Skip to content

Prove automatic fallback never moves a retained conversation (C2c2e E1) - #269

Merged
shoedog merged 1 commit into
mainfrom
feat/retained-context-exclusion-c2c2e1
Nov 2, 2026
Merged

shoedog merged 1 commit into
mainfrom
feat/retained-context-exclusion-c2c2e1

Conversation

@shoedog

@shoedog shoedog commented Nov 2, 2026

Copy link
Copy Markdown
Owner

Summary

Lane G C2c2e sub-slice E1 (order E2→E3→E4→E1→E5→E6): automatic fallback never silently moves a retained provider conversation to a different agent. Owner narrowed the rule on 2026-11-01 (not "permanent"): same-agent model switching on a warm session (#266) and operator/workflow-initiated cross-provider handoff with a transcript (#267) remain allowed in principle as separate features.

  • executor.rs: ColdOwnershipV1 typed marker required by run_local_chain, minted only when no dispatcher is present; the existing dispatcher refusal (BindUnsupported when a dispatcher meets frozen authority) is what enforces exclusion. Comment-level change apart from the marker plumbing.
  • Tests through the executor dispatcher seam with a real retained binding: a retained conversation reused across nodes and across invocations refuses on every declared rejection cause with zero successor preparation, polling or accounting rows (accounting attached, so the zero-row checks can fail), exact binding state per cause; positive control: same admission and accounting without the dispatcher activates the chain; a cold envelope-context control stays eligible.
  • No production warm-workflow support added; production A2A/MCP selection still disabled.

Verification

  • Implementer (Claude Code Sonnet 5.5): workspace 6,373 passed / 0 failed / 13 ignored; fmt, clippy, hygiene clean; wire SHA equals base. The new tests are already-passing controls on base (the refusal pre-existed); removing the refusal turns the retained tests RED.
  • Host: fmt, clippy (a2a-bridge, bridge-workflow, -D warnings) clean; fallback_workflow 163/163; bridge-workflow 260/260; uncapped_order_and_wire_control byte-identical to base.
  • Review: gpt-6.1-sol + Opus 5.5 (Opus synth) APPROVE round 1. Its material finding (retained-refusal tests ran without accounting, so zero-row checks could not fail) plus two minor items were fixed in a targeted test/comment round; orchestrator diff check.

🤖 Generated with Claude Code

https://claude.ai/code/session_017izEynabPeSUBT573AtvaZ

…tained-context exclusion (C2c2e1)

Candidate activation in the executor now consumes a typed ColdOwnershipV1
proof (no dispatcher retains the node's conversation) instead of relying on
an absent dispatcher branch. Automatic fallback never silently moves a
retained provider conversation to a different agent; the existing
bound-dispatcher refusal is unchanged.

Tests drive the executor dispatcher seam with a real warm SessionManager
context shared across nodes and invocations: frozen authority refuses before
checkout with the binding, session and generation unchanged and no successor
preparation, polling or accounting for each declared cause; ordinary retained
execution stays usable; a client envelope context ID that names a live
retained conversation still takes the cold chain and leaves it untouched.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>


Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017izEynabPeSUBT573AtvaZ
@shoedog
shoedog merged commit 1b26136 into main Nov 2, 2026
6 checks passed
@shoedog
shoedog deleted the feat/retained-context-exclusion-c2c2e1 branch November 2, 2026 00:16
@github-actions github-actions Bot locked and limited conversation to collaborators Nov 2, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant