fix-candidate-wg-control-plane-destruction

Metadata

Status	done
Agent identity	`02e879681e52e0a384106169be043416c4d946e850ab26b2269c57681b52a6e7`
Created	2026-08-01T08:02:49.686316922+00:00
Started	2026-08-01T12:27:03.851215324+00:00
Completed	2026-08-03T09:42:51.240485147+00:00
Tokens	24170318 in / 50498 out

Description

CRITICAL DATA-LOSS BUG observed on erikg@lambda01:/home/erikg/phind on 2026-07-31 22:32 UTC. A worker worktree (agent-226, task build-partition-stitching) created a .wg symlink pointing to /home/erikg/phind/.wg so worker commands could reach the graph. Commit 9f9a440 accidentally added that symlink (create mode 120000 .wg). Task-owned finalization then promoted rescue/main commit 2f991af; the root working tree transition replaced/stripped the live .wg control plane. graph.jsonl, config.toml, historical chat/session directories, messages, logs, and most control state vanished, while runtime-created agents/attempts/chat/finalization/service subdirectories were recreated. The live TUI continued showing its cached graph; every graph mutation failed with Failed to save graph. Evidence is preserved remotely under /home/erikg/phind/.wg/recovery/incident-20260801; daemon stopped, orphan observers SIGSTOP-frozen, live TUI PID 1210893 preserved.

Implement an unskippable control-plane boundary:

.wg (file, dir, symlink, gitlink, path prefix, case/normalization variants) must never be included in worker candidate/rescue manifests, staged commits, validation materialization, merge projection, or promotion. Reject loudly before candidate sealing if worker changes/adds/deletes it.
Worktree setup may expose graph access only through explicitly out-of-band runtime plumbing; its helper symlink must be untrackable/uncommittable and never projected to source.
Protected-ref promotion must update only exact allowed candidate paths and must never use checkout/reset/tree application semantics that can replace the live project .wg. This must hold even if .wg is already tracked in candidate/base history.
Before any root worktree/ref operation, assert canonical .wg identity/type and preserve a durable external snapshot/receipt of graph+chat registry sufficient for rollback. Fail closed on self-referential or changed control path.
Detect and stop a project whose Git index/tree contains .wg, with a recovery command that removes the tracked entry without touching live control data.
Add diagnostics that retain full I/O cause (Failed to save graph: ENOENT path=...) rather than stripping the chain.

Validation

Reproduce agent worktree adding a self-referential .wg symlink, commit it, submit Land: candidate sealing/promotion must refuse; root graph/config/chat bytes unchanged.
Test .wg directory/file/symlink/gitlink deletion/replacement, nested .wg/**, normalization variants, and base history already tracking .wg.
Crash/restart around candidate checkpoint/ref CAS/root projection cannot alter control-plane bytes.
Verify ordinary source changes still land and worker graph access works out of band.
Add candidate-binary smoke using two isolated graphs and exact byte digests for graph/config/chat sessions before/after.
cargo fmt --check, focused finalization/worktree/spawn/chat tests, cargo check, cargo clippy.

CRITICAL DATA-LOSS BUG observed on `erikg@lambda01:/home/erikg/phind` on 2026-07-31 22:32 UTC. A worker worktree (`agent-226`, task `build-partition-stitching`) created a `.wg` symlink pointing to `/home/erikg/phind/.wg` so worker commands could reach the graph. Commit `9f9a440` accidentally added that symlink (`create mode 120000 .wg`). Task-owned finalization then promoted rescue/main commit `2f991af`; the root working tree transition replaced/stripped the live `.wg` control plane. `graph.jsonl`, `config.toml`, historical chat/session directories, messages, logs, and most control state vanished, while runtime-created `agents/attempts/chat/finalization/service` subdirectories were recreated. The live TUI continued showing its cached graph; every graph mutation failed with `Failed to save graph`. Evidence is preserved remotely under `/home/erikg/phind/.wg/recovery/incident-20260801`; daemon stopped, orphan observers SIGSTOP-frozen, live TUI PID 1210893 preserved.

Implement an unskippable control-plane boundary:
- `.wg` (file, dir, symlink, gitlink, path prefix, case/normalization variants) must never be included in worker candidate/rescue manifests, staged commits, validation materialization, merge projection, or promotion. Reject loudly before candidate sealing if worker changes/adds/deletes it.
- Worktree setup may expose graph access only through explicitly out-of-band runtime plumbing; its helper symlink must be untrackable/uncommittable and never projected to source.
- Protected-ref promotion must update only exact allowed candidate paths and must never use checkout/reset/tree application semantics that can replace the live project `.wg`. This must hold even if `.wg` is already tracked in candidate/base history.
- Before any root worktree/ref operation, assert canonical `.wg` identity/type and preserve a durable external snapshot/receipt of graph+chat registry sufficient for rollback. Fail closed on self-referential or changed control path.
- Detect and stop a project whose Git index/tree contains `.wg`, with a recovery command that removes the tracked entry without touching live control data.
- Add diagnostics that retain full I/O cause (`Failed to save graph: ENOENT path=...`) rather than stripping the chain.

## Validation
- Reproduce agent worktree adding a self-referential `.wg` symlink, commit it, submit Land: candidate sealing/promotion must refuse; root graph/config/chat bytes unchanged.
- Test `.wg` directory/file/symlink/gitlink deletion/replacement, nested `.wg/**`, normalization variants, and base history already tracking `.wg`.
- Crash/restart around candidate checkpoint/ref CAS/root projection cannot alter control-plane bytes.
- Verify ordinary source changes still land and worker graph access works out of band.
- Add candidate-binary smoke using two isolated graphs and exact byte digests for graph/config/chat sessions before/after.
- cargo fmt --check, focused finalization/worktree/spawn/chat tests, cargo check, cargo clippy.

Depends on

done .assign-fix-candidate-wg-control-plane-destruction

Required by

(none)

Log

2026-08-01T08:02:48.825490464+00:00 Task paused
2026-08-01T08:02:53.040623507+00:00 Task published
2026-08-01T08:03:03.001302885+00:00 Lightweight assignment: agent=Careful Programmer (02e87968), exec_mode=full, context_scope=full, reason=Careful Programmer is the best fit for this correctness-critical control-plane protection task, requiring broad implementation and comprehensive validation.
2026-08-01T08:03:16.295832844+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-08-01T08:03:27.932638492+00:00 Starting implementation; inspecting prior WIP and candidate/finalization control-plane paths.
2026-08-01T12:27:02.852885380+00:00 Task fenced for retry from in-progress (attempt #1) — waiting for exact owner release — reason: Exited implementation produced validated WIP, but completion wrapper hit stale_process_identity before creating finish transaction; resume exact Pi session and existing worktree to commit, validate, and finish
2026-08-01T12:27:04.138149113+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-08-01T12:27:11.610024875+00:00 Starting implementation: auditing prior WIP and candidate/worktree/finalization paths
2026-08-01T12:42:25.444802706+00:00 Implemented and exercised centralized .wg path/tree/index boundary, out-of-band worktree graph access, exact-path ref projection, external identity/snapshot receipts, operator-only tracked-entry recovery, and full ENOENT path diagnostics. Focused control-plane/finalization/worktree tests and candidate-binary two-graph smoke pass; auditing full checks now.
2026-08-01T13:19:57.987642963+00:00 Validated: candidate-binary two-graph control_plane_candidate_boundary smoke PASS; 10/10 candidate finalization integration tests PASS; control-plane 6/6, parser 41/41, spawn 39/39, spawn-worktree 13/13, service-worktree 43/43, worktree-cmd 8/8, chat 216/216, full lib 3056/3056 PASS. cargo fmt --check, cargo check, and cargo clippy PASS. Full all-target cargo test was also attempted; only pre-existing unrelated route/lifecycle/TUI expectation failures remained, while the entire library suite passes sequentially.
2026-08-01T13:20:34.041152091+00:00 Committed: 06606ca4 — pushed to remote
2026-08-01T13:24:52.426106441+00:00 Installed exact committed candidate globally with cargo install --path . --locked; reran installed-binary two-graph smoke PASS. Working tree clean at 06606ca4.
2026-08-01T13:27:49.298704741+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-01T13:28:22.029530816+00:00 Consumed deep-readonly FLIP report deep-report-f4c740aaa4b227149c3bb95f9d90a18b220910e382cf271613d085046987caf6; observations=16 findings=4 route=b3:07cbfd6e71528de4a03ba3051159b1a811230a2a0a97c83e9fcb743edd0c2466 usage=70996in/1211out
2026-08-01T13:28:23.408513789+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-01T13:28:55.912086351+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-01T13:30:46.498850465+00:00 Post-integration validation: resolved grow-only smoke-manifest conflict by retaining both scenarios; cargo fmt --check, cargo check, 10/10 finalization integration tests, and installed-candidate control-plane smoke PASS. Pushed merge e2577aa1, promoted candidate 4e8aab7c via exact-path projection, and reinstalled latest merged source.