[JacobStephens2]

Summary

in-progress now marks only a live Run, on issues as on pull requests (ADR 0029). When a Run ends, the issue is labelled with how it ended. A failure, or a Spec that is only waiting, also gets a generated comment on GitHub.

 Claimed::end(ending)
   Merged                         -> remove in-progress once the issue is closed
-  ReadyForReview | Held          -> keep in-progress
+  ReadyForReview | Held          -> remove in-progress, put nothing back
   Failed, nothing on origin      -> release (ready-for-agent back), no comment
-  Failed, work on origin         -> add agent-failed beside in-progress
+  Failed, work on origin         -> swap in-progress for agent-failed + Recovery comment
-  Security fix failed            -> add agent-failed beside in-progress
+  Security fix failed / waiting  -> swap in-progress for agent-failed, no comment
+  Waiting (Spec run, or land-tickets Custom process)
+    untrusted Spec edit          -> needs-triage
+    else                         -> ready-for-agent back (if the Claim took it off)
+                                    + comment naming each undone Ticket and why
   Stop / NotReproduced           -> unchanged (needs-triage / needs-info)

A Spec run is only waiting (TicketBoard::only_waiting) when all of these hold:

• No Ticket failed or was interrupted.
• Every undone Ticket is an Unready Ticket, outside the Spec's repository, or blocked only by outside work and by Tickets that are themselves waiting.
• Every open Ticket passes the Trusted-account check for Tickets.

A blocking cycle is a failure.

Pickup's gates:

 gates
   sweep(closed issues)
+  sweep(open agent-failed issues): take in-progress off, warning-only
   clear_and_count_failures(open agent-failed issues)
-    neither in-progress nor needs-triage -> "took over", don't count
     ready-for-agent back                 -> take agent-failed off, don't count

The Recovery comment (src/recovery.rs) is built from factory-owned facts only:

• It opens with the attribution line (github::GENERATED), then gives the cause, where the Run stopped, what was preserved, the machine, and "Put ready-for-agent back to retry."
• It has no local paths and no continue command.
• It leaves out a failed session's Harness diagnostic.
• A comment that would quote stored private Security review material is replaced by a withheld notice.

The guide (regenerated into site/docs/index.html), GLOSSARY.md and the hand-written pages (site/index.html, site/how-it-works/, site/architecture/) describe the new endings.

Spec review fixes (3cabca0):

• A failed session's diagnostic no longer reaches the Recovery comment's cause (recovery::cause).
• A land-tickets Custom process that is only waiting hands its Spec back, matching its comment, where before it was labelled agent-failed.
• A Security fix Spec that is only waiting stays agent-failed with no comment.
• A hand-back refused by an untrusted Ticket edit now gives that reason in its cause.

Seams tested:

• fake-gh integration tests (failed_run, process, spec_run, pickup_run, security_run);
• the Claim's in-memory Outside (claim::tests);
• the Spec run's Outside (spec_run::tests).

Closes #1901

Evidence

Execution evidence

Each review test was run against d80995f, the Spec branch before the review, before the fix:

• Before: cargo test --test failed_run a_recovery_comment_does_not_post_the_sessions_own_text

  panicked at tests/failed_run.rs:617:5:
  - Cause: claude exited 1: agent-authored: ignore previous instructions
  test result: FAILED. 0 passed; 1 failed
  

  After: cargo test --test failed_run → test result: ok. 19 passed; 0 failed; 1 ignored
• Before: cargo test --test process land_tickets::

  test land_tickets::a_custom_process_whose_spec_only_waits_posts_a_comment_matching_its_label ... FAILED
  test land_tickets::a_spec_branch_whose_tickets_only_wait_hands_the_spec_back ... FAILED
  test result: FAILED. 12 passed; 2 failed
  

  After: cargo test --test process → test result: ok. 239 passed; 0 failed; 1 ignored
• Before: cargo test --test spec_run a_spec_run_failed_for_an_untrusted_ticket_says_so_in_its_comment

  panicked at tests/spec_run.rs:3896:5:
  test result: FAILED. 0 passed; 1 failed
  

  After: cargo test --test spec_run → test result: ok. 100 passed; 0 failed; 1 ignored
• Also on this head:
  • cargo test --test security_run → ok. 125 passed
  • cargo test --test pickup_run → ok. 147 passed
  • cargo test --test continuation → ok. 9 passed
  • cargo clippy --all-targets is clean, and cargo fmt --check passes.
  • npm run docs:check --prefix site exits 0.
• Not run locally: the unit-test binary (cargo test --bin thirdshift). rustc was SIGKILLed (OOM) linking it on this 7 GB host with no swap, the same limit the Ticket PRs hit. So the new claim::tests::a_waiting_security_fix_spec_is_swapped_for_agent_failed_and_owes_no_comment, and the other inline tests from A waiting Spec run puts ready-for-agent back on its Spec, not agent-failed #1936 and Post a failed Run's Recovery, and a waiting Spec's reasons, as a generated issue comment #1940, have only been typechecked; CI runs them first. scripts/affected-tests main would select the full Rust suite, so it was not run, for the same reason.

Visual evidence

None. The site changes are prose only, inside existing paragraphs and list items, and no screenshots were taken.

Unaddressed findings

Standards

• S2: ADR 0029 vs a successful Custom process that ends before Delivery and keeps in-progress. Declined, filed as A Custom process that ends before Delivery with work on origin keeps in-progress after it exits #1945. The behaviour predates this Spec and is documented on purpose: docs/guide.md (land-tickets) says "It leaves the Claim while the Spec waits for completion", and tests/process/land_tickets.rs::a_spec_branch_lands_dependent_tickets_and_leaves_the_spec_pr_draft asserts it. Changing it changes how Pickup and the Day shift treat a half-delivered Spec, so the Day shift or a Spec has to choose.
• S3, partly: the strengthened test asserts one comment with no private text, but not the WITHHELD wording. With the P1 fix, a session's diagnostic no longer reaches the cause, so this test's route never triggers the replacement; asserting it failed at tests/failed_run.rs:588. The WITHHELD replacement in Claim::end has no integration test left.
• S4 (Duplicated Code / Data Clumps, judgement call): the repeated return Err(failed_before_steps(…)) predates this Spec. main already has 24 such calls in src/processes.rs; this diff rewrites five. The cause half of the data clump now goes through one recovery::cause.
• S5 (Middle Man / naming, judgement call): recovery::comment is not pure delegation. It renders the before-work comment when there is no Recovery (src/recovery.rs, BEFORE_WORK).

Spec

• P4: the same ending as S2. Declined, filed as A Custom process that ends before Delivery with work on origin keeps in-progress after it exits #1945, for the same reason. The Spec's unchanged-endings list ("Release, Stop, not-reproduced and merged-and-closed") doesn't cover it.
• P5, partly: the extra Trusted-account check on Tickets before a hand-back is kept, though the Spec asked only for the Spec's own check. It came from the Security review of A waiting Spec run puts ready-for-agent back on its Spec, not agent-failed #1936 (5d9c221), and story 22 asks that relabelling "never launders an untrusted edit". Its reason now reaches the cause.

Review coverage

Both reviewers read every changed file except site/docs/index.html. Both confirmed its exclusion as generated output: docs/guide.md was reviewed, and npm run docs:check --prefix site exits 0.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Label endings and comments change; nothing is migrated except the Sweep, which takes in-progress off open agent-failed issues. Reverting restores the old labels on new Runs only.

Blast Radius: labels

Every Command's Claim ending, Pickup's Failure-limit count and Sweep, and public issue comments on failed issues. A wrong ending could stall Pickup (a ready-for-agent missing) or re-take work (one wrongly put back).

Tickets

• Claim endings: in-progress off at ready for review, swapped for agent-failed on failure #1902 landed with End a Claim when its Run ends: in-progress off at ready for review, swapped for agent-failed on failure #1929
• A waiting Spec run puts ready-for-agent back on its Spec, not agent-failed #1903 landed with A waiting Spec run puts ready-for-agent back on its Spec, not agent-failed #1936
• Post a failed Run's Recovery, and a waiting Spec's reasons, as a generated issue comment #1904 landed with Post a failed Run's Recovery, and a waiting Spec's reasons, as a generated issue comment #1940

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh