service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953

Description

@claude

Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.

The reading

AutomationEngine has two deliberate, operator-initiated run-lifecycle verbs:

Neither is reachable by an operator. Measured on origin/main plus PR #13951:

  1. No REST route. The automation run surface exposes resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.
  2. No CLI command.packages/cli has no run commands at all.
  3. Neither is declared on IAutomationService (packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.

⇒ Both are host-only primitives. For cancelRun that has been survivable because plugin-approvals calls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.

Why this is worth its own card rather than a rider

Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.

A trap for whoever takes it — do NOT ship a plain lister

The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over sys_automation_run terminal rows carrying a restorable snapshot, not a read of engine memory.

Not measured

How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.

Related

#13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)


Generated by Claude Code

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
       blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
      }
      } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
      })();
      (function(){
      try {
      var __m = "github.com";
      var __re = new RegExp('^' + "github\\.com" + '
      
      Skip to content

      service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953

      Description

      @claude

      Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.

      The reading

      AutomationEngine has two deliberate, operator-initiated run-lifecycle verbs:

      Neither is reachable by an operator. Measured on origin/main plus PR #13951:

      1. No REST route. The automation run surface exposes resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.
      2. No CLI command.packages/cli has no run commands at all.
      3. Neither is declared on IAutomationService (packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.

      ⇒ Both are host-only primitives. For cancelRun that has been survivable because plugin-approvals calls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.

      Why this is worth its own card rather than a rider

      Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.

      A trap for whoever takes it — do NOT ship a plain lister

      The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over sys_automation_run terminal rows carrying a restorable snapshot, not a read of engine memory.

      Not measured

      How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.

      Related

      #13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)


      Generated by Claude Code

      Metadata

      Metadata

      Assignees

      No one assigned

        Type

        No type

        Projects

        No projects

          Milestone

          No milestone

          Relationships

          None yet

          Development

          No branches or pull requests

          Issue actions

          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
          Skip to content

          service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953

          Description

          @claude

          Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.

          The reading

          AutomationEngine has two deliberate, operator-initiated run-lifecycle verbs:

          Neither is reachable by an operator. Measured on origin/main plus PR #13951:

          1. No REST route. The automation run surface exposes resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.
          2. No CLI command.packages/cli has no run commands at all.
          3. Neither is declared on IAutomationService (packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.

          ⇒ Both are host-only primitives. For cancelRun that has been survivable because plugin-approvals calls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.

          Why this is worth its own card rather than a rider

          Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.

          A trap for whoever takes it — do NOT ship a plain lister

          The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over sys_automation_run terminal rows carrying a restorable snapshot, not a read of engine memory.

          Not measured

          How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.

          Related

          #13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)


          Generated by Claude Code

          Metadata

          Metadata

          Assignees

          No one assigned

            Type

            No type

            Projects

            No projects

              Milestone

              No milestone

              Relationships

              None yet

              Development

              No branches or pull requests

              Issue actions

              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
              Skip to content

              service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953

              Description

              @claude

              Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.

              The reading

              AutomationEngine has two deliberate, operator-initiated run-lifecycle verbs:

              Neither is reachable by an operator. Measured on origin/main plus PR #13951:

              1. No REST route. The automation run surface exposes resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.
              2. No CLI command.packages/cli has no run commands at all.
              3. Neither is declared on IAutomationService (packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.

              ⇒ Both are host-only primitives. For cancelRun that has been survivable because plugin-approvals calls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.

              Why this is worth its own card rather than a rider

              Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.

              A trap for whoever takes it — do NOT ship a plain lister

              The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over sys_automation_run terminal rows carrying a restorable snapshot, not a read of engine memory.

              Not measured

              How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.

              Related

              #13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)


              Generated by Claude Code

              Metadata

              Metadata

              Assignees

              No one assigned

                Type

                No type

                Projects

                No projects

                  Milestone

                  No milestone

                  Relationships

                  None yet

                  Development

                  No branches or pull requests

                  Issue actions

                  , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
                  Skip to content

                  service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953

                  Description

                  @claude

                  Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.

                  The reading

                  AutomationEngine has two deliberate, operator-initiated run-lifecycle verbs:

                  Neither is reachable by an operator. Measured on origin/main plus PR #13951:

                  1. No REST route. The automation run surface exposes resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.
                  2. No CLI command.packages/cli has no run commands at all.
                  3. Neither is declared on IAutomationService (packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.

                  ⇒ Both are host-only primitives. For cancelRun that has been survivable because plugin-approvals calls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.

                  Why this is worth its own card rather than a rider

                  Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.

                  A trap for whoever takes it — do NOT ship a plain lister

                  The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over sys_automation_run terminal rows carrying a restorable snapshot, not a read of engine memory.

                  Not measured

                  How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.

                  Related

                  #13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)


                  Generated by Claude Code

                  Metadata

                  Metadata

                  Assignees

                  No one assigned

                    Type

                    No type

                    Projects

                    No projects

                      Milestone

                      No milestone

                      Relationships

                      None yet

                      Development

                      No branches or pull requests

                      Issue actions

                      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
                      Skip to content

                      service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953

                      Description

                      @claude

                      Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.

                      The reading

                      AutomationEngine has two deliberate, operator-initiated run-lifecycle verbs:

                      Neither is reachable by an operator. Measured on origin/main plus PR #13951:

                      1. No REST route. The automation run surface exposes resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.
                      2. No CLI command.packages/cli has no run commands at all.
                      3. Neither is declared on IAutomationService (packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.

                      ⇒ Both are host-only primitives. For cancelRun that has been survivable because plugin-approvals calls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.

                      Why this is worth its own card rather than a rider

                      Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.

                      A trap for whoever takes it — do NOT ship a plain lister

                      The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over sys_automation_run terminal rows carrying a restorable snapshot, not a read of engine memory.

                      Not measured

                      How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.

                      Related

                      #13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)


                      Generated by Claude Code

                      Metadata

                      Metadata

                      Assignees

                      No one assigned

                        Type

                        No type

                        Projects

                        No projects

                          Milestone

                          No milestone

                          Relationships

                          None yet

                          Development

                          No branches or pull requests

                          Issue actions

                          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
                          Skip to content

                          service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953

                          Description

                          @claude

                          Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.

                          The reading

                          AutomationEngine has two deliberate, operator-initiated run-lifecycle verbs:

                          Neither is reachable by an operator. Measured on origin/main plus PR #13951:

                          1. No REST route. The automation run surface exposes resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.
                          2. No CLI command.packages/cli has no run commands at all.
                          3. Neither is declared on IAutomationService (packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.

                          ⇒ Both are host-only primitives. For cancelRun that has been survivable because plugin-approvals calls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.

                          Why this is worth its own card rather than a rider

                          Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.

                          A trap for whoever takes it — do NOT ship a plain lister

                          The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over sys_automation_run terminal rows carrying a restorable snapshot, not a read of engine memory.

                          Not measured

                          How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.

                          Related

                          #13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)


                          Generated by Claude Code

                          Metadata

                          Metadata

                          Assignees

                          No one assigned

                            Type

                            No type

                            Projects

                            No projects

                              Milestone

                              No milestone

                              Relationships

                              None yet

                              Development

                              No branches or pull requests

                              Issue actions

                              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
                              Skip to content

                              service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953

                              Description

                              @claude

                              Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.

                              The reading

                              AutomationEngine has two deliberate, operator-initiated run-lifecycle verbs:

                              Neither is reachable by an operator. Measured on origin/main plus PR #13951:

                              1. No REST route. The automation run surface exposes resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.
                              2. No CLI command.packages/cli has no run commands at all.
                              3. Neither is declared on IAutomationService (packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.

                              ⇒ Both are host-only primitives. For cancelRun that has been survivable because plugin-approvals calls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.

                              Why this is worth its own card rather than a rider

                              Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.

                              A trap for whoever takes it — do NOT ship a plain lister

                              The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over sys_automation_run terminal rows carrying a restorable snapshot, not a read of engine memory.

                              Not measured

                              How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.

                              Related

                              #13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)


                              Generated by Claude Code

                              Metadata

                              Metadata

                              Assignees

                              No one assigned

                                Type

                                No type

                                Projects

                                No projects

                                  Milestone

                                  No milestone

                                  Relationships

                                  None yet

                                  Development

                                  No branches or pull requests

                                  Issue actions