verify-correct-wg-2 — Workgraph live mirror

Metadata

Status	done
Assigned	`agent-1371`
Agent identity	`f51439356729d112a6c404803d88015d5b44832c6c584c62b96732b63c2b0c7e`
Created	2026-05-01T15:41:07.562107310+00:00
Started	2026-05-01T16:03:39.112891129+00:00
Completed	2026-05-01T16:09:23.798117263+00:00
Tags	`priority-high,fix,verify,html,deploy`, `eval-scheduled`
Eval score	0.94
└ blocking impact	0.95
└ completeness	0.95
└ constraint fidelity	0.85
└ coordination overhead	0.95
└ correctness	0.95
└ downstream usability	0.90
└ efficiency	0.90
└ intent fidelity	0.91
└ style adherence	0.95

Description

Safety task that runs after wg-html-publish lands. Verifies the implementation matches the user's revised scope (live redirect via wg msg send) and corrects if the agent didn't pick up the message.

Background

wg-html-publish was originally specced to make -avz --delete --mkpath the default rsync flag set. User redirected via wg msg send after the agent had started: keep default UNCHANGED (-avz --delete), make --mkpath an opt-in CLI flag on wg html publish add, plus add --rsync-flags <STR> for full override.

The agent may or may not have read the redirect before committing. This task ensures the right outcome regardless.

What to do

Step 1: verify current state after wg-html-publish lands

Test against the freshly-built binary:

wg html publish add --help — list of flags. Should include --mkpath AND --rsync-flags.
wg html publish add testverify --rsync /tmp/wgtest-default/ (no --mkpath flag). Inspect resulting toml: rsync_flags should be -avz --delete (NOT include --mkpath). If it includes --mkpath, agent shipped the wrong scope.
wg html publish add testverify-mkpath --rsync /tmp/wgtest-mkpath/ --mkpath. Inspect toml: rsync_flags should be -avz --delete --mkpath.
wg html publish add testverify-custom --rsync /tmp/wgtest-custom/ --rsync-flags '-avzP'. Inspect toml: rsync_flags should be -avzP (full override).
wg html publish add testverify-conflict --rsync /tmp/x/ --mkpath --rsync-flags '-avz'. Should ERROR (mutually exclusive).
Existing deployments (e.g., the user's 'public-mirror') should have UNCHANGED rsync_flags from before this fix landed — no auto-migration.

Step 2 (only if needed): correct the implementation

If wg-html-publish shipped with default = '-avz --delete --mkpath' instead of as an opt-in flag:

Revert the default change: rsync_flags default returns to '-avz --delete'
Add the --mkpath flag if missing (appends '--mkpath' to default when set)
Add the --rsync-flags flag if missing (full override; mutually exclusive with --mkpath)
Add the validation that they're mutually exclusive
Drop any pre-flight rsync version check that may have been added
Confirm existing deployments aren't migrated automatically (their stored rsync_flags stay as-is)

If wg-html-publish ALREADY shipped this correctly: this task does nothing substantive. Posts a 'verified clean — no corrections needed' note in the log and exits.

Step 3: cleanup test deployments

Whichever path Step 2 took, remove the test deployments created in Step 1: wg html publish remove testverify testverify-mkpath testverify-custom

Validation

wg html publish add --help shows --mkpath and --rsync-flags as options
Default behavior (no flag): rsync_flags = -avz --delete (unchanged from pre-task)
--mkpath flag appends to default; --rsync-flags overrides; mutually exclusive
User's existing 'public-mirror' deployment unchanged
Test deployments cleaned up
cargo build + cargo test pass
cargo install --path . was run before claiming done

Process note

This is a safety net for live-redirect uncertainty. Same pattern as verify-correct-wg (earlier today, which also turned out to be a no-op verification because the agent did pick up its redirect). Either outcome is fine — verify-clean is a few hundred K tokens; correct-on-miss is medium work. The cost is small relative to shipping the wrong default rsync flag.

## Description
Safety task that runs after wg-html-publish lands. Verifies the implementation matches the user's revised scope (live redirect via wg msg send) and corrects if the agent didn't pick up the message.

## Background
wg-html-publish was originally specced to make `-avz --delete --mkpath` the default rsync flag set. User redirected via `wg msg send` after the agent had started: keep default UNCHANGED (`-avz --delete`), make `--mkpath` an opt-in CLI flag on `wg html publish add`, plus add `--rsync-flags <STR>` for full override.

The agent may or may not have read the redirect before committing. This task ensures the right outcome regardless.

## What to do

### Step 1: verify current state after wg-html-publish lands
Test against the freshly-built binary:
- `wg html publish add --help` — list of flags. Should include `--mkpath` AND `--rsync-flags`.
- `wg html publish add testverify --rsync /tmp/wgtest-default/` (no --mkpath flag). Inspect resulting toml: `rsync_flags` should be `-avz --delete` (NOT include --mkpath). If it includes --mkpath, agent shipped the wrong scope.
- `wg html publish add testverify-mkpath --rsync /tmp/wgtest-mkpath/ --mkpath`. Inspect toml: `rsync_flags` should be `-avz --delete --mkpath`.
- `wg html publish add testverify-custom --rsync /tmp/wgtest-custom/ --rsync-flags '-avzP'`. Inspect toml: `rsync_flags` should be `-avzP` (full override).
- `wg html publish add testverify-conflict --rsync /tmp/x/ --mkpath --rsync-flags '-avz'`. Should ERROR (mutually exclusive).
- Existing deployments (e.g., the user's 'public-mirror') should have UNCHANGED rsync_flags from before this fix landed — no auto-migration.

### Step 2 (only if needed): correct the implementation
If wg-html-publish shipped with default = '-avz --delete --mkpath' instead of as an opt-in flag:
1. Revert the default change: rsync_flags default returns to '-avz --delete'
2. Add the `--mkpath` flag if missing (appends '--mkpath' to default when set)
3. Add the `--rsync-flags` flag if missing (full override; mutually exclusive with --mkpath)
4. Add the validation that they're mutually exclusive
5. Drop any pre-flight rsync version check that may have been added
6. Confirm existing deployments aren't migrated automatically (their stored rsync_flags stay as-is)

If wg-html-publish ALREADY shipped this correctly: this task does nothing substantive. Posts a 'verified clean — no corrections needed' note in the log and exits.

### Step 3: cleanup test deployments
Whichever path Step 2 took, remove the test deployments created in Step 1:
`wg html publish remove testverify testverify-mkpath testverify-custom`

## Validation
- [ ] `wg html publish add --help` shows `--mkpath` and `--rsync-flags` as options
- [ ] Default behavior (no flag): rsync_flags = `-avz --delete` (unchanged from pre-task)
- [ ] `--mkpath` flag appends to default; `--rsync-flags` overrides; mutually exclusive
- [ ] User's existing 'public-mirror' deployment unchanged
- [ ] Test deployments cleaned up
- [ ] cargo build + cargo test pass
- [ ] cargo install --path . was run before claiming done

## Process note
This is a safety net for live-redirect uncertainty. Same pattern as `verify-correct-wg` (earlier today, which also turned out to be a no-op verification because the agent did pick up its redirect). Either outcome is fine — verify-clean is a few hundred K tokens; correct-on-miss is medium work. The cost is small relative to shipping the wrong default rsync flag.

Depends on

Required by

(none)

Log

2026-05-01T15:41:07.546160132+00:00 Task paused
2026-05-01T15:41:13.083153624+00:00 Task published
2026-05-01T15:41:49.409132932+00:00 Lightweight assignment: agent=Careful Programmer (f5143935), exec_mode=full, context_scope=task, reason=Careful Programmer is ideal for safety-critical verification + conditional fix work; the Careful tradeoff matches the user's feedback on exhaustive verification, and proven track record (0.80 score, 495 tasks) shows capability for surgical code corrections.
2026-05-01T16:03:39.112894906+00:00 Spawned by coordinator --executor claude --model opus
2026-05-01T16:03:48.737268562+00:00 Starting verification of wg-html-publish implementation
2026-05-01T16:04:03.279161955+00:00 wg html publish add --help shows --mkpath and --rsync-flags as options; default documented as '-avz --delete'
2026-05-01T16:05:09.597797370+00:00 Inspected src/commands/publish.rs: default_rsync_flags() returns vec!['-avz', '--delete'] — correct; --mkpath appends; --rsync-flags overrides; clap-level mutual exclusion; no pre-flight rsync version check
2026-05-01T16:08:48.652014212+00:00 Validated: cargo test commands::publish:: passes 18/18 (includes the 6 new --mkpath / --rsync-flags / no-auto-migration tests)
2026-05-01T16:09:21.426037646+00:00 Verified clean — no corrections needed. All five validation rows pass against the committed binary: --help lists both flags; default = '-avz --delete' (unchanged); --mkpath appends; --rsync-flags overrides; clap rejects --mkpath + --rsync-flags as mutually exclusive; public-mirror still resolves to default (no auto-migration). Test deployments removed. 18/18 publish unit tests pass. No code changes on this branch — earlier dep-context log was an intermediate state, the final commit (1aad56a48) has the correct opt-in default.
2026-05-01T16:09:23.798121501+00:00 Task pending eval (agent reported done; awaiting `.evaluate-*` to score)
2026-05-01T16:12:31.924369960+00:00 PendingEval → Done (evaluator passed; downstream unblocks)