[ronak-guliani]

Stacked on #420 (feat/validation-coordinator-lifecycle).

Depends on:

• #418 environment manager (moved to apps/server/src/validation/)
• #419 policy + repository runner
• #420 lifecycle base
• #421 browser executor + evidence

Once those land, retarget/rebase onto main.

Integration

• Coordinator owns plan via ValidationPolicy + checkpoint changed paths
• Repository gates via RepositoryValidationRunner (distinct attempts, bounded refs, redaction)
• Browser gates via BrowserValidationExecutor against acquired env; preflight before token; recording-required blocked until verified decoder
• Pairing-self-test via pnpm test:self, required only when selected
• Deterministic order, failure stops dependents, interruption resumable, drift->stale, duplicate idempotent, lease expiry rejects late, lease release on terminal
• Env/process/port persisted via diagnostics/outputRef, no credentials
• Timeline shows state, active gate, results/blockers, exact revision, evidence refs

Canonical contracts

• validation.ts: durable run/gate/result/lease/target (+interrupted result status)
• browserValidation.ts: rich scenario/evidence
• Simple ValidationScenario for request, rich BrowserValidationScenario for execution
• Structured result durable; browser result mapped with media refs
• Moved validationEnvironmentManager from scripts to server, preserved interface/tests
• Browser scope: validation-isolated providerSessionId validation:<runId>, preview-only, env/thread-bound; no weakening
• Recording-required blocked until verified decoder; PNG CRC-checked; file persistence for media

Validation

• Focused: ValidationPlanner, GateExecutor mapping, CoordinatorIntegration, Policy, Runner, BrowserEvidence/Executor, EnvManager, contracts validation, decider.validation — 88 passed
• pnpm fmt:check pass, pnpm lint warnings only, pnpm typecheck pass (suggestions only), pnpm test full suite pass (server 2510+102, web 1931, etc.)
• Tested revision: d025466 (plus stacked adapter commits 0936dd0, 94e4663, 2377f3d, a09135a, ed39954, a46a49b on base ea62420)
• Real-client pass (isolated, Playwright Chromium, base /tmp/t3code-test.0LsDBe, server 13773, web 5733):
  • Actions: opened web app, paired with fresh one-time token via pairing input, waited for redirect, asserted title contains T3, visible text contains Search, load complete; captured console/network; then tried invalid token for blocked state
  • Observations: ready true (all 3 assertions passed), 1 console error (pre-pairing WebSocket auth failure, expected unauthenticated rejection, no further errors after auth), 0 failed HTTP requests; blocked state shows actionable Invalid pairing token message
  • Evidence: validation-ready.png (authenticated app, no credentials), validation-blocked.png (invalid token error, masked input, no real credentials)
  • Limitations: empty workspace (no threads/projects), so timeline validation matrix not shown; full coordinator e2e (repo gates + browser gates via UI trigger) covered by integration tests, not exercised end-to-end in browser (no UI trigger yet); dev-runner full stack fails pre-existing (vp filter recursion), used manual server+web startup with same isolated base/ports; collaborative browser snapshot unavailable (no connected host), used Playwright for captures

Limitations / follow-up

• Env reuse adopts current server (no separate launch); release no-ops for current PID, preserves diagnostics
• Recording-required scenarios blocked (no verified production decoder yet)
• Validation trigger has no UI button yet; coordinator request via RPC; real-client validates browser assertions + timeline display (matrix code covered, not shown with empty workspace)
• Second BootstrapCredentialService instance shares DB for one-time tokens; PubSub not shared (ok for validation)
• Dev-runner pnpm dev full stack fails pre-existing (vp filter t3 matches root, recursion); used manual isolated server+web for real-client; fix dev-runner filters separately

Feature captures

PR head at upload: d025466a0075c3529a9be662a5d84d376261c633. See the testing notes for exercised behavior and limitations; uploading media is not a test result.

[ronak-guliani]

Stacked PR updated for latest dependency revisions

Pushed update bringing this stack current without force-push (merge + cherry-picks on top of the previous integration commit).

Newly integrated since the last push:

• Add durable validation coordinator lifecycle #420 @ 9997865: coordinator lifecycle hardening (b930e4c2c8, terminal-aware re-plan guards), legacy-run fence (f2dedbfbea), plus upstream feat(preview): saveable snapshots, recording transfer, native-client check #405/fix(opencode): recover silent and ambiguous turns #422 merges (merged here via 4119514294)
• Implement browser validation executor and evidence #421: browser evidence/recording cleanup (234f0a4604) and ffprobe recording decoder + cleanup diagnostics (c821d4e006) (cherry-picked as a83785c087, 7a36778b5a)
• feat: add validation environment manager #418 / feat: add repository validation runner #419: no new commits (still 65df75605e / 1143686a68)

Conflict resolution (ValidationCoordinatorReactor.ts): kept coordinator-owned policy planning (planCoordinatorRunWithPolicy + changed paths) and real gate execution (placeholder blockUnavailableGates/planValidationCoordinatorRun stay deleted); adopted the new canonical pieces — validationRunEffectiveStatus/isValidationRunTerminal checks, isValidationCoordinatorOwnedRun legacy fence, lease-expiry release, terminal-aware re-plan guard, and the lease-releasing target-error path. Interrupted keeps release + resume-to-planned (it is terminal per the new taxonomy, so it is checked first). Dropped the now-redundant releaseLeaseIfTerminal helper in favor of the unconditional releaseLease at already-terminal call sites.

Validation on final tree (7a36778b5a):

• Focused: 11 files / 96 tests passed (planner, gate-executor, coordinator integration, policy, repo runner, browser executor/evidence, env manager, contracts, decider + orchestration reactor fence tests)
• Orchestration dir: 40 files / 503 tests passed
• pnpm typecheck: 0 errors; pnpm fmt:check: pass; pnpm lint: warnings only, 0 errors
• pnpm test full suite: exit 0 (server 2526+102, web 1931, all 13 tasks green)

Still stacked on feat/validation-coordinator-lifecycle; retarget/rebase onto main after #418, #419, #420, #421 land.

[ronak-guliani]

Review findings addressed in 4d28dd0

All six findings are fixed on this branch (fast-forward push, no force-push):

1. P0 — stable process start identity (ValidationEnvironmentService.ts): the start identity is now captured once per process at module scope instead of recomputing process.uptime().toFixed(3) on every probe, so launch records and later inspect calls agree. New ValidationEnvironmentService.test.ts spins a real local readiness server, acquires, advances the clock 25ms, and re-acquires with a fresh manager — asserting same ownership identity and process (reuse, not pid-reuse). Verified the test fails with the fix stashed.
2. P1 — real attempt number (ValidationGateExecutor.ts): new exported attemptNumberForAttemptId parses the trailing counter from the reactor's attempt:<run>:<gate>:<n> id (falls back to 1 for foreign ids) and passes it to the repository runner, so retries get distinct artifact:<id>-attempt-<n> keys. Unit-tested.
3. P1 — token redaction everywhere post-pair (BrowserValidationExecutor.ts): new safeMessage closure reads the live pairing token (empty before issuance/after revocation) and replaces all broker-failure message paths, including the recording-stop cleanup diagnostic that used raw diagnosticFromError. Parameterized test covers openAndSnapshot/press/recordingStart/recordingStop echoing the token.
4. P1 — sanitized media filenames (ValidationGateExecutor.ts): new exported mediaFileNameForGate accepts only [A-Za-z0-9._-] segments (rejecting .., empty, slashes, spaces); violations throw before any write, surfacing as blocked rather than escaping baseDir/validation/<runId>. Unit-tested with ../../evil and friends.
5. P1 — stale persisted recovery (ValidationEnvironmentManager.ts): the fresh-launch block is extracted to launchFresh; a failed persisted revalidation now records a diagnostic, terminates the stale owner via cleanupOwned(removeState: true), and launches fresh instead of timing out on the same stale file forever. Cleanup-ambiguous still propagates without relaunching over ambiguous ownership. New manager test kills the persisted backend and asserts relaunch with new ownership/pids and corrected state.
6. P2 — outputRef disclosure (ValidationGateExecutor.ts): browser outputRef is now browser:<kind>:<hash16> only; absolute persistedPath no longer interpolated. Existing mapping test strengthened to assert the exact ref and absence of the path.

Validation on 4d28dd0: focused validation+orchestration+contracts 50 files / 599 tests passed; pnpm typecheck 0 errors; pnpm fmt:check pass; pnpm lint no errors; full pnpm test exit 0 (server 2534 incl. the new service test, web 1931, all tasks green). Still stacked on feat/validation-coordinator-lifecycle.

[ronak-guliani]

Follow-up findings addressed in e37734f

Both findings from the latest review are fixed (fast-forward push):

P1 — reset interrupted gates on resume (ValidationCoordinatorReactor.ts): the interrupted branch now dispatches a per-gate reset (interrupted → pending, stale refs cleared, attempts history preserved) for every interrupted gate before the run-level resume, so the pending-only selector can schedule again instead of stalling in running. Reset and resume command ids embed run.updatedAt so repeated interruption cycles cannot dedupe each other away (same pattern as lease claims); resets are skipped only when the run has no executor id, in which case no gate could have been running. The next-gate selector is extracted unchanged to exported selectNextRunnableGate in ValidationPlanner.ts and used by the reactor.

• Tests: planner unit test proves an interrupted gate blocks selection and a reset restores it; integration test proves the decider accepts and projects the exact interrupted → pending reset command the reactor emits.

P2 — per-run artifact keys (RepositoryValidationRunner.ts, ValidationGateExecutor.ts): specs accept an optional scope validated against the artifact-key alphabet (violations become invalid-spec without executing); keys become <scope>-<gate>-attempt-<n>, unscoped callers keep the legacy key. The executor scopes every run via new artifactScopeForRun (validation:req-1 → validation-req-1, injective over UUID request ids, length-bounded), so concurrent runs no longer share .log files and outputRef (artifact:<scope>-<gate>-attempt-<n>:<sha>) identifies the producing run.

• Tests: key-derivation units, a two-scope write test asserting both artifacts survive with distinct keys, unsafe-scope rejection, and executor scope/outputRef assertions.

Validation on e37734f: validation+orchestration+contracts 50 files / 604 tests passed; pnpm typecheck 0 errors; pnpm fmt:check pass; pnpm lint no errors in touched files; full pnpm test exit 0. Still stacked on feat/validation-coordinator-lifecycle.

[ronak-guliani]

Review findings addressed in 47f0a8c

All three findings fixed (fast-forward push):

P2 — transition run when gate kind has no runner (ValidationCoordinatorReactor.ts): the unknown-kind branch now dispatches thread.validation.result.record with a synthesized blocked result (same attempt id, lease, executor, actionable no integrated runner reason) instead of a bare gate update. Through acceptValidationResult this marks the gate blocked and transitions the run to blocked — terminal, lease-releasing, and actionable — instead of stalling in running behind a gate the selector can never pass.

• Test: integration test decides + projects the exact result-record command and asserts run and gate reach blocked with the reason preserved.

P3 — dead sha removed (ValidationGateExecutor.ts): deleted the unused sha computation, void sha, and the now-unused createHash import. No behavior change (proven by unchanged mapping tests).

P3 — actionable preflight mismatches (BrowserValidationExecutor.ts): preflightFailureMessage now takes the execution environment and reports unrequested targets (did not request the expected validation target) and environment mismatches (attached to a different environment), ordered to mirror preflightIsUsable.

• Tests: two executor tests assert the exact diagnostics with no token issued.

Validation on 47f0a8c: focused validation+orchestration+contracts 50 files / 607 tests passed; pnpm typecheck 0 errors; pnpm fmt:check pass; pnpm lint clean in touched files; full pnpm test exit 0. Still stacked on feat/validation-coordinator-lifecycle.