relay-flow 0.3.7-alpha → 0.3.8-alpha

package/README.md

@@ -24,13 +24,13 @@ same `relay-flow-plugin` package with host-specific entrypoints.
 **OpenCode**
 
 ```sh
-opencode plugin relay-flow-plugin@0.3.7-alpha
+opencode plugin relay-flow-plugin@0.3.8-alpha
 ```
 
 **Pi**
 
 ```sh
-pi install npm:relay-flow-plugin@0.3.7-alpha
+pi install npm:relay-flow-plugin@0.3.8-alpha
 ```
 
 Pi loads the package's `pi.ts` extension from its manifest. Do not add
@@ -160,7 +160,7 @@ OpenCode plugin configuration uses both entrypoints. The server entrypoint is li
 ```json
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugin": ["relay-flow-plugin@0.3.7-alpha"]
+  "plugin": ["relay-flow-plugin@0.3.8-alpha"]
 }
 ```
 
@@ -169,7 +169,7 @@ The native HITL approval entrypoint is listed in `.opencode/tui.json`:
 ```json
 {
   "$schema": "https://opencode.ai/tui.json",
-  "plugin": ["relay-flow-plugin@0.3.7-alpha"]
+  "plugin": ["relay-flow-plugin@0.3.8-alpha"]
 }
 ```
 
@@ -185,7 +185,7 @@ Pi plugin: install the same published package manually in Pi's global package
 settings before starting a Pi harness session:
 
 ```sh
-pi install npm:relay-flow-plugin@0.3.7-alpha
+pi install npm:relay-flow-plugin@0.3.8-alpha
 ```
 
 Relay-flow does not install or configure the package automatically. Pi resolves

package/cmd/relay-flow/observability_test.go

@@ -276,6 +276,34 @@ func TestBlockedActiveRunCountsAsActiveAndFailed(t *testing.T) {
 	}
 }
 
+func TestOutdatedWorkflowUsesDistinctNonBlockingMarker(t *testing.T) {
+	wf := &workflow.Workflow{Name: "editedFlow", Status: workflow.HealthOutdated, StatusReason: "hash mismatch", RepairCommand: "relay-flow workflow submit --file /tmp/editedFlow.yaml"}
+	for _, options := range []renderOptions{{ASCII: true, Width: 120}, {ASCII: false, Width: 120}} {
+		var out bytes.Buffer
+		renderWorkflowSummaries(&out, []server.WorkflowSummary{{Workflow: wf}}, options)
+		text := out.String()
+		if !strings.Contains(text, "hash mismatch") {
+			t.Fatalf("outdated workflow reason missing from output %q", text)
+		}
+		if options.ASCII && !strings.Contains(text, "[!]") {
+			t.Fatalf("ASCII outdated marker missing from output %q", text)
+		}
+		if !options.ASCII && !strings.Contains(text, "!") {
+			t.Fatalf("non-ASCII outdated marker missing from output %q", text)
+		}
+		for _, line := range strings.Split(text, "\n") {
+			if strings.Contains(line, "editedFlow") && strings.Contains(line, "✗") {
+				t.Fatalf("outdated workflow rendered as generic failure: %q", text)
+			}
+		}
+	}
+	var detail bytes.Buffer
+	renderWorkflowDetail(&detail, server.WorkflowDetail{Workflow: wf}, renderOptions{ASCII: true, Width: 120})
+	if !strings.Contains(detail.String(), "REPAIR") || !strings.Contains(detail.String(), wf.RepairCommand) {
+		t.Fatalf("outdated workflow repair command missing from detail: %q", detail.String())
+	}
+}
+
 func TestNarrowWorkflowDetailStaysWithinTerminalWidth(t *testing.T) {
 	wf := &workflow.Workflow{Name: "a-very-long-workflow-name", Repos: []string{"a-very-long-repository-name"}, Nodes: map[string]workflow.Node{workflow.StartNode: {}, workflow.EndNode: {}}}
 	var out bytes.Buffer

package/cmd/relay-flow/render.go

@@ -106,7 +106,7 @@ func statusMark(status string, ascii bool) string {
 			return "[x]"
 		case "running", "waiting", "active":
 			return "[>]"
-		case "failed", "blocked":
+		case "failed", "blocked", "unverified", "outdated":
 			return "[!]"
 		case "canceled":
 			return "[-]"
@@ -119,8 +119,10 @@ func statusMark(status string, ascii bool) string {
 		return "✓"
 	case "running", "waiting", "active":
 		return "⟳"
-	case "failed", "blocked":
+	case "failed", "blocked", "unverified":
 		return "✗"
+	case "outdated":
+		return "!"
 	case "canceled":
 		return "−"
 	default:
@@ -401,6 +403,10 @@ func renderWorkflowSummariesBody(w io.Writer, summaries []server.WorkflowSummary
 			}
 			state = markForRun(*summary.LatestRun, options.ASCII)
 		}
+		if summary.Status == workflow.HealthBlocked || summary.Status == workflow.HealthUnverified || summary.Status == workflow.HealthOutdated {
+			state = statusMark(string(summary.Status), options.ASCII)
+			last = valueOrDash(summary.StatusReason)
+		}
 		active += summary.ActiveRuns
 		fmt.Fprintf(tw, "%s\t%s\t%s\t%d\t%d\t%s\n", state, name, valueOrDash(repos), summary.NodeCount, summary.ActiveRuns, last)
 	}
@@ -477,8 +483,18 @@ func renderWorkflowDetailBody(w io.Writer, detail server.WorkflowDetail, options
 	}
 	fmt.Fprintf(w, "WORKFLOW  %s\n", wf.Name)
 	fmt.Fprintln(w, strings.Repeat("=", 80))
-	validMark := statusMark("valid", options.ASCII)
-	fmt.Fprintf(w, "STATUS       %s VALID\n", validMark)
+	status := string(wf.Status)
+	if status == "" || wf.Status == workflow.HealthHealthy {
+		status = "healthy"
+	}
+	statusMarkValue := statusMark(status, options.ASCII)
+	fmt.Fprintf(w, "STATUS       %s %s\n", statusMarkValue, strings.ToUpper(status))
+	if wf.StatusReason != "" {
+		fmt.Fprintf(w, "REASON       %s\n", wf.StatusReason)
+	}
+	if wf.RepairCommand != "" {
+		fmt.Fprintf(w, "REPAIR       %s\n", wf.RepairCommand)
+	}
 	fmt.Fprintf(w, "REPOSITORIES %s\n", valueOrDash(strings.Join(wf.Repos, ", ")))
 	fmt.Fprintf(w, "NODES        %d\n", len(wf.Nodes))
 	cleanup := "disabled"

package/cmd/relay-flow/scenario_test.go

@@ -39,6 +39,17 @@ var (
 )
 
 func init() {
+	newScenarioTask := func(context.Context, task.RepoSpec) (task.System, error) {
+		scenarioFactoryMu.Lock()
+		defer scenarioFactoryMu.Unlock()
+		if scenarioFactorySystem == nil {
+			return nil, errors.New("scenario task system not configured")
+		}
+		if fake, ok := scenarioFactorySystem.(*scenarioTaskSystem); ok {
+			fake.log.add("factory:task:" + scenarioTaskPlugin)
+		}
+		return scenarioFactorySystem, nil
+	}
 	task.Register(scenarioTaskPlugin, task.Factory{
 		RequiredRepoKeys: func() []string { return nil },
 		DefaultConfig: func() config.RawValues {
@@ -47,17 +58,8 @@ func init() {
 		TaskScopeKey: func(config.RawValues, config.RawValues) (string, error) {
 			return "scenario-scope", nil
 		},
-		New: func(context.Context, task.RepoSpec) (task.System, error) {
-			scenarioFactoryMu.Lock()
-			defer scenarioFactoryMu.Unlock()
-			if scenarioFactorySystem == nil {
-				return nil, errors.New("scenario task system not configured")
-			}
-			if fake, ok := scenarioFactorySystem.(*scenarioTaskSystem); ok {
-				fake.log.add("factory:task:" + scenarioTaskPlugin)
-			}
-			return scenarioFactorySystem, nil
-		},
+		New:      newScenarioTask,
+		NewLocal: newScenarioTask,
 	})
 	runner.Register(scenarioRunnerPlugin, func(config.RawValues) (runner.Runner, error) {
 		scenarioFactoryMu.Lock()
@@ -213,8 +215,8 @@ func TestCompositionRootSelectsAlternatePluginsForDurableRun(t *testing.T) {
 		"factory:task:" + scenarioTaskPlugin,
 		"factory:runner:" + scenarioRunnerPlugin,
 		"factory:harness:" + scenarioHarnessPlugin,
-		"task-config-validated",
-		"runner-repo-validated",
+		// Workflow task, runner, and harness preflight is submission-only;
+		// startup must not repeat it for an accepted definition.
 		"harness-agent-validated:implementer",
 		"harness-launched:" + scenarioTicket + ":implement",
 		"terminal-created:" + scenarioTicket + ":implement",

package/cmd/relay-flow/serve.go

@@ -50,8 +50,8 @@ import (
 //
 //	flock → load machine config → select task/runner/harness factories →
 //	construct shared runner/harness → load repos + one task.System per repo →
-//	load workflow files → validate each workflow against every referenced
-//	repo task system → bind workflows+matchers to repos → open go-workflows
+//	load workflow files with integrity/local checks → bind trusted
+//	workflows+matchers to repos → open go-workflows
 //	SQLite engine and start its workers → construct the Run Manager →
 //	start the Repo Poller group → start the Unix-socket server.
 func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
@@ -102,61 +102,82 @@ func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
 	// Load registered repos and one task.System per repo. The registry is
 	// shared with repo.Service (constructed below) so the engine, pollers,
 	// and server handlers observe the same in-memory set.
+	if err := task.ValidateLocal(cfg.TaskPlugin); err != nil {
+		return fmt.Errorf("task plugin %q cannot support normal startup: %w", cfg.TaskPlugin, err)
+	}
 	repoReg := repo.NewRegistry()
 	for name, rc := range cfg.Repos {
-		ts, err := task.New(ctx, cfg.TaskPlugin, task.RepoSpec{
+		spec := task.RepoSpec{
 			Name:       name,
 			Path:       rc.Path,
 			RootConfig: cfg.TaskConfig,
 			RepoConfig: rc.TaskConfig,
-		})
-		if err != nil {
-			return fmt.Errorf("repo %q task system: %w", name, err)
+		}
+		ts, taskErr := task.NewLocal(ctx, cfg.TaskPlugin, spec)
+		if taskErr != nil {
+			// A repo-local adapter construction failure must not prevent the
+			// management API or unrelated repositories from starting. Its
+			// workflows are isolated during binding and can be repaired by
+			// resubmission after the task-system issue is fixed.
+			slog.Warn("repository task system unavailable during startup",
+				"repo", name, "error", taskErr)
 		}
 		repoReg.Replace(&repo.Repo{
-			Name:       name,
-			Path:       rc.Path,
-			TaskConfig: rc.TaskConfig,
-			TaskSystem: ts,
+			Name:            name,
+			Path:            rc.Path,
+			TaskConfig:      rc.TaskConfig,
+			TaskSystem:      ts,
+			TaskSystemError: taskErr,
 		})
 	}
 
-	// Load workflow files.
+	// Load workflow files independently. Startup verifies the accepted
+	// integrity hash and performs only cheap local parsing/structure checks;
+	// malformed, legacy, or changed definitions are retained for inspection
+	// but cannot publish routes.
 	store := &workflow.Store{Dir: p.Workflows}
-	workflowList, err := store.LoadAll()
+	records, err := store.LoadAllRecords()
 	if err != nil {
 		return fmt.Errorf("load workflows: %w", err)
 	}
-
-	// Validate each workflow structurally (lifecycle nodes, routes,
-	// reachability, nudge templates) before any per-repo validation or
-	// binding; an invalid stored workflow must fail startup, not bind.
-	for _, wf := range workflowList {
-		if err := wf.Validate(); err != nil {
-			return fmt.Errorf("workflow %q: %w", wf.Name, err)
+	workflowList := make([]*workflow.Workflow, 0, len(records))
+	for _, record := range records {
+		wf := record.Workflow
+		if wf == nil {
+			continue
 		}
-	}
-
-	// Validate each workflow against every referenced repo task system.
-	for _, wf := range workflowList {
-		nodeCfgs := map[string]config.RawValues{}
-		for nodeName, n := range wf.Nodes {
-			nodeCfgs[nodeName] = n.TaskConfig
-		}
-		for _, repoName := range wf.Repos {
-			rp, ok := repoReg.Get(repoName)
-			if !ok {
-				return fmt.Errorf("workflow %q references unregistered repo %q", wf.Name, repoName)
+		if wf.IsRoutable() {
+			for _, repoName := range wf.Repos {
+				if _, ok := repoReg.Get(repoName); !ok {
+					reason := fmt.Sprintf("workflow %q references unregistered repo %q", wf.Name, repoName)
+					wf.MarkBlocked(reason, wf.RepairCommand)
+					break
+				}
 			}
-			if err := rp.TaskSystem.ValidateConfig(ctx, wf.TaskConfig, nodeCfgs); err != nil {
-				return fmt.Errorf("workflow %q repo %q: %w", wf.Name, repoName, err)
+		}
+		workflowList = append(workflowList, wf)
+		if !wf.IsRoutable() {
+			if wf.RepairCommand == "" {
+				slog.Warn("workflow isolated during startup",
+					"workflow", wf.Name, "status", wf.Status,
+					"reason", wf.StatusReason)
+			} else {
+				slog.Warn("workflow isolated during startup",
+					"workflow", wf.Name, "status", wf.Status,
+					"reason", wf.StatusReason, "repair", wf.RepairCommand)
 			}
 		}
 	}
 
-	// Bind workflows and compiled matchers to repos.
-	if err := repoReg.BindWorkflows(workflowList); err != nil {
-		return err
+	// Rebuild derived repository bindings per workflow. Invalid definitions
+	// are isolated while healthy workflows continue routing.
+	for _, issue := range repoReg.BindWorkflowsIsolated(workflowList) {
+		if issue.Workflow == nil {
+			continue
+		}
+		slog.Warn("workflow binding unavailable",
+			"workflow", issue.Workflow.Name, "status", issue.Workflow.Status,
+			"reason", issue.Error, "repair", issue.Workflow.RepairCommand)
 	}
 
 	// 5.5 normal-start refusal: serve REQUIRES an initialized database
@@ -253,18 +274,6 @@ func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
 		return fmt.Errorf("open %s engine: %w", cfg.ExecutorPlugin, err)
 	}
 
-	// 5.2 fail-fast preflight: before workers/pollers start, validate
-	// task-system, runner, and harness credentials/permissions/connectivity,
-	// every registered repo, and every configured agent. Known permanent
-	// errors abort startup; runtime failures of existing runs retry forever
-	// (design.md decision 16).
-	if err := preflight(ctx, repoReg, rnr, hrn, workflowList); err != nil {
-		shutdownCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-		_ = engine.Shutdown(shutdownCtx)
-		cancel()
-		return fmt.Errorf("startup validation: %w", err)
-	}
-
 	// Start engine workers and the one-shot startup retention sweep
 	// (3.25; runs once here, no background ticker).
 	if err := engine.Start(ctx); err != nil {
@@ -290,6 +299,7 @@ func serveRoot(ctx context.Context, p paths.Paths, recover bool) error {
 	runManager.Workflows = wfSvc.Registry()
 	wfSvc.Gate = lifecycleGate
 	wfSvc.ValidateTaskConfig = workflowConfigValidator(repoReg)
+	wfSvc.ValidateSubmission = workflowSubmissionValidator(repoReg, rnr, hrn)
 	// Submit/Remove must also rebuild repo bindings under the gate (spec
 	// 3.34: bindings rebuilt on submit/remove/startup). Wired as a plain
 	// callback — no dispatcher.
@@ -483,6 +493,13 @@ func workflowConfigValidator(repoReg *repo.Registry) func(context.Context, *work
 			if !ok {
 				return fmt.Errorf("workflow %q references unregistered repo %q", wf.Name, repoName)
 			}
+			if rp.TaskSystem == nil {
+				reason := rp.TaskSystemError
+				if reason == nil {
+					reason = fmt.Errorf("no local task-system constructor")
+				}
+				return fmt.Errorf("workflow %q repo %q: task system unavailable: %w", wf.Name, repoName, reason)
+			}
 			if err := rp.TaskSystem.ValidateConfig(ctx, wf.TaskConfig, nodeCfgs); err != nil {
 				return fmt.Errorf("workflow %q repo %q: %w", wf.Name, repoName, err)
 			}
@@ -491,6 +508,57 @@ func workflowConfigValidator(repoReg *repo.Registry) func(context.Context, *work
 	}
 }
 
+// workflowSubmissionValidator runs checks that are specific to a candidate
+// workflow and therefore belong at submission time, not on every restart.
+// Task config validation remains behind workflowConfigValidator; this callback
+// covers runner availability, task-system connectivity, filter compilation,
+// and every agent used by the candidate across its referenced repositories.
+func workflowSubmissionValidator(repoReg *repo.Registry, rnr runner.Runner, hrn harness.Harness) func(context.Context, *workflow.Workflow) error {
+	return func(ctx context.Context, wf *workflow.Workflow) error {
+		type agentProbe struct {
+			repoPath string
+			agent    string
+		}
+		seen := map[agentProbe]bool{}
+		for _, repoName := range wf.Repos {
+			rp, ok := repoReg.Get(repoName)
+			if !ok {
+				return fmt.Errorf("workflow %q references unregistered repo %q", wf.Name, repoName)
+			}
+			if rp.TaskSystem == nil {
+				reason := rp.TaskSystemError
+				if reason == nil {
+					reason = fmt.Errorf("no local task-system constructor")
+				}
+				return fmt.Errorf("workflow %q repo %q: task system unavailable: %w", wf.Name, repoName, reason)
+			}
+			if err := rnr.ValidateRepo(ctx, rp.Name, rp.Path); err != nil {
+				return fmt.Errorf("workflow %q repo %q runner: %w", wf.Name, repoName, err)
+			}
+			if _, err := rp.TaskSystem.Poll(ctx); err != nil {
+				return fmt.Errorf("workflow %q repo %q task system: %w", wf.Name, repoName, err)
+			}
+			if _, err := rp.TaskSystem.CompileFilter(wf.TaskConfig); err != nil {
+				return fmt.Errorf("workflow %q repo %q: compile filter: %w", wf.Name, repoName, err)
+			}
+			for nodeName, node := range wf.Nodes {
+				if (node.Type != workflow.NodeAgent && node.Type != workflow.NodeHITL) || node.Agent == "" {
+					continue
+				}
+				probe := agentProbe{repoPath: rp.Path, agent: node.Agent}
+				if seen[probe] {
+					continue
+				}
+				seen[probe] = true
+				if err := hrn.ValidateAgent(ctx, rp.Path, node.Agent); err != nil {
+					return fmt.Errorf("workflow %q node %q repo %q harness: %w", wf.Name, nodeName, repoName, err)
+				}
+			}
+		}
+		return nil
+	}
+}
+
 // repoExists adapts *repo.Registry to workflow.RepoLookup (Exists).
 type repoExists struct{ reg *repo.Registry }
 
@@ -680,60 +748,5 @@ func handleBatch(runManager *runsvc.RunManager) repo.BatchHandler {
 	}
 }
 
-// preflight is the 5.2 fail-fast startup validation. It runs after the
-// engine is open and BEFORE workers/pollers start. Permanent errors abort
-// startup; runtime errors of existing runs retry forever (different rule).
-//
-// Probes are no-side-effect reads on each adapter boundary:
-//   - runner: ValidateRepo per registered repo (Orca connectivity + repo
-//     presence at the configured path).
-//   - task system: Poll per repo (credentials/permissions/connectivity;
-//     returns active parents only, mutates nothing).
-//   - harness: ValidateAgent per (repo, workflow) agent node (configured
-//     agent must exist for that repo).
-//
-// Repos with no workflows still validate runner + task connectivity; agent
-// validation runs once per distinct (repoPath, agent) pair to avoid
-// redundant CLI calls when several workflows share an agent on one repo.
-func preflight(ctx context.Context, repoReg *repo.Registry, rnr runner.Runner, hrn harness.Harness, workflows []*workflow.Workflow) error {
-	for _, rp := range repoReg.List() {
-		if err := rnr.ValidateRepo(ctx, rp.Name, rp.Path); err != nil {
-			return fmt.Errorf("repo %q runner: %w", rp.Name, err)
-		}
-		if _, err := rp.TaskSystem.Poll(ctx); err != nil {
-			return fmt.Errorf("repo %q task system: %w", rp.Name, err)
-		}
-	}
-	type agentProbe struct {
-		repoPath string
-		agent    string
-	}
-	seen := map[agentProbe]bool{}
-	for _, wf := range workflows {
-		for nodeName, n := range wf.Nodes {
-			// Validate EVERY configured agent (agent and HITL work nodes
-			// both declare one); skip start/end which never carry Agent.
-			if (n.Type != workflow.NodeAgent && n.Type != workflow.NodeHITL) || n.Agent == "" {
-				continue
-			}
-			for _, repoName := range wf.Repos {
-				rp, ok := repoReg.Get(repoName)
-				if !ok {
-					return fmt.Errorf("workflow %q references unregistered repo %q", wf.Name, repoName)
-				}
-				key := agentProbe{repoPath: rp.Path, agent: n.Agent}
-				if seen[key] {
-					continue
-				}
-				seen[key] = true
-				if err := hrn.ValidateAgent(ctx, rp.Path, n.Agent); err != nil {
-					return fmt.Errorf("workflow %q node %q repo %q: %w", wf.Name, nodeName, repoName, err)
-				}
-			}
-		}
-	}
-	return nil
-}
-
 // The recover composition lives in internal/recover (recoverpkg.FromTaskSystem)
 // so it is importable by both serve and the recover test — see task 6.3.

package/internal/execution/goworkflows/activities.go

@@ -32,6 +32,12 @@ func (a *Activities) taskSystem(repoName string) (task.System, error) {
 	if !ok {
 		return nil, fmt.Errorf("repo %q is not registered", repoName)
 	}
+	if rp.TaskSystem == nil {
+		if rp.TaskSystemError != nil {
+			return nil, fmt.Errorf("repo %q task system unavailable: %w", repoName, rp.TaskSystemError)
+		}
+		return nil, fmt.Errorf("repo %q task system unavailable", repoName)
+	}
 	return rp.TaskSystem, nil
 }
 

package/internal/execution/temporal/activities.go

@@ -37,6 +37,12 @@ func (a *Activities) taskSystem(repoName string) (task.System, error) {
 	if !ok {
 		return nil, fmt.Errorf("repo %q is not registered", repoName)
 	}
+	if rp.TaskSystem == nil {
+		if rp.TaskSystemError != nil {
+			return nil, fmt.Errorf("repo %q task system unavailable: %w", repoName, rp.TaskSystemError)
+		}
+		return nil, fmt.Errorf("repo %q task system unavailable", repoName)
+	}
 	return rp.TaskSystem, nil
 }
 

package/internal/execution/temporal/recovery.go

@@ -141,6 +141,10 @@ func listWorkflowExecutions(ctx context.Context, list func(context.Context, *wor
 // ID is described and restored only when Temporal already owns that execution.
 func (e *Engine) reconcileClaimedParents(ctx context.Context, visible map[string]bool) error {
 	for _, rp := range e.deps.Repos.List() {
+		if rp.TaskSystem == nil {
+			slog.Warn("Temporal recovery skipping repository with unavailable task system", "repo", rp.Name, "error", rp.TaskSystemError)
+			continue
+		}
 		tickets, err := rp.TaskSystem.Poll(ctx)
 		if err != nil {
 			return fmt.Errorf("poll repo %q during Temporal recovery: %w", rp.Name, err)

package/internal/harness/opencode/opencode_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/rajpopat27/relay-flow/internal/workflow"
 )
 
-const configuredPlugin = "relay-flow-plugin@0.3.7-alpha"
+const configuredPlugin = "relay-flow-plugin@0.3.8-alpha"
 
 func TestBuildCommandArgv(t *testing.T) {
 	t.Setenv("RELAY_FLOW_HOME", "/var/lib/relay-flow-test")

package/internal/harness/opencode/repo_setup.go

@@ -10,7 +10,7 @@ import (
 	"github.com/rajpopat27/relay-flow/internal/config"
 )
 
-const relayFlowPlugin = "relay-flow-plugin@0.3.7-alpha"
+const relayFlowPlugin = "relay-flow-plugin@0.3.8-alpha"
 
 type jsoncToken struct {
 	kind       byte

package/internal/recover/recover.go

@@ -46,6 +46,10 @@ type MailboxSpecFor func(task.System, run.Work, *workflow.Workflow) ([]task.Mail
 // never automatic; database loss is never inferred.
 func FromTaskSystem(ctx context.Context, repoReg *repo.Registry, rnr runner.Runner, runManager *run.RunManager, specsFor MailboxSpecFor) error {
 	for _, rp := range repoReg.List() {
+		if rp.TaskSystem == nil {
+			slog.Warn("recover: skip repository with unavailable task system", "repo", rp.Name, "error", rp.TaskSystemError)
+			continue
+		}
 		tickets, err := rp.TaskSystem.Poll(ctx)
 		if err != nil {
 			return fmt.Errorf("repo %q poll: %w", rp.Name, err)

package/internal/repo/binding_test.go

@@ -0,0 +1,92 @@
+package repo
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/task"
+	"github.com/rajpopat27/relay-flow/internal/workflow"
+)
+
+type bindingTaskSystem struct {
+	task.System
+	compileErr map[string]error
+}
+
+func (s bindingTaskSystem) CompileFilter(values config.RawValues) (func(task.Ticket) bool, error) {
+	if name, ok := values["name"].(string); ok {
+		if err := s.compileErr[name]; err != nil {
+			return nil, err
+		}
+		return func(ticket task.Ticket) bool { return ticket.Key == name }, nil
+	}
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func TestBindWorkflowsIsolatedPublishesHealthyWorkflows(t *testing.T) {
+	system := bindingTaskSystem{compileErr: map[string]error{"bad": errors.New("invalid filter")}}
+	registered := &Repo{Name: "payments", TaskSystem: system}
+	registry := NewRegistry()
+	registry.Replace(registered)
+
+	bad := &workflow.Workflow{Name: "badFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy, TaskConfig: config.RawValues{"name": "bad"}}
+	good := &workflow.Workflow{Name: "goodFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy, TaskConfig: config.RawValues{"name": "good"}}
+	issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{bad, good})
+	if len(issues) != 1 || issues[0].Workflow != bad {
+		t.Fatalf("binding issues = %#v, want only badFlow", issues)
+	}
+	if bad.Status != workflow.HealthBlocked || bad.StatusReason == "" {
+		t.Fatalf("bad workflow status = %q reason=%q", bad.Status, bad.StatusReason)
+	}
+	bindings := registered.Bindings()
+	if len(bindings) != 1 || bindings[0].Workflow != good {
+		t.Fatalf("published bindings = %#v, want only goodFlow", bindings)
+	}
+}
+
+func TestBindWorkflowsIsolatedSkipsOutdatedWorkflow(t *testing.T) {
+	registered := &Repo{Name: "payments", TaskSystem: bindingTaskSystem{}}
+	registry := NewRegistry()
+	registry.Replace(registered)
+	wf := &workflow.Workflow{Name: "editedFlow", Repos: []string{"payments"}, Status: workflow.HealthOutdated}
+	if issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{wf}); len(issues) != 0 {
+		t.Fatalf("outdated workflow binding issues = %#v, want none", issues)
+	}
+	if bindings := registered.Bindings(); len(bindings) != 0 {
+		t.Fatalf("outdated workflow bindings = %#v, want none", bindings)
+	}
+}
+
+func TestBindWorkflowsIsolatedBlocksUnavailableTaskSystem(t *testing.T) {
+	registered := &Repo{Name: "payments", TaskSystemError: errors.New("task service offline")}
+	registry := NewRegistry()
+	registry.Replace(registered)
+	wf := &workflow.Workflow{Name: "paymentsFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy}
+	issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{wf})
+	if len(issues) != 1 || wf.Status != workflow.HealthBlocked || !strings.Contains(wf.StatusReason, "task service offline") {
+		t.Fatalf("unavailable task system issues=%#v status=%q reason=%q", issues, wf.Status, wf.StatusReason)
+	}
+	if bindings := registered.Bindings(); len(bindings) != 0 {
+		t.Fatalf("unavailable repo bindings = %#v, want none", bindings)
+	}
+}
+
+func TestBindWorkflowsIsolatedClearsStaleBindings(t *testing.T) {
+	registered := &Repo{Name: "payments", TaskSystem: bindingTaskSystem{}}
+	registry := NewRegistry()
+	registry.Replace(registered)
+	first := &workflow.Workflow{Name: "firstFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy}
+	if issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{first}); len(issues) != 0 {
+		t.Fatalf("initial binding issues = %#v", issues)
+	}
+	second := &workflow.Workflow{Name: "secondFlow", Repos: []string{"payments"}, Status: workflow.HealthHealthy}
+	if issues := registry.BindWorkflowsIsolated([]*workflow.Workflow{second}); len(issues) != 0 {
+		t.Fatalf("replacement binding issues = %#v", issues)
+	}
+	bindings := registered.Bindings()
+	if len(bindings) != 1 || bindings[0].Workflow != second {
+		t.Fatalf("replacement bindings = %#v, want only secondFlow", bindings)
+	}
+}

package/internal/repo/poller.go

@@ -39,6 +39,9 @@ func (p *RepoPoller) Run(ctx context.Context) {
 }
 
 func (p *RepoPoller) poll(ctx context.Context) {
+	if p.Repo == nil || p.Repo.TaskSystem == nil {
+		return
+	}
 	if p.sem != nil {
 		select {
 		case p.sem <- struct{}{}: