manager:: --lib - cargo test-system-duckdb retained_terminal_cleanup_keeps_openhands_conversation_active --lib - cargo clippy-system-duckdb - git diff --check * fix(orchestrator): harden hierarchy recovery boundaries Summary: - Delay parent dispatch intents until admission checks pass. - Restore terminal recovery evidence and generation-fresh leaf leases. - Preserve frozen parent identity and tolerate fresh workspace roots. Rationale: - Prevent transient capacity, persistence, provider, and restart conditions from permanently parking eligible work or allowing unsafe parent integration. Tests: - cargo check-system-duckdb --all-targets - cargo test-system-duckdb hierarchy:: --lib - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb --test workspace_manager - cargo test-system-duckdb manager:: --lib - cargo test-system-duckdb retained_terminal_cleanup_keeps_openhands_conversation_active --lib - cargo clippy-system-duckdb - git diff --check * fix(orchestrator): preserve hierarchy provenance Summary: - Persist run hierarchy generations and refresh stale child leases safely. - Bind merge evidence to canonical repositories with bounded requests. - Retry hierarchy persistence and reconcile hydrated parent edges. Rationale: - Keep late child outcomes fenced to their originating hierarchy generation. - Prevent provider stalls, stale snapshots, and repeated lookups from blocking the scheduler or admitting unrelated merge evidence. Tests: - cargo check-system-duckdb --all-targets - cargo test-system-duckdb hierarchy:: --lib - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb --test workspace_manager - cargo test-system-duckdb manager:: --lib - cargo test-system-duckdb retained_terminal_cleanup_keeps_openhands_conversation_active --lib - cargo clippy-system-duckdb - git diff --check * fix(orchestrator): fence parent launch preparation * fix(orchestrator): close nested hierarchy lease gaps * fix(orchestrator): bind merge evidence to current child run * fix(orchestrator): close nested lease recovery gaps * fix(orchestrator): close lease recovery gaps Summary: - preserve nested lease evidence until a parent launch succeeds - enforce configured review and check policy for merge evidence - retain recovery records and terminal executions across lease write failures Rationale: - prevent repeated terminal reconciliation from resurrecting released leaf leases - keep hierarchy snapshots and provider evidence aligned across restart and launch failure Tests: - cargo check-system-duckdb --all-targets - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb hierarchy:: --lib - cargo test-system-duckdb --test workspace_manager - cargo test-system-duckdb manager:: --lib - cargo test-system-duckdb retained_terminal_cleanup_keeps_openhands_conversation_active --lib - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(lifecycle): close provider and recovery edge cases Summary: - use review-profile credentials and complete paginated check evidence - preserve hierarchy generations and hydrated execution details across refreshes - fail closed on workspace-root drift and restore recovery batches on lookup errors Rationale: - keep parent eligibility tied to the configured provider policy and current durable checkout evidence - prevent restart, generation, and repeated-reconciliation paths from losing retained workspaces Tests: - cargo check-system-duckdb --all-targets - cargo test-system-duckdb hierarchy:: --lib - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb --test workspace_manager - cargo test-system-duckdb manager:: --lib - cargo test-system-duckdb retained_terminal_cleanup_keeps_openhands_conversation_active --lib - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(orchestrator): close hierarchy recovery gaps Fence active parent runs when frozen hierarchy scope changes, reconcile terminal parent snapshots, reset stale dispatch claims after reactivation, and hand off nested ancestor leases during recovery. Paginate GitHub review evidence so provider eligibility remains complete for large pull requests. Tests: cargo check-system-duckdb --all-targets Tests: cargo clippy-system-duckdb Tests: cargo test-system-duckdb hierarchy:: --lib Tests: cargo test-system-duckdb --test scheduler --test hierarchy_selection Tests: cargo test-system-duckdb --test workspace_manager Tests: cargo test-system-duckdb manager:: --lib Tests: cargo test-system-duckdb retained_terminal_cleanup_keeps_openhands_conversation_active --lib Tests: cargo test-system-duckdb github_provider_merge_evidence_ignores_stale_reviews_and_requires_configured_checks --lib Tests: cargo fmt --all -- --check Tests: git diff --check * fix(hierarchy): fence stale parent evidence Restrict dispatch claim resets to active reactivations, reconcile and fence hierarchy changes before worker completions without changing recovery order, preserve repository identities across descendant merge evidence, and model configured canceled children as non-required edges. Tests: cargo check-system-duckdb --all-targets Tests: cargo clippy-system-duckdb Tests: cargo test-system-duckdb hierarchy:: --lib Tests: cargo test-system-duckdb --test scheduler --test hierarchy_selection Tests: cargo test-system-duckdb --test workspace_manager Tests: cargo test-system-duckdb manager:: --lib Tests: cargo test-system-duckdb github_provider_merge_evidence_ignores_stale_reviews_and_requires_configured_checks --lib Tests: cargo test-system-duckdb retained_terminal_cleanup_keeps_openhands_conversation_active --lib Tests: cargo fmt --all -- --check Tests: git diff --check * fix(lifecycle): preserve descendant lease provenance Carry retained in-flight children onto the current hierarchy generation, release nested evidence when an undispatched root finalizes, and reject merge evidence when its configured review provider is not supported by the backend. Add a regression for clearing nested evidence during root finalization. Tests: cargo test-system-duckdb hierarchy:: --lib Tests: cargo test-system-duckdb --test scheduler --test hierarchy_selection Tests: cargo test-system-duckdb --test workspace_manager Tests: cargo test-system-duckdb manager:: --lib Tests: cargo test-system-duckdb github_provider_merge_evidence_ignores_stale_reviews_and_requires_configured_checks --lib Tests: cargo test-system-duckdb retained_terminal_cleanup_keeps_openhands_conversation_active --lib Tests: cargo check-system-duckdb --all-targets Tests: cargo clippy-system-duckdb Tests: cargo fmt --all -- --check Tests: git diff --check * fix(hierarchy): close lease recovery review gaps * fix(eligibility): close provider evidence gaps * fix(orchestrator): close hierarchy review gaps * fix(orchestrator): close nested eligibility review gaps * fix(orchestrator): close final review findings * fix(eligibility): close final provider and lease gaps * fix(hierarchy): close ancestor lease review gaps * fix(hierarchy): close provider and ancestry review gaps Summary: - require every protected check context across Checks and commit statuses - encode protected branch path segments and classify tracker canceled kinds - fence nested descendants and reject unresolved terminal leaf routing Rationale: - parent eligibility must fail closed when provider evidence is incomplete - active ancestor leases must protect every retained descendant generation Tests: - cargo test-system-duckdb --test hierarchy_selection -- --nocapture - cargo test-system-duckdb --test scheduler -- --nocapture - cargo test-system-duckdb --lib hierarchy::tests -- --nocapture - cargo test-system-duckdb --lib opensymphony_cli::orchestrator_run::backends::tests -- --nocapture - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(hierarchy): close replan and check identity gaps Summary: - Scope parent replans to fresh operation keys while allowing retries to reuse a key. - Preserve GitHub required-check app identities and match successful check runs to them. - Add transport, gateway, and provider regressions for both review findings. Rationale: - A permanent parent-only key prevents later hierarchy generations from being replanned after the first accepted request. - Collapsing protected checks to names permits evidence from the wrong GitHub App or from an unbound classic status. Tests: - cargo test-system-duckdb --lib opensymphony_cli::orchestrator_run::backends::tests - npm test - npm run type-check - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(hierarchy): close provider recovery gaps Summary: - Accept GitHub's any-App required-check sentinel while preserving App identity matching. - Scale descendant eligibility deadlines, preserve retryable replans, and retain unschedulable-parent evidence. - Validate GitHub review credentials and add scheduler/config regressions. Rationale: - Prevent provider evidence and action-journal failures from being silently consumed. - Keep retained checkout generations available across delayed parent hydration without crossing the COE-553 handoff boundary. Tests: - cargo test-system-duckdb --all-targets (scope suites green; unrelated supervisor fixture fails to launch fake server locally) - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - npm test -- --runInBand * fix(hierarchy): fence stale generations and provider evidence Preserve the old hierarchy generation until a fenced run is stopped, avoid retaining evidence for terminal undispatched parents, and keep finished children pinned to their dispatched generation. Bound pull-request evidence lookups, reject missing explicit review tokens, and verify recorded merge commits remain reachable from the target branch. Tests: cargo fmt --all; git diff --check; cargo check-system-duckdb --all-targets; cargo clippy-system-duckdb; cargo test-system-duckdb --test scheduler; cargo test-system-duckdb --test hierarchy_selection; focused GitHub evidence regression * fix(hierarchy): fence stale parent and run evidence Summary: - verify the current tracker parent state before suppressing terminal-child cleanup - carry provider evidence timestamps and reject stale evidence from prior child runs - reject unsupported active review providers during central validation Rationale: - terminal parent markers can outlive a parent state transition and otherwise authorize premature cleanup - reactivated children must not inherit an older merged PR on the same branch - unsupported providers must fail during configuration rather than silently block eligibility Tests: - cargo clippy-system-duckdb - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --test hierarchy_selection - cargo test-system-duckdb central_config_rejects_unsupported_active_review_provider - cargo test-system-duckdb current_merge_evidence_rejects_stale_merged_pr_when_replacement_is_newer - cargo fmt --all - git diff --check * fix(config): preserve inactive review profiles Summary: - enforce GitHub provider and environment credentials only for active review/check policies - preserve legacy inactive profiles used by migration and central-memory flows - keep generation coverage for an inactive non-GitHub policy Rationale: - unsupported providers must fail before parent eligibility can silently treat their evidence as unavailable - inactive profiles do not participate in review evidence and must remain backward-compatible Tests: - cargo test-system-duckdb - cargo test-system-duckdb central_config_tracks_scheduler_and_review_policy_generations_separately - cargo test-system-duckdb central_config_rejects_unsupported_active_review_provider - cargo test-system-duckdb central_memory_load_uses_typed_checkout_for_repository_policy - cargo test-system-duckdb apply_and_rollback_restore_legacy_files - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): fence stale provider evidence paths Summary: - validate every active review profile against the supported GitHub provider - bind merge evidence to merge time and newest required commit statuses - reconcile reactivated parents, nested generations, and replacement leaf leases Rationale: - optional review flags do not remove the provider evidence required for parent eligibility - mutable PR metadata and historical status entries must not satisfy a newer child run - reactivated or rebound hierarchy resources must not dispatch from stale snapshots or leases Tests: - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb required_status_context_uses_the_newest_commit_status - cargo test-system-duckdb central_config_tracks_scheduler_and_review_policy_generations_separately - cargo test-system-duckdb central_config_rejects_unsupported_active_review_provider - cargo fmt --all - git diff --check * fix(config): preserve legacy non-GitHub profiles Summary: - limit unsupported review-provider rejection to GitHub-backed merge evidence or explicitly required review/check policies - keep legacy non-GitHub checkout profiles valid when no merge policy is active Rationale: - older migration and memory configurations use a generic git review profile without a provider-backed parent merge policy - GitHub repositories and protected review policies still fail closed for unsupported providers as required by hierarchy eligibility Tests: - cargo test-system-duckdb --lib - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): fence leases across scope replans Summary: - retain live ancestor and subtree leases across tracker-only finalization - validate active project-set merge providers and GitHub credentials - preserve in-flight execution fences and resolve conversation suffix aliases Rationale: - prevent cleanup or redispatch from racing a still-running parent - fail closed before unsupported provider evidence can strand a hierarchy - keep durable hierarchy state aligned with tracker parentage and gateway IDs Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): fence nested provider evidence Summary: - Persist provider evidence boundaries for every descendant leaf. - Reject stale nested merge evidence against each leaf run. - Revalidate provider eligibility before retrying a dispatched parent. Rationale: - A nested descendant can be reactivated after an older merge, so one aggregate timestamp cannot fence every leaf checkout generation. - Parent retries must refresh provider truth after target or review state changes while retaining the existing hierarchy generation and leases. Tests: - cargo check-system-duckdb --all-targets - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): persist recovery run boundaries Summary: - Persist run-start boundaries in run manifests and durable orchestrator state. - Hydrate descendant boundaries before recovery eligibility checks. - Reuse retained parent ancestor leases when retrying a parent dispatch. Rationale: - Provider merge evidence must be fenced after restart by the descendant's latest run boundary, even before an in-memory execution is rehydrated. - Parent retries retain checkout resources under the parent owner after the initial dispatch releases child worker leases, so eligibility must recover those durable resources. Tests: - cargo fmt --all - git diff --check - cargo check-system-duckdb --all-targets - cargo test-system-duckdb --lib hierarchy::tests:: -- --nocapture - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb --lib opensymphony_cli::orchestrator_run::backends::tests::recover_workspaces_ - cargo test-system-duckdb --lib (1269 passed) - cargo clippy-system-duckdb * fix(hierarchy): close recovery and action validation gaps Summary: hydrate recovered parent edges from active and terminal tracker detail; record explicit completion or rejection events for replan no-ops; validate review credential variables against runtime environment usage. Rationale: preserve higher-ancestor lease evidence across terminal recovery, make accepted replans observable when durable hierarchy state rejects them, and fail closed before scrubbed credentials break worker startup. Tests: cargo fmt --all; git diff --check; cargo check-system-duckdb --all-targets; cargo test-system-duckdb --lib; cargo test-system-duckdb --test scheduler --test hierarchy_selection; cargo clippy-system-duckdb. * fix(hierarchy): close replan and projection recovery gaps Summary: - Treat disappeared replan targets as rejected actions and advance recovery. - Release and rebind durable ancestor leases across parent recovery and replans. - Project hierarchy generation and blocked reasons through control-plane output. - Add regression coverage for lease retention, projection, and missing targets. Rationale: - Restart and action processing must not strand cursors or leases when tracker state changes between validation and execution. - Operators need durable hierarchy blockers and generations in the same snapshot used by task-graph and run-detail clients. Tests: - cargo fmt --all -- --check - git diff --check - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler --test hierarchy_selection - cargo test-system-duckdb --test gateway --test action_handler --test task_graph_mutations_routes * fix(hierarchy): close latest lease review gaps Summary: - Keep live parent leases through in-flight fencing and combine retained resources with new leaf leases. - Refresh hierarchy edges before replanning and ignore deleted historical PR evidence. Rationale: - Prevent terminal cleanup or parent eligibility from crossing a running generation fence. - Preserve valid provider evidence when stale historical candidates disappear. Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler - cargo clippy-system-duckdb - cargo fmt --all && git diff --check * fix(hierarchy): fence recovered parent dispatches Restore in-flight fences from durable dispatch intents before terminal reconciliation, keep recovered parent leases until worker stop acknowledgement, and reopen only cleaned dispatched parents. Scale eligibility timeouts for nested traversal rounds and cover the recovery invariants with focused tests. Tests: - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --lib - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): preserve reactivation and running evidence Allow retained intermediate parents to reactivate while a higher ancestor owns their evidence, while keeping root dispatch claims fenced by active leases. Rebind unchanged running children only when an unfrozen hierarchy generation advances so their terminal evidence matches the new scope. Tests: - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --lib - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(leases): reject stale child evidence and protection gaps Require a current hierarchy edge before retaining a terminal child lease, and preserve branch-protection 404s as unresolved evidence instead of treating them as an unprotected branch. Keep historical PR 404 filtering scoped to candidate lookups. Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): scope retained evidence and eligibility diagnostics Summary: - Scope ancestor resources to the current hierarchy subtree and hydrate tracker parents before terminal cleanup. - Release canceled-only holds, propagate non-candidate provider failures, and project transient eligibility blocks through the control-plane snapshot. Rationale: - Prevent removed or inactive child relationships from retaining or satisfying the wrong checkout evidence while preserving restart-safe cleanup. - Keep provider failures fail-closed without hiding actionable diagnostics or turning transient eligibility failures into permanent replans. Tests: - cargo test-system-duckdb --lib (1275 passed) - cargo test-system-duckdb --test scheduler (96 passed) - cargo test-system-duckdb --test hierarchy_selection (2 passed) - cargo test-system-duckdb --test linear_client (41 passed, 1 ignored) - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): prune stale retry evidence Summary: - Reuse only current-subtree ancestor resources when rebuilding direct-child retry evidence. - Prune durable run boundaries and hierarchy-generation hints once no active hierarchy, lease, workspace, or execution retains the issue. Rationale: - Prevent removed children from pairing old checkouts with a replacement child's merge evidence. - Keep restart-safe evidence bounded after terminal cleanup and lease release. Tests: - cargo test-system-duckdb --lib (1276 passed) - cargo test-system-duckdb --test scheduler (96 passed) - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): persist terminal parent outcomes Summary: - Persist successful nested-parent outcomes beyond workspace cleanup and restart recovery. - Scope retained parent resources to the direct child subtree and fence canceled-subtree release until the child is durably terminal. - Add hierarchy regression coverage for sibling resource isolation and terminal-outcome pruning. Rationale: - Higher parents need durable child completion evidence after an intermediate workspace disappears. - A parent must never pair a replacement child with a sibling checkout or release descendant holds while its child worker is still live. Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --lib ancestor_resources_for_child_ignore_sibling_resources - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(leases): close root review and compare error gaps Summary: - Release root-owned review leases during undispatched subtree cleanup. - Propagate GitHub compare endpoint failures instead of hiding them as missing history. Rationale: - A crashed undispatched parent must not orphan review holds that retain child evidence. - Authorization and provider failures must remain visible to eligibility instead of being treated as absent merge evidence. Tests: - cargo test-system-duckdb --lib undispatched_root_release_clears_nested_child_evidence - cargo test-system-duckdb --lib historical_pr_404_filter_does_not_hide_protection_404 - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --lib (1277 passed) - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): close latest parent lease review gaps Summary: - Fence nested parent eligibility before durable intent and lease acquisition. - Release evidence when an off-scope terminal parent is undispatched. - Accept neutral and skipped completed required checks. - Document paginated multi-PR and Enterprise attachment normalization. Rationale: - Active ancestor leases must remain the sole mutation fence without leaving stale nested dispatch intents behind. - Terminal parent confirmation must authorize cleanup of retained subtree evidence even when the parent is outside the configured project scan. - GitHub treats completed neutral and skipped required checks as passing. - Operators need the documented contract to match the normalized Linear data. Tests: - cargo test-system-duckdb --test scheduler (97 passed) - cargo test-system-duckdb --lib (1278 passed) - cargo clippy-system-duckdb - cargo fmt --all - git diff --check * fix(hierarchy): fence recovery and bind replans to generations Summary: - Restore recovered dispatch fences and propagate persisted run start times. - Release removed nested subtree owners and require displayed replan generations. - Update gateway, API client, web, and desktop action contracts. Rationale: - Prevent reconciliation from redispatching an in-flight parent or accepting provider evidence from before the recovered run. - Keep removed descendant evidence cleanup scoped and make stale operator actions fail closed. Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --test hierarchy_selection - cargo test-system-duckdb --test gateway - cargo clippy-system-duckdb - cargo check-system-duckdb --all-targets - cargo fmt --all -- --check - git diff --check - npm run type-check * fix(hierarchy): preserve reparented leases at ingress Summary: - Keep leaf leases reachable from another active hierarchy during subtree release. - Reject replan actions without a numeric hierarchy generation at the gateway. - Add regressions for cross-hierarchy reparenting and malformed replans. Rationale: - Releasing a moved child before global reachability cleanup loses the checkout evidence required by its new parent. - Acknowledging generation-less replans creates accepted events that the orchestrator cannot execute or report. Tests: - cargo test-system-duckdb --lib (1282 passed) - cargo test-system-duckdb --test scheduler (97 passed) - cargo test-system-duckdb --test gateway (77 passed) - cargo clippy-system-duckdb - cargo check-system-duckdb --all-targets - npm run type-check - cargo fmt --all -- --check - git diff --check * fix(hierarchy): preserve moved evidence across replan races Summary: - derive removed-child reachability from the complete tracker snapshot - retain ancestor-integration leases for reparented nested children - journal expected fenced replan failures before advancing the action cursor Rationale: - active-parent reconciliation order must not release evidence before a new parent edge is materialized - a failed operator replan must not abort the scheduler tick loop Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --test gateway - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check - npm run type-check * fix(hierarchy): retain inactive reparent and tie PR evidence Summary: - retain moved leases from tracker parent links outside active states - tie equal-time GitHub evidence by pull-request number - add inactive-parent and deterministic-selection regressions Rationale: - inactive parents are not in candidate or terminal snapshots - unordered attachment lookups need a stable replacement ordering Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --test gateway - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check - npm run type-check * fix(hierarchy): preserve reparented terminal evidence Summary: - defer undispatched-parent descendant release until tracker reachability reconciliation - roll back hierarchy changes when replan persistence fails - add regressions for reparented evidence and failed replan writes Rationale: - terminal cleanup can precede the next tracker parent-edge refresh - failed atomic writes must not advance the in-memory generation Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --test gateway - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check - npm run type-check * fix(hierarchy): recover stale binding and terminal evidence Summary: - Release leases for stale binding generations before replacement cleanup. - Retry terminal outcome receipts after durable persistence failures. - Normalize SSH default ports for GitHub authority matching. Rationale: - Prevent retained old generations from blocking replacement recovery. - Keep in-memory terminal receipts retryable when the first write fails. - Match canonical enterprise SSH and HTTPS authorities. Tests: - cargo test-system-duckdb --lib --quiet - cargo test-system-duckdb --test scheduler --quiet - cargo test-system-duckdb --test gateway --quiet - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check - npm run type-check * fix(scheduler): retain current recovery evidence Preserve reparented child evidence when terminal parent eligibility is evaluated by using the latest complete tracker edge snapshot. Retain recovered run-start issue IDs during the pre-hydration durable-state write so restart evidence is not pruned before recovery hydration. Tests: cargo test-system-duckdb --lib --quiet; cargo test-system-duckdb --test scheduler --quiet; cargo test-system-duckdb --test gateway --quiet; cargo check-system-duckdb --all-targets; cargo clippy-system-duckdb; npm run type-check; cargo fmt --all -- --check; git diff --check * fix(hierarchy): close review rework gaps Thread reachability from the current full tracker snapshot before releasing canceled-subtree evidence, and prune recovered IDs with a durable cleanup write after hydration. Keep generic legacy Git providers on their compatible leaf-completion path instead of incompatible GitHub evidence. Replay the original accepted receipt for idempotent action retries and cover terminal recovery boundary cleanup. Validation: cargo test-system-duckdb --test scheduler --quiet (100 passed); cargo test-system-duckdb --test hierarchy_selection --quiet (2 passed); cargo test-system-duckdb --test gateway --quiet (77 passed); cargo test-system-duckdb --lib --quiet (1286 passed); cargo check-system-duckdb --all-targets; cargo clippy-system-duckdb; npm run type-check; cargo fmt --all -- --check; git diff --check. * test(gateway): align idempotency replay assertions Update the workspace action-handler integration tests to match accepted receipt replay for repeated idempotency keys, including concurrent retries that produce one journal dispatch. Validation: cargo test-system-duckdb --test action_handler --quiet (16 passed); cargo test-system-duckdb --test gateway --quiet (77 passed); cargo test-system-duckdb --test scheduler --quiet (100 passed); cargo test-system-duckdb --lib --quiet (1286 passed); cargo check-system-duckdb --all-targets; cargo clippy-system-duckdb; npm run type-check; cargo fmt --all -- --check; git diff --check. * fix(hierarchy): close latest lease review gaps Summary: - Defer summary and known-candidate parent dispatch until complete reachability is available. - Keep recovery-boundary cleanup dirty after failed durable persistence and select the latest matching GitHub check run. - Canonicalize synthetic orchestrator-state handles and cover symlinked workspace roots. Rationale: - Parent cleanup must have the same complete tracker edge set as eligibility so canceled-subtree leases cannot strand retained workspaces. - Failed recovery writes need a scheduler-owned retry signal, and historical successful checks must not override newer failures. - State artifacts must follow the canonical workspace root accepted by normal workspace validation. Tests: - cargo test-system-duckdb --lib --quiet (1288 passed) - cargo test-system-duckdb --test scheduler --quiet (100 passed) - cargo test-system-duckdb --test hierarchy_selection --quiet (2 passed) - cargo test-system-duckdb --test gateway --quiet (77 passed) - cargo test-system-duckdb --test action_handler --quiet (16 passed) - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - npm run type-check - cargo fmt --all -- --check - git diff --check - opensymphony memory context --issue COE-552 --include-code-intel * fix(hierarchy): close latest review gaps * fix(hierarchy): close latest review gaps Summary: - Rebind finished child evidence to the current hierarchy generation. - Make idempotency replay identity ignore correlation IDs. - Break equal-time commit-status ties with GitHub status IDs. Rationale: - In-flight children need a durable generation handoff after stopping so active retries can produce evidence for the current parent scope. - API retries may generate a new correlation ID while reusing their key. - Provider response order must not decide the newest required status. Tests: - cargo test-system-duckdb --lib --quiet - cargo test-system-duckdb --test scheduler --quiet - cargo test-system-duckdb --test hierarchy_selection --quiet - cargo test-system-duckdb --test gateway --quiet - cargo test-system-duckdb --test action_handler --quiet - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - npm run type-check - cargo fmt --all -- --check - git diff --check * fix(hierarchy): address latest provider review findings Summary: - exclude canceled edges from lease reachability and retain canceled-parent checks - make review, provider timestamp, and GitHub 404 handling deterministic - preserve GitHub rate-limit category and retry metadata Rationale: - canceled descendants must not hold ancestor resources after reparenting - provider timestamps and review IDs need deterministic, precision-aware fencing - inaccessible repositories and rate limits must remain observable to recovery Tests: - cargo test-system-duckdb --test scheduler --quiet - cargo test-system-duckdb --lib --quiet - cargo test-system-duckdb --test hierarchy_selection --quiet - cargo test-system-duckdb --test gateway --quiet - cargo test-system-duckdb --test action_handler --quiet - cargo check-system-duckdb --all-targets - cargo clippy-system-duckdb - npm run type-check - cargo fmt --all -- --check - git diff --check * fix(hierarchy): fence prepared parent merge evidence Persist required merge-result commits with parent dispatch intent and verify them against the prepared checkout before launch. Keep ambiguous second-precision provider timestamps fenced and replay failed generation rebinding from the pre-resolution execution state. Tests: cargo test-system-duckdb --test scheduler --quiet; cargo test-system-duckdb --lib --quiet; cargo test-system-duckdb --test hierarchy_selection --quiet; cargo test-system-duckdb --test gateway --quiet; cargo test-system-duckdb --test action_handler --quiet; cargo check-system-duckdb --all-targets; cargo clippy-system-duckdb; npm run type-check; cargo fmt --all -- --check; git diff --check * fix(hierarchy): keep merge evidence repository-bound Retain repository identity alongside provider merge-result commits and keep legacy durable state readable. Remove scheduler verification against the non-repository parent root so integration worktree preparation remains owned by the parent integration slice. Tests: cargo test-system-duckdb --lib --quiet; cargo test-system-duckdb --test scheduler --quiet; cargo test-system-duckdb --test hierarchy_selection --quiet; cargo test-system-duckdb --test gateway --quiet; cargo test-system-duckdb --test action_handler --quiet; cargo check-system-duckdb --all-targets; cargo clippy-system-duckdb; npm run type-check; cargo fmt --all -- --check; git diff --check * fix(hierarchy): expose replan contract and bound provider work * fix(hierarchy): bound evidence hydration and lifecycle action replay Give retry, cancel, resume, and rehydrate requests fresh operation IDs, with explicit key reuse for retries of the same request. Fetch only the latest 32 PR-shaped Linear attachments in issue queries and remove historical attachment pagination. Stop subsequent parent provider lookups when a prior lookup activates the shared cooldown. Validation: 1294 library, 101 scheduler, 41 Linear, and 132 API-client tests passed; TypeScript, Clippy, formatting, and diff checks passed. * fix(hierarchy): retain reparented evidence and scheduler authority Preserve required descendants and their review/ancestor owners when a subtree moves, and remove later leaf releases that ignore tracker edges. Derive parent terminal eligibility from scheduler-owned state and clear stale success receipts before reopened work enters a launch batch. Add regressions for both release paths, canceled edges, forged provider flags, reactivation ordering, and persisted receipt invalidation. Validation: 1526 Rust tests passed across library and five integration suites; the hierarchy fixture validation check also passed. Clippy, formatting, and git diff --check passed. Two review passes reproduced and addressed the original findings and three follow-up defects. * fix(hierarchy): defer partial releases and retain API PR links Keep existing scopes and leases during partial hierarchy changes and request a full observation on the next tick. Replans fetch reachability before reconciliation, preserving retry semantics on rate limits. Accept API-created canonical PR attachments during Linear normalization. Validation: library, scheduler, Linear client, workspace manager, and action-handler suites passed (1489 tests, one live test ignored). Both findings have regressions that failed before remediation. Clippy, formatting, and git diff --check passed.
* feat(workspace): add parent execution roots Prepare repository-neutral parent workspaces with generation-bound shared-object integration worktrees and immutable checkout maps. Bind the same validated multi-checkout scope into OpenHands and Codex runtime envelopes and provider-neutral prompts. * fix(workspace): harden parent execution-root reuse Summary: - roll back incomplete roots and bound Git subprocess trees - isolate credentials and revalidate every retained child generation - preserve trusted parent integration changes across scheduler retries - support empty child maps and aggregate instruction size limits Rationale: - parent preparation must remain retryable without weakening containment - reused roots must retain child evidence and in-progress integration work Tests: - cargo test-system-duckdb - cargo clippy-system-duckdb - cargo fmt --check - git diff --check * fix(workspace): verify live child state on parent retries Summary: - compare retained child Git HEAD and branch with pinned parent evidence - preserve parent changes through scheduler retry preparation - cover pre-pinned child commits and committed post-pin drift Rationale: - immutable acquisition manifests do not describe completed child work - retry preparation runs before the worker's retry-aware attachment path Tests: - cargo test-system-duckdb - cargo clippy-system-duckdb - cargo fmt --check - git diff --check * fix(runtime): revalidate parent roots before attach * fix(workspace): verify parent remote locators * fix(workspace): isolate parent preparation probes * fix(workspace): seal parent execution roots * fix(workspace): isolate authenticated parent fetches * fix(workspace): harden parent launch boundaries * fix(workspace): isolate parent verification probes
Record the merged parent-root implementation in project memory and sync managed topic sections from the complete existing capture corpus. Preserve prior issue history while adding the new harness topic. Validation: memory lint --public-docs, zero pending captures or warnings, and git diff --check. No runtime code changed.
* feat(orchestrator): add restart-safe parent integration * fix(orchestrator): harden parent retry lifecycle * fix(orchestrator): trust runtime parent evidence * fix(orchestrator): close parent recovery gaps Summary: - trust only runtime-owned command, root, deadline, and cleanup evidence - gate terminal release effects on durable parent-controller completion - preserve one OpenHands conversation by restoring its scoped memory bearer - reconcile prelaunch and lost-outcome crash windows without duplicate work - validate canonical repository identities and checkout ancestry for memory Rationale: - worker-authored receipts cannot prove command execution or cleanup - restart recovery must retain leases and authorization across every gap Tests: - cargo test-system-duckdb --lib - cargo test-system-duckdb --test scheduler - cargo test-system-duckdb --test memory - cargo test-system-duckdb --test workspace_manager - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(orchestrator): complete parent retry recovery * fix(orchestrator): secure parent completion recovery * fix(orchestrator): close durable parent scope gaps Summary: - bound worker memory rows to the parent and authorized descendants - persist command events and recover legacy controllers before reattachment - keep dry-run and empty-target parent lifecycles repository neutral - document and test the restart-safe recovery behavior Rationale: - restart recovery must retain one authoritative controller and conversation - parent capture and memory reads must not inherit unrelated leaf scope Tests: - cargo test-system-duckdb --lib (1330 passed) - cargo test-system-duckdb --test scheduler (110 passed) - cargo test-system-duckdb --test memory (46 passed) - cargo test-system-duckdb --test workspace_manager (42 passed) - cargo test-system-duckdb --test fake_server_contract (14 passed) - cargo test-system-duckdb --test issue_session_runner (19 passed) - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(memory): keep parent capture repository neutral Summary: - carry the durable parent-integration marker into capture planning - clear default repository ownership for parent capture routing - verify the persisted empty-target parent row has no repository scope Rationale: - repository-neutral parents must not inherit a leaf repository from project or catalog defaults during automatic capture Tests: - cargo test-system-duckdb --lib - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(orchestrator): close parent terminal review gaps * fix(orchestrator): fence parent tracker confirmation Summary: - park verified parent attempts until terminal tracker confirmation, including recovery from persisted state - reject completed controllers from stale hierarchy generations and clear their terminal-success marker - retain run provenance for repository-neutral parent captures Rationale: - a successful integration attempt must not relaunch or release hierarchy state before current tracker and hierarchy proof agree - empty-target parents still need durable run and attempt attribution Tests: - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb --lib - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb --test scheduler - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb --test memory - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb --test workspace_manager - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb --test fake_server_contract - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb --test issue_session_runner - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(orchestrator): retain capturable parent evidence Summary: - discover generation-bound parent run envelopes and retry terminal capture after daemon restart - retain completed parent roots until the cleanup milestone can persist a capture acknowledgement while still releasing finalized leases - require every work-item scope and preserve passed parent outcomes at zero retry budget Rationale: - terminal capture must survive reconciliation, process restart, and aggregate memory authorization without trusting partial scope or deleting evidence Tests: - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb - GIT_CONFIG_GLOBAL=/dev/null cargo check-system-duckdb - GIT_CONFIG_GLOBAL=/dev/null cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(orchestrator): close final parent recovery gaps Summary: - retain recovered workers across failed controller persistence and reopen completed parents when an accepted hierarchy change invalidates their run - bind final verification to exact transient command hashes, reject stale attempt events, and retain parent evidence leases through restart - document the OSYM-893 cleanup handoff and add lifecycle regressions Rationale: - prevent untracked harness work, stale command evidence, and completed-run fences from violating restart-safe parent integration - keep registered integration worktrees valid until durable capture cleanup can release their protective leases in order Tests: - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check
Record the merged parent integration controller and refresh managed source references using the complete project memory corpus. Validation: memory lint --public-docs and git diff --check passed.
* feat: add durable parent repair lifecycle * fix(orchestrator): harden parent repair recovery flow Drive failed parent verification through the production scheduler repair lifecycle, pin provider policy and target provenance, and reconcile current-head review and push evidence safely across retries and restarts.\n\nAdd regression coverage for the real scheduler/backend round trip, schema-one state migration, requested-change deduplication, force-push protection, and refreshed instruction provenance. * fix(orchestrator): harden parent repair recovery * fix(orchestrator): harden parent repair recovery * fix(parent): harden repair replay and merge authority Summary: - preserve pre-write Codex review cursors and reconcile branch receipts - requeue no-commit repair turns and reject invalid review-provider routes - require current policy evidence and a pending orchestrator merge intent - add focused crash, no-change, configuration, and external-merge tests Rationale: - prevent duplicate billed scans and permanently stalled repair attempts - keep provider reconciliation subordinate to durable scheduler authority Tests: - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb --lib - GIT_CONFIG_GLOBAL=/dev/null cargo test-system-duckdb --test scheduler - GIT_CONFIG_GLOBAL=/dev/null cargo check-system-duckdb - GIT_CONFIG_GLOBAL=/dev/null cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(parent): bind merge intents to repair heads * fix(parent): close review and repair policy gaps * fix: preserve bounded parent repair review recovery * fix: close parent repair provider lifecycle gaps * fix: authenticate parent repair review evidence * fix: retain unresolved repair review evidence * fix(parent): require terminal harness evidence for release * fix(orchestrator): retain indeterminate parent harness ownership * fix(orchestrator): fence unreconciled parent repairs * fix(orchestrator): close parent repair terminal fences * fix(parent): honor repair review policy * fix: harden parent repair lifecycle fences * fix: include human threads in child review evidence * fix: enforce human review threads across providers
Capture the merged parent repair lifecycle evidence and regenerate the managed documentation from the complete 172-issue memory corpus. Preserve existing history while recording PR #238 and its merge source. Validation: full sync-docs preview, memory lint --public-docs, and git diff --check passed; no pending docs or capture warnings.
* feat(lifecycle): add bottom-up subtree cleanup Summary: - persist capture-acknowledged parent cleanup intents, receipts, and generation tombstones - detach parent Git worktrees before releasing owner leases and deleting descendant generations bottom-up - resume incomplete cleanup across restart while preserving higher owners, retention policy, and harness archive fences - document and test cleanup ordering, retry, hook, tombstone, and hold cases Rationale: - completed parent roots must survive capture retries, then clean up without invalidating registered worktrees or evidence owned by another ancestor - destructive retries need exact-generation proof and durable step receipts rather than treating any missing path as success Tests: - GIT_CONFIG_GLOBAL=/dev/null CARGO_INCREMENTAL=0 cargo test-system-duckdb - CARGO_INCREMENTAL=0 cargo check-system-duckdb - CARGO_INCREMENTAL=0 cargo clippy-system-duckdb - cargo fmt --check - git diff --check * fix(lifecycle): harden cleanup recovery * fix(lifecycle): preserve terminal cleanup policy * fix(lifecycle): recover nested cleanup state * fix(lifecycle): fence cleanup state transitions * fix(lifecycle): resume retained cleanup on reopen * fix(lifecycle): preserve captured cleanup generation * fix(lifecycle): recover interrupted subtree cleanup * fix(lifecycle): fence active cleanup generations * fix(lifecycle): close cleanup crash windows Summary: - roll back owner lease release when its durable receipt cannot persist - fence best-effort hooks before execution and fail closed on malformed state - recover completed parent capture routing after parent root removal Rationale: - restart cleanup must never repeat side effects or invalidate live worktrees - durable completion must survive deletion of the parent run manifest Tests: - cargo test-system-duckdb targeted scheduler, runtime, and workspace tests - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(lifecycle): fence cleanup retries by generation Summary: - fence retry-queued descendants and roll back failed completion receipts - preserve newer-generation memory grants during old-generation cleanup - require OpenHands parent conversation archival before cleanup preparation Rationale: - delayed retries and newer runs must keep their workspace and authorization - every destructive completion and archival transition needs durable evidence Tests: - cargo test-system-duckdb targeted scheduler, memory, and runtime tests - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(lifecycle): refresh tracker before cleanup retries Summary: - refresh live tracker state before every pending destructive subtree retry - fence newly active unresolved or matching descendant workspace generations - reject missing launched conversation evidence before generation cleanup Rationale: - reopen events must reach the scheduler before retained checkouts are removed - absence of a harness manifest cannot bypass required conversation archival Tests: - cargo test-system-duckdb targeted capture, retry, and runtime tests - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(lifecycle): avoid retained cleanup refresh churn Summary: - force fresh tracker snapshots only for destructive or policy-resumed cleanup - keep intentionally retained failed parents on the normal refresh cadence - cover consecutive retained cleanup ticks with tracker request assertions Rationale: - diagnostic retention can persist indefinitely without creating API pressure Tests: - cargo test-system-duckdb targeted retention, cleanup, and runtime tests - cargo check-system-duckdb - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check
Capture the merged subtree cleanup and recovery evidence and regenerate managed documentation from the complete 173-issue memory corpus. Record PR #239 and its merge source while preserving existing history. Validation: full sync-docs preview, memory lint --public-docs, and git diff --check passed; no pending docs or capture warnings.
* feat(control-plane): project multi-repository operator state * fix(control-plane): harden operator projections * fix(gateway): keep remote run details path-safe
* docs(acp): define runtime and IDE attachment implementation waves Record the ACP runtime and IDE attachment specifications, task contracts, dependency sequencing, and published Linear mappings. Reconcile the shared planning snapshot with develop while preserving upstream documentation. Validation: both ACP and advanced knowledge/debug task manifests validate; git diff --check passes. This commit does not implement dependent tasks. * feat(acp): add supervised ACP v1 client and launch profiles Use the official pinned Rust SDK for initialize, authentication, session creation, ordered callbacks, prompt completion, and confirmed cancellation. Validate host workspace binding and secret-free profile references before launch; bound transport and evidence, redact diagnostics, and supervise process-tree teardown with explicit outcome uncertainty. Add a reusable adversarial subprocess and central/workflow configuration coverage. Keep production routing and durable sessions in dependent tasks. Document the implemented API and its limits; box the testkit event payload because the SDK JSON map feature increases its enum size. Validation: 2071 bundled tests passed, 4 existing ignored; bundled and system Clippy clean; 9 ACP, 67 workflow and 1 central focused tests pass. Formatting, diff checks, and both planning manifests pass. Full tests use an environment without ambient Linear OAuth credentials. * fix(acp): preserve stream content and cancel setup promptly Address the first full PR review in one batch: - Stop cancelled launches before spawn and interrupt pending setup. - Preserve ACP profiles and selectors during central config migration. - Keep live update text intact while redacting secrets; validate update payloads even when the caller does not request a stream. - Mark submission only after the encoded prompt passes its frame bound. Reject known host credentials in argv and keep untrusted negotiation metadata out of diagnostic Debug output. Add focused subprocess and migration regressions and update the runtime documentation. Validation: 2076 bundled tests passed, 4 existing ignored; 13 ACP tests and the migration regression passed; system and bundled Clippy, fmt and diff checks passed. Full tests exclude ambient Linear OAuth credentials. * fix(acp): scope credentials and preserve auth uncertainty Remove env-ref source aliases from the child environment unless explicitly selected as targets. Carry prompt submission state on authentication errors so a mid-turn credential failure cannot imply a safe retry. Keep opaque session identifiers out of SessionUpdate Debug output while retaining them for protocol correlation. Add subprocess regressions for renamed/retained environment sources, authentication failure after prompt submission, and credential-bearing session IDs. Update configuration and diagnostic documentation. Validation: 2079 bundled tests passed, 4 existing ignored; 16 ACP tests passed; system and bundled Clippy, fmt and diff checks passed. Full tests exclude ambient Linear OAuth credentials. * fix(acp): own Windows process trees and resolve routing overrides Use a kill-on-close Job Object before Windows children execute and retain one termination/reaping deadline. Add native Windows lifecycle CI with production-source and root-lockfile validation. Reuse platform-aware names when resolving environment references. Validate ACP selection after routing environment overrides, preserve profile validation causes, reject mixed-case credential flags, and list ACP in the supported-harness diagnostic. Validation: 2079 bundled tests passed (4 existing ignored), ACP 16 and central ACP 1 passed; bundled/system Clippy and fmt/diff checks clean. Windows helper and four lifecycle regressions cross-compile; native CI execution follows this push. * fix(acp): replace environment aliases with explicit values Use the shared platform-aware name comparison when applying environment aliases, so inherited Windows casing cannot override mapped credentials. Move the comparison and replacement into a small workspace environment module and run its real child-environment regression in Windows CI. Name the missing required agent capability in setup errors and cover all three supported capability requirements with the fake ACP peer. Validation: 2080 bundled tests passed (4 existing ignored), ACP 16 and child-environment regression passed; system/bundled Clippy and fmt/diff checks clean. Production Windows sources cross-compile; native CI follows. * fix(acp): clear profile for non-ACP harness overrides Drop the ACP selector when an explicit environment override selects a non-ACP harness. Retain the profile for ACP overrides and continue to reject incompatible static harness/profile combinations. Add regressions for ACP, OpenHands and Codex override targets and document the resolved selector behavior. Validation: ACP 16 and bundled 2080 tests passed (4 existing ignored). System/bundled Clippy, formatting and diff checks are clean. * fix(acp): enforce encoded prompt and cumulative evidence limits Admit prompt text based on the complete serialized wire frame instead of rejecting otherwise valid text above half the configured frame size. Cap retained redacted source frames by cumulative serialized bytes, including metadata, independently from their count. Keep processing the protocol when capture truncates and allow zero-byte retention. Add exact byte-boundary and legal-frame flood regressions, plus a prompt admission case alongside the escaped-overflow submission-state check. Document the 1 MiB default and 16 MiB maximum evidence budgets. Validation: ACP subprocess tests (18), evidence boundary unit test, system and bundled Clippy, and full bundled tests. * fix(acp): bound live queues and harden credential configuration Charge incoming wire bytes until ordered SDK dispatch, with independent frame-count and byte limits. Verify queue exhaustion and charge release without relying on retained diagnostic evidence. Share normalized sensitive-field classification between central config and ACP payload redaction, covering account identities in diagnostics and live updates. Reject alternate credential flags in profile argv and recognize ACP-only central files before permissive legacy fallback. Add adversarial subprocess, exact-budget and runtime-config regressions; document the new queue budget and fail-closed configuration behavior. Validation: ACP subprocess tests (20), ACP unit/config tests (5), system and bundled Clippy, and full bundled tests. * fix(acp): bound redaction and preserve RPC diagnostics Replace per-secret string rescans with a bounded Aho-Corasick matcher. Redact known secrets before limiting generic diagnostic normalization, and preserve overlapping-secret protection without replacement rescans. Reject configured environment targets that collide under host name rules before insertion. Share the production collision check with native Windows tests while retaining POSIX case distinctions. Keep RPC method, code, bounded redacted message and submission state in an explicit error even when source evidence retention is disabled. Preserve authentication and transport-disconnection classifications. Validation: ACP subprocess tests (22), ACP/config units (6), environment unit, Windows helper cross-compilation (6 native cases), both Clippy variants, and full bundled tests. The unit batch including a 16 MiB redaction input with 128-plus patterns completed locally in 0.05 seconds. * fix(acp): order session binding and bound callback output Bind new-session ownership inside the SDK ordered response callback before adjacent notifications can dispatch. Reserve callback frame count and encoded bytes before SDK enqueue, retaining each reservation until stdin flush completes so an unread peer cannot grow outgoing queues indefinitely. Cover adjacent response/update frames, blocked output for unknown and permission requests, exact encoded-byte boundaries, and reservation reuse. Document the independent callback budget and fail saturation promptly. Validation: 25 ACP subprocess tests, 7 ACP/config unit tests, system check, system and bundled Clippy, full bundled tests, fmt and diff checks.
Capture the merged ACP client issue and synchronize the complete 174-issue memory corpus into managed documentation. Public-doc lint and whitespace checks pass; existing managed history is preserved.
Keep one bounded, supervised ACP owner across worker attempts and expose private generation-fenced observation commands and source events. Persist identity, process ownership and submission markers before launch or send, then gate recovery on negotiated load/resume and known terminal outcomes. Preserve native manifests, ordered SDK dispatch, workspace containment and truthful remote-quiescence evidence. Add executable peer and real host-crash coverage for retention, replay, cancellation and uncertainty. Validation: full system-DuckDB suite 2116 passed, 4 existing ignored; final library and ACP regression targets 1425 passed; Clippy and format checks clean. No dependency or release metadata changes.
Capture merged session ownership and durable recovery, then synchronize the full 175-issue corpus. Public-doc lint and whitespace checks pass; all existing managed history is preserved.
* feat(acp): add host client facilities and session configuration Implement contained text callbacks and session-bound terminal supervision with bounded admission, asynchronous waits, cancellation and teardown. Keep host services immutable and scope each retained turn's callbacks. Apply explicit advertised session selections before prompting and attach required scoped MCP servers only over negotiated transports. Preserve ordered updates and redact resolved grants from captured evidence. Validation: system-DuckDB ACP integration and unit checks, full Rust suite, cargo fmt and all-target clippy; executable-peer lifecycle and policy cases. * fix(acp): close callback setup and credential safety gaps Reject Windows callback path reparse points, including junctions, using one production validator exercised by the native Windows CI harness. Redact resolved MCP credential option values from captured requests, echoed updates and stderr. Keep callback epoch admission cancellable and bounded inside the setup deadline so queued callbacks cannot trap setup. Validation: 2107 system-DuckDB tests passed, clippy and formatting clean. Windows helper and native junction regression cross-compile successfully; native Windows execution runs in CI after publication. * fix(acp): pin Windows paths and preserve configuration semantics Pin Windows path ancestors without write/delete sharing through callback I/O and terminal spawn; open leaves without following reparse points. Apply currently advertised category prerequisites before dependent configuration choices and preserve redacted setup RPC classification. Focused configuration regressions passed; Windows helpers cross-compile. Full combined validation follows the retained-session integration before publication, including native Windows CI. * fix(acp): request read access for Windows directory pins Native Windows regression demonstrated that attribute-only directory handles do not prevent rename despite excluding delete sharing. Request read access so the sharing check protects the pinned callback path. Validation: production helpers and tests cross-compile; fmt/diff clean. Native Windows rename/junction tests run on the published correction. * fix(acp): enforce callback cancellation and retained resource policy Pin Unix terminal cwd through child-only fchdir, reject credential-bearing MCP URLs, and resolve mode categories after model prerequisites. Bound encoded callback responses and include client limits in retained identity. Cancel active facility waits when the current turn is cancelled. The unsafe-code lint stays denied except for one documented pre_exec registration whose closure only calls async-signal-safe fchdir. Validation: 2140 tests passed across 38 suites, including native macOS cwd swap and queued-I/O cancellation regressions; clippy, fmt and diff clean. * fix(acp): stage callback writes and classify MCP secrets Stage filesystem writes beside the destination and promote only after a complete flush. Keep Unix descriptor-relative containment and file mode, Windows parent pins, and cleanup when a staged operation fails or cancels. Mask MCP environment and header values structurally in source captures. Register credential-named values for substring redaction so ordinary short settings do not reject launch commands or alter unrelated source text. Validation: 2144 tests passed across 38 suites; native macOS staging, permission and path-swap regressions; Windows helper cross-check; all-target clippy, fmt and diff clean. Native Windows atomic-write execution follows publication. * fix(acp): close Windows staging handles before promotion Drop both data handles before atomically persisting the staged path while keeping every parent directory pin through replacement. Preserve the native regression that caught the Windows sharing violation. Validation: Windows production helper cross-target check, fmt and diff checks passed. Native Windows verification follows publication. Unix behavior is unchanged from the passing 2144-test suite. * test(acp): isolate Windows pinned rename behavior * fix(acp): promote Windows writes through pinned file handles Use a same-directory NT rename that preserves parent sharing guards, and pin the stage against relocation until promotion. Mark cancelled stages for deletion by handle so outstanding writes cannot strand them. Remove the temporary native API diagnostic after it isolated the conflict. Add Windows-only SDK bindings and audited synchronous call wrappers, with native regressions for stage swaps, promotion errors, and delayed handle cleanup. Cross-target compilation and formatting pass; native regressions and bundled validation run in CI. * fix(acp): enable Windows stage creation access * fix(acp): fence reset callbacks and retained configuration Clear failed restoration bindings during ordered response dispatch and retire prior callback work before a fresh session can be bound. Reapply explicit model, mode and option choices before each retained prompt's durable submission, with cancellation and one setup deadline. Add executable regressions for abandoned load/resume callbacks, changed or removed choices, cancellation, deadlines and owner responsiveness. Restore saved Windows test permissions instead of clearing readonly. Validation: retained host 20 tests, Windows target Clippy/check, all-target Clippy, formatting and diff checks pass. Full suite result recorded in PR. * fix(acp): retire completed callbacks and protect captured file contents Close retained callback epochs in ordered prompt response dispatch and quiesce owned work before publishing Finished. Keep preparation frames bound to the accepted run even when setup fails before submission. Redact filesystem callback payloads structurally without changing the wire content. Reject MCP URL queries and excluded checkout credential values forwarded through attachment aliases. Tests: full system-DuckDB suite, ACP and retained-host regressions, all-target Clippy, cargo fmt and git diff checks. * fix(acp): release durable owner lock on drop Summary: - Explicitly unlock the durable owner file when its owner drops. Rationale: - A concurrent fork can briefly retain the inherited file description after the parent closes it, delaying the next owner's lock claim. - Keep the stable lock file and existing cross-process ownership check. Tests: - ACP library suite passed 20 consecutive parallel runs. - Full system-DuckDB suite: 2,151 passed, 0 failed, 4 ignored. - All-target Clippy, cargo fmt, and git diff checks passed. * fix(acp): close initial callbacks and mask terminal evidence Summary: - Start services with callback authority closed until begin_turn, including the missing-session restoration fallback. - Mask terminal output in captured response clones while preserving the original peer-visible response. - Cover pre-prompt denial and opaque terminal output with executable peers. Rationale: - Session binding and configuration do not grant callback authority before the first prompt, and workspace-derived output must stay out of evidence. Tests: - Full system-DuckDB suite: 2,152 passed, 0 failed, 4 ignored. - ACP client 41/41 and retained host 23/23 passed. - Pre-prompt test failed when initial cancellation was removed and passed when restored; all-target Clippy, fmt and diff checks passed. * fix(acp): close callback and capture gaps Summary: - Pin the Unix workspace root across agent launch and service callbacks. - Revoke one-turn callbacks at response dispatch and settle cancellation after the durable submission checkpoint without sending a prompt. - Mask all captured MCP stdio arguments and redact generic headers. - Cover root replacement, late callbacks, retained cancellation, and credential-bearing MCP arguments in executable regression tests. Rationale: - Path replacement, response adjacency, opaque argv, and cancellation during sync could cross the bound workspace or turn authority. Tests: - cargo test-system-duckdb (2156 passed, 0 failed, 4 ignored) - cargo clippy-system-duckdb (all targets, warnings denied) - cargo fmt --all -- --check; git diff --check * fix(acp): verify terminal group teardown after natural exit Summary: - Retry macOS process-group EPERM briefly after terminal exit, accepting cleanup only after signaling succeeds or an absent group is proven. - Exercise repeated short-lived terminals in retained prompt cycles. - Give the lease-expiry test enough time to renew during parallel setup. Rationale: - Darwin can return EPERM for a reaping group; treating it as a terminal failure made retained callback tests intermittently lose their peer. - Persistent EPERM still reports teardown failure for inaccessible live descendants. The lease test still asserts expiry after its full TTL. Tests: - cargo test-system-duckdb (2156 passed, 0 failed, 4 ignored) - retained-host integration suite 30 default-parallel runs (all 24 pass) - cargo clippy-system-duckdb (all targets, warnings denied) - cargo fmt --all -- --check; git diff --check
* feat(acp): route production workers through retained sessions Persist ACP profile routes and reuse verified workspace preparation, hooks, instructions, scoped grants and runtime envelopes in the actual run path. Integrate lifecycle reports, cancellation, recovery and fenced retirement; keep ACP-only execution independent of OpenHands startup. Expose profile and run capabilities through Rust and TypeScript schemas, and project redacted updates without charging replay or invented usage. Cover actual CLI execution, profile switches, retained recovery, ten concurrent workers, corrupt evidence and native harness regressions. Validation: 24 focused ACP tests and all-target clippy pass. The earlier complete routing suite passed 2,126 tests; later lifecycle refinements passed focused regressions. TypeScript: 726 tests and full type-check pass. Final model/config/MCP wiring follows the reviewed COE-610 integration. * fix(acp): preserve structural activity and reported usage Give structural updates summaries so scheduler activity retains their payloads. Preserve only recognized numeric prompt-response usage counters through frame redaction while keeping credential redaction and known secret matching. Keep response observations separate from context usage and avoid inferring delta accumulation into native aggregate counters. Clear the native server URL from ACP metadata. Exercise public plan and usage projection through the actual CLI, waiting for both durable success and after_run evidence before asserting completed hook execution. Validation: actual CLI regression passes, 25 focused ACP tests pass, and all-target clippy is clean. Final combined validation follows COE-610. * fix(acp): resolve profile environment for readiness checks Resolve executable preflight against profile-mapped PATH values and source-only environment removal, matching launch precedence. Report missing references before executable availability, reject platform-name collisions, and recognize Windows bare executable names. Validation: 17 focused ACP tests passed, including the mapped PATH and missing reference regression; all-target system-DuckDB clippy passed. * feat(acp): validate model routes and recover run capabilities Allow direct ACP model IDs through workflow and environment precedence, while rejecting unmapped OpenHands model profiles. Strengthen the central configuration authority test against repository-local profile overrides. Production application to session configuration follows the COE-610 merge. Recover public run capabilities from durable negotiation when reconciling a completed prompt, preserving the persisted profile without peer replay. Validation: workflow model selection, central authority, retained profile recovery tests and all-target system-DuckDB clippy passed; fmt and diff checks are clean. * fix(acp): consume failed worker joins once during abort Remove the consumed task handle and stale ACP registry entry when worker finalization returns a JoinError. Report failure and the already-observed harness stop proof through WorkerUpdate instead of allowing later polling to panic on the completed JoinHandle. Validation: forced-task-abort regression reproduced the Tokio panic before this fix; all 10 focused ACP routing and lifecycle tests now pass. Format, diff checks and all-target system-DuckDB clippy are clean. * fix(acp): fence unexpected worker task failures during polling Remove stale ACP active-session entries when polling observes a failed worker task. Cancel retained ownership work and use the owner snapshot to report a stopped failure or a detached uncertain outcome through worker messages, preserving scheduler cleanup and retry authority. Validation: all 11 focused ACP routing/config/lifecycle tests passed, including ordinary polling after forced task termination. All-target system-DuckDB clippy, format and diff checks passed. * fix(acp): box worker future on shared task stack Summary: - Heap-allocate the ACP run future before awaiting it in the worker task. Rationale: - The inline ACP future enlarged every route's task frame and caused the existing OpenHands gateway-cancel CLI test to overflow a Tokio stack. Tests: - cargo test-system-duckdb --test run (9 passed) - cargo test-system-duckdb --all-targets (2133 passed, 4 ignored) - cargo clippy-system-duckdb - cargo fmt --all -- --check * fix(acp): verify durable stop after pre-prompt owner exit Summary: - Confirm cancellation and abort outcomes from the exact owner, generation, run, and workspace when the live ACP control channel closes. - Keep uncertain submissions fenced and make abort coverage wait for the intended submitted prompt. - Read the first CLI prompt from history to avoid a scheduler retry race. Rationale: - COE-610 preparation can cancel before transport submission and close the owner after a safe stopped checkpoint; the scheduler must recognize that checkpoint without trusting an unrelated or uncertain record. Tests: - cargo test-system-duckdb --all-targets (2174 passed, 4 ignored) - cargo test-system-duckdb opensymphony_cli::orchestrator_run::backends::tests::acp_ - cargo test-system-duckdb --test run - cargo clippy-system-duckdb; cargo fmt --check; git diff --check - npm run type-check; npm test (759 passed) * fix(acp): fence scheduled interrupts and recovered turns Summary: - Resolve scheduler interrupts by issue identity and verify the ACP owner. - Match recovered finished turns to their prepared run and attempt. - Include resolved worker credentials in profile preflight and publish negotiated model-selection capability. - Wait for stop evidence on retained pre-submission cancellation. Rationale: - Generated worker IDs differ from scheduler interrupt identifiers, and retained ACP state can describe a prior turn during a new preparation. - Capability and preflight projections must match the launched session. Tests: - cargo test-system-duckdb --all-targets (2,177 passed; 4 ignored) - cargo clippy-system-duckdb; cargo fmt --check - npm run type-check; npm test (759 passed on prior published head) * test(cli): wait for Linux gateway readiness with diagnostics Summary: - Give the gateway-cancel CLI fixture the same bounded readiness window used by its neighboring recovery fixture. - Drain child stderr and report process status plus the last gateway issue state when readiness still fails. Rationale: - GitHub Linux CI hit the 10-second snapshot limit on three runs while the same fixture and all sibling CLI tests passed locally. - A further failure must expose whether startup exited or remained in a non-running state rather than another opaque timeout. Tests: - cargo test-system-duckdb --test run (9 passed) - cargo test-system-duckdb --all-targets (2,177 passed; 4 ignored) - cargo clippy-system-duckdb; cargo fmt --check; git diff --check * fix(openhands): bound worker stack during attach and event polling Summary: - Isolate OpenHands attach in a cancellation-owned task and box the shared routing, turn, and event-poll futures. - Constrain the gateway-cancel CLI fixture below Linux's default worker stack, retain child stderr diagnostics, and restore 10-second readiness. - Document attach cancellation ownership. Rationale: - Linux CI showed the run child exiting 134 from a Tokio worker stack overflow before the gateway bound; its readiness timeout was secondary. - The constrained-stack fixture reproduces that route while preserving normal cancellation and WebSocket attachment behavior. Tests: - cargo test-system-duckdb --all-targets (2,177 passed; 4 ignored) - cargo test-system-duckdb --test run (9 passed) - cargo clippy-system-duckdb - cargo fmt --all -- --check * fix(acp): preserve recovery identity and parent command evidence Summary: - Scope recovered outcomes and memory grants to the exact run and attempt. - Retire retained ACP owners when effective profile or credentials change. - Project terminal callback commands into parent verification receipts. - Align preflight exclusions and environment decoding with worker launch. Rationale: - Prior-turn checkpoints and stale owners must not govern new attempts. - Parent final evidence requires observed command start and exit results. - Ambient invalid Unicode must not crash an otherwise valid launch. Tests: - cargo test-system-duckdb --all-targets: 2182 passed, 4 ignored - Focused ACP callback fixture and recovery regressions passed - cargo clippy-system-duckdb; cargo fmt --all -- --check - git diff --check * fix(acp): bind recovery route to the prepared run Persist the selected ACP profile and model with each run so a restart before owner launch cannot inherit the previous turn's workspace route. Clear prior terminal evidence when reserving a different run, and resolve credential source aliases with platform environment-name rules. Cover stale legacy routes, changed-model recovery, claim checkpoints, and credential casing. Validate with the full 2,186-test all-target Rust suite. * fix(acp): preserve effective model and memory run scope Bind the profile-selected model before preparing ACP runs, acknowledge fresh memory grants only after a new owner reports launch, and rotate retained owners when per-run memory environment values change. Derive memory prompt guidance from the managed worker overlay instead of inherited shell values. Cover changed-profile recovery after owner retirement, grant revocation and failed setup, run-scope rotation, and stale ambient scope. Validate with the full 2,191-test all-target Rust suite. * fix: preserve ACP prompt seeding and long-running turns * fix(acp): preserve prompt and parent scope across retained runs Summary: - Persist workflow prompt seeding separately from transient ACP status, including legacy manifest migration and fresh-session reset. - Keep current run envelopes while binding retained ACP conversations. - Render repository-neutral parent memory guidance from scoped worker env. - Cover restored seeded sessions, parent checkout drift, and cancellations. Rationale: - A restored Ready session may already have received the full workflow; replaying it can repeat completed actions. - A retained owner holds the prior envelope, which must not replace the current hierarchy and checkout snapshot. - Parent memory grants intentionally omit an execution repository. Tests: - cargo test-system-duckdb --all-targets (2,199 passed, 4 ignored) - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --cached --check * fix(acp): scope memory grants and recover lagged activity Summary: - Strip ambient and workflow memory variables before ACP launch, then inject only the managed run grant; reject reserved env mappings. - Recover a lagged subscriber from the contiguous post-cursor source tail and project unknown session updates as bounded redacted activity. - Cover child and terminal environments, profile mapping, source gaps, and unknown updates; document the production behavior. Rationale: - Inherited admin credentials could reach the ACP peer or callbacks, historical evictions could falsely fence a current run, and future updates could disappear from scheduler stall accounting. Tests: - cargo test-system-duckdb --all-targets (2205 passed, 4 ignored) - cargo clippy-system-duckdb - cargo fmt --all --check - git diff --check * fix(acp): retain terminal evidence and callback liveness Summary: - Checkpoint bounded future ACP stop reasons as finished peer evidence and preserve their optional usage while keeping outcomes non-retryable. - Include run-bound pending OpenHands manifests in startup recovery when a configured harness has changed. - Project filesystem callback requests and responses as payload-free scheduler activity with bounded response correlation. Rationale: - Conclusive future peer responses must not become uncertain delivery, pending native ownership must initialize its transport after restart, and ongoing callback traffic must prevent false scheduler stalls. Tests: - cargo test-system-duckdb --all-targets (2209 passed, 4 ignored) - cargo test-system-duckdb --lib filesystem_callbacks_project_payload_free_scheduler_activity - cargo clippy-system-duckdb - cargo fmt --all --check - git diff --check * fix(acp): preserve parent sessions and redact terminal reasons * fix(acp): keep terminal output polls visible to stall detection
* feat(acp): route operator requests through scheduler and clients Summary: - Bind native ACP permission, question, and plan callbacks to live runs. - Route typed decisions through scheduler and gateway with stale-response fences, deadlines, receipts, and explicit permission policies. - Add web, desktop, and terminal controls plus protocol documentation. Rationale: - ACP callbacks must wait for a real, authorized operator answer without replaying stale approvals or blocking unrelated scheduler work. - Preserve opaque option and RPC identities while keeping protocol details inside the ACP adapter. Tests: - Native production worker/scheduler/gateway/peer round trip. - ACP transport 47 tests; gateway negative cases; terminal gateway client. - npm test (43 suites, 762 tests); npm run type-check. - cargo fmt --check; cargo clippy-system-duckdb; desktop cargo check. * fix(acp): preserve prompt cancellation when operator channel closes Summary: - Stop selecting closed optional operator channels during a worker turn. - Wait for the prompt result when pre-submission cancellation drops the operator request sender. - Print the full retained worker outcome on cancellation test failure. Rationale: - The closed channel could win the select race and turn an acknowledged cancellation into a failed worker outcome. Tests: - Reproduced failure on default-parallel unit run 4/4 before fix. - Four consecutive default-parallel unit suites passed after fix. - Full default-thread cargo test-system-duckdb -q passed; clippy and fmt checks passed. * fix(acp): bound and route operator callbacks safely Route standard form elicitation through the operator path, preserve RPC IDs across JavaScript, and handle gateway commands independently of tracker polling. Bound callback reservations and page terminal choices. Leave Cursor vendor methods for COE-613. * fix(acp): publish operator callbacks without tracker polling * fix(acp): keep scheduler ticks and operator forms stable * fix(acp): keep operator responses live across client boundaries Summary: - Proxy desktop capability discovery to the attached gateway and align mock approval targets with the HTTP transport. - Restart idle stall activity after delivered or closed operator requests while preserving the absolute runtime cap. - Keep Ctrl-C armed during non-cancellable scheduler ticks and cover the response, closure, shutdown, and client paths with regression tests. Rationale: - Static desktop metadata hid configured ACP profiles, and stale stall deadlines could abort a worker immediately after operator input. - A transient shutdown listener could lose a signal during a long tick. Tests: - Full Rust suite with four test threads; 1,457 unit tests and all integration groups passed. - Native Tauri capability test; 43 Jest suites and 763 tests. - TypeScript type-check, cargo format, and all-targets clippy. * fix(acp): fence timed-out operator replies and clear stale forms * fix(acp): fence gateway command timeout and serialize replies * fix: fence ACP operator delivery through peer input flush * test: publish ACP peer completion marker atomically * fix: keep ACP delivery waits off scheduler actor * fix(acp): fence automatic permission decisions by prompt epoch Summary: - Require an active callback epoch before applying automatic permission policy, including turns without an operator route. - Cover an in-turn allow and adjacent post-completion permission callback with a native retained-session peer. - Document the turn-bound permission behavior. Rationale: - A peer could ask for permission immediately after end_turn and receive allow_once because automatic answers bypassed the callback-epoch guard. - Retaining the epoch independently of the operator sender keeps automatic policies available during a live turn and cancels late requests. Tests: - cargo test-system-duckdb -q -- --test-threads=4 - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check * fix(acp): deliver callback closures under channel saturation Summary: - Wait boundedly to enqueue a callback Closed event after its response flushes, instead of dropping the event when the worker queue is full. - Fail the run if the worker stops draining the event queue, allowing worker completion to reconcile pending operator state. - Add a native peer regression that holds the prompt active while two timed-out callbacks close through a saturated event channel. Rationale: - Lost timeout closures left worker waiters and scheduler interactions pending, and skipped the idle-clock reset after an agent resumed. Tests: - cargo test-system-duckdb -q -- --test-threads=4 - 10 native saturation regression repetitions - cargo clippy-system-duckdb - cargo fmt --all -- --check - git diff --check
Summary: - Capture merged COE-612 with verified PR #246 and merge SHA. - Sync all 178 issue capsules into managed topic docs. Rationale: - Keep the full project memory corpus current after the ACP merge. - Preserve existing managed history while adding COE-612 refs. Tests: - opensymphony memory lint --public-docs - opensymphony memory status: 178 captured, 0 pending, 0 warnings - git diff --cached --check
* feat(acp): route registered extensions and harness operations Summary: - Handle pinned Cursor question, plan, and notification callbacks through bounded ACP dispatch and scheduler-owned operator responses. - Advertise peer-gated operation schemas and route a registered outbound operation through gateway authorization and run binding. - Add fake-peer, gateway, schema, and timeout tests plus a redacted Cursor CLI qualification record. Rationale: - Custom ACP methods need explicit version and effect policies; arbitrary wire methods and session IDs cannot be operator inputs. - The real pinned Cursor CLI requires login before vendor callbacks can be qualified, so the live-evidence gap remains documented. Tests: - cargo fmt --all -- --check - cargo clippy-system-duckdb - cargo test-system-duckdb --lib opensymphony_acp:: (49 passed) - cargo test-system-duckdb --test acp --test acp_session_host --test gateway --test gateway_schema (220 passed) - npm run type-check - npx jest --config jest.config.js packages/gateway-schema/__tests__ --runInBand (66 passed) * fix(acp): bound extension operations and gate Cursor qualification * fix(acp): bound unresolved operations and redact results * feat(acp): qualify pinned Cursor plan and todo callbacks * fix(acp): fence saturated and ambiguous Cursor todo projection * fix(acp): correlate Cursor todos across callback methods
* feat(acp): qualify live Cursor and Devin routing Summary: - Bind bounded ACP updates that arrive before session/new responds, while retaining the response as the authoritative configuration snapshot. - Add tracked-issue live tests for two pinned CLIs, Cursor operator and cancellation paths, and live session/load restoration. - Publish the versioned interoperability matrix and executable evidence. Rationale: - Devin sends valid session updates before session/new responds; rejecting them prevents a real ACP worker from starting. - Capability claims require live vendor runs and explicit optional-method limits in addition to deterministic fake-peer conformance. Tests: - cargo test-system-duckdb (full suite), cargo clippy-system-duckdb - cargo fmt --check, git diff --check, npm run type-check - npx jest --config jest.config.js packages/gateway-schema --runInBand - Pinned Cursor and Devin ignored live qualification tests * fix(acp): count pending session update bytes incrementally Summary: - Track the pre-response update queue's frame and byte charges as updates arrive and reset charges when the authoritative session response drains it. - Add byte-limit/reset and pre-prompt overflow regression tests. Rationale: - Repeatedly serializing all pending updates on each notification made setup work quadratic at the permitted queue limit. Tests: - cargo test-system-duckdb (full suite, 1,474 library and 51 ACP tests) - cargo clippy-system-duckdb, cargo fmt --check, git diff --check
Summary: - Capture verified COE-613 and COE-615 PR and merge evidence. - Sync the full 180-issue memory corpus into managed topic docs. Rationale: - Keep post-merge project memory and public source refs current. - Preserve existing authored docs outside managed memory sections. Tests: - opensymphony memory lint --public-docs - git diff --check
* test: add hermetic multi-repository rollout gate * fix(rollout): let orchestrator publish parent repair Keep the live parent harness focused on editing the verified checkout, then wait for the orchestrator to publish and merge its durable repair PR. Record completed controller evidence before marking the parent Done. Validated with bash -n and git diff --check. * fix(rollout): use automated checks without reviewer token * test(rollout): validate central config and three-repo lifecycle * fix(rollout): harden disposable lifecycle controller * fix(rollout): bound provisioning and deliver rework evidence * test: bound disposable lifecycle rollout and test stack * fix: make disposable lifecycle evidence teardown-safe * fix: isolate live fixture publishing and bounded shutdown * Fix disposable lifecycle worker completion and parent repair guidance * fix: place live memory catalog under state root * fix: canonicalize hermetic temporary directory * fix: accept an already-created disposable pull request * fix: use repository REST APIs in disposable PR flow * fix: reject empty disposable PR lookup * fix: gate disposable publishing on controller outcome * fix: refresh completed parent fan-in before hourly scan * fix: transition disposable children after durable completion * test: allow durable child handoff in live rollout * test: gate live publication on stopped run receipt * fix: accept issue-bound semantic child merge branches * test: use verifiable merge commits in disposable rollout * test: validate checks directly for private live fixtures * test: leave published child checkouts clean for parent fan-in * Clarify exact parent verification command in live fixture * Refresh parent retries on terminal cadence * Pin parent fixture verification command invocation * Reopen claimed parent workspace for integration retries * test: route live memory capture through stable fixture checkouts * fix: release parent checkout pins during terminal cleanup * test: exclude durable cleanup tombstones from live workspace check * fix: release checkout staging intent after terminal cleanup * test: force first disposable alpha PR through CI repair
Prepare OpenSymphony 3.0.0 documentation and version metadata
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release OpenSymphony 3.0.0 from
developtomain. This brings the completed M12.97 multi-repository lifecycle and M12.99 ACP v1 worker route together with the new operator guides, upgrade path, Mermaid diagrams, and aligned crate/desktop version metadata from PR #249.Repository-bound sub-issues run in their configured checkouts; an unlabeled parent verifies the merged result in an integration workspace. A local ACP profile can be selected independently of repository routing. Existing single-repository workflows remain available.
Evidence