relay-flow 0.3.9-alpha → 0.3.10-alpha

package/internal/execution/goworkflows/ownership_test.go

@@ -0,0 +1,259 @@
+package goworkflows_test
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/execution/goworkflows"
+	"github.com/rajpopat27/relay-flow/internal/identity"
+	recoverpkg "github.com/rajpopat27/relay-flow/internal/recover"
+	"github.com/rajpopat27/relay-flow/internal/router"
+	"github.com/rajpopat27/relay-flow/internal/run"
+	"github.com/rajpopat27/relay-flow/internal/task"
+	"github.com/rajpopat27/relay-flow/internal/workflow"
+)
+
+// ownershipCompositionState models the provider-owned labels and current
+// assignee shared by two independent relay-flow databases. The adapter fake
+// persists a durable wf-owner marker when the first server claims the ticket.
+type ownershipCompositionState struct {
+	mu       sync.Mutex
+	assignee string
+	labels   []string
+}
+
+type ownershipCompositionTaskSystem struct {
+	*fakeTaskSystem
+	owner string
+	state *ownershipCompositionState
+}
+
+func newOwnershipCompositionTaskSystem(owner string, state *ownershipCompositionState, log *eventLog) *ownershipCompositionTaskSystem {
+	return &ownershipCompositionTaskSystem{
+		fakeTaskSystem: newFakeTaskSystem(log), owner: owner, state: state,
+	}
+}
+
+func (s *ownershipCompositionTaskSystem) Poll(context.Context) ([]task.Ticket, error) {
+	s.state.mu.Lock()
+	defer s.state.mu.Unlock()
+	claims := make([]string, 0, 1)
+	for _, label := range s.state.labels {
+		if len(label) > len("wf:") && label[:len("wf:")] == "wf:" {
+			claims = append(claims, label)
+		}
+	}
+	return []task.Ticket{{
+		ID: "1", Key: "PAY-101", Title: "ownership composition",
+		WorkflowClaims: claims,
+		Fields: map[string]any{
+			"assignee": s.state.assignee,
+			"labels":   append([]string(nil), s.state.labels...),
+		},
+	}}, nil
+}
+
+func (s *ownershipCompositionTaskSystem) CompileFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(ticket task.Ticket) bool {
+		assignee, _ := ticket.Fields["assignee"].(string)
+		return assignee == s.owner
+	}, nil
+}
+
+func (s *ownershipCompositionTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(ticket task.Ticket) bool {
+		if len(ticket.WorkflowClaims) != 1 {
+			return false
+		}
+		assignee, _ := ticket.Fields["assignee"].(string)
+		if assignee != s.owner {
+			return false
+		}
+		want := "wf-owner:" + ticket.WorkflowClaims[0][len("wf:"):] + ":" + s.owner
+		labels, _ := ticket.Fields["labels"].([]string)
+		for _, label := range labels {
+			if label == want {
+				return true
+			}
+		}
+		return false
+	}, nil
+}
+
+func (s *ownershipCompositionTaskSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	s.state.mu.Lock()
+	defer s.state.mu.Unlock()
+	if s.hasOwnerMarkerLocked("ownershipFlow") {
+		return nil
+	}
+	return &task.OwnershipMismatchError{Ticket: "PAY-101", Workflow: "ownershipFlow"}
+}
+
+func (s *ownershipCompositionTaskSystem) BackfillClaimOwner(context.Context, task.TicketRef, string, config.RawValues) error {
+	s.state.mu.Lock()
+	defer s.state.mu.Unlock()
+	if !containsLabel(s.state.labels, "wf:ownershipFlow") {
+		return &task.OwnershipMismatchError{Ticket: "PAY-101", Workflow: "ownershipFlow"}
+	}
+	marker := "wf-owner:ownershipFlow:" + s.owner
+	if !containsLabel(s.state.labels, marker) {
+		s.state.labels = append(s.state.labels, marker)
+	}
+	return nil
+}
+
+func (s *ownershipCompositionTaskSystem) ClaimIfOwned(ctx context.Context, ticket task.TicketRef, workflowName string, _ config.RawValues) error {
+	s.state.mu.Lock()
+	defer s.state.mu.Unlock()
+	if s.state.assignee != s.owner {
+		return &task.OwnershipMismatchError{Ticket: ticket.Key, Workflow: workflowName}
+	}
+	ownerMarker := "wf-owner:" + workflowName + ":" + s.owner
+	claim := "wf:" + workflowName
+	for _, label := range s.state.labels {
+		if label == ownerMarker && containsLabel(s.state.labels, claim) {
+			return nil
+		}
+		if len(label) > len("wf:") && label[:len("wf:")] == "wf:" {
+			return &task.OwnershipMismatchError{Ticket: ticket.Key, Workflow: workflowName}
+		}
+	}
+	s.state.labels = append(s.state.labels, ownerMarker, claim)
+	return nil
+}
+
+func (s *ownershipCompositionTaskSystem) hasOwnerMarkerLocked(workflowName string) bool {
+	return containsLabel(s.state.labels, "wf-owner:"+workflowName+":"+s.owner)
+}
+
+func containsLabel(labels []string, want string) bool {
+	for _, label := range labels {
+		if label == want {
+			return true
+		}
+	}
+	return false
+}
+
+func TestExplicitLegacyBackfillPreservesClaimAndEnablesRoutingAndRecovery(t *testing.T) {
+	state := &ownershipCompositionState{assignee: "alice", labels: []string{"wf:ownershipFlow"}}
+	log := newEventLog()
+	sys := newOwnershipCompositionTaskSystem("alice", state, log)
+	reg := repoRegistryWith("payments", sys)
+	wf := linearWorkflow(false)
+	wf.Name = "ownershipFlow"
+	wf.TaskConfig = config.RawValues{"filters": map[string]any{"assignees": []any{"currentUser()"}}}
+	if err := reg.BindWorkflows([]*workflow.Workflow{&wf}); err != nil {
+		t.Fatal(err)
+	}
+	workflowReg := &workflow.Registry{}
+	workflowReg.Replace(&wf)
+	fr := newFakeRunner(log)
+	engine := newEngine(t, goworkflows.Dependencies{Repos: reg, Runner: fr, Harness: newFakeHarness(log)})
+	manager := &run.RunManager{Executor: engine, Runs: engine, Repos: reg, Workflows: workflowReg}
+	if err := manager.BackfillClaimOwner(context.Background(), "payments", "PAY-101", "ownershipFlow"); err != nil {
+		t.Fatalf("explicit backfill failed: %v", err)
+	}
+	state.mu.Lock()
+	labels := append([]string(nil), state.labels...)
+	state.mu.Unlock()
+	if !containsLabel(labels, "wf:ownershipFlow") || !containsLabel(labels, "wf-owner:ownershipFlow:alice") || len(labels) != 2 {
+		t.Fatalf("backfill labels = %v, want preserved claim plus one provenance marker", labels)
+	}
+	rp, _ := reg.Get("payments")
+	ticket, _ := sys.Poll(context.Background())
+	if _, err := router.ResolveWorkflow(rp, ticket[0]); err != nil {
+		t.Fatalf("backfilled claim did not route normally: %v", err)
+	}
+	specsFor := func(system task.System, work run.Work, w *workflow.Workflow) ([]task.MailboxSpec, error) {
+		return goworkflows.RenderMailboxSpecs(system, work, w)
+	}
+	if err := recoverpkg.FromTaskSystem(context.Background(), reg, fr, manager, specsFor); err != nil {
+		t.Fatalf("backfilled claim did not recover: %v", err)
+	}
+	if runs, err := engine.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "ownershipFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 1 {
+		t.Fatalf("recovered runs = %v, %v; want one run", runs, err)
+	}
+}
+
+func TestIndependentRunDatabasesCannotTakeOverReassignedClaim(t *testing.T) {
+	state := &ownershipCompositionState{assignee: "alice"}
+	logA, logB := newEventLog(), newEventLog()
+	sysA := newOwnershipCompositionTaskSystem("alice", state, logA)
+	sysB := newOwnershipCompositionTaskSystem("bob", state, logB)
+	regA := repoRegistryWith("payments", sysA)
+	regB := repoRegistryWith("payments", sysB)
+	wf := linearWorkflow(false)
+	wf.Name = "ownershipFlow"
+	wf.TaskConfig = config.RawValues{"filters": map[string]any{
+		"assignees": []any{"currentUser()"},
+	}}
+	if err := regA.BindWorkflows([]*workflow.Workflow{&wf}); err != nil {
+		t.Fatal(err)
+	}
+	if err := regB.BindWorkflows([]*workflow.Workflow{&wf}); err != nil {
+		t.Fatal(err)
+	}
+
+	engineA := newEngine(t, goworkflows.Dependencies{
+		Repos: regA, Runner: newFakeRunner(logA), Harness: newFakeHarness(logA),
+	})
+	engineB := newEngine(t, goworkflows.Dependencies{
+		Repos: regB, Runner: newFakeRunner(logB), Harness: newFakeHarness(logB),
+	})
+	managerA := &run.RunManager{Executor: engineA, Runs: engineA}
+	managerB := &run.RunManager{Executor: engineB, Runs: engineB}
+
+	ticketA, err := sysA.Poll(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	rpA, _ := regA.Get("payments")
+	resolvedA, err := router.ResolveWorkflow(rpA, ticketA[0])
+	if err != nil {
+		t.Fatalf("owner A route failed: %v", err)
+	}
+	if err := managerA.EnsureRun(context.Background(), rpA, resolvedA, ticketA[0]); err != nil {
+		t.Fatalf("owner A EnsureRun failed: %v", err)
+	}
+	waitFor(t, 10*time.Second, func() bool {
+		current, err := engineA.GetRun(context.Background(), identity.NewRunID("payments", "ownershipFlow", "PAY-101"))
+		return err == nil && current.State != run.StateCompleted && current.State != run.StateCanceled
+	})
+
+	state.mu.Lock()
+	state.assignee = "bob"
+	state.mu.Unlock()
+	ticketB, err := sysB.Poll(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	rpB, _ := regB.Get("payments")
+	if _, err := router.ResolveWorkflow(rpB, ticketB[0]); !errors.Is(err, router.ErrClaimOwnerMismatch) {
+		t.Fatalf("owner B route error = %v, want claim-owner-mismatch", err)
+	}
+	if err := managerB.EnsureRun(context.Background(), rpB, &wf, ticketB[0]); !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("owner B EnsureRun error = %v, want ownership mismatch", err)
+	}
+	if runs, err := engineB.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "ownershipFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 0 {
+		t.Fatalf("owner B database runs = %v, %v; want none", runs, err)
+	}
+
+	// Reassignment is a current-owner mismatch for both servers. The
+	// original durable run remains in database A, but neither server calls
+	// EnsureRun to reconcile or create execution state after the mismatch.
+	ticketAAfterReassignment, _ := sysA.Poll(context.Background())
+	if _, err := router.ResolveWorkflow(rpA, ticketAAfterReassignment[0]); !errors.Is(err, router.ErrClaimOwnerMismatch) {
+		t.Fatalf("owner A route after reassignment = %v, want claim-owner-mismatch", err)
+	}
+	if err := managerA.EnsureRun(context.Background(), rpA, &wf, ticketAAfterReassignment[0]); !errors.Is(err, task.ErrOwnershipMismatch) {
+		t.Fatalf("owner A EnsureRun after reassignment = %v, want ownership mismatch", err)
+	}
+	if runs, err := engineA.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "ownershipFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 1 {
+		t.Fatalf("owner A database runs after reassignment = %v, %v; want one existing run", runs, err)
+	}
+}

package/internal/execution/goworkflows/recovery_test.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/cschleiden/go-workflows/backend/history"
+	"github.com/rajpopat27/relay-flow/internal/config"
 	"github.com/rajpopat27/relay-flow/internal/execution/goworkflows"
 	"github.com/rajpopat27/relay-flow/internal/identity"
 	recoverpkg "github.com/rajpopat27/relay-flow/internal/recover"
@@ -1358,7 +1359,7 @@ func TestDatabaseFileIsOwnerOnly(t *testing.T) {
 // task.System/runner.Runner plus the real engine and the real RunManager.
 // Rewritten in 6.3 from a test-local copy so the production wiring is
 // actually covered.
-func recoverTickets(ctx context.Context, engine *goworkflows.Engine, sys *fakeTaskSystem, fr *fakeRunner, wf workflow.Workflow) error {
+func recoverTickets(ctx context.Context, engine *goworkflows.Engine, sys task.System, fr *fakeRunner, wf workflow.Workflow) error {
 	reg := repo.NewRegistry()
 	reg.Replace(&repo.Repo{
 		Name:       "payments",
@@ -1376,6 +1377,85 @@ func recoverTickets(ctx context.Context, engine *goworkflows.Engine, sys *fakeTa
 	return recoverpkg.FromTaskSystem(ctx, reg, fr, rm, specsFor)
 }
 
+type mismatchedRecoveryTaskSystem struct{ *fakeTaskSystem }
+
+type legacyRecoveryTaskSystem struct{ *fakeTaskSystem }
+
+func (s *legacyRecoveryTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	return func(task.Ticket) bool { return false }, nil
+}
+
+func (s *mismatchedRecoveryTaskSystem) CompileOwnershipFilter(config.RawValues) (func(task.Ticket) bool, error) {
+	// Let the router resolve the claim; the current-provider read below is the
+	// mismatch gate being exercised by this recovery regression.
+	return func(task.Ticket) bool { return true }, nil
+}
+
+func (s *mismatchedRecoveryTaskSystem) ValidateOwnership(context.Context, task.TicketRef, string, config.RawValues) error {
+	return &task.OwnershipMismatchError{Ticket: "PAY-101", Workflow: "basicFlow"}
+}
+
+func TestServeRecoverSkipsOwnerMismatchBeforeMutations(t *testing.T) {
+	log := newEventLog()
+	base := newFakeTaskSystem(log)
+	sys := &mismatchedRecoveryTaskSystem{fakeTaskSystem: base}
+	sys.parentsToRecover = []task.Ticket{{ID: "1", Key: "PAY-101", WorkflowClaims: []string{"wf:basicFlow"}}}
+	fr := newFakeRunner(log)
+	engine := newEngine(t, goworkflows.Dependencies{
+		Repos: repoRegistryWith("payments", sys), Runner: fr, Harness: newFakeHarness(log),
+	})
+	wf := linearWorkflow(false)
+	reg := repo.NewRegistry()
+	reg.Replace(&repo.Repo{Name: "payments", Path: "/srv/payments", TaskSystem: sys})
+	if err := reg.BindWorkflows([]*workflow.Workflow{&wf}); err != nil {
+		t.Fatal(err)
+	}
+	rm := &run.RunManager{Executor: engine, Runs: engine}
+	specsFor := func(system task.System, work run.Work, w *workflow.Workflow) ([]task.MailboxSpec, error) {
+		return goworkflows.RenderMailboxSpecs(system, work, w)
+	}
+	if err := recoverpkg.FromTaskSystem(context.Background(), reg, fr, rm, specsFor); err != nil {
+		t.Fatalf("recovery failed on owner mismatch: %v", err)
+	}
+	if len(fr.closedRun) != 0 {
+		t.Fatalf("CloseTerminals calls = %v, want none", fr.closedRun)
+	}
+	if base.hasCommentCount() != 0 {
+		t.Fatalf("HasComment calls = %d, want none before owner rejection", base.hasCommentCount())
+	}
+	if len(base.resets) != 0 {
+		t.Fatalf("ResetForRecovery calls = %v, want none", base.resets)
+	}
+	for _, event := range log.all() {
+		if strings.HasPrefix(event, "ensureMailboxes:") || strings.HasPrefix(event, "createMailbox:") {
+			t.Fatalf("mailbox mutation after owner mismatch: %v", log.all())
+		}
+	}
+	if runs, err := engine.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "basicFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 0 {
+		t.Fatalf("durable runs after owner mismatch = %v, %v; want none", runs, err)
+	}
+}
+
+func TestServeRecoverSkipsLegacyClaimWithoutProvenance(t *testing.T) {
+	log := newEventLog()
+	base := newFakeTaskSystem(log)
+	sys := &legacyRecoveryTaskSystem{fakeTaskSystem: base}
+	sys.parentsToRecover = []task.Ticket{{ID: "1", Key: "PAY-101", WorkflowClaims: []string{"wf:basicFlow"}}}
+	fr := newFakeRunner(log)
+	engine := newEngine(t, goworkflows.Dependencies{
+		Repos: repoRegistryWith("payments", sys), Runner: fr, Harness: newFakeHarness(log),
+	})
+	if err := recoverTickets(context.Background(), engine, sys, fr, linearWorkflow(false)); err != nil {
+		t.Fatalf("legacy-claim recovery failed: %v", err)
+	}
+	if len(fr.closedRun) != 0 || base.hasCommentCount() != 0 || len(base.resets) != 0 {
+		t.Fatalf("legacy claim caused recovery side effects: closed=%v comments=%d resets=%v", fr.closedRun, base.hasCommentCount(), base.resets)
+	}
+	if runs, err := engine.ListRuns(context.Background(), run.Filter{Repo: "payments", Workflow: "basicFlow", Ticket: "PAY-101"}); err != nil || len(runs) != 0 {
+		t.Fatalf("legacy claim durable runs = %v, %v; want none", runs, err)
+	}
+}
+
 func TestServeRecoverRebuildsFreshRuns(t *testing.T) {
 	log := newEventLog()
 	sys := newFakeTaskSystem(log)

package/internal/execution/temporal/interpreter.go

@@ -402,7 +402,8 @@ func runGraph(ctx temporalworkflow.Context, start run.Start, state *workflowStat
 		spec := harness.LaunchSpec{
 			RunID: start.ID, NodeVisitID: visit, RepoName: start.Repo, RepoPath: start.RepoPath,
 			Workflow: wf.Name, Ticket: start.Ticket.Key, Node: current, NodeType: node.Type,
-			Agent: node.Agent, Title: start.Ticket.Key + ":" + current, NudgePrompt: node.NudgePrompt,
+			AutoReject: node.AutoReject,
+			Agent:      node.Agent, Title: start.Ticket.Key + ":" + current, NudgePrompt: node.NudgePrompt,
 			PromptData: harness.PromptData{
 				TaskSystem: "", Ticket: start.Ticket.Key, Workflow: wf.Name, Repo: start.Repo,
 				Node: current, NodeType: node.Type, Agent: node.Agent, NodeDescription: node.Description,

package/internal/execution/temporal/recovery.go

@@ -6,10 +6,12 @@ import (
 	"fmt"
 	"log/slog"
 	"sort"
-	"strings"
 	"time"
 
 	"github.com/rajpopat27/relay-flow/internal/identity"
+	"github.com/rajpopat27/relay-flow/internal/repo"
+	"github.com/rajpopat27/relay-flow/internal/router"
+	"github.com/rajpopat27/relay-flow/internal/task"
 	enumspb "go.temporal.io/api/enums/v1"
 	"go.temporal.io/api/serviceerror"
 	workflowpb "go.temporal.io/api/workflow/v1"
@@ -145,52 +147,82 @@ func (e *Engine) reconcileClaimedParents(ctx context.Context, visible map[string
 			slog.Warn("Temporal recovery skipping repository with unavailable task system", "repo", rp.Name, "error", rp.TaskSystemError)
 			continue
 		}
+		capabilities, ok := rp.TaskSystem.(task.OwnershipCapabilities)
+		if !ok {
+			slog.Warn("Temporal recovery skipping repository without ownership capabilities", "repo", rp.Name,
+				"outcome", "ownership-capability-missing")
+			continue
+		}
 		tickets, err := rp.TaskSystem.Poll(ctx)
 		if err != nil {
 			return fmt.Errorf("poll repo %q during Temporal recovery: %w", rp.Name, err)
 		}
 		for _, ticket := range tickets {
-			for _, claim := range ticket.WorkflowClaims {
-				if !strings.HasPrefix(claim, "wf:") {
-					continue
-				}
-				workflowName := strings.TrimPrefix(claim, "wf:")
-				var matched bool
-				for _, binding := range rp.Bindings() {
-					if binding.Workflow != nil && binding.Workflow.Name == workflowName {
-						matched = true
-						break
-					}
-				}
-				if !matched {
-					continue
-				}
-				expectedID := identity.NewRunID(rp.Name, workflowName, ticket.Key)
-				if visible[string(expectedID)] {
-					continue
+			// Projection reconciliation only considers claimed parents. Resolve
+			// through the same router as normal polling so ambiguous, unknown,
+			// and owner-mismatched claims cannot restore an execution.
+			if len(ticket.WorkflowClaims) != 1 {
+				continue
+			}
+			wf, err := router.ResolveWorkflow(rp, ticket)
+			if err != nil {
+				var ownerMismatch *router.ClaimOwnerMismatchError
+				if errors.As(err, &ownerMismatch) {
+					slog.Info("Temporal recovery route outcome", "repo", rp.Name, "ticket", ticket.Key,
+						"workflow", ownerMismatch.Workflow, "outcome", "claim-owner-mismatch")
+				} else {
+					slog.Warn("Temporal recovery skipped claimed ticket", "repo", rp.Name, "ticket", ticket.Key, "outcome", "invalid-claim", "error", err)
 				}
-				info, err := e.client.DescribeWorkflowExecution(ctx, string(expectedID), "")
-				if err != nil {
-					var notFound *serviceerror.NotFound
-					if errors.As(err, &notFound) {
-						// This is the documented claim-before-run gap. Record it
-						// for operators, but leave creation to normal polling after
-						// recovery; this path must never start a replacement.
-						slog.Info("Temporal recovery missing claimed execution", "repo", rp.Name, "workflow", workflowName, "ticket", ticket.Key, "runID", string(expectedID))
-						continue
-					}
-					return fmt.Errorf("describe claimed Temporal workflow %s: %w", expectedID, err)
+				continue
+			}
+			workflowName := wf.Name
+			var matched *repo.WorkflowBinding
+			for _, binding := range rp.Bindings() {
+				if binding.Workflow != nil && binding.Workflow.Name == workflowName {
+					candidate := binding
+					matched = &candidate
+					break
 				}
-				if info == nil || info.WorkflowExecutionInfo == nil || info.WorkflowExecutionInfo.Execution == nil ||
-					info.WorkflowExecutionInfo.Type == nil || info.WorkflowExecutionInfo.Type.Name != TicketWorkflowName || info.WorkflowExecutionInfo.TaskQueue != TaskQueue {
+			}
+			if matched == nil {
+				continue
+			}
+			// Existing Temporal executions are restored only after the same
+			// ownership gate used by normal claimed routing. Lifecycle
+			// filters remain intentionally bypassed.
+			if err := capabilities.ValidateOwnership(ctx, ticket.Ref(), workflowName, matched.Workflow.TaskConfig); err != nil {
+				if errors.Is(err, task.ErrOwnershipMismatch) {
+					slog.Info("Temporal recovery route outcome", "repo", rp.Name, "ticket", ticket.Key,
+						"workflow", workflowName, "outcome", "claim-owner-mismatch", "error", err)
 					continue
 				}
-				if !shouldRestoreTemporalExecution(info.WorkflowExecutionInfo, time.Now().UTC(), e.retention) {
+				return fmt.Errorf("poll repo %q ticket %s validate ownership: %w", rp.Name, ticket.Key, err)
+			}
+			expectedID := identity.NewRunID(rp.Name, workflowName, ticket.Key)
+			if visible[string(expectedID)] {
+				continue
+			}
+			info, err := e.client.DescribeWorkflowExecution(ctx, string(expectedID), "")
+			if err != nil {
+				var notFound *serviceerror.NotFound
+				if errors.As(err, &notFound) {
+					// This is the documented claim-before-run gap. Record it
+					// for operators, but leave creation to normal polling after
+					// recovery; this path must never start a replacement.
+					slog.Info("Temporal recovery missing claimed execution", "repo", rp.Name, "workflow", workflowName, "ticket", ticket.Key, "runID", string(expectedID))
 					continue
 				}
-				if err := e.restoreProjection(ctx, info.WorkflowExecutionInfo); err != nil {
-					return fmt.Errorf("restore claimed Temporal workflow %s: %w", expectedID, err)
-				}
+				return fmt.Errorf("describe claimed Temporal workflow %s: %w", expectedID, err)
+			}
+			if info == nil || info.WorkflowExecutionInfo == nil || info.WorkflowExecutionInfo.Execution == nil ||
+				info.WorkflowExecutionInfo.Type == nil || info.WorkflowExecutionInfo.Type.Name != TicketWorkflowName || info.WorkflowExecutionInfo.TaskQueue != TaskQueue {
+				continue
+			}
+			if !shouldRestoreTemporalExecution(info.WorkflowExecutionInfo, time.Now().UTC(), e.retention) {
+				continue
+			}
+			if err := e.restoreProjection(ctx, info.WorkflowExecutionInfo); err != nil {
+				return fmt.Errorf("restore claimed Temporal workflow %s: %w", expectedID, err)
 			}
 		}
 	}

package/internal/harness/harness.go

@@ -49,6 +49,7 @@ type LaunchSpec struct {
 	Ticket      string
 	Node        string
 	NodeType    workflow.NodeType
+	AutoReject  bool
 	Agent       string
 	Title       string
 	Prompt      string

package/internal/harness/opencode/opencode.go

@@ -17,6 +17,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
 
 	"github.com/rajpopat27/relay-flow/internal/config"
@@ -206,6 +207,10 @@ func (h *Harness) BuildCommand(spec harness.LaunchSpec) (runner.Command, error)
 	} {
 		env[key] = value
 	}
+	if spec.NodeType == workflow.NodeHITL {
+		// HITL policy is launch metadata, not part of the report wire object.
+		env["RELAY_FLOW_AUTO_REJECT"] = strconv.FormatBool(spec.AutoReject)
+	}
 	args := []string{}
 	if spec.ResumeID != "" {
 		args = append(args, "--session", spec.ResumeID)

package/internal/harness/opencode/opencode_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/rajpopat27/relay-flow/internal/workflow"
 )
 
-const configuredPlugin = "relay-flow-plugin@0.3.9-alpha"
+const configuredPlugin = "relay-flow-plugin@0.3.10-alpha"
 
 func TestBuildCommandArgv(t *testing.T) {
 	t.Setenv("RELAY_FLOW_HOME", "/var/lib/relay-flow-test")
@@ -57,6 +57,22 @@ func TestBuildCommandArgv(t *testing.T) {
 	}
 }
 
+func TestBuildCommandCarriesHITLAutoRejectPolicy(t *testing.T) {
+	t.Setenv("RELAY_FLOW_HOME", "/var/lib/relay-flow-test")
+	cmd, err := opencode.New().BuildCommand(harness.LaunchSpec{
+		NodeType:   workflow.NodeHITL,
+		AutoReject: true,
+		Agent:      "reviewer",
+		Prompt:     "review the ticket",
+	})
+	if err != nil {
+		t.Fatalf("BuildCommand: %v", err)
+	}
+	if got := cmd.Env["RELAY_FLOW_AUTO_REJECT"]; got != "true" {
+		t.Fatalf("RELAY_FLOW_AUTO_REJECT = %q, want true", got)
+	}
+}
+
 func TestRenderPromptTemplatesExposeAllValues(t *testing.T) {
 	raw := config.RawValues{
 		"initial":  "initial {{taskSystem}}|{{ticket}}|{{workflow}}|{{repo}}|{{node}}|{{nodeType}}|{{agent}}|{{nodeDescription}}|{{nextSteps}}|{{mailbox}}",

package/internal/harness/opencode/repo_setup.go

@@ -10,7 +10,7 @@ import (
 	"github.com/rajpopat27/relay-flow/internal/config"
 )
 
-const relayFlowPlugin = "relay-flow-plugin@0.3.9-alpha"
+const relayFlowPlugin = "relay-flow-plugin@0.3.10-alpha"
 
 type jsoncToken struct {
 	kind       byte

package/internal/harness/pi/pi.go

@@ -13,11 +13,13 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
 
 	"github.com/rajpopat27/relay-flow/internal/config"
 	"github.com/rajpopat27/relay-flow/internal/harness"
 	"github.com/rajpopat27/relay-flow/internal/runner"
+	"github.com/rajpopat27/relay-flow/internal/workflow"
 )
 
 const (
@@ -214,6 +216,10 @@ func (*Harness) BuildCommand(spec harness.LaunchSpec) (runner.Command, error) {
 	} {
 		env[key] = value
 	}
+	if spec.NodeType == workflow.NodeHITL {
+		// HITL policy is launch metadata, not part of the report wire object.
+		env["RELAY_FLOW_AUTO_REJECT"] = strconv.FormatBool(spec.AutoReject)
+	}
 	args := []string{"--name", spec.Title}
 	if spec.Agent != "default" {
 		args = append(args, "--prompt-template", promptTemplatePath(spec.Agent))

package/internal/harness/pi/task_env_test.go

@@ -2,8 +2,24 @@ package pi
 
 import (
 	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/workflow"
 )
 
+func TestBuildCommandCarriesHITLAutoRejectPolicy(t *testing.T) {
+	t.Setenv("RELAY_FLOW_HOME", "/var/lib/relay-flow-test")
+	spec := launchSpec(t)
+	spec.NodeType = workflow.NodeHITL
+	spec.AutoReject = true
+	cmd, err := (&Harness{}).BuildCommand(spec)
+	if err != nil {
+		t.Fatalf("BuildCommand: %v", err)
+	}
+	if got := cmd.Env["RELAY_FLOW_AUTO_REJECT"]; got != "true" {
+		t.Fatalf("RELAY_FLOW_AUTO_REJECT = %q, want true", got)
+	}
+}
+
 // TestBuildCommandCarriesTaskSystemEnvironment asserts the task-system
 // workspace environment reaches the runner command so agent task commands
 // address the same workspace as relay-flow, and that relay-flow's own