diff --git a/BURNIN.md b/BURNIN.md index df0112e..7fa8eac 100644 --- a/BURNIN.md +++ b/BURNIN.md @@ -2414,3 +2414,113 @@ Unchanged and all operational rather than runtime: 29 blocked `test-e2e` tasks, three unschedulable `correx` tasks, and the Gitea 422 on reviewing your own pull request. The rig task above will requeue when the probe lease expires and start fresh, which is correct: its anchor was abandoned, not committed. + +## Run 14, 2026-08-28: plan-phase execution proven on `3c7cf95` + +Four tasks. Two carried a full lifecycle to a pull request, one failed for a +cause outside Orchestra, and the F60 rig task failed on its retry budget. + +### The rung: the worker runs the sealed plan's commands + +Task `06G4M8WHGQ4P3GQMPEEH0RJRHM`, plan `789ed6a8477b`, both phases verified +against the plan document rather than the request. + +```text +plan phase-1 - run: ["bash", "-n", "scripts/orchestra_e2e_healthcheck.sh"] + - run: ["bash", "scripts/orchestra_e2e_healthcheck.sh"] +event v19 commands identical, exit_codes [0,0], at_sha 3b66b2b6a669, + evidence_ref a5dbc4ecc9ce, status awaiting_manual_verification + +plan phase-2 - run: ["bash", "-n", "scripts/orchestra_e2e_healthcheck.sh"] + - run: ["bash", "-n", "scripts/test_healthcheck.sh"] + - run: ["bash", "scripts/orchestra_e2e_healthcheck.sh"] +event v20 commands identical, exit_codes [0,0,0], same at_sha and plan_ref +``` + +Every record binds `plan_ref`, `phase_id`, `at_sha`, `evidence_ref`, +`lease_epoch` and `harness_id`. Rotation ran between every work phase with +`TaskPickupValidated` each time. + +**Not yet proven:** a successor picking up mid-implement. Both phases verified +under one lease epoch, so no rotation separated phase 1 from phase 2. + +**The planner found the legal route to a forbidden command.** +`scripts/test_healthcheck.sh` may not be executed, but `["bash", "-n", ...]` +covers any path, so it syntax-checked the file it could not run. + +### The refusal loop is actionable, not merely observable + +Task `06G4M6HF1Z3EREX1X3NEKSHP24` sealed a plan naming +`bash scripts/test_healthcheck.sh`, which the policy forbids. + +```text +20:45:02 phase request refused: "bash scripts/test_healthcheck.sh" is not in the policy +20:45:33 implement <- the planner rewrote and resealed, 31 seconds later +20:48:03 in_review +``` + +F52 refused on the planner, F55's answer path delivered the reason, and the +agent corrected. Count stayed at 1 for both tasks that hit it. A brief that +states the policy avoids the round trip entirely: the `--list-checks` task was +told the allowed argv and sealed on the first attempt. + +### F61, recorded and deliberately not built + +The verification allow-list is enforced and never stated to the planner. Every +plan that guesses pays one refused round trip. It is not a one-liner: +`agentctx.Input.Policy` is filled from the worker's `SafeOperations`, while the +verification policy is coordinator-side by design, so this needs a new channel. + +The reason to promote it later is local models. A strong planner consumed the +refusal and repaired the plan in 31 seconds. A weaker one may propose forbidden +commands repeatedly, because it cannot infer the allowed substitute. Then F61 +stops being latency and becomes model compatibility. + +### opencode is not running, and the reason was only in the pane + +Task `06G4M6HH5BAM235AC4PWYXF1HM` failed at attempt 3 having never left +`frame`. Its worktree held only `launch.md`. The pane said why: + +```text +This model is not available in your country. + ▣ Build · Muse Spark 1.2 Free OpenCode Zen +``` + +Orchestra behaved correctly throughout: lease, no progress, expire, requeue, +fail. Two things are worth keeping. + +- **The adapter cannot resolve a session file for opencode**, so activity is + `unknown` and the worker falls back to agent status. The failure therefore + reads as "done and pane unchanged" rather than "dead". Orchestra cannot tell + finished from never-started on this harness. +- **No observation carried the cause.** Four of them named the lease, the + rotation and the activity. The fatal line existed only in the pane capture, + which Orchestra publishes but nothing summarises. Parsing harness chrome is + not Orchestra's job; surfacing the capture is. + +**Do not route to `workpc-opencode` until its model is reachable.** Every task +sent there burns three attempts and then fails. + +### The retry budget counts idleness, not just failure + +The F60 rig task `06G4KVSHAK9B8M9K8HENAF23CG` failed at attempt 3 mid-review. +Two attempts were rig-induced expiries and the third was a natural idle +expiry. Every lease expiry increments `attempt`, and an agent going quiet at a +phase boundary is a routine expiry here. A task making real progress can spend +its retry budget on idleness. The two clean tasks never expired at all, so this +is a dynamic to watch rather than a defect to fix. + +F59 was confirmed live twice more: both failed tasks left no release +transaction and no session behind, on either worker. + +### Result + +| Task | Harness | Outcome | +|---|---|---| +| `06G4M6HF1Z3EREX1X3NEKSHP24` | workpc-claude | in_review, recovered from a policy refusal | +| `06G4M8WHGQ4P3GQMPEEH0RJRHM` | workpc-claude | in_review, plan-phase execution proven | +| `06G4M6HH5BAM235AC4PWYXF1HM` | workpc-opencode | failed, model unavailable | +| `06G4KVSHAK9B8M9K8HENAF23CG` | workpc-claude | failed, retry budget | + +Both workers hold no sessions and no release transactions. Deployed pair is +still `3c7cf95` on both halves.