Repository navigation
Apply and deactivate bounded recovery policies visibly #404
Description
Parent
What to build
Inspectable scoped evidence/action/cooldown/ceiling policies, scheduled checks, suspected-unresponsive escalation, immediate deactivation and in-flight reconciliation without authority/accounting reset.
Acceptance criteria
- Inspectable scoped evidence/action/cooldown/ceiling policies, scheduled checks, suspected-unresponsive escalation, immediate deactivation and in-flight reconciliation without authority/accounting reset.
- Demonstrate the stated end-to-end behavior through public operations and every capable CLI/API/MCP surface.
- Cover authorized success, stale/unsupported/unauthorized targets and relevant crash/reconnect or uncertain-effect cases.
- Record source/package evidence and preserve existing work, authority and cumulative accounting; production effects need separate authorization.
Existing upgrade reconciliation
New controller capability; reuse the existing owners and the specification’s recorded decisions. No existing completed acceptance is invalidated.
Delivery boundary
Use public-seam TDD and exact red/green receipts. Source, integration, installed disposable acceptance and production activation are distinct. No provider experiment, credential copying, shared restart, governor activation or resource renewal is implied.
Activity
ecochran76 commentedon Oct 30, 2026
Qualified integrated source aec3495/79e02f4, ledger updated. Evidence docs/dev/evidence/plan0190/recovery404-installed.json. All five installed interfaces enabled explicit policy; existing controller maintenance performed scoped native action WITHOUT public tick/apply. Immediate off fences later steps, reconciles original in-flight outcome, preserves cumulative attempts/cooldown and continues authorized observation. Original grant, expiry and boot-bound elapsed deadlines persist; no authority/resource renewal. Activation/lost acknowledgements read original notices; broad/observer/revoked denied; exhausted/uncertain policies held visibly. Primary9recovery+2server/authority tests passed;11source hashes match installed qualification; fresh0ownedprocesses. Local CI authority; hosted CI skipped. Qualified composition fixture reuses actual390health/403native-notice boundaries; actualplatform and immutableBots acceptance remains405, production380 separate.