Resume tasks after scope amendments

[mchwang]

Summary

• Reconcile an amended plan suffix at the runner-audited checkpoint and require explicit revision- and snapshot-bound continuation approval.
• Preserve approval ancestry across committed continuation items; include reconciled completion in runner polling and publishing; refuse to skip completed work if an item changes without changing its ID.
• Settle owed scope and safety findings before continuation reconciliation, keep review available on reconciliation refusal while marking approvals stale, and support approval/publication after a final-item scope finding.
• Restrict checkpoint-owner amendments to declaring observed out-of-scope paths; completed work definitions remain immutable.
• Bind continuation planning context to the audited checkpoint and preserve the original prompt byte-for-byte for ordinary plans.
• Trigger ready publishing when a newly approved empty continuation completes an already-running task, without triggering on action replays or refusals.
• Validate the complete continuation candidate schema before suffix-only semantic validation, and reject duplicate dependencies plus invalid, duplicate, or overlapping checkpoint-owner path declarations under the configured filesystem identity.
• Keep continuation approval retryable during shutdown, including stale partial-body requests and configurations without an active runner.

Validation

• Baseline: 284d92ed5b1b0101c61723db1c693e680fb75d85 (current origin/main, including Docs: refresh architecture progress #133).
• Validated and pushed head: 1321cb19233a8f723422cfc556e36b0b490fa984.
• Exact-head lifecycle/publishing validation: 117 tests passed.
• Exact-head broader affected validation: 11 files, 485 tests passed.
• Exact-head typecheck and git diff --check passed.
• A fresh high-effort independent full-diff review of origin/main...1321cb1 returned no actionable findings.
• Exact-head GitHub CI is green: both standard test runs and the real-Docker isolation run passed.
• A full local suite attempt reached Docker supervisor coverage but hit the repository's existing Docker cleanup timeout/hang; it is not counted as passing. The exact-head GitHub real-Docker job completed successfully instead.

Review status

• Copilot: full candidate schema was not validated before completed items were sliced away. Fixed in ed9bc84; a 30-item-plan regression proves a 31st item cannot be persisted. Replied and resolved; nothing declined.
• Copilot: checkpoint-owner declarations could duplicate or overlap paths. Fixed in ed9bc84; regressions cover add/delete collisions, parent/child overlap, duplicate rename sources, and case-folded aliases. Replied and resolved; nothing declined.
• Copilot summary concern: completed items could carry renamed_from on a non-rename declaration. Reproduced and fixed in the same owner-declaration guard with regression coverage; nothing declined.
• Independent review: duplicate dependencies on the completed prefix were filtered before suffix validation. Fixed in fa832c6; regression rejects a repeated completed dependency.
• Copilot: a stale continuation approval finishing its body during shutdown could save a retry-blocking 409. Reproduced and fixed across a4eb7a3 and 8758c6e; regressions cover server shutdown, no-runner shutdown, and direct runner admission closure. Replied and resolved; nothing declined.
• Independent review: completed checkpoint declarations could bypass canonical repository-path validation. Reproduced and fixed in 1321cb1; regression rejects the unsafe declaration before approval.
• Final independent review: no actionable findings on exact head 1321cb1.
• Final Copilot review: Findings: None on exact head 1321cb1; it confirms the shutdown finding is resolved.
• Deferred follow-up issues: none identified.

Review-lesson audit

• Full-candidate schema, path identity, and completed-prefix ownership findings are covered by the existing fail-closed validation and untrusted-path rules in AGENTS.md.
• Shutdown/replay findings are covered by the existing outer-admission, partial-request shutdown, and retryable-503/idempotency rules in AGENTS.md.
• The duplicate-dependency invariant was a one-off semantic gap and is now recorded as a targeted regression.
• No new AGENTS.md rule is needed; no finding was declined.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable runner-state changes have unresolved correctness issues and incomplete full CI, requiring human review.

Review effort: Balanced
Findings: 5

Open (5)

• Retain approvals across verified continuation ancestry · New
• Recover legacy checkpoint trees before scope equality checks · New
• Avoid continuation validation before settling owed findings · New
• Include reconciled checkpoint prefix in publishing completion · New
• Return shutdown errors without persisting retry-blocking refusals · New

What changed in this PR

Enables runner tasks paused by out-of-scope changes to resume after explicit approval of an amended plan.

Changes:

• Reconciles completed work against audited runner commits.
• Adds snapshot-bound continuation approval and unfinished-item execution.
• Updates migration tests, continuation coverage, and documentation.

File	Description
web/​server.ts	Adds continuation approval and status API fields.
test/​store.test.ts	Tests continuation approval and suffix validation.
test/​runner-workspace.test.ts	Checks audited checkpoint trees.
test/​runner-start.test.ts	Tests API approval and resume.
test/​runner-publishing.test.ts	Supplies checkpoint context in fixtures.
test/​runner-production.test.ts	Wires checkpoint context into fixtures.
test/​runner-lifecycle-store.test.ts	Updates schema-version expectations.
test/​runner-execution.test.ts	Covers continuation and renewed approval.
test/​publish.test.ts	Updates migration expectations.
test/​planning-drafts.test.ts	Updates migration expectations.
runner/​store.ts	Persists approvals and reconciles checkpoint progress.
runner/​review.ts	Reads plan context at audited commits.
runner/​production.ts	Connects checkpoint context to execution.
runner/​execution.ts	Resumes unfinished work and captures checkpoint trees.
README.md	Documents continuation API usage.
docs/​plan-format.md	Defines amended-plan continuation requirements.
docs/​implementation/​runner-lifecycle.md	Documents approval lifecycle and schema v14.
docs/​architecture.md	Updates runner capabilities and workflow.
core/​plan.ts	Adds unfinished-suffix validation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable continuation changes have unresolved correctness issues, and the full test suite has not completed.

Review effort: Balanced
Findings: 7

Open (7)

• Publishing progress ignores completed continuation prefix · New
• Continuation approval inheritance omits audited completion prefix · New
• Return shutdown errors without persisting retry-blocking refusals
• Include reconciled checkpoint prefix in publishing completion
• Avoid continuation validation before settling owed findings
• Recover legacy checkpoint trees before scope equality checks
• Retain approvals across verified continuation ancestry

[Copilot]

Copilot review overview

🟡 Changes recommended

Continuation validation and recovery paths still contain blocking correctness issues.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Checkpoint validation ignores pre-checkpoint definition changes · New
• Allow approval and publishing after final-item scope findings · New
• Handle reconciliation refusals without failing review loads · New
• Ignore object key order when comparing item definitions · New

Resolved since last review (7)

• Continuation approval inheritance omits audited completion prefix
• Publishing progress ignores completed continuation prefix
• Return shutdown errors without persisting retry-blocking refusals
• Include reconciled checkpoint prefix in publishing completion
• Avoid continuation validation before settling owed findings
• Recover legacy checkpoint trees before scope equality checks
• Retain approvals across verified continuation ancestry

Previously missed (1)

In code that hasn't changed since last review

Defer reconciliation when scope debt remains unresolved

web/​server.ts:123

Owed scope evidence must also settle before reconciliation. If resumed P2 commits out-of-scope changes but its checkpoint save fails, importing an amendment to P2 makes this call reject its changed definition against the older P1 checkpoint. Resume then cannot reach the scope-debt branch or ItemExecutor.begin(), which would record P2's missing pause first. Defer reconciliation for scope debt as well as safety debt.

[mchwang]

Addressed the summary-only scope-debt finding on 296deeb. The resume path now skips continuation reconciliation while any finding is owed, allowing the missing scope pause to settle first. The regression simulates a later out-of-scope result plus an edited completed item and verifies the resume API records the scope checkpoint before prefix reconciliation can refuse.

[Copilot]

Copilot review overview

🟡 Changes recommended

Continuation validation can reject valid amendments or accept unexecuted work as completed.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Validate all paths in appended rename declarations · New
• Use configured path identity for amendment reconciliation · New
• Validate amendments against the checkpointed plan state · New

Resolved since last review (4)

• Allow approval and publishing after final-item scope findings
• Checkpoint validation ignores pre-checkpoint definition changes
• Ignore object key order when comparing item definitions
• Handle reconciliation refusals without failing review loads

[Copilot]

Copilot review overview

🟡 Changes recommended

Continuation validation and amendment recovery retain unresolved correctness gaps.

Review effort: Balanced
Findings: 3

Open (3)

• Duplicate IDs allowed across completed prefix and amendment suffix · New
• Plan reconciliation blocks corrective amendments during pending release · New
• Planning requests validate amendments against stale full-plan context · New

Resolved since last review (3)

• Validate all paths in appended rename declarations
• Validate amendments against the checkpointed plan state
• Use configured path identity for amendment reconciliation

[Copilot]

Copilot review overview

🔵 Needs a closer look

Cross-cutting durable lifecycle changes have unresolved issues and require final human review.

Review effort: Balanced
Findings: 1 · 3

Open (4)

• Clear pending requeue claim after empty-suffix approval · New
• Include checkpoint context and amendment rules in continuation prompts · New
• Allow continuation validation before unfinished operations fit checkpoint · New
• Persist ready-request invalidation when apply requests are refused · New

Resolved since last review (3)

• Planning requests validate amendments against stale full-plan context
• Plan reconciliation blocks corrective amendments during pending release
• Duplicate IDs allowed across completed prefix and amendment suffix

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable reconciliation, approval ancestry, and publishing transitions warrant human review, with a publishing issue still unresolved.

Review effort: Balanced
Findings: 1

Open (1)

• Trigger publishing after approval of an already-running task · New

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable approval ancestry, schema migrations, and automatic publishing interactions require final human review.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Trigger publishing after approval of an already-running task

Previously missed (1)

In code that hasn't changed since last review

Validate renamed_from invariant on completed items

core/​plan.ts:147

The completed prefix skips the v1 renamed_from check, but its checkpoint owner can still gain file declarations. An appended add for extra-a with renamed_from: 'extra-b' passes reconciliation when both paths were observed, and approval incorrectly counts both as declared. Validate this invariant on completed items before slicing or returning for an empty suffix, and add a regression rejecting this amendment.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable approval, execution, recovery, and publishing changes require human review, and validation gaps remain.

Review effort: Balanced
Findings: 2

Open (2)

• Validate full candidate schema before slicing completed items · New
• Detect duplicate and overlapping paths across all owner declarations · New

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable continuation and publishing changes need human review, with an unresolved shutdown-handling defect.

Review effort: Balanced
Findings: 1

Open (1)

• Check shutdown before version guards to return 503 during drain · New

Resolved since last review (2)

• Detect duplicate and overlapping paths across all owner declarations
• Validate full candidate schema before slicing completed items

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable migrations, continuation authorization, and automatic publishing across recovery and shutdown require final human review and confirmation of passing exact-head CI.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Check shutdown before version guards to return 503 during drain

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable migrations, execution authorization, and automatic publishing require final human review and confirmation of passing exact-head full-suite CI.

Review effort: Balanced
Findings: None