fix(delegation): complete under the original lease and preserve replan handoff

[huangruiteng]

Goal and delivered outcome

A delegated Host could finish its work but lose its original hard lease during final independent Todo acceptance. The adapter now renews that execution with its acquisition TTL before validation, journals the renewal intent, proves current authority, and freezes the terminal CAS intent. Lost replies replay the original renewal/completion requests; expired or replaced executions remain rejected. Validation does not renew and invalidate its own provider-revision witness.

A related integration gap appeared after main corrected replan precedence (#5332): after the last Todo completed, a valid empty-frontier replan was routed to a Host that requires a Todo identity. turn plan then returned a contract error. The existing Turn driver now preserves that replan as a blocked controller plan, including its instructions, without launching a Host, creating a transaction, or spending quota. Normal execution with missing lineage and invalid signatures still fail closed. Replans with a selected Todo keep their existing route.

Author declaration and scope

Written by: model_agent — OpenAI Codex (GPT-6 family).

Owning acceptance: S4 Host continuity and the shared-authority RFC's delegated execution checkpoint. This completes the bounded handoff from Host execution to final acceptance and the next controller decision; it does not qualify sustained D2 operation, SQLite release defaults, or old-writer retirement. Stop acknowledgements and interrupted-Turn no-progress settlement remain with #5308.

The Python transport adapter reuses TS claim, renew and terminal authority. The companion route fix stays at the existing Host-session adapter boundary; it does not introduce another replan decision owner, provider rule, public option, or production TTL. The future-facing pass reuses the existing route and Todo selection contracts rather than adding a compatibility mode or new module.

Validation

Candidate: d60680076e7288758ec76c1ae2f0be546cee2e0c; integrated main: 447878d0188715e3107836d2f6cc80b1c573c22c.

• Regression sensitivity: the real CLI completion → next-plan case fails before the route fix on current main, with both actionable and neutral next-action wording. After the fix, the full Optional Ark Turn workflow suite passes 348 tests locally. The original CI tested a merge ref, which explains why the old isolated branch-head run had passed; this was an integration gap, not a confirmed platform flake.
• Disposable real File/SQLite lease regression: 18 cases passed (12 running-Host/authority-loss cases plus 6 final-acceptance/reply-replay cases; targeted reruns after repairing fixture timing). The independent acceptance waits past the actual pre-renewal expiry. The fixture leaves a 20-second window for cold claim/renew commands, then uses that exact deadline rather than assuming eight seconds of sleep crosses a six-second lease. A six-second setup sometimes expired before the renewal command could run, exercising rejection instead of the intended live-renewal case. No production TTL changes. Running-Host deadline cases remain, and revocation retries only version mismatches while proving the original epoch/key so concurrent renewal cannot prevent the test from reaching cancellation.
• Mutation control: the same final-acceptance fixture rejects the pre-fix completion method after validation crosses the old expiry (handoff_mode_requires_lease); the candidate succeeds without reacquisition.
• Changed-file Ruff, configured mypy (19 files), focused driver mypy, semantic inventory advisory/drift smoke and diff/public-boundary checks: passed. No new vocabulary or provider contract.
• Exact-scope quality: receipt cqr_431cbb621c2081c40c6b, verified valid for the six-file scope 431cbb621c2081c40c6b282138688b524b5e6b4b58a36ec5f53bedba8190ba31 against the pinned integrated base; one bounded repair pass, no unresolved risks. Risk-based premerge: passed: 19/19 selected checks plus five direct checks, zero failures, warnings or manual holds.

The new head's remote CI and independent review remain separate from local evidence. No paid model or active-Goal migration was used. No authority-store implementation changed; PostgreSQL is outside this local adapter repair. Windows cancellation and installed adoption are not claimed.

Product boundary

Affected entry points are delegation and Turn CLI/controller execution. No frontend/Lark setting, permission, capability editor or rendered payload was added: completion reaches the existing accepted state, and the controller retains the existing blocked/replan contract. The complete signed envelope is preserved. Runtime changes await independent exact-head review and maintainer merge.

[huangruiteng]

CI triage for head 60a0523836e92957a1d180bc60947274bcb4e7f5, compared with current main 3cecb0d7cbf3d247cfd996267d7fc64627bd6e49:

• Packaged skill metadata: reproduced on the pinned main baseline. The performance diagnosis skill lacks agents/openai.yaml; fix(skills): ship performance diagnosis display metadata #5479 adds the metadata plus its wheel package entry. 27 existing tests and actual installed-wheel install/reinstall/uninstall passed.
• Release bundle assertion: fix(release): align artifact and host validation with shipped contracts #5467 already replaces the stale seven-skill assertion with the installed inventory. This does not make the old run green; an integrated rerun is still needed.
• Windows assertions: main includes b244ab3f6 (native Windows archive-update boundary) and 8f3783ccc (seed all packaged skills). Windows has not been rerun in this local validation.
• Doctor dispatch: the runtime-path argument expectation has a focused proposed correction in test(cli): align doctor dispatch runtime paths #5463; not yet counted as resolved here.
• Configuration revision test: failed because both default runtime roots contain state, before the expected revision rejection. fix(runtime): stop treating route locks as a second authority #5474 is a related route-lock/isolation change, but its fix for this exact failure is unverified.
• Dashboard journey: steward-journey.mjs:377 fails “the completed result removes its confirmation control.” This remains unresolved; ci(frontstage): run personal workspace browser smokes #5409's workflow changes do not establish that the interaction is fixed.
• Cancelled Python shards remain untested, not passed.

The lease-handoff implementation still needs independent review on its exact head and integrated validation. These findings separate demonstrated baseline/package failures from the provider and lease acceptance; they do not waive frontend behavior or certify SQLite admission.

[huangruiteng]

Integrated main at 3cecb0d7cbf3d247cfd996267d7fc64627bd6e49; current head is 355aa6230ce6c4095af4754ef4d11bc297ef873f. The four-file contribution diff is unchanged.

• Real File/SQLite delegation regression: 48 passed, including slow final acceptance, lost renewal/completion replies, expiry/replacement and ordinary delegation controls.
• Complete development browser acceptance with coverage: 37 scenarios passed. The previous exact head also passed a freshly built packaged steward journey. The CI confirmation-control failure was not reproduced locally; its root cause remains unconfirmed and no assertion was weakened.
• Exact-scope CQA receipt cqr_9e3081d84529fb39ea95 verifies valid; 19 selected premerge smokes, direct checks, Ruff, configured mypy and boundary scan passed; no manual holds.

Independent review has been requested for this head. New CI remains to be evaluated, including prior baseline failures documented above. This update does not claim an installed upgrade, sustained SQLite admission or maintainer merge.

[huangruiteng]

CI follow-up on unchanged head 355aa6230ce6c4095af4754ef4d11bc297ef873f: the Optional Ark Turn Python 3.13 job reports one failure in test_turn_run_once_cli_completes_selected_todo_after_validation, at the next plan after validated Todo completion (341 other cases passed). Failed job.

The same exact test passes locally in an isolated home on this PR head (24.48s) and on #5474 head cb1c8da10 (14.39s), using Python 3.13.13. CI used Linux/Python 3.13.15 and the larger adapter suite. This does not establish a fix or attribution; preserve this as an open CI failure pending a suite/environment-sensitive reproduction. No assertion has been weakened and no retry success is being used as proof of correctness.

Separately, #5474's fresh-runtime lock classification now has independent production-entrypoint and negative-case validation: #5474 (comment) . It should not be presumed to fix the Ark failure above.

[huangruiteng]

Updated and qualified head: d60680076e7288758ec76c1ae2f0be546cee2e0c (integrated base 447878d0188715e3107836d2f6cc80b1c573c22c).

The earlier CI failure is now reproduced and explained, superseding the isolated-pass triage: the workflow checked refs/pull/5466/merge. Main #5332 corrected replan precedence; after the final Todo completed, a legitimate empty-frontier replan reached the Host-session adapter without required Todo lineage. The old branch's pass was incidental to a separate prose-triggered projection-repair hint. Both neutral and actionable wording reproduce the failure on the integrated base.

The adapter now retains the complete blocked controller replan instead of building a malformed Host session. It does not create a transaction, invoke a Host or spend quota. Normal missing-lineage execution and invalid signatures remain rejected. The original completion change renews the same execution before independent acceptance and journals separate renewal/terminal intents; lost replies cannot revive expired or replaced authority.

Validation:

• Full Optional Ark Turn suite: 348 passed locally.
• Real disposable File/SQLite: 12 running-Host/authority-loss cases and 6 final-acceptance/reply-replay cases passed after fixing test timing. Revocation retries only same-epoch/key version conflicts; the acceptance fixture waits past the actual old deadline within the existing total validation budget. Production TTL is unchanged.
• Mutation sensitivity: the unchanged final-acceptance fixture rejects the baseline completion method after validation crosses the old expiry; the candidate succeeds. Initial timing/setup failures are retained locally, not counted as passes.
• Changed-file Ruff, configured mypy plus driver check, semantic drift and public-boundary checks passed.
• Exact six-file quality receipt cqr_431cbb621c2081c40c6b verified valid; one bounded repair pass, no unresolved risks. Premerge passed 19/19 selected checks + five direct checks, no failure, skip or manual hold.

Changed product entry points are delegation and Turn CLI/controller. No frontend/Lark configuration, capability editor or authority setting changed; the existing state/envelope contracts are retained. TS remains the lease/terminal authority; the bounded related refactor stays at the Host adapter. Raw Goal/session data are excluded. Sustained D2, SQLite default admission, PostgreSQL qualification and installed adoption are not claimed. Independent exact-head review has been requested; remote CI and maintainer merge remain separate gates.

[huangruiteng]

Reviewer: model_agent · GPT-6 · OpenAI

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head: d60680076e7288758ec76c1ae2f0be546cee2e0c. 已完整核对 6 个文件、277 行新增和 9 行删除；本结论只覆盖该提交，合并由维护者决定。

动机

本 PR 修复已存在的委派执行验收缝隙：Host 返回后，独立验收可能跨过原租约的到期点；完成任务后，空前沿的合法重规划又会被 Turn Host 执行器误报为契约错误。操作者需要的是一次原执行合法完成、结果可靠返回请求者、再由控制器处理后续工作，不能靠重新取得租约承认旧结果，也不应为了消除报错制造空 Host 会话。

独立规范依据为 docs/architecture/rfcs/ledger/shared-goal-authority-state-provider-v0/2026-09-28-retirement-cadence.md，固定在 447878d0188715e3107836d2f6cc80b1c573c22c，逐项结论如下：Delegated execution keeps its original lease 的原执行约束已实现；Claim replay 的原 owner/key/epoch 证明已实现；Ordinary non-hard delegation 的原路径保留；Completion 的持久化终态 CAS 与丢失回复重放已实现；Canonical completion 的释放和原 Turn 记账已实现。该 ledger 的 S4、D2、Windows 与持续运行验收仍未由此 PR 关闭。

改动思路

复用既有 TypeScript 租约、原子 claim 与验收 owner；Python 只在 Host 已停止、验收尚未捕获 provider revision 的边界适配已有命令。先证明当前原执行，再持久化续租意图并以原 acquire TTL 续租；随后重新证明当前 authority，冻结完成 CAS。续租和完成分别保留意图，避免回复丢失后从最新状态猜测旧命令。

不改生产 TTL，也不在验收中续租，后者会破坏验收的 revision witness。Turn 的另一处修复只把合法、无选中 Todo 的 REPLAN_REQUIRED 交回已有 blocked/controller 路径，完整保留 envelope，未执行重规划本身。无效签名和普通缺 Todo 仍拒绝。

具体改动

• Delegations._complete_delegated_todo：两个 journal 字段 completion_lease_renewal_version 与 completion_lease_version 分别记录不可推导的 effect intent；重放使用同一参数和原收据，不重新 acquire。
• build_loopx_turn_plan：仅合法 REPLAN_REQUIRED 且无 Todo 时走 BLOCKED；不启动 Host、session 或 transaction，不产生 quota/effect。
• 租约测试跨越真实旧截止时间，涵盖续租与完成回复各自丢失、已过期原执行及被替换 epoch；Turn 测试覆盖三种既有 replan action、无效签名，以及真实完成后不同下一步措辞。
• 双语 ledger 更新明确已交付的完成边界与仍开放的集成验收。没有新增 CLI 参数、权限或配置；UI/Lark 继续消费原有状态，不需要伴随新设置页。

对主干的风险

当前提交 104 项租约/Turn 验证及 6 项普通委派对照通过。实际 File、SQLite、CLI/Turn/managed Host 和独立验收均参与；仅模型协议为合成输入，没有付费模型调用或线上状态修改。确认单次 Host 执行、原 key/epoch 保留、canonical 完成释放和记账，丢失回复不重复执行。普通非 hard-lease 路径在 base/head 各 6 项通过。

反例敏感性已独立验证：immutable base 的真实 CLI 完成后 next-plan 回归失败；在相同真实 File/SQLite 场景换回 base 的完成方法，两次均在旧 deadline 后停留 turn_returned，当前 head 对应场景通过。过期及 replacement 原执行仍不能验收；blocked replan 的成功回执不被当作新任务已执行。

Ruff、项目配置的 19 文件 mypy、semantic drift 和 diff check 通过。额外对 driver 执行的全导入图 mypy 在 base/head 均有 4332 条错误；仅归一化行号后完整错误与备注一致，属于未改动依赖图的既有问题，不算通过，也不归为本 PR 回归。按当前评审配置未查询或等待远端 CI。没有声称 PostgreSQL store 重构验证、Windows 或安装态持续运行已通过。

我的整体评价

没有未解决的阻塞发现，APPROVE。与不修复或增加 TTL 相比，本改动在现有 owner 内修复真实失败并保留撤销和 CAS；27 行生产增量服务两个相邻的结果返回边界，范围合适。未来改动可继续复用同一租约 owner；本轮检查过 claim/renew/complete 的职责，无须抽出第二个 Python 状态机或新模块。后续更大范围的持续运行、Windows 与控制器重规划由现有 S4/D2 验收负责。本次批准不授权合并。

English verdict: APPROVE - d606800; original-lease completion and Todo-less replan handoff validated through real File/SQLite CLI paths, 110 passing focused tests, paired baseline regressions and unchanged unrelated mypy diagnostics. Maintainer merge required.