Two interacting defects broke the documented PARTIAL repair flow (fix
the plan, commit the known-good subset, rm BLOCKED.md, resume) —
observed on run wf_81a13333-be3 (aura): the resume replayed all 78
agents from cache in 33 ms and returned the byte-identical stale
end-report.
1. Plan content was invisible to the resume cache key. The substrate
caches per (prompt, opts) and every plan-reading prompt carried only
the plan PATH, so a plan edit changed no prompt and the extraction
replayed stale text. New required standard-mode carrier field
plan_sha256 (recomputed by the orchestrator at every invocation) is
stamped into all three plan-reading prompts (plan-index,
plan-extract-all, plan-extract:<id>): a plan edit re-runs the
extraction, and a downstream task replays from cache iff its
re-extracted text is byte-identical — worst case a redundant live
re-run, never stale text. Alternative considered: documenting "plan
edits need a fresh run with task_range" — rejected, it keeps the
trap armed and forfeits the cache replay a resume exists for.
2. The cross-task discard guard compared boundary path sets across a
moved HEAD. Boundary sets are diffs AGAINST HEAD; after the
sanctioned interim subset commit, the first live boundary measures
against the new HEAD while the replayed boundary carries the old
one — the entire committed subset read as "lost paths" and
hard-BLOCKed. The snapshot agent now also reports
`git rev-parse HEAD`; a boundary pair straddling a HEAD move resets
the guard with a concern (which also flags a rogue mid-run commit)
instead of comparing. Same-HEAD discards still hard-BLOCK; a blank
sha falls through to the comparison so a flaky report cannot disarm
the guard.
Verified with a zero-token mock harness (AsyncFunction + stubbed
agent()): fail-fast on missing plan_sha256, hash present in all three
extraction prompts (batched and fan-out paths), same-HEAD discard
still BLOCKs, HEAD-move resets with a concern, mini mode unaffected.
Adversarially reviewed (4-verifier workflow): SOUND. Known residuals:
the script cannot verify the hash matches the plan bytes (operator
obligation, documented in the carrier contract and SKILL.md), and a
coincident HEAD-move + discard surfaces as a concern rather than a
BLOCK.
closes#32
claude
5d1cffab76