v3 workflow: intent, phases, review, submission, enforcement, burn-in

The v3 stack, previously an uncommitted working tree, plus this session's two
units and the burn-in instrument. This commit is the burn-in build identity:
coordinator and worker must both report this revision before a task is created.

Workflow (earlier sessions, uncommitted until now): human decision events and
reduction, source cursors and reconcile-before-launch, turn-boundary
reconciliation, internal/agentctx as the single renderer, ace-fca phases with
sealed artifacts, the trajectory gate, bounded grilling, independent review,
task pr enforcement, and human review reflection.

Capability restrictions at the agent boundary: an authz.Agent surface at
GatedWrite may ask and may not act. It also fixes two bugs the unit exposed --
gated surfaces could not reach the two endpoints written for them, and
RequestHumanDecision would block an unowned task while rejecting a question
from the session that did own it.

Turn-boundary reconcile-failure escalation: a streak of consecutive failures
asks the session to hand off, fenced on the lease epoch, with reconcile_failure
as a real handoff reason. The worker was dropping the coordinator's verdict on
the floor; it now acts on it.

Burn-in: herdr.WriteLaunchContext dumps the exact agentctx.Build result to
<worktree>/.orchestra/launch.md at every launch, local and federated. BURNIN.md
is the runbook. deploy/build.sh stamps both binaries from one commit.

go build, go vet and go test ./... pass, 20 packages.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
2026-08-26 18:31:20 +04:00
parent 97a9c65302
commit 7f12c7fc37
78 changed files with 16417 additions and 352 deletions
+17 -3
View File
@@ -16,6 +16,20 @@
"worktree_root": "/var/lib/orchestra/worktrees/correx", // Optional per-project worktree dir.
// Overrides global ORCHESTRA_WORKTREE_ROOT.
"quality_gate": "go test ./... && go vet ./..." // Worker runs this before deterministic delivery.
,
// Cognitive phase path. Omit for the default
// frame -> research -> plan -> implement -> review. A phase left out is
// skipped, which is how a trivial project runs frame/implement/review.
"work_phases": ["frame", "research", "plan", "implement", "review"],
// Phase transitions the human must confirm before work continues. The
// task blocks with block_reason "trajectory_gate" and the decision
// packet arrives on the usual notification surfaces. Any reply is
// recorded as a human decision and outranks the sealed plan.
"trajectory_gate": { "plan_to_implement": "required" },
// Per-task budget for bounded questions to the human. Default 6. Once
// spent, the task blocks with block_reason "operator_required" and a
// reply no longer resumes it, so a task cannot become an interview.
"human_decisions": { "max_requests_per_task": 6 }
},
{
"id": "maven",
@@ -35,6 +49,7 @@
{
"id": "mainframe-claude-1", // Unique herdr id.
"machine_id": "mainframe", // Which machine (above) this herdr runs on.
"backend": "herdr", // Pane backend: "herdr" (default) or "tmux" (Claude only).
// "address" omitted: falls back to the parent machine's address (used here since
// this herdr's harness listens on the machine's default port).
"harness": "claude", // Harness adapter to use: "claude" | "codex" | "opencode".
@@ -50,10 +65,9 @@
{
"id": "satellite-claude-1",
"machine_id": "satellite",
"address": "10.0.0.11:9245", // Explicit override: this herdr listens on a non-default
// port on its machine (e.g. multiple herdrs per machine).
"backend": "tmux", // tmux entries are always worker-owned, including on the
// coordinator machine; the worker reports local health.
"harness": "claude",
"protocol": "1",
"capabilities": ["code"],
"concurrency": 1,
"quota_limit_5h": 20,