Repository navigation
fix(resume): rebuild a resumed run with the guards it started with - #665
Merged
Merged
Conversation
flynn resume assembled the run from its shell flags alone. A planned goal resumed after a crash or kill got a worker with no item verifier, so its first verify step failed the run with goal_no_verifier. The same resume also dropped the run's --max-cost and --max-tokens cap, its --require-approval and --irreversible gates and --require-proof. Every assembly already records its posture on the run's stream. The posture now also lists the actions marked --irreversible, and governed.ReadPosture reads back the first one, which is the run's original assembly (a resume records its own posture after it). resumeRun turns that posture into the same drive options: planning when the verifier was wired, ledger proof, the budget limits (the existing pool, with its recorded spend, is reopened), the approval and outside-action gates, and fan-out. A run an external agent CLI drove is refused, since resume drives a native model. TestResumeRebuildsTheRunsGuards assembles a run with every guard and its resumption the way flynn resume does, and requires equal postures; it fails when the guards are left out. The governed test round-trips every posture field and fails when one is not recorded. Signed-off-by: Ion Alpha <[email protected]>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
flynn resumenow rebuilds a run with the guards its first assembly recorded: the item verifier (planning),--require-proof, the--max-costand--max-tokensbudget, the--require-approvaland--irreversiblegates, and fan-out. The run's posture event also lists the actions marked--irreversible, andgoverned.ReadPosturereads a run's original posture back from its record.Why
Resume assembled the run from its shell flags alone. A planned goal resumed after a hard kill got a worker with no item verifier, so its first verify step failed the run with
goal_no_verifier: goal: verify step dispatched to a worker with no item verifier. The live e2e resume-after-hard-kill scenario hit this on the release candidate binary. The same resume also ran with no spend cap, no approval gate, no outside-action gate and no ledger proof, which is a weaker run than the one the operator started.How to verify
go test -run TestResumeRebuildsTheRunsGuards ./cmd/flynn/assembles a run with every guard the goal command can set, then assembles its resumption through the same codeflynn resumeuses, and requires the two postures to be equal. With the guards left out of the resume it fails.go test -run TestReadPostureReturnsTheFirstAssembly ./governed/checks that every posture field round-trips through the record, and that a later assembly with fewer guards does not replace the original. With the--irreversibleactions left out of the record it fails.Notes for reviewers
budget.Ledger.Openreturns the existing pool, so the spend recorded before the kill still counts against the cap.governed.Posturegains a field andgoverned.ReadPostureis new. Both are additions../dev/apidifflists nothing ingoverned.