RAGE #41: specify typed durable Auto-Dig lifecycle #43

Merged

lost-rob0t merged 24 commits from rage/41-autodig-lifecycle into main

2026-08-26 06:21:19 +00:00

lost-rob0t commented

2026-08-25 06:14:40 +00:00

(Migrated from github.com)

Implements the owning Quasar slice for #41 using RAGE/ADADR and TDD-first execution.

Reconciliation state

The lifecycle branch has been mechanically reconciled with current Quasar main through PR #47. GitHub compare showed disjoint changed path sets: current main changed CI/frontend E2E files while this lifecycle work changes control-plane/system/test files only. PR #47 ran the full Quasar CI against the combined merge candidate and completed GREEN before merge.

Current exact lifecycle branch head: e0e662be968568adbe0f9a22b00b417c92db9ad7.

TDD evidence

Tests-only a640874c4004a05045fcd2732fdb0009bedb5c0c produced expected RED: the seven autodig.* lifecycle commands were absent.
Expanded tests pinned restart durability, bounded status/list, transition semantics, workspace isolation and request-id idempotency before production realization.
Quasar lifecycle realization stores snapshots through the existing durable workspace/journal boundary; no parallel Auto-Dig DB.
Worker-fencing tests were added before autodig.worker.claim/heartbeat/complete/fail, proving stale workers cannot overwrite user pause/stop or a newer lease.
Production WebSocket authorization creates a dedicated least-privilege scheduled-worker session rather than reusing browser capabilities.
Crash-recovery tests exposed that active runs could be stranded forever after worker death. The implementation uses a bounded worker lease and permits reclaim of active only after the persisted owning heartbeat/claim timestamp expires; live leases remain exclusive and old fencing tokens fail closed.

Public lifecycle contract

autodig.status
autodig.run.get
autodig.run.list
autodig.run.start
autodig.run.pause
autodig.run.resume
autodig.run.stop

Properties:

stable workspace-scoped durable runId;
immediate queued start response;
stable requestId idempotency and conflict rejection;
process-restart recovery through the injected store/Tek9 journal;
bounded list/status;
explicit pause/resume/stop transitions;
no worker lease/principal internals in public run responses.

Worker-only lifecycle

Internal worker commands are separately fenced by workerId + fresh leaseId:

autodig.worker.claim
autodig.worker.heartbeat
autodig.worker.complete
autodig.worker.fail

Quasar alone owns lease expiry, reclaim decisions and lifecycle state. A stale worker cannot overwrite a user pause/stop or newer claim.

Exact reconciliation verification

PR #47 CI #805 completed SUCCESS on the combined main+lifecycle candidate, covering:

static/frontend/build checks;
Common Lisp transaction, persistence and control-plane tests;
real quasar-web load;
complete development-stack smoke;
Playwright real-stack desktop/mobile/mutation/reload paths;
packaged production routing/PWA/security smoke.

Runtime handoff

Paired worker PR lost-rob0t/starintel-gpt-auto-dig#2294 is currently 0e97ac468766f768e6ed1121cde6e7dc41af203a; exact-head Auto-Dig lifecycle CI #25 and full site/UI validation #591 are GREEN. It remains draft because its repository-local AGENTS.md requires a local nimble buildFast && bin/validate-for-merge --site gate before ready/merge, and that local dependency checkout cannot be executed in the current worker environment.

No Bixby-specific protocol, browser automation, direct CouchDB/RabbitMQ authority, or fake gateway compatibility layer is introduced here.

Implements the owning Quasar slice for #41 using RAGE/ADADR and TDD-first execution. ## Reconciliation state The lifecycle branch has been mechanically reconciled with current Quasar `main` through PR #47. GitHub compare showed disjoint changed path sets: current main changed CI/frontend E2E files while this lifecycle work changes control-plane/system/test files only. PR #47 ran the full Quasar CI against the combined merge candidate and completed GREEN before merge. Current exact lifecycle branch head: `e0e662be968568adbe0f9a22b00b417c92db9ad7`. ## TDD evidence 1. Tests-only `a640874c4004a05045fcd2732fdb0009bedb5c0c` produced expected RED: the seven `autodig.*` lifecycle commands were absent. 2. Expanded tests pinned restart durability, bounded status/list, transition semantics, workspace isolation and request-id idempotency before production realization. 3. Quasar lifecycle realization stores snapshots through the existing durable workspace/journal boundary; no parallel Auto-Dig DB. 4. Worker-fencing tests were added before `autodig.worker.claim/heartbeat/complete/fail`, proving stale workers cannot overwrite user pause/stop or a newer lease. 5. Production WebSocket authorization creates a dedicated least-privilege scheduled-worker session rather than reusing browser capabilities. 6. Crash-recovery tests exposed that `active` runs could be stranded forever after worker death. The implementation uses a bounded worker lease and permits reclaim of `active` only after the persisted owning heartbeat/claim timestamp expires; live leases remain exclusive and old fencing tokens fail closed. ## Public lifecycle contract - `autodig.status` - `autodig.run.get` - `autodig.run.list` - `autodig.run.start` - `autodig.run.pause` - `autodig.run.resume` - `autodig.run.stop` Properties: - stable workspace-scoped durable `runId`; - immediate queued start response; - stable `requestId` idempotency and conflict rejection; - process-restart recovery through the injected store/Tek9 journal; - bounded list/status; - explicit pause/resume/stop transitions; - no worker lease/principal internals in public run responses. ## Worker-only lifecycle Internal worker commands are separately fenced by `workerId` + fresh `leaseId`: - `autodig.worker.claim` - `autodig.worker.heartbeat` - `autodig.worker.complete` - `autodig.worker.fail` Quasar alone owns lease expiry, reclaim decisions and lifecycle state. A stale worker cannot overwrite a user pause/stop or newer claim. ## Exact reconciliation verification PR #47 CI #805 completed SUCCESS on the combined main+lifecycle candidate, covering: - static/frontend/build checks; - Common Lisp transaction, persistence and control-plane tests; - real `quasar-web` load; - complete development-stack smoke; - Playwright real-stack desktop/mobile/mutation/reload paths; - packaged production routing/PWA/security smoke. ## Runtime handoff Paired worker PR `lost-rob0t/starintel-gpt-auto-dig#2294` is currently `0e97ac468766f768e6ed1121cde6e7dc41af203a`; exact-head Auto-Dig lifecycle CI #25 and full site/UI validation #591 are GREEN. It remains draft because its repository-local `AGENTS.md` requires a local `nimble buildFast && bin/validate-for-merge --site` gate before ready/merge, and that local dependency checkout cannot be executed in the current worker environment. No Bixby-specific protocol, browser automation, direct CouchDB/RabbitMQ authority, or fake gateway compatibility layer is introduced here.

lost-rob0t commented

2026-08-25 08:18:56 +00:00

(Migrated from github.com)

Exact-head CI #740 diagnosis: this is not currently actionable as an #41 implementation regression. Current main SHA 560208d0906cf564dd59050bca9a0f9341a3c55d is already red in CI #718 at the same Real-stack desktop, mobile, mutation, and reload paths step, while #43 changes only Auto-Dig Common Lisp + ASDF test/system files and passes static/frontend/build, complete Lisp/control-plane tests, real quasar-web load, and development-stack smoke. Opened #44 for the baseline Playwright failure and draft #45 to retain HTML/trace diagnostics on failure without weakening/skipping the gate. Keep #43 draft and do not merge until baseline #44 is fixed and #43 receives a fully green exact-head run.

Exact-head CI #740 diagnosis: this is not currently actionable as an #41 implementation regression. Current `main` SHA `560208d0906cf564dd59050bca9a0f9341a3c55d` is already red in CI #718 at the same `Real-stack desktop, mobile, mutation, and reload paths` step, while #43 changes only Auto-Dig Common Lisp + ASDF test/system files and passes static/frontend/build, complete Lisp/control-plane tests, real `quasar-web` load, and development-stack smoke. Opened #44 for the baseline Playwright failure and draft #45 to retain HTML/trace diagnostics on failure without weakening/skipping the gate. Keep #43 draft and do not merge until baseline #44 is fixed and #43 receives a fully green exact-head run.

lost-rob0t commented

2026-08-25 11:11:56 +00:00

(Migrated from github.com)

RAGE/TDD continuation after #44/#46 cleared the stale Playwright baseline:

Fresh exact-head CI #785 on 91d723a88572d9671c898bd31b2da9dbaf0597f2 exposed a different, branch-specific test-bootstrap defect before the lifecycle suite could run: ASDF failed with Component #:CLACK not found, required by #<SYSTEM "clog">.

Root cause is now pinned. #43 changed quasar-tests to depend on quasar-web so the new Auto-Dig WebSocket authorization tests exercise the real service boundary, but scripts/test-lisp and scripts/check-control-plane-deps.mjs still modeled the old quasar-control + quasar-starlang test dependency graph. The static guard therefore false-greened a bootstrap that omitted CLOG/Clack/WebSocket dependencies.

TDD correction on the same branch:

9a7f7afc82e6d404a80d0afd732ef14e26b92743 preloads the exact external quasar-web test dependencies in scripts/test-lisp;
562c3ea00a773b44198430f940b3ce43cc00e21c updates the dependency guard so future test-graph drift is caught statically.

No Auto-Dig production semantics were weakened or changed for this failure. Exact-head CI #789 is running on 562c3ea...; static/frontend/build and Lisp dependency installation are already green, and the Common Lisp suite is currently executing. Keep #43 draft until that entire run is green and the scheduled worker bridge acceptance described in this PR is satisfied.

RAGE/TDD continuation after #44/#46 cleared the stale Playwright baseline: Fresh exact-head CI #785 on `91d723a88572d9671c898bd31b2da9dbaf0597f2` exposed a different, branch-specific test-bootstrap defect before the lifecycle suite could run: ASDF failed with `Component #:CLACK not found, required by #<SYSTEM "clog">`. Root cause is now pinned. #43 changed `quasar-tests` to depend on `quasar-web` so the new Auto-Dig WebSocket authorization tests exercise the real service boundary, but `scripts/test-lisp` and `scripts/check-control-plane-deps.mjs` still modeled the old `quasar-control + quasar-starlang` test dependency graph. The static guard therefore false-greened a bootstrap that omitted CLOG/Clack/WebSocket dependencies. TDD correction on the same branch: - `9a7f7afc82e6d404a80d0afd732ef14e26b92743` preloads the exact external `quasar-web` test dependencies in `scripts/test-lisp`; - `562c3ea00a773b44198430f940b3ce43cc00e21c` updates the dependency guard so future test-graph drift is caught statically. No Auto-Dig production semantics were weakened or changed for this failure. Exact-head CI #789 is running on `562c3ea...`; static/frontend/build and Lisp dependency installation are already green, and the Common Lisp suite is currently executing. Keep #43 draft until that entire run is green and the scheduled worker bridge acceptance described in this PR is satisfied.

lost-rob0t commented

2026-08-25 12:12:23 +00:00

(Migrated from github.com)

Exact-head verification update: CI #789 completed SUCCESS on current head 562c3ea00a773b44198430f940b3ce43cc00e21c. This confirms the full repository gate now passes after the test-graph/bootstrap corrections, including the Auto-Dig lifecycle/control-plane suites and the broader Quasar CI tail. I am keeping #43 draft because its stated runtime handoff gate is still real: lost-rob0t/starintel-gpt-auto-dig#2294 has not yet integrated the concrete authenticated quasar.control.v1 transport + existing research executor. No lifecycle tests are being weakened and no Bixby shim is being substituted.

Exact-head verification update: CI #789 completed **SUCCESS** on current head `562c3ea00a773b44198430f940b3ce43cc00e21c`. This confirms the full repository gate now passes after the test-graph/bootstrap corrections, including the Auto-Dig lifecycle/control-plane suites and the broader Quasar CI tail. I am keeping #43 draft because its stated runtime handoff gate is still real: `lost-rob0t/starintel-gpt-auto-dig#2294` has not yet integrated the concrete authenticated `quasar.control.v1` transport + existing research executor. No lifecycle tests are being weakened and no Bixby shim is being substituted.

lost-rob0t commented

2026-08-25 14:30:19 +00:00

(Migrated from github.com)

RAGE/TDD continuation on crash recovery:

Found an owning-boundary defect after the previous green lifecycle slice: autodig.worker.claim accepted only queued runs, so a worker crash could strand a durable run in active forever. Added a canonical ASDF test first (control-plane/tests/autodig-worker-reclaim-tests.lisp) proving a live lease remains exclusive but an expired lease must be reclaimable with the same runId, a fresh fencing lease, and stale-worker rejection for the old lease. The RED head failed exactly with autodig.claim-conflict on replacement claim.

Production realization now adds a bounded worker lease timeout and permits claim of active only when the persisted heartbeat/claim timestamp is expired. First implementation head 19e2a1f... still RED because persisted JSON timestamps were not reliably integerp; current head aea61e9602696a76f5d561e7f0873e501a7ab536 accepts any real numeric persisted timestamp instead. Exact-head CI #799 is running. Do not merge until the complete repository gate is green.

The paired Python consumer is being corrected separately so it offers active runs back to Quasar for the claim decision; it does not calculate lease age itself.

RAGE/TDD continuation on crash recovery: Found an owning-boundary defect after the previous green lifecycle slice: `autodig.worker.claim` accepted only queued runs, so a worker crash could strand a durable run in `active` forever. Added a canonical ASDF test first (`control-plane/tests/autodig-worker-reclaim-tests.lisp`) proving a live lease remains exclusive but an expired lease must be reclaimable with the same runId, a fresh fencing lease, and stale-worker rejection for the old lease. The RED head failed exactly with `autodig.claim-conflict` on replacement claim. Production realization now adds a bounded worker lease timeout and permits claim of `active` only when the persisted heartbeat/claim timestamp is expired. First implementation head `19e2a1f...` still RED because persisted JSON timestamps were not reliably `integerp`; current head `aea61e9602696a76f5d561e7f0873e501a7ab536` accepts any real numeric persisted timestamp instead. Exact-head CI #799 is running. Do not merge until the complete repository gate is green. The paired Python consumer is being corrected separately so it offers active runs back to Quasar for the claim decision; it does not calculate lease age itself.