Bridged implementer may commit checkpoints; timebox-free brief for long bridged tasks (#431) - #436
Merged
Merged
Conversation
…box-free brief for long bridged tasks - Bridge safety rule now reads: the child writes code and may commit checkpoints on the branch the host names; never push, never rebase or rewrite history, never decide scope, never issue a verdict, never spawn a bridge; the host keeps push, review, flowctl done, task state, and any history rewrite (usage template, orchestration guide, running-lean pointer, CLAUDE.md/AGENTS.md routing blocks, Codex mirror regenerated) - Usage guide states the host's on-return obligation (record base, review the commit range, run the gates on that diff, host-owned squash-or-keep) and carries a brief template for long bridged tasks with no timebox - Sandbox fallback named from a live probe: codex 0.153.4 workspace-write keeps .git/ read-only (index.lock: Read-only file system); danger-full-access in the asserted repo root permits the commit, else one run per scope unit with the host committing between - Changelog entry credits @DanielKillenberger (#431) Task: fn-244-bridged-implementer-may-commit.1 Claude-Session: https://claude.ai/code/session_01JFYv5JtK8HAsshpWRAT5YL
PR SummaryLow Risk Overview The The same rule replaces “child never commits” across orchestration, running-lean, Reviewed by Cursor Bugbot for commit 1e6cd75. Configure here. |
gmickel
added a commit
that referenced
this pull request
Sep 14, 2026
7 tasks
9 tasks
gmickel
added a commit
that referenced
this pull request
Sep 14, 2026
…438) * feat(worker): bridged child owns the task; fan-out license restored; July codex caveats retired - worker.md Phase 1b: implementer tier resolved before Phase 1.5; a CLI-reached model hands the task to the bridged child via pointer prompt + usage brief, one foreground bridge call, dirty-remainder commit, base..HEAD range review, focused gates, then Phase 3; `stage: implement` line records model + delegated count - work phases.md 3c and the SECTION3C mirror heredoc: the worker bridges and the conductor never does; mirror 3c carries the implementer-tier paragraph again, with grep guards for both literals - usage.md long-task brief: "never spawn another bridge"; carries the judicious-subagent license and asks for the delegation count in the digest; no-plan-route.md names the owner as the holder wherever it runs - July "keep the child flat" caveats (usage.md self-bridge line, codex reach page shell-out row) are dated watch lines naming openai/codex#33267 with the 0.153.4 / gpt-6-astra measurements and the 0.144-0.145 reported range - fn-98 R2 folded in: codex reach page in-host row and platforms.md worker-pin note state the measured steering facts; fn-98 closed with a pointer, R4-R9 recorded as undone - STRATEGY.md "The owner holds the license"; .flow/criteria.md G3; bug memory entry for the #436 widening; CHANGELOG Unreleased entry - Codex mirror regenerated (sync-codex.sh twice, clean second run) Task: fn-245-bridge-child-owns-the-task-worker.1 Claude-Session: https://claude.ai/code/session_01JFYv5JtK8HAsshpWRAT5YL * fix(worker): carry the invocation's implementer override; align the forwarded license and the stage-line model source - work 3c dispatch (canonical + SECTION3C mirror heredoc) gains the optional IMPLEMENTER line; worker Phase 1b consults it as the highest routing rung - no-plan-route.md license names the owner as the only committer and defers the commit convention to the owner's path, so the forwarded paragraph agrees with the long-task brief's checkpoint convention - Phase 1b records `model:` from the bridge command line (never the child's self-report) and `delegated:` from the digest - Codex mirror regenerated (sync-codex.sh twice, clean second run) Review round 1 (codex, three draws): three merged findings, all addressed. Task: fn-245-bridge-child-owns-the-task-worker.1 Claude-Session: https://claude.ai/code/session_01JFYv5JtK8HAsshpWRAT5YL * fix(usage): keep the #33267 watch line identifier-free; capture the review-round memory entry - usage.md names the codex-cli versions, counts, date and issue; the model identifier stays on the codex reach page (fn-195 R2 guard) - bug memory entry for the fn-245 review round (forwarded license carried the wrong holder's commit contract) - Codex mirror regenerated (sync-codex.sh twice, clean second run) Task: fn-245-bridge-child-owns-the-task-worker.1 Claude-Session: https://claude.ai/code/session_01JFYv5JtK8HAsshpWRAT5YL * chore(flow): task receipt fn-245-bridge-child-owns-the-task-worker.1 Claude-Session: https://claude.ai/code/session_01JFYv5JtK8HAsshpWRAT5YL * chore(flow): record completion-review skip for fn-245 Claude-Session: https://claude.ai/code/session_01JFYv5JtK8HAsshpWRAT5YL * Address PR review feedback (#438) - Phase 1b: inert and unreachable branches end the phase explicitly; Done-when scoped to the bridged branch - Investigate-first rule carries the Phase 1b bridged carve-out in sibling-rule shape - Conduct checklist gains the bridged-implementer contract with its failure clause Claude-Session: https://claude.ai/code/session_01JFYv5JtK8HAsshpWRAT5YL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bridged implementer may commit checkpoints; timebox-free brief for long bridged tasks (#431)
The headless bridge recipes carried a safety rule that the bridged child never commits. A user running a one-task spec through a
codex execimplementer hit the cost of that rule: no checkpoints allowed, so host-inserted returns and a timebox that taught the implementer to return partial.Closes #431.
TL;DR
flowctl done, task state, and any history rewrite, and reviews the child's commit range on return.workspace-writekeeps.git/read-only, so a checkpointing child needsdanger-full-accessin the asserted repo root or the one-run-per-scope-unit fallback.Not in this PR (by design)
flowctl done, review backends, or the thin-wrapper recipe beyond the sentence that names the rule.work.delegate*revival, no per-bridge config key.The change, top to bottom
The bridge safety rule no longer forbids a bridged implementer from committing: the child may commit checkpoints on the branch the host names while the host keeps push, history rewrite, review, task state, and the verdict. The usage guide gains a timebox-free brief for long bridged tasks plus the sandbox-denied fallback, and every surface that restated the old rule now states the new one (issue #431).
fn-244-aid-1e6cd758bb3554f6854c9f5ee7dc02bdebf77c0d33722a4a1e6cd758003c132efc8bdb6dee1489a1835e568fLegend:
WHYPRINCIPLESTEPKEPTVERIFY·NEWMODIFIEDDELETEDRENAMEDCOPIED·CANONICALGENERATEDMECHANICALWHY0. A prohibition that bought nothing and cost nineteen dispatches — The bridge recipes said the bridged child never commits. On a one-task spec run through a codex exec implementer that left two shapes: one multi-hour run ending in a single uncommitted diff, or host-inserted returns between spec steps so the host could commit, plus a timebox line that taught the implementer to return partial. One task took nineteen dispatches with a re-brief each time. The in-host worker already commits per task and the host reviews its commit range; the bound that matters is push, rewrite, scope, and verdict, not the local commit.Evidence: source:s-spec
STEP1. The rule, restated on every canonical surface — The safety rule now reads: the bridged child writes code and may commit checkpoints on the branch the host names; it never pushes, never rebases or rewrites history, never decides scope, never issues a review verdict, and never spawns a bridge; the host keeps push, review, flowctl done, task state, and any history rewrite, and on return reviews the child's commit range from the base it recorded before dispatch. Applied to the usage template's bridge section, the orchestration guide (bridge route, host-model paragraph, field-pattern table, what-stays-fixed list), the running-lean pointer sentence, and this repo's own routing block in CLAUDE.md and AGENTS.md.Evidence: source:s-t1, source:s-c1, source:s-r1, source:s-r2, source:s-r3, R-ID:R1, R-ID:R2, R-ID:R3, task:fn-244-bridged-implementer-may-commit.1
MODIFIEDCANONICALAGENTS.mdMODIFIEDCANONICALCLAUDE.mdMODIFIEDCANONICALplugins/flow-next/docs/orchestration.mdMODIFIEDCANONICALplugins/flow-next/docs/running-lean.mdSTEP2. Usage guide: return handling, the long-task brief, the sandbox fallback — The usage template's bridge section carries the new safety rule, the host's on-return obligation (record the base, review base..HEAD, run the gates on that diff, host-owned squash or keep), a brief template for long bridged tasks that names the branch, commit convention, checkpoint unit, the five never clauses, and one return condition with an explicit warning against timeboxes, and the fallback for a sandbox that denies commits. A live probe fixed the codex wording: workspace-write keeps .git read-only, so a checkpointing child runs danger-full-access inside the asserted repo root or falls back to one run per scope unit.Evidence: source:s-t1, source:s-c1, source:s-r4, source:s-r5, R-ID:R4, R-ID:R5, task:fn-244-bridged-implementer-may-commit.1
MODIFIEDCANONICALplugins/flow-next/templates/usage.mdSTEP3. Changelog entry crediting the reporter — An Unreleased Changed entry states the old rule, the new rule, why the local commit is safe to allow, the brief template and sandbox fallback, that no hook or flowctl guard is added, and credits the reporter of issue #431.Evidence: source:s-t1, source:s-c1, source:s-r6, R-ID:R6, task:fn-244-bridged-implementer-may-commit.1
MODIFIEDCANONICALCHANGELOG.mdKEPT4. What did not change — No hook, guard, or flowctl subcommand enforces the rule; bridge safety stays prose-only per the recorded decision. The in-host worker, flowctl done, review backends, and the thin-wrapper recipe are untouched beyond the sentence that names the rule. The flow-next.dev pages that restate the rule and the reply on issue #431 (R7) are left for the downstream release walk in the site repo.Evidence: source:s-spec, source:s-t1
VERIFY5. Gate, mirror regeneration, and task state — Full parallel suite green (4991 ran), ruff clean, sync-codex.sh run twice with no drift. The Codex mirror files are regenerated output; the .flow files are the spec, the minted implicit-owner task, and its receipt.Evidence: source:s-t1, task:fn-244-bridged-implementer-may-commit.1
Generated/mechanical files (7)
NEWMECHANICAL.flow/specs/fn-244-bridged-implementer-may-commit.jsonNEWMECHANICAL.flow/specs/fn-244-bridged-implementer-may-commit.mdNEWMECHANICAL.flow/tasks/fn-244-bridged-implementer-may-commit.1.jsonNEWMECHANICAL.flow/tasks/fn-244-bridged-implementer-may-commit.1.mdMODIFIEDGENERATEDplugins/flow-next/codex/docs/flow-next/orchestration.mdMODIFIEDGENERATEDplugins/flow-next/codex/docs/flow-next/running-lean.mdMODIFIEDGENERATEDplugins/flow-next/codex/templates/usage.mdCritical changes
plugins/flow-next/templates/usage.md— the user-facing rule and the new brief template; highest churn among canonical files, and the source the Codex mirror is generated from.plugins/flow-next/docs/orchestration.md— four places restate the rule: the bridge route, the host-model paragraph, the field-pattern table, and the "what stays fixed" list.CLAUDE.mdandAGENTS.md— this repo's own routing block, read by every development session.How to review this PR
The pipeline already verified this — you don't re-check it from scratch:
sync-codex.shidempotent; live probe of codex 0.153.4 sandbox commit behaviour recorded in the task evidence.Your job — the calls the pipeline can't make:
danger-full-accessfor a checkpointing codex child is acceptable, given the asserted-repo-root guard around it.Review plan
Must review (~15%)
plugins/flow-next/templates/usage.md— high-churn canonical file and the shipped user-facing recipe — Does the brief template give a bridged child exactly the five never clauses and one return condition, with nothing that reads as a timebox? — open the "Long bridged tasks" paragraph and thetextfence below it.plugins/flow-next/docs/orchestration.md— the canonical guide restates the rule in four places — Do all four say the same thing, and does "the host keeps git" survive nowhere? — open "Two rules survive from the packaged path".CLAUDE.md/AGENTS.md— instruction files every session reads — Is the routing-block sentence identical in both files? — open the model-routing block.Spot-check
CHANGELOG.md— one Unreleased entry; check the reporter credit and that the old and new rule are both stated.plugins/flow-next/docs/running-lean.md— one pointer sentence.Safe to skim (~85%)
plugins/flow-next/codex/— regenerated bysync-codex.sh, idempotent on a second run — skim..flow/specs/and.flow/tasks/— spec, minted implicit-owner task, and its receipt; task-state, not hand-written code — skim.Decisions made
No decision-track memory entries were written for this spec. The rationale lives in the spec's Decision Context and the changelog entry: a local commit is reversible and reviewable; push, rewrite, scope, and verdict are the bounds that matter. The standing decision that bridge safety is prose-only (recorded 2026-08-14) is unchanged.
Open items
plugins/flow-next/docs/release-history.mdstill describes the old rule as history under 4.0.0; it is append-only and gets its line when the release that carries this change is cut.Generated by
/flow-next:make-prfrom fn-244-bridged-implementer-may-commit againstorigin/mainon 2026-09-14.https://claude.ai/code/session_01JFYv5JtK8HAsshpWRAT5YL