coilyco-flight-deck/ward

Watch

Never salvage or reopen work already landed on main #1598

New issue

Closed

opened 2026-07-28 09:21:45 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-28 09:21:45 +00:00

Member

Problem

The reaper exists to prevent work from being lost when an ephemeral container exits before its changes land.

On #1605, Ward did the opposite:

The engineer had pushed the implementation.
The run HEAD was already contained in origin/main.
The salvage branch had no diff from main.
Ward had already recorded the run as done.
The reaper still declared the work unmerged, created a useless salvage branch, posted invalid recovery instructions, and reopened the issue because its closing-reference check disagreed.

That corrupted the audit trail and manufactured recovery work for a completed run.

Core invariant

Before creating a salvage branch or changing an issue, Ward must answer:

Does this container contain real work that is absent from the workflow destination?

Git determines whether code landed. Closing references, workflow comments, and issue state are bookkeeping. Bookkeeping may need reconciliation, but it cannot turn landed code into unmerged code.

Required behavior

Refresh the destination branch before making a teardown decision.
Check whether the container HEAD is equal to or contained in that branch.
Check whether any real residual diff remains.
If no work remains to land, create no salvage branch or pull request, publish no recovery instructions, and do not reopen the issue as an implementation failure.
If code landed but tracker bookkeeping is inconsistent, report that reconciliation problem separately and truthfully.
Salvage only a real, nonempty diff, and advertise recovery only after Ward verifies the recovery artifact exists.
If Ward cannot determine remote state, report that uncertainty. Never claim work is unmerged without Git evidence.
Lead every human and machine-readable result with whether code landed, whether tracker bookkeeping agrees, and whether a real recovery artifact exists.

Acceptance criteria

Reproduce #1605: HEAD is on main, the tree is clean, the closing-reference check fails, and Ward performs no salvage or reopen.
Exact equality and ancestor landing both count as landed.
A no-diff branch is never created or advertised.
A genuine unlanded diff is preserved before teardown.
A missing closing reference produces a bookkeeping warning, not an unmerged-work claim.
Fetch failures and contradictory evidence fail without inventing a landing or salvage result.
Repository validation passes.

Headless execution boundary

Use synthetic Git histories, branches, issue snapshots, and rendering fixtures. Do not merge a live pull request, reopen a live issue, or mutate a remote repository for acceptance.

This is an ordering and truthfulness fix in the reaper. It does not add another lifecycle taxonomy or state store.

## Problem The reaper exists to prevent work from being lost when an ephemeral container exits before its changes land. On #1605, Ward did the opposite: * The engineer had pushed the implementation. * The run HEAD was already contained in `origin/main`. * The salvage branch had no diff from `main`. * Ward had already recorded the run as done. * The reaper still declared the work unmerged, created a useless salvage branch, posted invalid recovery instructions, and reopened the issue because its closing-reference check disagreed. That corrupted the audit trail and manufactured recovery work for a completed run. ## Core invariant Before creating a salvage branch or changing an issue, Ward must answer: **Does this container contain real work that is absent from the workflow destination?** Git determines whether code landed. Closing references, workflow comments, and issue state are bookkeeping. Bookkeeping may need reconciliation, but it cannot turn landed code into unmerged code. ## Required behavior * Refresh the destination branch before making a teardown decision. * Check whether the container HEAD is equal to or contained in that branch. * Check whether any real residual diff remains. * If no work remains to land, create no salvage branch or pull request, publish no recovery instructions, and do not reopen the issue as an implementation failure. * If code landed but tracker bookkeeping is inconsistent, report that reconciliation problem separately and truthfully. * Salvage only a real, nonempty diff, and advertise recovery only after Ward verifies the recovery artifact exists. * If Ward cannot determine remote state, report that uncertainty. Never claim work is unmerged without Git evidence. * Lead every human and machine-readable result with whether code landed, whether tracker bookkeeping agrees, and whether a real recovery artifact exists. ## Acceptance criteria * Reproduce #1605: HEAD is on `main`, the tree is clean, the closing-reference check fails, and Ward performs no salvage or reopen. * Exact equality and ancestor landing both count as landed. * A no-diff branch is never created or advertised. * A genuine unlanded diff is preserved before teardown. * A missing closing reference produces a bookkeeping warning, not an unmerged-work claim. * Fetch failures and contradictory evidence fail without inventing a landing or salvage result. * Repository validation passes. ## Headless execution boundary Use synthetic Git histories, branches, issue snapshots, and rendering fixtures. Do not merge a live pull request, reopen a live issue, or mutate a remote repository for acceptance. This is an ordering and truthfulness fix in the reaper. It does not add another lifecycle taxonomy or state store.

coilyco-ops added the

autonomy

async-consult

priority

labels

2026-07-29 03:47:40 +00:00

coilyco-ops changed title from ~~Classify already-landed merge-remote-main runs before salvage~~ to Classify landing and reconciliation before salvage

2026-07-31 08:09:43 +00:00

coilyco-ops referenced this issue

2026-07-31 08:12:08 +00:00

Put decisive run evidence before cleanup diagnostics #1599

coilyco-ops added

and removed

labels

2026-07-31 08:29:44 +00:00

coilyco-ops changed title from ~~Classify landing and reconciliation before salvage~~ to Never salvage or reopen work already landed on main

2026-08-05 17:57:19 +00:00

coilyco-ops added

priority

and removed

priority

labels

2026-08-05 17:57:19 +00:00

coilyco-ops commented

2026-08-05 17:57:30 +00:00

Author

Member

Decision resolved by Kai on 2026-08-05.

The issue is now grounded in the #1605 failure. The reaper exists to preserve actual unlanded work. It must prove that a real diff remains before it creates a salvage branch, advertises recovery, or reopens an issue.

Git landing evidence is authoritative for code. Closing references, workflow comments, and issue state are reconciliation facts and cannot turn already-landed code into unmerged code.

No new lifecycle taxonomy or state store belongs in this issue. Priority is P2 because false salvage corrupts the audit trail and creates bogus recovery work.

Decision resolved by Kai on 2026-08-05. The issue is now grounded in the #1605 failure. The reaper exists to preserve actual unlanded work. It must prove that a real diff remains before it creates a salvage branch, advertises recovery, or reopens an issue. Git landing evidence is authoritative for code. Closing references, workflow comments, and issue state are reconciliation facts and cannot turn already-landed code into unmerged code. No new lifecycle taxonomy or state store belongs in this issue. Priority is P2 because false salvage corrupts the audit trail and creates bogus recovery work.

coilyco-ops referenced this issue from a commit

2026-08-06 02:50:28 +00:00

fix: trust Git before reaper salvage

coilyco-ops closed this issue

2026-08-06 02:50:28 +00:00

coilyco-ops commented

2026-08-06 02:50:52 +00:00

Author

Member

WARD-OUTCOME: done ✅

Landed on main in 4a43b122 (fix: trust Git before reaper salvage).

Git landing proof now precedes provenance, closing-reference, salvage, and tracker decisions.
Equal, ancestor, and patch-equivalent HEADs report code as landed. Missing closing references report tracker reconciliation only.
Salvage requires a refreshed, nonempty residual diff. Ward verifies the remote recovery branch before advertising it or reopening an issue.
Fetch failures and contradictory Git evidence report uncertainty without inventing a landing or salvage result.
A post-push destination recheck removes and verifies absence of a redundant salvage branch if main advances during preservation.
Regression coverage includes the #1605 case, equality, ancestry, fetch failure, empty and unverified recovery refusal, and genuine residual preservation.

Validation passed: ward exec test, lint, build, vet, test-policy-boundary, test-release-contract, pre-commit, and ward doctor.

WARD-OUTCOME: done ✅ Landed on `main` in `4a43b122` (`fix: trust Git before reaper salvage`). * Git landing proof now precedes provenance, closing-reference, salvage, and tracker decisions. * Equal, ancestor, and patch-equivalent HEADs report code as landed. Missing closing references report tracker reconciliation only. * Salvage requires a refreshed, nonempty residual diff. Ward verifies the remote recovery branch before advertising it or reopening an issue. * Fetch failures and contradictory Git evidence report uncertainty without inventing a landing or salvage result. * A post-push destination recheck removes and verifies absence of a redundant salvage branch if `main` advances during preservation. * Regression coverage includes the #1605 case, equality, ancestry, fetch failure, empty and unverified recovery refusal, and genuine residual preservation. Validation passed: `ward exec test`, `lint`, `build`, `vet`, `test-policy-boundary`, `test-release-contract`, `pre-commit`, and `ward doctor`.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/ward#1598

No description provided.

Rows
Columns