golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

enhance(execute): isolated-executor rejected/over-reaching run fails safe — never default recovery to main (#1292) (#1303)

Browse Source 
* enhance(execute): isolated-executor rejected/over-reaching run fails safe (#1292)

When an isolated (worktree) executor run is rejected — the user declines to
merge it, the orchestrator surfaces recovery for a blocked/halted plan, or the
run over-reached the requested scope — the orchestrator must no longer
default/propose recovery by editing the primary checkout (`main`). Absent an
explicit guardrail, the LLM orchestrator could improvise "continue on main",
inverting the isolation contract at the moment it matters most.

Added an ISOLATED-RUN RECOVERY — FAIL SAFE policy: default to a safe halt that
offers a fresh, narrowly-scoped worktree or inspect/discard; editing the primary
checkout requires explicit, clearly-labeled confirmation and is never the
default/proposed option.

To respect the ADR-857 phase-6 host-loop size cap on execute-phase.md (it sits
just under the pre-phase-6 baseline), the policy is delivered as an extracted
reference fragment rather than inline:
- New `execute-phase/steps/worktree-recovery-policy.md` holds the recovery policy
  (the existing FAIL-CLOSED rule #48 for base/HEAD mismatches + the #1292
  fail-safe guardrail). No #48 behavior change — moved verbatim.
- execute-phase.md references the fragment at the worktree-spawn recovery point,
  the step-5.5 merge decision, and the stalled-agent "switch to inline execution"
  menu (which for an isolated run now follows the fail-safe policy). Net effect:
  execute-phase.md shrinks below its cap.
- quick.md carries the fail-safe guardrail inline at its post-return merge/discard
  decision (quick.md is not size-capped).

Scoped to the recovery offer only — no automatic scope-overreach detection
(explicitly out of scope per the issue) and no new config key. Adds content
regression tests, a USER-GUIDE note, and a workflow size-baseline update.

Closes #1292

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(changeset): Changed fragment for #1292 isolated-executor fail-safe recovery

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
2026-06-15 20:53:38 -04:00
committed by GitHub
parent 137760a655
commit 91bd82f9a6
7 changed files with 155 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

127
tests/execute-phase-worktree-artifacts.test.cjs
View File

@@ -20,6 +20,16 @@ const fs = require('fs');
const path = require('path');
const WORKFLOW_PATH = path.join(__dirname, '..', 'gsd-core', 'workflows', 'execute-phase.md');
const QUICK_WORKFLOW_PATH = path.join(__dirname, '..', 'gsd-core', 'workflows', 'quick.md');
const RECOVERY_POLICY_PATH = path.join(
__dirname,
'..',
'gsd-core',
'workflows',
'execute-phase',
'steps',
'worktree-recovery-policy.md'
);
describe('execute-phase worktree: shared artifact ownership (#1571)', () => {
test('workflow file exists', () => {
@@ -130,3 +140,120 @@ describe('execute-phase worktree: shared artifact ownership (#1571)', () => {
);
});
});
describe('isolated-run recovery fail-safe (#1292)', () => {
test('worktree-recovery-policy.md fragment exists', () => {
assert.ok(
fs.existsSync(RECOVERY_POLICY_PATH),
'execute-phase/steps/worktree-recovery-policy.md must exist (ADR-857 extraction pattern)'
);
});
test('execute-phase.md references the worktree-recovery-policy.md fragment', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('execute-phase/steps/worktree-recovery-policy.md'),
'execute-phase.md must reference the extracted worktree-recovery-policy.md fragment'
);
assert.ok(
content.includes('#1292'),
'execute-phase.md must reference #1292 in the worktree recovery policy pointer'
);
});
test('worktree-recovery-policy.md fragment contains ISOLATED-RUN RECOVERY guardrail referencing #1292', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('ISOLATED-RUN RECOVERY'),
'worktree-recovery-policy.md must contain the ISOLATED-RUN RECOVERY guardrail label'
);
assert.ok(
content.includes('#1292'),
'worktree-recovery-policy.md ISOLATED-RUN RECOVERY guardrail must reference #1292'
);
});
test('worktree-recovery-policy.md fragment forbids defaulting recovery to main/primary checkout', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('never the proposed or default'),
'worktree-recovery-policy.md guardrail must state editing main is "never the proposed or default" option'
);
});
test('worktree-recovery-policy.md fragment offers fresh narrowly-scoped worktree as recovery path', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('fresh, narrowly-scoped worktree'),
'worktree-recovery-policy.md guardrail must offer a "fresh, narrowly-scoped worktree" as recovery path'
);
});
test('worktree-recovery-policy.md fragment requires explicit confirmation before editing primary checkout', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('explicit, clearly-labeled confirmation'),
'worktree-recovery-policy.md guardrail must require "explicit, clearly-labeled confirmation" before editing the primary checkout'
);
});
test('worktree-recovery-policy.md fragment contains FAIL-CLOSED rule (#48) with exit-42 content', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('worktree_branch_check'),
'worktree-recovery-policy.md must contain "worktree_branch_check" from the FAIL-CLOSED rule (#48)'
);
assert.ok(
content.includes('42'),
'worktree-recovery-policy.md must contain "42" (exit 42) from the FAIL-CLOSED rule (#48)'
);
});
test('execute-phase.md step 5.5 decline/over-reach sentence references fragment and forbids main-default', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('declines to merge a worktree'),
'execute-phase.md step 5.5 pointer must mention "declines to merge a worktree" as the trigger for fail-safe policy'
);
assert.ok(
content.includes('never default to editing'),
'execute-phase.md step 5.5 pointer must state "never default to editing" main'
);
});
test('quick.md contains ISOLATED-RUN RECOVERY guardrail referencing #1292', () => {
const content = fs.readFileSync(QUICK_WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('ISOLATED-RUN RECOVERY'),
'quick.md must contain the ISOLATED-RUN RECOVERY guardrail label'
);
assert.ok(
content.includes('#1292'),
'quick.md ISOLATED-RUN RECOVERY guardrail must reference #1292'
);
});
test('quick.md guardrail forbids defaulting recovery to main/primary checkout', () => {
const content = fs.readFileSync(QUICK_WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('never the proposed or default'),
'quick.md guardrail must state editing main is "never the proposed or default" option'
);
});
test('quick.md guardrail offers fresh narrowly-scoped worktree as recovery path', () => {
const content = fs.readFileSync(QUICK_WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('fresh, narrowly-scoped worktree'),
'quick.md guardrail must offer a "fresh, narrowly-scoped worktree" as recovery path'
);
});
test('quick.md guardrail requires explicit confirmation before editing primary checkout', () => {
const content = fs.readFileSync(QUICK_WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('explicit, clearly-labeled confirmation'),
'quick.md guardrail must require "explicit, clearly-labeled confirmation" before editing the primary checkout'
);
});
});