fix-brokered-deliverable-preflight-worktree

Metadata

Status	failed
Assigned	`agent-969`
Agent identity	`fbb2d89fe44d6b761bcb4b67748ab3d417f29df70a65f8d9403308f5bb2bab78`
Created	2026-08-02T21:16:00.085122069+00:00
Started	2026-08-03T06:08:44.469374093+00:00
Tags	`lifecycle`, `containment`, `worksave`
Tokens	24783264 in / 30516 out
Failure reason	Provider failure detected after streaming: provider-unavailable

Description

Fix the self-hosting completion defect reproduced by design-atomic-graph-work-save: a capability-brokered worker has an authenticated retained worktree and committed deliverables there, but done::run_inner runs deliverables::preflight against the graph project root and falsely reports the deliverables missing. Commit 9774eed0 propagates brokered worktree context for finalization, but preflight still ignores it.

Keep this a narrow containment repair. Make deliverable preflight resolve against the exact authenticated/detected worktree root when task-owned completion is active, and against the graph project root only for genuine human/root completion. Do not weaken or skip preflight. Do not copy deliverables into the graph root. Reject inconsistent worktree/project/task context rather than falling back. Preserve .wg control-plane exclusions.

Add focused regression tests covering:

brokered task with deliverable present only in retained worktree passes preflight and proceeds through the task-owned path;
same deliverable absent in retained worktree is refused even if a stale copy exists at graph root;
ordinary human/root completion retains existing graph-root behavior;
authenticated context mismatch fails closed;
lost/replayed broker request remains idempotent if relevant to the touched path.

Use the completed design attempt as the incident trace: task design-atomic-graph-work-save, agent-966, branch commit 1e4aca27, where both declared deliverables exist and are committed but wg done refused them from the graph root. Do not modify or clean that worktree; it will be retried after this repair lands.

Non-goals: do not implement the full GraphSave/WorkSave design, change dependency semantics, reconcile the formal task's false Failed projection, modify Lean, or broaden daemon planner scope.

Validation

Focused commands::done tests prove all four worktree/root cases above.
Reproduce the incident in an isolated graph/worktree smoke: committed deliverables present only in the worker worktree pass brokered completion preflight without copying to root.
Missing worktree deliverable remains a hard refusal.
cargo fmt --check, focused tests, cargo check, and cargo clippy pass.
Existing tests/smoke/scenarios/exited_worker_finish_convergence.sh still passes.

Fix the self-hosting completion defect reproduced by `design-atomic-graph-work-save`: a capability-brokered worker has an authenticated retained worktree and committed deliverables there, but `done::run_inner` runs `deliverables::preflight` against the graph project root and falsely reports the deliverables missing. Commit `9774eed0` propagates brokered worktree context for finalization, but preflight still ignores it.

Add focused regression tests covering:
- brokered task with deliverable present only in retained worktree passes preflight and proceeds through the task-owned path;
- same deliverable absent in retained worktree is refused even if a stale copy exists at graph root;
- ordinary human/root completion retains existing graph-root behavior;
- authenticated context mismatch fails closed;
- lost/replayed broker request remains idempotent if relevant to the touched path.

Use the completed design attempt as the incident trace: task `design-atomic-graph-work-save`, agent-966, branch commit `1e4aca27`, where both declared deliverables exist and are committed but `wg done` refused them from the graph root. Do not modify or clean that worktree; it will be retried after this repair lands.

Non-goals: do not implement the full GraphSave/WorkSave design, change dependency semantics, reconcile the formal task's false Failed projection, modify Lean, or broaden daemon planner scope.

## Validation
- Focused `commands::done` tests prove all four worktree/root cases above.
- Reproduce the incident in an isolated graph/worktree smoke: committed deliverables present only in the worker worktree pass brokered completion preflight without copying to root.
- Missing worktree deliverable remains a hard refusal.
- `cargo fmt --check`, focused tests, `cargo check`, and `cargo clippy` pass.
- Existing `tests/smoke/scenarios/exited_worker_finish_convergence.sh` still passes.

Depends on

done .assign-fix-brokered-deliverable-preflight-worktree

Required by

(none)

✉ Messages 4 messages (4 unread)

#1fix-brokered-deliverable-preflight-worktree2026-08-02T22:12:18.392283200+00:00read

Completion is blocked only by the new smoke's initially-integrated script requiring WG_BIN in the long-running daemon environment. Latest pushed commits make the smoke self-resolving and it passes manually, but the graph root is pinned at initial 55d2b6cb until finalization. Please restart/reload the daemon with WG_BIN=/home/bot/.cargo/bin/wg or fast-forward the already-integrated source to 922554a9+, then I can rerun the hard gate.

#2fix-brokered-deliverable-preflight-worktree2026-08-03T05:32:49.975120964+00:00read

Acknowledged the queued bootstrap note. I integrated the prior branch's self-resolving smoke corrections into this retained branch; the corrected owned smoke now passes with the installed candidate. I will complete through the broker once the currently busy coordinator responds.

#3fix-brokered-deliverable-preflight-worktree2026-08-03T05:35:03.641105790+00:00read

Completion bootstrap remains: graph-root main still has initial 55d2b6cb smoke, while corrected self-resolving script is pushed on origin/wg/agent-968/... at ccf51d90. The live daemon has no WG_BIN in /proc env, so owned gate cannot pass until operator fast-forwards the script correction or restarts/reloads with WG_BIN=/home/bot/.cargo/bin/wg. I will not mutate main or bypass the gate.

#4fix-brokered-deliverable-preflight-worktree2026-08-03T06:09:20.108823697+00:00read

Acknowledged all queued bootstrap notes — operator restart now supplies WG_BIN; I am validating the retained corrected smoke and will retry the hard gate.

Log

2026-08-02T21:16:00.044929897+00:00 Task paused
2026-08-02T21:16:00.168675131+00:00 Task published
2026-08-02T21:16:07.955390403+00:00 Lightweight assignment: agent=Pi Lifecycle Hotfix Programmer (fbb2d89f), exec_mode=full, context_scope=full, reason=Lifecycle-focused programmer with a containment-oriented tradeoff is the closest fit for this correctness-critical brokered completion hotfix and its focused regression tests.
2026-08-02T21:16:09.117841913+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-08-02T21:16:28.583208927+00:00 Starting containment repair; message read attempted but service returned no response. Inspecting prior WIP and completion/preflight paths.
2026-08-02T21:47:53.463140622+00:00 Implemented exact brokered worktree/root/task validation and bound deliverable preflight plus finalization to the retained root. Added focused root/worktree/mismatch tests, broker request replay recovery, and a real-daemon Fake-Pi smoke; new smoke passes.
2026-08-02T22:03:58.396685008+00:00 Validated: focused commands::done brokered present/missing/root/mismatch tests pass; worker request stale-owner replay test passes; new real-daemon Fake-Pi brokered_deliverable_worktree_preflight smoke passes; exited_worker_finish_convergence smoke passes; cargo fmt --check, cargo check, cargo clippy, cargo build, and cargo install --path . --locked pass. Full cargo test exposed pre-existing unrelated profile/add/fail/recover/TUI expectation failures; representative profile failure passes in isolation.
2026-08-02T22:03:58.535727265+00:00 Committed and pushed: 55d2b6cb
2026-08-02T22:05:03.397108212+00:00 Bounded evaluator infrastructure state error[WG-EVAL-INSUFFICIENT-EVIDENCE]: bounded evidence insufficient [candidate-manifest:candidate-manifest:truncated,candidate-source:candidate-source:truncated,declared-artifact:declared-artifact-000:truncated,declared-artifact:declared-artifact-001:truncated,declared-artifact:declared-artifact-002:truncated,declared-artifact:declared-artifact-003:truncated,declared-artifact:declared-artifact-004:truncated,declared-artifact:declared-artifact-005:truncated] without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-02T22:05:34.349853017+00:00 Deep FLIP infrastructure failed closed without source/config/repository mutation: error[WG-DEEP-REPORT-SCHEMA]: strict deep report rejected: missing field `latent_intent_probe_code` at line 1 column 1714
2026-08-02T22:05:37.231586806+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-02T22:06:12.183648265+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-02T22:14:06.675660887+00:00 BLOCKED AT COMPLETION: the first lost-response done attempt integrated functional commit 55d2b6cb into main before later smoke-script corrections. Main therefore contains the initial smoke that requires daemon env WG_BIN; the long-running daemon lacks it, so every hard-gate retry exits 1 before task-owned finalization can integrate the self-resolving script. Latest a157a370 passes the smoke manually and is pushed. This is a bootstrap/operator-authority deadlock; worker control correctly refuses daemon restart and skip-smoke.
2026-08-02T22:14:07.261180262+00:00 Task marked as failed: Implementation and all task-specific validation are complete and pushed at a157a370, but the smoke hard gate is bootstrap-deadlocked on the partially integrated initial script in main (55d2b6cb): it requires WG_BIN absent from the existing daemon. Latest script self-resolves and passes manually, but cannot integrate until the same gate passes. Requires operator daemon restart with WG_BIN or fast-forward of the pushed branch; agent correctly did not bypass worker authority or skip smoke.
2026-08-03T05:19:40.833021381+00:00 Task reset for retry from failed (attempt #2) — reason: Resume exact preserved session to finalize already-pushed post-promotion smoke corrections after installing the landed broker fix and restarting the daemon.
2026-08-03T05:19:49.079259739+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-08-03T05:32:40.016431635+00:00 Recovered prior implementation, integrated the self-resolving smoke corrections through ccf51d90, installed the candidate binary, and resumed validation.
2026-08-03T05:32:58.308762251+00:00 Validated focused done cases: brokered retained-worktree success, stale graph-root refusal, human graph-root behavior, authenticated mismatch fail-closed; broker request replay test passes.
2026-08-03T05:33:00.480931340+00:00 Validated isolated brokered_deliverable_worktree_preflight smoke PASS and exited_worker_finish_convergence smoke PASS under a clean smoke environment; cargo fmt --check, cargo check, and cargo clippy pass (baseline warnings only).
2026-08-03T05:33:02.628400273+00:00 Pushed branch at ccf51d90; cargo install --path . --locked completed.
2026-08-03T05:34:27.346964399+00:00 Validated: cargo build passes (baseline warnings only).
2026-08-03T05:36:22.136620795+00:00 Hard-gate retry confirmed the bootstrap defect: owned scenario brokered_deliverable_worktree_preflight exits 1 from graph-root main's initial script. Corrected script at ccf51d90 passes manually, but cannot integrate until the same gate passes; live daemon environment has no WG_BIN. Operator fast-forward/restart requested; no bypass attempted.
2026-08-03T05:36:43.428094700+00:00 Task marked as failed: Implementation and all required validation are complete and pushed at ccf51d90 (functional source already integrated on main at 55d2b6cb). Completion is bootstrap-deadlocked: graph-root main's initial owned smoke requires WG_BIN, but the live daemon environment has no WG_BIN, so wg done hard-gate exits 1 before task-owned finalization can integrate the self-resolving smoke corrections. Corrected smoke passes manually; focused tests, replay test, cargo fmt/check/build/clippy, and exited_worker_finish_convergence all pass. Requires operator fast-forward/cherry-pick of the smoke-only corrections or daemon restart with WG_BIN. I attempted the hard gate and did not bypass worker authority, mutate main, or skip smoke.
2026-08-03T06:08:42.270068903+00:00 Task reset for retry from failed (attempt #3) — reason: Resume retained worktree after operator restarted daemon with explicit WG_BIN to break the owned-smoke bootstrap cycle.
2026-08-03T06:08:44.714329775+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-08-03T06:09:22.157673147+00:00 Operator restarted daemon with explicit WG_BIN; retained branch is clean at ccf51d90 and differs from main only by the self-resolving smoke correction. Retrying validation and completion gate.
2026-08-03T06:09:58.827584683+00:00 Task marked as failed: Provider failure detected after streaming: provider-unavailable