Skip to content

Persist supervised SSH receipts before import and cleanup - #786

Merged
Meta-Develop merged 2 commits into
mainfrom
codex/supervised-ssh-receipts-20261030
Oct 30, 2026
Merged

Meta-Develop merged 2 commits into
mainfrom
codex/supervised-ssh-receipts-20261030

Conversation

@Meta-Develop

Copy link
Copy Markdown
Owner

Stacked on #780 (trusted SSH transport bridge); it is retargeted to main once #780 merges.

Third slice of #717.

  • Persist authenticated write-ahead lifecycle receipts and collection evidence before local candidate import or recapture, and allow remote cleanup only after both succeed.
  • Reconcile uncertain launch and collection replies with the existing idempotency keys, and checkpoint enough identity to resume without a duplicate launch or losing unimported output.
  • A cancellation that happens before staging or launch is recorded as such, so resume never treats it as a submitted launch.
  • Supervisor and nested-worker dispatch use the SSH bridge only for a selection with a matching trusted host configuration; otherwise they refuse and never fall back to the local runner.
  • Refusals that happen before any remote effect keep the normal scratch, messaging and budget cleanup; termination timing follows the trusted executor limits.

Tests use offline fake transports only. The opt-in two-host qualification remains a separate live gate; its commands are documented.

Validation: formatting and 35 exact Linux tests passed; Clippy and the full suites run in CI.

Refs #717.

Stacked on #780 (trusted SSH transport bridge); it is retargeted to main once #780 merges.

Third slice of #717.

- Persist authenticated write-ahead lifecycle receipts and collection evidence before local candidate import or recapture, and allow remote cleanup only after both succeed.
- Reconcile uncertain launch and collection replies with the existing idempotency keys, and checkpoint enough identity to resume without a duplicate launch or losing unimported output.
- A cancellation that happens before staging or launch is recorded as such, so resume never treats it as a submitted launch.
- Supervisor and nested-worker dispatch use the SSH bridge only for a selection with a matching trusted host configuration; otherwise they refuse and never fall back to the local runner.
- Refusals that happen before any remote effect keep the normal scratch, messaging and budget cleanup; termination timing follows the trusted executor limits.

Tests use offline fake transports only. The opt-in two-host qualification remains a separate live gate; its commands are documented.

Validation: formatting and 35 exact Linux tests passed; Clippy and the full suites run in CI.
@Meta-Develop
Meta-Develop merged commit b12240e into main Oct 30, 2026
2 of 15 checks passed
@Meta-Develop
Meta-Develop deleted the codex/supervised-ssh-receipts-20261030 branch October 30, 2026 00:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant