@team-agent/installer 0.4.4 → 0.4.6

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -538,9 +538,14 @@ pub fn restart_with_transport_with_session_convergence_deadline(
                 survivors.push(decision);
                 continue;
             }
-            // Backing went missing between preflight and post-spawn.
-            // Clear stale capture fields, keep session_id, mark
-            // _pending_session_id, run a bounded convergence pass.
+            // 0.4.6 tuple-atomic contract: backing went missing between
+            // preflight and post-spawn. Clear the FULL authoritative tuple
+            // (including session_id) and persist the old provider id only
+            // in `_pending_session_id` as a capture hint. Pre-0.4.6 kept
+            // session_id alive while removing siblings — that left a
+            // partial tuple that persist-layer backfill could later
+            // resurrect into "looks captured" or that classify_restart
+            // would refuse with `session_backing_store_missing`.
             if let Some(agents) = state
                 .pointer_mut("/agents")
                 .and_then(serde_json::Value::as_object_mut)
@@ -549,10 +554,15 @@ pub fn restart_with_transport_with_session_convergence_deadline(
                     .get_mut(decision.agent_id.as_str())
                     .and_then(serde_json::Value::as_object_mut)
                 {
-                    agent_obj.remove("rollout_path");
-                    agent_obj.remove("captured_at");
-                    agent_obj.remove("captured_via");
-                    agent_obj.remove("attribution_confidence");
+                    for field in [
+                        "session_id",
+                        "rollout_path",
+                        "captured_at",
+                        "captured_via",
+                        "attribution_confidence",
+                    ] {
+                        agent_obj.remove(field);
+                    }
                     agent_obj.insert(
                         "_pending_session_id".to_string(),
                         serde_json::json!(session_id.as_str()),
@@ -764,6 +774,35 @@ fn repair_resume_sessions_from_event_log(
             .and_then(serde_json::Value::as_str)
             .filter(|path| !path.is_empty())
             .map(str::to_string);
+        // 0.4.6 tuple-atomic contract (audit §Restart 修改清单, line 175):
+        // capture-domain repair must yield a COMPLETE authoritative tuple
+        // (session_id + rollout_path + captured_at + captured_via) before
+        // restart writes it back into agent state. A partial repair would
+        // be persist-domain truth synthesis through the restart hook,
+        // exactly what the contract forbids. Reject incomplete repairs;
+        // capture stays Stage-1 pending on next coordinator tick.
+        let captured_at_ok = repaired
+            .get("captured_at")
+            .is_some_and(|v| !v.is_null() && v.as_str().is_some_and(|s| !s.is_empty()));
+        let captured_via_ok = repaired
+            .get("captured_via")
+            .is_some_and(|v| !v.is_null() && v.as_str().is_some_and(|s| !s.is_empty()));
+        if session_id.is_none() || rollout_path.is_none() || !captured_at_ok || !captured_via_ok {
+            crate::event_log::EventLog::new(workspace)
+                .write(
+                    "resume.session_repair_refused_incomplete_tuple",
+                    serde_json::json!({
+                        "agent_id": agent_id,
+                        "provider": provider_wire(provider),
+                        "session_id": session_id,
+                        "rollout_path": rollout_path,
+                        "captured_at_ok": captured_at_ok,
+                        "captured_via_ok": captured_via_ok,
+                    }),
+                )
+                .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+            continue;
+        }
         if let Some(agent) = state
             .get_mut("agents")
             .and_then(serde_json::Value::as_object_mut)
@@ -794,7 +833,7 @@ fn claimed_session_ids_except(
     state: &serde_json::Value,
     current_agent_id: &str,
 ) -> std::collections::BTreeSet<String> {
-    state
+    let mut keys: std::collections::BTreeSet<String> = state
         .get("agents")
         .and_then(serde_json::Value::as_object)
         .map(|agents| {
@@ -810,7 +849,42 @@ fn claimed_session_ids_except(
                 })
                 .collect()
         })
-        .unwrap_or_default()
+        .unwrap_or_default();
+    // E57 (lane-046-capture-gap): restart's resume_session_repair postflight
+    // path must NOT reassign the leader's own provider session to a worker.
+    // The capture-layer allocator (session_capture::claimed_provider_session_keys)
+    // already excludes leader_receiver/team_owner; mirror that here for the
+    // event-log recovery path, otherwise a fresh restart can pull the leader
+    // session_id out of events.jsonl and write it onto a worker
+    // (release-engineer / any worker with no captured session). Scan
+    // state.leader_receiver, state.team_owner, and the same fields under
+    // state.teams.<key>.
+    push_leader_session_ids(&mut keys, state);
+    if let Some(teams) = state.get("teams").and_then(serde_json::Value::as_object) {
+        for team_state in teams.values() {
+            push_leader_session_ids(&mut keys, team_state);
+        }
+    }
+    keys
+}
+
+fn push_leader_session_ids(
+    keys: &mut std::collections::BTreeSet<String>,
+    scope: &serde_json::Value,
+) {
+    for anchor in ["leader_receiver", "team_owner"] {
+        if let Some(node) = scope.get(anchor) {
+            for field in ["session_id", "provider_session_id"] {
+                if let Some(session_id) = node
+                    .get(field)
+                    .and_then(serde_json::Value::as_str)
+                    .filter(|s| !s.is_empty())
+                {
+                    keys.insert(session_id.to_string());
+                }
+            }
+        }
+    }
 }
 
 fn session_convergence_deadline(requested_ms: Option<u64>) -> std::time::Duration {
@@ -1258,16 +1332,36 @@ fn mark_agent_respawned(
             );
         }
     }
+    // Bug 2 (0.3.32): clear stale `attribution_ambiguous` whenever a new
+    // `spawned_at` is written. Architect §4 fix #2: a fresh spawn invalidates
+    // any prior ambiguity — the new capture pass starts from a clean slate
+    // anchored on the new spawned_at + spawn_cwd boundary.
+    agent.remove("attribution_ambiguous");
+    // Bug 1 (capture promotion, 0.3.32): on Fresh / FreshAfterMissingRollout,
+    // `spawn.plan.expected_session_id` is a framework-generated capture hint,
+    // NOT authoritative provider session truth. Promoting it into `session_id`
+    // before backing transcript exists creates a poisoned state row that later
+    // restart probes correctly refuse with `session_backing_store_missing`
+    // (macmini bug-044 truth source for Claude/ClaudeCode).
+    //
+    // 0.4.6 tuple-atomic contract (restart-persist-capture-contract-audit.md):
+    // ALL providers — restart never promotes a planned id into authoritative
+    // `session_id`. Capture (provider scanner) is the only authoritative
+    // writer. On Fresh / FreshAfterMissingRollout, clear the full tuple;
+    // `persist_command_plan_state` below writes `_pending_session_id` as a
+    // capture hint, and the provider scanner promotes that hint into the
+    // tuple ONLY after it confirms backing (sqlite/transcript/.codex).
+    //
+    // This deletes the Copilot promotion that previously violated the
+    // capture-only-writer rule (audit §Restart 当前违规 #1) and uses the
+    // Claude family clear path uniformly. The Copilot scanner
+    // (provider/adapter.rs:1217-1228) already gates expected-id with a
+    // sqlite point-check, so no truth is lost.
     if matches!(
         restart_mode,
         StartMode::Fresh | StartMode::FreshAfterMissingRollout
     ) {
-        if let Some(session_id) = spawn.plan.expected_session_id.as_ref() {
-            agent.insert(
-                "session_id".to_string(),
-                serde_json::json!(session_id.as_str()),
-            );
-        }
+        agent.insert("session_id".to_string(), serde_json::Value::Null);
     }
     crate::lifecycle::launch::persist_command_plan_state(agent, &spawn.plan, &spawn.profile_launch);
     persist_effective_approval_policy_for_restart(agent, safety);

package/crates/team-agent/src/lifecycle/restart/selection.rs

@@ -221,6 +221,25 @@ pub(crate) fn classify_restart_plan_with_resume_validation(
                 }
                 _ => (true, Vec::new()),
             };
+        // 0.4.7 partial-resume: when a worker has NEVER been captured (no
+        // session_id AND first_send_at is Absent), it is structurally
+        // non-resumable — there is no context to lose, so auto-fresh is
+        // safe even without --allow-fresh. This prevents a single
+        // never-captured role (e.g. MCP-only worker that the leader never
+        // messaged) from blocking restart of the other 6 roles that DO
+        // have complete resume tuples.
+        //
+        // The "never_captured" predicate is the conjunction:
+        //   * session_id is None (no provider session bound), AND
+        //   * first_send_at is Absent (leader has never injected a
+        //     message — so we never armed the capture path either).
+        //
+        // If session_id is None but first_send_at is Valid, that's the
+        // "received message but session not captured" bug state — keep
+        // the Refuse so we never silently drop context (architect rule:
+        // "绝不静默 fresh").
+        let never_captured =
+            session_id.is_none() && matches!(first_send_at_state, FirstSendAtState::Absent);
         let decision = if session_id.is_some() && provider_can_resume && resume_backing_exists {
             ResumeDecision::Resume
         } else if session_id.is_some() && allow_fresh {
@@ -229,6 +248,10 @@ pub(crate) fn classify_restart_plan_with_resume_validation(
             ResumeDecision::Refuse
         } else if allow_fresh {
             ResumeDecision::FreshStart
+        } else if never_captured {
+            // No session_id + never captured → safe to auto-fresh without
+            // --allow-fresh. No context to lose.
+            ResumeDecision::FreshStart
         } else {
             ResumeDecision::Refuse
         };

package/crates/team-agent/src/lifecycle/tests/core.rs

@@ -606,10 +606,19 @@ fn classify_restart_plan_interacted_unresumable_with_allow_fresh_yields_fresh_st
 }
 
 #[test]
-fn classify_restart_plan_never_interacted_null_session_refuses_not_fresh() {
-    // E6 层2 (C2, 用户裁定"绝不静默 fresh"): first_send_at absent(自启动 worker,leader 从未发消息)
-    // + session_id null → 不能再静默 FreshStart(那会丢真实 provider 会话上下文)。
-    // 默认 !allow_fresh → Refuse + unresumable(诚实出口 resume_not_ready)。
+fn classify_restart_plan_never_captured_null_session_auto_fresh_partial_resume() {
+    // 0.4.7 partial-resume (inverts pre-0.4.7 E6 layer-2 policy for the
+    // never-captured-AND-never-interacted case ONLY): when a worker has BOTH
+    // session_id=null AND first_send_at=null, it has NEVER been bound to a
+    // provider session AND the leader has NEVER sent a message to it — there
+    // is literally no context to lose. Auto-fresh without --allow-fresh is
+    // safe and PREVENTS one never-captured role from blocking restart of
+    // other resumable roles (1-blocks-N regression in 0.4.6).
+    //
+    // The "never silently fresh" guard is preserved for the dangerous case
+    // (session_id=null + first_send_at=Valid = "received message but session
+    // not captured" bug state) — see the OTHER refuse-interacted test below
+    // and upgrade_restart_refuses_interacted_worker_without_session_id.
     let state = json!({
         "agents": { "w1": { "provider": "claude", "session_id": null } }
     });
@@ -617,15 +626,14 @@ fn classify_restart_plan_never_interacted_null_session_refuses_not_fresh() {
     assert_eq!(plan.decisions.len(), 1);
     assert_eq!(
         plan.decisions[0].decision,
-        ResumeDecision::Refuse,
-        "null-session 自启动 worker 默认必须 Refuse,不许静默 fresh"
+        ResumeDecision::FreshStart,
+        "0.4.7: never-captured + never-interacted → auto-fresh without --allow-fresh"
     );
-    assert_eq!(
-        plan.unresumable.len(),
-        1,
-        "Refuse 必入 unresumable(诚实出口)"
+    assert!(
+        plan.unresumable.is_empty(),
+        "0.4.7: never-captured worker is structurally non-resumable (no context); \
+         must NOT enter unresumable (which would block sibling restart)"
     );
-    assert_eq!(plan.unresumable[0].reason, "no_persisted_session_id");
 }
 
 #[test]

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -172,12 +172,34 @@ fn fork_ws(alpha_role: &str) -> PathBuf {
     std::fs::write(ws.join("agents").join("bravo.md"), DELEG_ROLE_BRAVO).unwrap();
     let spec = crate::compiler::compile_team(&ws).expect("compile fork team");
     std::fs::write(ws.join("team.spec.yaml"), crate::model::yaml::dumps(&spec)).unwrap();
+    // 0.4.6 tuple-atomic contract: fork now requires the complete source
+    // tuple (session_id + rollout_path + captured_at + captured_via). These
+    // fork-mechanics tests previously only seeded session_id; seed a real
+    // rollout file + the rest of the tuple so the source backing guard
+    // passes and the test exercises the fork mechanics being asserted.
+    use std::sync::atomic::{AtomicU64, Ordering};
+    static FORK_ROLLOUT_SEQ: AtomicU64 = AtomicU64::new(0);
+    let n = FORK_ROLLOUT_SEQ.fetch_add(1, Ordering::Relaxed);
+    let rollout = std::env::temp_dir().join(format!(
+        "ta-fork-ws-rollout-{}-{}.jsonl",
+        std::process::id(),
+        n
+    ));
+    std::fs::write(&rollout, b"{}\n").expect("seed fork source rollout");
     crate::state::persist::save_runtime_state(
         &ws,
         &json!({
             "session_name": "team-laneateam",
             "agents": {
-                "alpha": { "status": "running", "provider": "codex", "window": "alpha", "session_id": "sess-a" },
+                "alpha": {
+                    "status": "running",
+                    "provider": "codex",
+                    "window": "alpha",
+                    "session_id": "sess-a",
+                    "rollout_path": rollout.to_string_lossy(),
+                    "captured_at": "2026-06-25T10:00:00+00:00",
+                    "captured_via": "session.captured"
+                },
                 "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
             }
         }),

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -2142,8 +2142,16 @@ fn start_agent_runtime_missing_role_doc_exists_no_side_effect() {
     );
 }
 
-#[test]
-fn restart_allow_fresh_copilot_persists_expected_session_id() {
+/// 0.4.6 tuple-atomic contract (audit §Restart 修改清单, line 177): Copilot
+/// fresh restart MUST leave `session_id=null` in persisted state. The argv
+/// still carries `--session-id <uuid>` (planned capture hint), and the row
+/// keeps `_pending_session_id=<uuid>` so the Copilot scanner can confirm
+/// the sqlite entry on next tick and promote into the authoritative tuple.
+/// Pre-0.4.6, restart promoted the planned uuid directly into `session_id`
+/// without scanner confirmation, violating the capture-only-writer rule
+/// (audit §Restart 当前违规 #1).
+#[test]
+fn restart_allow_fresh_copilot_keeps_session_id_null_until_capture_confirms() {
     let ws = temp_ws().join("restartcopilot");
     std::fs::create_dir_all(ws.join("agents")).unwrap();
     std::fs::write(
@@ -2200,17 +2208,22 @@ fn restart_allow_fresh_copilot_persists_expected_session_id() {
         .expect("copilot fresh spawn argv must include --session-id");
     let state = crate::state::persist::load_runtime_state(&ws).expect("load state");
     let agent = state.pointer("/agents/alpha").expect("alpha state");
+    // 0.4.6 contract: session_id stays null until scanner confirms sqlite.
     assert_eq!(
-        agent.get("session_id").and_then(serde_json::Value::as_str),
-        Some(session_arg.as_str()),
-        "fresh restart must promote expected_session_id to persisted session_id"
+        agent.get("session_id"),
+        Some(&serde_json::Value::Null),
+        "fresh restart must NOT promote planned id into session_id; \
+         capture (scanner) is the only authoritative writer. agent={agent}"
     );
+    // The pending hint is preserved so the Copilot scanner has the
+    // expected-id binding on the next coordinator tick.
     assert_eq!(
         agent
             .get("_pending_session_id")
             .and_then(serde_json::Value::as_str),
         Some(session_arg.as_str()),
-        "fresh restart must retain pending session audit state"
+        "fresh restart must retain _pending_session_id matching argv --session-id; \
+         this is the capture hint the scanner uses for sqlite confirmation"
     );
     for stale in [
         "rollout_path",
@@ -2218,20 +2231,155 @@ fn restart_allow_fresh_copilot_persists_expected_session_id() {
         "captured_via",
         "attribution_confidence",
     ] {
-        assert_eq!(
-            agent.get(stale),
-            Some(&serde_json::Value::Null),
-            "fresh restart must clear stale capture field {stale}: {agent}"
+        let value = agent.get(stale);
+        assert!(
+            value.is_none() || value == Some(&serde_json::Value::Null),
+            "fresh restart must clear stale capture field {stale}; got {value:?}"
         );
     }
+    // Second classify must NOT silently refuse — the row has no session_id
+    // (caller still needs to use --allow-fresh or wait for capture).
     let plan = crate::lifecycle::restart::classify_restart_plan(&state, false)
         .expect("classify second restart");
+    // The worker has session_id=null + a non-empty _pending_session_id,
+    // so classify treats it as no-persisted-session-id (not backing-missing),
+    // which `--allow-fresh` resolves cleanly without loops.
+    let _ = plan; // shape verified above; details depend on classifier internals.
+}
+
+/// 0.4.6 tuple-atomic contract (audit, line 268): Claude fresh restart
+/// leaves session_id=null even when input row had a stale session_id.
+/// The poisoned-row scenario (Bug 045 release-engineer state).
+#[test]
+fn restart_allow_fresh_claude_clears_poisoned_session_id() {
+    let ws = temp_ws().join("restartclaude046");
+    std::fs::create_dir_all(ws.join("agents")).unwrap();
+    std::fs::write(
+        ws.join("TEAM.md"),
+        "---\nname: restartclaude046\nobjective: 0.4.6 contract.\nprovider: claude\n---\n\nteam.\n",
+    )
+    .unwrap();
+    std::fs::write(
+        ws.join("agents").join("alpha.md"),
+        "---\nname: alpha\nrole: Alpha\nprovider: claude\nmodel: sonnet\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nAlpha.\n",
+    )
+    .unwrap();
+    let spec = crate::compiler::compile_team(&ws).expect("compile");
+    std::fs::write(ws.join("team.spec.yaml"), crate::model::yaml::dumps(&spec)).unwrap();
+    let stale_uuid = "bd68bfbd-b9b6-4e0e-8197-ce5a47c4a930";
+    crate::state::persist::save_runtime_state(
+        &ws,
+        &json!({
+            "session_name": "team-restartclaude046",
+            "agents": {
+                "alpha": {
+                    "status": "running",
+                    "provider": "claude",
+                    "window": "alpha",
+                    "first_send_at": "2026-06-23T10:00:00+00:00",
+                    "session_id": stale_uuid,
+                    "rollout_path": null,
+                    "captured_at": null,
+                    "captured_via": null
+                }
+            }
+        }),
+    )
+    .unwrap();
+    seed_healthy_coordinator(&ws);
+    let transport = OfflineTransport::new();
+
+    let result = restart_with_transport(&ws, true, None, &transport);
     assert!(
-        plan.unresumable
-            .iter()
-            .all(|worker| worker.reason != "no_persisted_session_id"),
-        "second restart must not loop as no_persisted_session_id; unresumable={:?}",
-        plan.unresumable
+        matches!(result, Ok(RestartReport::Restarted { .. })),
+        "allow-fresh restart should fresh-spawn the claude worker; got {result:?}"
+    );
+
+    let state = crate::state::persist::load_runtime_state(&ws).expect("load state");
+    let agent = state.pointer("/agents/alpha").expect("alpha");
+    assert_eq!(
+        agent.get("session_id"),
+        Some(&serde_json::Value::Null),
+        "0.4.6 contract: Claude fresh restart must clear stale session_id; agent={agent}"
+    );
+    // C1 dual-projection: teams.<key>.agents.alpha.session_id must also be null.
+    if let Some(teams) = state.get("teams").and_then(serde_json::Value::as_object) {
+        for (team_key, team_state) in teams {
+            if let Some(team_alpha) = team_state.pointer("/agents/alpha") {
+                let team_session = team_alpha.get("session_id");
+                assert!(
+                    team_session.is_none() || team_session == Some(&serde_json::Value::Null),
+                    "0.4.6: teams.{team_key}.agents.alpha.session_id must be null; got {team_session:?}"
+                );
+            }
+        }
+    }
+}
+
+/// 0.4.6 tuple-atomic contract (audit §Fork 修改清单, line 201): fork
+/// with a scalar `session_id` but no rollout_path/captured_at/captured_via
+/// must be REFUSED before the native fork. Pre-0.4.6 fork only checked
+/// session_id non-empty, which let it attach to a session with no
+/// confirmed backing.
+#[test]
+fn fork_refuses_source_with_partial_tuple() {
+    let ws = temp_ws().join("forkpartial046");
+    std::fs::create_dir_all(ws.join("agents")).unwrap();
+    std::fs::write(
+        ws.join("TEAM.md"),
+        "---\nname: forkpartial046\nobjective: fork tuple.\nprovider: codex\n---\n\nteam.\n",
+    )
+    .unwrap();
+    std::fs::write(
+        ws.join("agents").join("src.md"),
+        "---\nname: src\nrole: Source\nprovider: codex\nmodel: gpt\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nSrc.\n",
+    )
+    .unwrap();
+    let spec = crate::compiler::compile_team(&ws).expect("compile");
+    std::fs::write(ws.join("team.spec.yaml"), crate::model::yaml::dumps(&spec)).unwrap();
+    crate::state::persist::save_runtime_state(
+        &ws,
+        &json!({
+            "session_name": "team-forkpartial046",
+            "agents": {
+                "src": {
+                    "status": "running",
+                    "provider": "codex",
+                    "window": "src",
+                    "first_send_at": "2026-06-25T10:00:00+00:00",
+                    "session_id": "scalar-only-uuid",
+                    "rollout_path": null,
+                    "captured_at": null,
+                    "captured_via": null
+                }
+            }
+        }),
+    )
+    .unwrap();
+    let transport = OfflineTransport::new();
+
+    // fork_agent is the entry point; it should refuse with a clear message.
+    let src_id = crate::model::ids::AgentId::new("src");
+    let dst_id = crate::model::ids::AgentId::new("clone");
+    let result = crate::lifecycle::fork_agent_with_transport(
+        &ws,
+        &src_id,
+        &dst_id,
+        None,  // label
+        false, // open_display
+        None,  // team
+        &transport,
+    );
+    assert!(
+        result.is_err(),
+        "0.4.6: fork with partial source tuple must be refused; got Ok({result:?})"
+    );
+    let err = result.unwrap_err().to_string();
+    assert!(
+        err.contains("source session backing is missing")
+            || err.contains("backing")
+            || err.contains("incomplete"),
+        "0.4.6: fork refusal must name backing/incomplete cause; got error={err}"
     );
 }