code-coordinator 0.5.561__tar.gz → 0.5.563__tar.gz

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.561
+Version: 0.5.563
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.561
+Version: 0.5.563
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.561",
+  "tag": "0.5.563",
   "distance": 0,
-  "node": "g719f616d563fc6b94375e7381da2f4b6bc6c833d",
+  "node": "gd370d95cd8b305a54b4761f01ee5c006b5fa5099",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-02"

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/coord/acceptance.py

@@ -877,6 +877,66 @@ def oracle_loop_contract_block(
     if ms_dir is None:
         return ""
 
+    return _render_oracle_contract_block(
+        repo_name, issue_number, ms_dir, acceptance_dirname, exempt=exempt,
+    )
+
+
+def oracle_loop_contract_block_for_slice(
+    repo_name: str,
+    issue_number: int,
+    *,
+    has_slice: bool,
+    exempt: bool,
+    ms_dir: str,
+    acceptance_dirname: str = ACCEPTANCE_DIRNAME,
+) -> str:
+    """(#2166) The exact same worker-briefing contract text
+    :func:`oracle_loop_contract_block` renders, but driven by an already-
+    resolved verdict (*has_slice*/*exempt*/*ms_dir*/*acceptance_dirname*)
+    instead of scanning a local checkout for one.
+
+    Exists so :func:`coord.dispatch.dispatch` can build the briefing block
+    from the EXACT SAME read :func:`coord.milestone_dispatch.
+    issue_oracle_ready` already did for the #1138 hard gate (default
+    branch, over ``gh``, one memoised fetch seam) rather than a second,
+    independent local-checkout scan that can silently disagree with it —
+    the #2166 split-brain: a dispatching host whose base checkout lagged
+    the default branch by a few commits had this (the old
+    ``oracle_loop_contract_block(Path, ...)`` call) come back ``""`` while
+    the gate, reading the default branch directly, had already let the
+    issue through — so the worker got dispatched with no oracle contract
+    at all, silently.
+
+    Returns ``""`` when *ms_dir* is empty (the gate never resolved a
+    milestone for this issue — ``OracleReadiness.applies`` was ``False``)
+    or neither *has_slice* nor *exempt* is set (no contract to point at
+    yet). Callers that have a full ``OracleReadiness`` in hand should pass
+    its ``has_slice``/``exempt``/``ms_dir``/``acceptance_dirname`` fields
+    straight through.
+    """
+    if not ms_dir or not (has_slice or exempt):
+        return ""
+    return _render_oracle_contract_block(
+        repo_name, issue_number, ms_dir, acceptance_dirname, exempt=exempt,
+    )
+
+
+def _render_oracle_contract_block(
+    repo_name: str,
+    issue_number: int,
+    ms_dir: str,
+    acceptance_dirname: str,
+    *,
+    exempt: bool,
+) -> str:
+    """Shared template for :func:`oracle_loop_contract_block` (local-
+    checkout scan) and :func:`oracle_loop_contract_block_for_slice`
+    (gate-verdict-driven, #2166) — ONE rendering so the text a worker sees
+    can never drift between the two slice-presence sources, even though
+    which SOURCE decided "there is a slice" differs between the two
+    callers.
+    """
     dirname = acceptance_dirname.rstrip("/") if acceptance_dirname else ACCEPTANCE_DIRNAME
     contract_path = f"{dirname}/{ms_dir}/contract.md"
     mocks_dir = f"{dirname}/{ms_dir}/mocks"

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/coord/db.py

@@ -1087,7 +1087,27 @@ def retry_on_locked(
 # knows the table exists: `_ensure_archive_mirror` itself, unconditionally
 # and idempotently (`CREATE INDEX IF NOT EXISTS`) on every housekeeping
 # sweep — see that function's own comment in coord/housekeeping.py.
-_DB_SCHEMA_VERSION = 21
+#
+# #2468: bumped 21 -> 22 for the new `review_post_claims` TABLE above (not a
+# column — same shape as #3113/#3333's table-only bumps: `_migrate_add_
+# columns` below is unchanged, `CREATE TABLE IF NOT EXISTS` in `_SCHEMA_SQL`
+# is what actually creates it on an existing database). `_try_parse_and_
+# post_review` (the live completion path) and `post_orphaned_review_findings`
+# (the orphan sweep) both query "done reviews with `review_posted_at IS
+# NULL`" and only set `review_posted_at` AFTER successfully posting to
+# GitHub — two coordinator passes racing each other (one on the live path,
+# one on the orphan sweep, or two concurrent `coord notify` invocations) can
+# both see NULL and both post, producing the byte-identical duplicate-comment
+# incident on #2288 round 4 this closes. `coord.state.claim_review_post`
+# does the same conditional `INSERT ... OR IGNORE` + `rowcount` check
+# `claim_review_dispatch` already does for *dispatching* a review; the loser
+# of THIS claim skips *posting* it instead. Released
+# (`coord.state.release_review_post_claim`) only when the post attempt
+# itself fails, so a legitimate retry of a transient `gh`/GitHub failure
+# isn't permanently stranded — a successful post leaves the claim in place
+# forever, which is harmless since `review_posted_at` being set already
+# excludes the row from both callers' candidate queries.
+_DB_SCHEMA_VERSION = 22
 
 
 def _read_schema_version(conn: sqlite3.Connection) -> int:
@@ -1981,6 +2001,32 @@ _SCHEMA_SQL = """
             PRIMARY KEY (work_assignment_id, capability_partition)
         );
 
+        -- #2468: atomic review-POSTING claim — a sibling to `review_claims`
+        -- above, but for the act of posting a review's findings to GitHub
+        -- rather than dispatching the review worker. `_try_parse_and_post_
+        -- review` (the live completion path, in `coord.notify`) and
+        -- `post_orphaned_review_findings` (the orphan sweep, same module)
+        -- both query "done review assignments with `review_posted_at IS
+        -- NULL`" as their candidate set and only set `review_posted_at`
+        -- AFTER the GitHub post succeeds — a classic check-then-act gap.
+        -- Two coordinator passes racing each other (the #2468 incident: the
+        -- identical "Review Complete" comment posted twice, 4 seconds apart,
+        -- on #2288's round-4 review) each saw `review_posted_at IS NULL`
+        -- and both posted. `coord.state.claim_review_post` does a
+        -- conditional `INSERT ... OR IGNORE` keyed on `assignment_id` and
+        -- checks `rowcount` to learn atomically whether THIS call gets to
+        -- post; the loser skips instead of also posting a duplicate
+        -- comment. Released (`coord.state.release_review_post_claim`) only
+        -- when the post attempt itself fails, so a transient GitHub/`gh`
+        -- failure doesn't permanently strand the row unposted — a
+        -- successful post never releases the claim, which is harmless
+        -- because `review_posted_at` being set already excludes the row
+        -- from both callers' candidate queries from then on.
+        CREATE TABLE IF NOT EXISTS review_post_claims (
+            assignment_id TEXT    PRIMARY KEY,
+            claimed_at    REAL    NOT NULL
+        );
+
         CREATE INDEX IF NOT EXISTS idx_assignments_status ON assignments(status);
         CREATE INDEX IF NOT EXISTS idx_assignments_machine ON assignments(machine_name);
         -- #3470: the `issue-cost` report's full-history scan groups every

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/coord/dispatch.py

@@ -12,6 +12,8 @@ import httpx
 if TYPE_CHECKING:
     from datetime import datetime
 
+    from coord.milestone_dispatch import OracleReadiness
+
 from coord import github_ops
 from coord.comments import (
     format_advisory,
@@ -112,7 +114,7 @@ class DispatchRefused(ValueError):
 
 def enforce_oracle_readiness(
     *, proposal_type: str, repo: Repo | None, config: Config, issue_number: int,
-) -> None:
+) -> "OracleReadiness | None":
     """#1138: hard-gate a ``type="work"`` dispatch on the issue-level oracle
     gate (:func:`coord.milestone_dispatch.issue_oracle_ready`) — refuses an
     issue that belongs to an oracle-opted-in milestone (Gate A already
@@ -147,11 +149,23 @@ def enforce_oracle_readiness(
     hard stop would turn a GitHub hiccup into a fleet-wide outage for every
     oracle-configured repo, which is a worse failure mode than the gap
     #1138 closes.
+
+    Returns the :class:`coord.milestone_dispatch.OracleReadiness` verdict
+    it computed (``None`` for every cheap-no-op / fail-open case above) —
+    (#2166) so ``dispatch()`` can build the worker-briefing oracle-loop
+    contract block from THIS SAME verdict instead of re-deriving "does a
+    slice exist" via a second, independent read. Before this, the gate
+    read the default branch over ``gh`` while the briefing separately
+    scanned the dispatching host's local base checkout for a manifest —
+    two sources that silently disagreed whenever that checkout lagged
+    (#2166's split-brain). One call, reused for both the pass/fail
+    decision and the text the worker sees, makes that disagreement
+    structurally impossible rather than merely rare.
     """
     if proposal_type != "work" or repo is None:
-        return
+        return None
     if not config.acceptance.has_driver(repo.name):
-        return
+        return None
 
     from coord import github_ops  # noqa: PLC0415
     from coord.milestone_dispatch import issue_oracle_ready  # noqa: PLC0415
@@ -159,7 +173,7 @@ def enforce_oracle_readiness(
     try:
         issue_data = github_ops.get_issue(repo.github, issue_number)
     except RuntimeError:
-        return
+        return None
 
     milestone_number = (issue_data.get("milestone") or {}).get("number")
     issue_labels = [lbl.get("name", "") for lbl in (issue_data.get("labels") or [])]
@@ -169,6 +183,7 @@ def enforce_oracle_readiness(
     )
     if readiness.reason is not None:
         raise DispatchRefused(readiness.reason)
+    return readiness
 
 
 def enforce_epic_dispatch_guard(
@@ -784,7 +799,11 @@ def dispatch(
     # a driver kind this install doesn't implement. Placed early / before
     # the TOS gate below so a refusal never depends on provider resolution
     # succeeding first.
-    enforce_oracle_readiness(
+    #
+    # #2166: the returned verdict is reused below to build the worker-
+    # briefing oracle-loop contract block — the SAME read this gate just
+    # used, not a second independent one — so the two can never disagree.
+    oracle_readiness = enforce_oracle_readiness(
         proposal_type=proposal.type, repo=repo, config=config,
         issue_number=proposal.issue_number,
     )
@@ -994,44 +1013,64 @@ def dispatch(
     # a milestone-level flag, so "driver configured for this repo" is the
     # signal, mirroring the tests/acceptance/ auto-seal above) AND this issue
     # already has an authored slice, OR (#3212) is exempted from one —
-    # oracle_loop_contract_block covers both and returns "" only when neither
-    # applies (e.g. before Gate A/#931 has run for it at all). An exemption
-    # waives the automated gate, not the design contract the milestone's
-    # mocks define, so the worker still needs the pointer — see
-    # oracle_loop_contract_block's docstring for the exempted-issue variant.
+    # oracle_loop_contract_block_for_slice covers both and returns "" only
+    # when neither applies (e.g. before Gate A/#931 has run for it at all).
+    # An exemption waives the automated gate, not the design contract the
+    # milestone's mocks define, so the worker still needs the pointer — see
+    # oracle_loop_contract_block_for_slice's docstring for the exempted-issue
+    # variant.
+    #
+    # #2166: this used to re-derive "does a slice exist" by scanning the
+    # dispatching HOST's local base checkout (`repo_root / search_root`) —
+    # a second, independent read from the #1138 gate above, which reads the
+    # default branch over `gh`. A stale base checkout (nothing refreshes it
+    # automatically — see docs/ORACLE_LOOP.md) made the two disagree: the
+    # gate let a dispatch through because the slice existed on the default
+    # branch, while this scan came back `""` because the local clone hadn't
+    # pulled it yet, silently sending the worker with no oracle contract at
+    # all. Now this builds the block from `oracle_readiness` — the EXACT
+    # verdict the gate above already computed — so there is only one read
+    # and the two can never diverge again.
     briefing_text = proposal.briefing
     if proposal.type == "work" and proposal.issue_number:
-        from pathlib import Path  # noqa: PLC0415
-
         from coord.state import issue_context_block  # noqa: PLC0415
 
         oracle_contract = ""
         if config.acceptance.has_driver(proposal.repo_name):
-            from coord.acceptance import oracle_loop_contract_block  # noqa: PLC0415
-
-            # #2896: the issue's slice may live under the shared repo-root
-            # tree (a directory-discovered driver, e.g. ms-37's cli-pytest
-            # suite) OR under an entrypoint-linked driver's own sibling
-            # `acceptance/` dir (e.g. ms-65's tui-tuidriver suite, relocated
-            # out of the repo root) — this dispatch call has no single path
-            # in hand to pick a route ahead of time (proposal.issue_number
-            # alone doesn't say which), so it tries every search root this
-            # repo declares and uses whichever one actually has the slice.
-            # A local checkout scan (no `gh`), so trying more than one root
-            # costs nothing but a stat/read against a directory that
-            # usually doesn't exist.
-            repo_root = Path(repo_path).expanduser()
-            for search_root in config.acceptance.acceptance_search_roots(
-                proposal.repo_name
-            ):
-                oracle_contract = oracle_loop_contract_block(
-                    repo_root / search_root,
+            from coord.acceptance import (  # noqa: PLC0415
+                oracle_loop_contract_block_for_slice,
+            )
+
+            if oracle_readiness is not None and oracle_readiness.applies:
+                oracle_contract = oracle_loop_contract_block_for_slice(
                     proposal.repo_name,
                     proposal.issue_number,
-                    acceptance_dirname=search_root,
+                    has_slice=oracle_readiness.has_slice,
+                    exempt=oracle_readiness.exempt,
+                    ms_dir=oracle_readiness.ms_dir,
+                    acceptance_dirname=oracle_readiness.acceptance_dirname,
                 )
-                if oracle_contract:
-                    break
+                # #2166 acceptance criterion: a gate must be able to fail,
+                # and unconfirmed success is a defect — if the gate's own
+                # verdict says there's a slice (or an exemption) to point
+                # at, rendering the block must not silently come back
+                # empty. That combination can only mean a bug in the
+                # renderer above, not "no slice yet" (which `applies`/
+                # `has_slice`/`exempt` already ruled out) — refuse loudly
+                # rather than dispatch a worker with a hollow briefing.
+                if (
+                    oracle_readiness.has_slice or oracle_readiness.exempt
+                ) and not oracle_contract:
+                    raise DispatchRefused(
+                        f"#2166: internal inconsistency building the "
+                        f"oracle-loop briefing for {proposal.repo_name}#"
+                        f"{proposal.issue_number} — the gate found a "
+                        "slice/exemption (ms_dir="
+                        f"{oracle_readiness.ms_dir!r}) but rendering the "
+                        "contract block came back empty. Refusing rather "
+                        "than dispatching a worker with no oracle "
+                        "contract."
+                    )
 
         # #1720: dispatch-time file-overlap fence — the union of file
         # footprints of every OTHER currently-running work-like assignment

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/coord/milestone_dispatch.py

@@ -433,6 +433,7 @@ def _fetch_manifest_data(
     *,
     issue_number: int | None = None,
     roots: Iterable[str] | None = None,
+    root_out: "list[str] | None" = None,
 ):
     """*milestone_number*'s manifest data via *fetch* (a raw-content GitHub
     fetch, no local checkout, no directory listing) — the legacy single-file
@@ -468,6 +469,16 @@ def _fetch_manifest_data(
     unchanged from before #2896. Tries each root until one actually has a
     legacy manifest and/or fragment file; a milestone's data lives under
     exactly one, so the first root that produces anything wins.
+
+    *root_out* (#2166), when given, has the matched root dir appended —
+    the SAME root this data actually came from — so a caller rendering the
+    worker-briefing contract block (which needs to name a repo-relative
+    dirname in the text, e.g. ``tests/acceptance/ms-37/contract.md``) can
+    do so without a second, independent search. Appends the first
+    candidate root (or the legacy single-root default) when nothing
+    matched, mirroring the fall-through return below — there is no "right"
+    root to name for a slice that doesn't exist, so the caller must check
+    ``has_slice``/``exempt`` before trusting this for message text.
     """
     from coord import github_ops  # noqa: PLC0415
     from coord.acceptance import (  # noqa: PLC0415
@@ -511,6 +522,8 @@ def _fetch_manifest_data(
         legacy, legacy_found = _fetch_one(f"{root_dir}/{ms_dir}", "manifest")
         if issue_number is None:
             if legacy_found:
+                if root_out is not None:
+                    root_out.append(root_dir)
                 return legacy
             continue
         fragment, fragment_found = _fetch_one(
@@ -518,10 +531,14 @@ def _fetch_manifest_data(
             str(issue_number),
         )
         if legacy_found or fragment_found:
+            if root_out is not None:
+                root_out.append(root_dir)
             return merge_manifest_data(legacy, fragment)
 
     # No root produced anything — degrade to empty data, same as the old
     # single-root "not found" behaviour.
+    if root_out is not None:
+        root_out.append(search_roots[0])
     return legacy if issue_number is None else merge_manifest_data(legacy, fragment)
 
 
@@ -714,6 +731,19 @@ class OracleReadiness:
     #: gate doesn't apply. ``"approved"``/``"exempt"`` are the only values
     #: that let ``reason`` be ``None``.
     gate_a_state: str = ""
+    #: (#2166) The milestone this readiness verdict was computed against,
+    #: and the ``ms-NN`` directory name / repo-relative acceptance-root
+    #: dirname the slice (or exemption) it found actually lives under —
+    #: set whenever ``applies`` is ``True``. Exists so a caller that needs
+    #: to RENDER the worker-briefing contract block
+    #: (:func:`coord.acceptance.oracle_loop_contract_block_for_slice`) can
+    #: do so from THIS SAME verdict instead of re-deriving "does a slice
+    #: exist" from a second, independent read (previously a scan of the
+    #: dispatching host's local checkout, #2166's split-brain) — one
+    #: fetch, one source of truth, per #2096 "one question, one answer".
+    milestone_number: int | None = None
+    ms_dir: str = ""
+    acceptance_dirname: str = ""
 
 
 def _gate_a_exempt_trade_off_note(
@@ -857,14 +887,27 @@ def issue_oracle_ready(
     from coord.acceptance import test_ids_for_issue  # noqa: PLC0415
     from coord.acceptance_drivers import SUPPORTED_KINDS  # noqa: PLC0415
 
+    # #2166: capture WHICH search root this issue's manifest data actually
+    # came from, so the verdict below can carry enough to let a caller
+    # render the worker-briefing contract block from THIS read — the same
+    # `gh`-fetched-from-the-default-branch source the gate itself just
+    # used — instead of a second, independent local-checkout scan that can
+    # silently disagree with it (the #2166 split-brain).
+    matched_roots: list[str] = []
     manifest = _fetch_manifest_data(
         repo_cfg.github, milestone_number, repo_cfg.default_branch, fetch,
         issue_number=issue_number,
         roots=config.acceptance.acceptance_search_roots(repo_cfg.name),
+        root_out=matched_roots,
     )
     has_slice = bool(test_ids_for_issue(manifest.tests, issue_number))
     exempt = issue_number in manifest.exempt or "oracle:exempt" in set(issue_labels)
 
+    from coord.acceptance import ACCEPTANCE_DIRNAME, ms_dirname  # noqa: PLC0415
+
+    ms_dir = ms_dirname(milestone_number)
+    acceptance_dirname = matched_roots[0] if matched_roots else ACCEPTANCE_DIRNAME
+
     entry = config.acceptance.drivers.get(repo_cfg.name)
     unsupported = _unsupported_driver_kinds(entry) if entry is not None else ()
 
@@ -887,13 +930,16 @@ def issue_oracle_ready(
         return OracleReadiness(
             applies=True, exempt=exempt, has_slice=has_slice,
             unsupported_kinds=unsupported, reason=signoff.reason,
-            gate_a_state=signoff.state,
+            gate_a_state=signoff.state, milestone_number=milestone_number,
+            ms_dir=ms_dir, acceptance_dirname=acceptance_dirname,
         )
 
     if exempt:
         return OracleReadiness(
             applies=True, exempt=True, has_slice=has_slice,
             unsupported_kinds=unsupported, gate_a_state=signoff.state,
+            milestone_number=milestone_number, ms_dir=ms_dir,
+            acceptance_dirname=acceptance_dirname,
         )
 
     reason: str | None = None
@@ -920,7 +966,8 @@ def issue_oracle_ready(
     return OracleReadiness(
         applies=True, exempt=False, has_slice=has_slice,
         unsupported_kinds=unsupported, reason=reason,
-        gate_a_state=signoff.state,
+        gate_a_state=signoff.state, milestone_number=milestone_number,
+        ms_dir=ms_dir, acceptance_dirname=acceptance_dirname,
     )
 
 

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/coord/notify.py

@@ -72,12 +72,14 @@ from coord.smoke import (
     smoke_leg_capabilities,
 )
 from coord.state import (
+    claim_review_post,
     load_dispatched,
     load_done_reviews_needing_post,
     load_liveness_audit_state,
     load_notified,
     mark_notified,
     mark_review_posted,
+    release_review_post_claim,
     save_liveness_audit_state,
     save_plan,
 )
@@ -3585,6 +3587,25 @@ def _try_parse_and_post_review(
         transition.assignment_id, findings.verdict, findings.body
     )
 
+    # #2468: claim the right to POST this review's findings before actually
+    # posting them. `post_orphaned_review_findings` (the orphan sweep) reads
+    # the identical "done review, review_posted_at IS NULL" candidate set
+    # this function is reacting to, and used to race it: both callers could
+    # see NULL and both post the byte-identical comment (the #2288 round-4
+    # incident this closes). Losing the claim means another caller is
+    # posting — or has already posted — these exact findings, so this call
+    # must NOT fall through to the "could not post" fallback comment below;
+    # return True (handled) rather than False (which the caller would read
+    # as a parse failure and post yet another, differently-worded, comment).
+    if not claim_review_post(transition.assignment_id):
+        log.info(
+            "#2468: lost the review-post claim for %s — another caller is "
+            "posting (or already posted) these findings; skipping to avoid "
+            "a duplicate GitHub comment",
+            transition.assignment_id,
+        )
+        return True
+
     review_target = record.get("review_target")
     repo_github = record["repo_github"]
 
@@ -3648,6 +3669,11 @@ def _try_parse_and_post_review(
         log.warning(
             "Failed to post review comment for %s: %s", transition.assignment_id, exc
         )
+        # #2468: both post attempts (gh pr review, then this issue-comment
+        # fallback) failed — release the claim so a later retry (another
+        # `coord notify` pass, or `post_orphaned_review_findings`) isn't
+        # permanently blocked from posting these findings at all.
+        release_review_post_claim(transition.assignment_id)
         return False
 
 
@@ -4546,6 +4572,24 @@ def post_orphaned_review_findings(
             # per-stage display can skip the HTTP fetch on later runs.
             _persist_review_findings(aid, findings.verdict, findings.body)
 
+            # #2468: claim the right to POST before actually posting —
+            # `_try_parse_and_post_review` (the live completion path, run
+            # from `detect_transitions` earlier in the same drain, or from a
+            # concurrent `coord notify` process) reads the identical
+            # "review_posted_at IS NULL" candidate set this sweep queried via
+            # `load_done_reviews_needing_post`. Losing the claim means that
+            # other caller is posting — or has already posted — these exact
+            # findings; skip entirely rather than writing a second,
+            # byte-identical GitHub comment (the #2288 round-4 incident).
+            if not claim_review_post(aid):
+                log.info(
+                    "post_orphaned: lost the review-post claim for %s — "
+                    "another caller is posting (or already posted) these "
+                    "findings; skipping",
+                    aid,
+                )
+                continue
+
             review_target = row.get("review_target")
             repo_github = row.get("repo_github") or ""
             issue_number = row.get("issue_number", 0)
@@ -4617,6 +4661,12 @@ def post_orphaned_review_findings(
                     mark_notified(aid, EVENT_COMPLETION)
                 posted_ids.append(aid)
                 log.info("post_orphaned: posted findings for review %s", aid)
+            else:
+                # #2468: both post attempts failed — release the claim so a
+                # later retry (the next drain's orphan sweep, or the live
+                # path) isn't permanently blocked from posting these
+                # findings at all.
+                release_review_post_claim(aid)
 
     return posted_ids
 

{code_coordinator-0.5.561 → code_coordinator-0.5.563}/coord/serve_app.py

@@ -4175,6 +4175,67 @@ def openapi_spec() -> dict:
                 },
             }
         },
+        "/review-post-claim": {
+            "post": {
+                "summary": (
+                    "Atomically claim the right to POST a review's findings "
+                    "to GitHub (#2468) — a conditional insert so the live "
+                    "completion path and the orphan sweep can never both "
+                    "post the identical comment"
+                ),
+                "requestBody": {
+                    "required": True,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "assignment_id": {"type": "string"},
+                                },
+                                "required": ["assignment_id"],
+                            }
+                        }
+                    },
+                },
+                "responses": {
+                    "200": {
+                        "description": "OK — `claimed` is true iff this call won",
+                        "content": {"application/json": {"schema": ok_response}},
+                    },
+                    "400": {"description": "Missing assignment_id"},
+                },
+            }
+        },
+        "/review-post-claim-release": {
+            "post": {
+                "summary": (
+                    "Release a claim taken via /review-post-claim (#2468), "
+                    "ONLY when the post attempt itself failed, so a "
+                    "legitimate retry isn't permanently stranded"
+                ),
+                "requestBody": {
+                    "required": True,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "assignment_id": {"type": "string"},
+                                },
+                                "required": ["assignment_id"],
+                            }
+                        }
+                    },
+                },
+                "responses": {
+                    "200": {
+                        "description": "OK — idempotent, absent claim is a no-op",
+                        "content": {"application/json": {"schema": ok_response}},
+                    },
+                    "400": {"description": "Missing assignment_id"},
+                },
+            }
+        },
         "/smoke-claim": {
             "post": {
                 "summary": (
@@ -8408,6 +8469,44 @@ def build_app(
             )
         return JSONResponse({"ok": True})
 
+    async def post_review_post_claim(request: Request) -> Response:
+        # #2468: atomic review-POSTING claim on the daemon's canonical DB —
+        # see coord.state.claim_review_post's docstring for the duplicate-
+        # comment race this closes.
+        from coord import state  # noqa: PLC0415
+
+        body = await _read_json(request)
+        if body is None:
+            return JSONResponse({"error": "invalid JSON body"}, status_code=400)
+        try:
+            claimed = state._claim_review_post_local(body["assignment_id"])
+        except KeyError as e:
+            return JSONResponse({"error": f"missing field: {e}"}, status_code=400)
+        except Exception as e:  # noqa: BLE001
+            return JSONResponse(
+                {"error": "review-post-claim write failed", "detail": str(e)},
+                status_code=503,
+            )
+        return JSONResponse({"ok": True, "claimed": claimed})
+
+    async def post_review_post_claim_release(request: Request) -> Response:
+        # #2468: release a claim taken via post_review_post_claim above.
+        from coord import state  # noqa: PLC0415
+
+        body = await _read_json(request)
+        if body is None:
+            return JSONResponse({"error": "invalid JSON body"}, status_code=400)
+        try:
+            state._release_review_post_claim_local(body["assignment_id"])
+        except KeyError as e:
+            return JSONResponse({"error": f"missing field: {e}"}, status_code=400)
+        except Exception as e:  # noqa: BLE001
+            return JSONResponse(
+                {"error": "review-post-claim-release write failed", "detail": str(e)},
+                status_code=503,
+            )
+        return JSONResponse({"ok": True})
+
     async def post_smoke_claim(request: Request) -> Response:
         # #3333: atomic smoke fan-out dispatch claim on the daemon's
         # canonical DB — see coord.state.claim_smoke_dispatch's docstring
@@ -12003,6 +12102,11 @@ def build_app(
         Route("/review-findings", post_review_findings, methods=["POST"]),
         Route("/review-claim", post_review_claim, methods=["POST"]),
         Route("/review-claim-release", post_review_claim_release, methods=["POST"]),
+        Route("/review-post-claim", post_review_post_claim, methods=["POST"]),
+        Route(
+            "/review-post-claim-release", post_review_post_claim_release,
+            methods=["POST"],
+        ),
         Route("/smoke-claim", post_smoke_claim, methods=["POST"]),
         Route("/smoke-claim-release", post_smoke_claim_release, methods=["POST"]),
         Route("/smoke-fanout-merge", post_smoke_fanout_merge, methods=["POST"]),