feat(agent-org): add authoritative Team lifecycle - #824
Open
ShiboSheng wants to merge 5 commits into
Open
Conversation
Establish durable Starting materialization receipts and a centralized quiescence boundary so Working teams enter Idle only from committed facts. Keep Run View pure-read, bound the global watchdog, and stop frontend polling for hidden or non-pollable teams behind one fail-closed rollout gate. Verification: - cargo clippy --all-targets -- -D warnings - Packaged Tauri Command+5 foreground, hidden, and restore lifecycle passed - Run View refresh left the isolated database byte-identical Pre-commit hook ran. Total eslint: 0, total circular: 0
launch_org.rs classified permanent identity failures with
.contains("identity mismatch") / .contains("Session identity"), but the
store emits 'materialization session mismatch for ...' and 'materialized
Session ... is missing for ...' — neither matched, so a permanently wrong
identity was retried forever instead of failing Starting.
Replace substring matching with stable machine prefixes defined next to
the error construction in AgentOrgRunStore:
- MATERIALIZATION_IDENTITY_MISMATCH_PREFIX now stamps all three permanent
identity failures in mark_materialization_succeeded and the certified-row
revalidation in finish_starting;
- STARTING_INPUT_CERTIFICATE_ERROR_PREFIX stamps the two permanent
initial-input certificate failures in finish_starting;
- is_materialization_identity_mismatch_error() /
is_permanent_finish_starting_error() are the only classification points.
Sweep of substring classifications introduced by this PR:
- launch_org.rs materialization receipt classification -> typed helper;
- launch/mod.rs both finish_starting sites (background launch + startup
recovery) -> is_permanent_finish_starting_error();
- launch/mod.rs initial-input payload decode classification -> shared
prefix constants + is_permanent_initial_input_payload_error(), used by
both the constructor and the classifier.
Pre-commit hook ran. Total eslint: 0, total circular: 0
handle_background_launch_failure discarded fail_starting's Ok(false) (returned when the run already left Starting) and then marked the coordinator session failed anyway — a Running team with a failed coordinator session row, and a log that claimed the run was marked failed when it was not. When fail_starting reports no transition, the handler now reloads the actual run status and logs error-level with that status, stating explicitly that the run status was left unchanged. For a Running run the coordinator session status is also left untouched (the watchdog and the initial-dispatch recovery own retries for a live team); the launch error is still broadcast and persisted to the transcript so the failure stays visible. Non-Running outcomes keep the previous behavior. Pre-commit hook ran. Total eslint: 0, total circular: 0
Hygiene batch from the PR 781 audit:
- The copy-pasted assess-quiescence -> extract generation/work_revision ->
try_transition_working_to_idle block (4 sites: scheduler post-intent
reconcile, lifecycle turn finalization, plan-approval follow-up,
watchdog terminal candidate) is hoisted into
AgentOrgRunStore::try_reconcile_to_idle() so the certificate protocol
cannot drift per caller.
- AgentOrgRunStore::create is production-dead (launch goes exclusively
through create_starting) but is needed by unit tests and the
#![cfg(debug_assertions)] /test endpoints, which seed arbitrary-status
runs create_starting cannot express (no coordinator identity, non-
Starting statuses, NULL root). Gate it #[cfg(any(test,
debug_assertions))] — present exactly where its consumers exist,
absent from release binaries.
- Drop 'cancelled' from the last_activity_outcome CHECK: no code path
reads or writes that value ('failed' via fail_starting and 'completed'
via the idle CAS are the only writers). CREATE TABLE IF NOT EXISTS
leaves existing databases untouched; PR 799 above regenerates its DDL
manifest from the binary. The DDL string is edited minimally, no
reformatting.
Pre-commit hook ran. Total eslint: 0, total circular: 0
Exercise Store-emitted permanent Starting errors and protect a Running team's coordinator Session from late launch-failure handling. Pre-commit hook ran. Total eslint: 0, total circular: 0
This was referenced Aug 16, 2026
ShiboSheng
marked this pull request as ready for review
August 17, 2026 04:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Supersedes #781.
Fixes #756.
Agent Org did not have one authoritative, restart-safe lifecycle boundary for a long-lived Team. Initial materialization, quiescence, Run View reads, watchdog recovery, and frontend polling could not yet guarantee that a Team moves safely through
Starting -> Running/Idle/Failed, becomes quiet inIdleorFailed, and can later be extended without introducing another state owner.PR #781 accumulated several later review commits whose scope went beyond PR1. This replacement rebuilds PR1 directly on the latest
developand carries forward only the review fixes explicitly accepted for this slice.Solution
The branch starts from
origin/developat8ad1fedea09dd1c4bc101a6a54c48e612466cdaaand contains only these changes:Startingmaterialization receipts, authoritative lifecycle transitions, centralized quiescence, pure-read Run View, one bounded watchdog, shared frontend polling ownership, and one fail-closed rollout gate.Running, preserve the coordinator Session status while retaining the visible error record.cancelledvalue from newly created lifecycle DDL.RunningTeam/coordinator pair.The replacement intentionally excludes the other #781 review commits. In particular, it does not add watchdog cursors, Starting retries, stale-intent repair, startup reservation pruning, legacy gate-off passthrough, Idle/Failed deletion, or the cache-hit send-fence probe.
The resulting PR1 boundary remains the design-doc boundary: no Pause/Resume implementation, Archive/Delete implementation, Task FSM rewrite, Writer settings, UserDirectedWork, or Group-send behavior is introduced here.
Potential risks
RunningTeam no longer marks its coordinator Session failed. Recovery remains owned by the existing live-Team recovery paths; this PR does not add a new retry owner.cancelledfrom theCREATE TABLE IF NOT EXISTSconstraint affects newly created databases only. Existing databases are intentionally not rewritten or migrated by this PR.Commit provenance
1db18a176(original) ->7beec7907(rebuilt), authored by Shibo Sheng.57e7e2c84(original) ->49cd4c3c4(rebuilt), authored by Neonforge.ed309078a(original) ->d4675fb15(rebuilt), authored by Neonforge.6b710f58d(original) ->1e4b4438d(rebuilt), authored by Neonforge.f998e9016, regression tests authored by Shibo Sheng.Verification
Passed:
cargo test -p agent_core starting_store_errors_drive_stable_permanent_failure_classificationcargo test -p agent_core late_launch_failure_does_not_fail_a_running_team_coordinatorcargo test -p agent_core core::coordination::agent_org_runs::tests— 45 passed.cargo test -p agent_core core::coordination::agent_org_watchdog::tests— 9 passed.cargo test -p agent_core core::session::launch::launch_tests— 10 passed.cargo test -p agent_core core::session::scheduler::tests— 6 passed.cargo test -p agent_core lifecycle::tests— 6 passed.cargo test -p agent_core state::commands::session::org_tasks::tests— 17 passed.cargo test -p org2 agent_org— 1 passed.npm test -- --run src/engines/ChatPanel/InputArea/components/agentOrgRunViewStore.test.ts— 12 passed.cargo clippy -p agent_core -p org2 --all-targets -- -D warnings.rustfmt --edition 2021 --checkon the two newly changed test files.git diff --check origin/develop...HEAD.cargo fmt --all -- --checkwas also attempted. It reports pre-existing formatting differences in three untouched files already present onorigin/develop:render_inline_canvas.rs,ui_metadata_tests.rs, andturn_window.rs. Those unrelated files are not changed in this PR; the two files added by the replacement test commit pass directrustfmt --check.No new packaged build or UI recording was produced for this reconstruction. The meaningful new verification is at the Store, launch-recovery, lifecycle, watchdog, Tauri command, and shared polling-store boundaries.