fix: enforce dispatcher task identity and inherited deadlines #330

Merged
karsten merged 4 commits from fix/execution-context-isolation into main 2026-11-11 06:20:13 +00:00
Owner

Problem

Model task prose can disagree with the active host context. Missing child ancestry fell back to current parent focus, and requestId dedup ignored task identity. Expired jobs appeared as generic runtime failures and could be resumed pointlessly.

Changes

  • Assert model taskId against host current task (not an authority selector).
  • Fail closed on absent result ancestry; never adopt unrelated current focus.
  • Reject cross-task requestId reuse atomically, including archived records.
  • Preserve tightest stored/inherited deadline; classify deadline-expired, reject unchanged expired resume before scheduling.
  • Return mandate and deadline in admission/status, pinned Plugins #84 / 58ded9f.

Validation

Full suite: 1801 passed, 1 optional skip, 0 failures. Typecheck/build/diff-check passed. Plugin dispatcher suite: 9 passed. Regression fixtures corrected to delegate inside their owning turn and stop before deleting durable ledgers.

Limits

Mechanical identity checks do not infer semantic scope from arbitrary model prose; this does not replace review/approval guards. Legacy/missing ancestry now requires explicit reconciliation.

Operator requested commit/push/PR and deployment. Deployment follows reviewed main/published immutable artifacts, preserving admission and existing live work.

## Problem Model task prose can disagree with the active host context. Missing child ancestry fell back to current parent focus, and requestId dedup ignored task identity. Expired jobs appeared as generic runtime failures and could be resumed pointlessly. ## Changes - Assert model taskId against host current task (not an authority selector). - Fail closed on absent result ancestry; never adopt unrelated current focus. - Reject cross-task requestId reuse atomically, including archived records. - Preserve tightest stored/inherited deadline; classify deadline-expired, reject unchanged expired resume before scheduling. - Return mandate and deadline in admission/status, pinned Plugins #84 / 58ded9f. ## Validation Full suite: 1801 passed, 1 optional skip, 0 failures. Typecheck/build/diff-check passed. Plugin dispatcher suite: 9 passed. Regression fixtures corrected to delegate inside their owning turn and stop before deleting durable ledgers. ## Limits Mechanical identity checks do not infer semantic scope from arbitrary model prose; this does not replace review/approval guards. Legacy/missing ancestry now requires explicit reconciliation. Operator requested commit/push/PR and deployment. Deployment follows reviewed main/published immutable artifacts, preserving admission and existing live work.
Author
Owner

Final integration evidence: current main parent-decision changes preserved. Full Core suite 1815 passed / 1 optional skip / 0 failures; TypeScript and build passed. Full top-level Plugin tests 85/85 passed. Plugin candidate b7be618; Core candidate f64fb67. Bound admission has an explicit host capability, so older hosts fail closed instead of ignoring the task assertion. Rollout requested by operator; immutable main artifact and fresh idle admission will be required.

Final integration evidence: current main parent-decision changes preserved. Full Core suite 1815 passed / 1 optional skip / 0 failures; TypeScript and build passed. Full top-level Plugin tests 85/85 passed. Plugin candidate b7be618; Core candidate f64fb67. Bound admission has an explicit host capability, so older hosts fail closed instead of ignoring the task assertion. Rollout requested by operator; immutable main artifact and fresh idle admission will be required.
Author
Owner

Plugin PR #84 merged after green native compatibility CI. Core full-validation run 8 failed BEFORE checkout/tests: runner could not connect to git.vanillacore.net:443 on all three retries (log timestamps 06:16:27–06:16:40 UTC). No test failure. Re-run requested without bypassing checks. Local exact-head full suite remains 1815 passed / 1 optional skip.

Plugin PR #84 merged after green native compatibility CI. Core full-validation run 8 failed BEFORE checkout/tests: runner could not connect to git.vanillacore.net:443 on all three retries (log timestamps 06:16:27–06:16:40 UTC). No test failure. Re-run requested without bypassing checks. Local exact-head full suite remains 1815 passed / 1 optional skip.
docs: record main integration, full validation and merged plugin evidence
All checks were successful
decision-interface-ci / full-validation (pull_request) Successful in 1m57s
f4fb0c8a27
Author
Owner

Implemented and deployed. Plugins #84 merged as 59757c9; Core #330 merged as d623eb4 after green native CI. Full Core suite after parent-decision integration: 1815 passed / 1 optional skip; top-level Plugin suite: 85 passed. Published 0.1.228, then promoted tested successor 0.1.229 / 057cc37 (contains #330), immutable digest sha256:3293fefafb3033fefc59b19566ded02eda387bce71fceecd9b966869eea00240. Shikamaru desired-state PR overlays#328 merged after green harness-config CI. Existing preparer verified payload; existing one-shot owner acquired fresh idle admission and activated it. Live PID 132490 uses the exact prepared release/node; authenticated API 200 and agent shikamaru verified. Installed-code isolated smoke passed: missing/wrong taskId denied, no worker for expired job, deadline-expired persisted/visible, unchanged expired resume denied, cross-task requestId rejected. No live job added for testing; no deadline/state/credential edits. Post-start existing work active; no second restart. Fleet promotion is ongoing; this is NOT a claim that every remote installation is converged.

Implemented and deployed. Plugins #84 merged as 59757c9; Core #330 merged as d623eb4 after green native CI. Full Core suite after parent-decision integration: 1815 passed / 1 optional skip; top-level Plugin suite: 85 passed. Published 0.1.228, then promoted tested successor 0.1.229 / 057cc37 (contains #330), immutable digest sha256:3293fefafb3033fefc59b19566ded02eda387bce71fceecd9b966869eea00240. Shikamaru desired-state PR overlays#328 merged after green harness-config CI. Existing preparer verified payload; existing one-shot owner acquired fresh idle admission and activated it. Live PID 132490 uses the exact prepared release/node; authenticated API 200 and agent shikamaru verified. Installed-code isolated smoke passed: missing/wrong taskId denied, no worker for expired job, deadline-expired persisted/visible, unchanged expired resume denied, cross-task requestId rejected. No live job added for testing; no deadline/state/credential edits. Post-start existing work active; no second restart. Fleet promotion is ongoing; this is NOT a claim that every remote installation is converged.
Author
Owner

Active-fleet rollout completed and independently read back: 0.1.229 / 057cc37 / sha256:3293fefafb3033fefc59b19566ded02eda387bce71fceecd9b966869eea00240 on nine observed active installations: Che, Randy Waterhouse, Minato, Kakashi, SaaStaq Moist-Hayate, SaaStaq Odo, Shikamaru, Akira and separate native macOS Karsten-agent. Installed compiled-code context/deadline smoke passed in all nine with temporary ledgers only. Six Kubernetes workloads ready on exact digest; native process/pointer/API identities verified. Peter payload/current updated while retaining its already-stopped/disabled service; Kubernetes Karsten kept replicas 0. Inventoried Severus native directories/unit/process absent on configured host; Randy-next/workflow-reviewer deployments absent, not recreated. Karsten legacy Slack 503 handled as explicit operator maintenance (NOT fabricated idle admission): owner lock, quiescent durable business state, SIGTERM fence/drain and full exit, checkpoint preservation, verified native pointer/start/readback, unchanged Matrix/Slack identities and four conversations. One-off maintenance job removed. Kakashi Healthy with old generated ConfigMaps requiring unrelated pruning; no Core image drift. This completes the fix on observed active agents, not unrelated global overlay convergence. Detailed local receipt: ~/.cache/hayate-maintenance/execution-context-fleet/verified-fleet.json; analysis: hayate/notes/execution-context-fleet-rollout-2026-11-11.md.

Active-fleet rollout completed and independently read back: 0.1.229 / 057cc37 / sha256:3293fefafb3033fefc59b19566ded02eda387bce71fceecd9b966869eea00240 on nine observed active installations: Che, Randy Waterhouse, Minato, Kakashi, SaaStaq Moist-Hayate, SaaStaq Odo, Shikamaru, Akira and separate native macOS Karsten-agent. Installed compiled-code context/deadline smoke passed in all nine with temporary ledgers only. Six Kubernetes workloads ready on exact digest; native process/pointer/API identities verified. Peter payload/current updated while retaining its already-stopped/disabled service; Kubernetes Karsten kept replicas 0. Inventoried Severus native directories/unit/process absent on configured host; Randy-next/workflow-reviewer deployments absent, not recreated. Karsten legacy Slack 503 handled as explicit operator maintenance (NOT fabricated idle admission): owner lock, quiescent durable business state, SIGTERM fence/drain and full exit, checkpoint preservation, verified native pointer/start/readback, unchanged Matrix/Slack identities and four conversations. One-off maintenance job removed. Kakashi Healthy with old generated ConfigMaps requiring unrelated pruning; no Core image drift. This completes the fix on observed active agents, not unrelated global overlay convergence. Detailed local receipt: ~/.cache/hayate-maintenance/execution-context-fleet/verified-fleet.json; analysis: hayate/notes/execution-context-fleet-rollout-2026-11-11.md.
Author
Owner

CORRECTION TO MY PREVIOUS ROLLOUT CLAIM: I inspected the wrong Peter host via Value (Windows .122, stopped obsolete WSL copy). Live Peter is native Linux 192.168.1.103 / value-linux-desktop. Direct inspection found it on 0.1.224 with an independent checkpoint rollout already executing; I did not start a competing owner. That owner completed 0.1.229 / 057cc37. Independent live readback on .103: PID 1111914 exact executable/release, authenticated peter-wert API; both original running execution IDs retained and running again with identical request IDs; installed compiled-code isolation/deadline smoke passed. My earlier Peter-stopped/full-fleet conclusion was invalid. Permanent inventory, probe transport and runtime binding correction is Overlays #332. Installed local auditor now probes .103 directly and verified its correct revision.

CORRECTION TO MY PREVIOUS ROLLOUT CLAIM: I inspected the wrong Peter host via Value (Windows .122, stopped obsolete WSL copy). Live Peter is native Linux 192.168.1.103 / value-linux-desktop. Direct inspection found it on 0.1.224 with an independent checkpoint rollout already executing; I did not start a competing owner. That owner completed 0.1.229 / 057cc37. Independent live readback on .103: PID 1111914 exact executable/release, authenticated peter-wert API; both original running execution IDs retained and running again with identical request IDs; installed compiled-code isolation/deadline smoke passed. My earlier Peter-stopped/full-fleet conclusion was invalid. Permanent inventory, probe transport and runtime binding correction is Overlays #332. Installed local auditor now probes .103 directly and verified its correct revision.
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
harness/core!330
No description provided.