flip-first-required-gate — WorksGood live mirror

Metadata

Status	done
Assigned	`agent-930`
Model	`pi:openai-codex:gpt-5.6-sol`
Created	2026-07-28T13:40:52.155345177+00:00
Started	2026-07-28T14:57:46.468780317+00:00
Completed	2026-07-28T15:46:48.417054263+00:00
Tokens	30167853 in / 48138 out

Description

Product decision

Deep read-only system FLIP is the primary and required feedback signal for real coding work. A candidate must not merge merely because deterministic validation or a bounded grader passes. The authoritative order is:

completion receipt → immutable candidate → deterministic validation → deep read-only FLIP → accepted FLIP verdict → merge → Done

Bounded evaluation is optional/secondary and must neither precede, dilute, average with, nor be required for FLIP. This supersedes the prior bounded-advisory-first rollout policy.

Required policy semantics

Managed rollout must support a FLIP-first required stage. In that stage auto_evaluate=false is valid, bounded records are absent unless separately requested, global deep FLIP selection is enabled for every qualifying real source candidate, and eval_gate_all remains irrelevant/false.
Decouple deep gate selection from bounded selection. A deep-only EvaluationGatePolicy must exist and be snapshotted before completion; current logic that returns no gate when bounded is absent must be corrected.
Qualifying sources: actual worker-produced immutable candidates for ordinary coding/structural tasks. Exclude system/meta/evaluation tasks, drafts/unpublished work, never-ran/preparation-failed/cancelled/skipped/abandoned/waiting/message-only/reconciliation-only work, explicit shell/exec tasks, stale generations, and candidates without current-epoch completion+validation proof.
The only acceptable product is the observation-only deep-readonly FLIP lane, not legacy shallow summary roundtrip or bounded grading masquerading as FLIP.
Pass requires a valid candidate-bound report, exact route/policy/evidence bindings, observation-only capability audit, required evidence coverage, semantic Pass, and score at/above the snapshotted FLIP threshold. Only then may exact candidate merge proceed.
Semantic fail/below-threshold supplies AcceptanceRejected: do not merge; preserve the successful source attempt, candidate, validation, report, and worktree/rescue evidence. Project an explicit RepairNeeded/AwaitingAcceptance state with exact operator/repair next actions.
Timeout, malformed output, unavailable credentials/adapter, route drift, crash, or missing evidence are infrastructure failures, never semantic rejection. Keep the candidate in AwaitingAcceptance, consume only the evaluation retry budget, and never reopen/retry/fail/complete the source attempt.
No cross-runtime/model fallback. A selected Pi route failure remains visible.
First accepted verdict wins under source generation/attempt/fence/candidate/policy CAS; later or stale verdicts are immutable evidence only. Restart/replay must never re-invoke after a valid report or merge twice.
Any waiver is explicit, content-bound, operator-attributed and audited; no silent promotion.

Rollout correction

Replace/extend the managed controller so it can prove and enter flip-required without first enabling bounded automatic evaluation.
Ordered gate evidence must include: credential-free Fake-Pi pass, semantic reject, infrastructure failure/retry, restart at every boundary, and one live low-risk Luna gate canary when the exact route is available.
The live canary must prove main remains unchanged while FLIP is pending, advances exactly once on pass, and remains unchanged on reject/unavailable.
Rollback atomically returns FLIP selection/gating to disabled while preserving reports/candidates and never changing already accepted source history.
Do not enable the live project gate from inside an unmerged worker candidate. Produce an explicit, copy-pasteable operator activation command/evidence plan for the chat operator to run only after exact-main install.

Feedback and repair visibility

wg show, stable JSON, status, TUI selected-task detail, and ⌂ Activity must distinguish FLIP queued/running, waiting on required FLIP, FLIP rejected—repair needed, FLIP infrastructure unavailable, and FLIP passed—merging with relative/system times and candidate/report IDs.
Surface structured latent-intent, counterfactual, cross-component, and evidence-reference codes safely; never raw chain-of-thought, prompts, secrets, or attacker-controlled unbounded text.
A rejected candidate must expose deterministic commands to inspect the report, retry only FLIP, request candidate repair/retry under policy, or issue an audited waiver. No message or late event may resurrect source execution.

Validation

RED test proves today a deep-only policy cannot gate because gate construction depends on bounded selection and managed rollout forbids global FLIP.
With bounded auto-evaluation off, a qualifying candidate remains unmerged while required deep FLIP is queued/running and merges exactly once only after a valid passing report.
Semantic fail/below threshold never changes main and projects retained RepairNeeded/AcceptanceRejected with inspect/repair actions.
Timeout, malformed, unavailable, route drift and crash never merge or source-retry; exact evaluation retry/restart converges.
Never-ran/excluded/stale candidates create no FLIP work and cannot block unrelated graph work.
Fake-Pi proves observation-only tools, full evidence classes, latent/counterfactual/cross-system findings, no source/config/graph/session mutation, no worker/build/worktree slot use, and no fallback.
Restart before/after candidate, report write, verdict link, acceptance consume and merge yields one report/verdict/merge with no duplicate cost.
Real candidate-binary daemon + terminal/TUI human-flow smoke demonstrates pass/reject/unavailable and legible Activity progress.
Live low-risk Luna gate canary records content-addressed evidence and leaves the gate disabled in this live project pending operator activation from accepted main.
Existing lazy, bounded, deep, finalization, strong-merge, watchdog, observer, Activity and native Codex smokes pass.
cargo fmt --check, cargo clippy, focused/full tests and owned smoke pass; commit/push and wg done finalize normally.

## Product decision
Deep read-only system FLIP is the primary and required feedback signal for real coding work. A candidate must not merge merely because deterministic validation or a bounded grader passes. The authoritative order is:

`completion receipt → immutable candidate → deterministic validation → deep read-only FLIP → accepted FLIP verdict → merge → Done`

Bounded evaluation is optional/secondary and must neither precede, dilute, average with, nor be required for FLIP. This supersedes the prior bounded-advisory-first rollout policy.

## Required policy semantics
- Managed rollout must support a **FLIP-first required** stage. In that stage `auto_evaluate=false` is valid, bounded records are absent unless separately requested, global deep FLIP selection is enabled for every qualifying real source candidate, and `eval_gate_all` remains irrelevant/false.
- Decouple deep gate selection from bounded selection. A deep-only `EvaluationGatePolicy` must exist and be snapshotted before completion; current logic that returns no gate when bounded is absent must be corrected.
- Qualifying sources: actual worker-produced immutable candidates for ordinary coding/structural tasks. Exclude system/meta/evaluation tasks, drafts/unpublished work, never-ran/preparation-failed/cancelled/skipped/abandoned/waiting/message-only/reconciliation-only work, explicit shell/exec tasks, stale generations, and candidates without current-epoch completion+validation proof.
- The only acceptable product is the observation-only **deep-readonly FLIP** lane, not legacy shallow summary roundtrip or bounded grading masquerading as FLIP.
- Pass requires a valid candidate-bound report, exact route/policy/evidence bindings, observation-only capability audit, required evidence coverage, semantic `Pass`, and score at/above the snapshotted FLIP threshold. Only then may exact candidate merge proceed.
- Semantic fail/below-threshold supplies `AcceptanceRejected`: do not merge; preserve the successful source attempt, candidate, validation, report, and worktree/rescue evidence. Project an explicit `RepairNeeded`/`AwaitingAcceptance` state with exact operator/repair next actions.
- Timeout, malformed output, unavailable credentials/adapter, route drift, crash, or missing evidence are infrastructure failures, never semantic rejection. Keep the candidate in `AwaitingAcceptance`, consume only the evaluation retry budget, and never reopen/retry/fail/complete the source attempt.
- No cross-runtime/model fallback. A selected Pi route failure remains visible.
- First accepted verdict wins under source generation/attempt/fence/candidate/policy CAS; later or stale verdicts are immutable evidence only. Restart/replay must never re-invoke after a valid report or merge twice.
- Any waiver is explicit, content-bound, operator-attributed and audited; no silent promotion.

## Rollout correction
- Replace/extend the managed controller so it can prove and enter `flip-required` without first enabling bounded automatic evaluation.
- Ordered gate evidence must include: credential-free Fake-Pi pass, semantic reject, infrastructure failure/retry, restart at every boundary, and one live low-risk Luna gate canary when the exact route is available.
- The live canary must prove main remains unchanged while FLIP is pending, advances exactly once on pass, and remains unchanged on reject/unavailable.
- Rollback atomically returns FLIP selection/gating to disabled while preserving reports/candidates and never changing already accepted source history.
- Do not enable the live project gate from inside an unmerged worker candidate. Produce an explicit, copy-pasteable operator activation command/evidence plan for the chat operator to run only after exact-main install.

## Feedback and repair visibility
- `wg show`, stable JSON, status, TUI selected-task detail, and `⌂ Activity` must distinguish `FLIP queued/running`, `waiting on required FLIP`, `FLIP rejected—repair needed`, `FLIP infrastructure unavailable`, and `FLIP passed—merging` with relative/system times and candidate/report IDs.
- Surface structured latent-intent, counterfactual, cross-component, and evidence-reference codes safely; never raw chain-of-thought, prompts, secrets, or attacker-controlled unbounded text.
- A rejected candidate must expose deterministic commands to inspect the report, retry only FLIP, request candidate repair/retry under policy, or issue an audited waiver. No message or late event may resurrect source execution.

## Validation
- [ ] RED test proves today a deep-only policy cannot gate because gate construction depends on bounded selection and managed rollout forbids global FLIP.
- [ ] With bounded auto-evaluation off, a qualifying candidate remains unmerged while required deep FLIP is queued/running and merges exactly once only after a valid passing report.
- [ ] Semantic fail/below threshold never changes main and projects retained `RepairNeeded`/`AcceptanceRejected` with inspect/repair actions.
- [ ] Timeout, malformed, unavailable, route drift and crash never merge or source-retry; exact evaluation retry/restart converges.
- [ ] Never-ran/excluded/stale candidates create no FLIP work and cannot block unrelated graph work.
- [ ] Fake-Pi proves observation-only tools, full evidence classes, latent/counterfactual/cross-system findings, no source/config/graph/session mutation, no worker/build/worktree slot use, and no fallback.
- [ ] Restart before/after candidate, report write, verdict link, acceptance consume and merge yields one report/verdict/merge with no duplicate cost.
- [ ] Real candidate-binary daemon + terminal/TUI human-flow smoke demonstrates pass/reject/unavailable and legible Activity progress.
- [ ] Live low-risk Luna gate canary records content-addressed evidence and leaves the gate disabled in this live project pending operator activation from accepted main.
- [ ] Existing lazy, bounded, deep, finalization, strong-merge, watchdog, observer, Activity and native Codex smokes pass.
- [ ] `cargo fmt --check`, `cargo clippy`, focused/full tests and owned smoke pass; commit/push and `wg done` finalize normally.

Depends on

done integrate-and-canary

Required by

Log

2026-07-28T13:40:52.126993276+00:00 Task paused
2026-07-28T13:40:52.217884743+00:00 Task published
2026-07-28T13:40:53.513446120+00:00 Spawn preparation deferred before launch permit; rollback is complete and no circuit-breaker charge was recorded. Repair the reported checkout/configuration condition and retry: spawn transaction for agent-929 rolled back (task remains dispatchable; rollback diagnostics: complete): failed to establish isolated-worktree observer baseline: observer source tuple mismatch
2026-07-28T13:43:18.937046509+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-07-28T13:43:33.744504512+00:00 Starting implementation: inspecting prior integration and current deep/bounded gate coupling before writing RED coverage.
2026-07-28T13:47:23.461270691+00:00 RED confirmed: deep-only managed selection cannot construct EvaluationGatePolicy because gate_policy returns None when bounded selection is absent (test exit=101).
2026-07-28T14:57:45.100035357+00:00 Task reset for retry from in-progress (attempt #1) — reason: Recover exact preserved Pi session/worktree after four consecutive provider errors; wrapper finalization was rejected stale_process_identity; no source completion inferred
2026-07-28T14:57:46.685631230+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-07-28T14:58:01.864358063+00:00 Starting implementation: inspecting prior WIP, deep gate construction, managed rollout, and validation coverage.
2026-07-28T15:28:23.238499604+00:00 Implemented deep-only required gate, exact source/policy/route CAS, retained RepairNeeded finalization, explicit audited waiver, FLIP-first rollout/rollback, safe show/status/TUI/Activity projections, and Fake-Pi pass/reject/unavailable coverage. Focused tests and owned smokes pass; continuing regression validation.
2026-07-28T15:34:11.229734453+00:00 Validation: cargo fmt/check and plain cargo clippy pass; focused deep/lazy/candidate tests pass; owned flip-first + rollout smokes pass; existing lazy/bounded/deep/finalization/strong-merge/observer/Activity/native-Codex smokes pass; watchdog smoke passed when rerun alone after parallel interference. Full cargo test: 3023 passed, 36 ignored, 7 pre-existing profile::named env/lock poison failures matching dependency baseline; no FLIP/evaluation/finalization failure.
2026-07-28T15:45:00.603828684+00:00 Committed: 11b4bdcb — pushed to remote. Global binaries updated via cargo install --path . --locked; live project gate remains disabled and operator activation plan is docs/reports/flip-required-luna-gate-canary-plan.json.
2026-07-28T15:46:48.417054553+00:00 Task marked as done