fix-pi-native-progress-session-proof — WorksGood live mirror

Metadata

Status	done
Assigned	`agent-921`
Model	`pi:openai-codex:gpt-5.6-sol`
Created	2026-07-27T21:08:32.802600940+00:00
Started	2026-07-27T22:21:27.681554099+00:00
Completed	2026-07-27T23:43:21.622203046+00:00
Tokens	21783581 in / 38210 out

Description

Objective

Fix the false-stuck Pi monitoring and duplicate-session proof defect exposed by implement-strong-agent attempt attempt-0-19. Status/TUI must report bounded native activity from Pi events and exact continuation must resolve the substantive journal unambiguously.

Incident evidence

raw_stream.jsonl contained more than 1,500 message/turn/tool events and exceeded 12 MiB while watchdog status remained phase=Unknown, progress_seq=0, event_seq=0, no tool, no token activity, and 17+ minutes of alleged silence.
The session directory contained both a 146-byte wg_<session>.jsonl bootstrap header and a growing substantive timestamped journal for the same session ID; watchdog pinned the header-only path/leaf.
This duplicates the earlier implement-crash-safe exact-session ambiguity that required archival reconciliation.

Requirements

Establish one canonical session journal/leaf per launch. If Pi creates a bootstrap header plus substantive journal, select and attest the substantive append-only journal deterministically; preserve bootstrap bytes as evidence without treating them as a second resumable session.
Reject genuinely ambiguous multiple substantive journals fail-closed. Do not delete or silently rewrite session evidence.
Bridge Pi NDJSON message/turn/tool/usage activity into watchdog native_activity and monotonic progress/activity counters in real time, including current bounded tool label/class, child/receipt state, output/thinking activity counts, and Pi usage receipts.
Never expose raw chain-of-thought or attacker-controlled content in status/TUI; only bounded labels, counts, timestamps, and digests.
Make soft suspicion depend on the ratified meaningful-progress classes while clearly showing live-but-unproven native activity; total runtime is still not a deadline.
Exact-session continuation must preserve session ID, route, worktree, attempt/fence/lease, and the attested substantive leaf.

Validation

Fake-Pi emits a bootstrap header, substantive journal, text/thinking/tool/usage events, and a long build tool; status/TUI updates live with monotonic bounded counts and does not call it silent.
One header-only plus one substantive journal resumes exactly; two substantive matches refuse loudly; no bytes are deleted.
Restart/replay deduplicates repeated stream snapshots and usage receipts without resetting progress or double-counting cost.
No raw reasoning or unbounded payload appears in JSON/text/TUI status.
Existing Pi watchdog human flow, exact-session continuation, crash-safe finalization, accounting, and plugin smokes pass.
cargo fmt --check, cargo clippy, focused/full tests and owned smoke pass; commit/push and wg done complete normally.

## Objective
Fix the false-stuck Pi monitoring and duplicate-session proof defect exposed by `implement-strong-agent` attempt `attempt-0-19`. Status/TUI must report bounded native activity from Pi events and exact continuation must resolve the substantive journal unambiguously.

## Incident evidence
- `raw_stream.jsonl` contained more than 1,500 message/turn/tool events and exceeded 12 MiB while watchdog status remained `phase=Unknown`, `progress_seq=0`, `event_seq=0`, no tool, no token activity, and 17+ minutes of alleged silence.
- The session directory contained both a 146-byte `wg_<session>.jsonl` bootstrap header and a growing substantive timestamped journal for the same session ID; watchdog pinned the header-only path/leaf.
- This duplicates the earlier `implement-crash-safe` exact-session ambiguity that required archival reconciliation.

## Requirements
- Establish one canonical session journal/leaf per launch. If Pi creates a bootstrap header plus substantive journal, select and attest the substantive append-only journal deterministically; preserve bootstrap bytes as evidence without treating them as a second resumable session.
- Reject genuinely ambiguous multiple substantive journals fail-closed. Do not delete or silently rewrite session evidence.
- Bridge Pi NDJSON message/turn/tool/usage activity into watchdog `native_activity` and monotonic progress/activity counters in real time, including current bounded tool label/class, child/receipt state, output/thinking activity counts, and Pi usage receipts.
- Never expose raw chain-of-thought or attacker-controlled content in status/TUI; only bounded labels, counts, timestamps, and digests.
- Make soft suspicion depend on the ratified meaningful-progress classes while clearly showing live-but-unproven native activity; total runtime is still not a deadline.
- Exact-session continuation must preserve session ID, route, worktree, attempt/fence/lease, and the attested substantive leaf.

## Validation
- [ ] Fake-Pi emits a bootstrap header, substantive journal, text/thinking/tool/usage events, and a long build tool; status/TUI updates live with monotonic bounded counts and does not call it silent.
- [ ] One header-only plus one substantive journal resumes exactly; two substantive matches refuse loudly; no bytes are deleted.
- [ ] Restart/replay deduplicates repeated stream snapshots and usage receipts without resetting progress or double-counting cost.
- [ ] No raw reasoning or unbounded payload appears in JSON/text/TUI status.
- [ ] Existing Pi watchdog human flow, exact-session continuation, crash-safe finalization, accounting, and plugin smokes pass.
- [ ] `cargo fmt --check`, `cargo clippy`, focused/full tests and owned smoke pass; commit/push and `wg done` complete normally.

Depends on

done fix-observer-ignored-churn-resource-leak

Required by

done implement-lazy-evaluation

Log

2026-07-27T21:08:32.776296744+00:00 Task paused
2026-07-27T21:08:33.572894057+00:00 Task published
2026-07-27T22:20:21.263457673+00:00 Spawn preparation deferred before launch permit; rollback is complete and no circuit-breaker charge was recorded. Repair the reported checkout/configuration condition and retry: spawn transaction for agent-921 rolled back (task remains dispatchable; rollback diagnostics: complete): failed to establish isolated-worktree observer baseline: observer source tuple mismatch
2026-07-27T22:21:30.010078780+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-07-27T22:21:50.628741378+00:00 Starting direct implementation: tracing Pi stream ingestion, watchdog activity state, and exact-session journal selection; worktree is clean with no prior WIP.
2026-07-27T23:20:30.745786232+00:00 Implemented canonical substantive Pi journal selection with ambiguity refusal, live native NDJSON follower/cursors, bounded status/TUI activity projection, usage dedupe, and focused Fake-Pi smoke. Focused watchdog and exact-session tests pass; new installed-binary native smoke passes. Plain cargo clippy passes (repository warnings remain).
2026-07-27T23:34:49.400598867+00:00 Committed: 31fb940e — pushed to remote
2026-07-27T23:42:01.612725257+00:00 Validated: focused integration_pi_watchdog 15/15, live_progress 5/5, exact-session resolver test, cargo build, cargo fmt --check, plain cargo clippy, and cargo install --locked pass.
2026-07-27T23:42:01.675567620+00:00 Validated human flows: owned native-activity/session-proof and tmux TUI smokes pass; existing Pi watchdog human flow, stream accounting bridge, and plugin load contract pass; credentialed plugin live validation skipped because credentials are absent.
2026-07-27T23:42:01.741039706+00:00 Full cargo test -- --test-threads=1: library suites pass; wg binary reports the dependency-documented 3830 pass / 25 unrelated pre-existing failures (legacy route, fail-attempt, provenance/recover, concurrent spawn observer tests).
2026-07-27T23:42:02.615948533+00:00 Implementation committed and pushed as 31fb940e to origin/wg/agent-921/fix-pi-native-progress-session-proof.
2026-07-27T23:43:21.622203426+00:00 Task marked as done