feat(reconciliation): implement live Vertex AI recovery advisor and Subgraph MCP client

[kapustazh]

Summary

Implement live VertexAiRecoveryAdvisor and LiveSubgraphMcpRecoveryPort for AI-assisted candidate recovery and lost-hash discovery, and integrate both into worker composition.

Scope and acceptance criteria

• Implement VertexAiRecoveryAdvisor in packages/reconciliation/src/vertex-advisor.ts conforming to RecoveryAdvisorPort and validateAndNormalizeRecommendation.
• Implement LiveSubgraphMcpRecoveryPort in packages/reconciliation/src/subgraph-mcp-client.ts supporting both MCP JSON-RPC protocol (execute_query_by_deployment_id) and Graph Gateway fallback with MCP envelope normalization.
• Export both implementations from @oneshot/reconciliation.
• Wire both into apps/worker composition with zero external submission permissions (settlementPermission: 'NEVER').
• Add comprehensive unit and integration tests (83 reconciliation tests, 27 worker tests, 900 total repo tests).
• Verify fail-closed invariants: external indexer absence, lag, or model errors must NEVER grant settlement permissions.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.

Invariant notes:

Recovery LLM advisor and Subgraph MCP have zero signing, retry, or settlement permissions (settlementPermission: 'NEVER'). All advisory outputs are strictly verified against authoritative Arc receipts by the OneShot deterministic safety core.

Validation

Commands and results:

pnpm lint: PASS (0 errors, 0 warnings)
pnpm typecheck: PASS (tsc -b)
pnpm test: PASS (57 test files, 900 tests)
pnpm --filter @oneshot/reconciliation test: PASS (83 tests)
pnpm --filter @oneshot/worker test: PASS (27 tests)
git diff --check: PASS
Targeted Prettier check: PASS
Live Drill (GCP Vertex AI Gemini 2.5 Flash + Arc Testnet receipt): PASS

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 97e56b5

• Candidate tree SHA: d677f01c5b86ff30b35766916fe70da5685a3cf1

• Candidate commit SHA: 1e812d4

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings or residual risks: no blockers; missing outbound timeouts (read-only advisory/discovery path); zero-submission assertion could be explicit on stored pack in composition test.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: feat(reconciliation): implement live Vertex AI recovery advisor and Subgraph MCP client #46 (feat(reconciliation): implement live Vertex AI recovery advisor and Subgraph MCP client #46)

• Remote head commit SHA: 1e812d4

• Remote head tree SHA: d677f01c5b86ff30b35766916fe70da5685a3cf1

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings or residual risks: no blockers; missing outbound timeouts on fetch (read-only advisory/discovery path); zero-submission assertion could be explicit on stored pack in composition test.

• Gate B reviewed the current remote head and matches Gate A's approved tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: Unresponsive Vertex AI or Graph Gateway endpoints could delay recovery cycles until timeout; fallback WAIT remains fail-closed.
• Rollback or recovery plan: revert commit 1e812d4; unavailable ports remain the safe default fallback.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	1e812d4	Sep 08 2026, 11:54 PM