Detect crash recovery divergence with replayable native and published checks

.agents/pm/history/pm-rust-published-history-open.jsonl

@@ -0,0 +1,6 @@
+{"hash_algorithm":"sha256","ts":"2026-10-24T23:28:02.986Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b901d62468c1f8f5717845ea","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-rust-published-history-open"},{"op":"add","path":"/metadata/title","value":"Measure and track published oracle history-open crash divergence"},{"op":"add","path":"/metadata/description","value":"The locked published pm-cli 2026.10.21 can publish an item before appending its history. A history-path openat SIGKILL followed by a different mutation exits zero but leaves item/history bytes outside both complete reference states. The crash harness detects and retains this synthetic failure. Investigate current published behavior separately without changing the locked parity oracle or repairing original streams."},{"op":"add","path":"/metadata/type","value":"Task"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["crash-consistency","follow-up","oracle"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-24T23:28:02.986Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-24T23:28:02.986Z"},{"op":"add","path":"/metadata/author","value":"codex-agent"},{"op":"add","path":"/metadata/acceptance_criteria","value":"Replay both mutation families on versioned disposable non-git trackers; distinguish acknowledged-prefix preservation from interrupted-write atomicity; retain independent behavioral revert evidence for any future runtime fix; no original history rewrites."}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"5bd5cab903f58aca89826b7008b58eb5528326ca08f1afafb58a1f93d7385c86","item_hash_version":3,"message":"","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"21c2337c5128c4fe2f96351c4f2a7bce1632f92e413dd7f9cf0c60d131d6974f"}
+{"hash_algorithm":"sha256","ts":"2026-10-24T23:28:07.872Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b901d62468c1f8f5717845ea","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-24T23:28:07.872Z"},{"op":"add","path":"/metadata/files","value":[{"path":"tests/fixtures/crash-review/published-history.json","scope":"project"}]}],"before_hash":"5bd5cab903f58aca89826b7008b58eb5528326ca08f1afafb58a1f93d7385c86","after_hash":"5c0c2d9a608bd947ccdc6f6e5302fdd8f1f963416444e4d91024c58396f1d8e5","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"e7873d331e7b173d211791ed3e5709a3ab2eaf4b99f79efd526f38464110bd53"}
+{"hash_algorithm":"sha256","ts":"2026-10-24T23:28:12.293Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b901d62468c1f8f5717845ea","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-24T23:28:12.293Z"},{"op":"add","path":"/metadata/docs","value":[{"path":"docs/CRASH_HARNESS.md","scope":"project"}]}],"before_hash":"5c0c2d9a608bd947ccdc6f6e5302fdd8f1f963416444e4d91024c58396f1d8e5","after_hash":"4b0175c99e102967036b078900d6ec0df006e42e50c2b3e96a0db5de5fabc6a8","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"e88f7095ab71128c4a4a1a493a67770f17d8bf9bf69fb3723bdd0a4f865af74c"}
+{"hash_algorithm":"sha256","ts":"2026-10-24T23:35:50.997Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b901d62468c1f8f5717845ea","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-24T23:35:50.997Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"node --test --test-name-pattern=\"published history-open\" scripts/crash-review.test.mts","scope":"project","provenance":{"author":"codex-agent","created_at":"2026-10-24T23:35:50.919Z","source_kind":"local_mutation","source_ref":"feat/crash-consistency-harness"}}]}],"before_hash":"4b0175c99e102967036b078900d6ec0df006e42e50c2b3e96a0db5de5fabc6a8","after_hash":"26a421e83cf1920e65cc2e892debdb388c378de27aadf616940616b540cd0cb1","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"525b8dad060f9bce3ed5da3445d77e5d0f98e1726f9537164af1fb2d425cea72"}
+{"hash_algorithm":"sha256","ts":"2026-10-24T23:49:15.458Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b901d62468c1f8f5717845ea","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-24T23:49:15.458Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-10-24T23:49:15.454Z","author":"codex-agent","text":"The complete 34-test Linux harness passes while explicitly detecting both version-pinned published history-open divergences. Public-copy measurements preserve all 26 acknowledged writes and history prefixes, but two interrupted writes diverge after exit-zero restart. Four differing paired outcomes and four synthetic reproductions are recorded in docs/CRASH_REVIEW_2026_10_23.json. This follow-up stays open; no runtime repair or oracle pin change is included."}]}],"before_hash":"26a421e83cf1920e65cc2e892debdb388c378de27aadf616940616b540cd0cb1","after_hash":"16053d3de859d45ee6e185db7ad2bd1be30a0c85781a206e3c6a945a7b1f20e0","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"310e6cec4ea857064e5ba1c99fe121d2e6fe23a6c2cf52a1fd38c99d7d85a4c1"}
+{"hash_algorithm":"sha256","ts":"2026-10-24T23:51:09.155Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b901d62468c1f8f5717845ea","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-10-24T23:51:09.155Z","author":"codex-agent","text":"Its pinned-PM linked command also passes independently: one real published history-open replay regression, zero failed/canceled/skipped, preserving the expected durable_divergence finding. The runtime follow-up remains open."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-24T23:51:09.155Z"}],"before_hash":"16053d3de859d45ee6e185db7ad2bd1be30a0c85781a206e3c6a945a7b1f20e0","after_hash":"8b155ccff26107d7729668874c3b83705a40b5c778ec1751babb2a8d1aad3796","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"98ae775ed032b8d7f01dd856a1c6dc2333a7fc5399552d1371f7adaaad344a91"}

.agents/pm/tasks/pm-rust-published-history-open.toon

@@ -0,0 +1,21 @@
+id: pm-rust-published-history-open
+title: Measure and track published oracle history-open crash divergence
+description: The locked published pm-cli 2026.10.21 can publish an item before appending its history. A history-path openat SIGKILL followed by a different mutation exits zero but leaves item/history bytes outside both complete reference states. The crash harness detects and retains this synthetic failure. Investigate current published behavior separately without changing the locked parity oracle or repairing original streams.
+type: Task
+status: open
+priority: 2
+tags[3]: crash-consistency,follow-up,oracle
+created_at: "2026-10-24T23:28:02.986Z"
+updated_at: "2026-10-24T23:51:09.155Z"
+author: codex-agent
+acceptance_criteria: Replay both mutation families on versioned disposable non-git trackers; distinguish acknowledged-prefix preservation from interrupted-write atomicity; retain independent behavioral revert evidence for any future runtime fix; no original history rewrites.
+comments[2]{created_at,author,text}:
+  "2026-10-24T23:49:15.454Z",codex-agent,"The complete 34-test Linux harness passes while explicitly detecting both version-pinned published history-open divergences. Public-copy measurements preserve all 26 acknowledged writes and history prefixes, but two interrupted writes diverge after exit-zero restart. Four differing paired outcomes and four synthetic reproductions are recorded in docs/CRASH_REVIEW_2026_10_23.json. This follow-up stays open; no runtime repair or oracle pin change is included."
+  "2026-10-24T23:51:09.155Z",codex-agent,"Its pinned-PM linked command also passes independently: one real published history-open replay regression, zero failed/canceled/skipped, preserving the expected durable_divergence finding. The runtime follow-up remains open."
+files[1]{path,scope}:
+  tests/fixtures/crash-review/published-history.json,project
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  "node --test --test-name-pattern=\"published history-open\" scripts/crash-review.test.mts",project,codex-agent,"2026-10-24T23:35:50.919Z",local_mutation,feat/crash-consistency-harness
+docs[1]{path,scope}:
+  docs/CRASH_HARNESS.md,project
+body: ""

README.md

@@ -92,8 +92,8 @@ The TypeScript SDK in [`scripts/crash-harness.mts`](scripts/crash-harness.mts)
 and `just crash` compare real native processes with the locked pm-cli 2026.10.21
 oracle. On Linux, strace injects SIGKILL at every declared per-task `rename` and
 `fsync` entry ordinal observed in uninterrupted update/comment reference runs.
-Each case starts after an acknowledged synthetic create, restarts through the
-same operation family, and checks exact item/history bytes, immutable history
+Each case starts after an acknowledged synthetic create, restarts through a
+different operation and returns to the original one, and checks exact item/history bytes, immutable history
 prefixes and recovery receipts. These commands work in plain directories without
 a Git executable. The source tracker is read only; all mutations use disposable
 non-git clones.
@@ -318,3 +318,12 @@ with `cargo build --locked --example native_adapter`, then pass an explicitly
 authorized tracker directory as its argument and one `AdapterRequest` on stdin.
 Replace its `exchange` implementation with the existing authorized transport
 when embedding against a remote backend. The example grants only get and list.
+
+The expanded crash corpus includes history-path `openat` cuts and native runtime
+journals. Historical same-operation receipts do not establish complete recovery
+conformance; the locked published oracle still has measured history-open failures.
+
+The repository check `node scripts/crash-history-prefix.mts` requires Git and
+compares every changed history stream with `origin/main` as exact bytes. Main
+history must remain a prefix; new item streams are permitted. Tracker commands
+and `just crash` continue to work in plain directories without Git.