[mchwang]

Summary

• add the F3 trusted local rebase engine with one-to-one commit mappings and byte-exact checkout verification
• persist exact rebase/process-group ownership and recover interrupted work before startup proceeds
• preserve cancellation, deadline, cleanup, and provenance state across the Store, production wiring, and recovery path

This is the first reviewable slice of issue #22. It is intentionally local-only. F4-F6 remain in #22: foreign-conflict resolution, attribution/approval refresh, plan cmd: checks, remote push/check refresh, and guarded merge handoff.

Validation

Validated head: 9b286956d3ea2cc4785681d5616e32bed4ea7375

• npm test -- --project parallel — 69 files, 1,744 tests passed, 1 Linux-only test skipped on macOS
• focused F3 exact-head suite — 5 files, 180 tests passed, 1 platform skip
• npm run typecheck — passed
• git diff --check — passed
• local real-Docker run — blocked by an unresponsive local Docker daemon; exact-head CI is the merge gate for real-Docker
• exact-head GitHub CI — both standard jobs passed (4m23s, 3m54s); real-Docker passed (16m38s)

Review rounds

Twelve fresh independent high-effort rounds converged on this exact head. Findings fixed across the loop include process/recovery ownership, cleanup and deadline preservation, checkout fidelity, fail-closed process scans, ignored tracked files, gitlinks, raw path handling, verifier scaling/transport bounds, complete mapping provenance, exact retained-ref recovery, absent-ref idempotency, pre-write intended-result ownership, same-head create refusal, empty-history target binding, trusted Git executable resolution, cleanup-only marker ownership, kernel-backed process identity, subprocess environment isolation, monotonic signal-settlement bounds, and the Linux rejection-test observation race. No findings were declined.

The full-PR round reviewed the complete production diff and documentation at 58ff11a, traced identity/platform fallback, ESRCH/EPERM handling, schema v16 migration, ref deletion, Git pinning, cleanup settlement, and compare-and-swap paths, and returned no actionable findings. Exact-head Linux CI then showed that the expected bounded-settlement rejection was observed only after fake time advanced, briefly surfacing it as unhandled despite 1,746 passing tests. 9b28695 attaches the rejection assertion synchronously before timer advancement; the final focused independent round reviewed that test-only delta and returned no findings.

Copilot produced six valid inline findings across prior rounds. All are fixed, replied to, and resolved: retained refs reject reused attempt IDs and use atomic creation/exact-value cleanup; Store validates mapping endpoints including empty history; recovery deletion is bound to durable exact ownership; the Linux process scan runs in a killable subprocess inside the overall deadline; checkout verification and all rebase Git calls share one trusted absolute executable; and recovery requires exact kernel-backed process ownership at each signal boundary. The fresh exact-head Copilot round completed at 2026-10-06 20:04:51 UTC with no findings.

Review-lesson audit

All findings are covered by existing repository rules for lifecycle ownership, exact process settlement, monotonic bounded cleanup, fail-closed scans, explicit allowlisted subprocess environments, trust-root validation, external identity, persisted lifecycle-field validation, byte-exact agent-controlled paths, and failing-before/passing-after race regressions. No new AGENTS.md rule was added because it would duplicate those existing rules.

Part of #22.

[Copilot]

Copilot review overview

🟡 Changes recommended

Ref reuse can destroy retained results, and persisted mappings are not validated against the rewritten head.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Prevent reused-attempt ref overwrite and unsafe cleanup · New
• Validate rebase mapping includes the committed head · New

What changed in this PR

Adds the local trusted pre-merge rebase foundation with durable lifecycle ownership and recovery.

Changes:

• Adds bounded, byte-verified Git rebasing.
• Persists rebase and process-group ownership.
• Adds recovery, documentation, and regression coverage.

File	Description
agents/​process-group.ts	Supports bounded output truncation.
runner/​rebase.ts	Implements the rebase engine.
runner/​recovery.ts	Recovers interrupted rebases.
runner/​store.ts	Persists rebase lifecycle state.
runner/​production.ts	Wires production recovery dependencies.
runner/​verify-checkout.ts	Verifies checkout fidelity.
test/​agent-process-group.test.ts	Tests truncated output behavior.
test/​runner-lifecycle-store.test.ts	Tests durable rebase ownership.
test/​runner-production.test.ts	Tests production recovery routing.
test/​runner-rebase.test.ts	Tests rebase and cleanup behavior.
test/​runner-recovery.test.ts	Tests restart recovery safeguards.
docs/​implementation/​pre-merge-rebase.md	Documents the new foundation.
docs/​implementation/​runner-lifecycle.md	Updates lifecycle documentation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Recovery can delete a prior retained result, and the Linux safety scan cannot enforce its stated deadline.

Review effort: Balanced
Findings: 1

Open (1)

• abort() can delete a previous result from a reused attempt ID · New

Resolved since last review (2)

• Prevent reused-attempt ref overwrite and unsafe cleanup
• Validate rebase mapping includes the committed head

Previously missed (1)

In code that hasn't changed since last review

Synchronous Linux scan can exceed the overall startup deadline

runner/​recovery.ts:313

The Linux branch cannot enforce the advertised overall deadline because the scan and every path resolution are synchronous; the clock is checked only between calls. In particular, realpathSync follows each same-UID process's cwd/FD target, so a stalled FUSE or network-backed target can block startup indefinitely past 15 seconds. Run this scan in a killable worker/subprocess with the deadline covering its settlement, as the lsof branch does.

[mchwang]

Copilot round 2 summary-only finding is fixed in 28473fa: the synchronous Linux /proc open-file walk now runs in an owned Node subprocess, with its timeout plus process-group and pipe settlement inside the existing overall recovery deadline. The regression asserts the subprocess boundary, stdin path transport, child budget, and fail-closed overall timeout.

[Copilot]

Copilot review overview

🟡 Changes recommended

Checkout verification drops the configured PATH, causing failures with non-default Git installations.

Review effort: Balanced
Findings: 1

Open (1)

• Preserve Git environment when launching checkout verifier · New

Resolved since last review (1)

• abort() can delete a previous result from a reused attempt ID

[Copilot]

Copilot review overview

🟡 Changes recommended

Recovery can infer ref ownership from incomplete markers and signal a reused process-group ID.

Review effort: Balanced
Findings: 2

Open (2)

• Reject incomplete recovery markers before deleting refs · New
• Prevent PID reuse race during process-group termination · New

Resolved since last review (1)

• Preserve Git environment when launching checkout verifier

[Copilot]

Copilot review overview

🔵 Needs a closer look

Durable process ownership, recovery, and Git ref cleanup are high-risk lifecycle changes requiring final human review.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Prevent PID reuse race during process-group termination
• Reject incomplete recovery markers before deleting refs

[Copilot]

Copilot review overview

🔵 Needs a closer look

Safety-critical subprocess, filesystem, and crash-recovery behavior warrants final human review despite comprehensive regression coverage.

Review effort: Balanced
Findings: None