fix(dag): low-severity batch from the 2026-08-19 deep-dive audit - #372
Merged
Conversation
- NEW-1: spawn failure boundary rethrows interrupts (parity with the file's own catchCause discipline) instead of persisting a nodeFailed - NEW-2: recovery-pause retries twice and only abandons adoption when the durable row is genuinely terminal (mirrors the replan-verdict gate) - REC-1: pending-node stale-child cancel is cause-hardened like the running branch — a persistent failure no longer aborts the whole reconcile - BLK-02: hyphen/underscore writer-id key collisions rejected at compile time - BLK-03: a verify node serving multiple parallel-writer review routes is rejected (the contract binds ONE fingerprint) instead of silently mapping only the first aggregator - CAP-02: regex tests capped at 100k chars, uniqueItems scan capped at 1000 items, file-ref capture capped at 64MiB (inline fallback beyond) - SW-L1: sweep publishes stamp the workflow row's location so live instances' summary publishers push swept settles to the TUI - F3: TUI reconnect refreshes stored goals (a missed goal.cleared no longer leaves a stale sidebar indefinitely) - F6: dag.cancel.active added to the keybind Definitions/CommandMap - AGENTS.md: tool-call discipline rules (no duplicate fan-out queries, one watch per CI wait) SW-L2 (cancel dies without ambient instance — acknowledged design) and F4/F5 (record items on the event surface) are accepted as designed. Closes#349
…s the reconcile The old test pinned the abort-on-cancel-failure behavior the audit flagged as the REC-1 defect (the workflow became unadoptable in-process until restart).
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes#349
What (all 12 audit items dispositioned)
Code fixes:
loop.ts— spawn failure boundary rethrows interrupts (Cause.hasInterrupts→failCause), parity with the file's own discipline; an instance teardown can no longer be persisted as a durablenodeFailedloop.ts— recovery-pause mirrors the replan-verdict gate: two attempts, defects folded, adoption abandoned only when the durable row is genuinely terminal; otherwise logs an error and leaves the workflow for the next instance load instead of silently stallingrecovery.ts— pending-node stale-childcancelSessionwrapped in catchCause (same hardening as the running branch); a persistent failure no longer aborts the whole reconcileblocks.ts— hyphen/underscore writer-id normalization collisions rejected at compile time (block.compile_faileddiagnostic)blocks.ts— verify serving ≥2 parallel-writer review routes rejected loudly (contract binds ONE fingerprint) instead of silently mapping only the first aggregatorcapture.ts/output-ref.ts— regex test span capped (100k chars), uniqueItems scan capped (1000 items, loud failure beyond), file-ref capture capped (64MiB stat-check, inline fallback beyond)supervision-sweep.ts— sweep's durable publishes run under an InstanceRef derived from the workflow row's directory+project, so live instances' summary publishers push swept settles to the TUI (previously bootstrap-refetch only)sync.tsx— reconnect hook refreshes every stored goal (symmetric withrefreshDagSummaries); agoal.clearedmissed during a disconnect no longer leaves a stale sidebar indefinitelykeybind.ts—dag.cancel.activeadded to Definitions + CommandMap (rebindable, in the config schema)Accepted as designed (no code change): SW-L2 (sweep cancel without ambient instance — self-documented, incident-correct), F4/F5 (event-surface record items).
Verification
bun test test/dag/600/600 across 51 files