Repository navigation
Conversation
|
Implementation completed for #389 at The final configured suite passed: 2,158 tests, one skip, exit 0. The current focused acceptance suite passed all 23 tests; package validation and unchanged configuration/sandbox checks passed. Verification is agent-reported, tests version 2, with AC-1–AC-6 covered by the frozen checks listed in the PR description. Broader static-analysis limitations are disclosed there.
Checks of this exact pushed head were read once under the parallel policy: 0 passed, 0 failed, 5 pending — Skills, manifests, and Bash installer; Windows test shard (windows-1); Windows test shard (windows-2); Windows test shard (windows-3); Windows test shard (windows-4). The cycle CI gate owns the wait. Closes #389. Resumed production stages now honor recorded quota exhaustion and explain the fallback selection. Complete reset dates, ordinal days, offsets and local DST rules are retained; ambiguous dated resets require an explicit operator retry, while missing reset information keeps the minimum 30-minute window. Dirty PR resumes require an exact ownership checkpoint bound to the work item, stage, PR, HEAD, executors and complete staged/unstaged/untracked fingerprint. Checkpoints survive quota expiry, allowing the original executor to resume after expiry. A matching fallback receives the existing changes intact and instructions to inspect them. Unrelated or altered edits are refused. Legacy worktrees have a scoped, confirmed, single-use operator attestation; new unattested work cannot use it. The PR-head guard, DiagnosisClassification: The related-work search covered the issue's links and open/recently closed quota/fallback items, including #338, #330 / PR #384, #285, #262, #173 and #281. This change provides recovery support for #384 without editing that worktree or asserting that its findings are resolved. Work units
Routing, operator CLI and stored schema behavior are documented in Verification (agent-reported)Checks were frozen before execution, using tests version 2 and stable criterion links:
An additional diff check confirms
Security
Implementation run: schema:2; profile:deep_coder; requested:openai/gpt-6.1-sol; effort:medium; resolved:?. CI policy is parallel; pushed-head checks are read once and remain the cycle gate's responsibility. |
[CCR-20261102-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2Initial review — PR #392 (closes #389)Verdict: CHANGES_REQUESTED at Summary and scopeReviewed the complete accumulated diff The routing change (every production route honours active quota rows, including Findings[REV-001] · high · open · - · blocks:yes — Windows: every clock-only reset becomes
|
| Check ID | Command | Result | Criteria |
|---|---|---|---|
| configured-test | python3 -m unittest discover -s tests |
exit 0; Ran 2158 tests in 246.305s — OK (skipped=1) on Linux |
AC-1, AC-3, AC-4, AC-5 (through test_quota_resume) |
| package-validation | python3 scripts/validate-package.py |
exit 0; VALID: 16 skills (7 cycle, 9 supporting), shared sections in sync, cross-agent manifests aligned |
package integration |
| unittest-default | python3 -m unittest |
exit 0; Ran 0 tests (no discovery from the repository root; proves nothing) |
— |
| configuration-invariant | git diff --stat 0627722..4028252 |
.code-cycle.yml, scripts/sandbox.py, scripts/native_sandbox.py and scripts/executors.py are absent from the 14 changed files |
AC-6 |
Acceptance criteria:
- AC-1: met.
test_from_resume_skips_recorded_primarypasses, and the decision reasons name the substitution. - AC-2: open. The Linux tests pass, but see REV-001 (Windows) and REV-002 (earlier resets for parenthesised zones, weekdays and relative durations).
- AC-3: met. The stop advice
--from resolve --pr 384is accepted byrun_cycle.py --dry-run(test_stop_advice_is_accepted_at_the_real_cli_boundary). - AC-4: met.
GitHandoffTestscover byte-exact staged, unstaged and untracked content, an unchanged HEAD, the record of both executors and the fingerprint, and refusal of altered or unrelated diffs. - AC-5: met.
test_ordinary_dirty_executor_change_is_refusedpasses. - AC-6: met (diff stat above).
Unverified
- REV-001 and REV-002 are established by code trace only. This stage's command table denies ad-hoc
python3 -cand helper scripts, so no reproduction was executed. REV-001 matches the failing Windows shard, whose log (gh run view --log-failed) is also outside the command table. - No live provider quota messages were exercised.
CI (parallel policy; read once at 4028252, not awaited)
| Check | State |
|---|---|
| Skills, manifests, and Bash installer | pass |
| Windows test shard (windows-1) | pending |
| Windows test shard (windows-2) | fail (7m53s) |
| Windows test shard (windows-3) | pass |
| Windows test shard (windows-4) | pending |
The cycle's CI gate owns these states. Not every required check has passed.
Residual risk
quota_resetis a hand-written grammar over free provider text. Formats not listed here may still fall through. The conservative-fall-through fix in REV-002 is what bounds this risk.- When a quota failure happens and a PR is known,
snapshot()now runs one extra time (cycle.py:958), even for read-only stages wherebeforeisNone. This costs extraghcalls but does not change correctness.
[CCR-20261102-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-001] · deep_coder · openai/gpt-6.1-sol→? · high · triaged:4028252bd648ecc03424de2709236ad7a878df6f · schema:2Triage is frozen before source edits at the reviewed PR head. All three findings are valid; no earlier resolver dispositions exist. The complete supplied 1,182-line accumulated diff and provider-authenticated review were inspected. No review threads exist. [REV-001] · high · open · valid · blocks:yes — Restore platform-local reset conversionConfirmed: missing [REV-002] · medium · open · valid · blocks:yes — Reject unresolved reset formats conservativelyConfirmed: parenthesized zones, weekdays and relative durations can silently become earlier resets. Add parsing/refusal and regressions before recording resolution. [REV-003] · low · open · valid · blocks:no — Correct later-stage availability documentationConfirmed: the owning routing page incorrectly says later stages retain availability after recorded quota exhaustion. Verification obligations are frozen before execution (agent-reported results will follow). All checks retain executor
Post-change delegated code review and |
[CCR-20261102-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-001] · deep_coder · openai/gpt-6.1-sol→? · high · triaged:4028252bd648ecc03424de2709236ad7a878df6f · schema:2Resolution: RESOLVED. All three dispositions were frozen as valid before edits and remain unchanged. Fix commit: [REV-001] · high · resolved · valid · blocks:yes — Restore platform-local reset conversionWhen IANA lookup is unavailable (including Windows without [REV-002] · medium · resolved · valid · blocks:yes — Reject unresolved reset formats conservativelyTimezone suffixes must match completely. Parenthesized UTC offsets and IANA zones are interpreted explicitly; ambiguous abbreviations, malformed parentheses and trailing unknown text are refused. Weekday-only dates and relative-duration messages remain [REV-003] · low · resolved · valid · blocks:no — Correct later-stage availability documentation
Verification is agent-reported, tests version 2. The four required checks were frozen before execution with their runtime identities unchanged:
The focused check includes actual disposable Git repositories, byte-exact dirty handoffs with unchanged HEAD, altered/unrelated diff refusals, ordinary dirty executor-change refusal, and real CLI invocation. AC-1 through AC-6 each have a required check; none is left uncovered. Agent-reported frozen check results (tests.version=2){
"version": 2,
"ran": true,
"passed": true,
"conclusion": "verified_with_reservations",
"boundary": "required",
"checks": [
{
"id": "configured-test",
"command": "python3 -m unittest discover -s tests",
"executor": "codex",
"profile": "deep_coder",
"context": "project",
"required": true,
"criteria": [],
"level": "test",
"provenance": "project",
"reason": "configured test command",
"head_sha": "bf7672096b0296c4cc56a6a89ed598fc9ff85e4d",
"result": "pass",
"evidence": [
{
"exit_code": 0,
"executed": 2160,
"skipped": 1
}
],
"cause": null,
"attempts": [
{
"exit_code": 0,
"executed": 2160,
"skipped": 1
}
]
},
{
"id": "quota-regressions",
"command": "python3 -m unittest discover -s tests -p test_quota_resume.py",
"executor": "codex",
"profile": "deep_coder",
"context": "project",
"required": true,
"criteria": [
"AC-1",
"AC-2",
"AC-3",
"AC-4",
"AC-5"
],
"level": "boundary",
"provenance": "acceptance",
"reason": "quota routing, CLI and real Git handoff regressions",
"head_sha": "bf7672096b0296c4cc56a6a89ed598fc9ff85e4d",
"result": "pass",
"evidence": [
{
"exit_code": 0,
"executed": 25
}
],
"cause": null,
"attempts": [
{
"phase": "before_fix",
"head_sha": "4028252bd648ecc03424de2709236ad7a878df6f",
"exit_code": 1,
"executed": 25,
"failures": 16
},
{
"phase": "after_fix",
"exit_code": 0,
"executed": 25
},
{
"phase": "final_tree",
"exit_code": 0,
"executed": 25
}
]
},
{
"id": "package-validation",
"command": "python3 scripts/validate-package.py",
"executor": "codex",
"profile": "deep_coder",
"context": "project",
"required": true,
"criteria": [],
"level": "static",
"provenance": "project",
"reason": "package validation",
"head_sha": "bf7672096b0296c4cc56a6a89ed598fc9ff85e4d",
"result": "pass",
"evidence": [
{
"exit_code": 0,
"executed": null
}
],
"cause": null,
"attempts": [
{
"exit_code": 0,
"executed": null
}
]
},
{
"id": "configuration-invariant",
"command": "git diff --exit-code 06277226a18f5fd7d427e700a896ca97deafec62 -- .code-cycle.yml scripts/sandbox.py scripts/native_sandbox.py",
"executor": "codex",
"profile": "deep_coder",
"context": "project",
"required": true,
"criteria": [
"AC-6"
],
"level": "static",
"provenance": "acceptance",
"reason": "routing configuration and sandbox settings remain unchanged",
"head_sha": "bf7672096b0296c4cc56a6a89ed598fc9ff85e4d",
"result": "pass",
"evidence": [
{
"exit_code": 0,
"executed": null
}
],
"cause": null,
"attempts": [
{
"exit_code": 0,
"executed": null
}
]
}
]
}The mandatory delegated
Supplemental static analysis: Residual limitations: local execution was Linux; the missing-IANA platform path was exercised, but native Windows execution and live provider quota messages were not. The parser still supports a bounded provider-text grammar. Tests use disposable Git identities rather than the user's global identity. The suite's one skip remains a skip. Dependency preparation was already successful; no dependency or lifecycle installation was run here. CI policy is parallel. The exact pushed head was read once; 0 passed, 0 failed, 5 pending:
The cycle's CI gate owns the wait; this resolution does not declare approval. |
[CCR-20261102-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-001] · deep_coder · openai/gpt-6.1-sol→? · high · triaged:4028252bd648ecc03424de2709236ad7a878df6f · schema:2[CCR-20261102-002] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2Re-review — PR #392 (closes #389)Verdict: REVIEW_PASSED_AWAITING_CI at What changed since the previous review (
|
| Check ID | Command | Result | Criteria |
|---|---|---|---|
| configured-test | python3 -m unittest discover -s tests |
pass — exit 0; Ran 2160 tests in 345.631s — OK (skipped=1) |
— |
| quota-regressions | python3 -m unittest discover -s tests -p test_quota_resume.py |
pass — exit 0; Ran 25 tests in 3.204s — OK |
AC-1, AC-2, AC-3, AC-4, AC-5 |
| package-validation | python3 scripts/validate-package.py |
pass — exit 0; VALID: 16 skills (7 cycle, 9 supporting), shared sections in sync, cross-agent manifests aligned |
— |
| configuration-invariant | git diff --exit-code 06277226a18f5fd7d427e700a896ca97deafec62 -- .code-cycle.yml scripts/sandbox.py scripts/native_sandbox.py |
pass — exit 0, empty diff | AC-6 |
All checks ran on Linux at bf7672096b0296c4cc56a6a89ed598fc9ff85e4d.
Acceptance criteria: AC-1 met, AC-2 met (REV-001 and REV-002 resolved), AC-3 met, AC-4 met, AC-5 met, AC-6 met. Every criterion has a passing required check.
Unverified
- Native Windows was not executed locally. CI shard
windows-4runstest_quota_resumeandtest_cycleamong about 30 modules, and it failed on this head. Its log is not readable from this stage's command table (gh run view --log-failedis not permitted), so the failure is unattributed. The same parser and message (reset at 9:46 PM) pass natively inwindows-2, which argues against REV-001 as the cause, but that is not proof. - No live provider quota messages were exercised.
CI (parallel policy; read once at bf76720, not awaited)
| Check | State |
|---|---|
| Skills, manifests, and Bash installer | pass (5m11s) |
| Windows test shard (windows-1) | pending |
| Windows test shard (windows-2) | pass (6m55s) |
| Windows test shard (windows-3) | pass (11m11s) |
| Windows test shard (windows-4) | fail (9m2s) |
Not every required check has passed. The cycle's CI gate owns these states and turns a failure into work for the next resolution.
Residual risk
-
quota_resetis still a hand-written grammar over free provider text. The fall-throughs are now conservative, so unknown forms make the executor unavailable untilquota_state.py retryrather than producing an earlier reset. Two forms that are not ambiguous are still treated as ambiguous:- An hour-only clock without minutes, such as
resets 3pm (Europe/Madrid). The clock regex requires:MM. - A digit elsewhere in a dateless prefix, such as
5-hour limit · resets 3:20pm.
Neither breaks the "never earlier" half of AC-2. If a provider emits them, the cost is an operator retry.
- An hour-only clock without minutes, such as
-
On Windows with an IANA-style
TZset but notzdatapackage,local_zone()now falls back to the C runtime, which does not understand IANA names. This is a rare configuration and does not affect the default Windows path.
CI diagnosis on head
|
The GitHandoffTests helpers opened telemetry.sqlite with a bare 'with sqlite3.connect(...)', which commits but never closes. Since Python 3.11 an unclosed connection can survive until the cyclic collector runs, so on Windows (CI Python 3.15.1) TemporaryDirectory cleanup failed with WinError 32 in eight tests. Close every connection with contextlib.closing and fail, where /proc/self/fd exists, any handle still open in the fixture directory before it is removed.
[CCR-20261102-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-001] · deep_coder · openai/gpt-6.1-sol→? · high · triaged:4028252bd648ecc03424de2709236ad7a878df6f · schema:2[CCR-20261102-002] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-002] · deep_coder · anthropic/claude-opus-5-5→? · high · triaged:bf7672096b0296c4cc56a6a89ed598fc9ff85e4d · schema:2Resolution round — CI failure on
|
| Check ID | Command run | Result | Criteria |
|---|---|---|---|
| configured-test | python3 -m unittest discover -s tests |
pass — exit 0; Ran 2160 tests in 651.542s · OK (skipped=1) |
— |
| quota-regressions | python3 -m unittest discover -s tests -p test_quota_resume.py |
pass — exit 0; Ran 25 tests · OK |
AC-1, AC-2, AC-3, AC-4, AC-5 |
| package-validation | python3 scripts/validate-package.py |
pass — exit 0; VALID: 16 skills (7 cycle, 9 supporting), shared sections in sync, cross-agent manifests aligned |
— |
| configuration-invariant | git diff --exit-code 06277226a18f5fd7d427e700a896ca97deafec62 -- .code-cycle.yml scripts/sandbox.py scripts/native_sandbox.py |
pass — exit 0, empty diff | AC-6 |
All four ran on Linux against the committed tree. git diff --check passed. Every criterion, AC-1 through AC-6, has a passing required check. The runs share no user-global state with CI: the fixtures set their own Git identity and use their own temporary directories. They do not share CI's platform or interpreter (Linux with Python 3.10 here, Windows with Python 3.15 in CI).
Post-change review and security triage
- Delegated
cc-code-reviewof the fix delta from the trusted rereview basebf7672096b0296c4cc56a6a89ed598fc9ff85e4d. That base was the HEAD at triage, so it is an ancestor of the new head. The review found no P0–P2 issues and raised two P3 notes:- It could not see a negative control for the guard. The deliberate-leak probe above provides one.
- It suggested a docstring note against adding
gc.collect()to the guard. Not applied: it would only change a comment, and the guard's docstring already says to close every connection.
- Security: the runtime plan does not require an audit (
security_required=false). The only changed path istests/test_quota_resume.py, which matches neither the mandatory minimum nor any sensitive area, socc-security-reviewdid not run (security_audit_ran=false). - Docs: this round changes only a test; there is no visible behaviour, command, schema or configuration change, so no
docs/page needs updating.
CI (parallel policy; read once, not awaited)
When I read the checks once, no check was registered on 33e07cd65a6c0dd0fcc67029cca42e303f62bd30 yet: 0 passed, 0 failed, 0 pending. The workflows had not started, so this is not a pass. The cycle's CI gate owns the wait. This resolution does not declare approval.
Residual risk
- The Windows-only leak cannot be reproduced on the local Python 3.10, so whether it is fixed rests on the
windows-4shard of33e07cd. - From the review, outside this change:
Telemetry._connect(scripts/telemetry.py) would leak its connection ifPRAGMA foreign_keysraised before returning. No test reaches that path.
[CCR-20261102-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-001] · deep_coder · openai/gpt-6.1-sol→? · high · triaged:4028252bd648ecc03424de2709236ad7a878df6f · schema:2[CCR-20261102-002] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-002] · deep_coder · anthropic/claude-opus-5-5→? · high · triaged:bf7672096b0296c4cc56a6a89ed598fc9ff85e4d · schema:2[CCR-20261102-003] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2Re-review — PR #392 (closes #389)Verdict: APPROVED at What changed since the previous review (
|
| Check ID | Command | Result | Criteria |
|---|---|---|---|
| configured-test | python3 -m unittest discover -s tests |
pass — exit 0; Ran 2160 tests in 447.839s · OK (skipped=1) |
— |
| quota-regressions | python3 -m unittest discover -s tests -p test_quota_resume.py |
pass — exit 0; Ran 25 tests in 4.158s · OK |
AC-1, AC-2, AC-3, AC-4, AC-5 |
| package-validation | python3 scripts/validate-package.py |
pass — exit 0; VALID: 16 skills (7 cycle, 9 supporting), shared sections in sync, cross-agent manifests aligned |
— |
| configuration-invariant | git diff --exit-code 06277226a18f5fd7d427e700a896ca97deafec62 -- .code-cycle.yml scripts/sandbox.py scripts/native_sandbox.py |
pass — exit 0, empty diff | AC-6 |
All four ran on Linux in this stage's disposable clone at 33e07cd65a6c0dd0fcc67029cca42e303f62bd30.
Acceptance criteria: AC-1 through AC-6 are all met, and each one has a passing required check.
Unverified
- Native Windows was not run locally, and neither was the Python 3.11+ cyclic-collection behaviour behind the original leak (local Python 3.10). CI shard
windows-4passing on this head is the evidence for that part. - No live provider quota messages were exercised.
CI (parallel policy; read once at 33e07cd, not awaited)
| Check | State |
|---|---|
| Skills, manifests, and Bash installer | pass (8m34s) |
| Windows test shard (windows-1) | pass (9m49s) |
| Windows test shard (windows-2) | pass (7m26s) |
| Windows test shard (windows-3) | pass (9m44s) |
| Windows test shard (windows-4) | pass (9m55s) |
| PowerShell installer | pass (1m3s) |
6 passed, 0 failed, 0 pending (run 41481918962; statusCheckRollup head 33e07cd65a6c0dd0fcc67029cca42e303f62bd30).
Residual risk
quota_resetis still a hand-written grammar over free provider text. Two forms that are not actually ambiguous are still refused: an hour-only clock such as3pm, and a digit in a dateless prefix such as5-hour limit · resets 3:20pm. Both refusals are conservative and cost only an operatorquota_state.py retry.- On Windows with an IANA
TZbut notzdata, conversion falls back to the C runtime. This configuration is rare. - Outside this change:
Telemetry._connectwould leak its connection ifPRAGMA foreign_keysraised before returning. No path reaches that today.
Docs: this round changed only a test, so no docs/ page needs updating. The accumulated behaviour is documented in docs/routing.md, docs/telemetry.md and docs/instrumentation.md.
Run: schema:2; profile:senior_reviewer; requested:anthropic/claude-opus-5-5; effort:high; resolved:?.
Code Cycle rereview — PR #392 (work item #389)[CCR-20261102-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-001] · deep_coder · openai/gpt-6.1-sol→? · high · triaged:4028252bd648ecc03424de2709236ad7a878df6f · schema:2[CCR-20261102-002] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-002] · deep_coder · anthropic/claude-opus-5-5→? · high · triaged:bf7672096b0296c4cc56a6a89ed598fc9ff85e4d · schema:2[CCR-20261102-003] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCR-20261103-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2Status: What changed since the previous reviewThe previous rereview (CCR-20261102-003) approved head Accumulated review
No new findings. Previous findings[REV-001] · high · resolved · valid · blocks:yes — Windows: every clock-only reset becomes
|
| Check | Criteria | Result | Evidence |
|---|---|---|---|
configured-test (codex/deep_coder, project) |
— | pass | python3 -m unittest discover -s tests: exit 0, Ran 2160 tests, OK (skipped=1) |
quota-regressions (codex/deep_coder, project) |
AC-1…AC-5 | pass | python3 -m unittest discover -s tests -p test_quota_resume.py -v: exit 0, Ran 25 tests, OK; also included in the full suite |
package-validation (codex/deep_coder, project) |
— | pass | python3 scripts/validate-package.py: exit 0, VALID: 16 skills (7 cycle, 9 supporting)… |
configuration-invariant (codex/deep_coder, project) |
AC-6 | pass | git diff --stat 3f356ac..9b15fd9 -- .code-cycle.yml .claude .codex .agents AGENTS.md CLAUDE.md .github: exit 0, empty |
Criterion coverage:
- AC-1:
test_from_resume_skips_recorded_primary,test_resolve_escalation_cannot_restore_exhausted_target. - AC-2: the
ResetTestsclass. - AC-3:
test_stop_advice_is_accepted_at_the_real_cli_boundary, which runsrun_cycle.py --from resolve --pr 384 --dry-run. - AC-4:
test_dirty_fallback_receives_exact_bytes_and_head_with_auditandtest_altered_staged_unstaged_or_untracked_diff_is_refused. - AC-5:
test_ordinary_dirty_executor_change_is_refused. - AC-6: the invariant diff above.
Note: python3 -m unittest tests.test_quota_resume run from the repository root fails with ModuleNotFoundError: No module named 'test_cycle'. This is the suite's existing discover -s tests layout and not a defect of this change: five other modules use the same from test_cycle import.
Unverified: none.
CI (read once, not awaited; parallel policy)
Run 41638080129, "Validate package":
- Skills, manifests, and Bash installer: pass
- Windows test shard (windows-2): pass
- Windows test shard (windows-3): pass
- Windows test shard (windows-1): pending
- Windows test shard (windows-4): pending
Residual risk and verdict
The resume logic depends on the Git porcelain fingerprint from executors._workspace_fingerprint. The tests use a real repository, but no real Windows run of the handoff path has been observed beyond the CI shards. Two Windows shards were still pending.
Verdict: the review of this head passed with no blocking finding. The cycle's CI gate still has to confirm the required checks before approval.
Rereview — PR #392 (work item #389)[CCR-20261102-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-001] · deep_coder · openai/gpt-6.1-sol→? · high · triaged:4028252bd648ecc03424de2709236ad7a878df6f · schema:2[CCR-20261102-002] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCT-20261102-002] · deep_coder · anthropic/claude-opus-5-5→? · high · triaged:bf7672096b0296c4cc56a6a89ed598fc9ff85e4d · schema:2[CCR-20261102-003] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCR-20261103-001] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2[CCR-20261103-002] · senior_reviewer · anthropic/claude-opus-5-5→? · high · schema:2Verdict: APPROVED for head What changed since the previous reviewThe head has not moved since the previous rereview (CCR-20261103-001), which had reviewed Accumulated reviewI read the complete accumulated diff in sections: 1,252 lines, base
No new finding. Previous findings[REV-001] · high · resolved · valid · blocks:yes — Windows: every clock-only reset becomes
|
| Check | Criteria | Command run | Result |
|---|---|---|---|
configured-test (codex/deep_coder, project, required) |
— | python3 -m unittest discover -s tests |
pass — exit 0, 2,160 tests, OK (1 skip) |
quota-regressions (codex/deep_coder, project, required) |
AC-1–AC-5 | python3 -m unittest discover -v -s tests -p test_quota_resume.py |
pass — exit 0, 25 tests OK |
package-validation (codex/deep_coder, project, required) |
— | python3 scripts/validate-package.py |
pass — exit 0, VALID: 16 skills (7 cycle, 9 supporting)… |
configuration-invariant (codex/deep_coder, project, required) |
AC-6 | git diff --exit-code --stat 3f356ac… HEAD -- .code-cycle.yml .claude .codex .agents AGENTS.md CLAUDE.md |
pass — exit 0, no diff |
quota-regressionscommand. The runtime froze this check's command as a hash, so I ran the acceptance module directly.- Module-path error. A first attempt with
python3 -m unittest tests.test_quota_resume …failed to import the module: it importstest_cycleas a top-level module. That was a problem with how I invoked it, not a product failure; the other three modules in that run passed 136 tests. Rerunning through discovery passed. - AC-6. The comparison used merge base
3f356ac, because this clone has noorigin. - Coverage. Every acceptance criterion (AC-1–AC-6) is covered by a passing required check. Conclusion:
verified.
CI (code host, head 9b15fd9)
6 passed, 0 failed, 0 pending — Skills, manifests, and Bash installer; Windows test shard (windows-1) through (windows-4); PowerShell installer. All succeeded.
Residual risk
Legacy attestation depends on the operator actually inspecting the diff before confirming its fingerprint; the tool records this as operator_attested, never as functional verification. The reset parser's coverage of real provider messages is limited to the forms the tests exercise. Anything else becomes reset_time_ambiguous, which is the safe direction.
Closes #389.
Resumed production stages now honor recorded quota exhaustion and explain the fallback selection. Complete reset dates, ordinal days, offsets and local DST rules are retained; ambiguous dated resets require an explicit operator retry, while missing reset information keeps the minimum 30-minute window.
Dirty PR resumes require an exact ownership checkpoint bound to the work item, stage, PR, HEAD, executors and complete staged/unstaged/untracked fingerprint. Checkpoints survive quota expiry, allowing the original executor to resume after expiry. A matching fallback receives the existing changes intact and instructions to inspect them. Unrelated or altered edits are refused. Legacy worktrees have a scoped, confirmed, single-use operator attestation; new unattested work cannot use it. The PR-head guard,
.code-cycle.yml, sandbox code and permission policies are unchanged.Diagnosis
Classification:
shared_cause; decision:implement_root_fix. Quota eligibility was loaded only for implementation continuations, reset parsing retained only a clock, and no durable ownership checkpoint distinguished an exhausted executor's work from unrelated edits. Two regression tests reproduced primary redispatch and the dropped ordinal date before editing; both failed initially. The root fix separates quota availability from durable worktree ownership rather than introducing WIP commits or relaxing the HEAD guard.The related-work search covered the issue's links and open/recently closed quota/fallback items, including #338, #330 / PR #384, #285, #262, #173 and #281. This change provides recovery support for #384 without editing that worktree or asserting that its findings are resolved.
Work units
test_quota_resume, existing cycle/outcome/schema/installation suitesRouting, operator CLI and stored schema behavior are documented in
docs/routing.md,docs/telemetry.mdanddocs/instrumentation.md. README links the new operator entry point.Verification (agent-reported)
Checks were frozen before execution, using tests version 2 and stable criterion links:
python3 -m unittest discover -s tests -p test_quota_resume.pypython3 -m unittest discover -s testspython3 scripts/validate-package.pygit diff --exit-code 06277226a18f5fd7d427e700a896ca97deafec62 -- .code-cycle.yml scripts/sandbox.py scripts/native_sandbox.pyAn additional diff check confirms
scripts/executors.py, native prerequisites, stage permission policy and.claude/.codexare unchanged. The installed CLI process tests passed (18 tests), stage dispatch passed (49), cycle tests passed (66), and outcome tests passed (55). Disposable Git fixtures set their own commit identity and exercise staged binary content, unstaged edits, untracked files, expiry, repeated exhaustion, mismatches, operator recovery and the actual CLI parser.basedpyright --level error scripts/quota_state.pypasses with zero errors. Broader static analysis has reservations: shared-module analysis was interrupted without diagnostics after a prolonged run; the new unittest file reports seven fixture initialization/import convention diagnostics. No type-check configuration was changed. No live provider quota was spent, and the historical PR #384 worktree was not modified. The one full-suite skip is retained as a skip, not a pass.Security
cc-security-reviewran;security_audit_ran=true. No confirmed vulnerabilities found in the scoped audit. Reviewed SQL parameter binding, argv subprocess calls, operator identity, exact fingerprint/scope validation, atomic single-use attestation claims, journal redaction and unchanged isolation controls. Local telemetry and the authenticated operator remain trusted boundaries; ownership evidence does not verify file correctness.Implementation run: schema:2; profile:deep_coder; requested:openai/gpt-6.1-sol; effort:medium; resolved:?. CI policy is parallel; pushed-head checks are read once and remain the cycle gate's responsibility.