fix-nonsemantic-failed-dependency-convergence

Converge non-semantic failed prerequisites without silent graph halt

Metadata

Statusdone
Agent identityfbb2d89fe44d6b761bcb4b67748ab3d417f29df70a65f8d9403308f5bb2bab78
Created2026-08-03T18:42:48.760718123+00:00
Started2026-08-03T19:38:58.753525074+00:00
Completed2026-08-03T22:04:37.439118076+00:00
Tagsatomic-save, lifecycle, replay
Tokens2151471 in / 6048 out

Description

The live atomic-save rollout exposed a correctness hole after the deterministic planner landed: an open synthesis task had only failed prerequisites, wg ready returned no work, no owner was live, and no scheduled convergence action existed. The failures were non-semantic infrastructure/source failures: (1) provider-unavailable after streaming with a committed three-commit candidate and a temporary finish-lease conflict, (2) orphan reconciliation before any worker/session/worktree existed, and (3) source execution failure before model progress.

Extend the pure planner and production convergence adapter so non-semantic failure classes preserve exact WIP/session evidence and deterministically produce either a bounded scheduled retry or an explicit actionable NeedsReconciliation state. A failed prerequisite must never leave unfinished descendants silently open with no owner, runnable action, external wait, or durable deadline. Semantic validation rejection remains terminal and must never be auto-retried or reclassified. Seed versioned Lean/Rust replay fixtures from these exact three incidents and require byte-identical planner/replay outcomes.

Validation

  • Lean proves the descendant exhaustiveness property under typed failure classification assumptions, with no sorry, admit, unsafe, or hidden axioms.
  • Rust/Lean conformance fixtures cover provider failure after durable candidate, zero-progress source failure, orphan-before-spawn, and true semantic rejection.
  • Property tests show non-semantic failure yields one bounded retry/reconciliation action while semantic rejection never retries.
  • Candidate-binary smoke proves an unfinished descendant cannot remain silently blocked after all live owners exit.
  • cargo fmt --check; cargo check; focused planner/convergence tests; (cd formal && lake build).

Depends on

Required by

Log