[abrichr]

Draft. It is stacked on three things:

• the self-repair bridge branch claude/self-repair-bridge (on feat(flow): self-repair a halted run under one person's approval #1265), which is the base here;
• feat(flow): Harness² benchmark adapter scored by read-back #1299 (the read-back scorer);
• feat(flow): Meta-Harness-style trace export for GUI rollouts #1300 (traces), merged in.

The diff against this base therefore also shows #1299 and #1300. Once those land, I'll retarget this PR to main. This PR's own files are repair/staging_search.py, tests/test_staging_search.py, the menu2 drift in mockmed/static/app.js, and a section in docs/HARNESS2.md.

Why

Self-repair probes a proposed fix up to the last point before the save, then stops. That shows the bridge reaches the save on the right record. It can't show what the save writes. Two bridges can look the same up to the save and still write different records.

What this adds

openadapt_flow.repair.staging_search does the following for each candidate bridge, on a resettable staging copy of the app:

1. Runs SelfRepair with that one bridge (halt, patch, probe, campaigns) and stops at the approval request, which nobody answers.
2. Runs the patched bundle end to end on a fresh copy, through the save.
3. Reads the copy's store with the reward worker and scores it, using the same search reward as feat(flow): Harness² benchmark adapter scored by read-back #1299.

StagingSearchAgent is a RepairAgent. It hands production self-repair one proposal: the best candidate that verified on staging, or none. After that the pipeline is unchanged: production probe, campaigns, one person's approval, staged, canary, active. The search never opens a production session. It uses only SelfRepair's public API and adds nothing to self-repair itself.

• Candidate proposers:
  • ScriptedBridges for tests.
  • ModelBridges: reads the halted step, the controls OCR finds on the live screen, and the full traces of the halted run and the last N verified runs (traces.from_flow_run). It answers with control labels, which are mapped to screen points, so it never invents coordinates.
• MockMed ?drift=menu2: the save moved into a menu with two save paths, Billing > Submit encounter (Triage) and Clinical > Submit as Consult. Both pass self-repair's probe.

Tests

tests/test_staging_search.py uses self-repair's own MockMed fixtures, with a separate staging server:

• End to end: on staging, the Consult path writes a Consult record (wrong value, -0.5) and the Billing path verifies (1.0). Production self-repair then receives only the Billing bridge, a person approves it on the phone, the resumed run is VERIFIED, and production holds exactly one Triage record.
• No verified candidate: the agent proposes nothing, and it proposes at most once.
• ModelBridges: maps labels to points, and the halted trace reaches the prompt.

All three pass locally (about 3 minutes, because of the tutorial recording).

Coordination: self-repair owns the bridge mechanics. Pre-approved repairs owns auto-promotion. This PR changes neither.

🤖 Generated with Claude Code

[abrichr]

The self-repair bridge branch is now #1325. This PR stays a draft on top of it: the staging search was deferred by the founder's decision on 2026-10-18. The names it uses (RepairProposal(actions=), SelfRepairResult.patched_bundle, the tests.test_self_repair helpers) are unchanged there.

[abrichr]

Closing as stale during PR cleanup; superseded by later work. Reopen if still needed.