implement-task-owned-finish-transaction

Metadata

Status	done
Created	2026-07-31T07:59:03.094401229+00:00
Started	2026-07-31T07:59:05.226506070+00:00
Completed	2026-08-03T09:42:52.122883337+00:00
Tags	`lifecycle`, `finalization`, `evaluation`, `worktree`, `synthesis`
Tokens	45331212 in / 69802 out

Description

Implement the approved task-owned finish transaction as a coherent replacement for the current detached worker → candidate → evaluator → repair-generation → merge → later-cleanup path.

Product contract

A task has an explicit completion contract:

land: repository-changing task; success means its exact accepted commit is on main and its worktree is cleaned.
deliver: produces an immutable contribution for a parent without modifying main; success publishes a durable Git ref/artifact and cleans its worktree.
report: produces immutable read-only evidence and cleans temporary state.

A synthesis task is a land task consuming deliver inputs. Child worktrees are never synthesis storage; retain commits/refs/bundles instead.

Required implementation

Add backward-compatible typed completion contracts and dependency/input semantics. Existing ordinary source tasks default safely to land; ordinary after edges still require landed success. Delivered inputs satisfy only explicitly typed synthesis/input edges.
Make the original source agent own land completion through integration, required validation/evaluation, guarded promotion, and cleanup. Do not dispatch a merge agent or ordinary repair task on the successful path.
Add one repository-scoped, persisted, expiring finish lease fenced by task, generation, attempt, process epoch, and worktree lease. While held, no other WG-controlled operation may advance main; other workers may continue editing.
Provide a task-invoked finish protocol (names may follow existing CLI conventions): begin returns the exact current-main base and lease; submit seals the commit integrated in the task worktree, runs required gates on that exact immutable commit, and atomically promotes it if main still equals the leased base. The source agent remains live/parked and receives conflicts, rejection, or retryable infrastructure outcomes.
Preserve WG as the protected-ref authority: the task agent initiates promotion, while the guarded command verifies lease ownership, candidate binding, validation receipt, accepted required-evaluation receipt, and compare-and-swap base before changing main. No raw bypass of evaluation.
Required evaluation is a read-only service invocation bound to the exact sealed candidate, not a graph-lifecycle owner. Materialize a temporary immutable checkout/bundle; never give evaluators the mutable task worktree. Missing/unreadable/truncated evidence is structured InsufficientEvidence/unavailable infrastructure state, never semantic rejection. Bounded evaluation remains advisory where required deep FLIP applies.
Rejection returns control to the same task agent/session/worktree for repair. A changed candidate gets fresh bound validation/evaluation. Provider failure does not silently change model/executor and does not reopen or replace the source attempt.
Replace normal merge.target_moved repair-generation behavior. Internal WG main movement cannot occur under a valid finish lease. External movement fails the CAS and returns synchronization to the same agent; it is breaker-neutral and does not leave a dead in-progress owner.
Store delivered contributions and sealed candidates durably under retained Git refs/content-addressed manifests so producer worktrees can be removed immediately. A synthesis land task combines those immutable inputs in its own worktree and alone takes the finish lease near final integration.
Make cleanup part of the task transaction. After durable promotion/delivery/report receipt, the wrapper exits the cwd, removes the task worktree/temporary branch and owned build state, writes a cleanup receipt, and only then exposes fully completed state. Crash after promotion must reconcile from the merge receipt into cleanup only—never rerun source work or evaluation.
Keep detailed transaction phases in the existing finalization journal rather than multiplying user-visible graph states. User surfaces must distinguish Working, Finishing/WaitingEvaluation, and completed disposition (Landed, Delivered, Reported) and must never show a dead worker as active.
Preserve exact-session continuation, attempt/process/worktree fencing, first-terminal-event authority, immutable-candidate evidence, required-FLIP activation policy, and breaker neutrality. Reuse and simplify current finalization/evaluation/worktree infrastructure; do not build a parallel lifecycle subsystem.
If a safe conversion requires staging, create explicit blocking subtasks owned by this parent, but do not land a half-converted state with two competing merge authorities.

Core invariants

Only a land task holding the finish lease can advance main.
The promoted commit exactly matches accepted required-evaluation evidence.
The original land agent initiates promotion and handles integration conflicts.
Completed(Landed) implies a durable merge receipt and no owned worktree.
Completed(Delivered|Reported) implies durable output and no owned worktree.
Synthesis consumes immutable contributions, never live child worktrees.
A crash after main advancement can cause cleanup work only, never duplicate implementation.
No broad recovery command is required for normal target movement or cleanup.

Validation

Add a credential-free smoke with two land tasks starting from the same base. They must finish serially through the lease, both reach main, bind validation/evaluation to their exact integrated commits, create no RepairNeeded/merge.target_moved generation, retain the same source ownership, and leave no task worktrees.
Add a conflict smoke proving the original source agent resolves integration in its existing worktree; no merge/repair agent is spawned.
Add rejection and insufficient-evidence tests: rejection leaves main unchanged and returns the same agent/worktree for repair; insufficient evidence consumes only evaluation retry budget and never emits semantic rejection/source retry.
Add crash-injection tests before sealing, during evaluation, after promotion-before-status, and during cleanup. Prove lease expiry/fencing, exact-session/worktree recovery before promotion, receipt-only cleanup after promotion, and exactly-once main advancement.
Add a synthesis smoke: two deliver children publish immutable contribution refs and clean their worktrees; one synthesis land task combines them, evaluates the exact combined/current-main tree, promotes once, and cleans itself.
Assert terminal worktree invariants across unit/integration tests and wg cleanup/restart reconciliation. A successful task may not remain cleanup-pending indefinitely.
Preserve and run focused existing candidate-finalization, required deep read-only FLIP, bounded evidence-sufficiency, Pi park/resume, worktree observer, abandoned-dependency, and spawn/fencing regressions.
Run cargo fmt, cargo fmt --check, cargo clippy, focused tests/smokes, and cargo build; install with cargo install --path . --locked before live CLI validation.
Commit and push all changes and record exact validation evidence and migration notes in the task log/artifacts.

Implement the approved task-owned finish transaction as a coherent replacement for the current detached worker → candidate → evaluator → repair-generation → merge → later-cleanup path.

## Product contract

A task has an explicit completion contract:

- `land`: repository-changing task; success means its exact accepted commit is on `main` and its worktree is cleaned.
- `deliver`: produces an immutable contribution for a parent without modifying `main`; success publishes a durable Git ref/artifact and cleans its worktree.
- `report`: produces immutable read-only evidence and cleans temporary state.

A synthesis task is a `land` task consuming `deliver` inputs. Child worktrees are never synthesis storage; retain commits/refs/bundles instead.

## Required implementation

1. Add backward-compatible typed completion contracts and dependency/input semantics. Existing ordinary source tasks default safely to `land`; ordinary `after` edges still require landed success. Delivered inputs satisfy only explicitly typed synthesis/input edges.
2. Make the original source agent own `land` completion through integration, required validation/evaluation, guarded promotion, and cleanup. Do not dispatch a merge agent or ordinary repair task on the successful path.
3. Add one repository-scoped, persisted, expiring finish lease fenced by task, generation, attempt, process epoch, and worktree lease. While held, no other WG-controlled operation may advance `main`; other workers may continue editing.
4. Provide a task-invoked finish protocol (names may follow existing CLI conventions): begin returns the exact current-main base and lease; submit seals the commit integrated in the task worktree, runs required gates on that exact immutable commit, and atomically promotes it if `main` still equals the leased base. The source agent remains live/parked and receives conflicts, rejection, or retryable infrastructure outcomes.
5. Preserve WG as the protected-ref authority: the task agent initiates promotion, while the guarded command verifies lease ownership, candidate binding, validation receipt, accepted required-evaluation receipt, and compare-and-swap base before changing `main`. No raw bypass of evaluation.
6. Required evaluation is a read-only service invocation bound to the exact sealed candidate, not a graph-lifecycle owner. Materialize a temporary immutable checkout/bundle; never give evaluators the mutable task worktree. Missing/unreadable/truncated evidence is structured `InsufficientEvidence`/unavailable infrastructure state, never semantic rejection. Bounded evaluation remains advisory where required deep FLIP applies.
7. Rejection returns control to the same task agent/session/worktree for repair. A changed candidate gets fresh bound validation/evaluation. Provider failure does not silently change model/executor and does not reopen or replace the source attempt.
8. Replace normal `merge.target_moved` repair-generation behavior. Internal WG main movement cannot occur under a valid finish lease. External movement fails the CAS and returns synchronization to the same agent; it is breaker-neutral and does not leave a dead `in-progress` owner.
9. Store delivered contributions and sealed candidates durably under retained Git refs/content-addressed manifests so producer worktrees can be removed immediately. A synthesis land task combines those immutable inputs in its own worktree and alone takes the finish lease near final integration.
10. Make cleanup part of the task transaction. After durable promotion/delivery/report receipt, the wrapper exits the cwd, removes the task worktree/temporary branch and owned build state, writes a cleanup receipt, and only then exposes fully completed state. Crash after promotion must reconcile from the merge receipt into cleanup only—never rerun source work or evaluation.
11. Keep detailed transaction phases in the existing finalization journal rather than multiplying user-visible graph states. User surfaces must distinguish Working, Finishing/WaitingEvaluation, and completed disposition (`Landed`, `Delivered`, `Reported`) and must never show a dead worker as active.
12. Preserve exact-session continuation, attempt/process/worktree fencing, first-terminal-event authority, immutable-candidate evidence, required-FLIP activation policy, and breaker neutrality. Reuse and simplify current finalization/evaluation/worktree infrastructure; do not build a parallel lifecycle subsystem.
13. If a safe conversion requires staging, create explicit blocking subtasks owned by this parent, but do not land a half-converted state with two competing merge authorities.

## Core invariants

- Only a `land` task holding the finish lease can advance `main`.
- The promoted commit exactly matches accepted required-evaluation evidence.
- The original land agent initiates promotion and handles integration conflicts.
- `Completed(Landed)` implies a durable merge receipt and no owned worktree.
- `Completed(Delivered|Reported)` implies durable output and no owned worktree.
- Synthesis consumes immutable contributions, never live child worktrees.
- A crash after main advancement can cause cleanup work only, never duplicate implementation.
- No broad recovery command is required for normal target movement or cleanup.

## Validation

1. Add a credential-free smoke with two `land` tasks starting from the same base. They must finish serially through the lease, both reach main, bind validation/evaluation to their exact integrated commits, create no `RepairNeeded/merge.target_moved` generation, retain the same source ownership, and leave no task worktrees.
2. Add a conflict smoke proving the original source agent resolves integration in its existing worktree; no merge/repair agent is spawned.
3. Add rejection and insufficient-evidence tests: rejection leaves main unchanged and returns the same agent/worktree for repair; insufficient evidence consumes only evaluation retry budget and never emits semantic rejection/source retry.
4. Add crash-injection tests before sealing, during evaluation, after promotion-before-status, and during cleanup. Prove lease expiry/fencing, exact-session/worktree recovery before promotion, receipt-only cleanup after promotion, and exactly-once main advancement.
5. Add a synthesis smoke: two `deliver` children publish immutable contribution refs and clean their worktrees; one synthesis `land` task combines them, evaluates the exact combined/current-main tree, promotes once, and cleans itself.
6. Assert terminal worktree invariants across unit/integration tests and `wg cleanup`/restart reconciliation. A successful task may not remain `cleanup-pending` indefinitely.
7. Preserve and run focused existing candidate-finalization, required deep read-only FLIP, bounded evidence-sufficiency, Pi park/resume, worktree observer, abandoned-dependency, and spawn/fencing regressions.
8. Run `cargo fmt`, `cargo fmt --check`, `cargo clippy`, focused tests/smokes, and `cargo build`; install with `cargo install --path . --locked` before live CLI validation.
9. Commit and push all changes and record exact validation evidence and migration notes in the task log/artifacts.

Depends on

(none)

Required by

Log

2026-07-31T07:59:03.061933322+00:00 Task paused
2026-07-31T07:59:04.146313019+00:00 Task published
2026-07-31T07:59:05.456358933+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-07-31T07:59:24.848437911+00:00 Starting implementation; inspecting approved design and existing finalization/evaluation/worktree infrastructure.
2026-07-31T09:47:17.608588346+00:00 Implemented task-owned land/deliver/report finish protocol with repository finish lease, exact candidate-bound evaluation receipts, source-owned CAS promotion, durable contribution/report refs, transactional wrapper cleanup, cleanup-only restart reconciliation, typed synthesis input edges, compatibility fencing, user projections, migration doc, integration tests, and credential-free smoke. Validation: cargo fmt/check PASS; cargo clippy PASS (existing warnings); cargo build PASS; cargo install --path . --locked PASS; integration_candidate_finalization 9/9 PASS; deep evaluation focused tests PASS; installed-binary task_owned_finish_transaction PASS; candidate_finalization_transaction PASS; bounded_insufficient_deep_authority PASS; flip_first_required_gate PASS; park/resume, isolated observer, abandoned dependency, Pi continuation fence, and spawn observer regression sequence reached flip smoke before its migrated expectation and the migrated flip rerun passed; spawn wrapper focused 16/16 PASS. Full cargo test exercised 3038 lib tests before 7 known parallel profile HOME-lock failures (the failing case passed alone); serial full run exercised 3818 bin tests with 28 unrelated baseline route/fail/recover/TUI failures. No finish-focused failure remains.