Repository navigation
feat(execution): preserve durable stop evidence - #209
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 809d05838c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 809d05838c
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b199371047
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
PR #209's review findings exposed gaps between helper-level tests and the complete shutdown lifecycle. Engineering guidance now traces owners and phases through durable completion and requires cancellation checks at the real runtime/transport and admission boundaries, preserving accounting and already-committed decisions. Planning agents must use Astra. Other delegation keeps the existing quality, security, speed, and cost criteria. Validation: committed documentation and diff checks pass. Documentation-only change; runtime code and threat model are unchanged.
A model handler that ignored cancellation could occupy the submission service and delay durable stop evidence. Task supervision now atomically records a stop request and suspension before waiting for acknowledgement. An uncertain stop frees the service for unrelated work; a late handler return retains usage and local completion evidence without publishing a result or resuming the task.
Live admission and replay bind the exact execution, original stop cause, suspension, and acknowledgement evidence. Stopped executions cannot reserve new inference or publish ordinary activity. Suspended tasks cannot begin a new protected effect, while already attempted effects retain their reconciliation path. Runtime cancellation and listener failure cancel adaptive planning, task supervisors, and active HTTP normalization before request draining. Task result admission remains cancellable until completion verification commits; finishing that already-verified task projection remains permitted. Shutdown drains stop evidence after closing providers.
The Codex adapter requires a matching terminal turn notification to confirm cooperative interruption. Otherwise it attempts owned-process termination and retires that process and transport. A later independent request creates a fresh isolated client under its own context; the interrupted request is never replayed. Deliberate shutdown prevents recreation. Handler return, local turn/process termination, and remote uncertainty remain separate facts.
Refs #178. Suspended-task reconciliation/resumption, planning and normalization acknowledgement, and the remaining complete action/timeline audit stay open under that issue.
Validation: Linux build, vet, lint (0 issues), module consistency, the full pre-commit hook (all unit tests, AIMS document checks, formatting, and architecture boundaries), race tests for the changed app/ledger/events/projections/recovery/execution/command packages, and dependency vulnerability checks passed. Regression coverage includes noncooperative handlers and unaffected tenants, active shutdown through real HTTP listeners, planning cancellation and admission, interruptions across post-handler result writes, already-verified completion recovery, late usage, transaction rollback and retry, exact live/replay bindings, file-backed recovery, stopped-task effect admission, and Codex interrupt/process lifecycle failures. No live provider calls were used.