Workflow modules¶
This page maps orchestrator/workflow/: the state and transition owners, the engine/ owners one tick is
composed of, the late_split/ domain the late size gate is defined by, and the stage subpackages the label dispatch
routes into. It is split out of
../architecture.md#top-level-layout, which keeps the top-level map and the
naming rules that hold for the tree as a whole. The packages this one decides with are in
platform-modules.md.
Each entry below is the responsibility its module owns, and it answers there and on no second site. What a stage does
per label is in ../state-machine.md; what the agent it spawns is prompted with and allowed
to write is in ../workflow.md.
Enforced boundaries¶
Each rule below names the check that holds it. The last is a convention the tree keeps rather than one a test can see, and is called out as such.
- Callers name the state and tick owners directly.
workflow/state.pydefines the label vocabulary,label_reading.pyresolves its spellings,transitions.pydeclares the graph, andtransition_guard.pyguards writes. The publicworkflow.tickshim resolvesworkflow.engine.tick.tickinside the call. The initializer re-exports labels and guards but imports no engine or stage, sogithub/andgit/can import the vocabulary without loading the engine or pointing back into their own initialization.tests/workflow/test_imports.pyprobes the import paths in a clean interpreter, andtests/repository/test_layering.pyholds the direction under them. - The stage handlers are resolved at call time.
engine/stage_targets.pypairs each label with the module its handler lives on and imports it when it dispatches, asengine/pickup.pydoes for the stage it starts an issue on: the stage tree importsengine/, so a module-scope bind would point that edge back at itself.tests/workflow/engine/test_dispatch.pypins that the handler is read off its owner per call rather than bound at import, andtests/workflow/stages/test_imports.pythat every labelled target lands on a stage package here. The late size gate's own refusal is resolved the same way and for the same reason — it lives on a stage owner, so the dispatcher imports it when it routes. - Operator log channels, spelled literally. The engine,
late_split/, and stage owners report onorchestrator.workflow,workflow/transition_guard.pyonorchestrator.state_machine, andengine/base_refresh.pyonorchestrator.base_sync, the channel of every git base-sync owner a refresh route runs through. A module moved between packages does not take its channel with it —tests/workflow/test_imports.pywalks the package and checks every owner that declares a logger. - Nothing sits flat beside the package. The retired spellings —
orchestrator.state_machine,orchestrator.workflow_drift,orchestrator.workflow_messages, and the export and dependency manifests — resolve to nothing (tests/workflow/test_imports.py), and the repo-wide naming rule intests/repository/test_package_layout.pykeeps theworkflow_family from returning one level down. - A borrowed helper keeps its owner (convention). Stage-private helpers stay in the stage that owns them, and
what more than one stage reaches for stays where it is defined with the borrower naming that owner — fixing's quiet
window imports
_comment_created_atfromin_review/watermarks.py. No check enforces this one; what keeps it is that a second copy of a shared helper would drift from the owner and from the tests aimed at it.
The map¶
engine/, late_split/, and every stage package publish nothing, so naming one costs no owner behind it. Each
stage package is listed with the labels its handlers answer for: eight own one label each, and decomposition/ owns
four — run.py for workflow:decomposing, blocked.py for both workflow:ready and workflow:blocked, and
umbrella.py for workflow:umbrella. That is twelve of the dispatch table's thirteen targets; the thirteenth is the
unlabeled entry, which engine/pickup.py answers rather than a stage package.
workflow/ publishes labels, transition guards, and the lazy per-repo tick entry point
state.py the exact `WorkflowLabel` / `ControlLabel` strings and the `workflow:` namespace boundary;
stage tags and legacy spellings retain the vocabulary used by live issues and event sinks
label_reading.py canonical and legacy label lookup, canonical-first issue state, strict coercion, and the
exact set of labels a workflow write replaces without removing unrelated bare labels
transitions.py the forward spine and declared interrupt sources, including cancelled `done` to `rejected`;
publication and base-refresh eligibility read the same stage sets used by those edges
transition_guard.py the same-label allowance and off/warn/enforce write guard, with strict rejection details and
the literal `orchestrator.state_machine` channel operators filter on
engine/ what every stage is driven by
agent_diagnostics.py what a park comment and a WARNING say about a run that left no usable message: the
agent's stderr under two budgets -- 1KB for the human who came to the issue, 400
characters so a log line still fits a screen -- and the exit code beside the first,
split into the subprocess's own return and the normalized failure code where the
result carries a failure record -- the return named not captured where the timeout
killed the run -- and left the plain code where it does not.
The shared redactor runs over the RAW stderr before either trim, since a secret sliced
by the cut survives as a fragment the redactor no longer matches, and that fragment is
what leaks; the same ordering puts it ahead of the `rstrip`, so a multi-line env value
ending in a newline still matches verbatim. A Codex usage-limit stop gets a block of
its own -- the reset the provider named, then its message -- redacted whole before a
1KB budget cuts the message, the reset read off that redacted text under a budget of
its own. An account-quota stop a failure record names gets the reset interval that
record kept, under the same budget, above the stderr block. Each block is quoted
through `messages.py`'s blockquote, so it reads as the last-message body it is
appended under
comments.py the orchestrator marker, bound from the GitHub trust owner, and the bounded id ledger
shared by issue and pull-request comment posts; a developer report enters the ledger on
whichever reading finds it on the thread, since a post whose response was lost hands
back no id, and a verification artifact enters the same one through the sibling owner
below; callers persist the ledger, merging another reading's ids into it several at a
time where two roads each added some -- its bound evicts the smallest ids, the oldest
comments, wherever they stand, so an id one reading already evicted is evicted again
rather than a newer one. The bound holds on every record, one that adds nothing
included, so a ledger an older binary or a hand edit left past it is cut to it, and it
counts comments rather than entries: an id carried twice is held once, where it first
stands, before anything is cut, and an entry naming no comment is neither merged into an
id it compares equal to nor taken for one. Shared token accounts are never treated as
exclusively automated. The id a report landed as is read off the LOOKUP, which
resolves it once when the reading is taken: this records a comment before its caller
ever sees the reading, and an id answered afresh to each of them could fail here and
succeed there -- leaving the settled report at a comment the ledger never learned
verification_comments.py
one verification artifact published onto a pull request and recorded in the ledger
above, beside the owner holding that ledger rather than inside it: what this answers
for is one domain's publication, while that owner answers for the marker, the id
list, and the plain comment posts every stage makes. The id is read off the LOOKUP
for the reason a report's is, and recorded on whichever reading finds the artifact,
since a post whose response was lost hands back none. Both halves are needed: the
marker in the artifact's own rendering says the comment is ours once its id ages out
of the ledger, and the id says so once somebody edits the marker away -- without
which a feedback scan reads this orchestrator's own evidence as a human's request.
The evidence transaction publishes through it (`verification_publishing.py`). A guarded
commit of the evidence domain merges its ledger entries into the ledger the comment
carries when it lands (`MERGED_LEDGER`) rather than staging the ledger whole, so an id
another road recorded meanwhile is kept, and the publication's measurement reserves the
artifact's entry against that same merged ledger (`RESERVED_LEDGER`), never against an
older reading whose free slot the comment may now hold; `records_the_artifact` commits
the artifact's entry alone, over the comment as it stands, for a settlement that did not
land, and answers whether the tick holds -- a comment unreadable, replaced, or no longer
parsing, or a write nobody confirmed
prompt_context.py trusted-author thread reads, retained orchestrator comment ids, quoted comment lines, and
bounded tracked-repository awareness for agent prompts; marker text alone cannot admit a
comment, and a delivery snapshot over a read taken by the pinned comment's id is handed
that id too. `_delivered_thread` takes the read ITSELF for the prompts whose delivery is
recorded -- the text, the entries it is made of, and the revision that read fingerprints
to, so a prompt and the mark taken for it cannot be two readings; the comments a caller
already answered as controls -- the bare continue a retry spent -- come out of that read,
which keeps every reply past the watermark of the batch it answers whole
prompt_delivery.py shared process-local input-delivery snapshot and conservative settlement contract recording
exact delivered issue-thread, PR-conversation, inline-review, and review-summary inputs;
preserves distinct namespaces, watermark fields, bounded-excerpt omissions, filtering decisions,
and requirements revisions without copying live thread tips or taking unrestricted maximums.
A caller that names the pinned state comment has it excluded by id on the issue thread, so a
reply quoting its marker is still a reply; one that does not keeps the marker test. The
forged-marker refusal is the two IssueComment surfaces' alone, because those are the two
this orchestrator posts on and the id ledger evicts old posts from; it writes no review
and no inline comment, so a body quoting the marker there is a reviewer quoting it, and
refusing it would hide their words from the prompt AND stall the watermark that would
have recorded them, since a refused entry is neither delivered nor blocking.
`human_replies` is the same classification asked as a list question -- the trust filter,
the pinned comment, our own posts by recorded id, and a marker the ledger cannot vouch for
-- for the roads that decide who OWNS a batch before anything builds a prompt from it, so a
command classifier and a delivery record cannot become two readings of one thread
community.py the open pull requests this orchestrator never opened, which is why the tick sweeps
them itself: one opened by somebody else carries no pinned state for a handler to
consult, so nothing dispatches it. `ALLOWED_ISSUE_AUTHORS` decides there is anything
to sweep at all -- empty, the sweep returns before it costs a request -- and every
open PR from outside it earns one `workflow:community_contribution` label and one
HITL ping, with the ping posted BEFORE the label that dedups it, since a label
written ahead of a comment that failed would suppress that ping forever. Both
spellings of the label are read, so a PR the bootstrap rename could not reach is
recognized rather than pinged twice; a Bot author is skipped outright, its PR being
structural rather than a contribution. The enumeration and each per-PR step are
caught separately, so one PR's failure costs that PR's ping and never the sweep or
the tick around it
completion_verdicts.py the two markers a terminal agent closes its own stage with -- the reviewer's
`VERDICT:` line and the documentation run's `DOCS: NO_CHANGE` -- read out of its last
message, with the LAST match winning and anything short of the marker answered `unknown`,
so the caller parks a human in rather than recording a decision nobody made. The review
marker counts inline, a verdict naming its own outcome; the documentation one counts only
as the FINAL line, alone and unpunctuated, because "nothing to write" is a claim the next
sentence can take back. That stage's other outcome -- docs WERE updated -- is a commit on
the branch and is read there instead. Each parser returns the slice above its marker, the
part a human is shown; the review slice keeps any verification declaration exactly as
written, since setting it aside for display belongs to `review_findings`, not to the parser
review_verification_models.py the reviewer verification vocabulary, kept apart from the `VERDICT:` line: the
`VERIFICATION: RUN` / `VERIFICATION: END` block with its `COMMAND:` and `EXIT:` step
lines, and the `VERIFICATION: REUSED` line naming a SHA-256 evidence revision; the subject
a declaration has to be about -- the reviewed commit and the current evidence revision
the reviewer was shown; the two accepted outcomes, each sourced to the reviewer run and
labeled reviewer-reported, with every command, exit status, and output kept as written;
and the closed refusals: five for a run that did not complete, three for a completed
run's message whose declaration is missing, malformed, or stale
review_verification.py the strict reader of that declaration, asked only by the claim reader
(`stages/validating/review_claims.py`) on the disposition's persisting road, which every
verdict a reviewer round returns takes. A run never invoked, interrupted, timed out, refused
by its provider, or exited nonzero is refused before its message is read; the declaration
has to be the message's only marker use, outside any code block, and a RUN block has to be
closed, list at least one command with one POSIX exit status right below it, and hold no
verdict the verdict
reader would accept. Shape is settled before truth: a well-formed declaration naming
another commit, or any revision but the current one, is stale. Nothing is counted or
inferred from what the reviewer wrote
review_findings.py a reviewer's findings as a human is shown them: the body above its `VERDICT:` line with
every line opening on `VERIFICATION:`, `COMMAND:`, or `EXIT:` dropped, and with them the
output of each check shown to pass -- one exit line, and that line reading 0 -- and each
check that wrote neither an exit status nor output, a bare command inventory. Any other
check, its exit line missing, blank, repeated, or reading anything else, stays as a
sentence naming its command and how it ended, over the output the reviewer quoted as a
code block. Read apart from the declaration reader and more loosely, since it accepts
nothing: a step line outside any block opens one, and a block its RUN line did not open,
or that no closing line ends, holds only the unbroken lines below each step line and the
code fences below them, so the findings written below it stay. A fence is read whole, from
where Markdown opens it to where Markdown ends it, as `review_findings_fences` reads them
rather than as the declaration readers' stricter fence reading does, so a fenced transcript
goes, or stays as a diagnostic, in one piece, and a finding below where the fence ends stays
a finding; indented code reads as a fence with no fence lines. Below a check's command or
exit line, a fence holding protocol lines is that check's output, even one holding nothing
else, so the diagnostic a failing test prints below a fixture of bare step lines stays the
check's; elsewhere one holding protocol lines beside other text is the findings quoting such
output. Either way every protocol line in it, marker lines too, is hidden and decides
nothing, and a quote holding no text goes whole rather than show as an empty fence. Below a
check that passed or wrote neither an exit status nor output, whose output goes, the fence
may as well list the block's next checks, so each step it quotes is read as a check of its
own and one not shown passing stays. A fence wraps a declaration instead right below a RUN
line, only blank lines between; outside a check's output, where it holds nothing but
protocol; or where the findings declare nothing outside fences and it holds one whole
declaration, a RUN line through the closing line or a lone marker line: its fence lines go
while what it held stays with its check. What is shown declares nothing and formats to
itself, and findings with nothing left read as a sentence saying so rather than as the raw
message. `stages/validating/review_disposition.py` formats the feedback of every verdict a
live reviewer round returns here, once the declaration is read, and that is the feedback a
change request is persisted with, posted as, and handed to its developer as;
`stages/validating/review_handoffs.py` formats a persisted request's feedback here again
where a later tick posts it and resumes its developer on it, so a record persisted before
that formatting, its declaration raw, goes out concise, and one already concise goes out as
persisted; `stages/validating/feedback_posts.py` formats here the findings an anchored
feedback post quotes where a `/orchestrator continue` replays it
review_findings_fences.py
where the code of a reviewer's findings -- fences and indented code -- opens and ends as
Markdown renders it, for `review_findings`: a fence opens on a run at most three spaces
in from the content column of the list item holding its line, column 0 outside any list,
and closes on the first bare run of its character at least as long at most three spaces
in from that same column, however far in its opening run sat. A non-blank line set in
less than the column ends the item and the fence with it, before that line, and a fence
neither closes nor ends runs to the end. Indented code opens on a line four spaces or
more past the column where no paragraph goes on, and holds every line so set up to its
last non-blank one. List items are tracked line by line, without a Markdown parser: a
thematic break such as `* * *` is read before a list marker and opens no item; only a
bullet or a marker numbered 1, with content after it, interrupts a paragraph; and a
less indented line continuing a paragraph lazily, opening no block that would interrupt
it, keeps every item open, as Markdown does
stage_targets.py exact label-to-handler and cleanup targets, with stage imports deferred to the call
(the settled-report reader the verification-evidence proof reuses among them);
the unlabeled target reaches pickup through the same resolver. Named here too, though
no label routes to any of them, are the stage owners a report record's own measurement
REPLAYS to size the writes that land behind it: the two code-publication receipt
owners, which the report evidence reads and whose gate write the record reserves; the
stale-approval hand-back an `in_review` relabel writes; the stamp a fixing
hand-back leaves on the comment the settlement ahead of it left
(`stages/fixing/round_marks.py`); and the records a reviewer round writes onto that
comment (`stages/validating/review_records.py`)
poll_models.py poll-time closure evidence and family/fanout/cleanup partitions, preserving deferred issues
absent from enumeration and the blocked/umbrella family capacity exemption; a closed
reading -- a family-bucket issue's included, there only when its label could not be read
-- carries the moment its poll took before listing anything, and the lane it was admitted to
run_limit_dispatch.py hold exhausted work, replay its owed notice, and admit grants or terminal cleanup;
an implementing plan PR does not prove that implementation work ended
dispatch_guards.py pinned-state admission, restart before cancellation, publication reconciliation, and
operator controls; an already-pinned unlabeled issue is left where its labels put it.
A standing auto-rebase anchor holds the handler, on the adjudication's own road too,
and is asked again behind the reconciliation; whether it holds and what a held tick
is owed are `base_sync/recovery_holds.py`'s, handed the proof a park that keeps the
attempt asks first (`rewrite_landing_moved.abandons_unproved`). An anchor beside a live
adjudication is
first offered to it (`rewrite_takeover.py`), so a pair describing one replay is handed
over with its attempt's park before the hold can strand it, and a handoff write
nobody confirmed holds the tick; a park the handoff leaves standing that its road does
not answer holds the adjudication until a human replies to it, and a retry the attempt's
notice drew past the handoff is recorded read ahead of it (`rewrite_takeover_parks.py`).
The developer-report transaction is
answered last of the reconciliations -- behind that second anchor reading as well as
behind the reconciliation itself -- and ahead of the reuse guard: its own evidence asks
whether the commit the report is about reached the pull request, which is the question
the publication reconciliation settles and which a pair it leaves on a still-pinned
anchor would answer soundly over work no recovery has finalized. The
verification-evidence transaction is answered directly behind it and ahead of the reuse
guard, since the evidence answers for a review subject that names the report.
The report debt a rewritten pull-request head leaves is asked directly behind that, and only
holds: any claim, readable or not, keeps the `documenting` and `in_review` handlers off,
while `validating` runs, since its report hold is what pays the debt. Directly behind
the agent-run-limit hold, and ahead of the adjudication's step aside, every reconciliation,
and the reuse guard, `stages/decomposition/split_seeds.py` holds an ordinary split's child
whose seed is not the one the receipt in its body owes it -- no `parent_number` naming that
parent, or a late ancestry missing, partial, or naming another place in the lineage --
under every label but a terminal, pickup with no label and an adjudication of its own
included, so nothing runs it on a lineage nothing proved
poll_reading.py classify labels and hard-skip controls while admitting observed-close cleanup; drop open
blocked/umbrella dependency walks on the ticks `DEPENDENCY_POLL_EVERY_N_TICKS` skips;
a failed label read reaches per-issue exception isolation through the family bucket,
with any closed reading carried there; and whether a pass's refetch leaves its admission
dispatch_closure.py persist poll and refetch closes, retain them across ordinary processing, and keep the
enumeration's own disposition when a worker submission is refused -- re-recording only a
cleanup it still holds, alongside this process's worker and with no read moment
cleanup_observation.py keep a close through cleanup exceptions and unsettled endings, including an ending owed
under a label no sweep queries; settle only after the defining stage proves it complete
dispatch_partition.py combine fresh poll results and still-owed closes, record every closed reading's receipt
before submission, a family-bucket fallback's included, under the issue's writer claim --
only the latch where it is refused -- carry the moment read before the listing to each
closed reading's worker, and include deferred issues that enumeration did not yield
issue_processing.py the issue writer claim every dispatch seam takes before its refetch, guards, close recovery,
and handler, keyed on the client's rename-proof `repo_id`, with a contender skipping the
issue whole, leaving its latch and holds as found, and keeping a closed reading its caller
hands in through `contended_closes`; apply controls, select cleanup or guarded stage
dispatch -- a closed reading on an issue its pass reads open again, or a label outside the
pass's admitted lane, reaching no stage -- hold publication through the handler, and record
timed evaluation analytics on success and failure
dispatch_workers.py take the writer claim at each worker entry, outside the observation scope it wraps, then
refetch on the worker's own client and semaphore -- or the sequential loop's -- keeping
ordinary and cleanup observation scopes; an ordinary pass that finds a close latched since
it was queued runs as that close's cleanup
scheduled_dispatch.py drain the family bucket under active tracking, each issue through the pass its reading
earns, enforce capacity rules, and submit fanout with claims released after execution or
refusal; observed closes remain cap-exempt
dispatch.py drive the sequential poll's closure classification under the issue's writer claim --
a contender keeping only a closed reading's latch -- refetching every issue it routes
under that claim with the reading and the moment the loop read before listing it carried
in, or submit its partition to the scheduler; refetched issues and still-owed closes keep
the processing scope their reading earned
observation_state.py the process-local close, receipt, scan, retirement, publication, deferred-settlement, and
restart registries behind one lock -- with the cycle each latched close was scoped to, the
moment it was read at, and the cycle each memo and scan answered for; settlement advances
the owner generation and clears its latch, scope, moment, and receipt memo atomically, and
whether a latched close ends a given cycle is answered under the same lock for every
cancellation barrier and retirement window that asks it, behind this process's own restart
fence
observations.py latch, scope, read, enumerate, and settle observed closes; a latch carries its read moment
and its scope to the cycle a read tied it to, and ends a cycle -- the one it is scoped to,
or one asked under the claim where no other poller, and no restart of this process's, has
written since it was read; settlement is deferred while a publication holds the owner, so a
record read cannot erase a close a running worker still owes, and a `fresh` latch withdraws
a settlement a hold still postpones while a retried one leaves it to land; a postponed latch
keeps its scope but not its moment
contended_closes.py what a poll refused an issue's writer claim keeps of the close it read -- its own fresh
latch and nothing on GitHub, scoped only where the record is read first, the issue still
reads closed behind it, and the record read again behind that names the same cycle (a moved
record is read again, a bounded number of times), or to the retired cycle the holder noted
on the claim -- the note is asked before the first read and behind every read, whatever the
record says, and one found is kept for the rest of the reads, past a release stamped over
it; a close reopened, restarted past, unreadable, never confirmed, or read behind a record
that named a cycle and then none is held unresolved, and a record naming no cycle at every
read leaves an older latch as it was
observation_receipts.py generation-scoped exclusive receipt-post claims and landed memos naming the cycle their
receipt was for, which a claim carries rather than being declined by it; thread scans owed
once per owner and cycle and again once another poller held the issue since the walk,
released on failure and reopened when a receipt lands, so a failed or stale attempt
suppresses no later receipt
retiring_cycles.py the held cycle id across a retirement write and its final barrier; exit removes the marker
and reports, under the same lock, a close observed inside the window that ends this cycle;
the cycle is also noted on the issue's writer claim for the rest of the hold, where a
refused poller reads it; and `restarting()`, which holds every close read before this
process's own restart write ended off the fresh cycle, since no claim note records it
publication_holds.py counted holds taken when a worker is admitted and nested around handler execution; only the
final release settles a deferred close, preserving the reading through queueing and refetch;
a fresh close latched before that release withdraws the deferred drop, since the
scheduler's hold outlasts its worker's writer claim
content_hash.py the user-content hash and filters for pinned records, orchestrator output, bots, untrusted
authors, and whole-comment operator commands, over the live thread or a read the caller
already holds -- the title and body included, for a caller that digests them too; the
legacy bare-continue mode recognizes an existing baseline
drift.py baseline persistence and legacy normalization, the dev resume a requirements edit earns, and
the pre-implementation decomposition reset; no road here marks a thread read to its tip,
since a tip crosses what a bounded excerpt dropped and what landed while an agent was
out. On a parked tick the check measures the
requirements by what the park had already read (`answered`), so replies to the park are
the frozen batch's, not drift. With no baseline recorded it compares against
`observed_user_content_hash` where a stage kept one, rather than taking the thread as found
drift_delivery.py the prompt a requirements edit is answered with and the record of what it quoted, frozen
together off ONE read and settled by whoever disposes the run: context the excerpt bound
dropped holds the watermark below it, a reply written while the agent was out is in
neither, and the revision recorded is that read's fingerprint rather than the thread's tip.
The PR-backed variant freezes a second surface into the same record -- the pull request's
unread conversation, quoted entire below the bounded thread -- and names an outsider's
comment refused rather than dropping it, so the carry behind the run may cross what no
reader is owed. It names NO shared watermark field: the two surfaces are covered at two
moments, so the cursor spanning them is the caller's merged re-read to derive and no
settlement's to write
guards.py what a finished agent run may leave behind: the never-invoked, shutdown-interruption,
and freshly-read pause refusals, and the awaiting-human park. The first is asked ahead
of the second wherever a stage reads the worktree before it asks whether the run
happened -- what a killed run left there is the operator's to see, and what a launch
that never started left is nothing. The park forwards explicit bounded correlation
fields (`route`, `agent_role`, `session_id`, `review_round`, `retry_count`,
`pr_number`, `sha`) to the emitted audit event and analytics record, rejecting
unsupported fields before emission through the same screen a park that emits for
itself reaches. Also the shared park vocabulary: the allow-list every road is
screened against, the route names the roads into a self-emitting park are spelled
with -- the two conversation stages own theirs on their own `state.py`, since their
stage funnels reach this one rather than emitting for themselves -- and the
`_ParkedRun` four stage packages hand one of those parks: a finished run plus the
road it came off, which the workflow label cannot say.
It marks the thread read to the id of the notice it POSTED rather than to whatever the
thread ends on afterwards: the two differ only for a human replying between the post and
that write, and on a park waiting for a reply, reading the tip there consumes the answer
with the question. A post this call could not identify moves the mark nowhere, since what
it may record itself read past is a comment actually posted AND identified; our own
unrecorded sentence is refused as forged by every prompt reading instead. `bounded=True`
asks for the other answer, and every park that FOLLOWS an agent run asks for it: it stamps
`park_watermarks.py`'s walk instead, and is popped before the correlation screen. Only a
bounded park reads the comment-id ledger ahead of its post, since the walk needs it; the
ordinary park only appends to that ledger, so a malformed legacy entry parks it all the
same
park_watermarks.py the bounded answer to how far a park ending an agent run may record the thread read,
taken by the funnel's `bounded=True`, by the implementing question and checkout parks
that post for themselves, by the run-limit notice's repair, by the refusal a parked
`/orchestrator continue` earns, and by the validating stage's returned-verdict parks
behind their own notice (`review_parks.py`), the mark riding whichever write goes
down behind it: through the comments our id ledger names, stopping at the
first it does not -- a reply from the run, one quoting the pinned record's marker (the
thread is read by that record's id), or our own sentence whose recording write was lost.
It never reads the tip: no floor to walk from (the pickup anchors one), a post the ledger
did not gain, and a thread the re-read fails on all leave the mark where it was, the last
without raising, since the notice is already posted and the park still has to be recorded
messages.py the `ACK:` acknowledgement read out of an agent's last message, the one blockquote
form every agent output an issue carries is quoted in, and the two commands a HUMAN writes:
`/orchestrator continue` with the refusal a park needing real guidance owes it, and the
SYNTAX alone of `/orchestrator authorize-oversized <commit>` -- read from the whole
comment and nowhere else, with the argument captured as written, since a malformed one
is a command the workflow owes an answer to. What that second command MEANS is the
late-split stage owners', which is where the pair it names exists -- one per park it can
end, the adjudication's and the size gate's, each proving it against its own record
pinned_commit_models.py the vocabulary of a guarded pinned-state commit: the capture it is held to -- the pinned
comment's id, whether that reading parsed, every field it carried as the comment's JSON
spells it (keys sorted, so `null` is not an absent field and `true` is not `1` at any
depth), the prerequisites the decision rests on, absent ones included, and the fields
the caller owns -- held as strings in a read-only mapping, so nothing the caller does to
its own state afterwards moves it, which of those prerequisites a fresh reading spells
otherwise (`moved`), and the caller's own domain check of the complete candidate, where it
has one; the refusals, the four statuses (PREPARED, COMMITTED, UNCONFIRMED, REFUSED), and
the outcome carrying the candidate reading, the fields that earned a refusal, the rendered
length an overflow measured, and what the domain check answered where it refused the
candidate (INADMISSIBLE); and `CONFLICT`, what a domain transformation answers where it
cannot keep both roads' moves of its field, refused as an owned conflict
pinned_commit.py the guarded commit itself, through which the verification-evidence publication and
settlement, the evidence reconciliation's retirements, `validating`'s invalidation of an
unanswered carry, the developer report's recording, binding, publication preflight
and settlement, the reconciliation's drops and damage-park retirement, the park a refused
recording or binding takes, and the fixing recovery's release (`report_commits.py`); a
reviewer round's launch, its no-verdict parks, the verdict persisted with its
transaction, the verdict's drops, and the parks a verdict takes
(`stages/validating/review_writes.py`); a change request's handoff, the drop,
retirement, and park of a handed one, and the recovery's anchor write-back, drops, and
bought-round settlement (`stages/validating/review_handoffs.py`,
`review_launch_park.py`, `review_resume.py`); and every write of an approval's tail --
its verdict's retirement, the squash's own records, the handoff with the evidence it
carries or invalidates, the failed squash's park, what it posted where its records
moved, and the handoff's end behind the label (`stages/validating/squash_writes.py`) --
commit so far, with the finish of a base rewrite the tick published itself
(`rewrite_finish_writes.py`) landing through it too, while every other road still writes
its whole state: a candidate derived
over a fresh reading of the
captured comment rather than written from the caller's state. A
write the caller did not declare refuses before anything is read; an unreadable,
unparsed, or replaced comment, a prerequisite spelled otherwise, and an owned field
another writer moved to something other than what the caller staged each refuse after;
a domain-supplied transformation decides its owned field over the fresh value instead,
and every other field, unknown ones included, is the fresh reading's. The whole
candidate is measured through `pinned_state_body` against `MAX_PINNED_BODY`, and held to the
guard's own domain check where it carries one, before anything goes out -- that very
candidate, over the reading the edit lands on -- and `prepare` stops there, for a caller
with an external effect to make first, and `commit` derives everything again over a newer
reading and lands it through the strict edit, sending nothing for a candidate the comment
already reads as. A refusal writes nothing and moves nothing the caller holds, and an edit
that went out unconfirmed is reported as neither answer, for the domain's own receipts to
settle. `reread` is that fresh reading alone -- the captured comment, still parsing -- for a
caller with requests of its own to make over it before it stages anything. `takes_in` is for
a road that lays another road's moves over a tick's state without writing -- the validating
reread and the run circuit's merge -- or replaces that state with what a commit landed, as
the verification settlement and the evidence retirements do, so the reading that state last
synced with (`PinnedState.synced`) counts those fields as the comment's
report_commits.py the developer report's guarded commits -- recording, binding, settlement, the
reconciliation's drops and damage-park retirement, the debt park, and the fixing
recovery's release: a `ReportWrite` declares the fields one write owns (`owning` adds
more), the report records it was decided on, and the check the fresh comment has to pass
first; a `ReportCommit` lands it over the issue's comment guarded by the reading the
tick last synced with, not by the state it holds now, so every field the tick changed
since rides the write as the tick spells it while every field another road moved is the
fresh reading's. A report record moved under the decision, or a field the write changes
moved another way, refuses it; a usage total, the cost tags, a comment-id watermark,
and the ledger of this orchestrator's comments keep both roads' moves instead, by the
validating stage's own rule (`stages/validating/state.py`) and the ledger's own writer,
and a move that rule cannot join -- another road left the field as no such value at all --
is refused as an owned conflict rather than written over. `on_the_publication` decides a
write on the pull request, branch and code-publication receipt as well, the implementing
stage's own fields resolved when asked; `deciding_on` on further fields of the caller's,
and `behind` owns what a run's `HandedRun.retires` and is decided on its `decided_on`.
The check -- a record's reading and every later write it reserves -- rides the guard, so
it is asked of the very candidate the commit sends, over the reading the strict edit
lands on or nowhere. A write with an effect to make first is PREPARED before it
(`prepares`): a settlement before its report is posted, and a park before its notice
with the ledger entry and the watermark that notice writes reserved at their widest, the
entry under an id the merged ledger the candidate carries does not already hold -- or
the entry alone, for a notice on the pull request that moves no watermark. Only
what lands is laid over the
tick's state; a refusal, or an edit sent and never confirmed, WITHHOLDS that state
(`withholds`, `PinnedState.withheld`), so no whole-state write later in the tick puts
back what the comment has since come to carry -- save a refusal for room over a comment
that, read again, is still the one the tick synced with, which is simply too full. A
road whose own requests ran over the comment -- a report posted or re-read -- and that
leaves without a write of this domain's landing asks `withholds` the same question with
no outcome: a comment another road wrote meanwhile withholds the state, and one still
reading as the tick synced with leaves it to be written. A validating reviewer round's
writes land through the same guard, each declaring its own `ReportWrite`
(`stages/validating/review_writes.py`), and so do a change request's handoff and the
recovery of one an earlier tick left waiting (`stages/validating/review_handoffs.py`,
`review_launch_park.py`, `review_resume.py`) and every write of an approval's tail
(`stages/validating/squash_writes.py`), and the finish of a landed base rewrite
declares its writes over it (`rewrite_finish_writes.py`)
report_outcome_models.py the developer report vocabulary: the `REPORT: READY` / `REPORT: END` and
`REPORT: VERIFIED` spellings the prompts teach, the two successful outcomes -- a complete
report ready for publication, and a report asserted to be on the pull request at a URL
and SHA-256 revision -- and the closed refusals: five for a run that did not complete,
two for a completed run's message that carries no marker or a malformed one
report_outcomes.py the strict reader of those outcomes. A run never invoked, interrupted, timed out, refused
by its provider, or exited nonzero is refused before its message is read; the outcome has
to be the message's only marker use and its last lines, outside any code block, and an
`ACK:` beside it makes it malformed. A verified location and revision are parsed for
shape, never taken as proof. Two yes/no readings beside it: whether a run FINISHED on an
outcome, for the stage whose other replies are ordinary answers, and whether it REACHED
for the contract at all -- well or badly -- for the caller whose other readers must not
take a message that reached and missed as one of their own
report_fences.py which lines of an agent's message a code fence may enclose, asked by both the developer
report reader and the reviewer verification reader, judged without a Markdown parser so
that a doubt reads as fenced: a fence opens at the top level or in a list item, closes
only on a bare run at its opening run's column, and stays open to the end past a line
that may have ended its list item. Asked by `report_prose.py` of a pull request's
description, it reads the fences a blockquote holds too, behind any nesting of list and
quote markers, closing one only behind the markers it opened behind; the marker readers
do not ask, since no marker line opens on `>`.
That reading errs towards code, so `definite_fences` answers the other end of the
doubt: the closed fences that are fences however the text is read -- opened at the
margin of their markers, outside anything an HTML block may hold, and closed where
Markdown closes them rather than only where the stricter reading does
report_prose.py what of a description is certainly prose, for the closing keywords GitHub does not act
on inside code. Not one reading of the Markdown but what EVERY reading leaves, so a
doubt reads as code. Lines are ended as Markdown ends them, a bare carriage return
included; a line a fence may enclose and a line indented as code are code behind any
nesting of list and blockquote markers; so is every span `report_code_spans.py` finds
possible and everything `report_html_literals.py` finds literal. What is taken out
leaves a character no reference is made of, so a keyword and a number either side of
code are never read as one, and a tag's own markup goes the same way, quoted attribute
values and all -- to its `>`, or to the end of the text for one that opens a line,
behind markers or what was taken out, and that nothing closes. So does what
`report_link_fields.py` finds read and not shown, asked once the tags are out. Both are
read TWICE, which backticks pair being a doubt of theirs too: with every possible span
out, where a span may hide a closing bracket, and with nothing out but certain code,
since a span only some reading encloses -- from a backtick a bare URL took, into a
title -- takes the link's syntax along and leaves the rest of the title as prose
report_link_fields.py what of a text a link, an image or a definition reads and shows nothing of, each
wherever it MAY be one. An image's description, an `alt` attribute once rendered: from
its `!` to the bracket that closes it, brackets paired innermost first and a backslash
escaping one, whatever follows it -- a collapsed or a shortcut image is one by a
definition nobody looks up. What stands behind a link's or an image's text: the
destination and title in parentheses, or the label it names; a bare destination holds
parentheses in pairs as deep as the renderer GitHub runs reads them, and one that goes
deeper runs to the whitespace that ends it, found once for the run it stands in. And a
link reference definition whole, behind the markers its line opens on, its destination
on the next line and its title on the one after included. A title goes on over line
endings, one behind a backslash included, and the parts of a link stand either side of
one behind the blockquote markers the next line opens on
report_code_spans.py the inline code spans of a text, POSSIBLE and CERTAIN. Markdown pairs backticks within
one stretch of inline text, and where one begins is the doubt: a heading or a list item
starts a block with no blank line above it, a table reads each cell on its own, and a
backtick is no delimiter where something else has TAKEN it -- a tag or an autolink,
which binds as tightly as a span, a bare `https://`, `ftp://` or `www.` URL, which
GitHub links where it stands through every backtick to ASCII whitespace or a `<`, a
link or an image, which reads its destination and title itself, a reference's label,
math -- so the pairing starts afresh past it. So a span is looked for from every line,
every cell of a block that may hold a table, and past every `>`, `]`, `)`, `$` and bare
URL's end from the first `<`, `[`, `$` or bare URL standing in no certain code, within
what blank lines bound and against one index of the text's backtick runs; possible is
whatever any reading encloses, and a block with more places to begin than the readings
allow is code throughout. Certain is what every reading agrees on: a span that ends
before the next place a reading could begin, begun where no earlier reading's span runs
in, with no taker before it in its block outside the certain spans already found. An
escaped backtick opens nothing, and a backslash inside a span escapes nothing
report_html_literals.py what HTML shows literally or hides -- `<pre>`, `<code>` and their kind, and what renders
as nothing: a comment, a declaration, a processing instruction, a CDATA section, and the
bogus comment any other `<!`, `<?` or `</` opens, each hidden to the LATER of Markdown's
terminator and HTML's `>` and read on as HTML from that `>` -- read off the text AS
WRITTEN, since an element is literal whether or not some reading pairs a backtick
across its opening tag. EVERY tag is read, as an HTML tokenizer reads one -- a quote
opens a value only after a name's `=`, a value never closed takes the rest, whitespace
is HTML's own five characters rather than `\s`, and a name is folded in ASCII alone --
so a closing tag in another tag's markup, a comment, or the bogus comment a `<!` opens
closes nothing, while an opening tag counts wherever it is found, since what shelters
it may be no tag as Markdown reads it; `report_prose.py` takes tag markup out through
the same reader, `TagEnds`, which remembers what one reading found unclosed so a text
of nothing but openers is read once. Opening tags are counted by name, so nesting
holds, and an element opened in another tag's markup is literal from where that markup
began; a CLOSING tag is trusted only where it stands in the same possible code, or the
same prose, as the tag that opened the element under every reading -- each span is asked
apart, since two that overlap may come from readings that each hide one tag only; and an
OPENING tag or comment opens nothing in DEFINITE code -- a certain span or a definite
fence -- since a tag quoted as an example is no tag, unless an element is already open,
where no Markdown is read. A tag is found by its opener and read to its end only once
it counts: a quoted one is passed over at its `<`, so one cut short inside its code
never takes a real tag after it as attributes, nor one right behind that code into its
name
report_redelivery.py whether a run that moved no head is ANSWERING a report this issue owes rather than
asking a question -- the debt, a finished report outcome, and a branch that carries
something, asked in the order that spends least -- which is the one reading that keeps
the reply an undeliverable-report park earns from being parked as a question again. It
sits apart from the recording beside it because it is a reading about a LATER run and
the branch it ran over
report_records.py the four additive pinned records one developer report goes through: the DELIVERED
report a completed run wrote before any of its code was published, the PENDING
transaction that report is bound into once a pull request carries the code, the
CURRENT report the pull request carries, and the HANDOFF receipt saying one
transaction finished. The subject the transaction and the CURRENT report share --
repository, pull request, branch, source commit, and the requirements revision the
run was actually handed -- is spelled apart, because it is the whole of what a
completion has to prove again. The other two carry parts of it rather than the group:
the delivered record names the one member the RUN settles, the requirements revision,
and nothing a pull request decides, and the handoff keeps the pull request, the source
commit and the workflow LABEL the issue was carrying when the settlement landed beside
its receipt: what it has to answer is whether THIS transaction is already done, and --
for a route whose bookkeeping includes a hand-back its own stage has to make -- whether
that stage was ever standing behind it, which no other record reconstructs afterwards.
`HandedRun` beside them is no record at all: what a caller
tells the recording about the run -- the road it came down, the requirements revision it
was handed where the caller took a snapshot, and the round, bookmarks and consumed
readers its handover owes where nothing behind that caller will carry them: a report
that is the whole handover passes no size gate, and the feedback it answers may not read
as answered until it lands -- and, where the caller's road is answered by the report
itself, what that road retires in the record's own commit and the fields that road is
decided on, which every write recording or holding the report is decided on too: a
persisted change request retired beside its developer's report. The MARK a fixing
round's own settlement raises rides that last group and is spelled here because every
settlement writes it -- put up by a fixing record's frozen spends, retired by every
settlement that froze none, so the mark and the
handoff beside it are always about one transaction. The transaction a delivered report
becomes is spelled once, on the delivered record (`bound_to`), because the acceptance that
reserves it and the binding that records it both build one, and built apart a member added
to either record would be measured under one shape and written under another
report_record_values.py what each recorded field may be, and the widths two of them are bounded by, published
because a record written before its publication exists has to reserve the room that
publication's subject will take: a receipt spelled the way the published report header
carries it, one repository slug, one ref-shaped branch, a number inside the range
GitHub issues its identities out of, and a report that says something, fits a comment
with headroom to spare, and quotes no receipt marker of this orchestrator's. Text is
held to what UTF-8 can carry rather than to what `str` can hold, since a JSON escape
spells lone surrogates every pattern here would pass and the digest that hashes a
report would raise on. The report is the one field read for why as well as whether:
`RecordRefusal` names a report quoting a receipt marker -- in inline code, a fence, or a
quotation alike, since the search matches the raw body -- apart from one past
`MAX_REPORT_TEXT` and from every other invalid record, because its author corrects the
first two differently and no rewrite of a report corrects the third. The reason is held
in memory only and never written to the pinned comment
report_consumed_values.py the bookkeeping a recovered record may write, per key and per shape -- the delivery
watermarks and the requirements baseline a completion advances, read off
`prompt_delivery.py`'s own field names rather than respelled, plus the round and
bookmark fields it closes through the held-pair vocabulary. A group is read
all or nothing -- its members shape-checked before either table is asked, since a
recorded field name JSON wrote as an array would raise out of the lookup -- and the
watermarks are ratcheted forward only, which is what makes a replayed settlement a
no-op and what makes their ceiling load-bearing: a boundary no later comment can pass
leaves every human reply reading as already answered
report_record_fields.py the groups more than one report record shares, read and written one way, so no
spelling can drift from another's: the subject and the location a transaction and the
settled report both name, and the routing and the mode's own half a delivered report
and the transaction it becomes both carry. The transaction's whole pinned object is
spelled here too, beside the groups it composes, since the subject is the only thing it
adds to the report a run delivered
report_record_reading.py what one recorded object reads back as, or why it reads back as nothing, for both
outstanding records: identity, routing, and the half its own mode owns, each refused
whole rather than partly. A delivered report is the same reading with the subject left
out, since a report waiting for a pull request names none. Each record is read once into
either the record or its `RecordRefusal`, and the optional readers the state owners call
are that reading with the reason dropped. The report's own refusal is the answer only
where every other member read; a record whose identity, routing, location, or
bookkeeping will not read is invalid whatever its report says
report_record_room.py which measurement of the pinned comment refused a report record, and by how much: the
`CommentOverflow` naming the write measured -- the record's own, the BINDING a delivered
report is reserved against, or the SETTLEMENT -- the later writes the measured comment
carried beside it (the code-publication receipt, the stale-approval hand-back), and the
size it rendered to beside the ceiling it passed. It is the capacity answer only, kept
apart from the `RecordRefusal` a record's reading gives, so a report too long or quoting a
receipt marker is never reported as a comment too full, and it is built only once
`report_record_state.fits_the_comment` has refused, so it never names a comment that test
would accept. The worlds those later writes make are built here too (`with_later_writes`),
through the owners that write them for real, since they are what an overflow names. Held
in memory only, like the reading's refusal: the pinned comment records a report or does
not, never why
report_record_state.py the pending record's round trip, with presence asked apart from meaning -- a damaged
record and an issue with nothing outstanding are the same absence to the reader and
opposite answers to the guard -- and a write refused rather than truncated when its own
reader would not hand the record back, or when either the comment it writes or the one
its settlement would leave is past what GitHub accepts. That second payload and the
fit test over it are published as a pair, because the publication asks them again on
the tick it would settle: a record that stands down lets the routes behind the guard
write to this same comment, so the room proved at acceptance is not the room the
settlement has. Handed the two settled records as they land, the payload measures
those rather than the widest, with no second ledger entry beside the one the post
already left -- what the settlement's own commit is held to over its final candidate,
never more than the widest measurement taken before the post. It is the
WHOLE settling write -- the watermarks it advances, the bookkeeping it closes, the two
records it adds, and the comment-id ledger entry that publishing the report leaves
between the two, reserved under an id that ledger does not already hold since its
writer is idempotent. A record whose own spends RAISE the fixing mark reserves the
hand-back behind it too, through that stage's own writer
(`stages/fixing/round_marks.py`): a settlement cannot move a label, so the round such
a record closes is handed back by the tick after it, onto the comment that settlement
leaves -- and unreserved, a transaction is accepted at the ceiling, settles, raises the
mark, and meets a hand-back GitHub refuses, with the mark raised and no later tick able
to relabel. Only where those spends raise it, since no other route writes it. The code-publication receipt is reserved in BOTH measurements
beside it, since a record written before its commit is pushed waits for the publication
gate and that gate writes onto this same comment -- reserved at the widest that receipt
records, and measured in BOTH worlds, since the reservation replaces what is there and a
comment can carry a receipt wider than any spelling this build writes. The settling
LABEL is reserved beside them at the longest spelling the vocabulary has, since which
one a settlement lands under depends on where the issue has got to by then -- a question
no record can answer for itself, and one the real write answers with something no wider.
The reviewer round the settled report is handed to is reserved in the settled world
too, since it writes onto this same comment -- its spec and subject, its launch
charge, its session and return time, and its approval -- replayed through the
validating stage's own writers at the widest each is written
(`stages/validating/review_records.py`).
All of it is
replayed through the owners that perform those writes rather than allowed for by a
margin, so a field added to any of them moves this refusal with it. The two later writes
are built by the world builder `report_record_room.py` publishes -- that receipt, and the
stale-approval hand-back `in_review` makes when a requirements edit sends an approved pull
request back -- because the delivered record written ahead of the same push is measured
against both, each for the roads that make it. The write answers in two shapes:
`stage_pending_report` says why it refused -- the record's own `RecordRefusal` where its
reader would not hand it back or its settlement cannot even be built, which is an invalid
record rather than one too large, and a `CommentOverflow` only where one of those
measurements failed -- and `record_pending_report` is that answer reduced to whether, for
every caller that acts on nothing more
report_delivery_state.py the delivered report's round trip and the write that BINDS one: presence asked apart
from meaning as the transaction's is, a record refused rather than truncated where
this owner's reader would not hand it back or the comment could not carry it, and the
binding composed on a copy so the drop of the delivery and the record of the
transaction land together or not at all -- two records claiming one report are two
reports the next tick would publish, and a drop with no transaction beside it is a
finished run's report lost. Acceptance also reserves what the TRANSACTION will cost,
since the binding happens after the push and a report refused there is one the code
went out without: the subject it will be bound to is unknowable then, so the
reservation is taken at the width every member of one is recorded at -- except for a
verification, held to its own location's pull request, which is the number the
transaction has to be about and a refusal no width could prevent. The BRANCH is
reserved at the width the comment RENDERS rather than at the count its reader bounds:
codepoints are what the field is bounded in, and the comment is measured in the
characters a JSON escape spells them as, so one outside the BMP costs twelve and a ref
bounded at 256 can occupy 3072. All of it measured over
the comment that binding LEAVES, since the exchange gives back the room a delivery
being replaced is holding and costs the `null` its drop writes. The record's OWN write
is measured in four worlds beside that one -- this comment, and this comment carrying
the code-publication receipt, the stale-approval hand-back, or both -- because what
stands between the record and the binding is the push and, on the `in_review` drift
road, the hand-back behind it; both write here. The hand-back is reserved for the
ROUTE the record names, since `in_review` is the only stage that makes one: charged
for a write its own road never makes, an implementation's report near the ceiling
would be refused for room nothing was going to take. They are a different world from
the exchanged one: the delivery ADDED to everything the issue already carries, a transaction
an earlier publication left outstanding included. The subject a binding
takes is held to the requirements revision the delivery froze, and one restating it
differently is refused with nothing staged: bound, the transaction would claim the
report answers content the run never saw. A refusal SAYS which
it was, by offering the same transaction to an empty comment: accepted there the record
is sound and this comment is full, which the routes behind a report still owed give back,
and refused there no comment would ever hold it. Acceptance says why it refused as well,
and in two shapes: `stage_delivered_report` answers with the record's own `RecordRefusal`
-- a quoted receipt marker, a report past its ceiling, or an invalid record -- or with the
`CommentOverflow` naming the comment that came out too large, the reserved transaction's
own refusal carried through as the BINDING it is from here, its settlement still a
settlement, under the hand-back the delivery's road reserved; `record_delivered_report` is
that answer reduced to whether, for every caller that acts on nothing more
report_minting.py the record one finished run's report outcome earns: the outcome read off the run, the
revision minted one past every report this issue has already recorded -- the settled
one, any transaction still outstanding, and any delivery still waiting to be bound,
since a receipt is spelled from the revision and a retry finds its own comment by it --
the requirements revision the run was handed rather than one computed now, which is the
snapshot a caller names on its `HandedRun` or else the pinned baseline the drift check
left before the spawn, and the route its caller names. The round, the bookmarks and the
readers the record carries are the caller's frozen pair JOINED with those of every
record this one SUPERSEDES -- the outstanding transaction and the unbound delivery,
oldest first, so a field two of them name keeps the newest reading of it. Nothing an
outstanding record owes has been written anywhere, and this record replaces it, so a
report minted on its own caller's pair alone settles leaving a round nobody spent,
bookmarks nobody cleared, and feedback a developer already answered reading as fresh.
`MINTED_FROM` names the records all of that is read from, which recording it is decided on
report_delivery.py the report one finished run earns, recorded before its code is published, as minted by
`report_minting.py`. The write is this owner's, because being durable before the size
gate and the push is the whole of what makes the report recoverable, and it is a
guarded commit (`report_commits.py`) decided on everything the record was minted from
and owning the delivery and the park and debt flags it retires -- and what the caller's
road retires with it, decided on that road's own fields (`HandedRun`, `ReportWrite.behind`),
as the parks below are: the tick's own reading only
refuses a record whose reading fails or which no comment could carry, its room is asked of
the very candidate the commit sends, and only a record that lands lets the
gate and the push run. A comment that would not read, was replaced, or moved under the
decision ends the tick with nothing parked, published, or written, every whole-state
write behind it withheld; so does a write sent and never confirmed, withheld the same
way, whose record, where it landed, is what the next tick binds -- with no second run and
no second revision.
TWO ways a run holds the tick instead, both parked under `report_undeliverable` and
both before the size gate and the push, so nothing is published and the commit stays
in the worktree. A report this build cannot RECORD is one no later tick could publish
either -- the record is the only thing a publication reads a report from, and the run
that wrote it has ended. A run that COMPLETED and handed over no usable report at all
-- no marker, a malformed one, a verification on another repository -- is the contract
every developer prompt teaches being broken, and published anyway it would send a
reviewer an implementation nobody described -- and a verification whose repository this
build could not hold against its own is held the same way, whether because it names
somebody else's or because the reading that would have proved it could not be taken:
that reading completes a repository PyGithub may hold only a URL for, and raised out of
here it would leave a finished run's report neither recorded nor parked. Either notice
names what its own road held back: the implementing seam publishes for the first time
and has no pull request yet, while a resume under review has one that stands on the
commit it stood on, so the initial wording there would deny an open pull request its
human is reading. A run that did
NOT complete is left
alone: a launch nothing invoked (which is every synthesis an implementing recovery
makes for a publication no developer ran), a shutdown kill, a timeout, a provider
refusal, a nonzero exit -- `INCOMPLETE_RUNS`, public for the stage that remembers which
commit such a run left. The park is announced once per attempt -- while it still STANDS -- with
the notice worded by whichever road took it, and it is retired the moment a report IS
recorded. A refused recording or binding takes it through the guarded commit,
`parks_the_debt`, prepared with its notice's own writes reserved before the notice is
posted, so a park the comment cannot carry posts nothing -- one refused only after its
notice went out leaves that notice unrecorded -- and so does the fixing recovery's
release, whose write (`PARKING` owning the records it drops besides) a newer report
record another road wrote since refuses with no notice posted; the stages' own parks take
`parks_an_undeliverable_report`, written over
the whole state they hold. A comment the fresh reading finds too full for the record is
the room refusal too, measured there. It also carries the input the caller said the run's
prompt delivered into its
OWN write: a park durable over feedback still marked unread is one the next tick reads
as fresh and resumes the developer over again, with nobody having replied. It is bounded like every park ending a run, so a reply written while the
agent was out stays unread under its notice. `owes_a_report` beside it is what the implementing publication asks before
it hands work on: both records asked as a CLAIM so a truncated one counts as a debt, and the
park, which writes `developer_report_owed` beside its reason so the debt of a road with
no record to leave outlives any later park that replaces that reason -- and onto an older
park still standing with the reason alone, with no second notice. Every record it reads is
published as `REPORT_DEBT`, which the verification evidence binds each of its guarded writes
to (`verification_durable.py`), since a review subject stands only while no report is owed.
A park already
saying everything the notice would still WRITES: what a caller staged into the same
state -- the consumed pairs, and the undescribed work the road behind them recorded --
is what that write is for, and skipping it would tell the caller the tick ended while the
comment still carried neither. Both holding
roads write `UNREPORTED_WORK` as well, which is the narrower fact the debt cannot
carry: these commits are undescribed, whatever record an EARLIER run left, and only a
report recorded over the branch as it stands retires it. `OWED_ROUND_RESET` is the
third, and the only one no road here writes: the fresh review budget an `in_review`
requirements edit earned, recorded by that stage's hand-back where the publication the
edit produced is still owed, read by `stages/validating/rounds.py` so the delayed road
spends none of it, and retired with the debt by the settlement that ends it. And
`redelivers_an_owed_report` is what both implementing dispositions ask of a run that
moved no head -- a debt owed, a run that finished on a report outcome, and a branch
that carries something -- so the reply answering such a park publishes rather than
parking as a question. The implementing publication seam is the caller, between its
tree reading and the size gate, and so are the two dispositions an open pull request's
fix loop runs ahead of that same gate -- the requirements-drift one both review stages
and `workflow:resolving_conflict` share (`stages/validating/drift_reports.py`) and the
reviewer-requested one the `workflow:fixing` label covers
(`stages/validating/fix_reports.py` for the round `validating` spawns,
`stages/fixing/reporting.py` for every round behind it), which is why those labels are
among the roads whose park notice says the pull request stands where it stood rather
than that none was opened. A caller may freeze the bookkeeping its handover
owes onto the record as well as onto the gate, which is what covers a report reaching
the pull request with no code in it and so no gate behind it. A report it cannot RECORD
is held on the refusal `stage_delivered_report` gave rather than on a yes or no, so the
notice and the log line can say which it was, worded by the owner below
report_refusal_notices.py what a human and the log are told about a delivery that refusal held: one notice per
refusal, each with its own recovery. A quoted receipt marker is described in prose
and never quoted back -- a notice is the orchestrator's own comment, where a receipt
search would read it as the step it names -- and the reply asks for the report with
every receipt described that way; a report past `MAX_REPORT_TEXT` is told its length
and that ceiling; a `CommentOverflow` names the write measured (the record, the
transaction it becomes, or that transaction's settlement), the later writes counted
beside it, the size against the ceiling, and what frees the room. A rewrite does only
for a written-out report whose record or transaction overflowed, the two writes that
carry its text, and the saving is asked for in the comment's own characters: the text
is stored escaped for JSON, so the notice gives the report's length beside what it
takes there and asks for escaped text at least the overflow smaller. Both counts are in
the rendering the refused write was measured in: `pinned_state_body` leaves the
HTML-comment terminators of a payload past the ceiling unescaped, and a comment fits
exactly when that rendering does, so the text's cost is its JSON escape alone. A
verification records a location and digest and the settlement where the report
landed, so neither is asked for a rewrite, only for room freed on the comment; and
every other refusal is the invalid record, worded without a claim about length or
room, its log line naming the route and the requirements revision the record was
stamped with for an operator to look for. Size is named only where a size was measured
and failed, and every recovery is the same resume: a reply whose session needs no new
commit to deliver the report
report_settlement_state.py the current report and the handoff receipt, written in the one durable write that
drops the pending record, each refused rather than stored when this owner's own reader
would not hand it back. The handoff also names the workflow LABEL the issue was carrying
as that write landed, because the reconciliation making one runs ahead of every handler
on every non-terminal label: a route whose bookkeeping includes a hand-back its own
stage has to make cannot otherwise tell a settlement that stage is standing behind from
one taken while the issue was somewhere else. Additive like the current report's road --
absent on a settlement written before the member existed, which every reader holds to
the stricter answer, and damage where it is present and names no label, `null`
included. Nothing here CLEARS a settled record -- a settlement replaces
one -- so either key is claimed by its presence alone, `null` included, which is the
one place this parts company with the pending record whose ordinary resting state that
is. What produces one is a publication that reached its report -- the initial
implementation delivery through `report_binding.py` below, or the reconciliation at
the end of this group a poll later -- and `dev_pr.py`'s body asks
`carries_settled_record` before writing the run's closing message
report_locations.py which places on a pull request this issue's reports claim, asked of all three records
-- a record nobody can read, or a settled pair missing its current report, included --
since even an edit keeping every word moves a verified DESCRIPTION off its digest, while
a report in a comment is out of a body edit's reach. A damaged record claims the
description unless the place it still names is readably elsewhere. The second reading
is what a description has to say: whether it closes this issue -- any spelling GitHub
accepts, bare or qualified with this repository, outside everything `report_prose.py`
takes out, ASCII from end to end, its number compared as digits -- and names the
session; `costs_the_description` is that answer held against a verification living on
the same description. It also answers which publication the SETTLED pair is about,
agreeing with itself and naming this repository, pull request, branch and commit; what
it hands back is a claim, for its caller to re-read. Asked by `report_binding.py`,
`stages/implementing/pr_description.py` and `stages/implementing/unreported_recovery.py`
report_evidence_models.py the four answers one reading gives: PROVED, which alone licenses a publication and
alone carries the pull request it proved; HOLD for a reading nobody could take; DEFER
for everything structural, which the routes behind the evidence are what clear; and
ENDED for a pull request that is over. The vocabulary heads the four evidence owners
below, which the reconciliation at the end of this group composes into one tick
report_evidence.py the affirmative evidence a completion needs, in two entry points: the pull-request
reading, which every other one stands behind, and the rest composed behind it cheapest
first. The requirements revision closes it, held against the one the run was handed and
COMPUTED here rather than read, so the comment walk that computes it answers with a
hold rather than leaving the reading by an exception. That last reading is published on
its own as well, over an issue read AGAIN from GitHub, for a caller completing the
publication it has just made: the issue it holds was fetched before its developer ran,
and a re-read that fails answers HOLD, since nobody could say the issue is unchanged.
That fetch hands the ISSUE back beside the verdict, for the settlement that stamps its
handoff with the label the issue is carrying -- one question, so one fetch.
`refuses_for_good` says, posting nothing, whether an owed transaction can ever settle: a
report of ours a human edited, or a verified location gone, changed or untrusted
report_checkout_evidence.py the checkout half: on this host, clean by a reading that HAPPENED rather than by an
empty path list, and standing on the commit the report is about
report_remote_evidence.py the remote half, which the checkout cannot answer: the recorded branch is fetched and
one divergence reading decides all three of unpushed commits, a remote that moved on,
and a tip that is not the commit the report is about. The branch asked for is the one
the record FROZE, since the whole point of freezing it was that a later tick's answer
can differ. `subject_remote_verdict` is the same reading over a bare report subject,
which is how the verification-evidence proof holds its branch to the same answer
report_publication_evidence.py the pull-request half: the repository, then ONE pull request read by the number
the record froze, still open, on the recorded branch, with a head in this repository
and STANDING on the recorded commit. Selected by number rather than searched for by
commit, because a number is unique in a repository and a search is not -- several pull
requests can stand on one branch carrying one commit, and a search answering with
whichever it reached first would refuse the transaction forever while the recorded
thread sits open on that very commit, and would hide an ending besides. A read that did
not happen HOLDS, the lazy members included. The code-publication receipt is asked
beside all of it, as one group through the receipt's own damage reader and then on both
of its members, since standing on a commit says it is there and nothing about how it
got there. Both those owners are reached through `stage_targets.py`, resolved when
called. `subject_verdict` is the pull-request reading alone over a bare report subject,
under the same boundary, and is what the verification-evidence proof reads first
report_replay_guards.py whether a record and the settlement beside it are about one thing. Either settled record
CLAIMED and unreadable stops the tick before anything is proved, since both are records
a settlement writes over. Two READABLE settled records are then held to each other,
without reference to any receipt: they are copied out of one pending record in one
write, so a pair naming two pull requests, two revisions or two commits is one nothing
here produced -- and under a previous transaction's receipt that is the only question
there is, since such a pair is never compared against the record in hand. A handoff
carrying THIS receipt is believed only beside the current report written with it, once
its own pull request, commit and revision agree and once that report matches the pending
record's whole subject AND the content that transaction would have left -- a
publication's own digest at a location that IS a comment, a verification's own exact
location and revision -- which is the only half of a settled record that says which
report actually landed and where. The road is held first wherever the settlement
names one: a settlement saying it verified is no completion of a publication, and one
naming no road, written before any did, is held to the content alone. A `null` comment
field is the pull request's description, which a verification records and a
publication never writes. Believed on
the receipt alone, or on the digest without the kind of place beside it, it would drop
a pending record whose report was never published. A current report
already recorded at this revision or a later one says the transaction in hand is stale,
which settled would replace the newest report on the pull request with an older one.
None answers with a repair: a caller that finds the records disagree stops, because
choosing between them loses something unrecoverable
report_publishing.py the two ways a proved transaction finishes -- a receipt-scoped post that a retry finds
rather than repeats, and a re-read of a trusted location whose content still hashes to
the revision verified -- and the settlement of either, composed whole on a copy so that a
settled writer's refusal lands none of itself rather than dropping the record beside a
report nothing says the pull request carries, and committed through
`report_settling.py`. A refusal short of PRESENT is split the way the evidence beside it
splits one: only a read nobody could take stops the tick, while an edited report, a
deleted one, and an untrusted author are definite answers about content a human owns and
stand down onto the routes behind the guard. The landed comment id and the verified
report's author are read under boundaries of their own, since each is a lazy member that
can fail on a worker holding an uncompleted object -- and an author nobody could read
HOLDS rather than standing down, because it is not an author this deployment refuses.
Both roads prove the room first: the settlement's own guarded commit is PREPARED over the
comment read afresh before anything is posted, since what the record reserved may since
have been spent by the routes a deferred transaction let run, and a comment whose records
moved meanwhile posts nothing either -- and the REQUIREMENTS last, over the issue read
afresh after the request, since a post is long enough for an edit to land under it. Every
road that leaves the transaction owed after its request -- a post unconfirmed, a report
edited, gone or untrusted, requirements moved, the commit refused -- asks the comment once
more (`report_commits.ReportCommit.withholds`): one another road wrote meanwhile withholds
the tick's state and holds the tick, so the stage behind writes nothing back over that
road's evidence, verdict or newer record, while one the tick read unchanged keeps the
road's own answer, hold or stand down. Each
settlement records which road made it, for the re-read below, and which LABEL the issue
was on as it landed -- read off that fresh issue rather than off the copy in hand, since
a human who relabelled while the developer ran is invisible there, and fail-closed, since
the labels are a lazy read and a settlement raising out of that line would leave the
report published with the transaction still outstanding. A preparation or commit refused
over a comment that moved, or a commit sent and never confirmed, holds the tick with its
state withheld; a preparation refused for room over the comment the tick read stands down
with nothing posted; and a later tick finds a report already posted by its receipt
report_settling.py the one guarded commit a finished transaction settles in (`report_commits.py`): the
current report and the handoff, the drop of the pending record, the readers the run
consumed and the route bookkeeping its record froze, the fixing MARK, the debt, and the
undeliverable-report park where that park is this domain's -- owning exactly those,
and decided on every report record, the handoff, the debt, the park, the work no report
describes, and the publication the evidence was proved against, so another road's
evidence, verdict or usage written meanwhile survives, a watermark and the comment-id
ledger keep both roads' moves, and a record or publication another road moved refuses
it. `prepares` measures it over the comment read afresh before anything is posted,
staged with everything it owes and held, through the guard, to the measurement the
record was accepted under (`report_record_state.settled_payload`) over that very
candidate -- the two records at their widest, the ledger entry the post adds, and the
reviewer round and fixing hand-back that follow; `lands` commits it behind the post and
the re-reads, its final candidate held to the same measurement with the two records as
they land, so a comment another road filled during the post refuses it with the pending
record kept rather than leaving the reviewer round or the hand-back no room. The mark is
REPLACED by the same write, never merely left: retired first
and put back up only where this record's own frozen spends carry it, so a mark an
earlier settlement raised elsewhere cannot outlive the handoff it was about. And it
retires what the transaction it ends is still recorded as owing: the debt, the fresh
review budget an `in_review` edit reset for this publication, and the undeliverable-
report park itself where that park is the one this settlement answers. Conditions like
it are repaired rather than replied to -- an edited report restored, a checkout cleaned
-- so the settlement is the only thing that would ever end the wait, and a debt
outliving it would hold the reviewer over a report the pull request carries. Any other
park reason belongs to whoever took it and stands. NOTHING is retired at all while the
issue records work nobody has described: a report written over the branch as it stands
retires that flag as it is recorded, so one still standing says this transaction was
written before those commits existed -- a true account of an earlier head, and no
account of the head the branch is on now
report_settled_reading.py a SETTLED report read again where it settled, posting nothing, and held to the
road the record says settled it: a VERIFIED location has to hash to the digest still,
under a trusted author; a PUBLISHED one has to re-render in its comment as our report,
written by the login this client posts under, with the text digest and whole header
(pull request, commit, requirements, revision, receipt) recorded -- so a comment cut
down to its bare text is CHANGED though it hashes. A record naming no road is read off
its location: a description was verified, a comment is held to the rendering. An
author nobody could read is UNCONFIRMED, and so is a published comment whose body will not
read again for its parse. `stages/implementing/report_handoff.py` asks it last before a
handoff, for the report a publication settled and for the one a recovery would hand on.
`carried_text` takes the same reading and returns the TEXT as well, the settled revision
alone -- a publication's words out of the very parse whose header the reading proved, a
verified location's whole body -- held to the digest once more, "" on every answer but
PRESENT; `stages/validating/review_report.py` asks it before a reviewer is handed the
report
report_binding.py what a publication does with the report its run delivered once the push has landed:
the record bound to that repository, pull request, branch and commit in one write made
BEFORE anything is posted, then published. Both steps on every call, held to the
publication in hand, so a record naming other work is the reconciliation's. The
REQUIREMENTS are proved afresh first, and a report answering an edited issue is left
owed for the drift resume, the comment asked once more behind that re-read so a road
that wrote it meanwhile leaves the tick's state withheld. Nothing is DISCARDED: a comment
too full is retried; a record
nobody can read, a verification on another pull request, and one on the DESCRIPTION this
publication needs park once under `report_undeliverable` with the record intact -- that
last the collision, held for a human to name the description, since nothing here
rewrites one. The exchange is a guarded commit (`report_commits.py`) decided on the
report records the tick read and on the pull request, branch and code-publication receipt
the publication was resolved from, owning only the two it swaps, its room asked of the very
candidate the commit sends; a comment that would not read, was replaced, or moved
under it is left for the next tick, parking and writing nothing -- the tick's state is
withheld from every whole-state write behind it -- and so is a binding sent and never
confirmed, which the next tick, finding the transaction rather than the delivery,
publishes without binding again. Only the delivery itself is judged on the tick's state;
whether this comment has room is asked of the candidate sent, and the parks it takes are
decided on the publication too, so a repointed one parks nothing. Nothing is posted on a
binding that did not land, and
`binds_the_delivery` answers whether it did. A transaction the settled pair beside it
refuses is left owed, for the reconciliation to park. The implementing publication calls it,
through
`stages/implementing/report_handoff.py`, once its push has reached a pull request; the
drift roads' `stages/validating/report_settlement.py` calls the binding step alone,
`binds_the_delivery`, and leaves the post to the reconciliation's full evidence
report_transaction.py the reconciliation the dispatcher runs ahead of every handler, behind the pause,
terminal, outstanding-publication and adjudication guards and ahead of the reuse guard
and the stage: it hands work that has ENDED straight back -- a closed issue, or one
wearing `done` or `rejected`, since a terminal label resolves to no handler and the
no-op behind this guard protects nothing -- then settles what it can prove, holds what
nobody could read, stands down on what a route behind it would fix, retires a
transaction whose pull request is over, and parks once on a record it may not act on:
one that will not read, a settled pair that contradicts itself, one whose handoff
disagrees with it, and one a newer report has already passed. That park is its own to
take and its own to retire -- the record repaired and settled, or the field cleared to
abandon it, both take the flags down, and no other owner's park is ever touched. A park
another route already holds STANDS THIS DOWN rather than holding in front of it: what
answers one is the handler behind this guard, so a hold there would leave both parks
standing for the life of the issue with neither announced, while a stand-down lets that
handler run and takes this park on the tick after its own clears. Its drop and the
retirement of its park are guarded commits (`report_commits.py`) decided on every report
record, the handoff and the park reason, owning only the pending record and this owner's
flags: another road's evidence or usage written meanwhile survives, a record or park it
wrote since is never dropped or retired with the one the tick read, and a retirement that
did not land over the comment the tick read, or landed unconfirmed, holds the tick
report_rewrite_debt.py the report debt a rewrite of the pull request's head leaves -- the pull request, its branch,
the head the rewrite replaced, and the exact head it published -- as one additive record,
`null` once paid. Read whole and fail-closed, with presence asked apart from meaning, so a
claim nobody can read is still a claim. A later rewrite of the head it names retargets it
and keeps the replaced head, a rewind onto that head refused; where a report of the head it
names has settled since and so paid it, the later rewrite's own debt takes its place, a
rewind included. A rewrite onto the head it names is a replay whatever head it says it
replaced; any other rewrite, and any over a damaged claim, is refused with the claim left
standing, and one the comment has no room for is not staged. It also answers whether the
settled report pays the debt -- a report of the head the pinned pull request stands on,
PUBLISHED rather than verified where it stood, and written against the current baseline --
whether a claim explains exactly why that report is about another head, and whether a
claim is owed a fresh report of the head it names because the settled report is of either
head it names and pays nothing -- or, where the approval squash's lineage answers for it,
is of the approved commit that squash collapsed into the replaced head, on the claim's pull
request and branch and against the current baseline. `dispatch_guards.py` holds the
roads past an approval on any claim and `stages/validating/report_refresh.py` holds the
reviewer, obtains that report, and pays it. `stages/conflicts/report_debt.py` records
one for every head the conflict stage's own push rewrites, `rewrite_finish_debt.py` one
for each clean auto rebase of the base refresh whose push lands -- the crash recovery's
retry and a push it finds already landed included -- and
`stages/decomposition/late_replay_debt.py` one for the replay a late generation took
over, once its authorized settlement publishes it
report_rewrite_room.py whether the debt owner refused a rewrite for nothing but the pinned comment's room -- the
one refusal a writer holds on rather than handing the head on -- told from a record that
would not read back and a standing claim the rewrite cannot extend; asked by every
writer -- the conflict stage, the workflow finish below, whichever road reached it, and
the late settlement of a taken-over replay -- so their readings cannot differ
report_squash_lineage.py the proof that a settled report's approved commit is the one this orchestrator's
approval squash rewrote into the head a rewrite debt replaced. It reads the squash's own
evidence carry -- owed, current, or from history, never asking whether that evidence is
current -- and holds it exactly to the settled report, the debt, the pinned pull request,
and the head it stands on, then reads both commits' trees again in the checkout
(`verification_world.tree_of`). PROVED, DEFER for no proof, or HOLD for a tree nobody
could read; it writes nothing. `stages/validating/report_refresh.py` asks it before
refreshing a report of that approved commit
rewrite_finish.py the one finish of a landed automatic PR base rewrite, whichever road reached it -- the base
refresh publishing its own rebase, or a recovery that pushed the replay again or found it
standing, announced or not -- handed the typed landing (`git/base_sync/rewrite_handoffs.py`)
beside the issue it finishes. A landing the pinned record does not account for -- the remote
not shown on it, a rewrite that moved nothing, a publication a guard refused for anything
but the remote already standing on it, no attempt anchored to the head it replaced, another
pull request pinned, a replay record naming another head, made under other terms, damaged,
or never written (one whose terms stand with no head yet is left to the caller's vouching,
and one never written is vouched for only by the recovery's own retry pushing on the
counts),
a mark naming another head, a lag against the base that could not be counted, or an attempt
a finish already retired -- makes nothing, leaving the attempt, the label, and the round as
they are, save a transaction an earlier finish captured for its head, proved again first and
abandoned where anything it rests on moved.
Otherwise the report debt is measured on the whole announcement write and on the
comment as it stands (`rewrite_finish_debt.fits`), and one with no room parks
`auto_base_rebase_unrecorded_debt` with the push and the attempt kept, before anything runs
or is recorded. Then a head the base has not advanced past has its evidence resolved
(`_resolves`, `rewrite_finish_settlement.resolves`): decided and landed by the evidence
step (`rewrite_finish_evidence.py`), and a transaction it recorded published and settled,
or retired, with the anchor still standing -- evidence an earlier finish already settled
for the head routed as it stands while nothing beside it says otherwise. Only then is the
announcement prepared before the notice and the `base_rebased` event go out, landing the
debt, the reset round, and the mark while the anchor stands; a finish whose mark already
names the head repeats neither and lands only a debt new beside it. A head the base
advanced past again is announced and retired unrouted for the caller's next rebase, a
transaction an earlier finish recorded for it abandoned ahead of that announcement, and
an abandonment that does not land holding it with nothing announced. The retirement -- the
attempt cleared, the round reset, a human's retry spent, decided on every record the
evidence is bound through too -- is prepared before the relabel to `workflow:validating`
and lands behind it. A refused or unconfirmed write, an evidence decision held, or a
transaction left owed stops the finish with nothing behind it made -- nothing announced,
the round as it was -- behind the last word
(`rewrite_finish_captured.stands_before_the_route`) wherever a transaction is recorded for
the head. It runs under its caller's issue writer claim and takes none. The ordinary
publication
(`rewrite_publication.py`) hands its landing here, and the recovery's retry
(`rewrite_retry.py`) and its finish of a push already landed (`rewrite_landed.py`) hand
theirs through `finishes_the_recovery`, on the recovery road with the reply that brought
the attempt back, so every landing shares one post-push policy and one evidence decision
rewrite_finish_models.py
the finish's input -- the typed landing, the issue, its pinned state and label, the road
(`FinishRoad`), the lag the publication's notice reports, and the human reply a recovery
spends, with whether this tick's own push is what the remote was shown standing on --
an observation, a publication refused over a remote already on the replay, and a push
whose remote could not be read after are not -- and what it came to (`FinishOutcome`):
routed, continued to another rebase, parked, refused, unconfirmed, held over an evidence
decision nobody could take, an invalidation with no room, a failure notice nobody could
confirm published, or a transaction whose publication or settlement did not resolve, or
unfinishable
rewrite_finish_debt.py the debt a landed rewrite leaves, staged only where both the announcement write it rides
-- the notice's ledger entry reserved at the widest id, the reset round, and the mark --
and the comment as it stands have room for it, a refusal for anything but room leaving a
standing claim as it is -- measured ahead of the evidence too (`fits`), so a debt with no
room parks before anything runs; and the park notice of a debt with no room
rewrite_finish_evidence.py
the finish's evidence step for a head it routes: asks the policy (`rewrite_evidence.py`)
and lands what the decision requires in one guarded commit before the announcement -- the
current evidence invalidated into history where the rewrite moved the tree or context, a
fresh or carried result minted and recorded as the pending transaction, its receipt put
on the attempt in the same write (`rewrite_landing_records.records`), which the
finish's next step publishes and settles under the anchor (`rewrite_finish_settlement.py`),
and a FAILED run's notice, recorded and then published once
(`rewrite_finish_failures.py`). A result the comment cannot record is recorded nowhere, and
the head goes to the fresh reviewer, as for a REVIEWER or MOVED decision. A failure notice
an earlier finish of the landing recorded is published once with nothing run; a
transaction it recorded is settled and routed as captured only once it proves again, and
otherwise
abandoned with nothing run (`rewrite_finish_captured.py`), and one already retired runs
nothing afresh; a head the base advanced past has its transaction abandoned before the
attempt retires (`continues`, asked by `rewrite_finish_settlement.resolves` behind the
same unresolved-record hold as the route). Every route that carries or follows a
recorded decision ends
in the last word behind its requests, a captured transaction's behind any stop.
On either road the invalidation is asked as the write is staged
(`rewrite_evidence.invalidates_current`), behind any commands run, so a configuration
moved during the run or between finishes is answered. A decision short of a reading nobody
could take or of a base that moved after the head was counted, an invalidation with no
room, or a failure notice nobody could confirm published holds the route (`HELD`)
rewrite_finish_captured.py
the helpers for a transaction an earlier finish of the landing recorded for its head and
never routed, asked by the finish's evidence step and the recovery: read (`recorded`), or
found retired into
history and so still captured (`retired`) -- or, once the history no longer keeps it, by
the receipt on the attempt naming no pending transaction
(`rewrite_landing_records.capture_answered`), or settled current for the head; proved
again (`proved_again`); held to the
last word behind every request a route made (`stands_before_the_route`), which abandons it
unrun wherever any reading establishes movement -- its binding, its review or report
records, the landing, or the base -- even beside a reading nobody could take, which only
holds; and abandoned where the base advanced past its head (`sets_aside`). The
abandonment is guarded by the comment read afresh, falls back to the tick's own reading
(`rewrite_finish_writes.ABANDONMENT`), keeps what another road wrote, is refused over an
attempt another road put in place of the one read, and with no room for history drops the
transaction and blanks the attempt's recorded base tip
rewrite_finish_settlement.py
the landed head's evidence resolved before the finish announces it (`resolves`), and the
publication and settlement of the transaction the evidence step recorded, before the
announcement, the relabel, and the retirement and with the attempt still standing
(`settles`): the reconciliation's own answer (`verification_transaction.answers`) over a
reading over the issue fetched afresh that names the anchor
(`verification_proof.ProofReading.anchored`) and rests on the attempt (`rests_on`), so the
landing -- the remote branch and the checkout on the head, the base on the tip its replay
was made onto (`rewrite_evidence_proof.last_word`) -- is read again ahead of the post and
again last of all ahead of the settlement, every write it makes is refused over
an attempt another road put in place of the one read, and any refusal short of an unread
reading retires the transaction rather than leaving it owed. One still owed behind that
answer -- a post or settlement nobody confirmed, an unread reading, a settlement refused
for room or a moved comment, an issue no longer live work -- is proved again and held to
the last word -- over the first movement the answer itself read
(`ProofReading.observed`), each refusal kept as it was read and sorted as the last word
sorts its own (`rewrite_evidence_proof.MOVEMENT`), where it read any -- abandoned where
any reading establishes
movement and otherwise HELD, for
the recovery of the push already landed to find its artifact under the receipt and settle
it once; a finish whose state took a replacement attempt in, or a newer transaction
another road recorded in place of the one answered, holds before anything reads on it
again, the successor left as that road wrote it. Evidence an earlier finish of the landing
already settled for the head is
routed with nothing decided, run, posted, or settled again while the records agree it is
the last word -- no pending record beside it, the handoff naming it, no revision spent
past it -- and while the configured context is still the one it was taken under, the
evidence step invalidating it with nothing run otherwise rather than holding over it; a
newer transaction recorded for the head is answered and settled over it, and
any other disagreement holds, as does a pending record about any other head beside the
head's own retired evidence with nothing current (`rewrite_landing_records.resolved`);
the records the answer itself leaves are held to the same agreement before anything is
announced or routed (`_holds_out_of_step`), so a settlement or retirement another road
made while the run was published, which comes in with the comment the answer adopted,
holds the route out of step too
rewrite_finish_failures.py
the notice a landed head's failed verification is owed, kept on the pinned comment
(`auto_base_rebase_failed_verification`: the head and the notice's whole text) from the
evidence write until the retirement clears it, and its publication: the pull request's
conversation read, and the notice posted only where no comment of ours carries it -- its
whole text its identity, its author held to this orchestrator -- so a lost answer is found
where it landed; an unreadable thread or a post that raised holds the route
rewrite_finish_notices.py
the pull-request notice and the `base_rebased` event a finish announces with, spelled as
every finish has spelled them -- the publication's, a recovery that pushed
again, and a head this tick sent nothing for, on either road, as one found standing,
each recovery notice saying where a base advanced again sends the landed head -- and the
method the event files for each; and the notice of a configured verification the landed
head failed, naming the command, how it failed, and its output's tail
rewrite_finish_writes.py
the guarded commits the finish writes through, under the tick-state guard
(`report_commits.py`) and decided on the publication's pinned fields as well: the
checkpoint, decided on the attempt, the report records and claim, the park's flags, the
round, and the evidence records -- so a transaction another road recorded beside the one
the finish resolved refuses the announcement before its notice -- and prepared with its
notice's ledger entry reserved over the fresh ledger;
the evidence write, owning the four evidence records' pending, current, and history, the
revision floor, a failed run's notice, and the attempt's receipt of the transaction it
records, decided on the attempt, the claim, and every
record the evidence is bound through (`verification_durable.py`), a refusal over one of
those records collected as movement for the caller's last word (`prepares`, `lands`); the
retirement, clearing that notice beside the attempt, decided on the attempt, the park's
flags, the round, the claim, and every record the evidence is bound through;
the debt park, decided on what the checkpoint is and prepared before its
notice is posted; and the abandonment of a recorded transaction staged on the tick's own
copy (`ABANDONMENT`, `abandons`), owning what abandoning writes and the attempt's recorded
base tip, decided only on the transaction, its history, and the attempt -- the fallback of
`rewrite_finish_captured.py`
rewrite_evidence.py the evidence policy for a landed rewrite's head, handed the finish's input and writing
nothing; the finish's evidence step (`rewrite_finish_evidence.py`) asks it for every head
it routes, ahead of the announcement and with the attempt standing, and asks whether
the current evidence is invalidated (`invalidates_current`) -- evidence already
answering for the landed head only where the configured context moved since it settled
-- again as it stages its write. Where the tree the rewrite replaced, the tree it
published, and the tree the current evidence tested all read as one under the configured
context, the generic carry-forward decision (`verification_carry_forward.py`) is asked and
held to a review subject about the rewritten head -- never the approval of the replaced
head -- and its whole binding proved (`verification_proof.binding_verdict`): CARRIED,
naming the tested commit and tree and the source it copied. Otherwise, a moved tree or
context invalidating the current evidence, the configured `VERIFY_COMMANDS` run through the
verify runner (`git/verification/runner.py`) on the rewritten head, but only over a binding
proved first -- `review_subject` about that head and the settled report's publication moved
to it. An empty configuration or no such binding runs nothing and leaves the evidence to the
reviewer (REVIEWER), never a pass. Behind the run its recorded baseline -- the commit, tree,
and context the runner read and minted -- has to be the planned one, or the run is of
something else and MOVED, a failure included; then the issue is fetched again -- the one the
finish holds keeps the title and body the tick read -- and its pinned comment read afresh,
and the whole binding proved again over them (`rewrite_evidence_proof.proves_again`) -- the
pull request, the remote branch and the
checkout, the configuration, the review subject, the settled report, and the requirements
-- so anything that moved or would not read is MOVED; then a run
`verification_local_runs.py` binds is FRESH with exactly its commands, statuses, and
outputs, a passing run that binds nothing is REVIEWER, and any other is FAILED with the run
kept whole. Before a run starts, behind it, and before a carry the head is held to the base
tip its replay was recorded as made onto (`rewrite_evidence_proof.standing_refusal`)
rewrite_evidence_proof.py
the readings a landed head's evidence route is held to, asked by the policy
(`rewrite_evidence.py`) and by `rewrite_finish_captured.py`:
the binding proved again over the issue and comment read
afresh, the review and report records heard beside a proof that stopped at an unread
reading (`proves_again`); the head held to the base tip its replay was recorded as made
onto (`standing_refusal`, over `git/base_sync/rewrite_facts.py`) -- a base moved or unread
holds, rewound under the head or never recorded defers; and the last word behind every
request (`last_word`), every reading taken -- the remote branch, the base, the
requirements and records, then the checkout, its local base, and the configuration -- and
the first movement and first hold answered side by side, a local base nobody could count
against holding
rewrite_evidence_models.py
the policy's decision (`RewriteEvidence`): its route (`RewriteEvidenceRoute`: fresh,
carried, reviewer, failed, or moved), whether the current evidence is invalidated, the
refusal in the proof's own verdicts, the run, and what a fresh run binds or a carry
licenses; `stages` retires the current evidence into history as invalidated where the
decision says so, through `verification_settlement_state.py`, and writes nothing; the
evidence step lands that same retirement, through the same owner
pickup.py an unlabeled issue's first tick: the author allowlist, the `DECOMPOSE` route, and the
greeting / hash / label / state order a start publishes in. The greeting anchors both
`pickup_comment_id` and `last_action_comment_id`, the floor the park ending the first
agent run walks from, since the spawn it opens quotes this thread as it stands
prompt_notes.py shared empty-context placeholders, foreground execution and AGY asynchronous-command
instructions, the commit-subject contract every prompt that may author one carries -- mirror
the repository's own recent history rather than any enumerated prefix set, and write the
descriptive subject alone, since the ` (#N)` suffixes in that history are the publication
metadata the orchestrator appends for the pull request and the tracked issue's number is
never one of them -- the developer report contract spelled from the report vocabulary with
its fresh-respawn counterpart, both scoping the report to the final change, its rationale,
and unresolved risks with verification left out and forbidding the receipt prefix
`github/comments.py` refuses anywhere in a report, and the continuation notes for a
session-limit retry
prompts.py implementation, documentation, fixing, conflict-resolution, fresh-session, and
report-refresh prompt builders; each response marker agrees with the parser that settles
its stage, and the report refresh asks for a `REPORT: READY` report of the rewritten head
alone, refusing `REPORT: VERIFIED` by name
review_prompts.py the fresh reviewer's prompt and the handover it is built over -- the backend that
implemented the work, the subject the validating stage resolved, and the verification
evidence it proved current for that subject -- with the developer report quoted whole
between the issue and the inspection commands, named by revision and location, and a note
where the requirements have moved on since it was written; a subject with no report says
none is recorded. The verification block follows the inspection commands, and the closing
instructions put the declaration it teaches above the verdict line
review_evidence_prompts.py
what a reviewer is told about verification, which the reviewer prompt renders: the current
evidence handed for its subject (`HandedEvidence`, the settled record and its artifact
re-read), quoted whole -- its summary and every command with its status and complete
output, decoded from the comment's hidden payload or read off a legacy comment's visible
section, every line quoted whatever ends it, a bare carriage return included -- under the
`sha256:` revision a reuse names, naming each listed command that did not exit 0 (a status
about those commands alone, not the configured ones), or the note that none covers the
subject; then the configured `VERIFY_COMMANDS` in order, each of which an approval has to
declare, or that none are configured and nothing the orchestrator runs is evidence that any
check passed;
then the declaration, spelled from `review_verification_models.py` -- a RUN block naming the
subject's head, and the REUSED line naming the handed revision only where evidence was
handed -- and the policy that a SHA, count, or command the orchestrator publishes itself is
no change to request while failed checks, missing verification, inaccurate claims, and
evidence about another subject stay actionable
review_subjects.py what one review is of -- pull request, head, requirements revision, and report revision and
digest -- recorded as `review_subject` before the spawn, as `review_returned_subject` once a
reviewer returns, and as `review_approved_subject` once an approval passes the verify gate,
where recording the approval also retires the head-keyed `docs_verdict` and `ready_ping_sha`
an earlier one left; the widest subject any of the three can be written at
(`ReviewSubject.widest`), which the report settlement's measurement reserves; whether a
number names, read as a recorded pull request is, the one a subject is on
(`ReviewSubject.is_on_pull_request`); and the question every later reader of an approval
asks, whether the report recorded as current is the one it covered, compared on the pinned
records alone. An approval with no record covers
only an issue with no report either -- one approved before the record existed over a pull
request that has settled a report goes back for a fresh review -- and a record nobody can
read covers nothing: it is read whole, exactly the five members its writer spells, each in
its shape -- requirements that are a digest or "", both report members or neither, a whole
commit id as the head wherever a pull request is named, and neither a head nor a report
where none is -- or neither its identity, its head, nor its requirements are read
verification_records.py the verification-evidence records and their pinned keys, reconciled by the dispatcher
(`verification_transaction.py`), whose live producers are a returned reviewer, the
approval squash's carry-forward (`stages/validating/squash_evidence.py`), and a landed base
rewrite's fresh run or carry (`rewrite_finish_evidence.py`), which its finish settles
through that same reconciliation under the anchor: PENDING
(`verification_evidence_pending`, the run and its binding, written before the artifact is
posted), CURRENT (`verification_evidence_current`), HISTORY
(`verification_evidence_history`, retired records with why -- superseded, invalidated, or
abandoned -- each keeping its whole binding), HANDOFF (`verification_evidence_handoff`, the
receipt of the last finished transaction), and the revision FLOOR
(`verification_evidence_revision`, the highest revision any transaction was recorded under,
which outlives a damaged, dropped, or evicted record); and the receipt spelling, which names
the revision a transaction was minted under. A binding extends the report records rather
than forking them: its target is a report `ReportSubject` about the head the evidence
answers for, beside the review subject exactly as `review_subjects.py` records it, and the
run adds the tested commit and full tree, the context revision, and the witness. The
artifact a pending record publishes is built here from those members, and `retargeted` moves
only the head a binding answers for, never the commit it tested
verification_record_fields.py
the pinned object a binding and a pending transaction are written as: the publication half
through `report_record_fields.py`'s own subject writer and reader, the review subject held
to the binding's pull request and requirements and required to name a developer report,
a pending receipt held to its own revision, and every command read back through the
published format's own type, so a record the artifact would refuse reads as damage rather
than as a refusal after the world was proved; `copied_from`, the receipt of the evidence a
carry copied its transcript from, is written only on such a carry and read as damage where
it is there and not a receipt, or missing from a reviewer's account carried to another head
(`EvidenceBinding.carries_a_copy`), which only such a copy ever is
verification_settled_fields.py
the pinned objects current evidence and a handoff are written as, and the members every
current and history record share (`record_members`); each reader refuses what its own
writer would not produce, a receipt naming another revision than the record's included
verification_history_fields.py
the pinned object one history entry is written as: the whole binding -- report revision and
digest and the complete review subject included, since the artifact names only the subject's
head -- beside an index of an artifact that stays on the pull request, whose comment is
`null` exactly when the entry was abandoned, since only evidence that was current ever held
one
verification_record_state.py
the pending transaction's round trip: presence and reading, minting (a revision past
the floor and every readable record, and a receipt spelled from it and a fresh nonce), and
recording -- refused unless its revision is past everything spent, it reads back
identically, its artifact renders, and the comment has room for it AND for its whole
settling write and the later invalidation of the evidence that installs (`settled_payload`),
measured at the widest comment id and label with the ledger entry reserved. Each record
raises the floor in its own write, and over a comment that did not parse, a floor present
and unreadable (`null` included), or a floor missing beside any record, nothing is minted or
recorded. A retry under the recorded receipt is accepted only identical and over an
established floor, and a later record abandons a readable earlier one into history in the
same write
verification_settlement_state.py
current evidence, its bounded history, and the handoff: read fail-closed, settled as
ONE composed write on a copy that keeps the comment it was read from, so writing it rewrites
that comment rather than posting a second, and only for the transaction the comment records
(the earlier current superseded into history, this one current, the handoff, the pending
record dropped), and retired -- current invalidated, or the pending record the comment
stores, named whole, abandoned -- into history without ever relabelling a run, each
retirement composed on a copy and refused, writing nothing, where the comment could not
carry it. History keeps the five highest revisions in revision order, lowest out, and its
reader refuses a `null`, a longer index, or revisions that do not strictly rise; the
revision floor, not the index, keeps revisions monotonic
verification_local_runs.py
what one local `VERIFY_COMMANDS` run is worth as evidence, asked by the approval squash
of its verify gate's run (`stages/validating/squash_evidence.py`) and by the base-rewrite
evidence policy of its fresh run (`rewrite_evidence.py`): only a run
`is_reusable` vouches for, on the head its target answers for, bound with exactly the
commands that ran. A failed run binds nothing, since the runner proves no
clean tree after a nonzero exit; nor do an empty configuration, a timeout, a dirty or moved
tree, a run on another head (a carry-forward's decision, never a local run's), or a
transcript the artifact would refuse, UTF-8 cannot carry, or could not fit in one comment at
the widest receipt and revision a record carries; the room on the pinned comment is the
recorder's question
verification_world.py the branch and object half of the evidence proof: a checkout on this host, the branch
held by `report_remote_evidence.py` to the target head, and the tested commit and the
target head each read as a commit in its own right -- never a tag peeling to one --
carrying the one tree the run recorded (`tree_of`)
verification_subject.py the subject half: the evidence's pull request the one this issue pins as `pr_number`; no
developer report still owed (`report_delivery.owes_a_report`, the validating hold's rule);
the bound review subject about the target head and equal to the applicable record
(`applicable_subject`: `review_returned_subject` for a reviewer's account, `review_subject`
for a run this orchestrator executed); the settled report re-read exactly as a reviewer is
handed it -- the settled pair held to each other and the report read at its location,
through `stages/validating/review_report.py` resolved when called -- named by that subject,
which passes that reader's own rules in its order (requirements the round was due, then a
report not stale: about the subject's head, written against the drift baseline -- or older
than a baseline that is the subject's own requirements, which only the settlement of the
reply that bought the round leaves); and the requirements the evidence was bound to still
the issue's own
verification_proof.py the whole proof, pull request first through `report_publication_evidence.py` and then
cheapest first (`rest_verdict`) -- the context against `configured_context_revision` (the
verify runner's own over the configured `VERIFY_COMMANDS` and `VERIFY_TIMEOUT`, for both
witnesses), the recorded subject, the world, the settled report, the requirements -- in
the report transaction's verdict vocabulary; `binding_verdict` is both halves in one call,
which the settlement takes again over the comment it re-read, and which the base-rewrite
evidence policy (`rewrite_evidence.py`) takes over a carry, and over a run's
binding before the run and behind it. `recorded_verdict` is the part the review and report
records answer with no request, for a caller whose proof stopped at an unread reading --
`rewrite_evidence_proof.py`. A reading's `anchored` proof is a caller's own, asked last
in `rest_verdict` and carried into the settlement's proof: the base a landed rewrite's
head is held to while its finish settles under the anchor
(`rewrite_finish_settlement.py`), beside the records that finish's writes rest on
(`rests_on`, the attempt) and where the refusals its answer reads are kept
(`observed`). `current_evidence_verdict`
is for a reader about to rely on the current record: the pull request, then its
publication (`verification_current.py` -- the latest record, its handoff, its artifact),
then the same proof. Its readers are the reviewer's hand-off of current evidence
(`stages/validating/review_evidence.py`), the approval's proof over the evidence its
verdict names (`approved_evidence.py`), and the squash handoff's proof of a settled carry
before the label moves over it (`squash_evidence.py`)
verification_current.py whether the current record is still what the pull request carries: no revision past it
spent (a newer transaction, its artifact posted or not, supersedes it), the handoff
describing it, and the comment it recorded, re-read, our artifact with every binding
member the artifact encodes (not the branch or the report revision and digest, which
the proof holds), the evidence digest, and a pass flag its commands earn; anything else
defers, and a thread nobody could read holds. `carry_answers` asks, off the pinned comment
alone, whether current evidence carried onto a head it did not run on still answers for
the review subject it was carried for. `copied_source_verdict` holds an owed carry to the
evidence it copied its transcript from (`copied_from`): still the current record, its
artifact re-read as the one that settled and carrying exactly the commands copied --
asked ahead of the carry's post and again ahead of its settlement
verification_carries.py a refused carry -- a transaction carrying a run onto a head it did not run on, which an
approval's squash records onto the head it published and a landed base rewrite's finish
onto its rewritten head (`rewrite_finish_evidence.py`) -- abandoned into history with the
approval it was recorded for (`review_approved_subject` written null, while it is still
exactly the subject the carry answers for, spelled as the carry recorded it -- the squash's
approval, and for a base rewrite's carry only an approval of the rewritten head's review --
and even where the carry's own entry has no room), in one guarded
commit staged on the pinned comment read afresh and guarded by it
(`verification_durable.py`), owning only the record, its history, and that approval
(`ABANDONS`), so an approval, a transaction, or any other bound record another road moved
under it refuses it with nothing written and the carry owed, while every field it does not
own is kept as written; asked on every refusal of the carry short of an unread reading,
ahead of the post and at the publication lookup (`abandons_afresh`, which the reconciliation
abandons every transaction that will never settle through too), and at the settlement, where
that commit records the artifact's ledger entry as well, and only while the comment read
behind its proof still carries every bound record as the tick read it. Which
approval a run was recorded for -- the very subject it answers for
(`retires_its_approval`) -- is the rule a settled carry invalidated in `validating` keeps
too (`stages/validating/squash_evidence.py`), and the one a carry still owed holds the
move by (`awaits_settlement`). A transaction a landed rewrite's finish answers under its
standing anchor, a fresh run included, is abandoned on those same refusals
(`abandons_on_refusal`), since no route behind the anchor answers it. The recovery
helpers of a landed rewrite's
captured evidence abandon through `abandons` as well (`rewrite_finish_captured.py`,
`rewrite_landing_moved.py`)
verification_carry_forward.py
the carry-forward decision, exposed only when the tested commit's and the target head's full
trees, read from this repository, are the tested tree and the configured context is the
recorded one -- no patch id, fingerprint, topic diff, or rewrite name is consulted -- and
only for a head other than the one it answers for, while the source is still the latest and
published (`verification_current.py`, read on the pull request standing on the new head,
whose artifact's transcript is the one carried), and either a review subject about the new
head is recorded or the review the source answers for is unchanged and is the one the
approval record covers. It licenses recording a transaction whose binding keeps the tested
run and answers for the new head and that review, which the reconciliation then proves
whole; a refusal is the proof's own verdict -- an unread pull request or artifact holds,
anything else defers. A local run bound to the head it tested (`local_run_decision`) is
carried over the same proofs save an artifact it never had, with its own transcript. The
approval squash asks for one (`squash_evidence.py`), and takes the unchanged approved
review alone (`approved`): a review recorded about the new head since refuses it. The
base-rewrite evidence policy (`rewrite_evidence.py`) takes only a review recorded about
the rewritten head
verification_publishing.py
posting a proved transaction's artifact through `verification_comments.py`, scoped by
its receipt: the settlement's own guarded commit staged at its widest
(`verification_record_state.settled_payload`) and PREPARED over the pinned comment read
afresh before the post (`pinned_commit.prepare`), the artifact's ledger entry reserved
against the ledger as it stands, with the invalidation of what it
installs measured again over that candidate -- a comment that will not read holds, and
one with no room or whose bound records moved posts nothing -- UNCONFIRMED held, any
other reading short of PRESENT stood down -- a carry, or a transaction published under a
standing anchor, abandoned (`verification_carries.abandons_on_refusal`) -- and, behind
that room and right before the post, the readings no guarded commit holds taken again
(`verification_unguarded.py`), so one that moved while the proof's requests were
answered posts nothing, abandoning a carry or an anchored transaction on it as on the
proof's own refusal -- and a landed post handed to the settlement
verification_settling.py
the settlement of a landed post: the issue read afresh and still live work -- where it
is not, nothing is written -- the pinned comment read afresh and held to the state in
hand on every bound record, the whole proof taken again over them with the artifact
re-read right behind the pull request, at the comment it landed as and held to exactly
this transaction's -- and a carry's copied source to what it copied
(`verification_current.py`) -- and every other reading behind that re-read, a standing
anchor's own proof of the base included (`verification_proof.ProofReading.anchored`),
the comment read once
more behind those requests and held to every bound record as the proof read it, the
artifact re-read once more behind all of them and held to exactly this transaction's,
the readings no guarded commit holds taken last (`verification_unguarded.py`) -- the
anchor's landing and base asked again, then the issue fetched once more and its
requirements hashed over that reading, the configuration read once more last of all --
and ONE
guarded commit (`pinned_commit.commit`) composed over that last reading and guarded by
it, stamped with the label the issue carries then: current evidence, the superseded
history entry, the handoff, the pending record dropped, the revision floor as the
transaction's record raised it, and the artifact's ledger entry merged into the ledger
it finds (`SETTLES`), every other field kept as the fresh reading carries it. A bound
record that moved, a comment that moved under the edit, or a commit with no room leaves
the transaction owed; a comment that will not read or was replaced, and a commit nobody
confirmed, hold, and the receipt settles it on a later tick. Wherever it does not land
over a comment that still reads, the artifact's ledger entry is committed alone
(`verification_comments.records_the_artifact`), holding the tick where that finds the
comment unreadable, replaced, or no longer parsing; a carry -- or a transaction settled
under a standing anchor -- whose binding is refused is abandoned with that entry instead,
a carry's approval with it, in one guarded commit staged on that
last reading and guarded by it (`ABANDONS_RECORDING`) -- only while that reading still
carries every bound record as the tick read it, since a record moved before or during the
proof refuses what the tick decided over rather than the carry -- the entry committed alone
where that abandonment is not made or does not land over a comment that still reads
verification_live_work.py
whether an issue is live work evidence may settle for -- not closed, not `done` or
`rejected`, not held by a hard-skip control label, and wearing a workflow label --
asked by the reconciliation of the issue it routed, and of the issue read afresh right
before the post and again after it (`verification_unguarded.py`)
verification_unguarded.py
the readings of a transaction no guarded commit holds, taken behind every other request
right before the post and right before the settlement's commit, in the one order that
leaves none of them in front of a request: a standing anchor's own proof of the landing
and base (`verification_proof.ProofReading.anchored`), then the issue fetched afresh --
still live work (`live_issue`), where it is not or would not read nothing is written --
its requirements hashed over that very reading, and the configuration last
(`unguarded_refusal`); every refusal of the binding kept the moment it is read
(`ProofReading.observes`)
verification_durable.py the evidence domain's adapter over the guarded commit: the pinned comment read afresh
before a settlement or a retirement through the commit's own reading
(`pinned_commit.reread`) -- the comment this tick read, parsed, and carrying `pr_number`,
the developer report's records and the report debt a review subject stands only without
(`report_delivery.REPORT_DEBT`: `developer_report_owed` and an undeliverable `park_reason`
beside them), the three review subjects -- the approved one, which a
carry across an approval's squash answers through, included -- and the evidence records
and revision floor exactly as the state in hand spells them, or the field that moved;
the capture every guarded evidence write is taken under, those bound records its
prerequisites with any other record the caller's decision reads (`guarded`, `rests_on`); the
commit of a retirement staged on the comment read afresh, laying what landed over the state
in hand and the reading it is synced with (`lands`); and what a guarded write's outcome
refuses in this domain's words (`refusal_of`): an unread or replaced comment and an
unconfirmed write HOLD, and every other refusal -- a moved record, a comment moved under the
edit, no room -- DEFERS
verification_transaction.py
the evidence reconciliation the dispatcher runs directly behind the report
transaction: holds behind a standing auto-rebase anchor, whoever calls it, leaving a
landed rewrite's transaction to the finish that answers it under the anchor through
`answers` (`rewrite_finish_settlement.py`), or the recovery that completes that finish;
stands aside on work that is not live
(closed, `done`/`rejected`, a
hard-skip control label, or no workflow label); drops a record whose revision a settled
or retired record already carries (a replay, or a restored comment) and an unreadable
one; abandons one whose pull request ENDED, or past which a revision was spent or
nobody can say what was -- every retirement one guarded commit staged on the comment read
afresh and guarded by it (`verification_durable.py`), owning only what it retires, with
nothing written where a record moved before that reading or under the commit, or where it
has no room, and every field it does not own kept; a retirement nobody confirmed holds, for
a later tick to find gone or retire once; holds
over a reading nobody could take, stands down on everything a route behind it answers --
save a carry onto a head it did not run on, which it abandons, retiring the approval it
was recorded for, on any refusal but an unread reading (`verification_carries.py`), its
copied source re-read behind the proof (`verification_current.py`), and so any
transaction answered under a standing anchor (`abandons_on_refusal`) -- and
otherwise publishes and settles. It never parks: evidence is reproducible and every consumer fails closed on its
absence
conversation_prompts.py question, discussion, PR-feedback follow-up, and developer human-reply resume prompts;
discussion publication instructions describe the confirmed plan artifact and the commit
its stage verifies
decomposition_prompts.py the decomposition prompt with the validator-owned child limit, and the bounded
single-decision comment that carries manifest notes into implementation
retry_values.py daily-retry decisions, notice phases, pinned keys, and the bounded continuation and
rolling-window constants
retry_ledger.py daily slot consumption, window expiry, and the remaining granted attempt; a standing
retry-cap park refuses even when time or configuration would otherwise reopen the budget
retry_park_state.py the durable retry-cap park, its recorded stage, and the exact notice still owed to the
thread; settling the sentence grants no launch
retry_notices.py bot-authored notice reconciliation, delivery, watermark advancement, and audit phases; an
unreadable thread keeps the notice owed and says nothing
retry_budget.py the shared charge-or-park form, persist-before-post ordering, stage-entry notice replay, and
the one bounded continuation; late adjudication uses the same ledger and owns its
generation-specific park
run_budget_models.py the four durable budget-event phases, refusal vocabulary, and the logical launch identity
used to correlate a charge
run_budget_fields.py the complete ledger payload, explicit unlimited remainder, reservation id combining a
bounded fingerprint and used count, and guarded stage lookup for a durable extension
run_budget.py budget events emitted only after the transition is durable; audit and analytics writes are
guarded independently so either may fail without costing the other or the tick
run_charge_state.py the issue and caller-state context of a launch charge, fresh pinned reads, guarded durable
writes, and a merge of only the fields that charge changed; an unreadable or failed record
refuses invocation. A launch owed once (`OwedLaunch`) names the count it is owed at and
the caller's hold on it -- requests to resolve again, and a judgment of each reading --
and a fresh reading whose recorded start of such a launch names that count, where the
caller's own state does not, is that launch made by another road
(`AgentRunBudget.made_elsewhere`)
run_circuit.py the ordered reserved and started writes before the sole process invocation; only the logical
launch holding a reservation reuses it, a launch owed once records the count it was owed at
in its started write and is refused with nothing written on any reading that shows another
road made it or that fails the caller's hold, and is started over the comment read again
behind its charge and the requests its hold resolves, only while its own reservation still
stands unstarted there; each durable step emits its budget event, and exhaustion parks on
the same reading
run_grant.py the one command that answers the spent-ledger park below: a trusted `/orchestrator
add-agent-runs N`, read only while that park stands and only as the request the parser
beside it hands over. It persists an allowance of exactly `used + N` -- absolute rather
than additive, so the same command read twice buys the same ceiling -- takes that park
down and puts back the park the refused launch was on, so a resume refused on a reply
is resumed on that reply, consumes the batch it read and the answer it wrote under it
(never a comment that arrived between the two: the boundary is built from ids this
tick observed rather than re-read off the thread, and nothing at all where the batch
begins below a notice of ours, over replies a refused resume was handed), and
lets the tick reach the stage its label names. Every other
request leaves both counts where they were and earns one receipt; an untrusted one earns
nothing at all. Both answers are marked with the comment that asked, so a post whose write
never landed is recognized rather than said twice. Only the ending that moves the ceiling
reaches the shared budget stream, and only once the write that moves it has landed
run_grant_request.py what a `/orchestrator add-agent-runs N` comment has to say before the owner above acts on
it: the command as a whole line of its own, the exact positive count no larger than
`MAX_RUNS_PER_COMMAND` its argument has to be -- leading zeros dropped before the length
is measured, so `007` is seven and a digit string too long to be inside the bound is
turned away before `int()` can raise on it -- the last such line in a batch as the
request, and the record carrying it, the comment that asked, and the batch a tick may
claim to have read. It reads words and decides what they buy; no ledger, park, or thread
is touched here. The bare-command reading the drift hash filters on lives beside them,
since the tick that answers the command is the tick the stage below runs on and a hash
counting it would call a body nobody edited changed requirements
run_ledger_models.py immutable allowance, used-count, and reservation snapshots; the reserved/started vocabulary
and predicates for unlimited, spent, and reusable launch charges
run_ledger_values.py the pinned ledger field names and validated readings; an absent allowance defers to
configuration, the used count is floored by the legacy meter, the start of a launch owed
once is read as the count it was owed at, and malformed values supply no reservation
evidence
run_ledger.py ledger snapshots and the reserve/start/settle mutations; used counts remain monotonic,
the start of a launch owed once records the count it was owed at, settlement clears only
reservation fields, and PROJECTED_KEYS retains the allowance and count across state
projection
run_limit_values.py the lifetime-limit notice record, the allowance and spent count it explains, the audit
phases, and the pinned park fields; `DisplacedPark` is the park a run-limit park goes up in
front of, read off the standing flag and reason (the run-limit reason itself reads as
none) and back off its `agent_run_limit_displaced` record, which anything missing or
malformed reads as no park
run_limit_state.py the standing lifetime-limit park and its owed sentence; changed ledger coordinates replace
the notice, and settlement clears the sentence without lifting the park or changing the
charge. Taking the park records the park it stands in front of, read off the durable
state the circuit refused on, and `_restore_displaced` is how the grant puts that one back
run_limit.py persist a supplied exhaustion reading before its budget event and notice, reconcile
bot-authored delivery, and replay the sentence still owed; this owner grants and spends no
additional run. The notice is a bounded park and its repair walks the same way, entering
the found notice in the id ledger first, so replies a refused resume froze stay unread
terminal_reading.py one guarded linked-PR reading for both endings, retaining failed reads and deferring a
merged publication to its merge path when recovering a human-closed issue
terminal_context.py the issue, publication, pinned state, and stage one ending is attributed to, with its
recorded PR number and conflict-round semantics
terminal_effects.py terminal stamps, labels, usage verdicts, pinned writes, events, issue closure, and branch
cleanup in their defined order; an open PR on a human-closed issue stays available
terminals.py select merged, rejected, and human-closed endings from their fresh readings; failed reads
leave the decision for a later tick, and the merged-PR path precedes closed-issue rejection
tick.py one repo's polling pass and the order it drives: the base refresh below, the
community-contribution sweep above, the skill-catalog emission, and the scheduler
handoff or in-tick execution behind them -- with the sequential mode of that execution
here, since streaming the enumeration rather than materializing it is what keeps a
partial one from losing what it already yielded
base_refresh.py the per-tick base refresh the tick opens with: the one authenticated fetch of
`<remote>/<base>`, the walk of the repository's worktrees root that hands each entry to
the git `refresh_selection` owner, the scheduler-active guard that keeps a worktree out
from under a live worker, the issue's writer claim that keeps it out from under every
other writer on the host -- taken behind that guard and before the issue is read, on the
key every dispatch path takes, and held through whichever route follows, so a refused
issue is skipped with nothing read or written and synced on a later tick -- the
dirty-tree refusal a pre-PR rebase owes, the base-lag probe, and the route: the git
`pre_pr` rebase for a branch nobody has pushed yet, the base-rewrite coordinator below
for one a pull request carries -- reached even with no lag, so a pinned anchor's
recovery is never skipped -- and, over a pinned anchor whose lag cannot be counted, that
coordinator's reset and park rather than a handler the dispatcher holds back. One
worktree's failure is logged and the walk goes on. Nothing below it takes the claim
again, and its lines report on `orchestrator.base_sync`
base_rewrite.py the base-rewrite coordinator for a PR-having worktree: the order the git `base_sync`
owners' gates and rebase and the publication below are asked in, a terminal pull request
asked for ahead of any park an anchor stands under, the recovery alone an anchor a
stage's park stands over is answered with, and the same gates in front of the abort a
checkout whose lag cannot be counted takes. It writes nothing itself -- a reply that let
the rebase start is staged read, where it only asked for the retry, for the anchor's own
write to land (`rewrite_replies.py`) -- and a clean rebase is handed to
`rewrite_publication.py`, a pinned anchor's recovery to `rewrite_recovery.py`,
the abort over an uncountable lag to `rewrite_recovery.answers_an_unreadable_checkout`,
with the recovery's answer to its reset, and the keyword
adapter binds the refresh's argument list into their typed context
rewrite_publication.py the ordinary publication of a clean rebase, from the candidate the git owner reads
(`git/base_sync/rewrite_facts.py`) to the shared finish: an unreadable head reset and
parked and a rebase that moved nothing cleared, both before the replay is recorded --
beside the base tip the anchor froze before git ran (`git/base_sync/attempts.py`); a
checkout git names uncommitted paths in reset, cleaned, and parked; the size gate and
the transfer permit asked before any push (`stages/implementing/late_push.py`), a permit
refusal measured cumulatively and `DECOMPOSE=off` publishing unmeasured as on every other
road; a hold that handed the replay to an adjudication handing the attempt over with
it (`rewrite_takeover.py`), whose proof leaves every park the gate takes its attempt;
and the push the gate licenses made as the git owner's publication of exactly that
candidate under its anchor's lease (`git/base_sync/rewrite_transport.py`), handed to the
gate as its two-step transport (`stages/implementing/late_transport.py`) -- the fresh
reading, then the push, with the gate's ending barrier between them -- so the receipt,
the debt it settles, the exemption's rotation, and the post-push checkout proof stay the
gate's. A remote that reading finds already on the candidate is proved there by a push
leased to the candidate itself, never taken on a reading's word. A publication refused
for what moved since the reading -- the checkout, the base, the remote, or its answer --
or a lease the remote rejected resets the checkout onto its anchor and parks
`auto_base_rebase_push_failed`; one the remote was shown standing on, its answer lost
included, is handed to `rewrite_finish.py`. Its transport (`CandidatePush`) is the one
the recovery's retry pushes through too, and the one the leased no-op settling a push
already landed proves it through. It runs under the refresh's issue writer claim
rewrite_recovery.py the recovery an interrupted attempt is owed, in the order it has always been asked: the
decision the coordinator takes ahead of any rebase (a recovery that answered the anchor
owns the tick, and a reply it spent is not spent again by the rebase behind it); a label
the refresh does not drive cleared or parked, and a checkout still on the anchor cleared
or parked, both before any comparison (`git/base_sync/replay_cleanup.py`); the fetch and
the remote comparison (`git/base_sync/snapshot.py`) and the transfer the attempt left
(`git/base_sync/transfers.py`); the transaction a finish of the attempt captured --
the one under the receipt it put on the attempt, found before any announcement mark is
down (`rewrite_landing_records.captured`) -- abandoned before any road a snapshot
reading the landing off its head takes -- the
fetched checkout asked before the remote head completes it -- the tick held
where no write retires it (`rewrite_landing_moved.py`), and the answer to a landed reset
handed to every road and to the abort over an uncountable lag
(`answers_an_unreadable_checkout`); a head the pull request already carries handed to
`rewrite_landed.py`; and an unpublished one refused for a foreign
publication, a prior announcement, a rollback, an unvouched transfer, or a checkout the
record disowns, in that order (`git/base_sync/replay_refusals.py`), parked as a rollback
where an evidence record names the replay (`rewrite_landing_records.saw_land`), then
retried where the
record names it over a remote on the anchor or the transfer vouches for a replay its
record never named, and otherwise read off the counts -- zeros over unequal heads and a
remote with commits of its own park, a strictly-ahead branch is retried
rewrite_retry.py the retry of a replay the crash kept off the pull request, from the candidate the git
owner reads in the attempt's own terms (`git/base_sync/recovery_push.py`) to the shared
finish: a checkout git names uncommitted paths in reset, cleaned, and parked; the
evidence a grant the crash came before is re-derived from
(`git/base_sync/transfer_evidence.py`), a replay only a transfer can vouch for parked
where none assembles, and the transfer permit asked before the gate wherever a transfer
licenses the push, the gate told it is the only licence, so a refusal on either side is
a reset and a park rather than the cumulative reading -- save a replay the record names
with no grant before the crash, whose refused evidence is a changed contribution the
gate measures as the publication would have; an ordinary replay measured; the
exact candidate pushed under the anchor's lease through `rewrite_publication.py`'s
transport, a refused or unlanded push reset and parked `auto_base_rebase_push_failed`, a
gate's hold written as it left it, the reply that brought the attempt back recorded read
in that write where it only asked for the retry (`rewrite_replies.py`), and offered to
the adjudication it may have left (`rewrite_takeover.py`), and a landing whose verdict
did not rotate parked with
HEAD and the anchor kept; and every other landing handed to `rewrite_finish.py` on its
recovery road with the reply that brought the attempt back, a head the base advanced
past again leaving this tick's rebase to go on from it
rewrite_landed.py the recovery of a push an interrupted tick already landed, with nothing pushed again or
measured: an attempt made for another publication parked; a checkout read as a candidate
naming any other head than the one the fetch classified -- the one every voucher below
is about -- left with nothing made for the next tick to classify, a transaction captured
for the head abandoned first where the checkout reads another head, and proved again over
every other reading where its head would not read; a landing the git owner
names a reason against (`git/base_sync/landed_recovery.py`) -- a mark naming another
head, a head nothing this attempt vouches for, a checkout not provably clean beneath a
verdict, a transfer the receipt and debt do not account for -- parked with HEAD and the
anchor kept; a settled transfer the sinks never heard of reported once
(`stages/implementing/late_transfer_telemetry.py`); a permission still outstanding settled
by the permit-only leased no-op -- the permit asked before the gate, the candidate proved
at the remote through `rewrite_publication.py`'s transport, and a refusal, a no-op that
did not land, or a rotation the gate did not make parked with HEAD and the anchor kept;
and anything else observed where the remote stands (`git/base_sync/rewrite_transport.py`),
which is how an accepted push whose answer was lost is finished without a second one, a
captured transaction abandoned first where the remote reads off the head.
What the proof or the observation found goes to `rewrite_finish.py` on its recovery road,
which resolves the evidence -- a transaction an earlier finish recorded, found by the
receipt on the attempt, published and settled under the anchor -- before anything is
announced, the mark an earlier finish left keeping its notice and event from being said
again
rewrite_landing_moved.py
the recovery's helpers: the evidence transaction a finish of the attempt captured --
the one under the receipt it put on the attempt, or before that receipt existed one
about the head its mark names (`rewrite_landing_records.captured`), which leaves any
other as the road that recorded it wrote it --
abandoned, unrun, before any road that reads the landing
off that head -- a snapshot reading its checkout or remote on another head
(`abandons_off_the_landing`, through `rewrite_finish_captured.py`'s last word with the
movement already read), answering False where no write could retire it so the road
holds, and keeping it where a head went unread, which moves nothing; the same
transaction proved again before every recovery park that keeps the attempt, which the
git owner asks for (`abandons_unproved`, behind `git/base_sync/persistence.py`), and
abandoned where its proof or the last word reads movement, a checkout gone from disk
abandoning it in the park's own write -- and the answer a
landed reset is owed (`abandons_over_the_reset`), staged on the
state the git owner's park writes (`git/base_sync/persistence.py`) so it lands with the
attempt's release or not at all, dropped with the recorded base tip blanked where
history has no room, so an attempt a park keeps runs nothing for that landing again
rewrite_landing_records.py
what the evidence records say a finish already did for the head it published, written
only once it saw the push land: whether any record -- pending, current, retired, or a
failed run's notice -- names the head (`saw_land`), which keeps the recovery's retry
from pushing over a remote rolled back off it before any mark was down, and whether the
head's evidence was already settled or retired (`resolved`), which the settlement step
asks before letting a pending record about another head go unanswered beside it, routed
or continued; and whose a pending transaction is for `rewrite_landing_moved.py`: the
receipt the finish's evidence write puts on the attempt beside the transaction it
records (`records`, `pending_auto_base_rebase_evidence_receipt`) names the finish's own,
or, with none recorded, the head its mark names does (`captured`). That receipt outlives
the bounded history, so one naming no pending transaction is a capture already settled
or retired (`capture_answered`) -- the settlement step holds beside it and the evidence
step runs nothing again -- and it answers `saw_land` for the replay the record names
rewrite_takeover.py the handoff of an unpublished replay the size gate handed to an adjudication, from the
attempt to the live late generation adjudicating it (`takes_over`), proved off the pinned
record alone: the attempt read back whole (`git/base_sync/attempt_records.py`) with no
announcement mark; a generation late adjudication would itself act on for this issue --
through the late domain's record gate (`late_split/validation.py`), both frozen commits,
and the issue it names -- live and measured past its ceiling, with a whole publication
group; and the two agreeing on the candidate, the pull request, the anchor the
generation froze as the published head, and the stage. Evidence short of that is
INCOMPLETE and evidence of other work UNRELATED, both left standing; a proved pair lands
in one guarded write (`report_commits.py`) decided on the attempt, the generation, and
the park's flags -- `late_auto_rebase_replay_sha` staged and the whole attempt retired
with any `auto_base_rebase_*` park it left and the replies that only asked that park
for a retry recorded read (`rewrite_takeover_parks.py`), every other park and every
other field as the comment spells them -- and a repeated handoff answers OWNED and
writes nothing. A write never confirmed is UNCONFIRMED, landed or not until the comment
is read again. Asked by `rewrite_publication.py` and `rewrite_retry.py` after every hold
the gate makes, whose parks its proof refuses, and by `dispatch_guards.py` ahead of the
anchor hold beside a live adjudication, which hands over a pair a crash interrupted or an
earlier build stranded. Ownership licenses no push
rewrite_takeover_parks.py
the parks on either side of that handoff, by owner: the attempt's `auto_base_rebase_*`
reasons, retired with the attempt and the retry replies that answered them; the late
domain's (`late_*`, and the shared `retry_cap`); and everybody else's
(`stands_for_another_owner`), which the size gate's route keeps beside a pinned anchor
(`stages/implementing/late_park_retirement.py`), the handoff leaves, and
`holds_the_adjudication` holds a taken-over replay's adjudication behind until a human
replies past its notice, so no verdict takes its flags over. With no park standing, that
same hold spends a retry the attempt's notice drew past the handoff -- up to the
adjudication's first reading of the thread, the only question a bare retry could answer --
in a guarded write of its own, and holds the tick only where that write did not land
rewrite_replies.py which replies to an auto-rebase attempt's park are the attempt's: a bare
`/orchestrator continue` or a bare retry phrase is the retry the park asked for, anything
more is guidance. The leading run of retries is staged read (`records_the_retry`) on
`last_action_comment_id` and -- where it already covers the thread up to the watermark
they were written past, in the current spelling or the legacy one that counted a bare
continue -- on `user_content_hash`, in the write that spends the reply: the anchor's
(`base_rewrite.py`), the retry's gate (`rewrite_retry.py`), the handoff's, or the
dispatcher's own past a handoff whose tick was lost (`rewrite_takeover_parks.py`), so no
lost tick leaves an adjudication to read a retry as guidance
parallel.py the other in-tick mode: the bounded pool a `parallel_limit` above 1 runs the pass
across, the submission plan the executor is sized from -- which is why this half
materializes the enumeration the sequential one streams -- the family bucket folded
into exactly ONE task so it costs one worker slot however many family-aware issues
are pending, each run through the pass its reading earns, and the completion drain that
reports each failure as it lands. Reached
only from the tick above, and every collaborator under it is named on the owner that
defines it
run_requests.py agent invocation requests, stable logical-round fingerprints, launch identities, and
optional runner arguments; prompt text is excluded so rebuilding a prompt cannot buy a
second charge
run_reporting.py agent-exit audit and analytics records, configured-model fallback, and triggered-skill
emissions; a failure to emit those skill records cannot discard a completed agent result
issue_usage.py historical per-issue usage counters and their terminal receipt; unknown and estimated costs
remain distinct from known prices and from the separate launch allowance
usage.py the tracked agent invocation: charge the required issue budget, emit spawn, call the runner,
record its exit and skills, and return the result for the stage to settle
late_split/ the late size gate's own domain: what one generation IS, apart from anything that drives
one
formats.py what any late value has to look like -- a real integer, a git object id, a bounded
single-line value, where one line is asked as the split every reader on the far side
breaks on rather than as a search for one character -- the reducer that shapes a raw
diagnostic into what that last predicate accepts, so the one free-text field a record
carries is bounded by the rule that guards it, and the one refusal every owner raises
over any of them
phases.py durable phase vocabulary and the in-flight, settled-split, and pre-transaction boundaries
models.py verdict and failure vocabularies, and the frozen generation's measurement, bounded
lineage, ordered child register, and lifecycle; immutable updates preserve cancellation
provenance and prevent rewinding an in-flight transaction
obligations.py resource kinds, states, and entries, with frozen resource and consumer ledgers; keyed
updates are idempotent, and opaque ledgers refuse updates that a write would discard
publication.py frozen publication context with validated entry and a fail-closed completeness predicate;
the marker, source stage, pull request number, and head are one reconciliation claim, and
the auto-rebase replay a generation took over rides beside them as provenance, answered
only for the exact candidate it names (`replayed_as`)
identity.py the monotonic cycle and generation identities, the child depth the bound still allows,
the two local content fingerprints a scope edit and a trusted answer are told apart by,
and the bounded name-free print one ledger entry is reported under
payloads.py what one hand-edited or older pinned late field reads back as: one reader per field
contract -- identity, count, depth, object id, literal flag, member, free text
ledgers.py what the two external ledgers read back as, the exact entry shape one of ours has, the
verbatim copy anything else is preserved through, and the all-or-nothing reading of the
ordered child register, whose entries are positional and so may not be skipped past
keys.py the `late_*` pinned keys one GENERATION owns -- the frozen evidence, the misses a
reading of it lost and the step a notice about it named, the publication provenance,
the ledgers, the hold's route bookkeeping, and the cancellation and
pending-owner-check markers -- spelled once, as the tuple a clear is defined as
dropping exactly
encoding.py what each of those fields is spelled as on the way out: the wire string a vocabulary
member is recorded under, the empty value every field names itself by and is dropped
at (a lineage depth of 0 excepted, since that is a root), and the publication group a
pre-publication entry writes none of
ledger_encoding.py what the two external ledgers are written back as: the verbatim copy that outranks the
typed view wherever the reader could not type the whole of one, and the only fields a
record with no identity still records
state.py the round trip over the generation's own group, which leaves a legacy comment untouched
and an unreadable obligation intact: the fail-closed read, the write that drops every key
first and supersedes the retirement correlation on an identity, the clear defined as
that group and nothing else, the all-or-nothing read and write of the hold's route
bookkeeping, and the one key a replay takeover stages alone (`record_replay_takeover`),
leaving every field it was proved against as written
spends.py the vocabulary that bounds a restored spend: every field a route may close, paired with
what that field may be set TO, since what comes back is applied to the pinned comment
and then read by the owner that knows what it is -- the rounds, the cleared bookmarks
and settled heads, and the one MARK a record may put up, which may only ever be raised,
since what takes one down is the route that reads it
endings.py what a cycle's ending leaves behind past the write that clears it, both records
deliberately outside the group a cleared generation drops -- three keys between them:
the cycle a retirement dropped, and the two-phase terminal record beside it -- the
decision naming the cycle a `rejected` is owed for, and the proof that one landed on
the issue, which together are the only durable evidence that the label an operator
removes to authorize a restart was ever applied, and which an attempt alone is not
ancestry.py frozen inherited ancestry, snapshot transforms, child and release receipt markers, and
the body reader that recovers a child's claimed lineage when its pinned write was lost
lineage.py durable inherited fields, fail-closed snapshot reads, and parent corroboration; keys and
write omission rules preserve ancestry after the child's own generation is retired
entitlement.py what a late record proves its own split made -- children proved only by the register or a
consumer or child entry, never by a phase; a snapshot entry, an unreadable ledger, or the
links announcement alone is ambiguous, and a child that is no other issue is invalid --
and the snapshot a replacement child could be pointed at: a proved split's own ref while
the ledger names it exactly once and `retained`, else, for an issue that never split, the
ancestry's pointer where it is the ref that ancestry's identity mints -- and, for a proved
split that entitles nothing, whether that is settled (its own ref's one entry passed to a
reclamation) or a ledger that cannot say whether the ref is held (unreadable, closed to a
new consumer, held under no identity of its own after a retirement, never proved, recorded
twice, or missing), which refuses a replacement
provenance.py the read-only decision of which late lineage an ordinary decomposition's children inherit,
asked by `stages/decomposition/replacement_lineage.py` before a split creates, finalizes, or
releases any: none for an issue no late split charged; otherwise the root, the depth already
charged, and the entitlement above -- or a refusal when an unparsed comment, an ancestry
field its reader would drop or a `null` one, a body receipt with no ancestry, a late
identity or split-evidence field its reader would drop, a live cycle missing its root,
issue, or depth, a cycle gone beside other fields, a split in flight or cancelled in flight,
an invalid or ambiguous split, a record rooted elsewhere than its ancestry, or a split at
another depth leaves the depth unproven, never read as a fresh root at 0
exemption_reading.py exact-commit exemption reads, their key groups, and whole semantic identities; a transferable
identity requires the frozen pair, matching exempt candidate, digest, and supported format,
while a claimed but unreadable group stays distinct from no record
exemption.py exemption and semantic-identity writes outside the generation's lifetime; moving the exempt
commit drops its old identity, and writing the same commit retains the identity it earned
rewrite_values.py persisted rewrite kinds, phases, and proof vocabulary, frozen authorization values, and the
valid kind/stage pairs; automatic rebases use the state graph's base-refresh stage set
rewrite_fields.py rewrite keys and wire shapes, bounded field reads, and validated encodings; the phase chooses
whether the accepted or rewritten commit binds the group to the exemption
rewrite_reading.py rewrite claims, whole authorizations, outstanding permissions, and pending reporting proofs;
unreadable claims cannot be replaced as though no authorization were recorded
rewrites.py rewrite grants before a push and publication rotation after one; the exemption, identity,
operator authorization, phase, and reporting proof are staged together for the caller's
settlement write, and only a readable outstanding grant may be spent
overrides.py the one oversized candidate an OPERATOR authorized to publish as it stands, bound to the
exact candidate SHA a human read: the frozen base it was read over, the canonical digest of
the contribution between them and the scheme that digest was taken under, the measurement
that made it oversized -- the additions counted and the ceiling they were counted against,
both recorded here rather than referred to, since the generation carrying them is cleared
and the ceiling is a knob an operator retunes -- and the trusted comment the authorization
was made in, which is what makes a bypass of the size gate attributable to one gesture at
one address. Deliberately outside the group a cleared generation drops, on the same terms as
the exemption: it is what a generation is cleared AGAINST. Read whole or not at all and more
strictly than that exemption, since here every member IS the authorization -- a missing or
damaged member, a digest scheme this build does not compute, a comment that is no identity,
and a reading at or under its own threshold, which describes a candidate the gate publishes
untouched, each authorize nothing, and what that costs is the measurement the gate would
have taken anyway. The write refuses the same terms rather than recording them and replaces
the whole group in one statement, so a record is never half about one candidate and half
about another; every other field on the pinned comment, an unknown one and a legacy
exemption group included, is left verbatim by both the write and the clear. What the
gate reads it FOR is the half of a bypass the exemption is not, so it moves with that
exemption: `carry_publication_override` re-points the pair onto the commit a workflow
rewrite produced -- the candidate and the base, and no other term, since the size, the
ceiling and the comment are what a human decided and the digest already describes the
rewritten pair -- while a comment with no readable authorization on it, and one about
some other commit, are each left exactly as found. The terms a caller offers answer for
themselves through `unusable_terms`, so a caller that has not decided to record yet
gets the same refusal the write would have raised
collapses.py the three terms a squash says it is about to replace, written before the reset that
destroys them and deliberately outside the group a cleared generation drops: the head
being replaced -- the rollback target, and the head the force-push behind it is leased
against -- the base it is rewritten over, and how many commits go in, which is the one
fact no reading past the rewrite could recover, what the walk proving the record is
held to, and what the handoff's notice is worded from. The wire names are a
compatibility contract live issues already carry, so one record covers every rewrite
this workflow makes: a collapse of several commits, and the subject rewrite of a
one-commit branch, which records a count of one and is the shape whose interruption
the branch itself cannot show at all. Read whole or not at all, so a missing member,
an end that is not a whole object id, and a count no squash replaces -- zero replaces
nothing -- each read back as no pending collapse, while
CARRYING one of those is a separate question the recovery has to ask, since a comment
claiming a rewrite it cannot produce describes a branch that reads as having nothing
left to do. What ENDS one is here too, and the write that does hands what it leaves
to `handoffs` beside it: the claim goes first and its successor is staged second, so
no comment a write could land from carries both -- a reader finding the pair would be
told a rewrite is outstanding over a branch already published, and refuse to resume
over it
handoffs.py the commit the relabel behind a finished collapse is still owed over,
`late_collapse_handoff_sha`: what the write that ends the claim leaves in its place,
since the relabel is a second call and an issue left on `validating` with the record
simply dropped is one the next tick runs a second reviewer on. Deliberately no member
of the collapse group and outside the one a cleared generation drops on the same
terms -- nothing about the rewrite is outstanding by then, so it freezes nothing and
refuses nothing -- and read for a usable value rather than for presence: a whole
object id at its exact length, since what it is spent on is a comparison against the
head the pull request stands on and an issue with no pull request to read has nothing
else between a value no commit could equal and a label moved past the reviewer. Such
a value is dropped rather than refused on the way in as well, the opposite of what
the claim it succeeds does with one: this write is taken past the push and past the
notice, where nothing is left to call off, so the worst it costs is that saved round.
One the relabel LANDED over is ended by `documenting`, which is the only owner that
can: having the issue is the proof that move happened, and the label history cannot
tell a move that never did from one a drift unwind later reversed
restart.py the two-phase restart marker: the closed pair of labels it may apply, the cycle it
mints, the whole-marker check that decides whether the one a crash left may still be
believed, the settled-ledger precondition retirement refuses without, and the fresh
cycle it projects
events.py the eight families, the per-family schema an event is refused against, the member each
detail has to actually be, the member each companion field has to sit BESIDE -- the
verdict a child count belongs to, and the one failure a measurement step and its line
belong to, since a field allowed beside every member describes none of them -- the
closed vocabulary a verdict category is chosen from, and the two the failure family
adds for a refused size reading, with the one constructor every seam that measures
builds them through, which drops the line with the step and reduces what survives,
since a refusal here would cost the only record of a reading that never happened
validation.py what a generation has to prove before a record of it may be written: the required
identity, the format of every field a sink would carry, the publication a marker has to
still be able to name, and what each family's own record has to be readable without
records.py the bounded payload both sinks carry -- including the closed pair every family's record
says which side of publication it was entered on under, the frozen context only the
marked half carries, and the refused reading's own step and line, the one free text on
a late record -- and the fields a duplicate record is deduplicated on
telemetry.py the dual audit / analytics emission, the stage tag resolved against the label
vocabulary, the refusal turned into a logged non-emission, and the guard on each half
that keeps a sink from reaching workflow
stages/
conflicts/ `workflow:resolving_conflict`
handler.py the order one tick asks its questions in: the missing-`pr_number` park, the terminal
arcs, and the rebase road behind them -- which owns the two dev resumes as well, since
deciding either needs the branch fetched and the checkout compared to it
routing.py the one reading every road runs behind -- the worktree restored, the branch fetched, the
checkout compared to it -- and everything that reading can report that is not a rebase:
a round the size gate held and an adjudication has since published, a behind-base
divergence, a body edit or a human reply the dev is resumed on, a report a resume
saved about the head the pull request carries (settled behind the edit, ahead of the
reply wait and the cap), and commits a crashed tick never pushed. Both resumes sit behind
the divergence guard, since what either
starts is an agent whose commit this stage force-pushes and no lease catches a push made
from a checkout the remote has moved past -- the tip it is pinned to is the tip the
resume read. Only the BODY EDIT also defers over a checkout ahead of its remote: it
leases against the head the round began at, a local commit the remote never saw, which
the gate then refuses as somebody else's movement, while a reply's publication freezes
the pull request's own head and carries the unpublished commit out with the resolution.
It defers by falling THROUGH to the reply rather than ending the tick, since the drift
hash covers the thread too and so every reply reaches the routing looking like an edit.
The published round is settled ahead of both. The `MAX_CONFLICT_ROUNDS` cap comes after
all of it, in front of the REBASE alone: what it refuses is another ATTEMPT, and every
reconciliation above it is work already done that only this stage can still finish. A
park left by a reading rather than a question is retried rather than waited on, and
announced once per reason
guards.py the worktree restore and the two probes that prove a stale PR head is safe to
force-publish over
divergence.py admission over a stale orchestrator-produced head, a recorded replay, or the publication a
body edit's resume recorded with the report it still owes, and recovered
publication through the size gate under the original lease; the behind-base count decides
whether the push finishes a round or precedes another rebase, and a landed push that
precedes one records its report debt at once, since that rebase may end without a tail,
having handed the gate its head so a later tick can record the debt after a crash or a
hold
recovery_guards.py recovery parks for an unreadable candidate, unpinned remote tip, or dirty/unreadable checkout;
each refusal retains the recovered work and the exact reason a later tick retries; and
the refusal of a recovered push no report would describe -- committed work the issue
owes a report nobody recorded, a head other than the commit a saved report describes, or
any push ahead of the settlement of a report already bound, which the review hold's
settling half is asked first and which parks where the checkout cannot vouch for it
rebase.py the branch and base fetches, the pre-rebase head every exit of the round leases its
push against -- refused when nothing could read it, since the gate reads no head as a
caller that established none and pins the push to whatever the pull request has moved
to -- the fork point that head's contribution is read over, taken in the same breath
since the replay destroys it and made DURABLE before the rebase runs, the rebase, its
`merge_attempt` event, and the three-way disposition -- none of it while a report this
issue recorded is still unsettled, since settled after the rebase it would be bound to
the head the rebase left. The `MAX_CONFLICT_ROUNDS` cap is asked here, behind that
settlement, and so is the earlier settlement of a saved report over a placed branch
publication.py the unproven-tree and unreadable-head parks, the no-op flip, the rebased-head push
(measured by the size gate first, since a base that moved changes what the branch adds
to it, handed the pair the replay replaced beside it, and stamping the commit that
replay produced onto the durable record before the gate is entered), and the hand-off
of real conflicts to the dev -- which presents no such pair, since a resolution an
agent authored is content somebody wrote rather than a replay of content somebody
ruled on. Both parks are the same refusal read one step apart: a status that
established nothing names no paths and a head that would not resolve reads as the head
this stage started on, so taken as absences they hand a reviewer a tree nobody read or
a rewritten head the pull request never received
evidence.py live and recovered rewrite evidence: the replayed input pair and the new fork point;
recovery requires the recorded publication, original lease, and produced commit to agree.
Beside it, the proof that a diverged branch is the publication a body edit's resume
recorded, while its report is still owed -- no rewrite evidence, only the force-push
resume_records.py the publication a body edit's resume owes -- the head its push is leased against, the
commit it sends, and the pull request -- staged with the report it returned so that
report's guarded commit, or the park taken instead, lands it; read by the proof above,
and read only while that report is unbound -- so no settlement of an older transaction
retires it, and the tail that counts the round drops it only where no unbound report is
about it, leaving it standing for the refusal behind a lost relabel; the base refresh
opening the next episode drops what is left. While that report is unbound it refuses
any other head -- the one a recovered push would send, or the one a binding would take --
parking for the report the branch as it stands is owed and keeping the record. A run
that commits nothing and reports names the head the pull request carries as both ends of
it, over any earlier candidate, through that report's own guarded commit. A report
whose run left a head nothing could read is refused before it is recorded, its work
marked undescribed and the issue parked, since no record could hold it to a commit
replay_records.py two-step replay persistence, before rebase and before publication; whole-commit reads and
the original publication identity keep a stale or unfinished record from proving a push
resume.py the three dev-resume entry points, the shared run, and the `/orchestrator continue`
classification. The body edit quotes one frozen read of the issue thread and settles
that record -- the comments and the requirements revision alike -- once the run is back
and only for an outcome that reached an agent; it reads no pull-request surface, so
none of their cursors moves. Each of the three can end in a commit this stage publishes onto a
pull request the remote already carries, so each passes the size gate -- the fresh
conflict and the reply behind it through the shared conflict disposition, the body edit
through `resume_reports` -- and each names the round it would have counted,
since a held candidate ends the tick on the adjudication and no later tick of this stage
counts one. A reply over a park that left a report owed, asked before the run, goes
through `resume_reports` too rather than the conflict disposition, resumed on the frozen
drift prompt as the edit's own resume is and leased against the head the pull request
stood on before the run. This orchestrator's own notices, by the id ledger, are no
reply, so a park whose notice stands above the watermark waits for a human
resume_reports.py the developer report a body edit's resume returns, carried into the report transaction:
the shared drift disposition named with this stage's route and the revision the resume
was handed, the report recorded ahead of the size gate, a pushed answer counted and
relabelled through the shared tail as `drift_resolved` before the report is bound to
the receipt's head and settled, and a report with no commit recorded for the head the
pull request carries and settled with the issue left here. The publication goes down
beside the report (`resume_records`) before anything pushes. The reply to a park that
left a report owed takes the same road under the lease its caller proved, so the commit
the first run left -- a rebase past the pull request's head included -- is published
under the report the reply wrote rather than pushed undescribed with that report parked
as a question; that report is stamped with the frozen drift prompt's record -- the issue
and conversation the run was handed, through a rotated session's fresh spawn too, which
is re-grounded on the same frozen text -- and that record is settled. Either run left
with the rebase mid-flight parks before anything is recorded or pushed, a timeout read
ahead of that as the funnel reads it, and a report from a run that left a command
running parks as the execution failure it is, recorded nowhere; one that commits
nothing and reports names the
head it is about in place of an earlier candidate in the write that saves its report,
for its settlement to spend. And ahead of
any rebase, a report this issue recorded and has not settled is settled first, through the
validating hold's own settling half, so it is never bound to a head a rewrite left
outcomes.py the interrupt / timeout / mid-rebase parks read before HEAD -- the mid-rebase one asked
by the report-carrying road too, behind its own timeout reading, and a timeout, a
mid-rebase stop, or a resolution over a tree not proved clean an account quota caused
taken as the session limit through the shared question park instead, which a bare
continue retries -- and the push a completed
resolution earns -- measured by the size gate first, since a resolution grows the pull
request like any other candidate, and pinned by the pre-rebase head this stage read
parks.py park notices, durable reasons, and the predicate that preserves a human question through
transient refusals; unreadable-head and unreadable-worktree parks are shared by callers,
beside the park a proved rewrite's report debt with no room on the comment is held under
transitions.py held-round receipt reads and writes, exact-head recovery, round increments, and handoff to
validation; a settled receipt is cleared only by the tail that pays it. The outcomes of
the three rounds that rewrite the head -- a clean rebase, an agent resolution, a
recovered push -- are named here, and the tail records their report debt before the
relabel, on the pushing tick and on the settled round a crash or a hold left alike; the
settled-round reader makes a move a counted round still owes first, then records a
published preamble head's debt before anything else. The tail drops a body edit's
recorded publication with the receipt
handoff.py the move a counted round owes `validating`: the count written with the head it hands
on, ahead of the round's audit event and the relabel, and that claim dropped in a write
behind it -- or, where that write was lost, by `validating` before anything else -- so a
count write that never landed reports nothing twice and a relabel that
never landed is made by the next tick standing on that head without counting again, a
head nothing could prove holding the tick with the claim kept rather than dropping it --
and the proof that a checkout stands on a recorded commit, which the settled-round
reader asks too
report_debt.py the report debt a head this stage rewrote is owed, read off the code-publication receipt
the push left -- the commit it names, the pinned pull request, and the head it replaced --
and carried through the debt owner's retargeting; a receipt short of any of those records
none, and the write that records one goes out ahead of the relabel to validation. A
recovered push ahead of a rebase finishes no round, so it hands the gate its head as a
spend instead, and the next tick records that head's debt once the receipt names it and
the pull request still stands on it. A proved debt the comment has no room for
(`engine/report_rewrite_room.py`) holds the handoff behind a park no reply answers, and
every later tick tries the write first
models.py frozen conflict context, checkout and resume results, live replay pairs, and recorded replay
values handed between the stage's owners; a body-edit resume's result carries the
delivery record its prompt was cut from, since the thread moves while an agent is out
and a mark taken off the one it returns to crosses replies nobody delivered -- the
reply that finishes a report-owed park carrying the same record; the parked reply names
the commands a retry spent, which that record's read leaves out, and the last comment it
holds, which only the resolution road marks read ahead of its run
state.py the counter keys they share, the single settled pair one held round at a time is named
by, the preamble head a recovered push ahead of a rebase leaves for its report debt, and
the `conflict_replay_*` group a rebase writes about itself -- both ends of what it
replaced, the commit it produced, and the publication it was made against -- for the
tick that may have to publish it; beside it the `conflict_resume_*` group a body edit's
resume writes about its own publication, and the handed head a counted round leaves
until its relabel is behind it
decomposition/ `workflow:decomposing`, `workflow:ready`, `workflow:blocked`, and `workflow:umbrella`
run.py one `decomposing` tick: the retry-cap notice a stranded park still owes replayed at
entry, the late route asked before anything else after it, the spent-budget park held
behind that and ahead of every road that would walk past one, the drift / recovery /
kill-switch order before the agent, and the pause, dirty-worktree, and interruption
checks after it
retry_cap.py the standing spent-budget park an initial decomposition meets: the hold that ends the
tick having written, spawned, and said nothing -- so the manifest, the children, the
locked session, the pull request, and the late record stay as they were -- the refusal
it still records, the sentence it waits to have said before any thread is read for an
answer, and the trusted `/orchestrator continue` that retires the session and renews the
budget for exactly one spawn, written down before the spawn it pays for
handoff.py the two ways this label hands an issue to implementation -- the kill switch and a
candidate the size gate settled, the latter releasing the hold and moving
`pr_number` onto the pull request the measured commit is on first -- and the re-read
the inline handler is given
session.py the locked decomposer session: the spec read, the fresh spawn that pins it -- gated
and parked by `engine/retry_budget.py`'s own parking form -- the
human-reply resume, and the retirement the drift reset and the continuation both take
-- the id dropped and the spec kept, since a spawn records an id only where the backend
hands one back and the resume after one that did not would replay the conversation the
issue was moved on from
drift.py what a body edit resets on an issue already wearing this label: the orphan notice said
before the new baseline is recorded, the manifest markers wiped in one step -- children,
dep graph, expected count, the seal that calls that count final, the split attempt its
children's receipts name, the umbrella flag, and the park flags -- and the session
retired through the owner above, so the tick falls through and re-derives a manifest
against the updated body instead of relabelling and returning the way the
pre-implementation routes do; a late split's generation is not manifest tracking and
survives it whole, so its orphaned children stay the snapshot's recorded consumers, and
the children a discarded replacement split may have pointed at that ref -- an unrecorded
one found by its receipt included -- are written onto its ledger first
manifest.py the fenced-block envelope rules both modes are held to, the JSON decode, and the parse entry
point the stage routes on
child_validation.py child text and dependency shapes; dependency indices must be real integers naming another
child in this manifest, and every malformed field is refused before graph traversal
validation.py bounded nonempty child envelopes, umbrella flags, and graph acyclicity after child validation
outcomes.py the live-pause and timeout settlement before the worktree check, and the three manifest
dispositions after it: the unparsed park, the `single` finalize, and the `split` hand-off
replacement_lineage.py
the late lineage an ordinary split seeds its children with, off the `late_split/` provenance
decision: one level below the parent under the same root and never past `MAX_LINEAGE_DEPTH`,
correlated by the parent's own cycle (else its ancestry's, else the retired one), and
pointed only at the snapshot the parent's own split holds, once its consumer ledger records
the child -- the seed carries the pointer only behind that write, and the reuse instructions
appended to its body name that ref and this repository's mirror of it, the only names the
child's text may give it; a parent at the bound, an unprovable record, one naming no cycle,
or one whose own snapshot is neither held nor released -- or is held with no recorded base
for the instructions to name its change from -- parks `replacement_lineage_unproved`
instead; the `SeedRepair` the recovery and the release make of each recorded child, an
ordinary split's included -- an unparsed comment, a link to anything but this issue's
number, or a title or body naming a snapshot ref the split cannot keep refused (any ref,
for a split that keeps none); while the split still holds its snapshot every recorded child
owed its pointer, read off the parent's record and not the child's text, so a lost consumer
slot is recorded again and a missing or foreign pointer seeded; once the snapshot has passed
to a reclamation a pointer dropped with its stamp; the owed group left as it is, and any
other group refused (every group, on a child owed none), with nothing written over it
split_receipts.py the hidden receipt every ordinary split child's body carries after its slice -- the parent,
the split's freshly minted `split_attempt`, the slice, and the late lineage the split owes
the child, or none -- the reader of the last whole one in a body, which governs, and the
recovery's adoption of the one child a crash can leave unrecorded: the only issue carrying
the next slice's receipt, unrecorded, open, birth-labelled, and ending on it, recorded on
the parent and, in the same write, on the consumer ledger the parent's lineage points at --
or named for the park; a parent naming no attempt this binary minted has none
split_seeds.py the lineage a body's last whole receipt says its split owed (`owed_by`); the hold the
dispatcher puts, ahead of a live adjudication's step aside and the reuse guard, on a child
this orchestrator opened whose seed is not what that receipt owes -- link, whole bounded
lineage, a whole pointer only at that split's snapshot -- parked once, or held with nothing
written on a comment that will not parse; the seed a restart keeps; and the check recovery
and release make that a recorded child's receipt is the one stamped for its slot
child_claims.py the writer claim a parent's handler takes on a child before writing it -- one child, or
all a release walk would start at once -- keyed on the client's rename-proof `repo_id` as
the dispatch claim is, and logged when refused; each caller answers a refusal as it
answers a child it may not act on yet
child_creation.py ordinary child creation, parent receipts, and pinned-state seeding; each created child is
recorded on its parent -- and on the snapshot's consumer ledger where its lineage owes it
a pointer -- in one write before it is seeded, under the child's own writer claim, with
its parent link, creation stamp, and that lineage, never with the parent's measurement,
exemption, or authorization, added to the record the child carries by then and lifting the
park its missing seed earned -- the seed completion recovery's repair writes too; a child
another poller holds is left unseeded on the plan for the recovery, and a failed create
or seed write parks the parent for repair
split.py decide the children's lineage and park an unprovable one before any marker -- or a slice
naming a snapshot ref its child would not be kept -- stamp each child's receipt and
append the snapshot's reuse instructions to the body of each child owed it, then persist
the expected count, the umbrella flag, the attempt, and the whole dependency graph in one
write, create the planned children, and publish the summary (`split_summary.py`) and
parent label before activating children without dependencies through `activation.py`'s
walk -- or, where a child was left unseeded because another poller held it, publish
none of them and leave the parent `decomposing` with every child recorded for
`recovery.py` to seed that child and finalize
split_summary.py the summary an ordinary split finalizes its parent with, ending on a receipt naming the
parent and `split_attempt`, which a recovery posts only where no comment of ours carries it
-- so a refused post is retried and a landed one is not posted again behind a failed label
write -- and not at all for a split recorded with no attempt; the `blocked` or `umbrella`
label the manifest asked the parent to wait under
recovery.py what a tick that died mid-split -- or a split that met a held child -- left behind: the
stale-manifest markers, the adoption of a child created and never recorded through
`split_receipts.py`, the orphan-child repair -- the parent link and the owed lineage, asked
of the parent's record again, a lost consumer slot restored ahead of its seed, the park the
missing seed earned lifted in the write that seeds it, and parked rather than finalized
where it no longer proves one or a child is not one the split can recognize as its own --
any child whose text names a snapshot the split cannot keep, or whose receipt is not the one
stamped for its slot, included -- the summary `split_summary.py` still owes ahead of the
finalize, the incomplete park, and the two owners that hold those markers instead -- a human
the issue is parked awaiting, and the late transaction while its generation is live; each
child is repaired under its own writer claim, and one another poller holds stops the
recovery with no park, short of the summary and the finalize, for the next tick to resume
split_repair.py the seed write of that repair onto one recorded child, inside the hold `recovery.py` takes
parents.py the fresh child scan -- fresh as of its read, which another poller can outlive -- the
rejected and manually-closed parks it earns -- published apart from the scan, since one
caller settles its ledger on the way out of them, and a closed child's merge finalize taken
under that child's writer claim off the child read again behind it, a held one counted
neither done nor closed by hand -- and the parent's own drift reroute, which first writes
the children it drops onto the ledger
activation.py the dep-graph walk that releases the next children, the child it passes over because GitHub
reports it closed or the scan holds no issue for it, the latch asked before EVERY relabel --
a relabel is a request, so a close observed after the first child was released may not
release the second -- the pull request a late split superseded these children out from under
asked in the same place and off this parent's own record, so a caller cannot answer it a
child scan too early and a parent that never entered the gate pays nothing, that ask itself
a request and so the latch taken on BOTH sides of it, the one behind having nothing between
it and the relabel, the ordinary split's lineage and snapshot proved again in front of any
walk over its children, and every child the walk would release held to the recovery's
recognition before the first is relabelled -- its parent link, the whole seed, a pointer the
parent's ledger still keeps, text naming no other ref, a receipt that is the one stamped
for its slot -- parking the parent, once, rather
than releasing any child under a record that changed; the same walk, over the same fresh
child scan and behind the same rejected and manually-closed parks, the split's own
same-tick release runs; every child it would release claimed for writing and read again
before the first is vouched for, and vouched for and relabelled off that reading -- one
held by another poller, unreadable, or no longer open and `blocked` releasing none and
parking nothing; and the held-dependency line it logs
blocked.py the `workflow:blocked` poll and the `workflow:ready` handoff to implementing with its
consumed-comment ratchet; a parent whose children all resolved settles what a late split
still owes the remote before it goes back to its own work, and waits on `blocked` while a
recorded consumer keeps a ref, its consumer list cannot be read, or a damaged record
still carries a ledger; settled, it
drops the split attempt and retires the split's late cycle -- candidate, register, and
identity, both ledgers kept -- in a write of its own inside the umbrella terminal's
retirement window before the flip, so its implementation starts a cycle of its own; with
no cycle to retire, the attempt is dropped in a write of its own ahead of the flip
umbrella_terminal.py resolution text, usage totals, and cycle/generation receipts for published late splits;
retire the live cycle while retaining its obligations, then label done and close; the
same retirement is the one a `blocked` parent's hand-back to its own work writes
umbrella.py the `workflow:umbrella` poll and barriers around child activation, cleanup, and completion;
require settled obligations and publication before retirement, and restore a cancelled
cycle when a close is observed inside the retirement window, a `blocked` parent's
hand-back included; its scan of the tracked
manifest is handed to cleanup, which proves a held snapshot against the recorded consumers
late_coordinator.py the late mode's order: admission, park retirement, content settlement, then reuse
a recorded answer -- never while a reply is still owed a whole quote -- or buy one fresh
adjudication; only the completion guard can hand a cleared split to the transaction
late_admission.py recover owed owner reads and park notices before the live-generation gate;
hold a spent-budget park ahead of the frozen-evidence proof and pull-request hold;
the explicit live-generation predicate leaves initial decomposition to its own gate
late_evidence.py prove the record belongs to this issue and carries every frozen field its readers need,
then prove both commits on this host before a pull-request hold or agent spawn; a
failed proof parks with the recorded candidate left for the operator to restore; the
post-run check also refuses a moved head or a tree no longer proved clean
late_attempt.py the durable attempt identity and the retry accounting its pre-spawn write omits;
both close-latch checks restore the unspent counters before cancellation can write,
so a run declined by shutdown or a live pause costs the issue nothing
late_execution.py spend the shared retry budget and start one admitted adjudication, checking the close latch
around its durable attempt record
late_completion.py account usage, refuse unstarted, timed-out, interrupted, or mutated-candidate answers,
and record the session and verdict; re-read the owner for every completed or reused answer
before settlement, handing only a guarded split to the transaction; none of its
refusals repays the owed replies a run was quoted, which only a recorded verdict does
late_retry_cap.py the same standing park on the adjudication's own road: the gate its fresh spawn is
charged to, the refusal staged through this mode's park owner so the generation,
the frozen pair, and the hold on the pull request the candidate stands under all ride
the one write, the hold asked ahead of the evidence probe and the content settlement
so a held tick writes, spawns, and says nothing, the sentence it waits to have said
before any thread is read for an answer -- on either owner's field, since a park the
shared parking form took under this label owes its own and is said by the stage-entry
replay -- and the trusted `/orchestrator continue` that
renews the budget for exactly one adjudication -- written down before the spawn it
pays for, and needing no session retirement of its own, since the pre-spawn record
opens a fresh conversation for every run that is not answering a question. The grant
cuts its batch from one reading of the title, body, and thread and consumes that
reading whole -- words beside the command are owed the adjudicator it buys, and a first
late baseline still to be taken is taken over what the issue-wide one covers -- unless
it shows drift, withholds guidance, or is not covered at all, where only the shared
watermark moves
late_run_reading.py read the pinned role, locked spec, session, source pair, and validated verdict payload,
with a rationale only beside a `single` or `split` and within its bound, absent otherwise;
recover adjudications and resume only a session bound to this candidate generation
late_result_payloads.py
encode verdicts, bounded rationales, and child estimates, and measure the actual
serialized pinned payload against the whole-comment budget with notice headroom
late_session.py persist spawn, bounded session, and result records and invoke the tracked adjudicator;
every discarded answer drops its publication override, and preflight reserves session room;
the conversation it is handed is `late_owed_replies`' excerpt-plus-quotes
late_owed_replies.py the trusted replies an adjudication still owes a whole quote: recorded by the question
answer and the retry-cap continue that consume them ahead of the spawn gates, quoted in
full after the bounded thread excerpt to every late run, and repaid only by a verdict
an adjudicator recorded over them or by the candidate a developer revision's
reconciliation re-measures off a run that neither timed out nor stopped before it worked
late_hold_text.py exact cycle-marked descriptions for unpublished, published, and superseded hold forms
late_hold_reading.py choose the held, published, or issue-recorded pull request, read it once, and require plan
provenance for the issue pointer; missing or unreadable evidence refuses the hold
late_hold_release.py restore only descriptions matching this cycle's hold, and release a stale hold before its
replacement is taken; an open pull request whose restoration failed keeps the handoff held
late_hold.py preserve the chosen pull request's identity, head, and body before applying its hold;
refuse unrecorded or displaced descriptions and report moved heads without restamping them
late_verdict.py what one finished reply decides: the lineage-bound refusal recorded as the categorized
question it actually is, the record written and persisted before anything is posted
and repaying, in that write, the owed replies it is the one answer taken over,
and the announcement a recorded question is reconciled by -- made past the owner
guard rather than beside the record, and suppressed where a park already stands. All
three sentences a read reply hands the issue back under are worded here -- the
unusable reply, the outcome too large to record, and the question itself -- since the
reason is a shared value this mode's park owner is read against and the sentence is
the failing step's own to say. Too large is asked of the COMMENT alone -- how an
explanation will render is never grounds to refuse the verdict carrying it, since that
park is superseded and the refusal would buy a second run and leave a `single` short of
the durable park a human's decision is owed on
late_outcome.py what every completion leaves on the record: the write that closes one by carrying the
owner read it now owes -- under `owner_check` unless a split transaction was
interrupted, whose boundary the record itself refuses to let any pre-split write
rewind, since the phase is all that says a loop was in flight when nothing is
recorded yet -- the answer a crashed tick reads back rather than paying an agent for
a second time, the session a timeout or a contaminated worktree pins before the issue
is handed back, the one record every ending hands its caller -- a decided one
travelling on the adjudication itself rather than on a re-read of the comment it was
written to -- and the three emissions each written straight after the state they
describe: a verdict, a typed late failure -- carrying the step and the line behind it
where the reading was a re-measurement, so a reading that did not happen reads alike
wherever it was taken -- and the cancellation an owner read earns
late_parks.py the decisions that take, stage, retire, or answer a late park: a pre-run park stages
its claim, persists it through `late_park_state`, and releases its notice through
`late_park_delivery`; a post-run park is staged with its result and released only
after the owner guard. A fresh attempt retires only the reasons it answers, while a
human's answer clears its own park and any sentence that park still owes
late_park_state.py the park reasons, pinned keys, standing-claim predicates, and shared generation write
every late writer uses. The consumed-comment watermark ratchets here so a spent reply
cannot become fresh feedback in a later stage, and every consumed content reading is
recorded here on all three baselines at once -- the late fingerprints, that watermark,
and `user_content_hash` from the hash the reading froze -- so the stage the issue
reaches next does not read answered guidance as an edit. A reading that still
withholds guidance a park's notice held back, handed on undelivered, moves the shared
watermark alone, so those words stay unread for the reading that hands them to an
agent. Repeated parks read both the flag and the owed notice, since a flag whose
comment failed has told nobody anything
late_park_delivery.py the release, redelivery, and reconciliation of a persisted park's notice. A delivered
comment is recognized on the thread when its settling write failed, so recovery
discharges the obligation without saying it twice. The shared spawn budget's
`retry_cap` keeps its delivery and reconciliation phases on the budget's own audit
stream. This owner reads state and notice owners directly and never calls back into
park decisions
late_notice_fences.py safe Markdown fencing for a whole recorded explanation; candidate fence caps preserve line
endings, split hostile closing runs into blocks, and select the shortest complete rendering
late_notice.py durable park notices, explanation insertion, comment-size fallbacks, and authenticated receipt
reads; the notice must still match the standing park, and a failed read leaves it owed
late_owner_reading.py fresh open/closed/unreadable owner readings, with the close-observation latch checked before
GitHub so a reopen cannot erase a close already observed during the worker's run -- one
that ends this cycle, a close held for a cycle restarted since asking GitHub instead
late_owner_settlement.py
persist cleared claims, cancellation, and unreadable-owner parks, and deduplicate recovery
follow-ups within the park episode before clearing its state
late_owner.py guard late outcomes and child activation, claim completion ahead of the owner reading,
reconcile pending checks, and release or discard staged parks after that reading settles
late_snapshot.py the immutable copy every child of a split is cut from: the ref this generation's
identity names, the obligation written ahead of the push and again behind the proof, the
create-or-verify that never overwrites, the fetch that proves a child could obtain it,
and the one park every refusal takes
late_child_content.py child scope, declared budgets, ancestry, immutable-snapshot reuse instructions -- rendered
off a pointed ancestry, so a protected replacement's body says the same -- the one reader
of every snapshot ref issue text names, each read
as the whole ref name git would take it for -- only wrapping closed on both sides, one
`+` opening the whole refspec, and a trailing full stop or slash taken off, a pattern's
`*` and a destination's own `+` kept, a refspec read as both its sides with wrapping that
closes after its destination wrapping the whole (the fetch the instructions quote), and a
mirror kept whole with the repository segment it was fetched for -- and exact slice
receipts; reserved markers in proposed scope are refused before publication
late_child_records.py retain the child walk, write each child on every parent ledger before seeding its ancestry
under the child's writer claim -- a held child parks the split as a failed seed would --
and seal a cancelled consumer ledger only once possible unrecorded children are accounted for
late_child_adoption.py
recover the exact issue for a resumed slice or create it after the close latch; ambiguous,
closed, or already-started receipt holders are refused without creating another child
late_children.py walk the manifest with a fresh owner check before each slice; record a created child before
checking closure again, and stop rather than seed or advance after cancellation
late_split_preparation.py
validate the manifest and ledgers before publishing a snapshot, prove that immutable
ref before creating any child, and return the durable children and ref together; an
owner close or an unprovable step leaves the transaction at the boundary it reached
late_retirement.py retire the generation with the umbrella label before activating children through
the shared guarded walk, then reconcile the recorded branch obligation; cleanup
failures remain on the ledger for the umbrella terminal to retry. The retirement write
carries the requirements baseline the last consumed reading recorded -- or, on an
issue with none, the reading the adjudication carried on over, kept as observed -- and
reads nothing
again, so the umbrella's first drift check does not orphan the children it was handed
late_split_notices.py forward links and cycle-bound supersession notices naming the snapshot and ordered children;
thread receipts recover announcements whose pinned writes were interrupted
late_supersession_state.py
persist reconciled or failed publication obligations and their parks before the split resumes
late_supersession_reading.py
prove the published head and this cycle's supersession still hold; moved, merged, or reopened
publications withhold child activation and reclamation
late_supersession.py release held descriptions and supersede the exact publication; re-read published work
immediately before closure and record completion only after its proof and effects succeed
late_transaction.py prepare the snapshot and children, announce the split, supersede its publication, and retire
onto the umbrella; owner and publication barriers surround every externally visible step,
including the branch reclamation left for cleanup when the supersession is undone
late_cleanup_state.py pass and reclamation values, obligation updates, and the shared close barrier that
persists cancellation once, for a close that ends this cycle, while retaining the current
generation and its debts
late_cleanup_reading.py
owed branches, held snapshots, opaque-ledger refusal, fresh consumer scans, and exact
generation-derived snapshot ownership; a consumer whose lookup, state, or labels cannot be
read retains its ref without failing the pass, and a recorded consumer the caller's scan
was not asked about -- an original a replaced manifest orphaned -- is read afresh rather
than taken from the manifest, while a replacement that manifest pointed at the ref is on
the ledger beside it and answered off that scan
late_cleanup_proof.py prove the complete consumer ledger from its recorded phase, count, or cancellation seal --
never while an ordinary replacement split of the same owner is short of its own count,
or records a replacement the ledger no longer names -- then require every
consumer to be freshly known closed before reclaiming its snapshot
late_branch_reclamation.py
delete only this issue's superseded branch and verify both local branch and checkout teardown;
either remote or local refusal leaves the obligation failed
late_consumer_release.py
deliver cycle-bound snapshot reclamation receipts once per child, checking closure around
every thread read and post, under the child's writer claim alongside this process's own
writer; an unreachable child, or one another poller holds, keeps delivery outstanding
late_snapshot_reclamation.py
persist reclamation intent, refresh the consumer proof, and delete the exact snapshot;
recover missing refs and interrupted receipts without recreating or repointing the ref
late_reclamation.py select owed work, apply close and publication barriers, and retain attempted and changed
entries separately so unchanged failures require no pinned-state rewrite; a held snapshot
is selected against the ledger's consumers, never the manifest the caller scanned
late_cleanup.py settle and report attempts, persist changed entries, and hold the umbrella terminal until
every obligation and the superseded publication settle; uncorrelated debts stay held, a bare
consumer list included, and a retired record with readable ledgers only on what it still
owes; the same settlement, and a consumer list it cannot read, gate a `blocked` parent's
return to its own implementation
late_reuse_reading.py snapshot reuse verdicts from the owner's reclamation receipt, corroborated ancestry,
trusted local mirror, and exact remote ref; unreadable evidence defers the dispatch
late_reuse.py hold or park the child before its label handler runs, distinguishing reclaimed and repointed
snapshots and repairing unseeded lineage from the evidence the child's body earns
late_sweep.py the cleanup-only pass over an owner a human closed mid-cycle -- reached by being closed
on `decomposing` or `umbrella`, where an adjudication runs, or on `ready` or `blocked`,
where a decomposition outcome that landed after the close can leave an ending nothing
else would find; never by the label alone: the one reading that says
whether there is a cycle to end, and the two readings that withhold everything but the
mark -- an issue open again between the poll and the refetch, and one an operator has
parked with `backlog` or `paused`. Being routed here at all says a close was observed,
so either leaves the mark behind and the rest to a later visit -- unless the reopened
record names a cycle the held close cannot be tied to: one other than the cycle it was
scoped to, which another poller settled and restarted from, or any cycle at all for a
close no read scoped and another poller has held the issue since; those are left
unmarked, while a closed owner scopes the held close to the record's cycle. What that
ending consists of is `late_cancellation`'s; what is here is the entry a closed issue has
no handler to give it -- the close a dead terminal left correlated on the record and
receipted on the thread, adopted before anything else is decided; and the one terminal it
writes itself, the `done` an umbrella recorded in the write that retired its cycle and a
crash took the label off, retried for as long as the remote refuses it because the owner
keeps the swept label until it lands; and a swept label put BACK on an owner still owing
the remote that a hand relabel moved outside all four, since after a restart the label is
the only thing that reaches a closed issue
late_cancellation_reading.py
outstanding cleanup and pull-request obligations, unprovable holds, and the combined
settled-ledger proof required before a cancelled cycle may end or restart
late_cancellation_state.py
persist cancellation before telemetry and reconstruct a retired cycle from retained
obligations and this issue's ancestry; already-cancelled generations remain unchanged
late_close_reading.py fresh owner and cycle readings, close-receipt markers, and the proof that cleanup ended;
a retirement in flight can still supply the cycle a concurrent close must name, and so can
a latch scoped to the cycle the record says a retirement dropped
late_close_observation.py
claim and post observed-close receipts, adopt them after a process restart -- the mark
written inside the scan claim, so a refused mark is walked for again -- and turn fresh or
latched closure into durable cancellation without letting a later reopen erase it; receipts
are confirmed by an issue read between two record reads naming the same cycle -- a record
that moved there binds nothing -- posted only for a cycle the held close ends and remembered
per cycle, scans are owed per cycle and again behind another poller's hold, a retired cycle
is adopted from a close scoped to it, and the dependency-walk barrier and poll guard end no
cycle restarted since the close -- the guard stopping the tick
late_cancellation_pr.py
release and close the held pull request with a cycle receipt, persist changed obligations,
report their outcome, and verify the publication again after cleanup
late_cancellation_cleanup.py
reconcile the held publication, adopt an unrecorded superseded branch, scan consumers,
settle cleanup, and discharge child receipts before the final publication proof
late_cancellation_terminal.py
record the owed rejected terminal, apply its label, and confirm it; recover confirmation
from the orchestrator's own label history so restart requires a terminal that really landed
late_cancellation.py route closed or reopened cancelled owners through the same cleanup and terminal rules;
hard-skip controls defer effects, and an ordinary handler never resumes a cancelled cycle
late_authorization_proof.py
recompute the frozen contribution for trusted consent and retained publication overrides;
every frozen term and the digest must still match before publishing unsplit
late_authorize.py consume trusted whole-comment oversized authorizations against the recorded single verdict;
record the override, clear the park, and consume its reading through `late_park_state` in
one write; refusals are receipted per reading, and an unreadable contribution leaves the
command unread; guidance the park's notice withheld outranks any command, resuming the
developer with it rather than publishing past it
late_unsplit.py the park a `single` hands the issue to a human under: the sentence naming the frozen
candidate, the reading that stopped it, the two replies that end it -- words that change
the work, and the command spelled out against this candidate -- and what the verdict
said stopped a split --
NAMED rather than copied, since a park nothing supersedes whose notice could not be
recorded beside the record it came from is one no later tick would ever say, and quoted
LAST and fenced, since an explanation opening an HTML comment would swallow the
instruction after it -- with the candidate, the generation, the publication it was
measured against, the hold, the session and the recorded verdict all left where they
were, and a park already standing rewritten by no tick
late_settlement.py what a guarded verdict earns: the announcement a question owes the issue, the split
passed on to the transaction that creates its children, the park beside it a
`single` earns where no operator has authorized one, and the ORDER a candidate an
operator HAS authorized is settled in -- the hold and the pull request reconciled first,
then the
exemption naming the measured commit written with the identity of what that commit
contributes and the commit a push is still owed for beside it, then the handoff --
with the latch asked between every one of those steps, and never a snapshot, since
an accepted candidate is superseded by nothing and publishes as itself. The identity
is fingerprinted over the frozen pair the adjudication was run against rather than
over a checkout that stayed writable throughout, and a reading nobody could take
leaves the exact exemption alone. A retry that finds its own push already landed owes
no push, only the code-publication receipt that push may have died before, written
against the head the verdict was measured over
late_reconcile.py the two reconciliations that order opens with, shared with the handoff of a candidate a
remeasurement put back under the ceiling: the hold RESTORED rather than rewritten, and
the pull request settled against the measured commit in any state -- searched for by
commit where nothing had published it, with a settled pointer dropped rather than handed
on, and where the verdict was taken PAST publication proved rather than searched for,
still open, and refused otherwise, since dropping the number there would push onto a
branch whose pull request a human settled and open a second one for a change
adjudicated against the first
late_proof.py where that publication has to be STANDING, and the refusal every unconfirmed
reconciliation takes: the head the reading was frozen at, or the accepted candidate
WHERE the approval, or the receipt read with the head it replaced, vouches for it --
which is the settlement's own push having landed before the tick died, and is finished
rather than refused (that same head on a fresh pass, ahead of both writes, is something
else's push and refuses with every other moved one)
late_verdict_push.py the push an authorized settlement of a candidate taken past publication makes --
what an adjudicator's own `single` earns is the park beside it -- made HERE because
this tick still holds the evidence -- named against the accepted commit and leased
to the head the reading was taken over -- plus the checkout proved on the road out,
since every stage the label hands the issue to works from it and one carrying loose
edits or an unmeasured descendant would reach a review, a squash, and a merge with
nobody having read it
late_replay_debt.py the report debt that push leaves where the candidate is an auto-rebase replay the
generation took over (`workflow/engine/rewrite_takeover.py`): proved by that ownership
and the code-publication receipt naming the replay over the frozen head on the frozen
pull request, recorded through `workflow/engine/report_rewrite_debt.py` -- retargeting a
standing claim as every rewrite does -- in a write of its own before the label, with the
reviewer's spent `review_round` put back to zero there as the rewrite finish puts it back,
and re-derived by a retry after a landed push without a second one; a proved claim with no
room parks `late_pr_unreconciled` with the push kept and the generation live, the park
measured first -- its flags, and its notice's ledger entry and watermark at the widest
id -- and nothing posted or written where it does not fit either
late_handback.py the effects a settled decision licenses, in the order a crash in them is safe in:
the push, the report debt a taken-over replay's push leaves, the label handed to the
stage the record names rather than to implementing -- a pre-publication candidate goes
back to the ordinary publication, and a taken-over replay to `validating`, where every
rebase this orchestrator publishes goes -- the accepted
notice, worded on the operator whose authorization is the only road here and quoting
the decomposer's rationale off the record through `late_notice`'s fencing, with a
display-only stand-in where the record holds none a reader can use, and the
retirement behind them answered by REINSTATING the cycle rather than
refusing, since past that write there is none left to end, with the write and that
barrier held inside the observations owner's retirement window so a poll reading the
record between them is not told there is nothing to end, and the cycle that
retirement dropped recorded outside the group the write clears, so a process that
dies before its own barrier leaves a receipt something can still be adopted against
late_publication.py the pull request a verdict taken PAST the first push was measured on, read once for
both roads out of the adjudication: a settlement publishes onto it and a `split` closes
it over a supersession, and neither may look it up -- the entry the gate froze names
it and the head it was standing on. One reading, because a fetched pull request is
lazy and the reads behind the lookup are what talk, so a caller guarding only the
lookup leaves them to raise out of a road whose every other refusal parks -- and a
caller's own receipt is read there too, since one that CLOSED the pull request itself
and died before the work behind that close was finished cannot tell its own close
from a human's by the state alone -- and the pull request those facts were read off
travels back with them, so a caller that has to ACT acts on what it proved rather
than on a second lookup a human can move something between; plus the question a
SETTLED split keeps asking, which three owners share: whether the pull request it
closed is still closed over the head it froze, published as the ASK rather than as a
fact and taken off the record every time it is put -- the generation for the
transaction and the reclamation, the pinned comment for the activation walk -- since
a step licensed by an answer the step in front of it took is one a human had time to
overtake, and since the retirement that hands the issue to `workflow:umbrella`
outlives neither the children still to be released nor the branch still to be
deleted
late_budget.py the declared addition-budget field and positive whole-line reader, plus fresh-reply bounds;
each proposed child needs a count strictly below the frozen ceiling, while legacy records
can still omit a budget
late_prompt.py the late-only prompt: the committed candidate, the frozen diff, the measurement, the
lineage, and the three outcomes with the bounds they are judged against and the two
field names they are answered under, read off the owners that read the reply -- the
human decision a `single` requires and the explanation it owes for it, the optional
rationale a `single` or a `split` keeps apart from that explanation, with the length the
record cuts it at read off `late_result_models`, the dependency-ordered slices and
dormant prerequisites a split has to consider before that answer, what every child body
owns, and the addition budget each child declares under this generation's own ceiling
-- the figure its own JSON template shows scaled to that ceiling, since a template is
copied verbatim and a standing one would be a child the reply contract refuses wherever
the ceiling is narrower than it
late_reply.py the late reply envelope and its three structured decisions; fresh split replies use the
shared child validator and budget bounds, and a single decision must explain why no safe
split exists before it can be presented for a human decision
late_content.py WHICH content the two late-local fingerprints are taken over -- the title and body, and
the trusted-thread run the ratcheting watermark covers -- what a comparison against a
recorded baseline says moved, and the floor a comment has to clear to be a REPLY rather
than conversation the issue was already carrying. What each reply past that floor IS
comes back from `late_content_replies` on the same walk, reported beside the bare
`/orchestrator continue` this owner reads for itself, since that one earns a flag and
no record; the digests themselves are the `late_split/identity` owner's. The title,
body, and thread are each read once, and that one reading also yields the issue-wide
`user_content_hash` under `engine/content_hash`'s own filter, operator commands
excluded, carried frozen on the signal so nothing arriving after the reading enters it
or splits it from the late fingerprint. The trusted guidance between the watermark and
the reply floor -- written before a park's notice, so no reply to it -- is reported as
withheld rather than dropped; this owner writes no pinned state
late_content_replies.py
which fresh reply is a requirement a developer may be resumed against, and which is the
whole-comment `/orchestrator authorize-oversized <commit>` that licenses a publication
past the size gate -- the last of those in a batch being the request, since a corrected
commit below a mistyped one is what a human who wrote both meant, and carried forward
with a malformed argument intact so the owner that refuses one has the command to
refuse. Neither that command nor a bare continue is guidance, because nothing hands an
agent a decision about the candidate that already exists as work to do, and nor is a
bare `/orchestrator add-agent-runs N`, which is the run-limit hold's to answer;
prose around any of them is guidance because none is the whole comment then. They are
recognized through `engine/messages` and `engine/run_grant_request` rather than re-read
here, and none is kept out of the digest the owner above takes -- a counted command
edited after the fact is exactly what that digest exists to catch
late_guidance.py initial content baselines, drift parks, and routing of trusted guidance or bare continues
over the same frozen candidate; a first baseline is taken over what `late_issue_baseline`
says the issue-wide one covers, routing what lies past it, and parks where nothing does --
and drift over the baseline that park took is asked of that owner again, so an edit taken
back retakes the baseline on the covered prefix and reads as the revert it is; a baseline
that counts what the issue-wide one does not cover is taken again the same way, and a
quiet reading the adjudication carries on over is recorded as observed
late_issue_baseline.py
the longest prefix of a reading that reproduces the recorded `user_content_hash` beside
the title and body as they now read (either hashing algorithm), which is all a first late
baseline may cover; None where no prefix does, which is drift, and the baseline that
drift parks on then counts no comment and holds the title and body to the recorded hash,
which a drifted reading of it is searched against again, since only that finds a revert;
no comment at all where no hash is recorded, since nothing is known to have been read.
It never records that hash itself. A generation with no `late_baseline_bounded` was
baselined over the whole thread and gives up what it counts before any comparison,
drifted or not -- cleared to be baselined again where a hash is recorded, and keeping
only its title and body fingerprint where none is -- and where none is recorded the
reading an adjudication carries on over is kept, in memory, as
`observed_user_content_hash` for the next stage's drift check
late_answers.py parked-answer dispatch, reverted edits, certification, question reopening, and reply consumption;
every consumed reading is recorded through `late_park_state` and persisted in one write,
while a bare continue cannot answer a decomposer question; a revert, a certificate, or
an answered question that finds guidance its park's notice withheld resumes the
developer with it rather than an adjudication consumed for ahead of its spawn gates
late_revision.py the developer run guidance buys -- the locked session resumed under `agent_role=developer`
and `stage=decomposing`, with a latched close asked on BOTH sides of it, since a resume
is the same step a spawn is and the run takes hours -- and the followup it is resumed
with, quoting the issue as it reads NOW and every guidance comment the run folds --
any a park's notice withheld ahead of the fresh ones -- carrying the developer report
contract, and
asking for the `ACK:` marker an UNCHANGED commit needs before it counts as an answer,
offered only while the report needs no change either. The reading is consumed once the
run is back and made durable only by the reconciliation's write, so a paused,
interrupted, refused, or close-latched run leaves every baseline where it was, and so
does one whose CLI stopped before it worked -- on its quota, a Claude notice or an
Antigravity failure record naming it, asked ahead of the timeout so a run that also ran
out its clock is still read as stopped; any provider refusal
(`agents/provider_failures`' wider verdict, a 401 or 429 included); or a
failed exit with nothing said -- whose park stands over guidance still unread. The two
entry points are this owner's own --
the guidance that buys a run, and the reply to a revision that stalled -- and each asks
the two owners below in turn rather than re-exporting what they hold
late_revision_obligations.py
the refusal a candidate the last adjudication already acted on earns instead of a
revision, asked on BOTH roads into one -- ahead of the notice and the spawn guidance
buys, and ahead of the re-read a bare continue takes without either. Two effects put a
candidate past replacing: children it created, which a second manifest over the top of
would strand, and a recorded snapshot obligation, refused in ANY state because a moved
`candidate_sha` leaves the reclamation comparing a ref against a commit it no longer
names and none of the states proves the ref absent -- an untypeable ledger entry
answering yes with them, since one this binary could not read may be exactly that
obligation. The hand-back is the reconciliation owner's own park, so a refusal exits on
the terms every other late park does
late_revision_reconciliation.py
the clean tree, re-frozen commit, and fresh measurement a finished run's result is
proved through (which carries none of the last generation's split receipts, and none of
the authorization an operator gave the answer this re-freeze retires -- an acknowledged
unchanged candidate comes back matching every term of it), the reading of the `ACK:`
marker that decides whether an UNCHANGED commit is an answer at all, the fresh owner
read a landed reconciliation and a parked one alike ride out past, and the owed replies
only a landed one repays, and only off a run the caller says worked to the end
late_relabel.py the `workflow:decomposing` label a live generation pins -- one still oversized, or one
whose owner read is still owed: the kill-switch route it refuses, and the dispatch it
refuses -- with the hand relabel it repairs -- when a human has moved the label out from
under an open adjudication
late_restart_effects.py
deduplicate and adopt restart notices by cycle receipt, then establish the chosen label;
reapply a foreign label so the fresh cycle has the restart's own history boundary
late_restart_state.py repair restart identity, persist its marker, and project the fresh cycle while retaining
thread attribution, cumulative usage, and the developer conversations retired as failed
-- and a split child's receipted seed, through `split_seeds.py`; retirement drops the
predecessor's work and sessions
late_restart.py admit and resume an authorized restart only after cancellation and every obligation settle;
hard-skip controls defer it, the recorded target outranks settings, and notice plus label
effects must succeed before retirement, which is written inside the restart fence
`engine/retiring_cycles.py` keeps, so no close read before it ends the fresh cycle
late_result_models.py late-run identity, adjudication answers, guarded splits, and settlement dispositions, plus
the rationale bound, its truncation marker, and the two verdicts that keep one; an
actionable answer remains bound to the exact cycle, generation, and candidate it read
late_content_models.py
frozen content fingerprints, trusted authorization replies, drift signals carrying the
issue-wide requirements hash of the batch they read, and the outcome of consuming one
reading
late_models.py mutable tick context, tri-state owner readings, held pull requests, and staged park values
models.py the run plan and its worktree policy, the locked session, the split plan -- with the
lineage it seeds, the attempt its receipts name, the whole declared dependency graph, and
the recorded children a seed under the child's claim left unseeded for the recovery to
seed and finalize -- and the child scan, with the readings a release walk and a merge
finalize ask of it and the later reading it adopts
state.py the pinned-state field names the owners share, `split_attempt` among them, the
held-child alias, the strict parent-link check, and the issue-reference renderer
discussion/ `discussion`
handler.py the order one round asks its questions in: whether the conversation is over, whose turn it
is, what the checkout holds, and what the round left behind
terminal.py the order the endings are asked in: the recorded plan PR handed to `plan_terminal` before
the issue's own close is read, then the marker lookup that finds a PR a crash left
unrecorded -- whose branch is resolved once, ahead of the number it records, so the ref a
reap names is the one this stage pushed, and which holds here on a recovered PR still open
and on a lookup GitHub declined, handing on only a decided one -- and the pre-PR close,
which reaps nothing
plan_terminal.py what the humans did with the plan PR: the fetch by recorded number, held where GitHub
would not serve it, and the verdict both callers finalize through -- merged to `done`,
closed unmerged to `rejected`, an open one writing and reaping nothing
session.py the pinned agent and session a conversation is locked to, the filter its replies are drawn
through, and the prompt paired with the replies it read
round_evidence.py what the checkout was holding before a round could open over it: the tree read as a
status rather than a path list, since the list form answers its own failure the way a
clean tree does and what follows a clean answer force-removes the tree, and the tip
compared against the anchor the last round recorded -- falling back to that round's
branch where the directory has gone, and held where neither read could answer. Taken
ahead of the restorer in `run`, which is the step that would erase what they report
run.py one round in the issue's own worktree, the restorer that checkout is rebuilt by, and the
branch and SHA it records opening on
settlement.py one reading of the evidence above -- the tree and the round anchor -- and the ownership
test the commit it finds is settled by: this stage's to publish where a round was in
flight, and somebody else's to report otherwise, under a park this stage wrote and off
one alike
outcomes.py the pause, timeout, write, and response decisions one finished round is classified by, and
their routing
publication.py the re-runnable order a publishable commit earns: the durable marker that makes the
attempt recognizable, the lease the push is held to, the push itself, and the hold that
stops where GitHub could not say whether the commit is already on a PR
artifact.py one reading of what the branch carries -- the tree, the base-relative diff, the plan in
HEAD, and whether HEAD is the branch -- taken from the checkout the round ran in and
rebuilt only where that directory has gone, plus the fetch that makes a remote tip
askable there
settled_prs.py the pull requests that leave a commit nothing to publish: the merged or closed one found
by commit, and the open one whose head the humans moved past it
recovery.py a publication a tick died in the middle of: the marker that answers for the branch, the
remote reading that tells a plan that landed from a branch an operator reset, and the
stale refusal written once
plan_pr.py the plan's own pull request: the open one reused -- its body rewritten where it does not
already name the publishing session -- or the new one opened and announced, the title
taken from the plan commit's own subject the way a dev PR's is -- the tracked issue's
own trailing reference dropped off it by the title owner under `git/publication/` --
the body that names that session and says what merging or closing decides, and the
refusal of a plan no session can be named for
records.py what a finished publication writes down: the adoption of a PR already carrying the
commit, and the plan path, branch, number, PR head, and moved round anchor one durable
write leaves behind
parks.py the funnel every way the stage hands the issue back goes through, which stamps each
park's reason, restores the consumed ceiling, and builds the bounded correlation the
park reports: the road off the tick's own record, the role, the pinned conversation,
the plan's own pull request -- read as the round gate reads it, so a developer's pull
request the issue merely arrived carrying is not reported as one -- and the commit the
artifact stands on, the in-flight marker ahead of the published record since the two
can both be pinned and only the marker is a claim about the publication this park is
about
checkout_parks.py the endings the per-issue checkout earns: the agent's loose edits and the stranded tree
that arrived holding them, the tree that would not read at all behind both, the finished
round whose HEAD could not say what it did, the tip that moved with no round in flight,
and the reply no round may open on
publication_parks.py the endings a reading of the committed plan earns: the round's own unpublishable commit
and the recovered one beside it, the published plan, the plan no session can be named
for, the publication the branch moved off, and the diverged and failed pushes
outcome_parks.py the endings the run itself earns: the timeout, the silent backend and its diagnostics,
and the analysis a finished round posts
park_messages.py what those endings quote: the bounded path list, the reading of a committed artifact,
the refusal frame both unpublishable-commit parks share, the stale-publication standing
and remedy, and the anchor a reset is named against
models.py the run and the road it opened on, the agent identity and session, the prompt and its
replies, the round, the outcome, and the publication artifact
state.py the park reasons and wire keys, the plan path and the commit its PR carries, the
open-round and in-flight publication markers, the three park predicates, and the
stage, role, and two route names a record is attributed by
documenting/ `workflow:documenting`
handler.py the order one final-docs tick asks its questions in
preconditions.py the terminals, the missing-`pr_number` guard, the parked-no-input fast path, and the
refused bare continue -- classified over the batch written since the park ASKED, which
on a half-finished drift unwind is that road's own notice rather than the delivery
cursor it holds back: read from the cursor, the instruction nobody delivered would
demote the command to guidance and the reconcile would re-run on an operator's nudge
run.py the branch refresh and diverged-worktree guard, the verdict an earlier pass left dropped
as this one begins -- every shape re-anchors the checked head, so a stale verdict beside
it would advertise a head no pass has documented as ready to merge -- plus the resume,
recovered-commit, and fresh-spawn shapes
outcomes.py the timeout / dirty / commit / `DOCS: NO_CHANGE` order a finished run is read in, a
timeout or a tree not proved clean an account quota's stop left parked as the session
limit rather than `agent_timeout` or the tree's park, the edits left in the checkout
subject.py the single ` (#N)` reference the docs commit's subject is normalized to end in under
`PR_REF_IN_SUBJECT`, ahead of the gate. Both numbers this pass knows -- the tracked issue's
and the pull request's -- go to the shared `git/publication/pr_references` owner, so the
issue's own reference is dropped, alone or from beside one an earlier publication
appended, and the line ends in exactly one reference to the request. The amendment is a
new commit bound to the one this pass read rather than to HEAD, so a checkout something
committed on meanwhile refuses it, and the replacement it creates -- handed on only once
HEAD reads back as standing on it -- is the only id the gate, a hold's receipt, the push,
and the stamp may name. Only the subject's own text changes, its line ending and the rest
of the message kept as written; a subject the normalization hands back as written is
published as the commit it is, and a message that does not read, a replacement git
refuses, a moved checkout, or a HEAD that does not read back as the replacement parks
`subject_amend_failed` rather than publishing it
publication.py the size gate a docs commit passes -- the last one before a human is asked to merge,
and handed the commit this pass made so a checkout something moved is refused rather than
measured in its place -- then the push, the docs watermarks it stamps, and the PR notice
it posts; a commit the gate held and one it let through leave the same receipt, the head
the handoff is still owed for, and the handler finishes from that only over a checkout
standing ON it, since in sync with its remote is what a replacement host rebuilt at a
moved pull request reads as too -- the write that records the pass drops it, so no
receipt outlives the handoff it was written for
drift.py a body edit mid-hop: the dropped approval, the unwind sentinel, and the relabel to
`workflow:validating`. No developer runs on this road, so nothing about the conversation
is recorded -- the requirements revision alone goes down, and it says only that this
stage has already rerouted for the edit. A git step that cannot be proved parks through
the shared HITL helper, which stamps the thread read as far as its own notice, so this
owner puts the delivery cursor back and keeps that notice as the unwind's own boundary:
the silence a pending unwind holds is measured against it rather than against a cursor
that would read the triggering comment as a retry signal every poll
drift_reset.py the fetch / probe / hard-reset that puts the worktree back on the PR head, and the parks
each failure earns
handoff.py the `pr_last_comment_id` ratchet that keeps in_review from replaying a consumed reply,
the write that carries it, and the relabel behind both -- taken ahead of that write, the
relabel leaves `in_review` a pass it reads as unfinished and no stage goes back for it.
And the hand-back past the terminals and ahead of drift, which writes nothing: a squash
handoff (`late_collapse_handoff_sha`) or a readable `review_returned_verdict` standing is
the approval that moved the label here having failed to end its own, or another road's
put down while that relabel ran -- which nothing here can tell apart -- so the issue goes
back to `workflow:validating`, whose recovery answers the handoff over the approval it
names and whose verdict holds the label, before a docs pass runs over either. So does an
approval that no longer covers the developer report -- as recorded, and as it reads at its
location (`review_coverage._approval_stands`) -- or whose evidence no longer stands
(`approved_evidence.stands`), since what moves once the handoff record is ended behind
the relabel no record stands over -- asked with the pinned comment read last behind those
readings, whose report,
pointer, verdict, evidence, or approval records moving sends the issue back too
(`_approval_still_stands`); a report, evidence, or comment nobody could read holds the tick
parks.py the shared awaiting-human park and the missing-PR, dirty-tree, and question parks, plus
the hold a park taken during a drift unwind applies inside its OWN write: that road
runs no agent, so the delivery cursor goes back where the tick found it and the notice
just posted is kept as the unwind's boundary instead -- a correction in a second write
is one a crash between them loses, and it loses it in the direction that waits forever.
`_asked_since` is the reader half, and it is what every road classifying a parked reply
asks so the two boundaries cannot be confused for each other
models.py the frozen records the owners hand each other, including the one reading of a finished
run three of them branch on -- whether it ended on a report -- taken where the run is
built rather than parsed again by each
state.py the pinned-state keys they share, the unwind sentinel and the boundary its silence
is kept behind among them -- the second is no delivery cursor, since the road that
writes it runs no agent at all
fixing/ `workflow:fixing`
handler.py the order one tick asks its questions in, plus the preflight terminals, the
missing-`pr_number` park, and the commit the no-feedback bounce publishes -- measured by
the same size gate the shared dev-fix publication passes, named BOTH ends of the
reading that placed it so a checkout something moved refuses instead of having
whatever it points at pushed, and a held candidate stops the
bounce rather than being relabelled over -- before it hands the PR back to the reviewer.
Ahead of the scan, everything this issue's report obligation owes
(`report_recovery.py`): a round whose publication SETTLED while nobody was looking is
handed back, and a record a crash left unbound is re-proved and bound. That position
is the point -- the input a dead tick consumed rides the same record, so a scan
running past it reads that feedback as unread and pays a second developer to answer
it. Right behind it, still ahead of the scan, a reviewer's handed change request whose
developer's run wrote nothing (`validating/review_resume.py`) -- its owed developer
launched, or a launch that may have run held, dropped, or parked -- whose feedback the scan
filters out as the orchestrator's own, so the bounce would pay a second reviewer.
The nothing-to-act-on exit behind the scan answers to two readings for the same
reason: watermarks that already cover the batch, and a report the issue OWES whose
own frozen pairs cover everything the scan found. Either way the bounce publishes
whatever is stranded, BINDS the report that push is the publication for -- on the
commit the receipt of that attempt names, never the standing value -- and hands the
round back; while a report is still owed over a branch PROVED to be carrying nothing
to publish it holds the relabel, the bookmarks and the round instead, and announces
the wait nothing left can end. A branch the stranded reading could not PLACE holds
the same three AHEAD of that, under `stranded_unproved` and a notice naming which
reading refused: every refusal reads identically to an empty branch, and this exit
is the last tick that would publish a commit. That park waits on a READING rather
than on a person, so a quiet poll arrives back here with the flags untouched, takes
the reading again, and hands the round back on the first one that places the branch
-- publishing a report owed for that commit on the same push -- while a refusal that
repeats holds again without a second notice. Ordered that way because a report owed
behind a refusal is owed a PUBLICATION: parked as a report no road can move, the
retry never runs and the reading coming back ends nothing
feedback.py the rescan past the three in_review watermarks -- read through that stage's own
per-surface owner, so the issue thread answers to the issue-only delivery cursor too and
the pull request never does (a bare `/orchestrator add-agent-runs` is no
feedback there, as in in_review) -- the quiet window a fresh batch settles
through before a resume spends the session on a fragment of it, and the settlement a
consumed batch earns: one reader per surface, derived through `engine/prompt_delivery.py`
-- whose classifier the two REVIEW surfaces are scanned through, since an item the scan
admits and the settlement refuses reaches a developer and moves no reader, so the next
tick hands the identical comment to a second one (the pinned record is dropped by
identity for the same reason). The issue thread settles the issue-action boundary
`last_action_comment_id` beside the PR-side cursor -- a reply this round quoted has been
in a developer prompt, and left behind it routes back to a second developer the moment a
human moves the label -- while the pull request's three surfaces settle only the
in_review watermarks that are theirs. The same pairs are offered FROZEN as well as
written, for the round that has to hand them to the report which answers its feedback.
The issue thread is read ONCE and the whole read is kept on the batch, because the
round owes that surface two more answers than the cut -- the conversation a retired
session is re-grounded on and the requirements a report is stamped with -- and a
second read taken later in the tick carries a comment the watermarks stop below.
While a report is OWED the readers say less than usual, so what says a batch has
already been delivered is the RECORD's own frozen pairs rather than any reader
bookmarks.py the `pending_fix_*` ids a replay rebuilds the triggering batch from -- each surface
apart, since the replay is delivered and so is settled -- and the clear each round earns.
The issue-thread half is CUT from the caller's own read of that surface rather than one
taken here, because a replay is part of the batch: a bookmarked comment edited or
deleted between two reads would reach the developer in the prompt while the requirements
fingerprint beside it never saw it, and the report that round writes is then one no
settlement can place
resume.py the dev run — routing through `implementing/execution.py`'s bounded coordinator to
recover premature AGY command exits before disposition — whose head is read on BOTH sides
of it however the run ended -- a timeout is a way to commit like any other, and the road
that holds a commit made over a standing report record has to see it -- the three refusals
that will not count one as a delivery -- a launch nothing invoked, a shutdown kill, a
live pause -- the settlement of the batch every other outcome DID deliver, the ACK fast path
-- which stands down on any reply that USED the
report contract, well or badly: one that reported is a handover to a fresh reviewer
rather than a reason to re-arm a ready ping, and one that reached for the markers and
missed (a report block with an `ACK:` beside it) is a broken contract rather than an
acknowledgement to act on, and neither is a reply on an issue that already OWES a
report, which is a debt read off the record rather than off this run, and which asks
the branch PROVED to be carrying nothing unpublished rather than merely nothing proved
stranded, since the ack vouches for the feedback and the hand-back is a claim about
the branch -- the report
contract the resume is held to through `reporting.py`, the `workflow:validating`
relabel a published report earns, and the round a PUSHED fix spends here while a
report still owed leaves the round, the bookmarks and the readers to the write that
settles it. The gate is handed NOTHING to close while a report stands, for that same
reason: a receipt write that cleared the bookmarks would leave an outstanding
publication with no batch to replay and a round counted for a report that may still
fail to post, so a held candidate rides its record to the adjudication and the
settlement behind that publication closes it. The settlement is taken ahead of the disposition, so whichever
durable write comes next -- the size gate's receipt, a park's own -- carries it, and it
is taken for every outcome but one: a run that finished on a report outcome
(`engine/report_outcomes.py`) owes a publication this tick cannot promise, and feedback
recorded as answered for a report no reviewer has is the reading that fork refuses. What
carries that batch instead is the report's own record, frozen onto it beside the round
and the bookmarks, so the readers move in the write that settles the report -- and on
every road but that one the settlement is taken in this caller's write, because a pushed
fix answered the feedback in code the pull request now carries and a PARK answered it
with a notice a human is being asked to read. A
replay settles the batch it REPLAYED joined with the fresh rescan, each item against the
reader of the surface it was posted on
reporting.py the settlement-driven form of that road, which the resume above disposes every
reported round through, a run an account quota stopped parked as the session limit over
the debt the missing-report parks would record. Which reply this is -- a report, an
ordinary answer, or one that reached for the contract and missed, an `ACK:` beside a
report, which is held for a human rather than acted on by either half; whether a round
that committed nothing may publish onto the head its pull request already carries, on
the affirmative proof that the head read, never moved, is the one the pull request is
STANDING on, and left a tree proved clean.
Three readings there HOLD rather than answering -- a pull request reading this poll
could not take, a head the checkout would not name, and a tree status that established
nothing are about this tick and not about the round, so nothing is published and
nothing is parked -- while a head that moved, a publication this report may not go
onto and a tree PROVED to be carrying something are decisive, the last of them for the
terminal park in `report_recovery.py` rather than for the roads that wait on a reply,
and for every reported round rather than only the one with nothing to push: taken by
the push tail's own checkout park instead, one condition is announced twice. The record that
carries this round's consumed readers, its route bookkeeping, the requirements revision
its own spawn was handed -- never a baseline re-read after the run, which would fold in
every reply that arrived while the developer worked -- and the settlement MARK for the
write that completes the publication. The binding taken only on a commit the CALLER
proved, never on the persistent publication receipt, and held to the fresh reading in
`report_publication.py` that both those roads share. A request that FAILED is the one
refusal the answer names for itself, because a caller may spend nothing on it. Then the
park a report no road left can move earns, once -- beside the park a run that
COMMITTED and did not finish earns, in this road's own words rather than the
engine's, since nothing else publishes for such a run. The silent-park streak comes
down with the recording, the earliest moment a session has proved it can speak. Then
the hand-back, which retires the mark in a write of its own BEFORE the relabel -- a tick dying between them has to leave
a round nothing can mistake for one that just settled -- and STAMPS the transaction it
closed the round on, since the mark falls with that write and the handoff beside it
never does -- and which takes down the `push_failed` park a landed publication is itself
the answer to, since the push a recorded report rides is durable a step ahead of the
publication and a relabel over that park hands a reviewer an issue still waiting on
a human. That reason and no other: the rest of the transient set is about a SESSION or a
reviewer run, so a park a LATER round left would have its question retired by a
publication that never answered it
report_publication.py the one fresh reading of the pull request those two roads take, spelled apart because
neither may carry a copy of it: answered twice they would come to disagree, and the
disagreement is a report on a thread nobody meant. It establishes the whole IDENTITY of
the publication, as `engine/report_publication_evidence.py` does for a transaction the
reconciliation is finishing -- still OPEN, since a thread somebody merged or closed
mid-run keeps the head it had and every other comparison passes on a publication that
is over; on this issue's own branch in THIS repository, since a number is all that
brought the object back and a second thread on another branch or a fork's carries this
repository's ref names over somebody else's commits while standing on the very commit
a caller proved; and STANDING on that commit rather than merely carrying it, since a
push landing between the proof and this reading leaves it in the history while the work
under review moves on. The DESCRIPTION comes back with it -- whether it still closes
this issue and names the session -- because the one report this workflow cannot both
keep and manage is a `REPORT: VERIFIED` naming that very body, and the binding refuses
it only if a caller says so. EVERY read is inside one boundary, the fetch included and
nothing only around it: a fetched pull request asks GitHub nothing, so the state, the
ref, the head repository, the sha and the body are each a request of their own, and the
client resolves its repository lazily too -- left outside, any one of them leaves the
reading by an exception rather than by an answer
report_recovery.py the other end of that contract, reached by the handler ahead of its scan and by the parked
dispatch behind it: what a tick coming back to one of those windows owes, written for the
position ahead of a scan because a scan is what the damage runs through -- the input a dead
tick consumed rides the same record, so a scan running past it reads that feedback as unread
and pays a second developer to answer it. A round whose hand-back was WRITTEN and whose
relabel never landed is relabelled again and nothing more, ahead of everything else, on the
reading `round_marks.py` gives it. A round whose report SETTLED while nobody was looking is
handed back on the mark that settlement raised, never on the settling itself: a delivery is
claimed by one key whoever wrote it, so the record settling there can be an implementing
candidate's or a drift resume's, closing THAT route's bookkeeping and raising no mark of
this stage's. A record a crash left unbound is answered off its own pairs, and whether the
code went out is RE-PROVED against the checkout rather than remembered off the persistent
receipt -- a tree provably clean and a head it could name, with where that head stands left
to the binding, which reads the pull request afresh -- and a binding whose guarded write
did not land over the comment the tick read, refused over a moved comment or sent and never
confirmed, ends the tick silently, its state withheld. A record nobody can READ parks with the
record untouched, since the debt is claimed by the key alone and reading it as an absence
would let the scan behind it through. The two refusals no later poll takes back, a worktree
that is GONE and a tree this host proved DIRTY, announce once and RELEASE the record as they
park -- left there, restoring or cleaning the checkout would be enough on its own to publish
the report and send the issue to review, which is the decision the notice exists to put in
front of a human. What that record SUPERSEDED is released with it, held to the revision that
says the two are one lineage: a delivery recorded over an outstanding transaction carries
its frozen pairs forward and the binding behind it is what would have dropped it, so a
transaction left standing is one the reconciliation proves, settles and publishes over
report text this issue has already replaced. The debt outlives both, and a reading nobody
could take is neither refusal and buys nothing at all. The release rides the park's own
guarded commit (`engine/report_delivery.parks_the_debt`), owning the records it drops and
decided on every report record the tick read: another road's writes meanwhile survive, a
newer record it wrote is never released with the one the tick found -- no notice, nothing
dropped -- and a release that did not land over the comment the tick read, or landed
unconfirmed, ends the tick silently, its state withheld. A settlement whose preparation or
commit did not land ends a binding's tick the same way, for the reconciliation ahead of the
next handler to settle, finding the report already posted by its receipt
round_marks.py whether the mark a settlement raised still places the round in hand, which is the one
reading the two owners that could relabel over one share. No mark is asked nothing. A mark
is correlated against the handoff beside it and refused on any of four: an outstanding
report, a handoff this build cannot read, one recorded under any label but
`workflow:fixing`, and either route anchor standing -- a settlement clears both, so one
there belongs to a round opened after the mark went up. The label is what catches an
anchorless manual relabel back onto `workflow:fixing`, which the rest of the comment
cannot tell from a round that has just closed, and a fifth reading catches the same
move made LATER: the mark falls with the hand-back and the handoff beside it never
does, so a comment whose round closed legitimately goes on satisfying all four, and
what ties a mark to ONE transaction is the receipt that hand-back stamped. That stamp
is this owner's too, and is taken only where a mark was RAISED: the reading above
places every road reaching a relabel on its own reasons as well, and one of those
closes no transaction to record. Either
owner CONSUMES the mark it asks about: one it may not place is the mark of a round
that is over either way, and left standing it would be waiting for whichever fixing
round came next. The same stamp answers the one question left once the mark is down:
whether a hand-back's write landed and its relabel did not. That comment reads the
same after a relabel that landed and a later anchorless move back, so what decides is
`review_returned_subject` -- a round whose report no reviewer has returned over is still
owed that review, and one a reviewer read is not
parked.py the five answers an `awaiting_human` tick can reach and the order they are asked in.
What counts as a reply is the reading the readers cannot give while a report is owed,
so the record's own frozen pairs decide it: a rescan with nothing above them clears
no park. The silent recovery is widened for one shape by the same rule -- a
`push_failed` park on the in_review route with a report still owed, where both groups
are the settlement's and the default would hold the issue on a park nothing clears --
and the retry that lands publishes the report against the commit ITS receipt names
before the hand-back retires the park. The `stranded_unproved` park the no-feedback
bounce files is the one shape here waiting on a READING rather than on a person, so
a quiet poll falls back through to that bounce with the flags left exactly as they
are: it is the single reader, and the park comes down in the write that relabels --
which is what keeps a reading that refuses again from announcing itself twice. An
accepted `/orchestrator continue` is
resolved here rather than falling through, since the stay-parked default behind it
would refuse the operator's retry as "nothing new"
continue_command.py `/orchestrator continue` on a parked fix: the replay and what it may hand the dev --
guidance, never the command itself -- plus the two refusals and the guidance passthrough
for retryable session failures (`agent_silent`, `agent_timeout`, `agent_execution_failed`).
The validating route's anchor joins the replay as `validating/feedback_posts.py` shows it:
the findings it quotes formatted, its id and every other attribute the posted comment's,
so a post made before findings were formatted reaches the fresh developer concise while
the comment stays as posted and the batch settles exactly as over it
drift.py the `workflow:resolving_conflict` reroute a stuck validating-route park earns when its
worktree has fallen behind base. Only a condition that has not resolved reaches it: a
park the branch READING withheld the clear from answers in a word of its own, since the
reconciliation this owner hands off to publishes that checkout with no report debt
staged for whatever it turns out to be carrying
models.py the frozen records the owners hand each other, the batch among them carrying the
whole issue-thread READ it was cut from -- the conversation a fresh spawn quotes and
the requirements a report is stamped with both come off it -- and the comment ids this
orchestrator RECORDED as it posted them, which is what keeps its own questions in that
conversation under an allowlist naming only humans: an agent handed the answers
without the questions they answer is re-grounded on half a thread
state.py the pinned-state keys they share, and the one park reason this stage files itself:
what a no-feedback bounce holds a branch it could not place under, which is the only
park here waiting on a READING rather than on a person -- durable, because nothing
else tells a later tick whose park it is standing over, and none of the validating
transient reasons, since those dispatch to a recovery that would publish against a
record this park has none of
implementing/ `workflow:implementing`
handler.py the order one tick asks its questions in, opening with the retry-cap notice a stranded
park still owes
spawn.py awaiting-human vs active, the restorer the checkout comes back from, the
recovered-worktree shortcut and the certified baseline it stands down for -- which
an unread head cannot spend, since that comparison is what a retirement rests on --
and the retry-gated fresh spawn, which retires the pinned session wherever a
continuation is what paid for it: the grant is durable and the budget is shared, so the
tick that spends one is not always the tick -- or even the stage -- that granted it.
The spawn routes through `execution.py`'s bounded developer run coordinator to resume
premature AGY command exits before disposition. The spawn's prompt and the record of the
thread it quoted come off one read and travel on the prepared run, for the pre-session
edit that is settled by nothing earlier
session.py the four session retirements -- the fourth being the continuation that buys a spent
budget one more attempt, which is a fresh spawn by definition -- the read-only plan of the
session a resume opens with (`_planned_dev_session`, which asks `session_retirement`'s
record before either counter), the post-run persistence that pins a fresh spawn's id --
the first spawn's on `spawn.py` included -- only through that owner's guarded pin, and
the fresh-spawn prompt, whose re-grounding conversation is the caller's frozen read
wherever it holds one and its own read otherwise. The budget that retirement answers to is
`engine/retry_budget.py`'s entire, gate and park alike, and the spawn road calls it
there
session_read.py the locked session read, every id either pin field holds (the legacy one that read
hides once `dev_agent` is pinned included), the stale / overflow / quota classifiers --
the quota one asking a failure record's verdict as well as the final message -- and
the blockquote they quote with
session_retirement.py the record of a developer conversation retired as failed (`dev_session_retirement`):
the idempotent retirement that records it and clears the pins with `dev_agent` kept,
the reading the planned resume asks before either counter, the pin a fresh spawn's id
goes through -- refusing a missing or retired id so recovery stays owed -- with every
pin a fresh conversation is owed over, in either field, counted as retired and named as
it is cleared or replaced (an unreadable record's included, which is read fail-closed:
recovery owed, every id it still names retired), and the guarded commit that lands the
retirement alone, over a fresh reading, for a tick whose own write is discarded -- every
id the tick's own record names retired over that reading too -- putting what it landed
back on that tick's state
resume.py the two resume entry points and the historical call shape they keep. The
human-reply one is handed its caller's frozen batch rather than reading the
thread itself, hands that batch's frozen conversation down for the re-grounding
a retired session's fresh spawn needs, and settles the consumed issue watermark
from the batch AFTER the run -- only for an outcome that counts the input as
delivered, so a launch the run circuit refused, a shutdown kill, and a live pause
consume nothing while a timeout, an empty result, and a question park all do
resume_batch.py the frozen reply batch every `implementing` and `validating` awaiting-human resume
reads: ONE whole-thread fetch, by the pinned comment's id, from which the quoted
followup, the delivery record naming exactly the quoted ids, the whole and the retry
re-grounding conversations, and command ownership are all cut. Each stage's handler
freezes it once per parked tick and hands it to every road that tick takes. The
measurement retry is asked of the delivered replies, and so is the parked-continue
classifier where a caller says it looked at an earlier read (`continue_claimed`,
which neither handler passes); the authorization command is asked of the last reply the
id ledger leaves, and while its park stands it is in no prompt text even where
something after it demoted it. An owned batch is handed back whole, delivering and
settling nothing. `answered` -- the frozen comments at or below the park's watermark
-- is what the drift check measures a parked issue's requirements by. Settlement is the
ordinary issue-only `prompt_delivery` ratchet, taken after the run and only for an
outcome that counts as delivered: not a live pause, a shutdown kill, or a launch never
invoked. It records `user_content_hash` too, the fingerprint of the frozen read through
the last reply delivered, so a delivered reply is never answered again as an edit
parked_replies.py the one cut of a parked thread's fresh replies the batch above and the command roads
share: `prompt_delivery.human_replies`, less a bare `/orchestrator add-agent-runs` the
run-limit hold has already answered. The measurement retry and the quiet timeout
recovery read it; the authorization park keeps its own first cut (the id ledger alone)
and takes the grant out through this one too. A reply counted on one side of those
hand-offs and not the other is a tick each road leaves to the next on every poll
resume_request.py what one such call supplied, frozen and checked before a run is built: the stage
its records are attributed to, the frozen conversation a fresh spawn is
re-grounded from where the caller holds one, the launch a resume owed once is -- the
run count it is charged against and the hold it is made behind -- and the unknown option
a named parameter would have refused on its own
execution.py one resume, its poisoned-session retry -- withheld on an issue a poll observed closed,
since that retry is a SECOND agent -- and what each attempt is allowed to persist; the
bounded AGY command-recovery coordinator (`_coordinate_developer_run`) that recognizes
incomplete command outcomes and permits at most one immediate tracked continuation for
both fresh spawns and resumes, never of a conversation `session_retirement` retired; and
the identity an attempt is charged under, spelled once
(`_launch_identity`), so the fingerprint a resume's first attempt would be charged under is
read without resuming (`_first_launch_fingerprint`) -- how a handed change request's
recovery tells that developer's charge from another road's
worktree.py the checkout a resume runs in, restored when reaped
disposition.py run-output attribution, inherited floors, timeout parks and their recovery, and agent-result
settlement; both heads must be readable and the run must leave commits above its floor --
with two exceptions: an issue still owing a report it could not deliver, where a run that
comes back with a report and moved no head is publishing the commits already on the branch
rather than asking a question; and an intentional `/orchestrator continue` retry of a park
that kept the failed run's floor -- `agent_execution_failed` past unfinished tool steps,
or the `agent_silent` session-limit park of any quota stop -- whose failed run committed
work before parking and whose retry now returns a valid report outcome without moving HEAD
again. A RECOVERED run -- the restart shortcut -- is settled against the pinned comment as
well as the tree, through `unreported_recovery.py`. The timeout park is bounded so its
notice cannot carry the watermark over a reply written while the agent was out, and a
timed-out run an account quota stopped takes the question park's session-limit branch
instead of it -- as does a quota stop's commit over a tree not provably clean, which
publishes only over a clean one
candidate_recovery.py exact-commit recovery for approved and frozen work, timeout-commit evidence, and publication
through a proved clean tree and the size gate; a recovery hands on the candidate it proved.
The report the run wrote is recorded between the tree and the gate, the last moment it is
certainly recoverable; a report this build cannot record, and a completed run that handed
over none, stop the call there with nothing measured, pushed or opened. Every synthesis a
recovery hands the seam carries `invoked=False`, so it records nothing -- and a candidate
a gate record named is held there instead, through `unreported_recovery.py`, where
nothing on the comment describes it
unreported_recovery.py
committed work a recovery republishes -- the restart shortcut and every road that
republishes a candidate a gate record named -- held under `report_undeliverable` before
anything is measured, pushed or opened unless a debt is still owed or a settled pair
names this repository, branch, commit and the receipt's pull request, re-read where it
settled with the requirements first. A commit a run that never COMPLETED left is
recorded as `implementing_incomplete_run_sha`, durably before the gate, and owed no
report, a timeout-park recovery's stranded commit included; a completed run retires it
in the write that records its report -- except over a
delivery or transaction an earlier run recorded and has not settled, which describes the
branch before that commit, so the commit is held the same way with the record kept.
Also the `invoked=False` result those recoveries hand the seam, and the attribution check
proving a failed run's commit for an intentional continue retry
late_gate.py prove the caller's committed candidate, ask receipts and existing permissions, and then
take a fresh or resumed measurement; the verdict carries the basis admitting publication
late_gate_permission.py
read the authorized exemption, frozen remote tip, unspent approval, and proved receipt;
an unknown candidate reaches the switch only after those records have answered
late_authority.py whether the human behind an adjudicated commit is one this issue can show, which is
what every road past the measurement asks before it takes one. The exemption and the
`late_override_*` authorization are asked TOGETHER and both held to naming one commit,
since either alone is half a bypass -- an exemption records that an adjudicator ruled
the change one whole, and only an operator's own gesture says a human agreed to publish
past the ceiling. Neither is believed on its shape: every term of an authorization but
the digest is the pinned comment agreeing with itself, so the contribution between the
pair the record names is fingerprinted again here and held to what that record says,
and a reading this host cannot take refuses on the same footing as one that disagrees.
What a refusal costs is the measurement the gate would have taken anyway. One thing is
never held back by it: a commit the pull request this call FROZE is ALREADY standing
on, where the push moves nothing and only the bookkeeping behind a publication that
has happened is left -- the seam that froze none asks the same question of its receipt
through `late_delivery` instead. Work that is over is outside it too, since a merged
or closed issue is finalized before any handler reaches the gate. The publication DEBT
such a commit leaves is the same question one field over, answered off the approval's
own recorded basis rather than inferred: the two bases an operator's gesture is behind
defer to this reading, a gate-owned `reading` approval is untouched, and an approval an
older binary wrote with no basis falls back to the exemption -- read conservatively, so
a comment that CLAIMS one and cannot say which commit it is about is the
adjudication's debt rather than this workflow's own
late_delivery.py what the publication receipt has to prove before it vouches for anything, and the pull
request that proof was ABOUT. The note names what this stage last PUSHED and nothing
about where it went or whether it is still there, and it is never cleared -- so a
branch published rounds ago carries one for the rest of the issue's life, and answering
on it alone republishes unmeasured and unleased, opens a SECOND pull request over the
same work, and hands the issue on. A call taken past a publication has its own frozen
head and is checked against that; the implementing seam froze none -- its push is what
OPENS a pull request -- so there the remote is read for the number the record names and
answers only for an open pull request standing on this exact commit AND open on the
branch that seam would push, which it resolves for itself, with its head in the
repository the client that took the reading is for, and over a receipt recording no
LEASE -- a lease names the head a push REPLACED and only a call that froze a
publication writes one, so a receipt carrying one at this seam was left by some other
call and its commit matching the candidate is a coincidence the fresh receipt behind
the push would clear the evidence of. The answer is the NUMBER
rather than a permission, because a reading is a moment: it pins the lease its push is
held to, which is that commit, and the pull request its bookkeeping belongs to. A proof
that FAILS is a park rather than a fall-through, and the size of the candidate is why:
measured and found small it would be published, which force-pushes a branch nothing
could confirm and opens a second pull request over work the first may already carry.
A receipt GROUP this build cannot read whole is the same answer one step earlier
and is asked at the gate's own DOOR, of the record and of no candidate: every road
out of a gate call ends in the write that puts a fresh group down, and the road that
answers FIRST -- `DECOMPOSE=off` with no caller-named candidate -- never reaches the
candidate question the rest of the proof hangs off. It is apart from the commit
comparison because that comparison cannot see it: every late field is read
fail-closed, so a hand edit comes back as no receipt, and published over the push
writes a fresh group across the damage and destroys what an operator would have
repaired it from. The one road with no gate door of its own -- the accepted
settlement, which reaches the transport directly -- is refused by its own
reconciliation on the same terms. Three shapes are damage. A KEY that is gone while its siblings are
there is asked first, and it is why PRESENCE is asked of every member rather than of
the commit alone: the write puts all three keys down, `null` included, so a missing
one is a hand edit rather than the empty lease an initial publication records. A
member that CARRIES a value nothing can read is the second, named so the park says
which field to repair. A group naming no PUBLICATION is the third -- a commit with no
readable number beside it, or a lease or number with no readable commit -- and it is
the one a commit-only check walks past, since a receipt naming some other object id is
never compared against the candidate and the next push completes the partial group
rather than leaving it. An empty LEASE is the one member that is not damage where its
key is there: an initial publication froze no head and records `null`.
The park writes nothing else -- the receipt, the recorded number and any debt beside
them stand for the terminal or the retry. Which pull request is the RECEIPT's own,
written with it by the push that landed and never searched for: `pr_number` is the
relabel's write, which is the one this window is missing, and a lookup by branch
answers with whatever is open on that ref -- so a REPLACEMENT somebody opened after
closing the original would be taken for the publication this stage made, and the
relabel, the debt and the receipt would all be spent against it. Absent or unreadable
the proof refuses. NOTHING is outside the park, an exemption or an approval naming
the same commit least of all: each answers whether the candidate needs a fresh READING
and says nothing about where the work went, and the delivered road records the commit
as a debt BEFORE it pushes -- so a tick dying there leaves an approval with no lease,
and waving it past publishes unleased onto whatever a branch lookup finds
late_consent_state.py durable authorization parks, candidate-scoped notice receipts, quiet delivery settlement,
and consumption through the command reading's watermark; later human replies remain unread
late_consent.py request an operator's authorization for an adjudicated oversized commit, validate the named
candidate, fingerprint its contribution again, and record the measured terms while retiring
the park; refusals retain the candidate and share the same scoped receipt rules
late_command_reading.py
whole-comment command parsing, valid comment ids, and stage attribution from the id ledger
late_command.py select the last fresh trusted human reply from one thread reading, carry its furthest
watermark, and read through later attributed stage comments without crossing human guidance;
receipt checks exclude the pinned comment by id. A bare `/orchestrator add-agent-runs` is
no reply to the park (`parked_replies.py`'s cut, which the frozen resume batch shares)
late_recovery.py the ordered recovery dispatcher ahead of every developer spawn: repair stranded
authorship, restore a held park, retry measurement, answer authorization, then
recognize a restored candidate; committed work never buys a replacement developer run
late_candidate_recovery.py
re-measure committed work on a trusted bare continue, or republish an approved
candidate restored to its checkout; both carry the proved commit into the ordinary
publication seam and persist its answer
late_authorization_recovery.py
answer the authorization park's named command only on its own committed candidate;
guidance returns to the ordinary resume and silence holds without another reading;
missing, dirty, unreadable, or moved checkouts leave the park and command untouched;
a proved checkout hands the decision to `late_rollback`, which preserves the park
across a publication that fails or never returns
late_authorship.py which comments on that park's thread are this stage's own words, on two records. The
ID is the ordinary one: the client this owner lends the seam puts what GitHub hands
back into `orchestrator_comment_ids` the instant each post returns, since the seam
says several things before it comes back and a sentence unattributed for the whole
of that call is one every reader in between misreads. The RECEIPT covers the one API
call left, and it is a digest recorded before the comment carrying it exists.
What it commits to is the SENTENCE rather than the sender -- the secret AND the exact
body it goes out on -- which is the whole of why claiming one is safe. A secret is
unforgeable only until it is disclosed, and posting the sentence discloses it: from
that moment a reply quoting our comment carries the secret too, and the login beside
both is a token this repository says may be shared with the human whose consent this
park collects. Ordering told the two apart only while our comment stood, and ordering
does not survive that comment being DELETED -- one tidy-up on a thread where somebody
has already quoted it. Bound to the body, their reply answers nothing, since a quote
carries their words as well as ours; what can still answer is a verbatim copy, which
carries nobody's words to lose. One receipt per COMMENT, since a digest of one body
is answered by that body alone, and the first is recorded before the seam is entered
at all -- the seam can post the moment it is called. What answers one is a
LEDGER repair, run ahead of every routing decision this stage makes: one reading of
the thread, the EARLIEST comment whose body is that sentence recorded in
`orchestrator_comment_ids`, no watermark moved -- one moved to our sentence crosses
everything under it, so a corrected command written below would be consumed unread.
Earliest because a copy can only follow what it copies, and a reply merely quoting
our sentence carries its author's words too and answers nothing, so the accidental
case cannot be claimed at all. Where our own comment has been DELETED the earliest
answer left is a verbatim copy and nothing on a thread tells it from ours, which
takes reposting a bot notice byte for byte and removing the original -- not an
accident, and available only to somebody already holding the token that authorizes
publication outright. A receipt is dropped by that repair, by the write recording a
posted id, or -- for a promise the seam never worded a sentence for -- by the
handoff that made it, and nowhere else: one cleared while its sentence is still
unledgered leaves nothing able to find that comment again
late_rollback.py one handoff into that seam and what it is held across. The seam's refusals park under
reasons of their own and its notices move the watermark past whatever they find --
right on every other road, and here the operator's own decision thrown away. So the
park, its reason and its watermark go down on the RECORD before the call and are put
back after it: the seam's writes are durable before it returns, so a rollback living
in the frame that made it dies with the process. A record still carrying that pair is
a call that did NOT publish, since the write moving the label out of this stage is
what spends it -- so both roads that read it restore whatever the record says now,
the call that came back with nothing pushed and the poll that finds a tick killed
halfway through one. What the seam left the park FLAGS saying decides nothing:
several of the gate's roads to a held verdict clear them without publishing -- a
bounded transport miss counting a quiet retry, a close that ended the cycle, a record
this commit is superseded by -- and each taken for a publication drops an operator's
question and consumes their command. Put back over work the seam did publish that
costs a poll; left off it costs a decision, and an issue the seam relabelled never
reaches this road again.
How far the reading behind the command GOT goes onto the record in that same write,
for the opposite outcome: the seam consumes the command itself where it records an
authorization from it, and its two roads that publish without reading a thread -- a
candidate the ceiling now lets through, and one an authorization already on the
record covers -- would leave it standing on an issue that has moved to `validating`,
read there as somebody's fresh feedback. Written down rather than applied on the way
out, since the write that moves the label is the last one this stage makes on the
issue, and `late_park_state` spends it there. Consumed to what that reading LOOKED at and
no further, and never on a call that published nothing -- the gate's own reading can
have held the park over guidance written between the two readings, and that reply has
to still be there for the poll that acts on it -- so every road that puts the park
back drops the boundary instead
late_reading.py the reading itself, on the two roads into one: a fresh pair frozen before it is counted,
so a tick that dies over the diff comes back to the pair this one froze, and a recorded
one acted on only once its other fields say what the number MEANS and the base it names
is proved present here
late_overflow.py what a gate call taken PAST publication freezes before it may measure -- the stage it is
taking the issue out of, the pull request the work already has, and the head that pull
request is standing on -- and the seven refusals that make freezing them fail closed: a
tree that is not provably clean, a pull request nothing could read, one that is closed or
merged, one whose head lives in another REPOSITORY -- a fork carries this repository's
ref names over its commits, so every term below agrees while the branch the push names
was never what that pull request is about -- one open on a BRANCH other than the one
this publication will push, a
caller-named head that is no whole object id or that disagrees with the head
this owner reads, and a head that moved off what a live record froze; asked behind the
switch, so an install with the gate off pays neither the read nor the park. Also what a
record already carrying a publication is re-proved against -- the whole frozen identity
rather than the head alone, since a branch reused across two pull requests puts the same
commit at the tip of both -- and what the CALLER established rather than what this owner
would re-read: the head it pinned its own decision to, checked against the one this owner
reads rather than substituted for it, the BRANCH it resolved and is about to push, and
the stage a same-tick remote relabel wrote over a cached one. The branch is asked first
because it is what makes every answer behind it about the same publication: the number
and the branch are two fields on one pinned comment and they can disagree -- a `branch`
a hand edit moved, or a `pr_number` left over from a cycle that ran on another ref -- so
an entry frozen on the head alone would describe a pull request the push never touches,
and the settlement, the receipt and the relabel would all be spent against somebody
else's publication. That comparison has one carve-out and it is not a preference: a
tip a DURABLE RECORD says this issue put there -- an approval's commit, a live record's,
or `implementing_published_sha` read with `implementing_published_lease`, the head that
receipt replaced, AND `implementing_published_pr`, the publication it went onto -- is
this issue's own push having landed, which is the window an
approval exists for; anything else at the tip is somebody else's branch move and
refuses. The caller's own candidate is deliberately not among them: on a fresh attempt
no push of this workflow's has run, so a tip that merely happens to BE that commit says
an agent put it there, and waving it through would measure and route the candidate the
gate is holding back. The receipt is not among them ALONE either, since one that is
never cleared would read a pull request rewound onto a commit published rounds ago as
this tick's own push arriving -- and a checkout rewound with it agrees on every local
fact there is. Dated by the head it was PINNED to it names the one window it is evidence
for, a push made from the head this call was entered on, onto the pull request this
call is freezing, under a process that died before the relabel. The number is the term
the other two cannot supply: a branch pushed from that head onto a publication since
closed and REPLACED by another on the same ref satisfies both of them.
Two readings here answer no entry at all and are asked for opposite
sides of an effect: whether a pull request is OVER, read fail-open for a tick that hands
itself back, and whether one is still OPEN, read fail-closed immediately before a push
late_publication.py the answer half, between that entry and the push: the switch, the record, and the count
asked in one place, so the seam that reached the gate makes no difference to what it is
told -- an install with `DECOMPOSE=off` reads no pull request for the MEASUREMENT,
which is the one reading it saves rather than every reading there is, a record already
in the gate goes through the ordinary questions, and a commit an approval owes a push is one
this gate has already ruled on; a hold is the whole of what the tick did, parked or
handed to the adjudication, rather than a bare permission, and anything else carries the
commit the push is named against, the head it is leased against, and the head the pull
request stands on now, which is what says whether the push has anything left to do.
Whether that publication has ENDED is this owner's too, asked immediately before the
push it answered for: a pull request merged or closed in the window behind everything
that read it -- whose branch is still at the head this tick froze, so the lease SUCCEEDS
and the force-push moves a merged pull request's branch back onto the commits it merged
-- and then, LAST, a close a poll latched. Read fail-CLOSED, the opposite of the same
reading at the reconciliation's door, since there falling through costs a poll and here
a branch nothing can put back; asked of every push onto a pull request the record names,
whatever the switch says, since `DECOMPOSE=off` decides what enters the MEASUREMENT and
not whether a merged pull request may be force-moved; and the latch last because the
reading above it is a request, so a close landing while it is in flight is one only an
answer taken after it can still give. A record that cannot NAME a pull request refuses
ahead of the reading and with no absence carved out, since every road here publishes
onto one the remote already carries: a field that is gone and one that will not type
are the same refusal, and reading the second as "nothing to check" is how the barrier
would skip its request altogether and force-push onto a publication somebody ended
late_push.py the one call every gated push onto a pull request the remote already carries goes
through -- measure, push named against the measured candidate and leased against the
frozen head, spend the debt it paid, close what the route owed for it (in that same
write, since past it neither the approval nor the generation is left to say a round was
owed, while the caller still has a relabel and a write to make), record what reached the
remote so a tick that dies
past the push neither re-reads nor re-pushes it, refuse work that ENDED -- a pull
request somebody merged or closed, and then a close a poll saw -- immediately before
the push and nowhere else here, since every guard above spends a reading, a diff or a
request after it and an ending landing in one of those windows would be answered one
push too late (the question itself is `late_publication`'s, beside the entry it is the
far end of), and prove the checkout again on the far
side of the effect -- AHEAD of that write, so what the proof answers rides it: a
checkout that moved or was dirtied holds the handoff rather than the publication, and
the claim it owes lands with the receipt rather than one write behind it, where a crash
would take it and leave the stage below reading a dirty worktree as no stranded work;
asked through `checkout_guards` below, the same owner the initial publication is
proved by, for both; a pull request already
STANDING on the candidate goes through the same
tail, since the request is the only atomic proof that the publication this tick froze is
still the one the pull request has -- git has nothing left to send, and the lease moves
to the head the branch is on NOW rather than the one an approval was measured against.
That write is skipped for a push that had nothing to SEND and finds the receipt naming
its commit with no debt beside it, which is a retry of a publication already settled; a
push that MOVED the pull request settles whenever a pair the route owes is not already
the value on the comment, since the receipt is never cleared and on its own reads a
branch pushed back onto an older published commit as a round nothing is left to close.
The exemption a rewrite earned rides that same write, staged by `late_rotation` and
asked whether or not anything else is owed, so a comment whose receipt already names the
commit still gets the move if the write that should have carried it was lost -- and
`late_transfer_telemetry` is asked past that write, so a move that really landed is the
only one reported. The push is the one step a caller may hand in, and only the base
refresh's publication and its recovery's retry do (`engine/rewrite_publication.py`,
`engine/rewrite_retry.py`), as one transport that reads before it pushes
(`late_transport.py`): the barrier is asked between that reading and the
push, so it is still the last question before anything is sent, and the proof and
settlement after the push are unchanged
late_transport.py the two-step push a caller may hand `late_push` in place of the branch push -- the reading
it is decided on, then the push -- typed as a protocol so the ending barrier sits between
them; only the base refresh's publication and its recovery's retry hand one in
late_accepted.py the push an adjudication already accepted, taken with no measurement -- a verdict read
this exact diff and said it ships as one change -- but still named against the commit
that was DECIDED, still pinned to the head the reading was taken over, made only
over a checkout re-proved to be the one that verdict was reached about, and refused
outright where the publication ENDED in the meantime. This road reaches the transport
directly rather than through the gated call, so it makes that call's own barrier for
itself -- and the window is the widest any publication has, since the pull request was
last read by the reconciliation and the exemption, the identity, the debt, the park
persist and both checkout probes all run between that reading and the push
late_collapse_state.py
immutable pre-squash values and durable head/base/count claims written before reset;
failed writes restore in-memory state, and handoff or proved rollback clears the claim
late_squash_proof.py prove the checkout still holds the squash, decide whether approval, receipt, generation,
or a changed checkout keeps it standing, and choose the receipt-proved retry lease
late_rewrite.py enter and publish a squash, with the switch governing measurement and every push retaining
its terminal barrier; hand the actual pre-squash pair to transfer, name a resumed candidate,
and drop abandoned approval, transfer permission, and collapse claim after proved rollback
late_transfer_reading.py
pending permissions and operator authorization; a damaged claim cannot be overwritten
as a grant, and an existing grant must agree with this reading's fingerprint
late_transfer_evidence.py
bounded rewrite kind, stage, endpoint, and publication evidence; frozen and recorded PRs
agree with the lease, with a rewritten remote tip admitted only by its pending permission
late_transfer_checkout.py
fresh clean-checkout, lease-object, unchanged-owner, and remote-backed base proofs;
an observed close, control label, relabel, or unprovable base refuses the transfer
late_transfer_contribution.py
immutable permit results and fingerprints of accepted, claimed, and rewritten pairs;
the recorded adjudication reproduces locally and every claimed contribution agrees
late_transfer.py ask evidence and live-proof questions in order, then grant and persist the permission with
its publication debt; restore failed writes and abandon a permission after proved rollback
late_rotation.py what the receipt of that landed push does with the permission behind it, staged into the
push tail's own write so the exemption, the identity it carries, the phase that spends
the permission, the account of what the remote holds, and the bookkeeping the landing
closes land together or not at all. What licenses the move is the PERMIT `late_transfer`
re-asked on this tick, handed down the tail beside the commit it proved out for, and not
the permission on the comment: a refusal there is not a hold, so the rewritten commit
falls through to the ordinary cumulative gate and a count under the ceiling publishes the
same commit -- a settlement reading the record alone would rotate a human's verdict onto
a rewrite nothing revalidated and write the very digest the permit declined. A permission
no permit vouched for is therefore left exactly where it stands, neither spent nor
dropped, since the remote is now on a head the permit accounts for and a later tick whose
refusal has cleared can settle it. A permission naming the commit that just landed, where
this tick's permit proved out for it, is
SPENT -- the verdict moves onto it, since the pull request really carries it now -- and
the record says which of the two readings proved that: a leased force-push that moved
the publication off the head the permit was granted against, or the leased no-op a
recovery makes over a pull request a tick that pushed and died had already left it
standing on. There is no third, since a remote anywhere else is a permit `late_transfer`
refused and a reading that could not be taken refuses the same way -- neither is read as
equivalence, and neither is ever pushed for unleased. A permission the publication went
PAST is dropped instead, on the rollback's own terms (an outstanding record this build
can vouch for entirely), since the head it was granted against is gone and what is left
is a claim about a push that cannot happen. What it stages is the transition and not
what is said about it: the rewrite a verdict moved onto and the reading that proved the
publication ride the answer, and the record is the telemetry owner's below. A permission
whose rewrite a merged or closed pull request shipped -- pushed from the anchor the
attempt was leased against, onto that pull request -- is settled from the head it ended
on, the same proof a leased no-op buys
late_transfer_telemetry.py
the one record a settled transfer leaves on both sinks -- one `late_transfer` event
naming both pairs, the pull request, the rewrite kind, and which reading proved the
push, correlated by a generation minted from what the pinned comment already says, since
a transfer runs past the retirement that dropped the pair it was adjudicated under.
Called by `late_push` on the far side of the write `late_rotation` stages into rather
than by that owner, so the ordering is a property of the call site: a receipt GitHub
refuses ends the tick and reports nothing, and a rotation that moved no verdict -- a
permission left standing, one the publication went past -- says nothing either. A
settlement whose record was lost is reported from the proof the comment kept, with the
proof dropped durably behind it, so a later poll has nothing left to report once that
drop lands.
Deliberately no second `late_verdict` beside it, which would read as a second
adjudication of work nobody was asked about twice. The proof the settlement kept for
this record is dropped by this owner's own write, ordered after it: a comment still
carrying one MEANS a report is owed, so left standing it would say a settled transfer
had never been announced. A drop GitHub refuses is logged and walked past, since the
record has been made and a later tick may make it again
late_terminal.py whether the work a late record still owes a push for has already ended, asked ahead of
every road the reconciliation takes because all of them publish while the terminal that
drains such work runs inside the stage handler behind it. Two facts, since an issue's
own flag shows one of them: the OBJECT the tick opened with, and the PULL REQUEST the
record names -- a merge leaves the issue open until a stage terminal reads it, and the
gate below refuses to freeze an entry against either ending, so the road would
otherwise park a human over a publication that is finished. Read fail-OPEN, so a remote
that would not answer falls through to the road that parks with the reason it fails
for; the same fact immediately before a PUSH is `late_publication`'s and is read the
other way round, since what falling through costs there is a branch nothing can put
back. Asked behind the caller's record questions rather than at its door, because the
pull-request half is a request and this runs ahead of every stage on every dispatch
late_reconcile.py the reading the dispatcher takes for a pair frozen and never counted, scoped to the
stage the record names and taken with no run behind it: measured at or under the ceiling
the candidate is PUBLISHED before the stage runs -- nothing goes back for a push a
settled reading left owed, and the stage behind an unpublished one spawns a reviewer over
a pull request that never received it -- measured past the ceiling the issue is routed to
the adjudication, and a refusal parks. So does a push that was allowed and did not land.
An approval with no generation left behind it is the same window one step on, and
`late_debt` beside this answers it.
Both roads end in a PUSH, so work that is already OVER is handed back ahead of either,
which `late_terminal` answers and this owner only places: behind the three record
questions, since the pull-request half is a request and the only ticks its answer can
change are the ones with something left to reconcile.
It stops the tick outright where the checkout that pair names is not on this host and
where the label has left the stage the pair was frozen on, since neither a re-entry nor
the handler is this process's to pick -- and it retires its own measurement park on a
record whose split has settled, which is a group with no count that owes no reading.
Ahead of every answer it makes the record a settled transfer never got to report, since
every settled rewrite's crash comes back through this seam and no other is guaranteed to
late_claims.py what a post-publication record claims and what it cannot produce: whether a live one
still owes its count, and -- ahead of both reconciliations -- the five refusals a record
that cannot make a claim whole earns. Read off the RAW fields, because the parse is what
loses them: a group missing one member comes back as no group, an approval missing its
lease as no approval, a frozen field the comment CARRIES and no reader will type as a
field nothing froze, a spend group with one unusable member as no bookkeeping at all, and
a settled transfer's proof nothing can report from as no report owed
-- so every question behind them answers "nothing owed" and the stage runs over a claim
nothing can check, while the freeze quietly re-derives the half it cannot see from a
remote that has moved. A field the comment does NOT carry is the same gap: what the
write that mints a generation puts down in one go is required rather than merely checked
when present, and a base is required beside any count, since a number is taken over a
pair. All five claims on the five stages the transition graph's own set names, since
`workflow:implementing` has an edge to the adjudication too and its approval carries no
head by design; `workflow:decomposing` is asked the publication one and the transfer
proof's, because that group is what a settlement decides everything by and cannot
re-derive and a proof nothing can report from is damage in any mode, while a verdict
taken before publication approves its commit with no head to pin it against -- the very
half-written pair the approval claim calls damage
late_debt.py the approval the dispatcher pays ahead of every handler, where a crash past the write
that granted one left no generation to reconcile from: that write retires the record
before the push, deliberately, so what is left names a commit the pull request never
received and nothing under the stage reads it. Paid under the id the gate decided about
and the head it decided against, both of which live only on the approval by then --
and only from a checkout still standing on that commit. One that is absent, unreadable,
or standing elsewhere PARKS rather than standing down: the debt says a commit the pull
request does not carry was allowed to join it, so a handler behind any of those reads a
publication the approved work is not on. A push that LANDS closes what its caller never
got to -- the route bookkeeping the approval carried past its own retirement, and the
transient park that failed push left -- since no tick behind this one can, and one that
misses again leaves both alone and says nothing: a second mention is one nobody can
answer any faster, and a rewritten reason turns a park the stage recoveries retry into
one only a human clears. The commit is read ONCE and named to the gate,
so the proof that the checkout is standing on it and the reading the gate takes behind
it are about one approval: a commit landing between the two is refused rather than
measured, pushed, and receipted while the debt it was granted for is dropped as paid.
A branch some owner deliberately moved off that commit never reaches here -- the auto
rebase's own reset drops the approval it abandons. Payable only from the five stages the
transition graph's own predicate names, rather than from every label with an edge to the
adjudication -- `ready`, `blocked`, and `umbrella` each have one for reasons of their
own, none of them a pull request -- and a debt whose label has moved to one of those
stops the tick rather than being ignored, since the stage behind it would run over a
publication the approved commit never reached
late_gate_models.py frozen gate calls, publication provenance, caller-owned route spending, and gate verdicts;
publication ids distinguish absence from damaged claims, and the close latch stays shared
late_identity_reading.py
retained measurement misses, inherited root/depth, and generation identity validation;
unreadable or foreign records cannot supply a reportable identity
late_records.py gate construction and candidate-generation minting; identities advance durably, the frozen
candidate owns its spent readings, and existing publication context is retained
late_freeze_guards.py reject missing measurement fields and foreign identities before a retained pair is used;
an unfinished base permits only that field to remain absent, preserving its original ceiling
late_freeze.py prove the candidate, freeze or recover its exact base, and account for failed base reads;
refuse a head differing from the caller's commit or a reconciling tick's record, and
recover retained bases by object identity; a permit-only caller is never kept out
of the gate by the switch
late_evidence.py what a recovery proves before it acts: the checkout, both recorded objects, a
head that is still the candidate, and a head that is still the commit an approval
owes a publication for -- proved ahead of every spawn
late_verdict_retirement.py
retire the generation inside the observation window; a close before or inside its write
leaves a durable cancelled cycle for cleanup, including reinstatement after retirement
late_verdict_debt.py keep unmeasured candidate, lease, basis, and route spends together; stage debt with a
transfer or persist it before publication, drop superseded approvals, and spend the
caller's owed fields before routing
late_verdict.py approve accepted or authorized work, route oversized work with its unpublished notice,
retire answered parks, and coordinate generation retirement with route and publication debt
late_approval_reading.py
whole candidate/lease/basis approval reads and explicit operator-backed bases; damaged
and legacy bases remain distinct from known permissions
late_approval_state.py
coordinated approval writes, preservation of an existing candidate's basis, and debt
retirement together with its owed route spends
late_publication_state.py
exact commit, lease, and PR receipt reads and writes; the recorded issue pointer stays
distinct, and recovery receipts must match the attempt's head and publication
late_receipt_damage.py
whole-receipt validation, distinguishing absent or empty records from missing members,
unparseable claims, and nonempty receipts lacking a commit or publication
late_measurement_state.py
notice ownership and quiet transport-retry coordinates, including held parks; reaching
the base clears misses and a completed measurement also clears its failure
late_park_retirement.py
targeted retirement of measurement, authorization, and settled-split parks, and explicit
supersession of the current wait -- save, beside a pinned auto-rebase anchor, a park
neither the attempt's nor the late domain's (`engine/rewrite_takeover_parks.py`), which no
hold answers; unrelated park reasons remain standing
late_park_state.py persist generations and route spends, retire a measurement park bound to another candidate,
and consume a held authorization's command watermark monotonically
late_park_notices.py operational failure descriptions, stage-attributed events, and measurement park notices;
the failure is emitted before the wait is recorded, and whether that park already stands
is what an announce-once refusal asks before taking it again
late_measurement_reply.py
bare-continue batches reserved for the active measurement park; mixed feedback
stays with its stage and the current reason and wait must agree. Which replies count
is `parked_replies.py`'s cut, so the park's own notice cannot make the batch look mixed
late_parks.py quiet transport retries and announce-once measurement failure handling; changed frozen bases
remain durable during a quiet repeat, and a different failure earns its own notice;
an unreadable candidate retains its resolved object id for recovery
publication.py the push -- named against the commit the gate decided and pinned to the head the
answer that admitted it was about: a published approval's frozen head where there is
one, and the CANDIDATE itself where the gate admitted it because its pull request is
already standing on it, since a lease the transport reads for itself adopts whatever
tip somebody moved to in the window and force-pushes over it -- work that ENDED
refused immediately before that push, which `push_barrier` beside this owns -- the
pull
request opened or reused for it, which is that same pull request by NUMBER on the
delivered road and never a second one where it closed in between, and the commit the
push carried (decided once ahead of the push --
the one that passed the gate, or the checkout's own head where the switch named none
-- and made durable there, with a checkout that can name none at all publishing
nothing); the receipt naming that commit and pull request is written the moment the
pull request is known, before one this tick opened is announced, and everything from
there to the relabel is handed to `report_handoff.py`, the handoff left owed wherever
that refuses it, so the next tick republishes the same commit onto the same pull request
report_handoff.py a landed push to the handoff: the description judged on a fresh read, the report the
run delivered bound and published through `engine/report_binding.py` with that verdict
-- a binding or settlement whose guarded write did not land over the comment the tick
read, refused over a moved comment or never confirmed, or a post that left the report
owed while another road wrote the comment, withholds the handoff right there and says
nothing, since the tick's state is withheld and no park behind it could be recorded --
and the relabel reached last -- held until no report is still owed (a debt no retry
can pay -- no record left, or a report a human edited, removed or wrote untrusted, per
`engine/report_evidence.py` -- parking for a report-only reply), the issue's
requirements read afresh and then the report settled for this commit, read where it
settled, still stand (the check `unreported_recovery.py` asks too, before a recovery's
push) -- or, where no report covers the commit, the requirements still answer the drift
check against the revision the run was handed, held unparked for the drift resume where
they do not -- the checkout is proved after those requests, and the description, read
afresh again, closes this issue and names the session
push_barrier.py what may have ended between this tick's readings and the push it is about, asked
immediately before the transport and nowhere else: everything above spends a run, a
reading or a proof, and each is time a poll on another worker can find the world
changing under. Two endings -- a close a poll LATCHED, which the issue object cannot
give since it is the snapshot the tick opened with, and the pull request this push
would JOIN, which is the one the gate proved where it proved one and otherwise the one
the RECORD names: reuse is a lookup by branch, so one that ended in the window answers
nothing to it, a second pull request is opened over the work, and `pr_number` is
overwritten with it. The pull request is read first and the latch last, since the
reading is a request and a close landing while it is in flight is one only an answer
taken after it can still give. One ending is not an ending for this push and is the
reason this is an owner rather than an open-state check: a `discussion` plan the humans
SETTLED is an agreement rather than a delivery -- the stage ahead lets such a tick
carry on for the same reason, since finalizing on it would close the issue `done` with
no developer having run -- and what it licenses is an implementation with a pull
request of its own. Told apart by the two records the stage's own terminals use, read
off the same reading rather than a second fetch, and never offered to a number that
came from a proof, which no plan publication can produce. A record that NAMES a pull
request and cannot produce one is the third answer and refuses outright: absent is an
issue that has published nothing, which this seam's own first push is for, while a
field that will not type is the record disagreeing with itself and read as an absence
would buy exactly the push this owner withholds. Refusing writes nothing
checkout_guards.py the proof that the worktree is still the thing that was measured, asked of the
commit AND of the tree because work can appear beside a commit without moving it:
a head that has left the approved commit, and a tree that cannot be proved to carry
nothing, refused before the push -- where nothing is published and the commit stays
where the developer left it -- and refused again once the pull request is open,
where the publication stands and only the handoff stops so review never reads the
descendant; every one of them parked under the one reason a moved checkout earns,
named after the commit to go back to or the paths to clear, and settled by the
worktree rather than by a reply. The moved-head refusal writes the whole approval
group as it parks, through the same owner the publication mints one with: it stands
exactly where that publication would have recorded the debt this seam owes, so a
candidate a receipt or an exemption admitted would otherwise be parked as a commit
with no account of what its push rests on
checkout_recovery.py whether the checkout is the commit that was decided about, on the two parks that
turn on it. What a handoff refused for its checkout waits to see back is the only
park in this stage settled by a worktree rather than by a reply: the commit the
size gate approved under the checkout's own head, with a provably clean tree
around it -- both halves, since a proof narrower than the refusal it answers would
republish straight into that refusal again -- read off the commit the park wrote
down, on every ordinary tick rather than on a command, and silently, so an
operator who leaves the checkout where it is is not told the same thing once a
poll. The authorization park asks the same question one field over and is told WHY
rather than yes: what the seam past it measures is whatever the checkout is
standing on, so a head that has moved is a candidate the exemption does not cover
and the override does not name -- the policy's door closed, the ordinary road
measuring it, and a commit nobody authorized pushed under a command that named a
different one. Which commit that park is about is read off the record rather than
off an approval, the recorded override first since it is the terms a human agreed
to and it outlives the generation a failed publication retires, and a record
naming no commit at all held rather than published under
dev_pr.py what that pull request says and whose work it says it carries: the title taken from
the branch's own first commit subject, falling back to a prefix inferred from recent
base history so it reads like the repository it lands in, less the tracked issue's own
trailing reference, which the title owner under `git/publication/` takes off whichever
line it reuses since the body below is what links that issue; the body pairing the
`Resolves #N` that closes the issue with the dev session the branch was written by
and the run's closing message, cut on a paragraph, line, or word boundary and marked
as clipped where it outgrows the cap, with a fence the cut left open closed first --
that message written only where the issue neither owes a report nor has one settled,
since the report comment is the authority and a capped excerpt would be a second,
unmarked copy; and the reuse of whatever is already open on the branch, which `find_open_pr`
promises nothing else about, handed back with its description untouched for
`pr_description.py` to judge. Opening one announces nothing: `_announce_opened_pr` posts
the comment and emits `pr_opened` once `publication.py` has written the receipt naming
it, so a response lost there leaves that pull request recorded. One road names its
pull request instead and may
OPEN none: a publication the gate admitted because that pull request already carries
the commit is finishing bookkeeping rather than publishing, so it is resolved by
number and re-read WHOLE -- open, in this repository, on the branch the push named,
and standing on the commit it sent, off one fetch and against the object handed on,
since what this writes is a receipt naming that commit and a relabel handing a
reviewer that pull request. One somebody closed OR MOVED between the gate's proof and
here holds the tick rather than earning a second pull request over the same work or a
receipt naming work the branch no longer carries
pr_description.py the report-aware verdict on a reused description, read afresh by number, which
`report_handoff.py` asks before the binding and again before the relabel: one closing
this issue and naming this session stands, and any other is held for a human, the two
lines quoted in the notice. It WRITES no description: GitHub offers no conditional write for one, so a
body built from any reading can overwrite an edit saved since, and human text, legacy
tails and concurrent edits stand as found. A failed re-read holds silently; one a
report claims -- delivered, pending, settled, or too damaged to say -- is left to the
binding's collision park while that report is owed, and parks here once it has settled
handoff.py the one write and the one relabel a finished publication is handed on by, spending the
park reasons reaching that line answers -- the agent timeout, the execution failure,
the silent or quota park a shipped commit got past, and the report this publication
could not deliver and since did: the pull request and the branch recorded
together, since a state that arrived without a
branch would leave the next tick resolving the legacy name while the live pull
request sits on the slug-namespaced one; the plan SHA, the certified baseline, the
handoff anchor, the pair an authorization handoff carries while it is still in
flight -- which a poll finding them would read as a call into the seam that never
came back, and put a spent park back over an issue bounced here later -- and the
commit an approval said was still owed a push all spent
beside them; the reading that handoff staged CONSUMED rather than dropped, since two
of the seam's roads publish without reading the thread at all and the reply that
ended the park would cross this line unread, to be taken for fresh feedback on the
stage it lands in; the review round, the retry budget, the granted attempts, the
silent-park streak, and the `pre_implement_sha` watermark a timeout recovery and a
failed run's attribution read all reset, since the issue moved
forward and any of them left behind would mis-fire a later hop back into
implementing -- and every one of those written durably AHEAD of the
`workflow:validating` label, so nothing this line spends is stranded on an issue
that has moved on and a relabel that fails leaves the branch recognizable
park_correlation.py the bounded payload the two parks below report beside their reason, since neither can
reach the shared funnel's: the caller's route, the session and exit status off the
result, and the pinned counters -- screened against the funnel's own allow-list, and
built from no part of what the agent wrote
checkout_parks.py dirty and unreadable checkout refusals, operator messages, and staged park events; both retain
the work and use the shared watermark reader after posting their notice; the refusal
reports which half failed, how many paths git named where it named any, and whether the
run had timed out
parks.py classify session limits, unfinished commands, transient provider failures, real questions,
and silent exits; retryable failures keep their reason and streak, while a question clears
both, and the execution-failure and quota parks keep the run's `pre_implement_sha`
floor for a continue retry's attribution. A quota stop comes first -- a failure
record's quota verdict, read without the final message and ahead of unfinished command
diagnostics, or a Claude notice matched as a prefix -- and an Antigravity one's notice
explains the exhausted account with the reset interval and diagnostics; structured
unfinished command diagnostics precede the remaining message checks, where the final
message picks the branch -- the provider phrasings matched as a prefix, an empty one the
silent exit -- reporting the branch that ran so the emitted vocabulary stays closed
however the agent phrased itself
drift.py a body edit mid-implementation: the resume it earns -- withheld while a continuation
has bought an attempt, since a resume passes no gate and the attempt is owed as a fresh
spawn -- and the `ACK:` that answers it. A commit-less reply bringing the report an
undeliverable-report park asked for publishes the commits already on the branch; on a
parked tick only an edit reaches this road, a reply going to the park's own resume.
What the resume quoted is settled by its disposition, and a pre-session edit by the
spawn that answered it, for every outcome that reached an agent and no other -- the
shutdown kill, the live pause and the launch the circuit turned away each returning
before anything is written. That settlement is also what records the new baseline:
nothing here stages it ahead of a run, since a baseline written for a prompt nobody
read marks the edit answered and hands the words under it on as already delivered
drift_preflight.py a pre-session edit -- handed on rather than consumed, since clearing a park delivers
nothing at all -- the refusal that records nothing about the edit and its own reason
durably instead, so the tick after it recognizes that park, says nothing again and
stands down to the resume the reply it asked for belongs to, the quiet
timeout recovery, held off by that reason and by a reply the
tick's frozen batch would deliver, and the awaiting-human resume on that batch
continue_command.py `/orchestrator continue` on a parked issue for retryable session failures (`agent_silent`,
`agent_timeout`, `agent_execution_failed`), opening with the one park below that the
classifier here would refuse the right command on, and handing back outright a
batch the measurement park's own road would re-measure on: this read comes after
that road looked at the thread, so a command landing between the two is in this
batch and in nobody else's -- and classified here it is a continue on a park
needing real guidance, refused and consumed past the refusal, with the reading its
author asked for one nothing will ever take. What it classifies is the tick's one
frozen batch (`_parked_batch`, frozen here and handed on to the drift check and the
resume) -- the replies the resume would DELIVER -- so a notice of ours or a forged
marker above a bare command cannot turn an explicit retry into a generic resume over
prose. The retry is re-grounded, wherever its session is missing or retired, off that
freeze's conversation less the commands it consumes
retry_cap.py the same standing park on this stage's road, held against the three that would read it
as an ordinary one -- the continue classifier, the drift check, and the resume -- so the
tick ends having written, spawned, and said nothing, and the pinned session, the pull
request, an approval's unpushed commit, and the late record stay as they were. The
refusal it still records, the sentence it waits to have said before any thread is read
for an answer, and the trusted `/orchestrator continue` -- looked for anywhere in the
unread batch, taken with whatever else its comment carries -- that retires the session
and renews the budget for exactly one spawn, written down before the spawn it pays for
read_only_relabel.py the `question` / `discussion` relabel screen: which park it answers for, and the
acceptance write that retires the conversation's records and hands its round anchor
on as the floor the dev run is measured against
relabel_hazard.py what a relabeled issue's branch and checkout are carrying, with every reading that
convicts reported together so one refusal names all of it
relabel_evidence.py what those readings have grounds to vouch for a tip sitting on -- the tip the round
opened on, the head the plan PR is on, and the ahead-of-base question a merged plan
takes back
relabel_refusal.py the idempotent `<stage>_unsafe_relabel` park a finding earns, and the remediation
aimed at the tip worth keeping
plan_reading.py what the recorded plan PR carries and where that leaves the branch, read afresh by
both halves rather than remembered
plan_handoff.py the reconcile that keeps an accepted plan handoff in step with its PR until a
developer commits, and the marker that makes its own re-anchor recoverable
models.py the frozen records the owners hand each other, including what a fresh spawn quoted and
what a requirements edit leaves the rest of the tick
state.py the pinned-state keys and CLI marker tuples they share, the label a report this stage
delivers records as its route -- a wire value like every key beside it -- and the two
retry bounds: the silent parks a session survives, and the readings one frozen pair
may lose
in_review/ `in_review`
handler.py the order one tick asks its questions in, and the missing-`pr_number` park asked before
the rest -- with an approval that no longer covers the work, stale by a requirements
edit or recorded against another developer report, asked right behind the terminals
feedback.py the four surfaces scanned before the drift check, their author filters (a bare
`/orchestrator add-agent-runs` is nobody's review), and the park that stays silent for
the base-sync retry loop
fixing_route.py the pending-fix bookmarks, the hash refresh, and the `workflow:fixing` relabel
drift.py a body edit on an open PR: the move to `workflow:validating` it owes staged with the
refreshed requirements hash, since every write the disposition makes persists both and
the hash is what stops a later tick re-detecting the edit -- a report recorded or a
debt withheld says the move is owed on the roads that leave one, and the marker says it
for the `ACK:` and the park that leave none, so neither may become durable without the
other; the unread PR conversation captured first and frozen with the bounded issue
excerpt into ONE delivery record, settled after the run and only for an outcome that
reached an agent -- the issue thread's own cursor and the requirements revision, and no
more, since the cursor the two surfaces SHARE covers a numbering this record read at two
moments and only the carry's merged re-read can answer for it; neither review
surface moves at all, as no prompt here reads one -- with the carry over that record
taken BOTH before the disposition -- so the first durable write that disposition
makes carries it, rather than a process dying mid-way leaving a report and a push over
feedback still marked unread -- and after, for the notices the disposition posts; the
dev resume
under the requirements revision that record fingerprints, and the `workflow:validating`
return a pushed fix, an `ACK:`, and a report alone all take -- the fresh round and the
marker saying the move is owed persisted BEFORE that relabel, since a label moved first
and a write then lost hands the reviewer the budget the stale approval was earned
under, while a relabel that does not land leaves both durable for the next tick to
move -- and the report bound only once the relabel is behind it; and the hand-back a
later tick gives an issue whose approval an edit made stale, read off a report it still
owes (a failed push, a held candidate, a tick that died mid-way) or off that marker,
which is the only thing an `ACK:` and a resume that PARKED leave, or off an approval
recorded against another report than the current one or of one since edited or
removed at its location -- a location nobody could read holding the tick -- a question
answers
the edit with nothing, so the move is owed from there too, and made ahead of the
feedback scan that would otherwise route the answer to `workflow:fixing` -- with the
comment a human wrote while the resume was out still unread beneath the carry, so the
move hands on the reply they wrote. A publication still owed when either move
is made is recorded as belonging to the budget that reset gives it, so the road that
lands it on `workflow:validating` spends no round the edit has already paid for
merge_gate.py the unmergeable park -- bounded, since the scan that let the tick reach it ran several
round-trips ago -- and the one HITL ready-ping an approved, unvetoed head earns per head
SHA, which is no park and carries no mark; a fresh approval retires the stamp, so a
report re-reviewed on an unchanged head is pinged again, and the subject the approval
covered is read again at the ping itself -- the report at its location, the requirements
over the issue read afresh against the approval's revision and the baseline, the head
over the pull request read afresh (`review_coverage.py`), and last the report records on
the pinned comment -- since the requests before it are time another
road can settle a later report in, a human edit the report or the issue in, or a push
move the head in; refused or unread, nobody is pinged and nothing written. The park
asks the pinned comment the same before it writes
surfaces.py the two reads the shared IssueComment id space is taken as -- the issue thread against
the delivery cursor an issue-only resume settled as well, the PR conversation against
neither -- and the raw merged read tagged by surface that the watermark walks consume.
The thread cut takes a caller's OWN read of that surface where one is handed in, since a
caller deriving more than the batch from it -- the conversation a fresh spawn quotes,
the requirements its report is stamped with -- owes each of those to the same read
watermarks.py how far a park's own notice may carry the issue-side mark, and the legacy seed a
manually-relabeled issue needs -- both walks forward from where the mark is, over what
they can vouch for, and neither reads a tip. The carry is handed the tick's frozen
delivery record rather than the read behind it, since a bounded excerpt delivers less
than it read and the context it cut is what the walk has to stop below
models.py the per-tick handles and the drift-resume record, which carries the delivery its prompt
was built from -- what the issue may mark answered, and the revision its report is
stamped with, off the one read
state.py the issue-side watermark key they share, the marker saying this issue owes
`workflow:validating` a label move its own relabel did not land, the predicate reading
that marker beside a report still owed, an approval of another report, and one of other
requirements than `user_content_hash` holds -- whose own test is spelled here -- and the one
staged write spelled here rather than at the owner that makes it: every field the
hand-back puts down, asked by the report reservation so a field added moves it too
question/ `question`
handler.py the order one tick asks its questions in, the closed-issue finalize that outranks them,
and both worktree teardowns
run.py the resume and fresh-spawn routes, the tracked spawn they share, and the park funnel every
exit lands on -- which is also where the bounded correlation every park reports is
built: the road off the tick's own record, the role, the pinned conversation, and any
recorded pull request, screened against the shared funnel's allow-list and read from
no part of what the agent wrote
session.py the locked question-agent identity, the trusted-reply consume, and both prompt builders
outcomes.py the read-only violations checked before any answer, and the park each outcome earns
models.py the tick record and the road it opened on, the locked session, and the outcome
state.py the park reasons and pinned-state keys they share, plus the role a run is attributed to
and the two route names a park is recorded under
validating/ `workflow:validating`
handler.py the order one review tick asks its questions in, opening with the retirement of a
handed head a lost `resolving_conflict` write left claimed, the terminals, and the
recorded-collapse route it asks behind only those, ahead of every route that could
point an agent at the branch -- and the report hold it asks last, behind the drift resume
that would supersede a stale report and ahead of the reviewer spawn, settling a park the
awaiting-human branch cleared into a round the hold then stops, or beside a verdict the park
outlived, in one guarded commit over the comment read afresh
(`review_resume.settles_a_bought_round`). It keeps the pinned comment as the tick read it,
before any road below stages a move, and hands it to the reviewer round, whose binding
reading is measured from it. Behind the hold and ahead of the round cap and the spawn, a
reviewer verdict an earlier tick persisted and never disposed of is finished in place of a
round (`review_resume.py`)
reviewer.py the round cap, the tracked reviewer spawn and its two refusals, what a round that RAN
records about the reply or grant that bought it -- taken from the one read its OWN prompt
was rendered from, under that prompt's bound, never from the unbounded batch a park froze
for a developer, and owed to that reply whether or not the park outlived the tick that
cleared it -- and about the note a deferral left, which that round discharges -- and the
verdict fan-out: a timeout or a missing verdict parks with the run's return recorded by the
park's own guarded commit, prepared before its notice (`review_writes.parks_the_return`),
and so, behind the timeout and ahead of any VERDICT parse, does a Codex reviewer whose
last turn failed on the account's usage limit (`reviewer_usage_limit`, read off its
JSONL stream by `provider_failures.codex_usage_limit_failure`), its notice naming the
limit, the provider's reset, and the trusted `/orchestrator continue` that retries it,
and an approval or a change request goes to `review_disposition.py`, which
records that return over its own last reading, so the usage is folded once. The developer
report is resolved through `review_report.py` ahead of the spawn and the subject it yields
committed beside the reviewer spec before the spawn, over the comment as that resolution
read it (`review_writes.lands_the_launch`) -- decided on the report records, the pull
request, the returned-verdict record, and the spec and subject themselves there, so one
that moved, a comment that will not read, or an edit never confirmed spawns no reviewer --
once that reading is laid over the
state the tick holds, measured from the comment as the tick read it, and what the commit
landed over laid over it behind that, so a run another road charged and folded or a
notice it posted while the subject was resolved is kept by every write of the round; behind
that commit the verification evidence current for exactly that subject is asked through
`review_evidence.py` and handed to the prompt beside the report; the launch charge written
behind it is taken into that reading as well, so a later charge another road writes is never
mistaken for this round's own and written back over; the pinned comment is read again
through `review_comment.py` as the reviewer returns, before any park or record the run
leaves is written, the run measured from then on against the comment as that reading found
it, and the disposition holds the verdict to the whole subject standing, the pull request
the issue points at included, with the comment read once more behind that resolution
collapse.py whether a squash this issue began and did not finish is answered before anything else
runs an agent -- and, where nothing claims one, whether current evidence carried onto a
head no longer answers for its review or is no longer named by the approval's claim
(`squash_evidence.carry_unanswered`), which is invalidated with the approval resting on it
in a guarded commit of its own ahead of any round, staged on the comment read afresh, held
to the bound evidence records -- the report debt its review subject stands only without
among them -- and to the approval's claim (`squash_evidence.CARRY_ANSWERS_ON`) at that
reading and under the commit, and owning only what it retires
(`squash_evidence.INVALIDATES`) -- over the same tail the
approval road runs -- what the branch is owed
does not depend on which reading sent the tick. Asked only from that road it would be
asked on no tick whose reviewer times out, crashes, or votes CHANGES_REQUESTED: an
already-landed collapse would never get its notice, its watermarks, or its relabel, a
record nothing can read would reach `fixing` without the park it owes, and a body edit
would resume the dev on a branch standing on a commit nobody accounted for. Presence
on the pinned comment is the whole test, so an issue with nothing recorded costs one
lookup; ABOVE the drift resume and the awaiting-human branch both, which is what makes
the park its own to answer -- its own refusals park under a durable `squash_failed`
and are retried every tick without a second mention, while a park the size gate worded
is held until the human replies and that reply is then spent on the recovery rather
than on the dev; neither road holds a returned verdict, so one waiting beside the handoff
holds the move while the handoff record ends; and the checkout is READ where it is there
and rebuilt only where it is not, which is the one thing this route may not borrow from the reviewer road:
ensuring a worktree force-removes a checkout carrying no commits over its base, and
that is exactly what a collapse rewound and not yet recommitted looks like, with
every change it was about in the index -- which is why the subject the squash tail
decides over is built here, off that reading, rather than a layer down off the pieces.
The settled handoff is answered beside it and needs no checkout at all: the label
a finished squash never got to move is moved here, but only while the pull request is
still standing on the commit that handoff named, the developer report recorded as
current is the one its approval covered and still reads at its location as it settled,
and the issue read afresh still carries the requirements the approval was given and the
baseline holds -- a report settled on that same commit since, edited or removed in place,
or an issue edited since, is work no reviewer has read, and the record goes for the round
below to answer; a location, an issue, or a pull request nobody could read holds the tick.
The move is also held to the approval's evidence answering for that commit
(`squash_evidence.py`): a carry the squash tail recorded is settled by the reconciliation
ahead of this handler, and one the tail could not decide is decided here in a guarded
commit of its own (`handoff.CARRIED`), the move left for the next tick. That proof is
taken ahead of the coverage, so the
pull request is read last before the move, and a handoff the coverage drops takes a
settled carry onto its commit into history with it
approval.py the verify gate and the squash-and-hand-off tail both roads run, over the subject,
branch, and pull request number whichever road decided them hands in, holding at most
the returned verdict of its own run's round and subject and retiring only that one, in
whichever write it makes, save where the subject would not read. Behind the gate,
whatever it said, the subject is resolved again and the pinned comment read last,
watching the verdict beside the report records and the pointer, an evidence record moved
there a move too: a failed gate parks through `review_parks.py` only over that subject
still standing, and otherwise the run is recorded with no park. A passed one posts the
approval comment and resolves the subject again behind it, holding the comment's records
(`handoff.py`), before the review subject is recorded as approved, riding whichever write
the tail makes, and the squash is taken; the relabel that tail owes is held wherever that
approval no longer covers the report the pull request carries, the requirements the issue
carries, or the head the rewrite published (the approved head where it rewrote nothing),
each read afresh, the rewrite finished either way -- the one check the recovery of a
squash an earlier tick did not finish gets -- and nothing it holds is posted or written
past a published rewrite, nor the label moved on either road, where the pinned comment no
longer carries the report, pointer, verdict, or evidence records in hand or the review
subjects, claim, report debt, park, or collapse records the tail last read or wrote, nor
past a
returned verdict still waiting there, a later review than the approval; that number
read as an identity before the squash subject may reference it: the optional squash,
the park each of its four readings earns, filed through `review_parks.py`, the notice
its count is worded from --
posted ahead of the seed it orders, and the one failure that stops the road, since
the count lives only on the collapse record the next tick would otherwise drop -- the
end of that record, and the `workflow:documenting` relabel that lands behind that
write rather than ahead of it, with the commit the move is owed over left on the
comment across that boundary -- for an approval that collapsed nothing too, over the
head it was given -- so a relabel that does not land, or that write landing with its
response lost, is the next tick's to retry rather than the next reviewer's to re-review.
That write also carries the evidence the approval rests on onto the head the rewrite
published, decided ahead of the comment it is laid over (`squash_evidence.py`), and the
relabel waits for the carry to settle; a carry the fresh candidate has no room to record
or settle is invalidated in its place (`handoff._Held.settles`). Every write of the tail
is a guarded commit over the comment read afresh (`squash_writes.py`), decided on the
records the tail holds and every record a report debt is read from (`handoff.HELD_ON`) and
owning what it declares: the verdict's retirement (`RETIRES`), the handoff -- the verdict,
the approval and its claim, the park, the collapse record and its handoff, and what a carry
or an invalidation writes (`HANDOFF`) -- and the end of the handoff behind the label
(`_ENDS`); a refused write writes and relabels nothing, records what the tail posted, and
retires its verdict where a record the approval was proved over -- a report owed among
them -- moved under it, and one never confirmed is acted on no further. A park or a
collapse record another road puts down during the verify gate holds the arc with nothing
written and the verdict kept. The record is ended behind the label only where none of
those records or subjects moved during the relabel, so documenting hands a moved one back
to be answered
handoff.py what that arc posts on the pull request, seeds after, and holds its writes to: the
approval comment whose failure is logged and walked past, the squash notice its count is
worded from, and the in_review watermarks in two halves -- the snapshot taken behind the
caller's notice so the seed walk steps past the notice's own id, abandoned outright on an
unreadable PR rather than stranding an approved branch on a read, and the ratchets
reached past it, which is what each of the three watermarks becomes against what is
already persisted -- and the records every write of the tail is held to behind its
requests (`_holds_its_records`): the report, pointer, verdict, and evidence records in
hand, and the three review subjects, the approval's claim, the report debt, the park, and
the collapse record and its handoff as the comment carried them when the tail last read
or wrote it -- what every proof since was taken over, and what the tail clears and ends
itself -- the state laid over the comment as
read, measured from the comment as the tail last read or wrote it (`_Held`, which also
carries the run the approval's verify gate made) -- behind the squash, the last write the
squash made, or the reading before it where it made none -- and, where they moved,
nothing written but the
ledger entries of what the tail posted and -- where a record the approval was proved over
moved, not a park or a collapse another road put down -- the end of the verdict it holds,
in a guarded commit of its own, the tick's state withheld; the guarded writes the tail
lands each write as (`_Held.lands`), decided on every record it holds and every record a
report debt is read from (`HELD_ON`) and what each owns (`RETIRES`, `HANDOFF`, `CARRIED`,
`SQUASH_PARK`), a refusal over a record the tail holds answered as one that reading
caught; the commit carrying what the squash's evidence owes the head, a carry the fresh
candidate has no room to record or settle invalidated in its place (`_Held.settles`);
and, on
`_Held`, the proofs the arc asks behind the
approval notice: the round's checkout still on the head the approval was of and clean
(`checkout_stands`), since the branch is handed on from it, and the evidence its verdict
was proved over (`evidence_stands`)
squash_writes.py the guarded commit every write of an approval's tail lands through (`lands`), under the
developer report's tick-state guard (`engine/report_commits.py`): a refusal or an edit
never confirmed writes nothing, withholds the tick's state, and licenses nothing behind
it; the collapse record and its handoff a squash's writes own (`COLLAPSE_RECORDS`); and
the client the approval's squash is handed on its gate, passing every call through,
holding each write of the issue's own pinned comment to the records in hand, laying it
over the comment first, and landing it through that commit (`handoff._Held.follows`),
taking it, once it lands, as the one the tail last wrote. A write whose records moved, or
whose commit did not land, is refused as a write GitHub refuses is, so the squash never
puts an older report, round, or verdict back, and leaves the state, the reading it is
synced with, and the tail's last reading as it found them -- so a field another road
wrote, which the reading ahead of it took in, is never read as one the tick deleted; and
since the squash's reply does not say
whether it wrote, measured from the reading before a squash that wrote a usage fold its
write carried would be counted twice, while taken whole behind one that wrote nothing a
round another road spent meanwhile would be written back over. A write of another
issue's comment is neither guarded nor followed
verify.py the approval's local verify gate: its run of the configured `VERIFY_COMMANDS` under
`VERIFY_TIMEOUT` over the round's checkout (`_runs_the_gate`), which the squash carries
as evidence where it publishes another head (`squash_evidence.py`), and how a refused
result reads: the reason and the words of the park it earns, which
the arc files through `review_parks.py`; `ok` and the `not_run` an empty
`VERIFY_COMMANDS` returns both advance instead
squash_evidence.py the verification evidence an approval's squash carries onto the head it published: where
the approval's claim names the current evidence and that evidence answers for another
head, the carry-forward decision over the trees, context, review subject, and publication
(`verification_carry_forward.py`) -- of the run the approval's verify gate made on the
approved head where it binds, as orchestrator-executed evidence, and of the reviewer's
evidence otherwise: an empty configuration, or the recovery, which runs no gate -- taken
ahead of the comment the squash tail's handoff write is laid over, and what that write
stages -- the carried transaction, naming the evidence whose transcript it copied, and the
claim pointed at it, or, refused, the evidence invalidated, the approval it answers for
retired (its subject written null; one another road recorded in its place, of another
subject, stands), and the handoff dropped for a fresh reviewer; an unread decision stages
nothing and is decided again by the handoff, and a carry already recorded and still owed
for its approval -- its settlement stood down for want of room -- holds the move with the
handoff kept. Evidence answering for the head only through
a carry is proved whole again before the handoff moves a label over it
(`current_evidence_verdict`), ahead of the approval's coverage on the relabel's retry, and
a handoff that coverage drops takes the carry with it (`drops_the_handoff`); evidence
minted under a context that moved -- during the squash included -- is invalidated the same
way. What an invalidation writes (`INVALIDATES`) and the record beyond the bound ones that
whether a carry still answers is read off (`CARRY_ANSWERS_ON`, the approval's claim) are the
ownership and extra guard `collapse.py` commits an unanswered carry's invalidation under;
what recording a carry writes (`CARRIES`), and what one decision stages
(`SquashEvidence.writes`), are what the guarded commit carrying it owns; and that
commit's candidate is held to the room the carry's settlement, and the invalidation
behind it, need (`SquashEvidence.admits`), a carry without it refused for want of room
(`SquashEvidence.without_room`)
watermarks.py the seed walk past leading orchestrator comments and a bare `/orchestrator
add-agent-runs` a grant left unread, and the ratchet that never regresses one
requested_changes.py the PR feedback and `workflow:fixing`-labeled dev fix, its report disposed of through
`fix_reports.py` and bound behind the round and the relabel -- its record carrying the
fixing stage's settled-round mark for a relabel that never lands -- plus the no-VERDICT
park, landing with the run's records through `review_writes.parks_the_return`, and the
split that tells a provider's failure from a reviewer's. The feedback post answers
the id it landed as, or nothing where it had no pull request to go on, failed, or named no
positive whole comment id, and leaves that anchor to its caller: the persisted request's
handoff (`review_handoffs.py`), the one road posting it, goes on only behind one and stages
it with the handed commit. Asked by a later tick's handoff to find the post first, it
takes the one an earlier tick made for that very request -- in the words it posts, whatever
reviewer and round cap their opening line names, and the receipt below them naming the
request (`feedback_posts.finds`) -- staging that comment's
ledger entry and posting nothing, and answers nothing where the thread will not read. The
round a persisted request's developer answers retires that request only in a guarded commit
decided on it (`review_writes.ANSWERED`): its report's record, the park the round lands, or
the hand-back behind the relabel back to validating, which keeps what another road wrote
while the label moved and settles nothing where it is refused. The post is in the words
`feedback_posts.py` writes
feedback_posts.py a change request's reviewer-feedback post: the words it is posted in (`posted`) -- a line
naming the review and its round, then the feedback -- below them a hidden receipt naming
the persisted request it was posted for, a digest of its round, recorded subject, and
evidence claim (`receipted`); the post a later tick's handoff finds in those words and
that receipt, the orchestrator's marker included, before it posts (`finds`), the line
naming the review held to the request's round alone, since the reviewer and round cap it
names are configuration a restart may change: the newest
comment this orchestrator wrote on the pull request so, by its whole id, never one another
author copied, since the anchor is replayed as this orchestrator's own words, and never
another request's receipted post in the same findings; a request is found too in the words
a tick before receipts, or before formatting, posted it in -- concise or raw with no
receipt, raw with one -- but a post with no receipt only where it stands behind the
developer report and the evidence artifact the request was reviewed over and is no comment
the ledger of the orchestrator's own accounts for, so another request's post, above a later
report or fresh evidence or anchored by its own landed handoff, is never taken.
The thread is read whole (`pr_conversation_thread`) so findings quoting the pinned state's
marker are found too. And the post as a `/orchestrator continue` replay quotes it
(`ShownPost`, asked by `fixing/continue_command.py`): the same comment, its id, author, and
every other attribute its own, whose body has the findings formatted through
`engine/review_findings.py` between that line and the receipt and hidden marker, all kept as
posted. A post made before findings were formatted, its declaration raw, is replayed concise
-- a declaration alone as the sentence saying there are no findings -- one made since as
posted, and a body of no post's shape reads as findings whole
dev_fix.py what a finished dev fix leaves behind: the publishable reading and the proved remote
head it carries on as the lease, taken for a run that committed as well as for one
that did not -- a tick committing over work an earlier one stranded begins at a
commit the pull request has never carried, so a lease read off that head parks every
such tick unmeasured -- unless a caller names the head it proved it may lease over,
which is then the lease and is never re-proved, so a pull request moved while the agent
was out is refused rather than adopted, and a rebase that reads to the proof as a remote
that moved still goes out; the tree proved in BOTH halves before the push, since the
size gate's own proof rides the entry it freezes and `DECOMPOSE=off` freezes none,
the size gate every fix route publishes through, told the
state the run really belongs to by the route that relabels before it spawns rather
than reading it off the issue object, the push and the approval it spends, the round
bump, and the bounded timeout park, which a timeout an account quota caused skips for
the session limit the shared question park takes -- as do the fix-report and drift
dispositions beside it, and as a quota stop's commit over a tree not provably clean does
in place of the tree's park
stranded.py one reading of a branch against the publication it is on, answered in words rather
than yes-or-nothing. Eight findings, two of them readings and six refusals. A clean
checkout fetched and proved strictly AHEAD of the remote pull request branch and
behind nothing is `stranded`; the two proved EQUAL are `in_sync`. Both name BOTH
ends -- the remote tip the count was taken against, which is what the push replaces
and is leased to, and the local commit it was counted over, which is the work going
out. That local commit is FROZEN before anything counts it, and the commit AND the
tree are both proved again afterwards, so the numbers and the checkout handed on are
one world: `HEAD` is a symbol every command re-resolves, and a fetch and a count are
time a worktree can move or pick up loose work in. A size gate given both ends then
refuses a checkout that moved rather than measuring whatever it points at. The refusals are a status nobody could take, a tree holding
loose work, a fetch that did not return, a divergence git would not count, a remote
that moved, and a HEAD that did not read or disagreed with the count. Typed
because "nothing to publish" and "nothing could be read" are opposite facts about the
branch: collapsed, the fix disposition publishes blind, the ACK fast path hands back a
pull request that may be short of a commit, the transient recovery clears a drift park
over one or leases a push to a head its publication never carried, and the no-feedback
bounce relabels past the last tick that would have published it. What each refusal MEANS is spelled here too, so the road that stops on
one names the reading rather than the silence, and which of them may be a reading that did
not return (`_StrandedEvidence.unread`) -- an unreadable status, a failed fetch, an
uncounted divergence, a checkout that moved while read -- rather than loose work or a moved
remote somebody has to act on
awaiting.py the three park-reason claims on the context's one frozen reply batch, and the dev
attempt they fall through to, handed that same batch; the explicit `/orchestrator
continue` retry is re-grounded off its conversation less the commands it consumes.
The cap's grant is the one control road recording anything of its own, and only
where the comment IS the command: those WORDS as read, since the orchestrator
answered them on the thread, and nothing else, because what no agent has read is
the requirements they arrived beside. A command written inside a comment of
guidance records none of it -- the round the grant buys is what delivers those
words, under its own bound -- so the grant writes down the COMMENT it answered
instead, beside the round reset and in the same write: durable exactly where that
reset is, which is what a launch the run circuit refuses discards, and what keeps
one comment from resetting every cap the issue later reaches. A
reviewer-side park -- a returned verdict's `reviewer_unverified` and
`reviewer_unrecorded` among them -- is answered by a fresh reviewer, and its retry
records nothing at all: that reply belongs to the round it
buys, which reads it under the round's own bound (`reviewer.py`). The usage-limit park
(`reviewer_usage_limit`) is answered only by a batch carrying the `/orchestrator
continue` line, and short of one the same claim holds the tick -- idle or not, ahead
of the dev attempt, consuming and posting nothing. Both roads DO write
down the round those words bought, since the clear can go out on a tick that runs no
round and the reply has moved the requirements by the next one.
A transient retry that resolves drops the fresh review budget a hand-back recorded
with the park it clears: that retry IS the publication the budget was reset for --
pushed, or found not to exist -- and a record left standing would spend nothing for
the next unrelated publication this stage owes
awaiting_resume.py the order those claims are asked in and the resume none of them wanted, over the context
the handler built before its drift check -- and, where the park was one this stage took
over a report it owes, the drift reading of that resume's answer, stamped with the
revision the batch delivered, since a reply to a park is no drift and this is the road
it arrives on -- a park over an edit its own resume never answered reads the same
way, off a claim taken BEFORE the run, since the resume clears the park it was written
beside -- and spending the round `rounds.py` says it does, which is none where the
park came back from `in_review` with the budget already reset for it
drift.py a body edit mid-review, the parks that defer -- every reviewer-side one and the
review cap, which deliver nothing and so
record nothing, baseline included -- the one thing that outranks a deferral, which is
a report this stage still owes its pull request: no reviewer runs behind that debt,
and the record it is owed was written against requirements a reply has already moved,
so standing down for the held round would leave the two waiting on each other for the
life of the issue -- and the frozen prompt its resume settles once the
run is back. The requirements revision its report is stamped with is that prompt's own,
not the drift check's a moment earlier: a reply landing between the two is in the prompt
and in the settled baseline, and a report stamped behind them is one the reviewer hold
refuses; on a parked tick the edit is measured by what the park had already read
drift_models.py the frozen record that route's resume hands the helper that finishes it, the delivery
it was built from -- and the revision that read fingerprints -- included
drift_outcomes.py the claim that the edit is still unanswered, written -- for a caller that named what
its resume was `handed`, which is the caller that reads it back, so on the two review
routes alone, since a `resolving_conflict` park is answered by that stage's own reply
road -- beside every park a
resume ends on and dropped by every outcome that answers it, with the fresh review
budget a hand-back recorded, but only once the publication that budget was reset for
has happened, so an `ACK:` leaving a commit withheld for its report keeps it; the `ACK:`
reply that must not park, over the shared fix disposition, and -- where the
caller names what its resume was `handed` -- the report reply that is neither, recorded
for the unchanged head as `reported`, and a commit held to the same contract
drift_reports.py that contract for a drift resume on an open pull request, which is that nothing this
road publishes may be work no report describes: the run's report recorded ahead of the
size gate under the route and the revision its CALLER handed it -- the prompt-delivery
record's on either review stage and on `resolving_conflict` -- a
commit of this run's with no usable report parked rather than pushed -- as the session
limit, over the same debt, where an account quota stopped the run -- a report alone
recorded only over a tree proved clean -- parked on the tree otherwise, with nothing
recorded -- and a commit an earlier run stranded, under a run that committed NOTHING,
withheld until a reply brings the report that describes it; a run that committed is
held to its own report ahead of the gate instead, so a reply with none parks for the
report both commits are short of rather than posting an `ACK:` over new code.
Which run wrote nothing decides none of it: the engine
exempts an unfinished run from the contract because the roads it serves publish
nothing either way, while this road publishes, so a nonzero exit, a provider refusal
and a launch nothing invoked are each parked here as the missing report they also are.
What the debt is asked against is a record of THIS work: a delivery
or transaction an earlier run left describes the branch before the commits a later run
made, so the undescribed-work flag those commits leave is read first and the reply
that publishes them is the one that describes them
fix_reports.py that same contract for the `CHANGES_REQUESTED` run this stage spawns itself, which is
the half of the fix loop it owns -- every later round is `stages/fixing/reporting.py`'s,
holding it to the same contract and, while the report is owed, holding the readers,
the round and the relabel with it. The
run's report recorded ahead of the size gate, a report with no code in it recorded for
the head `fix_report_evidence.py` PROVED the pull request to be standing on, and a
commit of this run's with no usable report parked rather than pushed, in this road's
own words rather than the engine's, through the report domain's guarded park
(`report_delivery.parks_the_debt`) decided on the run's road as well and retiring what that
road retires -- the change request the run answered -- in the park's own commit
(`ReportWrite.behind`). The report contract is the RUN's only where that
run committed or reported: a commit an EARLIER round stranded is published through the
ordinary gate either way, since its report was that round's to record and the debt it
left is what holds the reviewer off the head this lands on
fix_report_evidence.py what a report with no code in it has to prove before it is recorded, and what its
refusal owes: the branch proved to be standing exactly where its remote is (a clean
tree, a local head, a tip, the two equal) AND the code-publication receipt naming that
same commit on the pull request the report would go onto. Asked of a CHECKOUT rather
than of a run, because what it is about is a checkout rather than a session: this
disposition holds the run and the worktree it ran in, and everything it proves is
about where that worktree stands. One caller only -- the `fixing` stage answers the
same question for itself, over a pull request it reads AFRESH rather than over this
receipt, which is persistent and on any tick that pushed nothing names an older
round's commit. Nothing is inferred from an
absence, because "this run committed nothing publishable" is the same answer the
disposition gives a checkout nobody could read, a fetch that failed, a divergence git
refused and a remote that moved -- each of which may be a branch carrying a commit the
pull request has not got. Short of all of it the round parks with the debt recorded and
the report UNWRITTEN, since a record over an unproved head is one no reconciliation
could settle honestly. The consumed-input write sits here beside them because it is the
same kind of obligation, owed by every park rather than by one: a park is durable the
moment it is taken, so the input the prompt delivered rides that write rather than a
caller's afterwards
report_settlement.py a recorded report bound to the publication the code-publication receipt names -- only
where the checkout, resolved as the reviewer resolves it, stands on that commit -- over
the pull request, its description, and the issue all read again by number: the binding
is told whether that description still closes the issue and names the session, and the
dispatch reconciliation settles it over the FRESH issue, since the one in hand predates
the resumed run and an edit made during it exists only on the new object. Asked by both
drift callers behind their own bookkeeping and by the hold, so a delivery a later push
carried (a recovered failed push, a settled adjudication) is bound on the first tick
that proves it; a refusal no retry changes parks once under `report_undeliverable`
report_hold.py the hold that keeps the reviewer off while the issue still owes a report, settling what
it can through `report_settlement.py` first and parking for what no retry settles: a
report written against requirements the issue has moved past, a receipt naming another
pull request or none, a checkout on a commit the pull request never received, a
checkout that has picked up loose work or moved off the commit a bound transaction is
about, a report the thread has moved out of reach --
edited, removed, or written untrusted, asked with the reading the implementing handoff
takes -- and a debt no record describes at all. Every one of those is something the
reconciliation stands down on rather than holding, so a silent hold there would
suppress every later reviewer with nobody told. A settlement whose binding, preparation
or commit did not land over the comment the tick read -- refused over a moved comment or
never confirmed -- or whose post or re-read left the report owed while another road wrote
the comment, is the one silent hold among them: the tick's state is withheld, so no park
could be recorded. The settling half is its own step, which `resolving_conflict` asks
ahead of any rebase of a head a recorded report is about.
Once nothing is owed it asks `report_refresh.py` about the rewritten-head report debt
report_refresh.py the rewritten-head report debt (`workflow/engine/report_rewrite_debt.py`) the report hold
asks once nothing else is owed, against the pull request's head as the reviewer's subject
reads it. A published report of that head, against the current baseline and still intact
where it settled -- re-read as `review_report.py` reads it -- pays it, written `null`
before the reviewer road; a report the thread moved out of reach pays nothing and is left
to that road's refusal. A readable claim owed a fresh report, on the branch the issue pins,
holds the reviewer and resumes the locked session on the report-refresh prompt -- over a
settled report of the approved commit an approval squash collapsed too, once
`workflow/engine/report_squash_lineage.py` proves that lineage and the report re-reads
intact, the prompt naming that commit; a lineage nothing proves is left to the reviewer
road, and a tree or location nobody could read holds with nobody run. Before either,
requirements the drift check stood down for hold and drop the owed-round note, so the
drift resume answers them rather than a report of older requirements paying. The refresh
freezes its world before any run: a damaged receipt group, a receipt not naming the
rewritten head, or a checkout not standing on it clean -- the one the resume runs in,
read where it stands and only recreated where gone -- parks under `report_undeliverable`.
A launch nothing ran, a shutdown kill, and a live pause write nothing. Anything else is
left to `review_report.py`'s own staleness refusal
report_refresh_models.py the frozen record that refresh hands the owner reading its run -- the debt, whose
rewritten head is the one proved on the pull request, the receipt, and the checkout, the
requirements baseline the report is stamped with, and the approved commit a proved squash
leaves the settled report describing -- with the reading of the
requirements taken once the run is back and the park both helpers take
report_refresh_outcomes.py what a refresh run left: a `REPORT: READY` over a checkout still clean on the head,
with the pull request's head and the requirements read again unchanged, recorded under
the frozen baseline with no round or watermarks, then bound and settled through
`report_settlement.py` on the same tick, so a refused post, a lost response, or a crash
before the binding or on the settlement is finished later by its receipt; a moved head
or an edit records nothing. A commit (recorded as work no report describes), loose work, a
timeout, and a `REPORT: VERIFIED` of the report already there park under
`report_undeliverable`; any other finished run with no report -- and one an account
quota stopped, whatever its checkout reads as, a commit it left off the head still
recorded as work no report describes -- takes the agent-failure park
`implementing/parks.py` classifies, route `report_refresh` -- a run that left a command
unfinished among them, read so ahead of any report block it wrote. Each park records
`developer_report_owed`, so the reply is read as the report it owes
review_report.py the report a reviewer is handed once nothing is owed: the one last settled, re-read where it
settled and quoted whole, and the pull request's head read with it for the subject. Refused
rather than reviewed -- parked under `report_undeliverable` with the debt recorded, so the
reply resumes the developer -- when no report is recorded at all, when the settled record
will not read, is about another pull request, disagrees with the handoff that settled it, or
reads ABSENT or CHANGED (removed, edited, cut short, or untrusted) -- and when a report that
reads intact is STALE: about another commit than the pull request's head, or written against
requirements the drift baseline has moved past, an `ACK:` of an edit included, which is the
rule the hold holds an owed report to. The baseline rather than the reviewer's own read,
since that read carries the reply that bought a retried or granted round -- while that read
has to be the revision the round was due to hand over: the baseline, or on a round a
control-only reply bought -- a bare grant or `/orchestrator continue` -- the thread through
that reply (`validating_reviewer_round_requirements`); a reply carrying words is a
requirements change, and records none. One that moved on after it is held, nothing parked,
the owed round stood down, for the next tick's drift check to resume the developer on the
new words. A reading nobody could take holds without a notice, and every hold writes what
the tick staged -- a cleared park, a cap grant and its notice -- so none of it is answered
twice. Nothing is decided or written until `review_comment.py` finds the pinned comment
carrying the report records the subject was resolved from. The reading itself posts and
parks nothing, so `review_coverage.py` takes it again
review_comment.py the pinned comment a review is bound to. The subject is resolved from the state the tick
read when it began, so the comment is read once it is resolved and has to carry the same
report records and returned-verdict record, and point the issue at the same pull request: a
later report settled in between -- on the very head, by another road -- is there and
nowhere in hand, while the report the tick resolved still reads intact, a subject resolved
at one pull request bound to a comment naming another would be judged over the wrong one,
and a verdict another road persisted is a later tick's to finish. Where it does not,
the comment will not read or parse, or the fresh reading is another comment than the one
the state was read from -- replaced or gone, whose write would pin a second one -- nothing
is handed over and the tick ends WITHOUT writing, since any write would put the replaced
report back. The reading that agreed goes with the subject -- and with the verification
evidence handed beside it once the launch is recorded (`_ResolvedSubject.evidence`) --
laid over the state in hand
before the round writes anything, measured from the comment as the tick read it save a
field the comment already holds as the state does, which is not counted twice
(`_ResolvedSubject.lays_over`) -- what another road wrote while the subject was resolved
is there and nowhere in hand -- with the round's own launch
charge taken into it once that charge is down (`_ResolvedSubject.carrying`), and the
comment is read against it again as the reviewer returns, behind the subject resolved
again for its verdict, and behind the subject resolved once more after an approval's
verify gate passes, before anything the run leaves is written: the report records and the
pull request the issue points at are watched, records that moved refuse the verdict, and
either way everything the comment changed since is carried onto the state in
hand -- a later report, evidence another road recorded or settled, a round a reply bought,
a run another road charged -- save, where the records stand, a field the tick changed too,
which its own write says; another comment or an unread one carries nothing and the tick
writes nothing. The writes behind the reviewer's return, the disposition, and the parks it
asks for are guarded commits captured over the reading this hands back
(`review_writes.py`), so what the comment changes after it is kept as well, or refuses
them. A field both roads changed keeps both changes where they add up or only
advance -- the usage totals, their cost tags, a comment-id watermark, each only as its
writers spell it (`state.py`) -- and the ledger of the orchestrator's own comments is
merged rather than carried or kept whole, an id either side recorded kept once among the
newest its bound holds -- a ledger already past the bound cut to it even where the merge
adds nothing -- and an entry naming no comment dropped from either side, so no later scan
of the ledger fails on it. Each reading hands back the
comment as it found it (`_Reread.read`), and a later reading of the same run is measured
against that, since a move kept beside another road's, measured again from the older
comment, would be kept twice. Records are compared as the comment's JSON spells them, so
one written `null` where there was none, or a revision `true` where it was `1`, is a move.
The reviewer's return, `review_disposition.py`, and `review_handoffs.py` -- which every
returned verdict reaches, as does the recovery of one an earlier tick left waiting
(`review_resume.py`) -- ask it of more wherever they hold a verdict to its subject
(`persisted`): the returned verdict, so another round's persisted meanwhile is never written
over, and the pull request the issue points at beside the report's records, which no write
may act on once another road dropped or replaced the verdict or pointed the issue elsewhere,
and whose evidence records it judges the verdict's claim over. The later roads that act on
an approval after requests long enough for a settlement -- the squash tail once the squash
returns, and the in_review park and ready ping -- ask the comment the same of the report
records and the pull request pointer before they write, and act on nothing and write nothing
where they moved. Those roads write the state in hand whole rather than composing over the
comment, so a field another road changed in their window that no guard watches is not kept.
A change request's developer run records what it left -- its report, the park it takes, the
hand-back behind its relabel -- with the request retired, in guarded commits over the
comment read afresh (`review_writes.ANSWERED`, `report_records.HandedRun.decided_on`), which
keep another road's write or are refused by it; only the size gate's own writes around its
push still write the state in hand whole, keeping of another road's writes only what the
handed request's launch boundary laid over it (`review_launch_hold.py`).
A tick settling the round a reply bought asks its reading whether another road recorded a
park there (`_Reread.parks_anew`): its flags moved, which that tick keeps as the reading
spells them (`_Reread.keeps_the_park`); a comment another road posted naming the HITL, which
a same-reason park's notice does and a status line may, cannot be told apart, and that tick
writes nothing. Nothing here parks or posts
review_coverage.py whether an approval still covers the subject standing when it is acted on. When the reviewer
returns -- approving or requesting changes -- and the report records on the pinned comment
stand (`review_comment.py`), the pull request the issue points at is asked first --
pointed at another than the subject names, whenever it moved, the verdict is not acted on
-- and the whole subject is resolved again over the issue read afresh
and has to RECORD as the one handed over -- pull request, head, requirements, and the
report's revision and digest, its words read again at its location, where an edit or a
removal refuses the reading -- or the verdict is not acted on and the next round
resolves the subject for itself; asked again by `approval.py` once the verify gate has
passed, since a verification can run long enough for the report to be edited or replaced
under it. On both the comment is read again behind the resolution, since its own requests
are long enough for the issue to be pointed at another pull request. Later, once the
pinned records agree the current report is the approved one and its settlement handoff
still describes it -- the pair a reviewer spawn refuses otherwise -- the report is read
at its location again, since no record sees a comment
edited or deleted in place; the issue is read afresh against the approval's own requirements
revision and the drift baseline both, since a baseline moved on to an edit says nothing
about what the reviewer read; and the pull request is read afresh against the commit the
move is owed over, since a push landing meanwhile is a commit nobody approved: the
squash tail asks all of it before its relabel, on either road into it, the settled
squash handoff before moving a label that tail left owed, and `in_review` before an approval
may stand behind a ready ping. A returned verdict is held to its subject the same way ahead
of the write persisting it, once more before it is handed back ready, on every tick it
waits on its evidence, and -- a change request -- behind its feedback post and behind the
relabel ahead of its developer (`_verdict_still_stands`) -- the subject resolved and then
the comment read behind it, watching the verdict and the pull request the issue points at
beside the report's records, and carrying the evidence records for its claim to be judged
over; a reading nobody could take is told apart from a subject that moved, so a persisted
verdict is held rather than dropped. Nothing here parks or posts
review_records.py what a reviewer round writes onto the pinned comment, through writers the round and the
report settlement's measurement share -- staging only, the round's own writes landing
through `review_writes.py`: the spec and the subject it is handed, committed ahead
of the spawn -- over the comment as `review_report.py` read it, since the launch charge
writes only its own fields and the state in hand carries what only the round's own write may
land -- and the session, return time and returned subject it leaves; and the reservation of
the whole round at its widest (spec, subject, launch charge, session, return time, returned
subject, and approval), so a report is never accepted into a comment its own reviewer cannot
write to. The usage meters the return folds are left out: running totals every run folds,
already on the comment from the developer run whose report it is wherever that run's usage
parsed
review_writes.py the guarded commits (`engine/pinned_commit.py`) a reviewer round's writes land through,
under the developer report's tick-state guard (`engine/report_commits.py`): each captured
over the reading the tick last synced with -- which every reading of the round lays its
moves into -- owning what the tick staged since beside the fields it declares, and keeping
both moves of a usage total, its cost tags, a comment-id watermark, and the comment-id
ledger. The launch (`lands_the_launch`) is captured over the reading its subject was bound
to rather than the state in hand, and owns the spec and the subject it is handed; a
return's own records (`RETURN`), and the park a reviewer that left no verdict takes with
them (`parks_the_return`, prepared before its notice with what posting it writes reserved
at its widest), are decided on the report records, `pr_number`, and the returned-verdict
record; a verdict persisted with its transaction (`lands_the_verdict`, staged on a copy and
held to the room its handoff and the transaction's settlement reserve over the very
candidate sent -- no room answers as unrecorded), its drop (`DROP`), and a verdict's park
(`PARK`, prepared before its notice by `parks_over`, over the comment as it stands with
the run's records left out where only room refused it) on those and the
`verification_evidence_*` records besides (`VERDICT_STANDS_ON`). Each is decided as well
on the fields of its own it may stage exactly as the comment already spells them -- the
launch's spec and subject, a return's subject, a park's flags -- since the commit tells a
write's moves by their difference from the capture, and a launch repeated over a recorded
subject, or a park a reply-bought round takes over a parked reading, would otherwise land
beside another road's spec, subject, or cleared park. A record that moved, an
owned field another road moved, a comment that will not read, parse, or is not the one
read, or a candidate past what one comment holds refuses the write with nothing written,
and nothing that depends on it is made; an edit never confirmed acts on nothing either, the
records it may have left settling it on a later tick. `lands` is the commit a change
request's handoff, the drop, retirement, and park of a handed one, and the recovery of a
waiting verdict land through as well, each with the `ReportWrite` its own owner declares
(`review_handoffs.py`, `review_launch_park.py`, `review_resume.py`)
review_evidence.py the current verification evidence a reviewer is handed, asked by `reviewer.py` once the
launch has recorded the round's subject: only a record bound to exactly the subject it is
about to review -- pull request, head, requirements, and the report's revision and digest,
compared whole -- proved current again
(`current_evidence_verdict`), and its artifact re-read at the comment it settled as and
held to the record again, so the words quoted are the ones the revision names; anything
short of that, a reading nobody could take included, hands nothing and logs why, and the
reviewer runs the verification itself
review_verdicts.py the `review_returned_verdict` record a returned reviewer's verdict is to wait in, written
only by `review_disposition.py` and `review_handoffs.py`, which every returned verdict
reaches, and dropped by the park of a handed request's launch (`review_launch_park.py`)
and the recovery of one an earlier tick left waiting too (`review_resume.py`), each
through a guarded commit: its round, verdict, subject, feedback, the one evidence claim it
relies on, and the agent-run count a change request was handed to `workflow:fixing` on,
beside the
id of the feedback post it was handed over with (`anchor`, carried only by a handed record,
so a waiting one is spelled in the six members every writer of the record spells; a handed
record without one, as a handoff wrote it before it anchored its post, still reads, its
launch held for good and the shape staged by nothing) -- an approval handed nothing and
carrying no feedback. Read whole or not at all, and staged only where it reads back exactly
and the comment has room for it at its widest write -- a change request's handoff, with the
count, anchor, and ledger entry it adds -- the very entry, once, for a request measured as
already handed behind its post -- and the developer launch's run-ledger charge and its
start, recording the count it is owed at, composed over it, through the run circuit's own
ledger writers -- with exactly the transaction a published claim names staged in the same
write and measured with its settlement beside that reservation, a retry of one already
recorded included, a reuse or no claim beside none, or neither; marked handed, or dropped,
only where it stands -- and, where the caller names the verdict it holds, only where the one
waiting is exactly that verdict, a caller naming none dropping nothing, a record no reader
takes included
review_claims.py what a returned reviewer's verification declaration earns, asked only by
`review_disposition.py`, of the run every returned verdict comes back in: commands it ran
minted, not recorded, as a reviewer-reported transaction past every spent revision, bound to
the handed subject, the reviewed head and its tree, and the configured context, its whole
artifact rendering as one comment; a reuse of exactly the current evidence it was handed; or
the reason it earns none. Also whether a claim's commands cover every configured command
exactly, and where its evidence stands -- settled or owed under the configured context at
the latest revision spent, or lost -- which `review_handoffs.py` asks too
review_disposition.py the returned-verdict disposition, which `reviewer.py` hands every returned verdict to: a
returned run's verdict persisted and prepared, then acted on or parked
(`disposes_of_the_verdict`), and a waiting one finished by a later tick
(`finishes_the_verdict`), which the validating handler's recovery asks of a verdict an
earlier tick left waiting (`review_resume.py`). A run that does
not name, as a whole number, the pull request its subject is on is refused before anything
is minted. The
preparation (`prepares_the_verdict`) mints the evidence, then holds the subject to what
stands with the pinned comment read again behind that resolution -- an evidence record moved
since refusing it as a report does -- then stages the run's own records over that reading,
its usage folded over whatever usage another road folded meanwhile, the last requests before
the verdict is persisted with its minted transaction in one guarded commit
(`review_writes.lands_the_verdict`), which a record moved after that reading refuses with
nothing written or published, and an edit never confirmed leaves for a later tick to finish
from the records it may have left -- or, where the record
would not read back as written or the comment has no room for either, nothing written or
published and an answer that says which (`review_parks.UNREADABLE`, `review_parks.NO_ROOM`),
which parks under `reviewer_unrecorded` -- then publishes that transaction through the
dispatcher's own reconciliation. A verdict is ready only while the comment carries it as
persisted, its subject, held to it once more with the comment read again last, still stands,
and its claim, judged over that reading, is settled or it relies on none: a settlement of
the very evidence it claims readies it, an owed transaction holds it, and a lost claim --
published or reused, superseded included -- drops it. A later tick asks the same of a
waiting verdict over the pinned comment alone (`waiting_verdict_ready`), the record's own
subject what the standing one has to record as, and finishes a ready one only beside a run
its caller rebuilt of the verdict's own round and subject, naming that subject's pull
request, each read as the record spells it -- through any other, a round `False` for `0` or
a report revision `True` for `1` included, it acts on nothing and writes nothing. A ready
change request goes to `review_handoffs.py`, through the decision in the tick its reviewer
returned and from the record on a later tick. A ready approval goes to
`unverified_approvals.py` over a gate built on its run's checkout: an unread proof holds it,
and a refusal -- or a declaration that earned no evidence, parked with no proof asked --
parks it under `reviewer_unverified` only once the approval is held to its subject and claim
again, measured from the comment its readiness was proved over, a move there dropping it for
a fresh reviewer instead. Every write is a guarded commit captured over the comment as read
just before it (`review_writes.py`), keeping what another road wrote there before or after
that reading, refused where a record it was decided on moved, and drops only ever the
verdict it holds. The
feedback a verdict is persisted with -- what a change request posts and hands its developer,
in that tick or from the record on a later one -- is the reviewer's findings formatted
through `engine/review_findings.py` only once the declaration has been read off the run's
own message, which nothing rewrites (`VerdictInHand.returned_by`): the declaration set
aside, save each check not shown passing, kept as the diagnostic a developer acts on, while
the transaction carries every command, exit status, and output exactly. The raw feedback is
chosen before it is formatted, and the formatting never answers empty, so findings it left
nothing of read as a sentence saying so rather than falling back to the raw message; it
decides no claim, refusal, or approval
review_handoffs.py a persisted change request handed to the one developer it owes: the disposition calls it,
right behind proving it ready, and the recovery of a request an earlier tick left waiting
(`review_resume.py`), where its launch is still owed: only a change
request the pinned comment carries, through the decision it was persisted from -- round,
verdict, subject, and feedback -- in the tick its reviewer returned
(`hands_the_request_over`), or from the record and the issue's checkout alone on a later
tick, which holds no decision (`hands_the_waiting_request_over`), either way on that
subject's pull request; nothing posted, written, relabelled, or launched under a park the
state in hand shows standing, one the caller's reading carried onto it included; the
handoff's guarded commit prepared over the comment read afresh
before anything is posted -- the request at its widest handoff, its launch's charge beside
it -- so a comment another road filled, moved, or replaced posts nothing; the feedback
posted first -- or, on a later tick, the post an earlier one made for this very request
found by its words and receipt (`feedback_posts.finds`) -- a post that failed or left no
positive whole id holding the verdict unhanded with nothing written, the whole subject --
with the pull request the issue points at and the evidence the request claims -- held again
behind that post, the verdict committed as handed at the run count, with the post's id as
its anchor beside the pinned
`pending_fix_reviewer_comment_id` (`_HANDOFF`: decided on the report, pull-request, verdict,
and evidence records, the anchor, the run ledger, and the park's flags as that reading
spells them, and held
to the room its preparation was over the candidate it sends, its post's ledger entry
counted once (`ReturnedVerdict.at_its_handoff`), so a move of any after it, or a comment
filled past that room behind the post, refuses the commit with nothing relabelled or
launched, and an edit never confirmed is finished from what the comment carries by the
next entry), the relabel --
skipped where the issue
is on `workflow:fixing` already, as the fixing stage's recovery finds it -- and the launch,
each made only where the launch still stands over the comment read again -- subject,
evidence, run ledger, and anchor, and no park standing (`HandedLaunch.stands`,
`_still_stands`) -- so no relabel announces a launch another write behind the handed one
already ruled out, and none runs under a park another road recorded. A request already handed resumes
there without posting its feedback again -- relabelled and launched, or retired, over the
comment read again, where the run ledger records the start of the developer it owes at the
count it was handed at; any other run charged meanwhile, a reviewer's, records no such
start, and a charge still standing as the run circuit's unstarted reservation recorded none,
the launch staying owed and that reservation honored -- which is asked again right before
the launch, so a developer another road launched behind the relabel is not launched twice,
and by the run circuit on the readings it charges and starts from, the launch owed at the
handed count behind the hold of `review_launch_hold.py`. Either launch is made only behind
the pinned anchor still naming, as a whole comment id, the post the verdict records, which
the fixing stage clears with the round's other bookmarks: a handoff that lost it, whose
anchor names another comment, whose anchor is no whole id, or recorded before handoffs
anchored their post, naming none, is held, nothing relabelled, launched, or written, since
no failed run could replay the feedback, or one would replay another comment as it. A moved
subject drops the verdict this road holds, and the anchor where it still names this road's
post, over the newer records -- never a verdict or anchor another road put in their place,
and never where the reading that proved the move records the start of the developer the
request owes, whose own push that move is: the verdict is retired as launched, its anchor
kept for that developer's replay. The drop (`_DROP`) and the retirement (`_RETIRE`) are
guarded commits decided on the verdict held and the owed start as the comment spells them --
the drop on the records the request stands on and its anchor besides -- so another road's
verdict in this one's place, or a start recorded or written away meanwhile, refuses them
with nothing written; a drop clears the anchor only where the verdict it dropped was this
road's. The developer's run retires the request only in a guarded commit decided on it, the
pull request the issue points at, the start of its launch, the anchor, and the park's flags
(`review_writes.ANSWERED`): the report domain's commit recording its report, which writes
the retirement itself (`report_records.HandedRun.retires`, decided on
`HandedRun.decided_on`), the commit landing a park the round takes instead, or the hand-back
behind the relabel (`requested_changes.py`), each prepared over the comment read afresh
right behind the run (`HandedLaunch.retires`), so another road's verdict in this one's
place, a repoint, a start written away, the anchor repointed -- which a failed run's
continue would replay -- or a park recorded writes, posts, pushes, relabels, and spends
nothing of that result. The
request stays on the comment until that record is down with it, so a commit never
confirmed leaves both or neither and the ticks behind answer it as a confirmed one -- never
a retired request with nothing recorded, handed back for a review nobody asked for; a run
paused, killed by the shutdown sweep, or refused at the circuit retires nothing. The run
ledger the launch is read off is spelled once (`RUN_LEDGER`) for the handoff and the park
to be decided on alike.
Whether that launch is still owed is read off the run ledger (`HandedLaunch.owed`): not
where `agent_run_owed_started` records a start at or past the handed count or is spelled as
no count, `null` included, nor where the latest charge at or past that count -- one reserved
before the handoff is counted in it -- is STARTED under the fingerprint the developer's own
launch is charged under (`implementing/execution.py`), nor where it stands with a record no
reader takes, which may be that very launch -- STARTED, or in a phase no reader takes, under
that fingerprint, any charge under a fingerprint gone or spelled as none, RESERVED included,
or a run count below the handed count, which only ever rises: none standing, an unstarted
reservation under the launch's own fingerprint, which the circuit honors, or a charge
another road took under a fingerprint of its own leaves it owed. The same reading is asked
again of the comment read right before the launch (`HandedLaunch.stands`) and handed to
`review_launch_hold.py`, so a start of that identity landing behind the relabel launches
nobody. A launch that may have started and left nothing to show is parked by
`review_launch_park.py`.
A later tick's handoff builds its launch over the issue's checkout where it stands and
restores that checkout only behind the relabel, once the launch is held to its subject, so a
moved subject drops the verdict with no checkout restored and one that will not restore
keeps no stale verdict pinned. What a later tick posts and resumes the developer on is the
record's feedback formatted through `engine/review_findings.py` (`HandedLaunch.of`): a
record persisted before findings were formatted, its declaration raw, goes out concise --
each check not shown passing kept as its diagnostic -- while the record itself, its claim,
receipt, and anchor, is what every comparison is made against as read, its feedback never
rewritten on the pinned comment, and a post already made stays as it was posted, the
`/orchestrator continue` replaying it quoting its findings formatted (`feedback_posts.py`)
review_launch_hold.py the hold a handed change request's developer launch is made behind at the run circuit
(`owed_launch`): the launch owed once at the count the request was handed at, the whole
subject resolved again right behind its charge, and every reading its charge and start are
written from held to being of the pinned comment the handoff read, not one pinned in its
place, and to showing the verdict still the one handed, the pinned anchor still naming its
feedback post, and the report records, the pull request the issue points at, the park's
flags, and the claimed evidence where the last reading it took in had them -- and its run
ledger ruling out a start
of that launch as the handoff reads it (`review_handoffs.HandedLaunch.owed`), one of its
very identity STARTED with no owed count, or one whose record no reader takes, included,
save where the state in hand already carries the launch's own start, so its poisoned-session
retry or recovery prompt goes on.
Each reading it accepts is laid over the state the developer's run is written back from,
measured against the last one, so that run's writes keep what another road wrote there -- a
run allowance granted, a usage total folded. It writes nothing itself: a refusal launches
nobody and leaves the verdict handed for the next entry
review_launch_park.py the park a handed change request's developer launch takes where it may have run and left
nothing to show, and what moves such a request on instead (`has_moved_on`): its claimed
evidence no longer the settled evidence, a commit the checkout carries that its pull request
has not got, loose work, or a remote that moved past it -- or None where the branch would
not read (`stranded._StrandedEvidence.unread`). The park (`parks`) goes under
`agent_execution_failed`, only behind the feedback anchor its `/orchestrator continue`
replays -- one something cleared, before the notice or behind it, put back in the park's
own commit, one naming another comment holding the launch with nothing posted ahead of the
notice and no park behind it -- in one guarded commit (`PARK`) owning its flags, the
verdict it drops, the anchor, and the ledger entry and thread read its notice adds, and
decided on the
report, pull-request, verdict, and evidence records, the anchor, the park's flags, and the
run ledger as the comment spells them. It is prepared before its notice with what posting
that notice writes reserved at its widest, so a comment that will not read, moved one of
those records, or has no room posts nothing; and settled behind it: the subject resolved
again, the branch read again ahead of the comment so that reading is the last before the
commit, a move there -- the subject, a report, pull-request, verdict, or evidence record, a
superseded claim, a commit on the branch -- dropping the verdict for the stage's own road, a
subject or branch that would not read or a notice that left no id holding it, as does a
run ledger read there as the launch owed again (`HandedLaunch.owed`), its charge left for
the next entry to honor, and a park another road recorded there kept as it wrote it. The
commit captured over that reading
refuses a record or owned field moved after it with nothing written, and its event goes out
only once it is down
review_resume.py the recovery of a verdict an earlier tick persisted and never disposed of, running no
reviewer and folding no usage or round again. On
`workflow:validating`, ahead of the round cap and the spawn (`resumes_a_returned_verdict`):
a verdict not yet handed is finished through a run rebuilt of its round over the subject
resolved again, which has to record as the verdict's -- a moved subject drops it for good,
in a guarded commit over the comment read afresh only while that comment still carries it
(`review_writes.DROP`), ending the tick for the next one's round, and one nobody could read,
or a thread that would not read,
holds the tick -- and a handed one whose relabel never landed is relabelled and its owed
developer launched, one whose developer may have run dropped the same way over its subject
resolved again -- only while the comment read for the drop still shows that launch not owed,
decided on its run ledger too (`_LAUNCHED_DROP`), so a start written away with its charge
left unstarted drops nothing and the next tick launches the developer owed -- and one on a
tick a park was cleared into settled instead of run where the report hold stops the reply's
round or a verdict waits (`settles_a_bought_round`): one guarded commit captured over the
comment read afresh against the tick's own reading and decided on the verdict and the park's
flags as that reading spells them (`_BOUGHT_ROUND`),
keeping the cleared
park unless another road recorded a park there, its flags moved
(`review_comment._Reread.parks_anew`), which stands as it wrote it -- one recorded again for
the same reason shows only in its notice, so a comment another road posted naming the HITL,
as a status line may too, writes nothing for the next tick to answer the reply again --
carrying what another road wrote meanwhile, and dropping the verdict the park outlived only
where the comment still carries it, the round running next tick. On `workflow:fixing`, ahead
of the feedback scan (`finishes_a_handed_request`) and standing down while a park stands:
the owed developer launched, or a launch that may have started held to the subject resolved
again, its claimed evidence, and the branch -- a move, a commit the pull request has not
got, loose work, or a remote that moved past it dropping the verdict the same way for the
next tick's own road to publish or hold over and hand back, an unread subject or branch --
`stranded._StrandedEvidence.unread` -- holding the tick (`review_launch_park.has_moved_on`),
and anything else parked (`review_launch_park.parks`). A pinned feedback anchor something
cleared is written back from the record's `anchor` before the launch, once the subject is
established, in a guarded commit (`_ANCHOR_BACK`), and a verdict another road put in place
of the handed one, or a park another road recorded, on that write's reading -- or a record,
the anchor, or the park's flags moved under its commit -- ends the tick with nothing written
or handed over. Every write here lands through
`review_writes.lands`, so a refusal withholds the tick's state and an edit never confirmed
is finished by the next tick from what the comment carries, with no second reviewer, post,
developer, or charge, and no review round but the one the confirmed write leads to -- the
round a reply bought, or the fresh one a dropped verdict leaves its subject for. Either road
resolves the subject before it
restores the checkout the verdict is finished or launched in, so a checkout that will not
restore never keeps a stale verdict pinned. A change request is finished from its record as
written -- round, subject, claim, receipt, and anchor -- with only the words it posts and
resumes its developer on formatted (`review_handoffs.HandedLaunch.of`), so one persisted
before findings were formatted -- waiting on its evidence's publication or its feedback
post, or handed and stopped on its relabel or launch -- goes out concise with no second
reviewer, its recorded feedback never rewritten, and no second post
review_parks.py the two parks a verdict takes instead of being acted on, which the disposition asks for:
`reviewer_unverified` for an approval relying on no valid evidence (`parks_unverified`,
measured against the state it began over) and `reviewer_unrecorded` for a verdict that could
not be persisted (`parks_unrecorded`, measured against the reading the returned run was
resolved over, so what that run staged lands with the park, over one of the two causes
spelled here, `NO_ROOM` and `UNREADABLE` -- its notice asks for room on the pinned comment
only for the first, since freed room does nothing for words no record can carry), each
answered by a fresh reviewer, and the funnel both take (`parks_over_the_subject`): measured
before the notice is posted at the park's own write, the verdict it refuses dropped -- the
write keeping a waiting verdict is measured behind the notice, where it is asked -- taken
over the comment as it stands where it has no room beside what the returned run staged --
only while that reading still carries the records the verdict stands on -- and posted and
written nowhere where there is room for no park. Behind the notice the subject is resolved
again and the comment read last: a report, pull-request, verdict, or evidence record moved
there, like a push, lands no park and drops only the verdict held, over the newer records,
whether or not the notice left an id, while -- where nothing proved a move -- a subject that
would not read, or a notice that left no id, lands none either and leaves the verdict
waiting. That write is the park's guarded commit (`review_writes.PARK`), over the comment as
it stands, so a field another road wrote behind the notice -- a round spent -- is kept,
measured again once it carries what moved, and not made where another road's write left no
room or moved a record the park was decided on after its last reading. The measurement
before the notice is the same commit prepared (`review_writes.parks_over`). Only a park that
lands sets its flags,
drops the verdict it holds -- a `reviewer_unrecorded` park holds none, and leaves whatever
record stands there as it is, and a `reviewer_unverified` park holds only the approval of
its run's round and subject, posting and writing nothing where that is not what waits -- and
reports `park_awaiting_human`, once its write is down. The park a failed verify gate takes
over an approval goes through the same funnel from `approval.py`, holding that approval's
verdict and reporting no agent's run; the `agent_execution_failed` park a handed change
request's unaccounted developer launch takes (`review_launch_park.py`) posts its notice
through these helpers and is prepared, settled, and committed by its own owner, holding its
feedback anchor; the
park a failed squash takes (`parks_the_failed_squash`) is filed beside the funnel rather
than through it, since the recovery of a squash an earlier tick did not finish reaches it
with no reviewer run: prepared before its notice as the guarded commit it lands as,
keeping any verdict it does not retire (`review_writes._prepares_the_park`), held behind
that notice to the records the squash tail holds (`handoff._holds_its_records`) and, on
the approval road, to the approved subject, landing only behind a notice that was
identified, and reported only once that commit is down (`handoff.SQUASH_PARK`)
approved_evidence.py the evidence an approval was proved over: the proof of a claim (`refusal`) -- the
current evidence named exactly, proved current again, its artifact re-read as the one that
settled, passing and covering `VERIFY_COMMANDS` -- which the arc takes again behind the
verify gate and the approval comment (`handoff._Held.evidence_stands`); and the
`review_approved_evidence` record written beside the approved subject (`records`), which
every road moving the approval on past the squash holds it to (`stands`, asked by
`review_coverage._approval_holds` and the documenting opening): every part of the proof the
force-push left standing, since it stands the pull request on a commit the evidence was
never bound to -- the current record named exactly, no revision past it spent, settled or
still owed, its handoff describing it, the verification context it was minted under still
the configured one, and its artifact, re-read on the pull request it was published on,
still the one that settled, passing and covering the configuration; unread holds. A
squash's carry points that record at the carried transaction (`squash_evidence.py`)
unverified_approvals.py whether an approval rests on evidence it may be acted on over, asked only of a
persisted approval, by the disposition -- which every returned approval reaches, as does
the recovery of one an earlier tick left waiting (`review_resume.py`): the approval proved
is the one the comment has waiting, only where that is the run's own -- its round and
subject, the
verdict the arc retires (`handoff._Held`) -- and refused where none of the run's waits, and
the claim proved is the one that record names, never one handed in beside it, through
`approved_evidence.refusal`. That claim has to name the current evidence exactly -- receipt,
revision, and digest -- that evidence has to prove current again
(`current_evidence_verdict`), and its artifact, re-read at the comment it settled as, has to
be the one that settled, with `passed` holding there and every configured `VERIFY_COMMANDS`
command among its commands exactly, exiting 0; the claim's own flags refuse it early and
never stand in for the artifact, and a claim on a transaction still owed refuses as
unpublished. The pinned comment is read last behind the proof, a report, pointer, verdict,
or evidence record moved there refusing it too. `approval_refusal` answers the refusal in
the words a `reviewer_unverified` park carries, "" for a proved approval, and None for a
proof nobody could read, which holds the verdict; `approves` hands a proved one to
`approval.py` measured from that last reading. Nothing here parks
recovery.py the silent retry of a push race or dev timeout, both through the size gate -- the
timeout's commit is the one road to a published pull request nothing else measures.
A timed-out round is answered by the BRANCH rather than by the run on both its
shapes, and on every road rather than on the drift one alone: `pre_dev_fix_sha` says
only whether the killed run committed at all, since it is the head that round OPENED
at and a commit an earlier interrupted resume left can sit between it and the
publication. Level with its publication clears; a commit the pull request has not got
is published through the same gate, named by the commit the reading froze and leased
to the remote tip it counted that commit against -- pinned to the anchor instead, the
push names a head the publication never carried and is refused unmeasured, parking a
human over work the branch is holding. On the requirements-drift road that commit is
also work no report describes, and which run made it decides: one the KILLED run made
publishes with the debt staged into the write the push makes, since nothing here can
ask a session that is gone, and the review hold asks a human before any reviewer
reads that head, while one an earlier resume stranded leaves the park standing for
the reply that reports it. A reading nobody could take holds, because a clear taken
on one sends the next reviewer to a checkout with no receipt and no gate debt behind
it. Both holds answer in a word of their own rather than as a condition that has not
cleared, which is what keeps the branch reading out of the fixing stage's worktree-drift
reroute: relabelled there, the park comes down and the checkout is published by a road
that stages nothing for it -- the debt the push that lands pays, the round `rounds.py` says that push spends, which
is none where the park was delaying a publication an `in_review` hand-back had already
reset the budget for, the held outcome that owes the caller no follow-up and
no relabel, and the one sentence a park that healed itself owes the thread
rounds.py the `review_round` a fix pays for on the one event `MAX_REVIEW_ROUNDS` counts -- a head
the reviewer has not seen reaching the pull request, or the report of that head reaching
it, since the next reviewer reads both -- spent by the push that lands, by the hold that
sends the candidate to the adjudication, and by the write that settles a report no gate
ever saw, the frozen form handed to all three so the count is neither lost to a crash in
the relabel window nor taken twice; the pair a reviewer-requested round closes, which is
that round and the replay anchor its handover consumes; and the publications that spend
nothing -- one a drift park still owes, whose budget an `in_review` requirements edit
already reset and whose delayed landing would otherwise charge that edit twice, and one
whose own RECORD already carries the round, since a fixing round that finished on a
report froze its bookmarks and its round there precisely so the write completing the
publication is the only thing that spends them. The record is asked rather than the
debt, because the two part company: a drift resume records a report carrying no
bookkeeping at all, and read off the debt that reviewer would be handed a head no round
was ever spent on. Both are asked by the resume that answers such a park and by the
silent retry that finishes its push
models.py the frozen records several owners in this stage hand each other -- a record one
route builds and reads alone stays beside that route instead -- the awaiting context,
whose park reason is a word or none, a hand edit's list or object read as a reason no
route knows rather than asked about a set it cannot join, the park clear
every awaiting road takes, which drops the unanswered-edit claim with the park it was
written beside, the two settlements an awaiting road may take -- the whole batch, or
ONE control comment the orchestrator answered rather than delivered, with every other
comment held in as an omission so no mark crosses words nobody read -- the record
that such an answer already stands on the thread, and the note a reply's round is
owed by; a reviewer run carries the evidence its prompt handed as current, the only
evidence a reuse may name
state.py the pinned-state keys, park reasons, and outcome tokens they share -- with the
grouping of the reviewer-side parks whose reply buys a fresh reviewer and that the
drift check stands down for, `reviewer_unverified`, `reviewer_unrecorded`, and
`reviewer_usage_limit` among them, none of which retries itself, the last answered
only by `/orchestrator continue` and set by a Codex reviewer its usage limit stopped
(`reviewer.py`) -- including the
three that outlive their own tick: the claim that a requirements edit this stage's
resume ended without answering is still outstanding, the note left for a reviewer
round still owed -- the park it was written beside is gone before that round runs
-- whose value says whether a reply bought the round, and so whether the round has
anything to record, and the comment a review-cap grant was written for, which is
how a grant already honored is told from one a refused round left still owed. Two
of the outcome tokens are about what a caller may do NEXT rather than about what
healed: the word a silent retry answers with when the BRANCH reading is what
withheld the clear -- told apart from a transient condition that merely has not
resolved, since only the second licenses the fixing stage's worktree-drift reroute
-- and the grouping of every outcome that healed nothing, which is what keeps a road
testing for the words it knows from reading a later addition as a recovery. The fields
a write laid over the comment as it stands keeps both moves of are named here too, with
how: the `issue_*` usage totals add up -- the run and token counts as whole numbers --
`issue_cost_sources` joins, and a comment-id watermark keeps whichever reading went
further, each only over values spelled as its writers spell them; every other field
both moved, and one a hand edit left in no writer's shape, is one road's to say