state-hub/workplans/STATE-WP-0094-routed-gates-and-owner-returns.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	related	state_hub_workstream_id
STATE-WP-0094	workplan	Route human gates and expose actionable owner returns	infotech	state-hub	blocked	codex	infotech	2026-10-03	2026-10-04	implementation	CUST-WP-0075 STATE-WP-0086 RMGR-WP-0005	2c4e96a3-ca0d-5003-b759-880976600ecc

Owner acceptance of Custodian proposal b4825539-1425-4028-a2e9-9243785a344b. Scope is source-level monitoring and diagnosis. No schedules, production rollout, human decision resolution or automatic wait-status transitions are authorized.

Warn on unrouted human waits (P1)

id: STATE-WP-0094-T01
status: done
priority: high
state_hub_task_id: "ddb88e77-06c0-5e88-be29-a40f3869b392"

Extend C-39 for needs_human waits in open non-residual workplans without decision_id. Routed gates, residuals and terminal workplans are excluded.

Detect task-level owner replies (P5)

id: STATE-WP-0094-T02
status: done
priority: high
state_hub_task_id: "0c888d53-3a39-5f8d-a1a9-6f8e6f258bc6"

Extend C-25 to task blocked_on markers. Compare messages, including read replies, against the task's latest dated note; keep stable task/message IDs for deduplication. Undated tasks use unread replies conservatively. This detects work for owners; it does not awaken agents or create duplicate tasks on every checker run.

Integrate deduplicated owner wakeups with the supported runner

id: STATE-WP-0094-T03
status: wait
blocking_reason: "Memo 2 plan-only and submit trials wait for a live owner return; C-25 found zero findings across 13 public repos on 2026-10-04"
priority: medium
state_hub_task_id: "cd73e265-68b0-5dd5-9874-d1d439910a7e"

Select the current owner runner, consume C-25 task/message identities once, record receipts and provide an opt-in activation plan. Reuse the Custodian dependency monitor and established runner; do not introduce another schedule. Production activation remains a separately reviewed founder action.

Correct Forge qualifier receiving in source (P6a)

id: STATE-WP-0094-T04
status: done
priority: high
state_hub_task_id: "cd03399c-a905-5804-9700-e5e763d2500b"

Correct the evidenced immutable Forge receiving omission: task decision_id, blocked_on, wait_until and flavor, and workplan flavor/promotion fields were absent from derivation, serialization, diff and create/update receiving paths. Verify source normalization, refusal of malformed qualifiers before receiving, creation, updates, deliberate null/absent clears and repeat noop against the real API and PostgreSQL test database. This task completes source correctness only; historical CLI report 70d08f35-a008-4b2c-878d-d9f32db892ce remains separate from that evidenced omission. Primary deployment and normal-sync parity remain T05.

Prepare approved receiving promotion and assess graph freshness (P6)

id: STATE-WP-0094-T05
status: wait
blocked_on: message-from:railiance-platform
blocking_reason: "Memo 3 apply trials need a read-only Forgejo token for the Activity Core worker; then memo 4 schedule and 48 h freshness evidence. 2026-10-14: CCR-2026-0034 in railiance-platform is the keycape operator reader (applied), not this token; no Forgejo-read CCR for the Activity Core worker found."
priority: medium
state_hub_task_id: "ec0acd06-0e2f-5b5c-ae8a-6a3241041d4c"

Decline enabling the proposed legacy --all --remote schedule: production values explicitly disable it pending RMGR-WP-0005-T11, and ADR-002 prohibits central reads/writes of workstation checkouts. Confirm current Forge reconciliation coverage, task-level edge support and supported graph freshness schedule before preparing any production change. The receiving promotion was explicitly authorized by the founder on 2026-10-04; freshness scheduling remains separate.

2026-10-04 owner assessment: P1 is implemented in C-39; P5 detection is implemented in C-25, with task/message IDs exposed in JSON. Owner wakeup execution remains T03 and is not represented as delivered by detection alone. Date-only notes acknowledge their full UTC day; undated waits retain unread-only behavior. The inbox query is bounded to 200 replies per awaited agent; a paginated runner must retain stable deduplication and evidence before activation.

P6a reproduction retained: primary snapshot for ops-warden task 33587361-2b8a-5540-9c4f-d7b4f8ef25e0 (WARDEN-WP-0041-T03) has both blocked_on and blocking_reason null while its file carries message-from:railiance-platform and an explicit reason. A read-only current checker run narrowed to that owner plan emits C-41 for both fields. record_id is also null but does not hide the task from UUID-addressed C-41. Installed statehub resolves the same editable checkout and Python interpreter; its API_BASE is the direct checker's default localhost:8000. The earlier CLI PASS therefore is not accepted as convergence evidence. Its causality remains T04; do not call the gap fixed on this evidence.

P6 disposition: decline the requested legacy nightly remote checkout sweep in this form. Production Helm source explicitly disables it pending RMGR-WP-0005-T11; the supported alternative is immutable Forge reconciliation (STATE-WP-0086) and a separately reviewed freshness/wakeup runner under T03/T05. No scheduler, deployment, credential or human decision was changed.

2026-10-04 owner note (source only; T03/T05 remain progress): Forge receiving now derives frontmatter and task-block depends_on edges from the pinned commit and reconciles workplan_dependencies under the source-edge ownership contract in docs/forge-dependency-edge-receiving.md (additive migration b3c4d5e6f7a8: source_owner / source_commit). Only forge:<repo> rows are created or removed; external relations are preserved and reported; missing/ambiguous/self targets are recorded in unresolved_edges and hold the from-side's owned edges; failures roll back; repeat receipts are noop. Real PostgreSQL receiving tests cover this (tests/test_forge_dependency_edges.py). For T03, C-25 reply collection now pages (offset, stable created_at, id ordering on GET /messages/) instead of capping at 200 per counterpart, dedups by message id and emits an explicit incomplete WARN when the hub ignores paging or the page bound is hit (tests/test_c25_message_pagination.py). Remaining: deployment of the migration and receiving change needs separate founder authorization; freshness schedule evidence (runner revision, active definition, per-repository receipts, freshness window) is being handled by the repo-manager/activity-core agents; T03 owner-runner consumption and activation are unchanged. No deployment, Helm, schedule or legacy sweep was touched.

Source validation receipt

2026-10-04 T04 source correction verified: 130 receiving, flavor and wait-kind tests pass in the serial real API/PostgreSQL suite; whitespace check passes. The earlier trial had 127 passing and two failing tests: PyYAML raised ValueError for an impossible bare date before the date validator. The refinement converts both invalid-date and malformed-task-YAML errors into a derivation refusal, preserving existing gates. A review also identified datetime being a date subclass; exact date acceptance plus bare/quoted timestamp regressions now enforce YYYY-MM-DD. These refinements remain one correction trial.

Evidence: Forge qualifier receiving. Origin/origin_ref remain in source because the workplan model has no such fields. No migration, production deployment or schedule was performed. Ruff was absent from the venv and PATH; no lint success is claimed.

T05 stays live: identify the actual deployed receiving revision, prepare a concrete reviewed image/rollout/rollback package, obtain the separate per-change production authorization, then prove primary qualifier/flavor/null-clear parity through normal immutable Forge reconciliation without follow-up field PATCHes. Point-in-time direct C-41 repairs do not supply that receiving proof. Confirm task-level graph edge support and actual supported freshness coverage as well.

T03 stays live: api/services/execution_queue.py rejects new launch requests and has no launch-request pickup consumer. Select the supported owner-agent runner, stable task/message deduplication and receipts through owner interfaces; do not wire C-25 to the retired queue. Current chart sweep is disabled and legacy hostPath fields are rollback-only. Activity Core owns schedules/ops runs, while its runbook routes the C-rule engine to Repo Manager. Older live-sweep prose in docs/activity-core-delegation.md does not establish current runtime coverage.

Historical CLI causality distinction: cmd_fix_consistency forwards the same checker, --fix/path/API/no-writeback arguments and intentionally maps warnings exit 2 to shell success. C-16 can skip writes despite that successful shell exit. This does not isolate every historical CLI/direct-checker discrepancy. The old Forge path omitted new fields on creation and left them untouched on existing rows; it did not explicitly erase already-correct new qualifiers. Source removal now deliberately clears them. Do not call the original CLI report or deployed receiving fixed merely because this bounded source task is done.

2026-10-04 authorized receiving rollout: founder instruction “Do the rollout”. Promoted CI image main-3791e60 (source 3791e608ba) through the owner Helm path with --reuse-values --atomic --timeout 3m. Revision 71 is deployed; API/MCP Ready, schema a0b1c2d3e4f5, tested receiving source digest matches the running container. The image also contains the previously committed additive memo receipt migration; its 20 focused tests passed. No destructive schema downgrade belongs to rollback.

Fresh normal receiving-endpoint derivations at exact immutable owner commits restored STATE-WP-0094 flavor=implementation and cleared absent Warden task blockers, including WARDEN-WP-0041-T03. Independent requests with fresh idempotency keys then returned noop. No task PATCH or direct consistency repair was used for these receiving proofs. Custodian broader exact-commit derivation failed transactionally on a historical ADHOC task UUID collision; its residual cadence task remains wait/human-needed with its original decision gate. The failure is retained, not represented as receiving parity success.

T05 remains progress for actual task-level dependency-edge receiving and scheduled freshness coverage; T03 retains runner selection/dedup/receipts. Neither the legacy remote scheduler nor a recurring provisioning cadence was activated. Evidence: docs/evidence/2026-10-04-receiving-rollout.json.

2026-10-04 T03 source preparation: selected ActivityDefinition → Activity Core ops_run → admitted owner harness as the supported recurring pickup boundary. The offline owner_return_handoff planner derives stable repo/task/message event IDs and correlates existing ops-run pending/terminal receipts; 13 staged tests pass. No dispatch, receipt write, schedule or task transition is performed. An accepted definition/profile/authority and callable owner submission adapter remain required, so T03 is progress, not done. Details and T05 graph freshness assessment: docs/owner-return-handoff.md. Normal Forge receiving still omits dependency edges; C-20 can index them, but runtime freshness coverage and safe source-owned edge reconciliation remain live T05 obligations.

2026-10-04 T03 eligibility review refinement: C-25 can report tasks carrying both owner-return and human gates. Before commit/activation the planner was corrected to require current authoritative task/workplan eligibility, resolved predecessor/decision states and observation date. Human, residual, stale, nonterminal or future gates stop preparation even with prior successful pickup. Missing safety metadata refuses planning. Thirty staged tests pass; the initial 13-test result remains historical preparation evidence, not complete safety coverage. T03/T05 stay progress; no dispatch, schedule or source gate clearing.

2026-10-04 T05 follow-up (claude-state-hub): consistency report-only run at HEAD and with the b2af3c1 checker produced identical findings (27 C-03 FAIL on STATE-WP-0069/0070/0071/0073/0080 stale hub IDs, 11 WARN C-20/C-26/C-28/C-35); none caused by fceb5f2/3b9a5c5. Migration b3c4d5e6f7a8 ran a0b1c2d3e4f5 -> head -> a0b1c2d3e4f5 -> head on a scratch local PostgreSQL database with a pre-existing edge row preserved (owner NULL). c287ed8 adds the dry-run edge preview (create/remove/retain/unresolved/external) through the shared pure planner and fixes duplicate-edge-key collapse in the classifier. Rollout package prepared, not executed, and requires founder per-change authorization: docs/rollout-dependency-edge-receiving.md. No deployment, schedule or production write. T03/T05 status unchanged.

2026-10-04 founder-approval batch prepared (not posted): informed-decision docs/batches/2026-10-04-state-hub-wp0094 (commit bb61984), four one-question memos under pending hub decision 7b19de6c-72a1-409e-89a9-ec3ac09c03fd: (1) deploy c287ed8 receiving/pagination, (2) owner-return pickup plan and gated single-repo trial, (3) RMGR-WP-0020 runner deploy and limited trials, (4) bounded freshness schedule and legacy sweep retirement. Live State Hub is Helm revision 72, main-5dd3df9. Open T03 source gaps before any trial: C-25 must report the scanned commit, and the pickup caller is not yet wired into the existing runner. Activity Core b2c6c56 aligns its freshness projection with the runner's results[] output. T03/T05 remain progress.

2026-10-04 T03 source gap closed (claude-state-hub): the checker JSON now carries per-repository repo_slug, source_revision (full 40-hex HEAD SHA, or null) and source_revision_reason; C-25 findings repeat them. A dirty workplans/ tree, a non-git path or a tree that moves mid-scan yields null with a reason, never HEAD or a branch. plan_owner_returns passes the revision into each candidate. Matches Activity Core build_current_tasks (repo_slug, source_revision). See docs/owner-return-handoff.md. Pickup caller wiring remains open; T03/T05 remain progress.

2026-10-04 memo 1 executed (founder accepted 13:15:51Z, approval 974eae4d): State Hub Helm revision 73, image main-fad9b3f (sha256:a1decd9e…; runtime source equals c287ed8). Schema b3c4d5e6f7a8; 559 pre-existing dependency rows stay unowned. Normal immutable receive of state-hub at 150cb0b applied 3 source-owned edges with 3 external edges preserved; identical repeat returned noop. Evidence: docs/evidence/2026-10-04-edge-receiving-rollout.json. T05 edge receiving is now deployed; T05 stays progress for scheduled freshness evidence (memos 3 and 4). All four memos were accepted; memo 4 waits on clean memo 3 trials.

2026-10-04 session close: workplan set to blocked. Delivered and deployed: State Hub revision 73 (edge receiving, paginated C-25), C-25 scanned-commit binding (150cb0b, workstation checker), informed-decision v10 admission with all four memos accepted by the founder, and the Activity Core worker on git-34d1dc5 (Argo a86a143) carrying owner_return_pickup and repo_manager_freshness, both definitions disabled. T03 waits for the first live owner return: C-25 reported zero findings across 13 public repos at their Forge HEADs. T05 waits for the Forgejo read token (draft lane railiance-platform docs/credential-lane-designs/activity-core-repo-manager-forgejo-read.md), then memo 3 apply trials, memo 4 schedule and measured freshness. Hub decision 7b19de6c stays open until those steps complete.

2026-10-13 CLI C-41 report 70d08f35 re-check: a read-only checker run for hall-of-helix from ~/state-hub and from ~/hall-of-helix (same interpreter and checker) gives identical results (C-40 only, no C-41). The CLI forwards --repo unchanged, and the checker has no cwd-dependent skip path for task checks. No live drift remains to reproduce against, so the report is not confirmed and no regression test was added. Reproducing it needs a seeded wait-qualifier drift run through statehub fix-consistency.