Prove a carried run landed new run-owned history before marking success #513

New issue

Closed

opened 2026-07-02 06:01:57 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-07-02 06:01:57 +00:00

Owner

Ward can attribute a later engineer run as done based on an older already-landed commit that predates the issue creation and reservation window.

Concrete repro chain from the operator:

run/container: engineer-goose-infrastructure-426
intended issue: coilyco-flight-deck/infrastructure#426
issue opened: 2026-07-02 05:35:59 +00:00
reservation posted: 2026-07-02 05:39:58 +00:00
commit ward associated with success: coilyco-flight-deck/infrastructure 08f117fb0dd9b419b09b7fb15fd291e7247bc9d6
that commit was authored at 2026-07-02 05:19:32 +00:00, before the issue existed and before the reservation

Required outcome:

ward must only mark a carried run as done when it can prove that the run itself landed new remote history for the carried repo after dispatch/reservation
tree clean and HEAD on origin/main are not sufficient success criteria on their own

Preferred implementation direction (the better version):

persist a run-local identity/provenance record at dispatch time, including:
- run id
- carried repo ref
- carried issue ref
- reservation timestamp
- baseline origin/main sha at dispatch time
on completion/reap, fetch origin/main and inspect the commit range from the baseline to the remote head
require a positive proof that at least one landed commit in that range belongs to this run and this carried issue before marking done
if no such commit exists, the run must not report success

Acceptance criteria:

implement the run-owned success proof above or a stronger equivalent
add tests proving an older pre-existing commit on origin/main cannot satisfy a newer run
add tests around adjacent issue numbers and reused deterministic container names where stale attribution is likely
update ward docs for the success invariant if needed
link related carry-integrity issue ward#512

Ward can attribute a later engineer run as `done` based on an older already-landed commit that predates the issue creation and reservation window. Concrete repro chain from the operator: - run/container: `engineer-goose-infrastructure-426` - intended issue: `coilyco-flight-deck/infrastructure#426` - issue opened: `2026-07-02 05:35:59 +00:00` - reservation posted: `2026-07-02 05:39:58 +00:00` - commit ward associated with success: `coilyco-flight-deck/infrastructure` `08f117fb0dd9b419b09b7fb15fd291e7247bc9d6` - that commit was authored at `2026-07-02 05:19:32 +00:00`, before the issue existed and before the reservation Required outcome: - ward must only mark a carried run as done when it can prove that the run itself landed new remote history for the carried repo after dispatch/reservation - `tree clean` and `HEAD on origin/main` are not sufficient success criteria on their own Preferred implementation direction (the better version): - persist a run-local identity/provenance record at dispatch time, including: - run id - carried repo ref - carried issue ref - reservation timestamp - baseline `origin/main` sha at dispatch time - on completion/reap, fetch `origin/main` and inspect the commit range from the baseline to the remote head - require a positive proof that at least one landed commit in that range belongs to this run and this carried issue before marking `done` - if no such commit exists, the run must not report success Acceptance criteria: - implement the run-owned success proof above or a stronger equivalent - add tests proving an older pre-existing commit on `origin/main` cannot satisfy a newer run - add tests around adjacent issue numbers and reused deterministic container names where stale attribution is likely - update ward docs for the success invariant if needed - link related carry-integrity issue `ward#512`

coilyco-ops commented

2026-07-02 06:02:13 +00:00

Member

🔒 Reserved by ward agent --driver codex — container engineer-codex-ward-513 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T06:02:11Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Codex, via ward agent

🔒 Reserved by `ward agent --driver codex` — container `engineer-codex-ward-513` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T06:02:11Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Codex, via `ward agent`

coilysiren referenced this issue from a commit

2026-07-02 06:07:48 +00:00

fix(reap): prove run-owned landed history

coilysiren closed this issue

2026-07-02 06:07:48 +00:00

coilysiren commented

2026-07-02 06:08:06 +00:00

Author

Owner

WARD-OUTCOME: done - carried run now proves landed history after reservation before reap can mark success.

This went cleanly once I moved the proof into dispatch-time provenance and made reap require a post-reservation commit on origin/main. The only fight was the log parsing and the doc cap, both straightforward once surfaced. Confidence is high, but I would still watch for any edge where a run lands through a non-standard history rewrite path.

WARD-OUTCOME: done - carried run now proves landed history after reservation before reap can mark success. This went cleanly once I moved the proof into dispatch-time provenance and made reap require a post-reservation commit on origin/main. The only fight was the log parsing and the doc cap, both straightforward once surfaced. Confidence is high, but I would still watch for any edge where a run lands through a non-standard history rewrite path.

coilyco-ops referenced this issue

2026-07-08 22:19:00 +00:00

Make agent workflow defaults configurable and default engineers to PRs #707