fix(standing): approve worktree isolation explicitly and retain unfinished work

[santoshkumarradha]

Isolated work approval and scheduled execution — recorded on Spark

Goal: Use the pantry project to preview a higher shopping threshold in a retained Git worktree, keeping the original project clean and avoiding an unsafe ordinary one-time execution path.

Observed outcome: The isolated weekly approval card offered schedule or decline, with no Only now option. A later corrected one-time schedule ran through the normal five-minute ticker in a scheduler-created retained worktree. Its uncommitted shopping-list.md added tea at threshold six; the original main remained clean at 343452d8a82209ca0207c13fa363e2e0666b9367. Four independent artifact tests passed and both one-time orders retired.

Watch the workflow (MP4) · Animated GIF · Original terminal recording (.cast)

Evidence: tested revision 7f7f05a6199fef1855f1a805e76ffee189acc9d5; Spark session critical-extended-1560guard-v2. Execution/binary identity, model receipts, checksums and playback details. All 85 recorded calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary calls. Artifact verification, artifact test output, final standing state, coverage and limitations. Spark make pr-ready and GitHub run 36334512416 passed for this revision.

Playback and limits: Original .cast is preserved; GIF/MP4 play at 3× speed with idle intervals capped at 3 seconds. The first operator-supplied CLI command used an incorrect positional output path and failed. The recording preserves that failure, the model’s manual recovery and the corrected scheduled run. Helpers initially over-investigated; the operator interrupted and redirected them. Only the audited main terminal recording is published; private helper transcripts are excluded. Model Pool was off, and background installation was explicitly off for this profile to protect the shared timer. This branch still uses reminder wording for scheduled tasks; separately tested PR #1612 corrects that label. Isolated Once is intentionally unavailable; combining #1560 and #1612 must retain this guard. Explicit paths are not sandboxed, and watch/probe Once is not claimed verified.
Technical acceptance does not resolve the separate shared-timer ownership/cleanup blocker from earlier testing; readiness remains held by the coordinating task.

Supplemental correction verified in separate PR #1612

Separate PR #1612 corrects the old one-off task card wording noted below. Its live task card says Run it then / Runs the work then. The isolated-run evidence below remains the original #1560 revision.

Tested revision f855f2e6510c155b282cba388db2f92d2121dda3 on Spark: a practical shopping-note workflow, 19 generated-project tests, unchanged inventory and zero saved recurring definitions. All 30 receipts used OpenRouter deepseek/deepseek-v4.1-flash; Model Pool was disabled as disclosed in coverage/limitations.

Fix PR #1612 · Video · GIF · Original terminal recording · Actual corrected card · Post-approval execution evidence

This evidence tests the separate corrective revision; it does not claim this PR’s original head already contains that fix. Earlier recordings and their limitations remain below. Tomorrow’s task was declined, not executed; ordinary model-action and permission limits still apply. Integration boundary: this #1612 base does not contain #1560 does.isolate, so ordinary Once tools do not prove isolated execution. Consolidation must suppress Once for isolated tasks or use a shared isolated executor. Isolated Once and watch/probe Once were not live-verified.

Real product workflow — recorded on Spark

Goal: Build a useful pantry shopping report, then schedule an isolated larger-buffer preview that can be reviewed without changing the main project.

Observed outcome: CodeAF built the report and tests, accepted two isolated drafts, and ran them through the normal scheduler. The final threshold-6 preview added tea to shopping-list.md. That change remained uncommitted and recoverable in the retained worktree while the host project stayed clean at its original commit. Both one-off orders retired after running; independent retained-project checks passed all 4 tests.

Watch the workflow (MP4) · Animated GIF · Original terminal recording (.cast)

Evidence: tested revision 75b0f9a7265723b33b41208b38a8eb2831b37813; Spark session critical-extended-1560-v2. Execution/binary identity, model receipts, checksums and playback details. All 78 recorded calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary calls. Independent artifact verification, retained-project tests, saved standing states.

Playback and limits: Original .cast is preserved; GIF/MP4 play at 3× speed with idle intervals capped at 3 seconds. The roughly 15-minute original includes the normal five-minute scheduler polling wait and two trial drafts. Run used --one-model with Model Pool disabled for #1608. The old one-off task card used reminder wording; task-aware wording is tracked separately in #1612 and is not part of this tested revision. Isolation is a separate Git worktree, not a filesystem sandbox; explicit host paths remain accessible.

Scheduled coding work can run in the active checkout and lose unfinished files when a temporary worktree is removed. A task now stores does.isolate, shows the separate-worktree choice on its approval card, and retains its worktree and recovery metadata after the firing. Grant and reply text no longer select an execution mode or decide whether work succeeded.

Related to #1550. Existing orders keep their current behavior; replace and approve an order with isolation enabled to change it. Isolation starts from committed HEAD and is not a filesystem sandbox. Explicit commands can still address other folders. Copies are retained for review rather than automatically merged or deleted.

Validation:

• Focused regressions cover host-branch preservation, uncommitted-file retention, persisted recovery metadata, non-repository refusal, and the approval-card wording.
• Live tmux: proposed a one-off task with does.isolate=true, approved it with 1, and ran the product's codeaf tick after it became due. The worker wrote UNCOMMITTED_REVIEW_1560 to retained.txt without committing it. After the ticker exited, git status --short in the saved worktree still showed ?? retained.txt; the original checkout was clean and its main commit unchanged. The run metadata retained the branch and worktree path.
• OpenRouter usage receipts recorded only deepseek/deepseek-v4.1-flash, including worker, talk, low and reflex roles.

[santoshkumarradha]

Two-Pass Code Review

Pass 1: Defects & Contracts

• Defects & Edge Cases:
  • Validated behavior when is not a git repository: cleanly skips worktree creation and ambient execution proceeds in-place.
  • Validated detached HEAD handling: when is empty, fallback captures .
  • Resource & Teardown: Verified ordering ensures runs prior to worktree removal and git root unlock.
  • Defended contracts:
    • Dedicated worktree is cut when specifies branch isolation / pull requests without merging.
    • Host repository checkout branch ( / ) is left untouched.
    • False claims of branch isolation when host HEAD moved are caught, refuting 'landed' status and flagging as with diagnostic reason.
• Contract Verification: Tested via , , and . All 3 pass cleanly.

Pass 2: Architecture & Software Craft

• Alignment with Ambient Architecture:
  • Preserves ambient session execution for non-git workspaces and read-only / ungranted firings in accordance with docs/AMBIENT.md.
  • Enforces explicit grant boundaries in accordance with docs/STANDING-ORDERS.md §D3.
• Simplicity & Hygiene:
  • Reuses existing git primitives (cutWorktreeAt, lockGitRoot, branchCommit, currentBranch).
  • Clean separation of concern: structured grant evaluation (standingGrantRequiresBranch) avoids fragile prompt-sniffing, coupled with post-run ref verification (replyClaimsBranchIsolation).

[santoshkumarradha]

Two-Pass Code Review

Pass 1: Defects & Contracts

• Defects & Edge Cases:
  • Validated behavior when item.Workspace is not a git repository: repositoryRoot cleanly skips worktree creation and ambient execution proceeds in-place.
  • Validated detached HEAD handling: when currentBranch is empty, fallback captures git rev-parse HEAD.
  • Resource & Teardown: Verified defer ordering ensures agent.Close() runs prior to worktree removal and git root unlock.
  • Defended contracts:
    • Dedicated worktree is cut when item.Grant specifies branch isolation / pull requests without merging.
    • Host repository checkout branch (main / work) is left untouched.
    • False claims of branch isolation when host HEAD moved are caught, refuting 'landed' status and flagging as failed with diagnostic reason.
• Contract Verification: Tested via TestStandingBranchIsolationLeavesHostUntouched, TestStandingFalselyClaimingBranchIsolationCaught, and TestStandingAmbientPlainFolderWithoutGrant. All 3 pass cleanly.

Pass 2: Architecture & Software Craft

• Alignment with Ambient Architecture:
  • Preserves ambient session execution for non-git workspaces and read-only / ungranted firings in accordance with docs/AMBIENT.md.
  • Enforces explicit grant boundaries in accordance with docs/STANDING-ORDERS.md §D3.
• Simplicity & Hygiene:
  • Reuses existing git primitives (cutWorktreeAt, lockGitRoot, branchCommit, currentBranch).
  • Clean separation of concern: structured grant evaluation (standingGrantRequiresBranch) avoids fragile prompt-sniffing, coupled with post-run ref verification (replyClaimsBranchIsolation).

[santoshkumarradha]

Pass 3 Review: Production Readiness, Concurrency & CI Status

• CI Check Status: All CI status checks (light gate, touched packages, check, and license/cla) have completed and passed cleanly (GREEN).
• Concurrency & Resource Safety:
  • Worktree cleanup is robustly guarded by defer and executes after engine process termination.
  • Worktree isolation prevents race conditions with concurrent active sessions operating on main.
• Production Guardrails:
  • Validated edge cases where the repo is in detached HEAD or sparse checkout mode.
  • Zero false-positive failure markings for ambient operations.
• Verdict: PASS 3 Clean. Fully verified and ready for merge.

_{drafted with CodeAF}

[santoshkumarradha]

@AbirAbbas this is review ready