[Steel-tech]

Stacked on #14 (itself on #13). Base is feat/ci-repair-ledger; merge in order and GitHub retargets each.

What

U3 of the CI repair plan: the engine keeps an accepted chain alive so a red CI run can be repaired inside the same attempt.

When a definition declares publish.ci.on_fail, an accepted attempt that isn't held now comes back with a worker.Continuation. Each RepairCI(ctx, failure) call runs one round:

1. The on_fail phase receives the CI failure as its input envelope, through the same door a failing test already uses. The CI data is bounded and framed as data, not instructions.
2. Every phase after it runs again, with if: guards, gates and repair edges all live. Phases before it do not re-run.
3. The round is judged by the same acceptance check and publish hold as the chain. run is split into run and conclude, so both end through one door.

Carried into a round	Not carried
Field view and who reported each field, phase results, gate reports	Agent sessions and transcripts (rounds get their own session keys, <attempt>-ci<N>-<role>)
Send count and wall-clock deadline, so a round never buys more budget	The ephemeral HOME: wiped when the chain ends and when each round ends, then re-seeded per role
Handoff notes directory	Touched paths: a round reports only what it changed

A round spends the continuation if it isn't accepted, trips the hold, changes nothing (ci_repair_no_change), or leaves a HOME that can't be wiped. Release destroys everything and can safely be called twice.

Who releases: the worker's attempt loop and jig run release unconditionally. Hosts that own resources a round still needs, such as jig worker's scratch removal and trace stream, hand that cleanup to the continuation via worker.DeferToContinuation.

⚠️ Still inert

Nothing calls RepairCI until U5. Every continuation is released as soon as the attempt ends, so behaviour on main is unchanged. The existing suite, including the exact event-sequence tests, passes untouched.

Verification

• just check is green.
• 17 new engine tests on the scripted runtime cover:
  • What a round runs: only run and later phases; a reviewer rejection loops the builder under its own edge; a high-risk fix trips the hold; the repair phase ignores its own if: guard.
  • Budgets and cancellation: shared send budget, shared ceiling, cancellation.
  • HOME and scratch: the HOME is wiped after the chain and after a round (with a credential-shaped file written into it); roles are re-seeded; handoff notes survive; an unwipeable HOME gets no round; a panic still destroys the scratch.
  • Lifecycle and input: no continuation unless repairable; Release is idempotent and refuses later rounds; a no-change round ends the repair; every CI field is bounded.
• 3 worker tests: the attempt loop releases; DeferToContinuation runs cleanup once, after the inner Release; an unbound publisher releases what it drops.
• Mutation-checked: 35 breaks, all caught. Three results needed correcting first:
  • Two fixture gaps let mutants survive: HOME was never actually written to, and re-seeding was untested. Both fixed.
  • Two "caught" results were compile errors, not real catches. Both were redone so they compile, and are now genuinely caught.

Review

An independent review found a design-level bug, fixed in 69d2ede. jig worker's runner removed the scratch and closed the trace stream as soon as Execute returned, so a U5 round would have started with no handoff notes and a dead trace. It also found five more problems, all fixed: a leak on the unbound publisher path, a panic skipping HOME cleanup, a failed HOME wipe being ignored, the missing no-change outcome, and the uncapped head.

Not yet proven: the cmd/jig/worker.go wiring itself. It can't be exercised until a round actually runs, so the plan now requires U5 to include an end-to-end round through the real jig worker harness.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 82202a61-f8c9-4f0d-b7ee-33899fc158ef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}