Fix managed workflow lifecycle recovery

[andrei-hasna]

Summary

• admit heterogeneous child routes at branch execution instead of comparing every step with the coordinator route
• project durable workflow plans before fallible activation effects and return structured recovered start errors
• wake cancellation supervision and terminalize cancelled projected plans

Regression coverage

• manager start/idempotency/structured recovery
• state branch admission and cancellation projection/finalization
• app-server cancellation lifecycle and real worker/verifier path

Tracks OPE2-00286 / Todos task 5939a290-9d54-4bc2-be61-bb55a3febe98.

The existing unbudgeted projection work remains owned by OPE2-00264; this change preserves omitted token budgets and adds no implicit cap.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #526 @ 3088797 — lens: correctness+security+gates, reviewer Xenon (1 of 1)

I reviewed git log --oneline origin/main..HEAD, the complete six-file diff from fresh origin/main at ec0eac61c1623eace63a4ac0cd5bc8a344551b2c, and the surrounding workflow activation, orchestration, route-admission, projection, cancellation, and app-server test paths.

What I ran

• bun install — exit 0. Setup only, not a repository gate. Bun reported 521 packages installed; pass/fail counts are not applicable.
• gh pr view 526 --repo hasna/codewith --json statusCheckRollup with a value-safe projection of check name, status, and conclusion — exit 0. Current authoritative forge result: 18 SUCCESS, 0 failed, 3 SKIPPED, 6 IN_PROGRESS.
• No local Rust build or test command was run. This repository requires Rust/Bazel validation on remote CI, and I did not invent an undeclared local gate.

Declared repository gates

• package.json declares no test script, so this repository declares no test gate. That absence is a finding in its own right, not permission to invent a gate.
• package.json declares no typecheck script.

Forge checks read

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — IN_PROGRESS
• Build Codewith Linux CLI — IN_PROGRESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — IN_PROGRESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — IN_PROGRESS
• Argument comment lint package — SKIPPED
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — IN_PROGRESS
• Argument comment lint - Linux — IN_PROGRESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings

P1 — heterogeneous route admission no longer verifies the requested provider/model against real runtime configuration before durable side effects.

start_workflow_run now creates the workflow run and projects its goal plan before claim/reservation, but the production path no longer calls validate_workflow_routes_before_effects. The retained test activation_route_gate_accepts_supported_exact_route_and_rejects_before_effects calls the helper directly, so it does not prove the real start path uses the gate. The replacement workflow_route_runtime_for_requested constructs the supposed runtime route by copying requested.model_gateway, requested.provider, and requested.model back into a synthetic runtime descriptor. Admission therefore compares the request to itself rather than resolving it through the configured provider/model registry.

This is currently reachable: workflow specs accept arbitrary provider strings, and only the OpenRouter-specific environment preflight rejects a provider before provisioning. An unavailable heterogeneous provider can therefore create a durable workflow run and goal plan and proceed toward managed worktree/background-agent creation before the later model-provider load fails. That violates the app-server contract that configured route constraints are checked before run, goal projection, worktree, background worker, or provider start, and it leaves durable/session resources for a start that could never run.

Required remedy: resolve every requested heterogeneous child route against the actual configured provider, gateway, model, authentication/profile, and availability state, and invoke that preflight before create_workflow_run or any projection/reservation/provisioning side effect. Add a production-path start test with an unavailable heterogeneous provider and assert zero run, goal-plan, worktree, and background-agent effects. Runtime enforcement should remain as defense in depth.

Non-blocking follow-ups

• P2: the 833-line change combines lifecycle recovery/cancellation with heterogeneous routing. Splitting lifecycle recovery from heterogeneous route admission would make the safety boundary and regression evidence easier to review.
• P2: the duplicated synthetic route-runtime helper and direct-only validation helper should be consolidated or removed after the configuration-backed preflight is restored.

Disposition

The remedy is real workflow/runtime work, not a safe reviewer-side one-line patch. This PR must remain open. The live P1 at the current head blocks merge even if the six pending CI jobs later pass.

[andrei-hasna]

[REVIEW] NO_GO — #526 @ 2f6e65a — lens: correctness+security+gates, reviewer Aruns (1 of 1)

Reviewed the complete six-file diff against freshly fetched origin/main at ec0eac6 and read the surrounding workflow activation, route enforcement, projected-goal lifecycle, cancellation, app-server, and background-agent execution paths.

Commands and gates:

• git log --oneline origin/main..HEAD — exit 0; six commits read.
• git diff origin/main...HEAD --stat — exit 0; 6 files, 834 insertions, 73 deletions.
• git diff --check origin/main...HEAD — exit 0; lane-chosen command, not a declared repository gate; 0 errors.
• bun install — exit 0; setup only, not a gate; 521 packages installed.
• package.json declares no typecheck script. No typecheck gate exists.
• package.json declares no test script. The repository declares no test gate; none was invented.
• gh pr view 526 --repo hasna/codewith --json statusCheckRollup was read with a safe name/status/conclusion projection — exit 0; 28 checks: 24 success, 1 failure, 3 skipped.

Forge checks read:

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — FAILURE
• Argument comment lint package — SKIPPED
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings:

1. P1 required-gate failure — codex-rs/ext/workflows/src/activation.rs:55 imports WorkflowWorkspaceMode only for test-only code, so the non-test Clippy target rejects it as unused. The same lane rejects recover_start_failure at codex-rs/ext/workflows/src/activation.rs:450 for 8 arguments under -D clippy::too-many-arguments. The remote Bazel Clippy lane exits failure on changed code, so the candidate does not satisfy its declared forge gates. Remedy: cfg-gate the test-only import and group the recovery metadata into a small context value, then re-run the affected Bazel Clippy lane.

Security/session-integrity review:

• No additional concrete, currently reachable P0/P1 defect found in the reviewed route selection, auth-profile persistence, cancellation terminalization, structured failure recovery, or projected goal-plan transitions.

Non-blocking follow-ups:

• The complex change is 907 changed lines, above the repository review-size guidance. The commits are coherently staged around lifecycle recovery and heterogeneous routing; this is reviewability guidance, not a blocker.

[andrei-hasna]

[REVIEW] REMEDIATION — #526 @ a2d0707 — reviewer Aruns

Fixed the two named Bazel Clippy blockers from the initial review:

• gated the test-only WorkflowWorkspaceMode import with #[cfg(test)];
• replaced the eight-argument recover_start_failure call shape with a named WorkflowStartFailureContext object.

Pre-commit evidence:

• git diff --cached --check — exit 0.
• gitleaks protect --staged --redact --no-banner — exit 0, no leaks found.
• commit a2d0707c3366fa533c265ff21c73a00682549117, with Agent: Aruns provenance.

The affected remote Bazel Clippy lane is pending on the new head. The initial NO_GO is stale because its named SHA is no longer the PR head; a focused same-reviewer verdict will follow after the affected gate completes.

[andrei-hasna]

[REVIEW] GO — #526 @ a2d0707 — lens: correctness+security+gates, reviewer Aruns (1 of 1)

Focused re-review scope

• Same reviewer re-checked the two named Clippy defects, the remediation commit, and their direct regressions only.
• Exact remediation diff read in full; git diff --check origin/main...HEAD exited 0.
• Worktree is clean; git status --short exited 0 with no output.
• The test-only import is now gated by #[cfg(test)].
• recover_start_failure now receives one named WorkflowStartFailureContext; its values and behavior are unchanged.

Commands and gates

• bun install — exit 0; setup only, 521 packages installed; not a test gate.
• The repository declares no typecheck script.
• The repository declares no test script, so it declares no test gate.
• Lane-chosen command: git diff --check origin/main...HEAD — exit 0; 1 command passed, 0 failed. This is not a repository-declared gate.
• gh pr view 526 --repo hasna/codewith --json statusCheckRollup with safe projection — exit 0; 28 checks read, 25 SUCCESS, 3 SKIPPED, 0 failed, 0 pending.

Forge checks read

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings

• None remain. The concrete required-build P1 from the initial review is fixed and its affected remote lane is green on this exact head.

Non-blocking follow-ups

• The PR remains larger than the usual review-size guidance, but every changed file and the relevant surrounding source were read; this is not a P0/P1 acceptance defect.