Skip to content

[Task][RFC]: Complete Goal lifetime fencing and governed orphan recovery #5206

Open
Open
[Task][RFC]: Complete Goal lifetime fencing and governed orphan recovery#5206
Labels
direction/architecture-evolutionArchitecture evolution and research-incubator work.

Description

@huangruiteng
huangruiteng
opened on Sep 27, 2026

Outcome / 目标

完成 Goal 生命周期隔离与孤儿状态恢复。One task tracks this RFC's delivery; keep implementation PRs and milestone evidence here instead of creating a parallel task tree.

Canonical design: RFC. Roadmap: S2/S3/S9 · R5, under #4574. Design acceptance is distinct from implementation, live qualification and promotion.

Current boundary

Integrated checkpoint: #5389, merge 3cecb0d7cbf3d247cfd996267d7fc64627bd6e49 (2026-10-02). The source-session lifetime transaction and individually qualified attached Chat, handoff and Turn-journal owners are already implemented; first-party host enforcement remains partial. Do not restart from the old codec-only checkpoint.

#5389 qualifies quota_settlement: exact GoalRef admission and ownership across spend/replay/receipt repair/void/readback, with legacy parity. Exact-head review: 231 Python and 279 TypeScript tests passed; 37 final-main integration tests passed; identical base/head public CLI and native artifact comparisons passed; risk-based premerge passed with 19 checks and no failures. These are isolated component/runtime results, not live product qualification.

execution_authority: false and the overall activation hold remain. Remaining inventory owners, old/warm-writer compatibility, external-effect drain, M4 recovery and packaged M5 acceptance are still open.

Product integration path / 产品联动路径

Canonical plan: RFC integration matrix · roadmap integration · golden-query lifecycle scenario.

  1. P0 / R1–R3 / G1: Goal 创建、Agent 创建或复用、2–3 worker 两轮依赖产物与 peer handoff、独立验收和同生命周期纠偏恢复。先在已支持 profile 验证；重连、换模型和新 Turn 不创建新的 Goal lifetime。
  2. P1 / S7 / R5: 实例归属接共享团队预算与 M4 孤儿恢复。共享额度分配仍由 quota/scheduler 验收，不能从实例隔离直接推导完成；恢复复用 preview/backup/apply/resume/readback。
  3. P2 / R6 / G3: 在真实跨主机认证、撤销与 lease 条件下验证迟到 worker，不把本地文件证据算作远端资格。

M5 的隔离重建场景必须等选定 profile 的 M2/M3 owner、旧 writer 与 drain 门槛满足后运行；涉及孤儿处置时包含 M4。检查 A 退役、B 同名重建、迟到 A 与重复回调不会污染 B，B 和无关 Goal 继续推进，结果回到原入口。App + 独立 CLI/source 回读先验，Lark 单独资格化。Component fixtures can precede activation but cannot certify the live journey. Use existing R1–R3/G1 owners under #4574; this issue owns the lifetime/recovery dependency, not a parallel team-orchestration ledger.

Work remaining

  • Finish the current binding-owner inventory and remaining admission/commit fences using the source registry’s exact GoalRef.
  • Complete preview/backup/journal/apply/resume/readback for supported orphan dispositions with explicit activation and compatibility boundaries.

Ownership and ongoing work

Reuse #4800/#4915 for paths and #3245 for authority promotion. Do not reimplement delivered source-session transactions or take over the active migration writers. Record remaining binding families, not an obsolete codec-only status.

Contribution route: implementation/integration overlaps active work. Start from the linked current owners/PRs and identify an unowned acceptance gap in a claim comment; do not begin a competing rewrite.

Acceptance

  • Delete/recreate of one alias cannot accept old session, inbox, host or execution authority; late A results cannot settle B.
  • Concurrent retirement, stale global projections, crash recovery and ambiguous commit preserve exact original identity and receipts.
  • Recovery never guesses a candidate or mutates active state as a test; isolated real-provider evidence and CLI/product readback cover the advertised path.
  • Reconcile the RFC's current delivery checkpoint and this issue with the integrated revision, commands, passed/failed/untested evidence and remaining gates. Close the accepted scope only; no claim that a merged PR alone completes the RFC.

Starting points and delivery boundary

Base: latest main. Reuse the existing typed owner and provider boundaries. Include affected CLI/frontend/Lark companions; verify real entrypoints and backend where changed. Preserve existing first-screen review and maintainer merge gates. Public artifacts contain only synthetic/public-safe evidence, no private operational state. This task does not authorize provider promotion, benchmark launches, release/deployment or unrelated protected effects.

Activity

  1. huangruiteng
    added
    direction/architecture-evolutionArchitecture evolution and research-incubator work.
    on Sep 27, 2026

  2. Duang777 commented on Sep 29, 2026

    @Duang777
    Duang777
    on Sep 29, 2026
    Collaborator

    Claiming the unowned M3 acceptance gap for handoff_inbox_outbox: bind the local-authority shadow outbox producer, commit marker, and drain cursor to the exact source-registry GoalRef.

    Base: origin/main@738115bde87eef3fd153abe456d53da5e2b249f8. Intended owners are local_authority_shadow_outbox.ts, local_authority_shadow_adapter.py, their generated coordination-state contract/schema, focused TypeScript/Python tests, the binding inventory, and the RFC delivery checkpoint. I will first characterize whether the existing capture_lineage_id already fences same-alias replacement; I will not add a format revision if that proof already holds.

    Decisive acceptance: prepare/commit an outbox entry for Goal A, retire A and create same-name Goal B, then prove B cannot drain, acknowledge, or advance a cursor over A state; A remains attributable, B valid work succeeds, and crash/replay stays idempotent. If a persisted format change is required, it will be versioned and the old format will remain legacy read-only. This does not overlap the Goal Channel work in #5248 or the App journey in #5275, and it does not authorize provider promotion.

  3. Duang777 commented on Sep 29, 2026

    @Duang777
    Duang777
    on Sep 29, 2026
    Collaborator

    @huangruiteng I am claiming the unowned M3 turn_journal binding gap on origin/main@51089ff. I will reuse the existing TypeScript ExactGoalRef parser and FirstPartyHostGoalAdmission lifetime guard, require every source-profile recovery and journal checkpoint to match the current GoalRef at the short commit boundary, and keep journal paths, persisted schema, and non-source behavior unchanged; same-alias Goal B must block every A resume/checkpoint without changing either journal, while legacy source journals remain historical read-only. This slice does not authorize provider promotion or remove the broader M3 activation hold.

  4. Duang777 commented on Sep 30, 2026

    @Duang777
    Duang777
    on Sep 30, 2026
    Collaborator

    The claimed M3 turn_journal slice has landed via #5324.

    • Reviewed exact head: 9b3873f7e64b28d6c39871de19836d05e614d8d2
    • Merge commit: 07311771d617fd8893aba1d89ddd1ebbe5eaa663
    • Result: every source-profile journal mutation now validates the exact current GoalRef under the alias guard handoff; stale Goal A cannot mutate A or B, fresh Goal B can proceed, and legacy journal wire/persisted bytes remain compatible.
    • Validation: maintainer review independently exercised the managed TypeScript/File journal boundary and approved the exact head.

    This closes only the bounded turn_journal inventory gap. The overall issue, first_party_host_runtime completion, other M3 owners, and the activation hold remain open.

  5. Duang777 commented on Oct 6, 2026

    @Duang777
    Duang777
    on Oct 6, 2026
    Collaborator

    @huangruiteng I am claiming the remaining read-side turn_journal capability-evidence gap on origin/main@42e55a809. PR #5324 fences journal mutations, but turn_journal.observed_capabilities still accepts a settlement identity without the current GoalRef, so a same-alias Goal B can consume Goal A capability evidence. I will pass the current exact GoalRef through the CLI bridge, require the journal binding to match it, preserve legacy behavior outside instance-aware profiles, and cover A-to-B replacement plus matching-instance readback in a separate PR. This does not authorize provider promotion or close the broader M3 hold.

  6. Duang777 commented on Oct 6, 2026

    @Duang777
    Duang777
    on Oct 6, 2026
    Collaborator

    @huangruiteng I am also claiming the separate external Manager session-scope gap on origin/main@42e55a809. Lark routing and manager_authorization_scope_id currently reduce authority to Goal aliases, so deleting Goal A and recreating the same alias as Goal B keeps the old authorization hash and upstream model thread while injecting B evidence into A context. I will bind external Manager evidence and thread rotation to canonical exact GoalRefs, keep owner-portfolio behavior unchanged, and add same-alias replacement regressions in an independent PR. This does not overlap #5248 or authorize live Lark promotion.

  7. Duang777 commented on Oct 8, 2026

    @Duang777
    Duang777
    on Oct 8, 2026
    Collaborator

    @huangruiteng I am claiming the remaining M3 canonical Goal acceptance owner gap on upstream/main@5f51559dc. I will bind acceptance authority to the exact current GoalRef, add a persisted retire/activate transition that fences stale writers across provider-backed runtime roots, re-project historical receipt replays against the current head, and migrate source-session recreation through that transition. Legacy non-instance-aware Goals remain compatible. Same-alias Goal B must never inherit Goal A acceptance, and Goal A must not configure or verify after retirement begins. This is a bounded A1/A2 delivery and does not claim completion of the broader RFC or authorize provider promotion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    direction/architecture-evolutionArchitecture evolution and research-incubator work.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions