Wire delegation to A12's trigger, and implement A3's resume rule #25

2026-09-08T20:04:03Z

dev-agent commented

2026-09-08 20:04:03 +00:00

Two gaps found by auditing the spec against the code. The second was created by 7b landing the harness without its boot-time half.

The harness was connected to nothing

Only a live test constructed a Delegation. A12's failure-count trigger still gated to you, which A13 treats as the fallback when there is no delegate, not the intended path — so the whole harness was unreachable from production code, and DELEGATION_INTENT was defined but never used.

Consecutive command failures now hand the sub-task to the delegate, with the failures in the brief so it need not rediscover what the local model already learned the hard way. A usable handback lets the local loop carry on; anything else escalates, because a cap breach leaves a half-edited tree.

A3 step 5 was unimplemented

A crash mid-delegation failed safe — boot gated on "restarted mid-EXECUTING" — but it always gated, including on the clean cut A3 says should resume automatically, and it left the delegation branch orphaned, since _abandon only runs while the process is alive.

A delegation records an intent before the branch exists, and settles it whichever way it ends. An aborted delegation is a finished one; leaving the intent pending would make the next boot believe work was still in flight.
delegation_verdict implements the clean-cut test as an observable check, never model self-assessment: settled when a completion follows the start, absent when the branch was never created, gate on a tool_call with no recorded result, resume otherwise.
recover() sweeps at boot, announcing a resume with a notice rather than a question — a clean cut needs no decision from you — and leaving an unclean cut pending so the generic sweep gates on it.
resume() continues the same delegation rather than starting a second one: no new branch, no second delegation_started. A10 defines a session as the delegation, not the process lifetime, which is what makes resuming legitimate.

One honest limit, stated in the code

A3 says the branch must sit "at the expected commit". I approximate that by the branch existing and carrying the delegation's commits, because per-turn shas are not recorded in the log — so a branch rewritten out from under us would go undetected. Closing that properly needs a canonical event carrying the sha, which felt like scope creep here but is the obvious follow-up if you want the check to match the wording.

16 new unit tests covering the trigger, the four verdicts, resume-continues-the-same-session, and each branch of the boot sweep. 257 unit + 17 integration green locally.

🤖 Generated with Claude Code

Two gaps found by auditing the spec against the code. The second was created by 7b landing the harness without its boot-time half. ### The harness was connected to nothing Only a live test constructed a `Delegation`. A12's failure-count trigger still gated to you, which A13 treats as the *fallback* when there is no delegate, not the intended path — so the whole harness was unreachable from production code, and `DELEGATION_INTENT` was defined but never used. Consecutive command failures now hand the sub-task to the delegate, **with the failures in the brief** so it need not rediscover what the local model already learned the hard way. A usable handback lets the local loop carry on; anything else escalates, because a cap breach leaves a half-edited tree. ### A3 step 5 was unimplemented A crash mid-delegation *failed safe* — boot gated on "restarted mid-EXECUTING" — but it always gated, including on the clean cut A3 says should resume automatically, and it left the delegation branch orphaned, since `_abandon` only runs while the process is alive. - A delegation **records an intent before the branch exists**, and settles it whichever way it ends. An aborted delegation is a *finished* one; leaving the intent pending would make the next boot believe work was still in flight. - **`delegation_verdict`** implements the clean-cut test as an observable check, never model self-assessment: *settled* when a completion follows the start, *absent* when the branch was never created, *gate* on a `tool_call` with no recorded result, *resume* otherwise. - **`recover()`** sweeps at boot, announcing a resume with a **notice rather than a question** — a clean cut needs no decision from you — and leaving an unclean cut pending so the generic sweep gates on it. - **`resume()`** continues the *same* delegation rather than starting a second one: no new branch, no second `delegation_started`. A10 defines a session as the delegation, not the process lifetime, which is what makes resuming legitimate. ### One honest limit, stated in the code A3 says the branch must sit "at the expected commit". I approximate that by the branch existing and carrying the delegation's commits, because per-turn shas are not recorded in the log — so a branch rewritten out from under us would go undetected. Closing that properly needs a canonical event carrying the sha, which felt like scope creep here but is the obvious follow-up if you want the check to match the wording. 16 new unit tests covering the trigger, the four verdicts, resume-continues-the-same-session, and each branch of the boot sweep. 257 unit + 17 integration green locally. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dev-agent added 1 commit 2026-09-08 20:04:03 +00:00

Wire delegation to A12's trigger, and implement A3's resume rule

CI / checks (push) Skipped

CI / checks (pull_request) Successful in 1m8s

Details

ce436262f4

Two gaps found by auditing spec against code, the second created by
7b landing the harness without its boot-time half.

**The harness was not connected to anything.** Only a live test
constructed a Delegation; A12's failure-count trigger still gated to
the human, which A13 describes as the fallback rather than the path.
Consecutive command failures now hand the sub-task to the delegate,
with the failures in the brief so it need not rediscover what the
local model learned the hard way. A usable handback lets the local
loop carry on; anything else escalates, because a cap breach leaves a
half-edited tree.

**A3 step 5 was unimplemented.** A crash mid-delegation failed safe —
boot gated on "restarted mid-EXECUTING" — but always gated, even on
the clean cut the spec says should resume, and left the branch orphaned
because _abandon only runs while the process lives.

- A delegation now records an intent before the branch exists, and
  settles it whichever way the delegation ends; an aborted delegation
  is a finished one, and leaving it pending would make the next boot
  believe work was still in flight
- delegation_verdict implements the clean-cut test as an observable
  check, never model self-assessment: settled if a completion follows
  the start, absent if the branch was never created, gate on a
  tool_call with no recorded result, resume otherwise
- recover() sweeps at boot, announcing a resume with a notice rather
  than a question, since a clean cut needs no decision from the
  operator, and leaving an unclean one pending so the generic sweep
  gates on it
- resume() continues the same delegation rather than starting a
  second: no new branch, no second delegation_started, because A10
  defines a session as the delegation, not the process lifetime

Honest limit, stated in the code: "the branch sits at the expected
commit" is approximated by the branch existing and carrying the work,
since per-turn shas are not recorded in the log, so a branch rewritten
underneath us would go undetected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dongar approved these changes

2026-09-08 21:46:22 +00:00

dongar merged commit 6331fcafd9 into main

2026-09-08 21:46:26 +00:00

dongar deleted branch delegation-resume

2026-09-08 21:46:26 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dev/nisse#25