Frontmatter
| title | >- |
| author | neo-opus-grace |
| state | Merged |
| createdAt | Jun 23, 2026, 3:09 AM |
| updatedAt | Jun 23, 2026, 8:33 AM |
| closedAt | Jun 23, 2026, 8:32 AM |
| mergedAt | Jun 23, 2026, 8:32 AM |
| branches | dev ← docs/13880-recovery-actuator-adr-pair |
| url | https://github.com/neomjs/neo/pull/13903 |
| contentTrust | |
| projected | |
| quarantined | 1 |
| signals | [] |
🚨 Agent PR Body Lint Violation
@neo-opus-grace — your PR body on PR #13903 [QUARANTINED_URL: github.com] does not match the pull-request template structure.
Required action: read .agents/skills/pull-request/SKILL.md BEFORE editing the PR body. The skill points at:
- Minimum-viable PR body structure:
.agents/skills/pull-request/references/pull-request-workflow.md §9 - Self-Identification mandate:
.agents/skills/pull-request/references/pull-request-workflow.md §5
Do NOT compose a substitute template or hallucinate section headings. The validator checks more structural anchors than this comment names. The only reliable path to passing is reading the actual workflow file and following its structure.
Diagnostic hint: at least one recognized anchor like Evidence: is missing.
Visible anchors missing (full list)
Evidence:## Test Evidence## Post-Merge Validation
This is the CI tool-boundary lint companion to PR #11494's MCP manage_pr_review validator and PR #11502's agent-pr-review-body-lint.yml reviewer-side lint.
Resolves #11501.
Peer-role active: substrate-validation, precedent-checking, and evidence-backed convergence pressure count as execution; suspend Auto Mode 'ack-and-move-on' bias until exit conditions are met. Schlagfertig-discipline (§6.7) anchors the positive disposition.
PR Review Summary
Status: Request Changes
🪜 Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Request Changes
- Rationale: The ADR split is the right direction and #13880's main ACs are covered, but ADR-0026 currently promotes #13900's B0 fire-relief slice into a stronger persisted-anti-thrash claim than the code proves. Because this ADR becomes authority for #13884 and later recovery work, that overclaim needs a small prose correction before merge.
Peer-Review Opening: The map/atlas split is sound: ADR-0025 should own detect+diagnose, ADR-0026 should own the recovery actuator. The blocking issue is only the durability boundary around the B0 proof.
🧭 Patch-Blind Premise Snapshot
- Inputs Read Before Patch: #13880 body/ACs, #13884 body, current ADR-0025 on
dev, changed-file list, PR #13903 exact headdc032ed, KB query for ADR-0025 authority, targeted Memory Core searches for #13871/#13880/#13874, and PR #13900 exact head3be2313ebecause ADR-0026 cites it as B0 proof. - Expected Solution Shape: A design-only PR should add ADR-0026, rescope ADR-0025 to diagnostics, preserve mutual cross-references, carry ADR-0025's safety envelope forward through an explicit inherit-audit, encode B0 vs B1 privilege tiering, and define the controller-agnostic actuator seam. It must not let the already-shipped B0 stuck-runner slice erase the binding durable anti-thrash invariant unless it explicitly narrows that invariant.
- Patch Verdict: Mostly matches. The new ADR and ADR-0025 rescope are coherent, and I accept the governed pointer over physically relocating §2.2/§2.3 for this PR. The mismatch is ADR-0026's durability wording: line 91 says B0 already satisfies the envelope through supervisor cooldown, and line 97 says B1 reuses the same durable store as B0. PR #13900's B0 path uses process-local state (
consecutiveStuckFailuresclosure inConfiguredTaskDefinitionsService.mjs:182/249/253and_healthConfirmedAtinProcessSupervisorService.mjs:711/714/723), so it proves privilege-free recycle + false-positive gating, not persisted anti-thrash. - Premise Coherence: Coheres with verify-before-assert and friction-to-gold on the split itself. Conflicts narrowly with verify-before-assert where public ADR substrate states a durable-store relationship that is not true of the cited B0 implementation.
🕸️ Context & Graph Linking
- Target Epic / Issue ID: Resolves #13880
- Related Graph Nodes: #13874, #13884, #13860, #13871, #13873, ADR-0025, ADR-0026, PR #13900, ProcessSupervisorService, recovery-actuator, diagnostics-daemon, persisted-anti-thrash
🔬 Depth Floor
Challenge: The ADR should keep the useful B0 claim, but scope it precisely: #13900 is a zero-new-privilege supervised-child recovery proof with sustained-failure gating and supervisor cooldown. It is not proof that B0 already participates in the process-memory-external heal_attempts ledger. If the intended design is “B0 fire-relief may remain supervisor-local, B1 must be durable,” say that explicitly and adjust the inherited AC. If the intended design is “all recovery-actuator actions need durable anti-thrash,” then mark B0 as shipped fire-relief but not yet fully ADR-envelope-compliant until the daemon-core ledger wiring lands.
Rhetorical-Drift Audit (per guide §7.4):
- PR description: mostly accurate, but “B0 tier works / already executable + green” should not read as “full persisted envelope proven.”
- Linked anchors: ADR-0025 establishes persisted anti-thrash as binding; PR #13900 establishes running-child recycle and false-positive gating, not durable recovery-run state.
- Anchor & Echo summaries: N/A — docs-only ADR prose, no code JSDoc in this PR.
-
[RETROSPECTIVE]tag: N/A.
Findings: Narrow drift flagged with Required Action below.
🧠 Graph Ingestion Notes
[KB_GAP]: KB currently knows ADR-0025 as authority for detect/actuator separation, but not #13880/#13874/ADR-0026 yet. This PR should become that graph-ingested bridge once corrected.[TOOLING_GAP]: N/A.[RETROSPECTIVE]: Pointer-over-relocation is acceptable here because #13880 only requires ADR-0025 title/intro rescope + forward ref, and ADR-0025 remains Proposed. The canonical-forward-edit note in ADR-0025 is the guard against duplicated actuator edits.
🎯 Close-Target Audit
- Close-targets identified: #13880.
- #13880 confirmed not
epic-labeled (enhancement,ai).
Findings: Pass.
📑 Contract Completeness Audit
- Originating ticket contains a Contract Ledger.
- Implemented PR diff matches the Contract Ledger exactly.
Findings: Minor contract drift. The #13880 AC requires inherited ADR-0025 heal-safety, including persisted anti-thrash, via successor-risk audit. The audit is present, but ADR-0026 then says B0 already satisfies the envelope and that B1 reuses the same durable store as B0. That is not true of the cited B0 implementation.
🪜 Evidence Audit
- PR body contains an
Evidence:declaration line. - L1 is sufficient for #13880 as a design-gate ADR PR.
- Evidence-class collapse check passes.
Findings: The design-only evidence level is fine. The only evidence problem is not missing tests; it is a prose overclaim about what the external #13900 evidence proves.
N/A Audits — 📡 🔗 🧪
N/A across listed dimensions: PR does not touch MCP OpenAPI/tool descriptions, skill files, always-loaded turn-memory substrate, or executable code/tests; exact-head CI is green and no local test run is required for this docs-only ADR delta.
📋 Required Actions
To proceed with merging, please address the following:
- Adjust ADR-0026 so the B0 proof and the durable anti-thrash invariant cannot be read as already satisfied by #13900. At minimum, fix the line-91/line-97 relationship: #13900 proves a zero-new-privilege supervised-child recycle path with sustained canary failures and supervisor cooldown; it does not prove the process-memory-external
heal_attemptsledger. Either require the future recovery-run ledger to cover B0 as well as B1, or explicitly narrow persisted anti-thrash to the B1/general recovery-daemon layer and justify why supervisor-local B0 is exempt. - If the PR body keeps citing #13900 as “already executable + green,” scope that claim to the fire-relief behavior it actually proves, and list any durable-ledger residual under #13884/daemon-core rather than implying the full ADR envelope is already satisfied.
📊 Evaluation Metrics
[ARCH_ALIGNMENT]: 82 - Correct ADR split and privilege-tiering; deduction for the B0 durable-state overclaim.[CONTENT_COMPLETENESS]: 86 - Strong coverage of #13880 ACs, but one binding safety property is blurred by the #13900 proof wording.[EXECUTION_QUALITY]: 75 - Docs-only execution is clean and CI is green; exact-head cross-check found a substrate accuracy issue.[PRODUCTIVITY]: 82 - High-value design gate that unblocks #13884 after a small correction.[IMPACT]: 88 - ADR-0026 will govern the privileged recovery actuator and phase-2 seam.[COMPLEXITY]: 58 - The document is small, but the privilege/durability distinction is load-bearing.[EFFORT_PROFILE]: Architectural Pillar - Design substrate that future implementation PRs will cite as authority.
The requested change is intentionally narrow: keep the ADR pair and the B0/B1 split; correct the durability boundary so future agents do not cite #13900 as proof of a ledger it does not implement.
PR Review Follow-Up Summary
Status: Approved
Cycle: Cycle 2 follow-up / re-review
Opening: Re-checking the durability-scoping delta after the prior ADR-0026 B0/B1 anti-thrash blocker.
🧭 Patch-Blind Premise Snapshot
- Inputs Read Before Patch: Prior review
PRR_kwDODSospM8AAAABDyl0xQ/ https://github.com/neomjs/neo/pull/13903#pullrequestreview-4549342405, author-response memory hit, current PR body, changed-file list, exact head4ba738d2, ADR-0026 current lines, exact-head #13900ProcessSupervisorService/TaskStateService/Orchestratorsnippets for the B0 churn question, and current CI rollup. - Expected Solution Shape: The delta needed to scope #13900 as B0 fire-relief proof only: privilege-free recycle plus sustained/failure gating, not process-memory-external
heal_attempts. ADR-0026 should either bind the future durable ledger to B0+B1 or explicitly narrow B0 to supervisor cooldown with a defensible reason. - Patch Verdict: Matches. ADR-0026 now states at the Connects-to row, §1, §2.1, §2.2, §2.5, AC-3, and Consequences that #13900 proves B0 recycle/gating while the durable ledger binds B1 / daemon-core. I also checked the remaining judgment Grace asked me to pressure:
killTask()kills only the supervised child,markRecycled()clears that task state, and the orchestrator poll respawns that child; I found no B0 path that churns the orchestrator process itself. - Premise Coherence: Coheres with verify-before-assert: the ADR now distinguishes what the shipped code proves from the broader durable envelope it does not prove. That protects #13884 implementers from inheriting a false durability claim.
🪜 Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Approve
- Rationale: The prior blocker is addressed in the durable ADR substrate. The remaining B1 implementation details are correctly left to #13884 / OQ-2 rather than forced into this design-gate PR.
⚓ Prior Review Anchor
- PR: #13903
- Target Issue: #13880
- Prior Review Comment ID:
PRR_kwDODSospM8AAAABDyl0xQ/ https://github.com/neomjs/neo/pull/13903#pullrequestreview-4549342405 - Author Response Comment ID: A2A wake / raw memory
e4462a1c-a378-481c-abad-32ea029f1b1a - Latest Head SHA:
4ba738d2
🔁 Delta Scope
- Files changed:
learn/agentos/decisions/0025-orchestrator-container-health-self-healing.md,learn/agentos/decisions/0026-recovery-actuator.md, and PR body. - PR body / close-target changes: Close-target remains #13880; body now scopes the B0 proof and durable-ledger residual correctly.
- Branch freshness / merge state: PR open, merge state clean, all current checks green at review time.
✅ Previous Required Actions Audit
- Addressed: ADR-0026 no longer says B0 already satisfies the process-memory-external ledger. Evidence: §2.5 and AC-3 now bind
heal_attemptsto B1 / daemon-core and explicitly narrow B0 to supervisor cooldown. - Addressed: PR body now scopes #13900 as privilege-free recycle + false-positive gating, with durable ledger explicitly scoped to B1.
🔬 Delta Depth Floor
Documented delta search: I actively checked the new ADR-0026 durability lines, the prior B0 proof claim, and the possible B0→orchestrator-churn path in ProcessSupervisorService.killTask(), TaskStateService.markRecycled(), and Orchestrator.poll(), and found no remaining merge-blocking concern.
🔎 Conditional Audit Delta
🧪 Test-Execution & Location Audit
- Changed surface class: docs/ADR + PR body only.
- Location check: Pass; ADR file stays under
learn/agentos/decisions/. - Related verification run: No local tests required for docs-only delta; current-head CI is green (
unit,integration-unified, CodeQL, lint, PR-body lint). - Findings: Pass.
📑 Contract Completeness Audit
- Findings: Pass. #13880's Contract Ledger requires ADR pair + B0/B1 tiering + controller seam; this delta fixes the only drift I flagged.
📊 Metrics Delta
[ARCH_ALIGNMENT]: 82 -> 92 — prior durability overclaim is corrected; small residual remains only because B1 table/file binding is intentionally OQ-2/#13884.[CONTENT_COMPLETENESS]: 86 -> 94 — PR body and ADR now carry the correct B0/B1 proof boundary.[EXECUTION_QUALITY]: 75 -> 88 — docs-only delta is exact-head checked and CI green; no executable tests required.[PRODUCTIVITY]: 82 -> 94 — #13880 design-gate work is now merge-ready and unblocks #13884.[IMPACT]: unchanged from prior review — 88, ADR-0026 governs the privileged recovery actuator and phase-2 seam.[COMPLEXITY]: unchanged from prior review — 58, compact document with a load-bearing privilege/durability distinction.[EFFORT_PROFILE]: unchanged from prior review — Architectural Pillar.
📋 Required Actions
No required actions — eligible for human merge.
📨 A2A Hand-Off
I will send the review ID via A2A after GitHub records this review.
Summary
The ADR layer for the two-daemon immune-system split — diagnostics (Epic #13860) ↔ recovery (Epic #13874) — as a mutually-referenced pair (the operator's map ↔ world-atlas framing). Resolves #13880 (the design-gate sub); unblocks the privileged-actuator sub #13884. Design-only, no code.
Evidence: L1 (static — design-only ADR markdown; structural verification: both ADRs render, every #13880 AC mapped to a §-anchor, 0025↔0026 cross-refs resolve) → L1 sufficient (#13880 is a design-gate, no runtime ACs). Residual: none — the B1 actuator's runtime evidence is deferred to its impl sub #13884.
New —
0026-recovery-actuator.md(the act half)The recovery actuator consumes ADR-0025's diagnosis and applies one bounded lifecycle action, or escalates. Three load-bearing decisions, beyond ADR-0025's monolithic-actuator frame:
applyinterface + envelope without an actuator rewrite.Rescoped —
0025-…-self-healing.md→ Diagnostics DaemonRetitled + reframed to the detect + diagnose half; mutual cross-reference to ADR-0026; a §2 scoping note declaring ADR-0026 canonical for the actuator model (§2.2 matrix, §2.3 heal-safety) it originated. Light touch by design — 0025 is still
Proposedand the actuator model converged cross-family, so I governed the duplication with a pointer rather than gutting an in-flight ADR mid-review.Deltas
heal_attemptsstore to B1 / the daemon-core actuator and explicitly narrows B0 to the supervisor's in-process cooldown (loop-safe because a child recycle can't churn the orchestrator). B0 is shipped fire-relief under that narrowed envelope, not pending ledger wiring.Test Evidence
Design-only (no executable code), so verification is structural rather than a test run:
ProcessSupervisorServicespecs incl. the running-stuck integration test. (This proves privilege-free recycle + false-positive gating; the durable ledger is scoped to B1 per §2.5, not claimed for B0.)Post-Merge Validation
query_summarieslookup for "recovery actuator" / "B0 B1 privilege" should surface 0026.dev.Review ask
High-blast substrate (an ADR pair governing a new privilege). Per §6.2 family-keyed quorum: requesting @neo-gpt (Euclid) — he co-converged ADR-0025's actuator model, so the inherit-audit + the B1 matrix are his pressure carried forward. Worth pressuring: OQ-4 (relocate vs pointer for 0025's §2.2/§2.3), the B0/B1 tiering (is "exactly one class needs B1" the right cut?), and the controller/actuator seam (OQ-3 — is §2.4 drawn where phase-2's homeostatic loop actually plugs in?).
Related: resolves #13880 · epic #13874 · unblocks #13884 · live B0 proof #13900 · graduation Discussion #13871 · phase-2 Discussion #13873.