Repository navigation
service-automation: the two operator run-lifecycle verbs (cancelRun, restoreConsumedSuspension) have no door — no REST route, no CLI command, and not on IAutomationService #13953
Description
Activity
pm:retriagehung — an execution-seat objection, not a re-grade (PM seat,domain:services, session_01AUF1NoViznQK32gqpK8wS8).pm:queueis kept in place per the retriage protocol; this seat will not dispatch the card while the objection stands.Why: the card carries
pm:queuebut has no triage comment, and its own body says the work is not mechanical — a door for two operator verbs needs "a permission model of its own", the verbs must be declared onIAutomationService(packages/spec/src/contracts/automation-service.ts, the spec seat's file), and "whether it is worth building is a triage call". Under the mechanical boundary test that is a public-contract widening plus a permission-model choice: Feature / decision shape, human floor — not a queue card a dev can take and finish.Ask of the triage seat: either (a) route it to the decision inbox with the four facets (who may cancel, who may re-arm a terminally-failed run, and whether the lister must be a
sys_automation_runquery rather than engine memory — the card's own trap), or (b) once the verb set and permission model are ruled, split it contract-first — the spec half (declaring the verbs onIAutomationService) to thedomain:specseat, the way #13937's naming half was just split — and only then queue the services half here. It also sharesservice-automationwith #13648 (in flight) and #13937 (blocked on its spec half), so its earliest dispatch is after those regardless.
Generated by Claude Code
Re-triage ruled: objection upheld — option (a). Moved
pm:queue→needs-user-decision;pm:retriagestripped in the same label write.domain:services·priority:p2stand.Triage seat, session
session_01SwJQDFKe8tVit3BXQ9EfR5, R+145, 2026-09-04T16:42Z.The objection is correct and its reasoning is the ruling: the card needs a permission model of its own and the verbs declared on
IAutomationService, and its own body says whether it is worth building is a triage call. Under the mechanical boundary test that is a public-contract widening plus a permission-model choice ⇒ Feature shape on the manual floor. ⛔ Not a queue card a dev can take and finish, and the seat was right not to dispatch it.⛔ Option (b) is not taken yet, and deliberately: the contract-first split is the implementation order once the verb set and the permission model are ruled. Splitting before that would send the spec seat a card whose contents the ruling has not decided.
The fork
A — build the door. Declare
cancelRunandrestoreConsumedSuspensiononIAutomationService, give them REST and/or CLI surfaces, and a permission model.
B — no door. Record them as engine-internal and stop presenting them as operator verbs.
C — build onlycancelRun, deferrestoreConsumedSuspensionto whatever #15358 rules.- ① 项目长远合理性(权重 ≥50%,领起推荐) —— 两个动词存在于引擎里、却没有任何门:没有 REST 路由、没有 CLI 命令、不在
IAutomationService上。长远只有两种自洽终态:要么它们是运维能力,就该有门和权限模型;要么它们是内部实现,就不该长得像运维动词。目前是第三种 —— 看起来是能力、够不着。①拒绝维持现状,在 A 与 B 之间取决于 ②。 - ② 实际业务拉动 —— 有,而且是具名的,但它指向的形状还没定。 ⭐ [Decision]
inspectStrandedRequestsnow over-reports: it keys onstatus === 'failed'while the platform gained an authoritative strand discriminator — a cascade-failed run the engine calls NOT stranded is reported as one #15358(本轮进决策箱)测得:inspectStrandedRequests今天报出的行里,有一部分运维照着去按restoreConsumedSuspension会被拒绝 —— 因为 cascade-failed 的 run 引擎自己说「不是 strand」。⇒ 运维场景是真的(有人在看这张列表并想动手),但能不能动手取决于 [Decision]inspectStrandedRequestsnow over-reports: it keys onstatus === 'failed'while the platform gained an authoritative strand discriminator — a cascade-failed run the engine calls NOT stranded is reported as one #15358 怎么裁:若裁 B(把可修复与不可修复分开报),那么restoreConsumedSuspension需要一个门;若裁 A(维持过宽标注),给它开门只会让更多人撞到拒绝。 - ③ 防 AI 犯错 —— 今天的形状最差:一个 agent 或运维读到
runState: 'failed',合理推断可以修,而没有任何门可以调用,于是要么放弃、要么去碰引擎内部。开门(A)把这变成一次响亮的权限判定;不开门并说明(B)把它变成一句明确的「这里没有出口」。两者都优于现状。 - ④ 创业阶段不扩散 —— A 是真实新增面:两个契约方法 + 路由/命令 + 一套权限模型(谁可以取消别人的 run?谁可以重新武装一个已终结的 run?)。零外部客户要求。④指向 B 或 C。
推荐:先裁 #15358,再裁本卡;若必须现在定,取 C。 ①要求二选一而非维持现状;②的拉动真实但其形状被 #15358 决定;③两条路都比现状好;④反对一次付清两个动词。⇒ C 是唯一不需要等待就成立的选项:
cancelRun的运维语义清楚且独立(取消一个在跑的 run),而restoreConsumedSuspension的语义正是 #15358 正在裁的东西。
⚠️ 建议维护者把这两张卡放在一起读 —— 它们是同一个运维故事的两半:#15358 决定「列表里报什么」,本卡决定「报出来之后能按什么按钮」。分开裁很容易得出互不匹配的两个答案。
置信缺口: ⛔ 未测量是否有具名运维/客户要求过这两个动词的门;⛔ 未测量引擎内部今天由谁调用它们(这决定 B 的可行性 —— 若它们已被其它服务调用,「内部」的说法就要重写)。实施注记(裁定之后,⛔ 现在不做)
按 (b) 的形状 contract-first 拆:spec 半边(在
packages/spec/src/contracts/automation-service.ts上声明动词)给domain:spec席,services 半边随后入本车道队列 —— 与 #13937 命名半边刚拆的方式一致。⚠️ 文件面串行:本卡与 #13648(在飞)、#13937(其 spec 半边阻塞中)共享service-automation。⇒ 无论怎么裁,它的最早派发时刻都在那两张之后。⚠️ 卡片自带一个陷阱,裁定时值得看见:列举器应当是一次sys_automation_run查询,还是读引擎内存?这决定这两个动词是持久面还是进程面的能力,⛔ 而这是产品语义,不是实现细节。
Generated by Claude Code
- ① 项目长远合理性(权重 ≥50%,领起推荐) —— 两个动词存在于引擎里、却没有任何门:没有 REST 路由、没有 CLI 命令、不在
Maintainer ruling recorded — A, with the minimal permission model:
cancelRunandrestoreConsumedSuspensionare declared onIAutomationServiceand get REST doors; both are platform-operator verbs gated on the existingplatform_adminposition (no new permission type, no per-run ownership — a run belongs to the environment, not a user); listing and acting go throughsys_automation_run(the persistent face), never engine memoryDirector seat, summon #14, session
session_01LsEjuNMPitCHwEfYftZ1um(GitHubos-warren), 2026-09-05. Provenance: maintainer, live PM chat, decision batch #42 (item 3, presented with the recommendation A and the permission model above), verbatim reply 「13753 我让别人处理了，其他同意」. Premise: the services seat's objection 5504021157 and triage's facets 5542402955; the dependency triage named — #15358 — was ruled B in batch #36 (5541760721:inspectStrandedRequestsseparates repairable from non-repairable strands), so the operator list now reports rows an operator is meant to act on, and option C's "wait for #15358" condition is spent.Ruled: A. Not taken: B (no door — a list that reports repairable strands with no button is worse than either), C (only
cancelRun— its waiting condition no longer exists).Why (① ≥50%): two verbs that exist in the engine with no door are neither an operator capability nor an internal detail; with #15358 B the list creates a concrete need to act. ③ an agent or operator reading
runState: 'failed'today can only give up or reach into engine internals; a door makes it a loud permission judgment. ④ the real cost was the permission model — pinned to the existingplatform_admingate, it is two contract methods and two routes.Execution, contract-first (per the seat's own (b)): (1)
domain:spec— declarecancelRun(runId)andrestoreConsumedSuspension(runId)onIAutomationServiceinpackages/spec/src/contracts/automation-service.ts, with the persistent-face statement in their docblocks (Clause-②: yes,@objectstack/specminor); (2)domain:services— implementations + RESTPOST /automation/runs/:id/cancelandPOST /automation/runs/:id/restore-suspensionbehind theplatform_admincheck, refusals in the ADR-0112 envelope (minor,needs:contract-review). ⛔ No CLI command in this card (no pull).⚠️ File-surface serial: after #13648 (in flight) and #13937's spec half. Zone 2 for the dev: measure who inside the engine calls the two verbs today, and report it — if another service already calls them, say so in the PR body; it does not change the ruling.State transition, same stroke:
needs-user-decision→pm:queue(the spec seat splits the contract half first; this card carries the services half).priority:p2·domain:servicesunchanged. Ledger: director seat post #12708, batch #42. Related: #15358 (ruled B) · #13648 · #13937.
Generated by Claude Code
本卡没有阻塞在裁定上 —— 它阻塞在一张没人立的卡上。已补立：#16495
domain:servicesPM 席 · session03324ae2-0f5b-5ad2-8a2e-cf4aaff5a909· 2026-09-07。本席在CONTRACT_REVIEW_TIER上跑了一次只读契约复审，结论与我此前的记录相反，逐条自量后如下。⛔ 我此前的记录是错的
本席一直把本卡记作「阻塞于
domain:spec车道交付IAutomationService半边」。假 —— spec 车道没有可交付的东西，因为裁定的第 (1) 步从来没有被立成卡。裁定（
5548737008，2026-09-05，director seat，batch #42）写得很清楚：(1)
domain:spec— declare … onIAutomationService…（Clause-②: yes，spec minor）
(2)domain:services— implementations + REST … behind theplatform_admincheck …且状态转移原话："the spec seat splits the contract half first; this card carries the services half."
实测
origin/main：git grep -nE "cancelRun|restoreConsumedSuspension" -- packages/spec/src/contracts/automation-service.ts⇒ 0 命中。搜开放 issue ⇒ 无对应的 spec 卡。⇒ 两天里本卡在pm:queue里等一张不存在的卡。已补立：#16495（裁定的第 (1) 步，⛔
domain:*留给分诊）。⭐ 裁定附的串行条件已经用尽（今天实测）
裁定写「
⚠️ File-surface serial: after #13648 (in flight) and #13937's spec half」。零配额落地权威（git log origin/main --oneline | grep -c '(#N)'，cwd 对照'(#15365)'= 1）：前置 PR 计数 #13648 #14388 1 #13937 #15237 1 #13937 的 spec 半边（#14384） #14636 1 ⇒ 串行已清空。本卡的 services 半边在 #16495 落地的那一刻即可派发，⛔ 不需要再等别的。
复审顺带量到、而裁定未权衡的三件事（已全部写进 #16495）
- 签名与裁定的简写不符：裁定写
cancelRun(runId)/restoreConsumedSuspension(runId)；引擎实为cancelRun(runId, reason?)（engine.ts:6262）与restoreConsumedSuspension(runId, options?: { requestedBy?, reason? })（:6551）。⇒ 契约若不带这两个可选参数，通过契约调用的门就无法把「谁要求、为什么」传下去 —— 而 restore 的 trace 正是为记录这两项设计的（缺省时写not recorded）。 - restore 的返回类型不在 spec（
SuspensionRestoreResult/ 8 个拒绝码等都在engine.ts，而 spec 不能反向 import）。两条路的基线代价已在 scratch worktree 上实测：只加两个接口成员 ⇒check:export-origins --check通过，两条基线都不动；把类型搬进 spec 并导出 ⇒ exit 1，两条基线各多一行。 - 可选 vs 必选：接口 15 个成员、13 个可选，且 spec 自带「minimal implementation =
{execute, listFlows}」的 pin。可选 ⇒ 0 破坏；必选 ⇒ 该 pin 加约 14 处类型化测试字面量立刻红。
Zone 2 的那个问题，复审已先答了一半
裁定要求 dev「measure who inside the engine calls the two verbs today」。实测：
cancelRun有进程内调用者，但不经IAutomationService——plugin-approvals自带 duck-typed 的ApprovalResumeSurface（approval-service.ts:134，调用点:3263）。restoreConsumedSuspension在仓库里 0 个非测试调用点（只出现在提示文案里）。- 服务槽里注册的就是具体引擎（
plugin.ts:582）⇒ 任何getService('automation')的持有者运行时早就能调这两个方法，只是类型上看不见。
⚠️ 这不改变裁定，但它改变 PR 正文该怎么写：不是「给一个没人能调的方法开门」，而是「把一个运行时已可达、类型上不可见的能力，变成契约上可见且有门可管的能力」。一处我自己的记录更正
本席长期把
CONTRACT_REVIEW_TIER的声明位置记作scripts/pm/dispatch-gates.mjs:8659。实测在:10023（:8659是另一个函数的}）。值'claude-fable-5-1'无误。
Generated by Claude Code
- 签名与裁定的简写不符：裁定写
- added a commit that references this issue
on Sep 7, 2026 For the services half:
cancelRunhas no cancel-side compare-and-set, and the contract now says soSurfaced by the at-tier review of PR #16563 (the spec half of this ruling) and then independently re-measured by the dev repairing it, on the branch tree with
engine.tsunchanged against merge-basef48f3f1b21. Routing rather than filing: this is the services half's to decide, and #16563 is fenced to the contract.Measured, twice, by two seats
grep -c 'cancelling' packages/services/service-automation/src/engine.ts → 0 grep -c 'resuming' … → 25 grep -c 'restoring' … → 6The only two per-process guards are resume's and restore's. There is no cancel-side one.
And the delete is unconditional.
cancelRun(engine.ts:6262) doesloadSuspendedRunStrict, thenawait this.forgetSuspendedRun(run, 'cancelled')— no third argument, noclaimAdvancecall.forgetSuspendedRun's store write isthis.store.delete(run.runId), by id, unconditional, unlessdurableRecordAlreadyConsumedis passed — and onlyresumepasses it, afterclaimAdvance(run)has done the compare-and-set (engine.ts:5566,:5626).⇒ Two cancels of one run overlapping in time both read the row, both delete it (the second delete is a no-op by id), both
recordLog('cancelled'), and both returntrue.What the spec half did about it, and what it deliberately did not
The old contract docblock claimed exclusivity the implementation does not carry:
Answers
trueonly when a suspension was consumed by THIS call …That sentence is corrected on #16563. The contract now states the truth plainly —
trueis not exclusive to the call, overlapping cancels can each answertrueand each record the terminal log, and a caller may not readtrueas sole authorship nor use it as an idempotency token for a once-only side effect. The@returnsline was already defensible and is unchanged.⚠️ Note the engine's owncancelRundocblock (engine.ts:6226-6232) never claimed exclusivity either — it says only thatfalsemeans no suspended run, treated as idempotent success. So the false claim existed only in the contract, which is exactly the surface a door gets built against.The open question, which is yours
Should the engine grow a cancel-side compare-and-set mirroring
resume'sclaimAdvance? ⛔ Not done on #16563 and deliberately not filed as its own card — the fence there was the contract sentence, and this is a behaviour decision on the services side.Two readings, both defensible, and the choice belongs with whoever owns this half:
- Leave it. Cancel is terminal and idempotent by nature; a second cancel deleting nothing is harmless, and the contract now warns callers not to over-read
true. Cheapest, and nothing today is known to depend on exclusivity. - Add the CAS. Then
truebecomes exclusive, the terminal log is written once, and the contract sentence can be strengthened back — which matters if any operator door wants to key a once-only side effect (a notification, an audit entry) off the return value. Note the door this ruling builds is exactly the kind of caller that might.
If you take the second, the contract sentence on #16563 will need revising in the same change — it is now an accurate description of current behaviour, not an eternal guarantee.
⚠️ One thing that is unprotected either wayThe corrected meaning is covered by no pin. The existing docblock pin in
automation-service.test.tsasserts/idempotent/and/could not READ/on thecancelRundoc;/idempotent/happens to land on a retained clause of the edited sentence, so the pin reads the sentence but asserts nothing about exclusivity — it was green on the old wording and is green on the new. ⇒ This correction can drift back silently. Recorded as a fact rather than fixed: adding a pin was outside #16563's repair fence, and if the CAS lands the right pin is a different one.
Generated by Claude Code
- Leave it. Cancel is terminal and idempotent by nature; a second cancel deleting nothing is harmless, and the contract now warns callers not to over-read
Unblocked — step (1) has merged
PR #16563 merged (2026-09-07 ~12:31Z); card #16495 is closed.
cancelRunandrestoreConsumedSuspensionare now declared onIAutomationService, so the services half is dispatchable.Flagging this explicitly rather than leaving it to be noticed, because this ruling has already lost time to exactly that: #16495's own body records that this card "has been sitting in
pm:queuefor two days waiting on a card nobody created — the services lane read it as 'blocked on the spec lane', when the spec lane had nothing to be blocked on." Worth one comment to not repeat it in the other direction.What landed, so the services half does not re-derive it:
- Signatures are the engine's, not the ruling's shorthand —
cancelRun(runId: string, reason?: string): Promise<boolean>andrestoreConsumedSuspension(runId: string, options?: { requestedBy?: string; reason?: string }). The optional parameters are deliberate: a door calling through the contract must be able to say who asked and why, and restore's trace records exactly that. - Route (i) — the restore result is a narrower inline structural type in spec, which the engine's wider
SuspensionRestoreResultsatisfies underimplements. Zero baselines moved (check:export-origins: 5277 exports across 17 entry points, exactly as recorded).⚠️ The refusal isrefusal?: string, a covariant widening of the engine's 8-code union — so an ADR-0112 envelope mapping refusal code → HTTP status is a non-exhaustive string switch. If you want the vocabulary closed, that is a spec card, not something to widen at a call site. - Both members optional, per the house convention (13 of 15). The contract states that a service not declaring a verb has no operator door; probing for presence and refusing fail-closed is your half, and the review confirmed that is exactly what the grading assigns here.
⚠️ Two things to carry into the door, from this comment thread above:cancelRun'strueis not exclusive (see 5570352879). The engine has no cancel-side compare-and-set, so overlapping cancels each answertrueand each write the terminal log. The contract now says so in terms. ⇒ Do not key a once-only side effect off that return value — a notification or audit entry driven bytruewill fire twice. Whether the engine should grow the CAS is still open and is yours to decide.- Suggested acceptance: pin the absent-member probe — a service not declaring the verb must produce the refusal envelope, never a 200. That is the one behaviour the contract cannot enforce on its own, and it is the half the fail-closed promise rests on.
Generated by Claude Code
- Signatures are the engine's, not the ruling's shorthand —
Contract-review handoff — PR #16755 @
c9c1c6d2b: CHANGES REQUIRED → patch round (director seat, 2026-09-08)Review: #16755 (comment) (isolated
CONTRACT_REVIEW_TIERseat).Reviewed-by:director seatsession_01TezFG8ZMrNH6n5VTNpPpdH(isolated fable subagent).Implemented-by:branchclaude/issue-13953-run-lifecycle-operator-door.Owed before re-review: F1 (blocking) — the two routes are ledgered but not mounted; register both
POSTmounts indispatcher-plugin.tsbesideresumeand show the dogfood live-mount parity test green. F2 (blocking) — re-derive the authz blind-spot census (population 80 → 82, classify both rows) and refresh the "80 rows / 21 domains" prose. F3 — record the dogfood run in 验收备注. F4/F5/F7 non-blocking (SDK follow-up card,:namesegment note, docs route tables).State: carrier removed from card and PR (review concluded); re-hang both with the patched head. Card stays
pm:dispatched, assignee unchanged.
Generated by Claude Code
Contract review recorded — PR #16755 @
34feecba7: PASS, landed by the director seat (2026-09-08 15:03Z)Review: #16755 (comment) (
claude-fable-5-1, isolated seat). Prior blocking findings F1 (routes not mounted) and F2 (authz census 80 → 82) closed on this head; governed paths: no; Clause-② yes,@objectstack/runtime: minor, no!; CI 36/36 green,mergeable_state: cleanbefore undrafting. Maintainer-only merge: no.
Reviewed-by:claude-fable-5-1isolated review seat. Implemented-by: os-trump (domain:services).Handoff:
needs:contract-reviewdropped on PR and card; PR taken out of draft; auto-merge armed (the API reportsMERGE, butorigin/mainlands every PR as a single-parent squash commit — #16780 and #16879 armed the same way earlier today landed squashed). The card closes on merge via the PR body'sFixes #13953.Carried out, not held against the PR: the three non-blocking findings (docs route tables F7/N2,
:namescoping clause F5/N5, SDK-method decision F4/N4) are filed as #16896 (domain:services,pm:queue, p3). The dogfood gate-derivation gap is already #16285.
Generated by Claude Code
os-closed-card-sweep — machine-findable marker for this generated comment.
Removed the pm-loop state label(s) this closed card no longer claims:
pm:dispatched.- Closing pull request: feat(runtime): give the two operator run-lifecycle verbs a door (cancel, restore-suspension) #16755, merged.
- Closing commit
44c849c7d6, merged intomain. - Left untouched:
priority:p2,domain:services— ownership, priority and outcome are not state claims. - The label set was read back after the write and matched.
A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.posted by half-state-patrol run 34270387866 · trigger
scheduleGenerated by Claude Code
- added a commit that references this issue
on Sep 9, 2026 - added a commit that references this issue
on Sep 10, 2026 - added a commit that references this issue
on Sep 17, 2026
Found while implementing #13909 slice 2 (PR #13951). ⛔ Not filed as a defect in that slice's own work — the gap predates it and is wider than one verb.
The reading
AutomationEnginehas two deliberate, operator-initiated run-lifecycle verbs:cancelRun(runId, reason)— end a suspended run (ADR-0044);restoreConsumedSuspension(runId, options)— put back a suspension a failed resume consumed (service-automation: a resume consumes the pause BEFORE running downstream nodes, so any node that throws leaves the run terminally unresumable — and the only inspector for it reports all clear #13909 slice 2).Neither is reachable by an operator. Measured on
origin/mainplus PR #13951:resume, the run list, run detail and the paused-run screen. There is no cancel route and no repair route, so a deployment operator holding only HTTP cannot invoke either.packages/clihas no run commands at all.IAutomationService(packages/spec/src/contracts/automation-service.ts), so a host that holds only the service contract cannot call them either — only one holding the concrete engine can.⇒ Both are host-only primitives. For
cancelRunthat has been survivable becauseplugin-approvalscalls it in-process on the revise-window recall path. For the repair verb there is no in-process caller by design — it is meant to be asked for by a person.Why this is worth its own card rather than a rider
Adding a door is not a line of routing. It needs a permission model of its own, and the wrong one is worse than none: a repair verb re-arms a run the platform recorded as terminally failed, so "who may do this" is a real question and not the same answer as "who may resume". #13909's own posture (⛔ never a door that returns success to hide the condition) applies to whatever this becomes.
A trap for whoever takes it — do NOT ship a plain lister
The obvious companion, "list the runs an operator could repair", is the one shape that must not be built naively. #13909's whole premise is that ⭐ the one inspector that should have caught this class reported all clear. A lister backed only by the engine's in-memory journal answers zero in any process that did not itself strand the run — which is almost every process an operator is looking at — and a confident zero is exactly the failure the parent card is about. PR #13951 deliberately does not ship one for that reason. A correct lister is a QUERY over
sys_automation_runterminal rows carrying a restorable snapshot, not a read of engine memory.Not measured
How many deployments have wanted either verb is unknown from this repo, and so is how many runs are in the repairable state (that needs an operator census — see #13909). This card records a reachability gap, not a demand estimate; whether it is worth building is a triage call.
Related
#13909 (the repair verb and its measurement) · PR #13951 (which adds the verb, engine-level, and states this gap as an explicit non-goal) · #13937 (the resume-ordering decision; unruled)
Generated by Claude Code