Repository navigation
feat(chat-swarm): add durable worker continuity and conversation rollover #51
Description
OWNER HOLD — CoS PILOT FIRST (2026-09-20)
Do not implement or extend DevSpace-owned ChatGPT worker continuity/rollover from this Issue until #218 establishes which worker-runtime responsibilities remain in DevSpace. Preserve the logical-worker-vs-conversation invariant as portable design evidence. No auto-chain.Textual prerequisite: #218.
Owner scope amendment — macOS only (2026-09-11)
依 Owner 最新裁決，本工作線相關功能設計、實作、交付與驗收 只處理 macOS。本裁決取代下文較早的跨平台／三平台要求。
- Windows、Linux 支援、移植、修復與平台驗證不在本次工作範圍；不再以三平台全綠作為本工作線的 acceptance criterion。
- 驗收保留 macOS 上必要的 source tests、獨立 package/install、真實呼叫入口、operation／副作用／讀回及適用的恢復與終態證據；ownership、lease、CAS、安全與獨立審查要求保持有效。
- 下方歷史測試、PR、平台結果與問題紀錄保留作為歷史證據，不代表目前仍有跨平台交付承諾。後續設計及驗收計畫以此 macOS-only 範圍為準。
- 本次更新僅修正 Issue 與規劃範圍；實作、部署與重啟仍依 Owner 的暫停指令保持暫停。
- 此文字更新不會自行修改 GitHub CI 設定或 branch protection；既有檢查設定如與新範圍不符，須另行明確調整，不得假稱已通過或繞過保護。
Status
BLOCKED_BY #49
Purpose
Add durable logical worker continuity so a ChatGPT Swarm worker can survive ordinary conversation replacement/context rollover without changing worker identity or losing task/reconciliation lineage.
This is the continuity layer after the basic MCP peer Swarm has passed live canary. It is not required for V0.1.
Hard prerequisite
- test(chat-swarm): run isolated 2-worker ChatGPT live canary #49 live canary passes on an exact bound Dev MCP runtime.
OpenCLI #50 is optional and not a hard prerequisite. Continuity must be defined at the Swarm/Core level so multiple runtime carriers can use it.
Core principle
workerId != conversationId
A worker is durable logical execution identity. A ChatGPT conversation is a replaceable carrier.
Expected model:
worker-01
continuationEpoch: 4
currentCarrier: conversation-B
history:
epoch 3 -> conversation-A -> closed/rolled over
epoch 4 -> conversation-B -> active
Objective
Implement explicit, auditable continuation/rollover semantics with one-time binding material and fail-closed recovery.
Required behavior
Worker continuity state
Represent at least:
- stable worker ID
- current continuation epoch
- current carrier identity fingerprint
- prior carrier/epoch lineage sufficient for audit/reconciliation
- last acknowledged checkpoint
- current task binding
- rollover/continuation state
Continuation ticket
If a ticket/token is used to bind a replacement conversation:
- short-lived
- single-use
- scoped to one exact worker + swarm + next epoch
- stored as hash only
- invalid after successful consumption
- cannot be replayed by the old carrier
- cannot bind a different worker
- must not upgrade task/controller authority
Rollover safety
- do not roll over while an effect is ambiguous without a checkpoint/reconciliation rule;
- if a worker has an active task, continuation must preserve exact task/attempt identity;
- if old and new carriers both appear active, fail closed until ownership is resolved;
- loss of old conversation must not silently mark task complete/failed/retryable;
- controller must be able to distinguish
carrier_lost,continuation_pending,continuation_bound, andreconcile_required.
Context/checkpoint capsule
Define a bounded continuation capsule sufficient to resume worker role without copying full conversation history.
Expected contents may include:
- worker/swarm identity
- continuation epoch
- current/last task IDs
- stable worker role instructions
- bounded task/result summaries
- unresolved unknowns/blockers
- explicit authority/claim ceiling
- checksum/schema version
Do not treat model-generated narrative as authoritative task state; canonical state remains in Swarm storage.
Context pressure
Do not claim exact ChatGPT token telemetry unless a supported host/runtime signal exists.
If context pressure is estimated:
- label it estimated
- use conservative thresholds
- keep estimate separate from hard model context facts
- rollover decision must remain observable
Automatic context compaction/rollover may be added only after deterministic continuity semantics work without it.
Ultra reference boundary
The Ultra project may be used as a reference for:
- stable worker identity across conversation replacement
- continuation epochs/tickets
- checkpoint capsule concept
- idle-boundary rollover
Do not copy:
- assumptions tied to Windows AppX cloned runtimes
- session/cookie seeding
- context estimates presented as exact native token telemetry
- automatic authority transfer from browser/session state
Required tests
- one-time continuation ticket success
- ticket replay rejected
- wrong-worker ticket rejected
- expired ticket rejected
- old carrier cannot submit after new carrier binding
- ambiguous dual-carrier state fails closed
- active task/attempt identity survives rollover
- restart during continuation does not duplicate worker or task execution
- checkpoint capsule corruption/version mismatch fails closed
- controller sees stable worker ID before/after carrier replacement
Live acceptance
After deterministic tests, run a bounded worker rollover witness:
- worker joins and completes at least one task;
- worker starts/holds a second bounded task or checkpoint;
- create replacement ChatGPT conversation;
- bind it through the continuation protocol;
- prove stable worker ID and incremented epoch;
- prove targeted follow-up routes to replacement carrier;
- prove old carrier can no longer submit as the worker;
- prove no duplicate task execution occurred.
Non-goals
- automatic browser spawning
- OpenCLI requirement
- unlimited persistent conversations
- mutation grants
- coding-agent delegation policy
- automatic model selection
- account/quota bypass
Claim ceiling
DURABLE_WORKER_CONTINUITY_CANARY_PASS only after exact source + live rollover evidence passes.
Do not claim infinite context, exact token awareness, production autoscaling, or autonomous coding readiness.
Activity
James3014 commentedon Sep 9, 2026
2026-09-09 Continuity 重規劃：區分 run context、cache replay 與 worker 身分延續
Owner 完整目標仍要求本 issue 的實作與真實 rollover；不是只產出規格。本 issue 仍在 #49 原生兩conversation canary 通過後才進入實作，#50維持 optional，不把瀏覽器自動化列成必要前置。
ODW 來源與可借鏡範圍
固定
travisliu/open-dynamic-workflow@164b313a75f1e05b0e294a2085b6e44721959762：odw resume的 cached-call reuse。借鏡的是小而完整、版本化、可重建的checkpoint；實際worker/epoch/attempt/權限真相仍來自已接受的Swarm store与現有identity contract。沒有獨立memory authority或新的模型路由。
Implementation slices（#49之後）
保留的硬條件
本次只追加來源研究與切片計畫，未開始continuity實作或執行rollover。本issue保持open，最大結果仍須依原contract以exact source+native evidence確認。
James3014 commentedon Sep 11, 2026
2026-09-11 scope amendment — Ultra parity requires proactive worker Auto Compact after deterministic rollover
Canonical parity tracker: #104.
Fresh Ultra comparison confirms this Issue correctly owns the core invariant:
and the continuation ticket / epoch / checkpoint / stale-carrier fencing semantics remain the correct first gate.
However, the original wording leaves automatic compaction/rollover as an indefinite future enhancement. For the previously requested Ultra-style behavior, that is now too weak.
Updated scope interpretation
Keep the existing sequence:
Then add a required second gate for Ultra parity:
Pressure semantics
Capsule rules
Preserve only bounded material state such as:
Do not carry full transcripts, hidden reasoning, raw tool history, credentials, or stale transport state.
Live parity witness required
After deterministic continuation passes, temporarily lower a test pressure threshold and prove a real worker conversation A -> B rollover:
workerId;#105 owns worker carrier lifecycle/creation/recovery. This Issue owns worker logical continuity and proactive rollover semantics.
James3014 commentedon Sep 11, 2026
V2 continuity contract：兩階段交付、受信 admission、不要把 token 或 context estimate 當權威
Parent #104。初始 native admission / diagnostics由 #108 負責；carrier wait/wake由 #105 負責。沿用現有 Swarm SQLite、workerId、continuationEpoch、task/attempt與reconciliation，不建立新queue/authority。
研究來源：DevSpace
8da19eb34e2fcdd9cf36faf2064911d5cbed7020；Ultra2c61c79ffe269d31523bac37ae6ecd60c9065a5e的 dist/chat-swarm.js / dist/conversation-continuity.js / docs/conversation-continuity.md。A — deterministic continuation，#49 後的第一個獨立交付
workerId != conversationId保持不變。replacement必須綁 exact swarm、worker、sourceEpoch、targetEpoch、sourceCarrier、targetCarrier、task/attempt/checkpoint hash 與 expiry/version。沿用 #108 的 nonsecret request -> exact owner approval -> requester readback 模式；replacement與initial join不同，不消耗新slot，不以新worker假裝原worker復活。
Ultra的SESSION_BOUND_CONTINUATION只是已綁定session的舊schema sentinel，不是通用無憑證admission。不要把它拷貝來繞過權限。若某個已批准adapter確需一次性ticket，ticket只屬該明確信任邊界、短效單次hash存儲，不暗中重啟目前被Host封鎖的secret傳遞路徑。
B — proactive Worker Auto Compact，Ultra parity 必做後續
A可以獨立交付與驗收，不能因本Issue還有B就阻塞 #105 的epoch-based recovery；B需要 #105 已證明可用的carrier safe-boundary/replace能力。這避免 #51 <-> #105 循環。
採用 donor 的行為原則而非Windows/CDP細節：
context pressure可使用單調backend ledger與可用的bounded DOM/host signal；重複task/replay不可重複計入，UI virtualization不能讓已觀測context倒退。source/provenance、估值／exact、coverage unknown與reserve必須分开。
不要硬編碼 Ultra 的1,050,000 token budget作為目前ChatGPT模型真實上限。budget/threshold為explicit configuration，unknown native signal保持unknown。只有估值時不提供假exact get_context_remaining。
重要限制：等待safe boundary可能晚於真正context上限；持續checkpoint與 #101/#106 對應恢復路徑仍需要存在，不能保證永不滿。
必做新增測試
pending/approval重播與撤銷、錯worker/錯swarm/錯epoch、並行replacement、commit前後crash/readback、舊carrier fence、active unknown不重派、capsule hash/version/size/redaction、transport generation仍在執行時不rollover、ledger replay去重與UI縮減不降低壓力、unsupported carrier明確blocked。
B的live gate可暫時降低測試threshold，但必須跨同一production watchdog/safe-boundary/binding流程並恢復原config；不能mock出continuation成功當作real rollover。
A/B各自有exact source/build/manifest/native receipt。沒有A證據不解鎖epoch recovery；没有B live witness不宣稱Worker Auto Compact完成。
James3014 commentedon Sep 12, 2026
Owner continuity amendment — rollover must be runtime-managed, not user-created
The existing core invariant remains correct:
But live acceptance must now use #117/#105's zero-touch runtime pool. A user manually opening a replacement Worker conversation and then supplying continuation material is diagnostic-only and cannot satisfy the product gate.
Required normal rollover
Owner interaction with the worker UI after one-time setup must be zero.
#117 integration
#117 owns the macOS carrier creation/open/recover substrate. #51 owns the continuity truth and epoch transfer.
Do not implement a second browser/session launcher in #51. Instead expose a transport-neutral continuation contract that #117 can call.
The runtime must preserve the separation:
Acceptance correction
The historical live step 'create replacement ChatGPT conversation' is amended to mean DevSpace runtime manager creates it.
Manual replacement conversation creation or manual worker rejoin does not count toward
DURABLE_WORKER_CONTINUITY_CANARY_PASS.Final live evidence must include:
runtime_ensure/recover uses the replacement carrier automatically.Auto Compact remains required for #104 parity; deterministic continuation semantics must remain transport-neutral and fail closed on ambiguous active effects.
James3014 commentedon Sep 13, 2026
2026-09-13 #51-A implementation started as #120
Deterministic continuation is now split into focused child #120:
feat(chat-swarm): deterministic worker continuation epoch transfer (#51-A).Fresh source fence:
main@ab22dc9d0360bd02d00892734a5c51cdd0873f39.Implementation branch created:
codex/issue-120-worker-continuation.Scope is intentionally transport-neutral and may proceed in parallel with #117:
workerId,continuationEpoch, checkpoint, task/attempt and authenticated carrier identity;#117/#105 remains the carrier creation/navigation/wake owner. #120 only establishes the deterministic continuity truth that #117 recovery will consume. Overall #51 remains OPEN until zero-touch real carrier rollover and later proactive Auto Compact acceptance.
James3014 commentedon Sep 13, 2026
2026-09-13 #51-A source Candidate ready via #120 / PR #122
Deterministic continuation source slice (#51-A) has reached
DETERMINISTIC_WORKER_CONTINUATION_SOURCE_CANDIDATE_READYon PR #122 exact head503c900c1d3413207e1db7a9b0a98981c94b0281.macOS exact-head source/CI acceptance is green; independent exact-head review remains required before merge, so #120 and #51 remain OPEN.
Important boundary unchanged:
Therefore a future #51 live PASS still requires zero-touch replacement via #117/#105 with manual replacement-worker creation = 0 and manual continuation transfer = 0. This source Candidate does not claim real ChatGPT rollover, Auto Compact or Ultra parity.
James3014 commentedon Sep 13, 2026
2026-09-13 #51-A source candidate ready via #120 / PR #122
Child #120 has reached source-candidate-ready at exact head
a168bb39ea55a868f40c15e85f91fb1a59c0d8ceagainstmain@c6e09967cb745407de3a7d09808c472d38f6e612.Controller verification is complete: focused continuation macOS tests, full macOS Smoke, Ubuntu Smoke, Local Agent Sessions, and PR
git diff --checkpass. Windows failure is the same current-main carrier-binding baseline and is not attributed to #120.PR #122 is Ready for review. Remaining #120 source gate is independent exact-head review and normal merge governance; no self-approval or merge claim is made.
Parent #51 remains OPEN after #120. This child provides only transport-neutral deterministic worker continuation truth (epoch transfer, atomic carrier rebind, old-carrier fence, replay/reconciliation/corruption semantics). Real zero-touch ChatGPT conversation creation/replacement remains owned by #117/#105; proactive Auto Compact remains a later #51 phase.
James3014 commentedon Sep 13, 2026
2026-09-13 #51-A accepted into main
Owner waived the independent-reviewer gate for child #120. PR #122 merged normally as
main@5256c40f56bbfd5a7eff7737ecf54da4b0359c4d; #120 is CLOSED / completed with claimDETERMINISTIC_WORKER_CONTINUATION_SOURCE_ACCEPTED.Parent #51 remains OPEN by design. The deterministic transport-neutral epoch transfer is now canonical source truth. Remaining parent acceptance is native/product work: #117/#105 must create/recover the replacement ChatGPT carrier with zero manual replacement-worker creation and zero manual continuation-ticket transfer, then #51 can prove real rollover and later Auto Compact behavior. Do not reopen or duplicate #120 logic in #117; consume the merged continuation seam.
James3014 commentedon Sep 13, 2026
2026-09-13 Worker Auto Compact planner source accepted via #126 / PR #127
PR #127 merged as
main@07f5c30a6ec8fcb9bfb511cb2b76ae089d6f6244; child #126 is CLOSED / completed with claimWORKER_AUTO_COMPACT_PLANNER_SOURCE_ACCEPTED.Canonical source now provides the transport-neutral pre-rollover planner on top of the already-merged #120 continuation seam:
Important boundary:
Therefore #51 remains OPEN. Source prerequisites for the worker-side pressure/capsule/safe-boundary and deterministic rebind layers are now canonical; remaining #51 work is integration with #117 real carrier lifecycle plus live rollover/Auto Compact acceptance.
James3014 commentedon Sep 13, 2026
#117 dependency update — replacement-carrier source now exists
#117 G1 is merged via clean PR #131 / main
da4be27769c72e42ec24882145d8a84a804a4999.For #51 this removes the source-side carrier-lifecycle blocker: managed carrier creation/reopen/wake/recover and exact conversation mapping now exist alongside #120 deterministic epoch transfer and #126 Auto Compact planner/capsule.
#51 still remains OPEN. Its remaining acceptance is physical A→B rollover on the exact installed macOS runtime:
This live witness depends on #117 G0/G2-G6 native acceptance; source merge alone is not
DURABLE_WORKER_CONTINUITY_CANARY_PASS.James3014 commentedon Sep 27, 2026
Wave 4 reconciliation — DevSpace worker continuity implementation superseded
Classification:
SUPERSEDED/RETIRED_FOR_CURRENT_DIRECT_CONTROL_PATH.Owner architecture decision now proven by Nexus-new #1154:
CHATGPT_DIRECT_CONTROL_PLANE_CANARY_PASSwithout Dev MCP.Decision:
The DevSpace-owned worker continuity/rollover implementation is superseded for the current direct-control path by CoS-owned worker conversation lifecycle. Preserve the portable invariant
workerId != conversationIdand fail-closed ambiguous-effect semantics as design evidence.Residual boundary:
Cross-client/cross-conversation Prime-family migration and supported external CoS control remain unproven optional future gaps; they are not silently claimed solved here.
This close does not rewrite the Issue's historical implementation/evidence as wrong or completed. It records that this DevSpace-specific implementation line is no longer the selected current path.
Causal watermark:
updated_at=2026-09-20T07:12:07Z3b92d6165e8531765dbaf929c3c298e0b03505bbba3036020c7d87c90f7cf1c4cfa84fa613b13ce2AUTO_CHAIN=false.