Lineage stage 3: converge admission, status and label mutations atomically

[jeffhuber]

Part of #963, stabilization epic #979, and roadmap #900. Depends on accepted #990 (pure contract) and #991 (trusted delivery/publication). Replaces the admission/projection portion of unaccepted draft PR #989.

Problem and outcome

Every consumer must resolve the same exact-head contribution history and enforce admission before provider execution or label mutation. The convergence checkpoint found gate/status/controller/Board rejecting a configured branch conflict while Greptile structural requeue still mutated labels when episodes were empty.

Scope

• Direct Codex/Claude/Devin reviewer wrappers, including legacy Devin entrypoint, use one shared contributor-excluded admission decision before launch.
• Actual gate and both generated/package templates validate raw authoritative history before flattening/filtering; preserve current-head review and independent authority policy.
• SaaS/trailer/Greptile labeler entrypoints (check_run, live/replayed issue_comment and pull_request_review) carry the fetched exact head/branch and complete trusted history.
• All label mutation paths, including structural requeue and failure paths, require resolved eligible lineage first, regardless of episode count.
• Status/controller/Board and setup-rendered contracts preserve configured branch provenance and canonical identity semantics; informational versus merge-authority review stays separate.
• Complete canonical/tools/template/package mirror and import/materialization parity.
• Activate automatic runner publication/label reconciliation only in this final integration stage, after every consumer is wired to the accepted contract; maintained runner and both template/package copies move together.
• Activate delivery reconciliation and consumer admission atomically, including both Greptile structural failure paths on configured branch conflict with zero episodes. Episode presence is never a substitute for a resolved full decision.

Deterministic consumer matrix

Consume the eventually accepted #994 typed core and #991 producer adapters. Every exact route constructs one validated Target, preserves declared Identity/Authorities, validates raw History, combines raw arrivals once into a bound Chain, then uses the full resolve/admit decision. Core status ready must be translated deliberately if a legacy projection retains resolved; episode presence and current-writer fields never substitute for readiness. Keep I/O outside the pure core and reuse the already pinned trusted base. Activate all automatic runner/CLI publication and label transitions together with consumer admission, including maintained, generated and package copies.

Map every entrypoint to exact target binding, raw transport validation, configured branch conflict, ordinary matched/custom/no-contract controls, valid verified takeover/continuation, contributor exclusion, no-independent-reviewer owner action, and admission-before-side-effect. Include malformed/null/optional field controls, ambiguous/empty markers, 32-step cumulative history, semantic publication readback consumption, and normal single-builder behavior. Actual entrypoints are required; lower-helper tests alone do not prove composition.

Preserve both confirmed Greptile pull_request_review failure paths as real entrypoint tests: missing review ID and inline-comment fetch failure with required review comments. With a configured codex/ branch policy, branch codex/topic, builder:claude, an unmapped opener and genuine empty history, assert conflict and zero added or removed labels, including existing done/blocked labels. Compare the same fixture through gate and status/controller/Board; matched, custom-prefix and no-contract controls must retain valid behavior. No if episodes exemption.

Acceptance and Code Mower delivery

One isolated Code Mower Claude writer, one draft child PR using Refs #963, qualified independent exact-head Codex review with demonstrable complete diff/source coverage, no unresolved P0/P1/P2, deterministic matrix, exact unittest discovery, focused/Ruff/privacy/package checks, full CI and authoritative gate. No hosted Devin create allowance. #963 closes only after all three staged PRs are accepted and the shared outcome matrix passes on final main; #915 still verifies actual release artifacts and publication.

[jeffhuber]

Assignment update after accepted #990/#991: Codex source author, independent Claude reviewer. The earlier planned Claude/Codex assignment is superseded; historical prototype diffs are not inherited source authority.

Start from accepted main a420a8cf97ca596dcc583a7c1bb64657de44d392, whose stage-2 tree matches independently reviewed PR #995. One isolated writer and Code Mower session/lease, one draft issue-linked PR, and no automatic retry. The initial attempt is capped at 1,800 seconds / 32 MiB of output, with a hard 44-path / 400,000-byte diff envelope; no native dollar cap or model override is implied.

Deliver the complete atomic consumer/producer integration, including zero-episode branch conflicts on every label route, all contributor exclusions, bounded gate/status/Board projections, a verified takeover→continuation→second-takeover flow with explicit sequence, and genuine candidate-package execution. Preserve the accepted typed core and producer semantics. Update stage-2 inactivity assertions into actual activation and legacy-capability refusal without weakening business/origin/readback/bounds tests.

Trusted configuration remains pinned to the selected immutable base. Authorities remain separate from identity/reviewer aliases. Every consumer uses the full Target/History/Chain/resolve/admit decision, including genuine empty/no-authority controls; producer observation is not a generic consumer resolver. One LineageRound object lives through launch, supervision and post-exit collection. Required private evidence cannot become absent through exception fallback, and workflow inputs cannot establish their own policy provenance.

The existing code-mower==1.4.0 pin remains. Missing installed capability refuses before publication, label or attribution effects. #915 separately qualifies emitted artifacts with published 1.4.1 before claiming installed production activation. Stop for a concrete design or scope decision; source delivery, qualified independent exact-head review, CI/gate and observed writer/lease closeout precede merge. #963 remains open until the shared final-main matrix is accepted.

[jeffhuber]

Root design disposition for the final atomic lineage integration:

The initial implementation stopped before edits after confirming that a third writer cannot use the original writer’s branch prefix as proof of ownership. The approved extension accepts an optional, typed ownership observation backed by a nonempty verified chain for the exact repository, PR, case-preserved branch and pre-launch head. Its current writer and contributors must match the chain. Invalid supplied proof refuses without a prefix fallback; absent proof preserves the existing first-handoff checks. All actual source-exit and quiescence checks remain required.

The same Codex implementation session is continuing with independent Claude review. The scope remains at most 44 paths and 400,000 diff bytes, with no automatic retry. Regression coverage must include takeover, continuation and third-writer handoff, plus malformed, empty, stale and mismatched ownership refusing before launch. #963 remains open until the complete integration and final acceptance matrix pass.

[jeffhuber]

Root scope amendment superseding the earlier 44- and 51-path selections:

The accepted-base inventory identified nine existing test modules whose positive fixtures must be migrated for exact heads, trusted pinned-base policy, explicit history, declared identity fields and complete generated-runner snapshots. The changelog moves to release #915. The complete named selection is now at most 52 physical paths / 400,000 diff bytes. Business acceptance remains the same complete atomic consumer/producer matrix, including takeover, continuation and third-writer handoff. Core, producer storage/publication, role/runtime and actual source-exit checks remain protected. No identity-only fallback, skipped business test or admission mock is permitted.

The prior scope-stop retained an incomplete private patch and restored the tracked checkout. Root also cancelled a prematurely launched continuation after the final runner fixture arrived; that was a coordination correction, not user cancellation or demonstrated provider implementation failure. No new PR was created. Historical attempts remain separate.

Root authorizes one explicit same-session Codex implementation continuation with independent Claude review, unchanged configured model, 1,800-second/32-MiB output bounds and no automatic retry. No new hosted Devin session is authorized. #963 remains open until the actual complete integration and final acceptance matrix pass.

[jeffhuber]

Source execution update: the preceding attempt exited before implementation because the configured Codex model was at capacity. It delivered no PR or head; source completion, quiescence, known process/group absence, clean checkout, and unchanged guards were independently verified. This was a provider-availability failure, not an implementation verdict.

One deliberate retry is now running through Code Mower with the same configured model, existing session and branch, accepted base a420a8cf97ca596dcc583a7c1bb64657de44d392, 52 selected paths, 400,000-byte diff limit, and 30-minute supervision limit. Automatic retry remains disabled. The writer applied its preserved incomplete patch and is correcting existing fixtures before the atomic consumer/runner checks. No candidate, independent verdict, or release qualification is claimed yet.

[jeffhuber]

Final #992 qualification and merge checkpoint

Draft #997 passed final qualification at head 6adb2f11e28922dba24874c01490f6f9b082de10: 3,750 full tests with 16 skips, 67 focused public-boundary checks, all six CI/package/containment jobs, and independent complete-input Claude review with zero P0/P1/P2/P3 findings. The authoritative Code Mower gate passed and auto-merged the exact head as 0b5fdcf78fe0ec7d76042fbdae5e4d3c5849c514. The tested, reviewed, and merged tree is 7b5c6a14d61f40f173168862937dac01b7a3bad6.

Operational closeout exception: marking the PR ready allowed the Code Mower gate to auto-merge before the local orchestration lease was released. No source or review process remained. The lease was released immediately afterward and a fresh read observed it absent; the merged tree is unchanged. This ordering deviation is preserved rather than represented as a pre-merge lease release.

All three #963 stages and all eight #979 stabilization outcomes are now implemented on main. Graphify #982 refresh follows from the accepted merge commit; #915 remains responsible for package publication, installed verification, scorecard, metadata freshness, and final v1.4.1 closeout.