state-hub/workplans/STATE-WP-0094-routed-gates-and-owner-returns.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	related	state_hub_workstream_id
STATE-WP-0094	workplan	Route human gates and expose actionable owner returns	infotech	state-hub	active	codex	infotech	2026-10-03	2026-10-04	implementation	CUST-WP-0075 STATE-WP-0086 RMGR-WP-0005	2c4e96a3-ca0d-5003-b759-880976600ecc

Owner acceptance of Custodian proposal b4825539-1425-4028-a2e9-9243785a344b. Scope is source-level monitoring and diagnosis. No schedules, production rollout, human decision resolution or automatic wait-status transitions are authorized.

Warn on unrouted human waits (P1)

id: STATE-WP-0094-T01
status: done
priority: high
state_hub_task_id: "ddb88e77-06c0-5e88-be29-a40f3869b392"

Extend C-39 for needs_human waits in open non-residual workplans without decision_id. Routed gates, residuals and terminal workplans are excluded.

Detect task-level owner replies (P5)

id: STATE-WP-0094-T02
status: done
priority: high
state_hub_task_id: "0c888d53-3a39-5f8d-a1a9-6f8e6f258bc6"

Extend C-25 to task blocked_on markers. Compare messages, including read replies, against the task's latest dated note; keep stable task/message IDs for deduplication. Undated tasks use unread replies conservatively. This detects work for owners; it does not awaken agents or create duplicate tasks on every checker run.

Integrate deduplicated owner wakeups with the supported runner

id: STATE-WP-0094-T03
status: progress
priority: medium
state_hub_task_id: "cd73e265-68b0-5dd5-9874-d1d439910a7e"

Select the current owner runner, consume C-25 task/message identities once, record receipts and provide an opt-in activation plan. Reuse the Custodian dependency monitor and established runner; do not introduce another schedule. Production activation remains a separately reviewed founder action.

Correct Forge qualifier receiving in source (P6a)

id: STATE-WP-0094-T04
status: done
priority: high
state_hub_task_id: "cd03399c-a905-5804-9700-e5e763d2500b"

Correct the evidenced immutable Forge receiving omission: task decision_id, blocked_on, wait_until and flavor, and workplan flavor/promotion fields were absent from derivation, serialization, diff and create/update receiving paths. Verify source normalization, refusal of malformed qualifiers before receiving, creation, updates, deliberate null/absent clears and repeat noop against the real API and PostgreSQL test database. This task completes source correctness only; historical CLI report 70d08f35-a008-4b2c-878d-d9f32db892ce remains separate from that evidenced omission. Primary deployment and normal-sync parity remain T05.

Prepare approved receiving promotion and assess graph freshness (P6)

id: STATE-WP-0094-T05
status: progress
priority: medium
state_hub_task_id: "ec0acd06-0e2f-5b5c-ae8a-6a3241041d4c"

Decline enabling the proposed legacy --all --remote schedule: production values explicitly disable it pending RMGR-WP-0005-T11, and ADR-002 prohibits central reads/writes of workstation checkouts. Confirm current Forge reconciliation coverage, task-level edge support and supported graph freshness schedule before preparing any production change. The receiving promotion was explicitly authorized by the founder on 2026-10-04; freshness scheduling remains separate.

2026-10-04 owner assessment: P1 is implemented in C-39; P5 detection is implemented in C-25, with task/message IDs exposed in JSON. Owner wakeup execution remains T03 and is not represented as delivered by detection alone. Date-only notes acknowledge their full UTC day; undated waits retain unread-only behavior. The inbox query is bounded to 200 replies per awaited agent; a paginated runner must retain stable deduplication and evidence before activation.

P6a reproduction retained: primary snapshot for ops-warden task 33587361-2b8a-5540-9c4f-d7b4f8ef25e0 (WARDEN-WP-0041-T03) has both blocked_on and blocking_reason null while its file carries message-from:railiance-platform and an explicit reason. A read-only current checker run narrowed to that owner plan emits C-41 for both fields. record_id is also null but does not hide the task from UUID-addressed C-41. Installed statehub resolves the same editable checkout and Python interpreter; its API_BASE is the direct checker's default localhost:8000. The earlier CLI PASS therefore is not accepted as convergence evidence. Its causality remains T04; do not call the gap fixed on this evidence.

P6 disposition: decline the requested legacy nightly remote checkout sweep in this form. Production Helm source explicitly disables it pending RMGR-WP-0005-T11; the supported alternative is immutable Forge reconciliation (STATE-WP-0086) and a separately reviewed freshness/wakeup runner under T03/T05. No scheduler, deployment, credential or human decision was changed.

2026-10-04 owner note (source only; T03/T05 remain progress): Forge receiving now derives frontmatter and task-block depends_on edges from the pinned commit and reconciles workplan_dependencies under the source-edge ownership contract in docs/forge-dependency-edge-receiving.md (additive migration b3c4d5e6f7a8: source_owner / source_commit). Only forge:<repo> rows are created or removed; external relations are preserved and reported; missing/ambiguous/self targets are recorded in unresolved_edges and hold the from-side's owned edges; failures roll back; repeat receipts are noop. Real PostgreSQL receiving tests cover this (tests/test_forge_dependency_edges.py). For T03, C-25 reply collection now pages (offset, stable created_at, id ordering on GET /messages/) instead of capping at 200 per counterpart, dedups by message id and emits an explicit incomplete WARN when the hub ignores paging or the page bound is hit (tests/test_c25_message_pagination.py). Remaining: deployment of the migration and receiving change needs separate founder authorization; freshness schedule evidence (runner revision, active definition, per-repository receipts, freshness window) is being handled by the repo-manager/activity-core agents; T03 owner-runner consumption and activation are unchanged. No deployment, Helm, schedule or legacy sweep was touched.

Source validation receipt

2026-10-04 T04 source correction verified: 130 receiving, flavor and wait-kind tests pass in the serial real API/PostgreSQL suite; whitespace check passes. The earlier trial had 127 passing and two failing tests: PyYAML raised ValueError for an impossible bare date before the date validator. The refinement converts both invalid-date and malformed-task-YAML errors into a derivation refusal, preserving existing gates. A review also identified datetime being a date subclass; exact date acceptance plus bare/quoted timestamp regressions now enforce YYYY-MM-DD. These refinements remain one correction trial.

Evidence: Forge qualifier receiving. Origin/origin_ref remain in source because the workplan model has no such fields. No migration, production deployment or schedule was performed. Ruff was absent from the venv and PATH; no lint success is claimed.

T05 stays live: identify the actual deployed receiving revision, prepare a concrete reviewed image/rollout/rollback package, obtain the separate per-change production authorization, then prove primary qualifier/flavor/null-clear parity through normal immutable Forge reconciliation without follow-up field PATCHes. Point-in-time direct C-41 repairs do not supply that receiving proof. Confirm task-level graph edge support and actual supported freshness coverage as well.

T03 stays live: api/services/execution_queue.py rejects new launch requests and has no launch-request pickup consumer. Select the supported owner-agent runner, stable task/message deduplication and receipts through owner interfaces; do not wire C-25 to the retired queue. Current chart sweep is disabled and legacy hostPath fields are rollback-only. Activity Core owns schedules/ops runs, while its runbook routes the C-rule engine to Repo Manager. Older live-sweep prose in docs/activity-core-delegation.md does not establish current runtime coverage.

Historical CLI causality distinction: cmd_fix_consistency forwards the same checker, --fix/path/API/no-writeback arguments and intentionally maps warnings exit 2 to shell success. C-16 can skip writes despite that successful shell exit. This does not isolate every historical CLI/direct-checker discrepancy. The old Forge path omitted new fields on creation and left them untouched on existing rows; it did not explicitly erase already-correct new qualifiers. Source removal now deliberately clears them. Do not call the original CLI report or deployed receiving fixed merely because this bounded source task is done.

2026-10-04 authorized receiving rollout: founder instruction “Do the rollout”. Promoted CI image main-3791e60 (source 3791e608ba) through the owner Helm path with --reuse-values --atomic --timeout 3m. Revision 71 is deployed; API/MCP Ready, schema a0b1c2d3e4f5, tested receiving source digest matches the running container. The image also contains the previously committed additive memo receipt migration; its 20 focused tests passed. No destructive schema downgrade belongs to rollback.

Fresh normal receiving-endpoint derivations at exact immutable owner commits restored STATE-WP-0094 flavor=implementation and cleared absent Warden task blockers, including WARDEN-WP-0041-T03. Independent requests with fresh idempotency keys then returned noop. No task PATCH or direct consistency repair was used for these receiving proofs. Custodian broader exact-commit derivation failed transactionally on a historical ADHOC task UUID collision; its residual cadence task remains wait/human-needed with its original decision gate. The failure is retained, not represented as receiving parity success.

T05 remains progress for actual task-level dependency-edge receiving and scheduled freshness coverage; T03 retains runner selection/dedup/receipts. Neither the legacy remote scheduler nor a recurring provisioning cadence was activated. Evidence: docs/evidence/2026-10-04-receiving-rollout.json.

2026-10-04 T03 source preparation: selected ActivityDefinition → Activity Core ops_run → admitted owner harness as the supported recurring pickup boundary. The offline owner_return_handoff planner derives stable repo/task/message event IDs and correlates existing ops-run pending/terminal receipts; 13 staged tests pass. No dispatch, receipt write, schedule or task transition is performed. An accepted definition/profile/authority and callable owner submission adapter remain required, so T03 is progress, not done. Details and T05 graph freshness assessment: docs/owner-return-handoff.md. Normal Forge receiving still omits dependency edges; C-20 can index them, but runtime freshness coverage and safe source-owned edge reconciliation remain live T05 obligations.

2026-10-04 T03 eligibility review refinement: C-25 can report tasks carrying both owner-return and human gates. Before commit/activation the planner was corrected to require current authoritative task/workplan eligibility, resolved predecessor/decision states and observation date. Human, residual, stale, nonterminal or future gates stop preparation even with prior successful pickup. Missing safety metadata refuses planning. Thirty staged tests pass; the initial 13-test result remains historical preparation evidence, not complete safety coverage. T03/T05 stay progress; no dispatch, schedule or source gate clearing.

2026-10-04 T05 follow-up (claude-state-hub): consistency report-only run at HEAD and with the b2af3c1 checker produced identical findings (27 C-03 FAIL on STATE-WP-0069/0070/0071/0073/0080 stale hub IDs, 11 WARN C-20/C-26/C-28/C-35); none caused by fceb5f2/3b9a5c5. Migration b3c4d5e6f7a8 ran a0b1c2d3e4f5 -> head -> a0b1c2d3e4f5 -> head on a scratch local PostgreSQL database with a pre-existing edge row preserved (owner NULL). c287ed8 adds the dry-run edge preview (create/remove/retain/unresolved/external) through the shared pure planner and fixes duplicate-edge-key collapse in the classifier. Rollout package prepared, not executed, and requires founder per-change authorization: docs/rollout-dependency-edge-receiving.md. No deployment, schedule or production write. T03/T05 status unchanged.