make-automatic-archival-opt-in — WorksGood live mirror

Metadata

Status	done
Agent identity	`fbb2d89fe44d6b761bcb4b67748ab3d417f29df70a65f8d9403308f5bb2bab78`
Created	2026-08-02T06:13:33.450002245+00:00
Started	2026-08-02T06:13:46.557024650+00:00
Completed	2026-08-03T09:42:52.325284579+00:00
Tokens	18669394 in / 25585 out

Description

Make task-graph automatic archival opt-in rather than a time-triggered default. The current shipped default (default_archive_retention_days) can cause a daemon restart or upgrade to hide a large historical backlog based only on wall-clock age. That is unsafe for repositories where completed/abandoned tasks retain dependency, receipt, session, audit, incident, or recovery evidence. Archive is organization, not backup or cleanup.

Change the new-install/default retention to 0 (disabled; visible history preserved). Preserve an operator's explicit non-zero project/profile setting. Ensure setup, config templates, starter profiles, status, service reload, upgrades, and documentation consistently represent automatic archival as disabled unless deliberately enabled. A daemon upgrade must never activate archival merely because a new default appeared, and disabling retention while a hold exists must clear or neutralize the pending batch without archiving anything. Manual archival and an explicit dry-run/confirmation workflow must remain available.

Do not delete existing archives, rewrite graph history, or conflate task archival with bounded stream/cache cleanup. Document the risk model and recommend manual review for evidence-bearing development graphs.

Validation

Unit tests prove a fresh/default config resolves task archive retention to 0, while an explicit non-zero value remains effective across load/reload.
Regression test starts with an eligible historical backlog, enters an archive hold, changes retention to 0, reloads/restarts the candidate daemon, and asserts zero tasks archived and all visible task states preserved.
Candidate-binary clean-room smoke uses isolated HOME and explicit --dir, verifies a new graph does not auto-archive after restart/upgrade simulation, then opts into a short retention and confirms only the exact reviewed batch is archived.
wg service status and wg archive auto --dry-run clearly report disabled behavior at retention 0.
Update operator/config documentation and run pinned cargo fmt --check, focused tests, and the owned smoke scenario.

Make task-graph automatic archival opt-in rather than a time-triggered default. The current shipped default (`default_archive_retention_days`) can cause a daemon restart or upgrade to hide a large historical backlog based only on wall-clock age. That is unsafe for repositories where completed/abandoned tasks retain dependency, receipt, session, audit, incident, or recovery evidence. Archive is organization, not backup or cleanup.

Change the new-install/default retention to `0` (disabled; visible history preserved). Preserve an operator's explicit non-zero project/profile setting. Ensure setup, config templates, starter profiles, status, service reload, upgrades, and documentation consistently represent automatic archival as disabled unless deliberately enabled. A daemon upgrade must never activate archival merely because a new default appeared, and disabling retention while a hold exists must clear or neutralize the pending batch without archiving anything. Manual archival and an explicit dry-run/confirmation workflow must remain available.

## Validation
- Unit tests prove a fresh/default config resolves task archive retention to `0`, while an explicit non-zero value remains effective across load/reload.
- Regression test starts with an eligible historical backlog, enters an archive hold, changes retention to `0`, reloads/restarts the candidate daemon, and asserts zero tasks archived and all visible task states preserved.
- Candidate-binary clean-room smoke uses isolated `HOME` and explicit `--dir`, verifies a new graph does not auto-archive after restart/upgrade simulation, then opts into a short retention and confirms only the exact reviewed batch is archived.
- `wg service status` and `wg archive auto --dry-run` clearly report disabled behavior at retention `0`.
- Update operator/config documentation and run pinned `cargo fmt --check`, focused tests, and the owned smoke scenario.

Depends on

done .assign-make-automatic-archival-opt-in

Required by

(none)

Log

2026-08-02T06:13:33.388325886+00:00 Task paused
2026-08-02T06:13:33.580119488+00:00 Task published
2026-08-02T06:13:44.954293755+00:00 Lightweight assignment: agent=Pi Lifecycle Hotfix Programmer (fbb2d89f), exec_mode=full, context_scope=graph, reason=Lifecycle-sensitive archival behavior requires careful cross-component implementation covering configuration, reload/holds, tests, smoke validation, and documentation.
2026-08-02T06:13:46.963337041+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-08-02T06:14:07.259347971+00:00 Starting implementation; inspecting prior WIP and archival/config paths.
2026-08-02T06:17:24.290357805+00:00 FANOUT_DECISION: stay inline — archival config, hold state, smoke, and docs share one lifecycle contract and require sequential integration.
2026-08-02T06:17:26.105417638+00:00 Research: prior fix-surprise-startup-archival already set the runtime default to 0 and added guarded holds; this task will close load/reload, hold-disable, clean-room opt-in smoke, starter/setup representation, and operator documentation gaps.
2026-08-02T06:30:49.147024851+00:00 Implemented default/load/setup/starter-profile assertions, immediate stale-hold cancellation on disabled dry-run, reload/restart regression, clean-room candidate smoke, and operator risk documentation. Focused unit tests and the owned smoke pass; proceeding to full validation.
2026-08-02T06:45:41.226552306+00:00 Validation: pinned cargo fmt --check passes; cargo clippy passes with pre-existing warnings; cargo test --lib serial passes (3057); focused archival/setup/profile tests pass; owned candidate smoke automatic_archival_opt_in passes. Full bin suite remains red on 27 pre-existing unrelated route/lifecycle/TUI assertions; no archival failures.
2026-08-02T06:56:59.002686872+00:00 Committed: cc32fc87 — pushed to remote. Installed candidate globally with cargo install --path . --locked after clearing this worktree's 60 GiB target; final installed-binary owned smoke passes.
2026-08-02T06:57:17.700526178+00:00 Validated task criteria: default/missing=0 and explicit non-zero reload tests; real held-batch disable/reload/restart preserves exact graph and archives zero; isolated-HOME explicit-dir candidate smoke confirms disabled status/dry-run then exact reviewed opt-in; docs separate archival from backup/GC/stream-cache cleanup.
2026-08-02T06:58:31.142482722+00:00 Resolved submit-time integration conflict by merging current main and preserving both grow-only smoke manifest entries; merge commit 7aae2066 pushed.
2026-08-02T07:02:16.284807636+00:00 Bounded evaluator infrastructure state error[WG-EVAL-INSUFFICIENT-EVIDENCE]: bounded evidence insufficient [candidate-manifest:candidate-manifest:truncated,candidate-source:candidate-source:truncated,declared-artifact:declared-artifact-000:truncated,declared-artifact:declared-artifact-001:truncated,declared-artifact:declared-artifact-002:truncated,declared-artifact:declared-artifact-003:truncated,declared-artifact:declared-artifact-004:truncated,declared-artifact:declared-artifact-005:truncated,declared-artifact:declared-artifact-006:truncated,declared-artifact:declared-artifact-007:truncated,declared-artifact:declared-artifact-008:truncated,declared-artifact:declared-artifact-009:truncated,declared-artifact:declared-artifact-010:truncated,declared-artifact:declared-artifact-011:truncated,declared-artifact:declared-artifact-012:truncated,declared-artifact:declared-artifact-013:truncated,declared-artifact:declared-artifact-014:truncated,declared-artifact:declared-artifact-015:truncated] without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-02T07:02:59.517562229+00:00 Consumed deep-readonly FLIP report deep-report-ec47fb64f64f1fbc7e590b66daa2275958866bf30ffaa47a7fa7bd0def952fc9; observations=21 findings=4 route=b3:07cbfd6e71528de4a03ba3051159b1a811230a2a0a97c83e9fcb743edd0c2466 usage=61403in/1616out
2026-08-02T07:03:02.863155258+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress
2026-08-02T07:03:35.837073447+00:00 Bounded evaluator infrastructure state error[WG-EVAL-EVIDENCE-UNAVAILABLE]: automatic immutable evidence assembly failed without semantic rejection or cross-executor fallback; source remains in-progress