feat: implement Graph Studio agent recovery

[SuPuHe]

Summary

Implements docs/GRAPH_STUDIO_AGENT_RECOVERY_PLAN.md on plan/graph-studio-agent-recovery: native authenticated Studio GraphQL for the active Arc Testnet recovery path, truthful Graph provenance, bounded validation before Vertex, API error handling, and consistent contracts, storage, UI, docs, and tests.

Scope and acceptance criteria

• The change is limited to the Graph Studio agent recovery milestone.
• Native authenticated Studio GraphQL is the active Arc Testnet source.
• STUDIO_GRAPHQL and optional SUBGRAPH_MCP provenance are transport-truthful.
• Graph data is bounded and validated before Vertex.
• Idempotency and settlementPermission: NEVER are preserved.
• API, contracts, storage, worker, UI, documentation, and tests are updated.
• No unrelated cleanup is included.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.
• Any non-applicable invariant is explained below.

Invariant notes:

No settlement-path behavior changed. Recovery remains advisory and uses settlementPermission: NEVER. UNKNOWN remains a reconciliation requirement and is never treated as proof that payment did not happen. Studio API keys remain runtime-only and are not persisted, logged, or passed to Vertex.

Validation

Commands and results:

pnpm format:check — PASS
pnpm typecheck — PASS
pnpm lint — PASS
pnpm check:generated — PASS
pnpm validate:fixtures — PASS (9 contracts + 7 UI fixtures)
pnpm test — PASS (64 files, 971 tests)
pnpm demo:e2e — PASS (Gate P6 demo)
npx markdownlint-cli2 — PASS (0 issues)
pnpm test:browser — PASS (7/7)
PostgreSQL integration suites — SKIPPED (TEST_POSTGRES not enabled locally)

Independent review evidence

Gate A — exact candidate tree before push

VERDICT: PASS
REVIEWER_TOOL: free-pi-cli
REVIEWER_MODEL: glm-5.3-flash
REVIEWED_BASE: develop (dd79e71be187a86671fd127613732dd99f0e1529)
REVIEWED_TARGET: plan/graph-studio-agent-recovery (staged index; HEAD 1a55b921db2429187785bde606e326bacdf440b8 unpushed, worktree identical to index)
REVIEWED_TREE: 2c93a7e6f068f3fa4cf1149bf69ee486a2257eed
BLOCKING_FINDINGS:
- None
NON_BLOCKING_FINDINGS:
- packages/reconciliation/src/agent-contract.ts:87 — degraded no-index prompt context defaults retrieval to SUBGRAPH_MCP; a transport-neutral or explicit not-observed value would be more truthful.
- packages/recovery-ui/src/RecoveryTimeline.tsx — rendered coverage does not exercise the STUDIO_GRAPHQL label branch.
- docs/DEMO_SCRIPT.md — cosmetic line-break indentation issue around settlementPermission: NEVER.

Gate A validation evidence included full candidate diff inspection, routed policy review, secret scanning, 971 passing tests, 7/7 browser tests, generated contracts, fixtures, demo E2E, format, lint, typecheck, and markdown validation. Gate A found no blocking findings.

• The reviewed tree equals the committed and remote tree: 2c93a7e6f068f3fa4cf1149bf69ee486a2257eed.

Gate B — exact remote PR head

• Pull request URL/number: feat: implement Graph Studio agent recovery #68

• Remote head commit SHA: 29f27da067dac89075e7486c1b3a86e9c7cd8c0b

• Remote head tree SHA: 2c93a7e6f068f3fa4cf1149bf69ee486a2257eed

• Reviewer tool: free-pi-cli

• Reviewer model: NOT RUN

• Verdict: NOT RUN — Gate B is pending

• Findings or residual risks: Required CI is green. PostgreSQL integration and live acceptance remain environment-dependent; sponsor qualification remains NOT VERIFIED pending a fresh Studio and Vertex trace.

• Gate B reviewed the current remote head and matches Gate A approval.

• Agent policy / repository-policy and all currently reported required CI checks pass.

Risk and rollback

• Residual risks: PostgreSQL integration is not locally enabled. Live Studio/Vertex acceptance, outbox consumption without health traffic, and unchanged nonce still require the documented live gate. Studio remains rate-limited/testing-grade; Network or self-hosted migration is future work.
• Rollback or recovery plan: Revert commit 29f27da067dac89075e7486c1b3a86e9c7cd8c0b if CI or human review identifies a regression; no settlement was submitted by this change.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

Gate A reviewer report

The complete supplied Gate A report is represented above: VERDICT: PASS, reviewer free-pi-cli, model glm-5.3-flash, base dd79e71be187a86671fd127613732dd99f0e1529, candidate tree 2c93a7e6f068f3fa4cf1149bf69ee486a2257eed, no blocking findings, and only the three listed non-blocking findings.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	29f27da	Sep 10 2026, 05:39 PM