fix(#2830): propagate a halted plan to its transitive dependents (#3038)

* test(#2830): add failing regression tests for halted-plan dependent blocking

Add tests/fix-2830-halted-plan-dependents.test.cjs covering direct,
transitive (2 and 3 hop), and diamond dependents of a halted plan across
both independent "which plans are incomplete" readers (phase-plan-index's
cmdPhasePlanIndex and findPhaseInternal/searchPhaseInDir), the negative
case (an unrelated decoupled plan stays runnable), and a parity check that
the two readers agree. Uses only modules that already exist at this
commit (gsd-tools.cjs via subprocess, the pre-existing phase-locator.cjs)
so the test file loads and runs cleanly on a fresh clone of this exact
commit. These fail against current behavior: neither reader has any
concept of a halted plan or a blocked_by/runnable view yet.

* fix(#2830): a halted plan no longer leaves its dependents on the runnable work list

A plan that reaches a designed stop still writes a SUMMARY, so both
"which plans are incomplete" readers saw it as an ordinary completion and
reported its dependents as ordinary runnable work — never checking
whether an upstream plan had halted rather than finished.

- New `status: halted` frontmatter value, documented in all four SUMMARY
  templates alongside the existing `status: complete`.
- New shared src/plan-dependency-graph.cts: a single computeHaltPropagation
  pass that both phase.cts's cmdPhasePlanIndex (wave-grouping) and
  phase-locator.cts's searchPhaseInDir (the phase-location primitive, ~50
  dependent symbols across 5 command routers) now call, so the
  two-implementation divergence that caused this bug cannot recur. It
  accepts an optional precomputedOrder so cmdPhasePlanIndex — which already
  runs Kahn's algorithm in computeDependencyLevels for wave assignment —
  passes that order straight through instead of a second traversal;
  searchPhaseInDir (no prior traversal) lets the module derive its own.
  The two small duplicated predicates each reader would otherwise carry
  (is this status "halted"?, which summary file matches which plan id?)
  are centralized in the same module as isHaltedStatus/buildSummaryFileIndex.
- Additive fields only: `halted`/`blocked_by`/`runnable` on
  cmdPhasePlanIndex's plans[] and top level, `halted_plans`/`blocked_by`/
  `runnable_plans` on searchPhaseInDir's result. The pre-existing
  `incomplete`/`incomplete_plans` fields are unchanged in meaning and
  membership.
- execute-phase.md's discover_and_group_plans step now also skips any
  plan whose `blocked_by` is non-empty, reporting it by name with its
  blocking chain, in addition to (not instead of) the existing
  has_summary skip rule.

Extends tests/fix-2830-halted-plan-dependents.test.cjs (introduced in the
prior commit) with direct unit coverage of computeHaltPropagation
(including the precomputedOrder call shape) and a fast-check property
test — both only possible once this commit's new module exists.

Closes #2830

* fix(#2830): surface the halt-aware view from init execute-phase

The adopted work made phase-locator compute halted_plans / blocked_by /
runnable_plans, but cmdInitExecutePhase builds its output by explicitly
enumerating fields, so all three were computed and then silently dropped at
the exact consumer the issue names as regressed.

Forwards them additively -- incomplete_plans and incomplete_count keep their
name, type and semantics byte-for-byte -- and adds the same three empty
defaults to the roadmap-only fallback so the shape is consistent in both
branches. Covered by a new test that drives the real CLI end to end rather
than the locator function, since the locator already worked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#2830): fail closed on dependency cycles and stop the templates inviting the defect

Three review findings, all fixed:

- BLOCKER (isolated adversarial). Cycle participants never reach indegree 0 in
  the Kahn pass, so they were excluded from the topological order, never visited
  by the forward pass, and vanished from blocked_by entirely -- i.e. reported as
  runnable. The wave-grouping reader hard-fails on a cycle so it never hit this,
  but the phase-location reader does not, so init execute-phase offered a plan
  depending directly on a halted plan. Reproduced, then fixed in the shared
  engine so every consumer is safe regardless of pre-checks: a node absent from
  the order is now blocked with a deterministic, non-empty named cause. A plan
  silently missing from both blocked_by and runnable is the exact disappearance
  this issue exists to prevent.

- MAJOR (isolated adversarial). All four summary templates showed the field as
  an inline comment on the value line. Frontmatter parsing does not strip
  trailing comments, so an executor copying the templates' own presentation
  wrote a halt that parsed as a non-halted string, silently reproducing the
  original bug. Guidance moved off the value line, and the halt predicate now
  tolerates an unquoted trailing comment.

- HARD standards violation. A test regex-matched child-process stderr prose for
  /cycle/i, which CONTRIBUTING bans. Replaced with the structured failure signal
  plus a differential assertion (same fixture without the cycle edge must
  succeed), so it stays cycle-specific without matching prose.

Also folds the duplicated read-summary-and-check-halted wrapper out of both
readers into the shared module -- centralizing only the predicate left the exact
two-copies-that-drift pattern the module exists to prevent -- and commits the
artifact-types documentation for the new status value.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test(#2830): stop the property generator hanging the whole suite

The remote runner did not fail -- it hung. Two containers sat in this file for
31+ minutes, and an earlier attempt ran 9 hours before I killed it. The runner
passes --test-timeout=0, so nothing ever reaps it: this would have hung CI
indefinitely, not reported a failure.

Root cause: the DAG generator built edges by rejection --

  from: fc.integer({ min: 0, max: n - 1 })
  to:   fc.integer({ min: 0, max: n - 1 })
  .filter(({ from, to }) => from < to)

With n === 1 both integers are forced to 0, so the predicate is unsatisfiable
and fast-check retries value generation forever. n is drawn from 1..12 and
fast-check biases toward boundary values, so n === 1 is reached almost at once.

This also explains why the failing-first run completed normally while the fixed
run hung: before the fix the graph module did not exist, so the property test
threw on import and never reached generation. It only starts hanging once the
code under test works.

Generates the DAG by construction instead -- `to` is drawn strictly above
`from`, with the degenerate single-node case short-circuited to an empty edge
list -- so no rejection sampling is involved. Switches the import to the shared
fast-check setup so the seed and run count are pinned per CONTRIBUTING, and adds
a bounded regression guard that samples the arbitrary directly, so a future
reintroduction fails loudly instead of hanging.

Verified: the file now completes in 2 seconds, 29 tests started and 29 finished,
zero failures, against an indefinite hang before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#2830): restore the depends_on display contract and acknowledge the workflow growth

Full-suite run surfaced two things the focused harnesses could not.

1. Regression of a pinned pre-existing contract (#3785). A refactor routed the
   EMITTED depends_on field through the new dependency resolver, which also
   consults the canonical-prefix map. The original consulted the plan map only,
   so a short canonical prefix passed through verbatim -- '24-01' stayed
   '24-01' rather than becoming '24-01-auth-hardening'. The emitted field is a
   DISPLAY mapping, not the DAG resolution, and #3785 pins that. Reverted with
   a comment recording why it must not use the resolver; full resolution is
   still used for the wave DAG and halt propagation, which is what needs it.

2. The workflow file grew 518 bytes without an acknowledgment, from the
   halt-aware skip rule and the widened parse contract. Acknowledged.

Note on where the acknowledgment landed: the guidance is to add a NEW fragment,
but execute-phase.md is already named by an existing fragment and the linter
hard-fails when two ack sources name the same path. Appending to the owning
fragment, following its own established multi-PR pattern, was the only
lint-clean option.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(#2830): backfill changeset pr number

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
2026-08-04 06:47:46 -04:00
committed by GitHub
parent ff4a57b78c
commit ef823ca9d9
18 changed files with 1248 additions and 14 deletions

View File

@@ -68,6 +68,9 @@ import verificationMod = require('./verification.cjs');
// eslint-disable-next-line @typescript-eslint/no-require-imports -- verify.cjs is an export= CommonJS module
import verifyMod = require('./verify.cjs');
const { readVerificationStatus } = verificationMod;
// eslint-disable-next-line @typescript-eslint/no-require-imports -- plan-dependency-graph.cjs is an export= CommonJS module
import planDependencyGraphMod = require('./plan-dependency-graph.cjs');
const { computeHaltPropagation, buildSummaryFileIndex, isSummaryFileHalted } = planDependencyGraphMod;
const { planningDir, withPlanningLock, listAvailableWorkstreams, getActiveWorkstream } =
planningWorkspace;
@@ -511,16 +514,40 @@ interface RawPlan {
filesModified: string[];
taskCount: number;
hasSummary: boolean;
/** #2830: true iff this plan's own SUMMARY declares `status: halted` (a designed stop). */
halted: boolean;
}
/**
* Resolve a raw `depends_on` token to the `RawPlan.id` it refers to
* (case-folded exact match, falling back to canonical-id matching). Returns
* `null` when the token does not resolve to any plan in this phase (a typo
* or a cross-phase reference) — every call site treats that as "ignore this
* edge", never a throw. Shared by `computeDependencyLevels`'s DAG-edge
* resolution, the `depends_on` display mapping, and (#2830) the
* halt-propagation node resolution, so the three can never disagree about
* which token resolves to which plan.
*/
function resolveDependencyId(
dep: string,
planMap: Map<string, RawPlan>,
canonicalToId: Map<string, string>,
): string | null {
const lower = dep.toLowerCase();
return planMap.has(lower) ? (planMap.get(lower) as RawPlan).id : (canonicalToId.get(lower) ?? null);
}
// O(V + E). Assigns each in-phase plan its longest-path topological level over the
// in-phase dependsOn DAG (Kahn's algorithm). Returns { level: Map<id,number>, visited: number }.
// visited < rawPlans.length signals a dependency cycle.
// in-phase dependsOn DAG (Kahn's algorithm). Returns { level: Map<id,number>, visited: number,
// order: string[] }. visited < rawPlans.length signals a dependency cycle. `order` (#2830) is
// the exact dequeue order this pass already produces — a valid topological order — passed to
// computeHaltPropagation as `precomputedOrder` so halt propagation does not re-run Kahn's
// algorithm a second time over the same graph.
function computeDependencyLevels(
rawPlans: RawPlan[],
planMap: Map<string, RawPlan>,
canonicalToId: Map<string, string>,
): { level: Map<string, number>; visited: number } {
): { level: Map<string, number>; visited: number; order: string[] } {
const level = new Map<string, number>();
const inDeg = new Map<string, number>();
const adj = new Map<string, string[]>();
@@ -529,10 +556,7 @@ function computeDependencyLevels(
if (!inDeg.has(p.id)) inDeg.set(p.id, 0);
if (!adj.has(p.id)) adj.set(p.id, []);
for (const dep of p.dependsOn) {
const depLower = dep.toLowerCase();
const resolvedDep = planMap.has(depLower)
? (planMap.get(depLower) as RawPlan).id
: canonicalToId.get(depLower);
const resolvedDep = resolveDependencyId(dep, planMap, canonicalToId);
if (!resolvedDep) continue;
if (!adj.has(resolvedDep)) adj.set(resolvedDep, []);
(adj.get(resolvedDep) as string[]).push(p.id);
@@ -568,7 +592,7 @@ function computeDependencyLevels(
}
}
return { level, visited };
return { level, visited, order: queue };
}
function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
@@ -598,7 +622,7 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
if (!phaseDir) {
output(
{ phase: normalized, error: 'Phase not found', plans: [], waves: {}, incomplete: [], has_checkpoints: false },
{ phase: normalized, error: 'Phase not found', plans: [], waves: {}, incomplete: [], runnable: [], has_checkpoints: false },
raw,
);
return;
@@ -617,6 +641,12 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
return canonical === exact ? [exact] : [exact, canonical];
}),
);
// #2830: reverse lookup from a completed plan's id (exact or canonical) to
// the actual summary filename, so a plan's own SUMMARY frontmatter can be
// read for its `status`. Shared builder (also used by phase-locator.cts's
// searchPhaseInDir) so the two can never disagree about which summary
// belongs to which plan.
const summaryFileByPlanId = buildSummaryFileIndex(summaryFiles, extractCanonicalPlanId);
// ── Pass 1: parse each plan file ─────────────────────────────────────────
@@ -660,6 +690,16 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
const hasSummary =
completedPlanIds.has(planId) || completedPlanIds.has(extractCanonicalPlanId(planFile));
// #2830: a plan can have a SUMMARY (hasSummary=true) and still be halted —
// a designed stop still writes a completion record, just one whose status
// says "halted" rather than "complete". Only look up the summary file
// when one exists; there is nothing to read otherwise.
const summaryFile =
summaryFileByPlanId.get(planId) ?? summaryFileByPlanId.get(extractCanonicalPlanId(planFile));
const halted = hasSummary && summaryFile !== undefined
? isSummaryFileHalted(path.join(phaseDir, summaryFile))
: false;
rawPlans.push({
id: planId,
declaredWave,
@@ -669,6 +709,7 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
filesModified,
taskCount,
hasSummary,
halted,
});
}
@@ -692,7 +733,7 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
rawPlans.map((p) => [extractCanonicalPlanId(p.id).toLowerCase(), p.id]),
);
const { level, visited } = computeDependencyLevels(rawPlans, planMap, canonicalToId);
const { level, visited, order } = computeDependencyLevels(rawPlans, planMap, canonicalToId);
if (visited < rawPlans.length) {
const cycleNodes = rawPlans.filter((p) => !level.has(p.id)).map((p) => p.id);
@@ -702,6 +743,20 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
return;
}
// #2830: single shared halt-propagation pass, reusing the SAME id
// resolution (planMap/canonicalToId) AND the SAME topological order
// (`order`, computeDependencyLevels's own Kahn's-algorithm dequeue
// sequence) — passed as `precomputedOrder` so computeHaltPropagation does
// NOT run Kahn's algorithm a second time over this graph.
const haltNodes = rawPlans.map((p) => ({
id: p.id,
resolvedDependsOn: p.dependsOn
.map((dep) => resolveDependencyId(String(dep), planMap, canonicalToId))
.filter((id): id is string => id !== null),
halted: p.halted,
}));
const { blockedBy } = computeHaltPropagation(haltNodes, order);
// ── Pass 3: determine lowest bucket key and build output ─────────────────
const anyWaveZero = rawPlans.some((p) => p.declaredWave === 0);
@@ -710,6 +765,7 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
const plans: Record<string, unknown>[] = [];
const waves: Record<string, string[]> = {};
const incomplete: string[] = [];
const runnable: string[] = [];
let hasCheckpoints = false;
const warnings: string[] = [];
@@ -717,8 +773,15 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
if (!rawPlan.autonomous) {
hasCheckpoints = true;
}
const blockedByIds = blockedBy.get(rawPlan.id) ?? [];
if (!rawPlan.hasSummary) {
incomplete.push(rawPlan.id);
// #2830: the runnable-only view — incomplete AND not transitively
// blocked by a halted upstream plan. Additive alongside `incomplete`,
// which keeps its existing "no SUMMARY yet" meaning unchanged.
if (blockedByIds.length === 0) {
runnable.push(rawPlan.id);
}
}
const computedWave = (level.get(rawPlan.id) ?? 0) + levelOffset;
@@ -732,6 +795,13 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
const plan: Record<string, unknown> = {
id: rawPlan.id,
wave: effectiveWave,
// DELIBERATELY not `resolveDependencyId`: the emitted field is a DISPLAY
// mapping, not the DAG resolution. It rewrites a dep only when it names a
// plan directly (planMap) and otherwise passes it through verbatim — a
// short canonical prefix like `24-01` stays `24-01` rather than becoming
// `24-01-auth-hardening`. #3785 pins that contract. Full resolution via
// canonicalToId is used for the wave DAG and #2830 halt propagation only;
// routing this line through it too silently changed the output shape.
depends_on: rawPlan.dependsOn.map((dep) => {
const lower = String(dep).toLowerCase();
return planMap.has(lower) ? (planMap.get(lower) as RawPlan).id : dep;
@@ -741,6 +811,11 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
files_modified: rawPlan.filesModified,
task_count: rawPlan.taskCount,
has_summary: rawPlan.hasSummary,
// #2830: additive fields — halted is this plan's OWN status; blocked_by
// names the halted plan(s) transitively upstream of it (empty when not
// blocked). Neither mutates has_summary/incomplete's existing meaning.
halted: rawPlan.halted,
blocked_by: blockedByIds,
};
plans.push(plan);
@@ -757,6 +832,7 @@ function cmdPhasePlanIndex(cwd: string, phase: string, raw: boolean): void {
plans,
waves,
incomplete,
runnable,
has_checkpoints: hasCheckpoints,
};
if (planNamingWarning) result['warning'] = planNamingWarning;