devlyn-cli 4.3.25 → 4.3.28

package/native/claude/skills/_shared/task-complete.py

@@ -316,15 +316,21 @@ def ignore_task_records(work):
             f"{directory} records are not ignored or .devlyn is dirty; repair the starting commit's .devlyn paths and ignore rules before allocating")
 
 
-def storage_call(name, *args, adapter=False, receipt_path=None, **kwargs):
+def storage_call(name, *args, adapter=False, receipt_path=None, resume=None, **kwargs):
     module = shared("storage-checkout" if adapter else "storage-client")
     try:
         return module[name](*args, **kwargs)
     except module["StorageRefusal"] as exc:
         request = args[2] if adapter and len(args) == 3 else kwargs.get("receipt", {}).get("storage", {}).get("request", {})
         path = receipt_path or request.get("external_receipt")
-        resume = exc.resume or (storage_resume(path, for_removal=name in ('enrollment', 'recovery_registration')) if path else None)
-        error = CompletionError(str(exc) + ('; resume ' + resume if resume else '; repair Devlyn enrollment and retry'))
+        resume = exc.resume or resume or (storage_resume(path, for_removal=name in ('enrollment', 'recovery_registration')) if path else None)
+        message = str(exc)
+        if resume:
+            if resume not in message:
+                message += '; resume ' + resume
+        else:
+            message += '; repair Devlyn enrollment and retry'
+        error = CompletionError(message)
         error.storage_error = exc.result(receipt=path, resume=resume)
         raise error from exc
 
@@ -339,10 +345,15 @@ def managed_registration(receipt, *, recovery=False):
     require('storage' in receipt, 'managed receipt binding missing; retain and repair enrollment')
     saved = receipt['storage']['decision']['registration']
     if recovery:
+        storage_call('retirement_refusal')
         current = storage_call('recovery_registration', receipt_path=receipt['storage'].get('request', {}).get('external_receipt'))
+        if authority_binding(current) != authority_binding(saved):
+            refuse_moved(receipt)
         require(authority_binding(current) == authority_binding(saved),
                 'recovery pins authority binding changed; retain and repair enrollment')
         return {**current, 'helper_path': current['retained_helper']['path']}
+    if decision['mode'] != 'managed' or authority_binding(decision['registration']) != authority_binding(saved):
+        refuse_moved(receipt)
     require(decision['mode'] == 'managed', 'managed enrollment missing')
     require(authority_binding(decision['registration']) == authority_binding(saved),
             'enrollment authority binding changed; retain original recovery binding')
@@ -487,11 +498,61 @@ def storage_rpc(registration, request, path=None):
         raise error from exc
 
 
+def refuse_moved(receipt, path=None):
+    if receipt['storage'].get('moved') or storage_call('moved_operation', receipt['storage']['decision']['registration']):
+        path = Path(receipt['storage']['request']['external_receipt']) if path is None else path
+        resume = receipt_resume('recover-storage', path, receipt)
+        error = CompletionError('This task moved with Devlyn; release it and keep its files: ' + resume)
+        error.storage_error = {'receipt': str(path), 'resume': resume}
+        raise error
+
+
+def release_moved(receipt, path, operation):
+    state = receipt['storage']
+    if 'moved' not in state:
+        registration = storage_call('recovery_registration', receipt_path=str(path),
+                                    resume=receipt_resume('recover-storage', path, receipt))
+        registration = {**registration, 'helper_path': registration['retained_helper']['path']}
+        storage_call('replay_retirement', registration, receipt_path=str(path))
+        result = None
+        if path_present(path.with_name('storage-allocation.json')):
+            if 'removal_request' not in state:
+                work = Path(receipt['worktree'])
+                state['removal_request'] = {'adapter_protocol': 1,
+                    'allocation_operation_id': state['request']['operation_id'], 'external_receipt': str(path),
+                    'removal_operation_id': storage_call('operation_id'),
+                    'worktree_identity': storage_call('persistent_identity', work) if path_present(work) else None}
+                atomic_json(path, receipt)
+            result = storage_call('call', registration, 'reconcile-for-removal', state['removal_request'], adapter=True)
+            require(result['operation_id'] == state['removal_request']['removal_operation_id'], 'removal fence ID changed')
+            require(result['closure_result']['established_by'] != 'legacy_unreserved', 'moved release lacks positive closure')
+        state['moved'] = {'operation_id': operation, 'removal_result': result}
+        atomic_json(path, receipt)
+    root = Path(receipt['common_gitdir']) / 'devlyn-completion'
+    moved = root / 'moved'
+    moved.mkdir(exist_ok=True)
+    require(moved.resolve() == moved and moved.is_dir(), 'moved receipt directory redirected; retain')
+    destination = moved / (receipt['id'] + '.' + state['request']['operation_id'])
+    if path.parent != destination:
+        require(not path_present(destination), 'moved receipt destination already exists; retain both')
+        path.parent.rename(destination)
+    # Also retry the retired source barrier after a rename whose reply was lost.
+    if path_present(root / 'retired'):
+        storage_call('sync_directory', root / 'retired')
+    storage_call('sync_directory', moved)
+    storage_call('sync_directory', root)
+    return {'status': 'STORAGE_MOVED', 'receipt': str(destination / 'receipt.json'), **state['moved']}
+
+
 def recover_storage(args):
     path = resolve_receipt(Path(args.receipt).absolute(), operation_id=getattr(args, "operation_id", None))
-    with locked_receipt(path, operation_id=getattr(args, "operation_id", None), resume=True) as receipt:
+    with locked_receipt(path, operation_id=getattr(args, "operation_id", None), resume=True, allow_moved=True) as receipt:
         args.operation_id = receipt.get("storage", {}).get("request", {}).get("operation_id")
         require(storage_call("managed_receipt", receipt), "receipt is not managed")
+        operation = receipt['storage'].get('moved', {}).get('operation_id') or storage_call(
+            'moved_operation', receipt['storage']['decision']['registration'])
+        if operation:
+            return release_moved(receipt, path, operation)
         if args.for_removal:
             accepted = receipt.get('acceptance') or receipt.get('pushed') or receipt.get('pr_number')
             if accepted and receipt.get('pr_number') and receipt.get('delivery') not in {'COMPLETE', 'CLOSED'}:
@@ -1457,32 +1518,41 @@ def resolve_receipt(path, *, operation_id=None):
         if operation_id is None or read_json(path).get('storage', {}).get('request', {}).get('operation_id') == operation_id:
             return path
         require(path.parent.parent.name == 'devlyn-completion', 'receipt operation ID differs from saved resume')
+    kinds = ('retired', 'moved')
+    if path.parent.parent.name == 'retired' and path.parent.parent.parent.name == 'devlyn-completion':
+        key, separator, archived_operation = path.parent.name.partition('.')
+        require(separator and (operation_id is None or operation_id == archived_operation),
+                'receipt operation ID differs from saved resume')
+        operation_id = archived_operation
+        path = path.parent.parent.parent / key / 'receipt.json'
+        kinds = ('moved',)
     require(path.parent.parent.name == 'devlyn-completion', 'receipt locator is missing')
     candidates = []
-    retired = path.parent.parent / 'retired'
-    if path_present(retired):
-        require(retired == retired.resolve() and retired.is_dir(), 'retired receipt directory redirected')
-        for candidate in retired.glob(path.parent.name + '.*/receipt.json'):
-            if operation_id is not None and candidate.parent.name != path.parent.name + '.' + operation_id:
-                continue
-            saved = read_json(candidate)
-            operation = saved.get('storage', {}).get('request', {}).get('operation_id')
-            require(candidate == candidate.resolve() and saved.get('id') == path.parent.name
-                    and Path(saved['common_gitdir']) / 'devlyn-completion' / saved['id'] / 'receipt.json' == path
-                    and saved.get('storage', {}).get('request', {}).get('external_receipt') == str(path)
-                    and candidate.parent.name == saved['id'] + '.' + str(operation)
-                    and managed_terminal(saved),
-                    'retired receipt locator/operation binding changed; retain')
-            if operation_id is None or operation == operation_id:
-                candidates.append(candidate)
-    require(len(candidates) == 1, 'receipt operation/locator missing or ambiguous; use the operation-specific retired receipt: '
+    for kind in kinds:
+        retired = path.parent.parent / kind
+        if path_present(retired):
+            require(retired == retired.resolve() and retired.is_dir(), f'{kind} receipt directory redirected')
+            for candidate in retired.glob(path.parent.name + '.*/receipt.json'):
+                if operation_id is not None and candidate.parent.name != path.parent.name + '.' + operation_id:
+                    continue
+                saved = read_json(candidate)
+                operation = saved.get('storage', {}).get('request', {}).get('operation_id')
+                require(candidate == candidate.resolve() and saved.get('id') == path.parent.name
+                        and Path(saved['common_gitdir']) / 'devlyn-completion' / saved['id'] / 'receipt.json' == path
+                        and saved.get('storage', {}).get('request', {}).get('external_receipt') == str(path)
+                        and candidate.parent.name == saved['id'] + '.' + str(operation)
+                        and (managed_terminal(saved) if kind == 'retired' else bool(saved.get('storage', {}).get('moved'))),
+                        f'{kind} receipt locator/operation binding changed; retain')
+                if operation_id is None or operation == operation_id:
+                    candidates.append(candidate)
+    require(len(candidates) == 1, 'receipt operation/locator missing or ambiguous; use the operation-specific archived receipt: '
             + ', '.join(map(str, candidates)))
     return candidates[0]
 
 
 @contextlib.contextmanager
-def locked_receipt(path, *, blocking=True, operation_id=None, resume=False):
-    require(path.name == "receipt.json" and (path.parent.parent.name == "devlyn-completion" or path.parent.parent.name == "retired" and path.parent.parent.parent.name == "devlyn-completion") and path == path.resolve(), "receipt must be its original external nonsymlink path")
+def locked_receipt(path, *, blocking=True, operation_id=None, resume=False, allow_moved=False):
+    require(path.name == "receipt.json" and (path.parent.parent.name == "devlyn-completion" or path.parent.parent.name in {"retired", "moved"} and path.parent.parent.parent.name == "devlyn-completion") and path == path.resolve(), "receipt must be its original external nonsymlink path")
     preview = read_json(path)
     if storage_call('managed_receipt', preview):
         root = path.parent.parent if path.parent.parent.name == 'devlyn-completion' else path.parent.parent.parent
@@ -1504,7 +1574,8 @@ def locked_receipt(path, *, blocking=True, operation_id=None, resume=False):
             require(operation_id is None or actual == operation_id, 'receipt operation ID differs from saved resume; retain both operations')
         original = Path(receipt['common_gitdir']) / 'devlyn-completion' / receipt['id'] / 'receipt.json'
         archived = original.parent.parent / 'retired' / (receipt['id'] + '.' + receipt.get('storage', {}).get('request', {}).get('operation_id', '')) / 'receipt.json'
-        require(path == original or path == archived, 'receipt/common Gitdir binding mismatch')
+        moved = archived.parent.parent.parent / 'moved' / archived.parent.name / 'receipt.json'
+        require(path in (original, archived, moved), 'receipt/common Gitdir binding mismatch')
         require(receipt["id"] == hashlib.sha256(receipt["branch"].encode()).hexdigest()[:24] and receipt["branch"] not in {receipt["base"], "main", "master"}, "receipt branch ownership changed")
         if storage_call("managed_receipt", receipt):
             require(receipt.get("storage", {}).get("decision", {}).get("registration") and receipt.get("storage", {}).get("request"), "Open Devlyn and repair this managed receipt binding before resuming")
@@ -1513,6 +1584,10 @@ def locked_receipt(path, *, blocking=True, operation_id=None, resume=False):
             require(receipt["allocation"] == "owned", "allocation was interrupted; no historical adoption is permitted")
         if path == archived:
             require(managed_terminal(receipt), 'retired receipt is not terminal')
+        if path == moved:
+            require(receipt.get('storage', {}).get('moved'), 'moved receipt lacks disposition')
+        if storage_call('managed_receipt', receipt) and not allow_moved:
+            refuse_moved(receipt, path)
         yield receipt
 
 

package/native/claude/skills/_shared/task-completion.md

@@ -106,8 +106,10 @@ New allocation and warming modes come from enrollment state alone:
 | absent | present | verified `retired: true` | standalone (unenrollment complete) |
 | absent | present | absent, unreadable or incomplete | refuse; Open Devlyn to repair its storage registration |
 
-The journal `storage-client-unenroll.json` is read no-follow only on the last two
-rows. Schema 1, canonical UUIDv7 operation, permanent `storage-client-fence.json`,
+An unfinished retirement takes precedence over enrollment; follow its
+operation-specific retained-helper resume to reconcile or cancel as named.
+The journal `storage-client-unenroll.json` is read no-follow for retirement
+recovery and the last two rows. Schema 1, canonical UUIDv7 operation, permanent `storage-client-fence.json`,
 matching operation/root/lock identities and Rust's archive ordering/path
 validation are required. If native root/lock identities or the home path changed,
 completed retirement permits standalone only when `storage`, `control`,
@@ -119,7 +121,9 @@ completed unenrollment; a leftover managed key retains its own recovery command.
 Existing operations keep their managed identity. Receipts pin the control
 identity; current enrollment verifies the helper before allocation. Recovery uses
 the current verified `storage-client-recovery/pins.json`, including after uninstall
-or unenrollment, and requires its authority binding to match the receipt. Missing
+or unenrollment, and requires its authority binding to match the receipt, except
+for a proven moved task: use its unflagged, operation-specific `recover-storage`
+resume to release it, retain its files, and archive its receipt under `moved/`. Missing
 or invalid pins retain resources and require repair; saved artifacts are never a
 fallback. Enrolled checkout preserves
 `managed_pending`/`managed_owned` and Rust's `storage-allocation.json` subreceipt.

package/native/claude/skills/devlyn-ideate/SKILL.md

@@ -3,7 +3,7 @@ name: devlyn-ideate
 description: Loop designer and intent queue. Turns an intent or a document into a validated loop package (a meta-prompt plus self-contained task contracts), queues its tasks, reports queue status, and drains the queue serially with evidence-derived acceptance, recovery and delivery. Operations — plan, add, status, drain; a bare intent is planned and, when the request authorizes implementation, continues through add and drain; no arguments shows status. Use when the user wants an idea, goal or document planned into tasks, wants to stack work ("queue this", "큐에 넣어줘"), asks what is queued, or wants unattended execution ("drain the queue", "큐 드레인 시작", "밤새 돌려줘").
 ---
 
-Ideate owns planning and durable serial execution. Each task runs under the installed methodology, the CLAUDE.md/AGENTS.md instruction block; ideate adds no phase graph, reviewer quota, engine router or restart cycle.
+Ideate owns planning and durable serial execution. Each task runs under the installed methodology, the Devlyn defaults and project instructions; ideate adds no phase graph, reviewer quota, engine router or restart cycle.
 
 <ideate_args>
 $ARGUMENTS
@@ -94,7 +94,7 @@ A removed flag stops with its instruction and selects no other behavior.
 
 An absolute path to a package's `meta.md` is added as it is; anything else is planned first. Add with `python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" add '<absolute meta.md>'`, the only writer of a loop's queue file `docs/specs/<loop-id>/queue.md`; never edit one by hand. In every delivery mode add makes no commit on the checked-out branch and leaves the branch, the index and tracked files as they are: it holds the package and its rows at `refs/devlyn/captures/<loop-id>`, records the add and removes the package copies equal to that capture. Report the capture ref and its `git show` command, any `cleanup` entry, and that a revision needs a new loop id. A retry of the same add reports it as added, also once the copies are gone. Tasks start from committed state, a local loop from the branch it was added on and `auto`/`pr` from the remote base, so commit, and for `auto`/`pr` push, whatever the plan depends on. A pending legacy raw-intent row of `docs/specs/queue.md` is replaced in place by a package whose `## Intent` reproduces the row verbatim, added with `--materialize <line>`.
 
-Release-backed queues retain their verified release in `<git-common-dir>/devlyn-loops/harness.json` until all tasks, recovery and delivery settle. A different release refuses with the exact recovery argv; use it. Existing unfinished unbound queues and standalone installations remain legacy.
+Release-backed queues retain their verified release in `<git-common-dir>/devlyn-loops/harness.json` until all tasks, recovery and delivery settle. A different release refuses: use the exact recovery argv when it gives one; otherwise do what it says (Drain in Devlyn, the tasks to finish first, or a repair). Never build the bound queue's path yourself. Existing unfinished unbound queues and standalone installations remain legacy.
 
 ## status
 

package/native/claude/skills/devlyn-ideate/references/loop.md

@@ -55,9 +55,9 @@ Package cleanup, parent pruning and report failures appear as diagnostics under
 
 ## Release binding and read-only consumers
 
-`<git-common-dir>/devlyn-loops/harness.json` is authoritative across linked worktrees: `{schemaVersion: 1, release: {package, version, digest, root}, defaults: {path, sha256}}`. Paths are absolute and hashes cover exact bytes. The queue lock covers binding before the first capture. An interrupted first add, unfinished tasks, recovery conflicts and pending delivery retain it; settlement removes it. A different release refuses with `recovery argv` as a JSON argv array, preserving the caller’s arguments. No caller substitutes another implementation.
+`<git-common-dir>/devlyn-loops/harness.json` is authoritative across linked worktrees: `{schemaVersion: 1, release: {package, version, digest, root}, defaults: {path, sha256}}`. Paths are absolute and hashes cover exact bytes. The queue lock covers binding before the first capture. An interrupted first add, unfinished tasks, recovery conflicts and pending delivery retain it; settlement removes it. A different release refuses: use the exact recovery argv when it gives one (a JSON argv array preserving the caller’s arguments); otherwise do what it says (Drain in Devlyn, the tasks to finish first, or a repair). Never build the bound queue’s path yourself. No caller substitutes another implementation.
 
-`queue.py inspect --repo <dir> --json` reads without cleanup, locks or writes. It returns the status summary plus `binding` (null for legacy) and `compatibility`: `compatible`, `legacy`, `reasons`, `recoveryArgv`, `taskPacket` ranges and `queueBinding` ranges. Incompatible or unreadable state is reported, never migrated. Apps should use this reader instead of `status`, which still reconciles cleanup. For a mismatch, `recoveryArgv` names the bound queue’s inspect invocation; use the same bound queue entry point for authorized add/drain operations.
+`queue.py inspect --repo <dir> --json` reads without cleanup, locks or writes. It returns the status summary plus `binding` (null for legacy) and `compatibility`: `compatible`, `legacy`, `reasons`, `recoveryArgv`, `taskPacket` ranges and `queueBinding` ranges. Incompatible or unreadable state is reported, never migrated. Apps should use this reader instead of `status`, which still reconciles cleanup. For a mismatch, `recoveryArgv` names the bound queue’s inspect invocation when handoff is allowed, and is null when the refusal names Drain in Devlyn, tasks to finish first, or a repair. Use an exact recovery argv when provided; otherwise follow the refusal.
 
 Codex projection writers place `.devlyn-harness-projection.json` at the copied plugin root, beside `skills` and `.codex-plugin`: `{schemaVersion: 1, release: <ReleaseRef>, source: "native/codex/plugins/devlyn"}`. The reader verifies the named release and every projected file’s bytes/mode against that subtree (excluding only the marker). Symlinked skill invocations resolve through their real path. Standalone installs and existing unfinished unbound queues retain legacy behavior; new legacy packets use v2 with a null release, and their `defaults` name the invoking installation's own `_shared/runtime-principles.md` (`source: "skill"`). No engine applicability is inferred from instruction filenames: bound queues use verified release defaults with native instructions taking precedence, except a Devlyn managed block, which the defaults replace. Worker and runner paths point to the bound release, independent of a projection cache’s lifetime.
 

package/native/claude/skills/devlyn-ideate/scripts/queue.py

@@ -188,8 +188,11 @@ def enforce_binding(common, anchor=None):
         if binding and anchor is not None and release_settled_binding(anchor, common, interrupted_add=True):
             return enforce_binding(common)
         if binding:
-            argv = harness_call("recovery_argv", binding, sys.argv[1:])
-            raise LoopError(f"{exc}; recovery argv: {json.dumps(argv, ensure_ascii=False)}") from exc
+            line = shared("storage-client")["queue_handoff"](common, binding)
+            argv = harness_call("recovery_argv", binding, sys.argv[1:]) if line is None else None
+            error = LoopError(f"{exc}; {line}" if line is not None else f"{exc}; recovery argv: {json.dumps(argv, ensure_ascii=False)}")
+            error.handoff = line
+            raise error from exc
         raise
     return binding
 
@@ -1661,7 +1664,11 @@ def inspect(args):
         compatibility.update(compatible=False, reasons=[str(exc)])
         try:
             valid = harness_call("read_binding", common)
-            if valid:
+            if hasattr(exc, "handoff"):
+                line = exc.handoff
+            else:
+                line = shared("storage-client")["queue_handoff"](common, valid) if valid else None
+            if valid and line is None:
                 compatibility["recoveryArgv"] = harness_call("recovery_argv", valid, ["inspect", "--repo", str(anchor), "--json"])
         except (LoopError, OSError):
             pass  # The diagnostic above describes the malformed binding; no safe argv can be inferred.

package/native/codex/.agents/plugins/marketplace.json

@@ -1,5 +1,5 @@
 {
-  "name": "devlyn-harness-v4-3-25",
+  "name": "devlyn-harness-v4-3-28",
   "plugins": [
     {
       "name": "devlyn",

package/native/codex/plugins/devlyn/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.25",
+  "version": "4.3.28",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }

package/native/codex/plugins/devlyn/skills/_shared/runtime-principles.md

@@ -17,7 +17,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
 4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
-6. **Optimized** — use efficient code and avoid unnecessary work without sacrificing correctness or the user's requirements.
+6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
 
 Three discipline rules govern HOW the principles are applied:

package/native/codex/plugins/devlyn/skills/_shared/storage-checkout.py

@@ -52,6 +52,7 @@ def validate_closure(value):
     require(type(value) is dict, 'positive reservation closure missing')
     tag = value.get('established_by')
     shapes = {'released': {'established_by': ('released',), 'reservation': 'reservation'},
+              'authority_migrated': {'established_by': ('authority_migrated',), 'operation_id': 'str'},
               'authority_expired': {'established_by': ('authority_expired',), 'operation_id': 'str'},
               'never_admitted': {'established_by': ('never_admitted',), 'operation_id': 'str'},
               'legacy_unreserved': {'established_by': ('legacy_unreserved',), 'receipt_version': 'u32'}}