runtime: ordinary governance reviews fail closed across adapters

[sumitake]

Summary

Four ordinary, bounded governance.repository attempts during one architecture-documentation task failed closed despite valid exact-head repositories and noninteractive EOF-delimited stdin. Three completed failures are captured here; a separately running public review is intentionally excluded until it reaches a terminal state.

The observed failures are false-positive outcomes from the caller's perspective: the requested read-only repository review could not produce governing evidence even though the request shape and source were valid. The evidence does not yet prove whether the cause is avoidable prompt/invocation behavior, provider tool choice, adapter containment classification, or coordinator/runtime brittleness.

Related diagnostic gaps already exist in #139 and #131. This issue tracks the cross-adapter outcome and the root-cause investigation needed before changing caller guidance or runtime behavior.

Environment

• Installed package: agent-collab 6.2.0
• Provider runtime: 4.1.0
• Manifest digest: 13a9f85f6e35a62af990fa9ae11e0c49e82d69ed07deaa4ef71339192b303c56
• Source: one operator-authorized private workspace architecture PR, exact reviewed head prefix ec178215
• Invocation: printf '%s' '<closed JSON>' | python3 <plugin-root>/coordinator.py
• repo_root: canonical absolute root of the same real Git worktree used as cwd (path omitted)
• No PTY, raw provider fallback, caller-supplied lineage, replay, mutation, or concurrent same-provider call

Common request fields were exactly:

{
  "logical_action": "governance.repository",
  "quality_profile": "frontier",
  "effort_class": "maximum",
  "timeout_ms": 600000,
  "prompt": "<bounded exact-head read-only review request>",
  "repo_root": "<canonical private worktree root>"
}

Each attempt additionally named one operator-approved target_agent.

Terminal evidence

Grok / xAI

• Request: arch-refresh-grok-20260823
• status=capability_error
• error_code=source_containment_failed
• adapter_code=outside_source
• outside_source_observed=true
• provider_processes=1, metadata_process_count=1
• tool_outcomes={success:0, failed:0, incomplete:0, unknown:0}
• native_envelope_sha256=null
• cleanup_confirmed=true
• No artifact or receipt

Zhipu / OpenCode Go

• Request: arch-refresh-zhipu-20260823
• Same public classification and zero-tool outcome as Grok
• effective_effort=provider_default even though the closed request asked for maximum
• provider_processes=1, metadata_process_count=1
• cleanup_confirmed=true
• No artifact or receipt

Gemini / Google

• Request: arch-refresh-crosscheck-20260823
• status=advisory, reason=execution_failed_text_salvaged
• salvaged_from=protocol_error
• adapter_code=failed_terminal, terminal_state=error
• tool_outcomes={success:185, failed:1, incomplete:0, unknown:0}
• outside_source_observed=false
• provider_processes=1, metadata_process_count=2
• cleanup_confirmed=true
• The salvaged text identified three repository inconsistencies that were independently verified as real, showing that the read-heavy review substantially completed.
• Correctly no governing artifact or receipt; advisory text was not treated as approval.

All attempts were consumed once and not replayed.

Investigation required

1. Reproduce against a synthetic exact-head repository with the same coordinator shape, then compare a minimal prompt with the bounded architecture-review prompt.
2. Preserve a path-free closed containment subtype for Grok and OpenCode as requested by runtime: classify outside-source repository review failures #139, and a bounded failed-operation class for Gemini as requested by runtime: classify failed tools in salvaged protocol errors #131.
3. Determine whether the provider actually requested an out-of-root location, the adapter resolved an allowed location incorrectly, or the coordinator supplied inconsistent cwd/source context.
4. Determine whether Gemini's single failed operation was load-bearing to the verdict contract or whether a benign tool failure currently poisons an otherwise grounded review.
5. If caller wording or request construction is causal, add deterministic preflight or precise invocation guidance. If adapter/runtime logic is causal, fix it without weakening containment.
6. Add cross-adapter regression coverage from real producer bytes through the public verifier.

Invariants

Keep fail-closed authority, canonical-source containment, bounded execution, cleanup, no raw provider output, no sensitive paths, and no automatic replay. A fix must improve classification or eliminate the false-positive path; it must not convert uncertain source behavior into a governing verdict.

Related

• runtime: classify outside-source repository review failures #139 — outside-source repository review classification
• runtime: classify failed tools in salvaged protocol errors #131 — failed-tool classification in salvaged protocol errors

[sumitake]

Same-task reproduction through the installed 6.2.0 intent-check path:

• Request: provider-failure-evidence-intent-20260823
• Action: context.documents.intent, untargeted, standard/standard, 120000 ms
• EOF-delimited closed stdin; two bounded inline documents
• Result: advisory partial/ungrounded execution_failed_text_salvaged from protocol_error
• adapter_code=failed_terminal, terminal_state=error
• tool_outcomes={success:31, failed:1, incomplete:0, unknown:0}
• outside-source false; one provider process; two metadata processes; cleanup confirmed
• Salvaged text said VERDICT: MATCH with no missed constraints, added scope, or ambiguity, but it was correctly not accepted as intent authority.

This is a fourth occurrence in the same evidence-logging task and reinforces that the failure is not specific to repository source containment: ordinary document intent comparison also reaches useful completion and is then downgraded by one unclassified failed operation. No replay was made. The existing recurrence for this task remains anchored once at agent-collab#144; no duplicate ledger recurrence was created.

[sumitake]

Classification update from the workspace PR #2986 remediation: one apparent cross-check hang in this session was conclusively caller-side EOF framing, not a provider false flag. A PTY request plus newline never left sys.stdin.buffer.read, produced no provider process/receipt/artifact, and was interrupted; the same sanitized request through closed noninteractive stdin succeeded through Gemini. That recurrence belongs to the existing coordinator.stdin.requires.closed.noninteractive.request pattern and is also recorded on agent-collab#130. It is distinct from the real coordinator brittleness tracked here/#131: the earlier 31-success/1-failed intent call did execute provider work and returned an advisory salvaged artifact without a provider execution receipt. No request was automatically replayed.

[sumitake]

Follow-up umbrella classification: the new architecture/evidence-task diagnostics are operator-classified false flags and should be fixed in a future runtime session; they are not provider-unavailability verdicts.

• Gemini architecture review arch-refresh-crosscheck-20260823: 185 successful operations, 1 unclassified failure, substantive findings returned, then receipt-free advisory salvage from protocol_error.
• Grok and Zhipu architecture reviews arch-refresh-grok-20260823 / arch-refresh-zhipu-20260823: canonical exact-head roots and closed stdin, but generic source_containment_failed with zero classified outcomes and no safe subtype.
• Gemini intent comparison provider-failure-evidence-intent-r2-20260823: 29 successful operations, 1 unclassified failure, structured comparison returned, then receipt-free advisory salvage from protocol_error.

All executed once, remained non-authoritative, and were not replayed. These are distinct from #130's caller-side PTY/EOF framing error, which never reached a provider. Workspace PR #2993 records the applicable source-containment recurrence; the protocol recurrence is intentionally not duplicated inside the 24-hour same-agent lock.

[sumitake]

Additional parent-session evidence extends this umbrella without changing the authority classification:

• Exact-head Grok review after PR #2979 rebased again returned generic source_containment_failed before any classified repository operation, with cleanup confirmed and no artifact/receipt.
• Managed Moonshot and Alibaba governance reviews each timed out at the enforced 600-second cap with zero repository-read evidence and no artifact/receipt.
• A separately authorized direct OpenCode/DeepSeek advisory review emitted no output within 600 seconds and was terminated once; it is not a canonical coordinator receipt.

The operator classifies these as false flags requiring a future runtime fix. All are neutral/unavailable evidence rather than dissent or provider-unavailability verdicts, and none was replayed. Workspace PR #2993 now records one #2979 containment recurrence and one #2979 timeout-source recurrence, while correctly deduplicating repeated same-task observations.

[sumitake]

Additional exact-head evidence from workspace PR #2998, using installed agent-collab 6.2.0 and the documented closed governance.repository request:

• request: workspace-pr-2998-exact-head-governance
• reviewed head: 996d061d05b5a792058f2b094229715331e1fe5c
• untargeted central selection resolved logical agent gemini / Google lineage
• canonical repository root, EOF-delimited noninteractive stdin, one provider process, no replay or provider fallback
• enforced timeout: 240000 ms
• terminal result: status=timeout, error_code=timeout, adapter_code=provider_error, failure_phase=inference
• tool_outcomes={success:0, failed:0, incomplete:0, unknown:1}
• cleanup_confirmed=true, outside_source_observed=false
• no artifact and no provider execution receipt; treated as neutral/unavailable review evidence
• manifest digest: 13a9f85f6e35a62af990fa9ae11e0c49e82d69ed07deaa4ef71339192b303c56
• adapter wire digest: 0e4e888f5ef0fd37250b16ceff72fcb440e683935470eeeb16027ae7d08484c4

This occurrence is especially relevant because PR #2998 contains source fixes for the false-positive adapter classes tracked here, but the currently installed/signed runtime necessarily cannot use that unshipped source. The attempt was consumed once and will not be replayed. The PR must obtain independent exact-head evidence through another authorized surface or remain blocked.

[sumitake]

Additional exact-head substitute-review evidence from workspace PR #2998:

• failover request anchor: f24d40a6-1abc-4004-9d27-55954ab80853
• reviewed head: 996d061d05b5a792058f2b094229715331e1fe5c
• caller: checked-in scripts/peer_review_failover.py at that head, using the co-packaged workspace semantic runtime (wire v6 source; this was not a released/installed runtime)
• logical action: governance.repository; pinned target: grok; quality frontier; effort maximum; canonical repository source; bounded 600000 ms request
• independence inputs: author lineage openai, prior cross-check lineage google; the active graph deterministically selected Grok/xAI
• exactly one invocation; no retry, rollover, or provider fallback
• terminal caller result: selected governance authority returned no valid result; _invoke_repository_review produced no contract-valid source-evidenced governance artifact
• no substitute review reply was posted and no failover-completed event was emitted

The failover caller intentionally collapses invalid/non-success runtime responses to None, so this observation cannot honestly assert a more specific provider status, adapter code, or tool count. It remains neutral/unavailable review evidence, not dissent or approval. The Grok leg is consumed once and will not be replayed. PR #2998 therefore remains gated unless the original designated reviewer supplies a valid exact-head response or the operator authorizes another governance path.

[sumitake]

Workspace source remediation is now split into two reviewable layers. PR #2998 at 996d061d05b5a792058f2b094229715331e1fe5c tolerantly normalizes grounded adapter results and preserves useful semantics without granting false authority. Stacked PR #3002 at d6585da303a8bbbeb9658c8648ba160fc2b3037e advances wire schema 7 with one-invocation route recovery, closed typed missing criteria, evidence-anchor adjudication, and path-free containment/failed-operation diagnostics. A bounded independent code audit approved #3002 after all findings were integrated; the sandbox-safe broad run is 232/233 suites (8,159 tests), with the sole failure reproduced unchanged on the parent due the .codex worktree-path import-side-effect false positive. Both workspace PRs remain open because qualifying exact-head distinct-family governance evidence is unavailable; no inbox UUID/silence/failover marker was used, no uncertain call was replayed, and no merge or release is claimed.

[sumitake]

Source progress update:

• Adapter recovery PR #2998 advanced to ba3210ee160a22d3507ebeba5371573dc66d1b41 after fixing a review-found duplicate rejected-tool correlation defect with a red-then-green regression and fail-closed security review.
• Wire-v7 same-invocation route recovery PR #3002 was rebased onto that corrected parent at signed head 8e85ccaf539495b2a36e80fa65b16460109ded87 and reverified across the ACP, wire-contract, runtime, orchestrator, project-estimation, and interface surfaces.
• Inbox default-deny governance PR #3001 remains separately blocked at bfedf817c9a39d380937bbe99f6b632afa716e64 by one actionable documentation contradiction, unavailable review capacity, missing exact-head convergence, and operator-reserved ownership.

No workspace PR is being represented as merged or released. No uncertain provider call was replayed, and no asynchronous inbox path was used.

[sumitake]

Workspace wire-v7 remediation has advanced to signed exact head 91c9bafe9d4c1faf4b70767fe8715e271de81f8f on PR #3002.

A third post-hoc review round found three material gaps: the published action-target descriptor omitted statically admissible shadow routes, and Grok/OpenCode containment traces omitted the triggering current failed lifecycle fact. Serial patching stopped under the design tripwire. A revised invariant-driven plan received fresh Google-family adversarial approval through the operator-authorized Direct CLI, then all three findings were fixed together in one test-first patch.

Current behavior:

• advertised targets exactly match enabled statically admissible active-or-shadow routes while routing and receipts preserve shadow-only authority
• Grok and OpenCode account the current structured lifecycle fact before path normalization
• outside/unresolvable paths still fail closed with path-free typed diagnostics and no evidence
• no retry, replay, fallback provider call, raw-output authority, asynchronous inbox path, or admin bypass was introduced

Affected adapter/routing suites are fully green; the 11,558-test all-roots run has 341/344 suites green, with the three red suites independently classified as two clean-main environment failures plus one .codex/worktrees path false positive that passes 163/163 at this exact head from a neutral worktree. PR #3002 remains open and stacked on #2998 because no qualifying exact-head distinct-family governance receipt or formal approval exists. The Direct CLI plan approval and bounded implementation audit are advisory assurance only, not merge evidence.

[sumitake]

Additive recurrence (plugin 6.2.0, manifest 13a9f85f6e35, runtime 4.1.0, 2026-08-23/24): governance.repository (frontier/maximum, target_agent grok, timeout_ms 600000, repo_root = canonical private workspace root, closed JSON on stdin, no PTY) failed closed with status: protocol_error, error_code: execution_contract_violation. New detail vs the entries above: failure_trace shows the provider substantially COMPLETED the review — tool_outcomes: {success: 63, failed: 1, unknown: 18}, failure_phase: protocol, adapter_code: invalid_final, cleanup_confirmed: true — i.e. the repository reads happened and only the final-message closed-verdict contract was violated, so a full ~10-minute review produced no artifact or receipt. Consequence downstream: the workspace check_pr_phase1_extension receipt gate then has no canonical receipt to accept for an otherwise-completed distinct-family review (request_id gov-review-ledger-flips-1).

[sumitake]

Additive release-qualification evidence (runtime 4.2.0 ARM artifact built from workspace main 3cb09f8dd0b20d0ed67daef306e254be29838508; wire 0c2cba3ab79f0217b1ae4de83ec9723412e46809b98b4f11f8997a8599125a51; staged public package 6.2.1): one context.documents.extract Gemini canary read the required document and produced the correct terminal text, but returned source_containment_failed / outside_source / absolute_outside_roots with 39 successful tool outcomes and 1 failed outcome. No replay was made. Preserved local trajectory metadata proves the outside path was the coordinator-created exact request-private agy diagnostic log, which the provider inspected after reading the document; the log was a sibling of the document root and therefore poisoned an otherwise valid result. This is a coordinator false-positive, not evidence that the provider read an arbitrary caller source. A narrow workspace fix is in progress: classify only the exact current-invocation log file as non-evidence while retaining fail-closed behavior for its parent, siblings, and every other outside path; parser, run wiring, and salvage regression tests are green. The signed artifact will be rebuilt from freshly fetched post-merge main before release.