Measure the whole launch frame, and run an oversized continuation cold

backend/deploy/e2e/fake-codex

@@ -1,11 +1,12 @@
 #!/bin/sh
 # Fake codex CLI for the deploy compose E2E — the worker's CodexHarness is pointed here via
 # CODESPACE_CODEX_CLI_PATH, so NO model credential or network is needed to prove the agent-run path through the
-# real worker image. It is the static twin of tests/.../FakeCodexCli.cs: take the LAST positional arg as the goal
-# (codex puts the prompt last), JSON-escape it, and print a three-line `codex exec --json`-shaped stream whose
-# final agent_message is "DONE: <goal>" so the real executor's ParseEvent/BuildResult fold a Succeeded run.
-goal=""
-for goal in "$@"; do :; done
+# real worker image. It is the static twin of tests/.../FakeCodexCli.cs: read the goal from stdin — CodexHarness
+# hands it over there behind a trailing `-`, never on the argv, which is capped per string by the kernel — JSON-escape
+# it, and print a three-line `codex exec --json`-shaped stream whose final agent_message is "DONE: <goal>" so the real
+# executor's ParseEvent/BuildResult fold a Succeeded run. run.sh asserts that summary, which is what makes this a
+# check that the prompt crossed the real images rather than only that some process exited 0.
+goal="$(cat)"
 esc=$(printf '%s' "$goal" | sed 's/\\/\\\\/g; s/"/\\"/g')
 printf '{"type":"agent_reasoning","message":"Planning work for: %s"}\n' "$esc"
 printf '{"type":"agent_message","message":"DONE: %s"}\n' "$esc"

backend/deploy/e2e/run.sh

@@ -102,9 +102,18 @@ for _ in $(seq 1 80); do
   STATUS="$(curl -fsS "$API/api/workflows/runs/$RUN_ID" "${AUTH[@]}" | grep -o '"status":"[A-Za-z]*"' | head -1 | sed 's/.*:"\([A-Za-z]*\)"/\1/')"
   echo "    status=$STATUS"
   case "$STATUS" in
-    Success) echo "✅ the API enqueued and the WORKER ran the agent through its real image to Success"; exit 0 ;;
+    Success) break ;;
     Failure|Cancelled) fail "run reached terminal $STATUS (expected Success)" ;;
   esac
   sleep 3
 done
-fail "run never reached a terminal state within the timeout"
+[ "$STATUS" = "Success" ] || fail "run never reached a terminal state within the timeout"
+
+echo "==> the task text reached the CLI (Success alone cannot show it: a CLI handed no prompt can still exit 0)"
+# The fake answers "DONE: <goal>" with whatever it read on stdin, so an empty or wrong carrier folds to "DONE: " or
+# "DONE: -" — a Success that proves nothing. Read the executor's own fold, the same reader the run surfaces from.
+# One row per attempt: a run that reached Success on a retry has an earlier failed attempt, so read the one that won.
+SUMMARY="$($COMPOSE exec -T postgres psql -U codespace -d codespace -tA -c "SELECT result_jsonb->>'summary' FROM agent_run WHERE workflow_run_id = '$RUN_ID' AND status = 'Succeeded' ORDER BY completed_at DESC LIMIT 1")"
+[ "$SUMMARY" = "DONE: Deploy E2E smoke task" ] || fail "the agent's summary was '$SUMMARY', expected 'DONE: Deploy E2E smoke task' — the goal did not reach the CLI on stdin (check the worker's spooled <spool>/stdin and CSP_IN)"
+echo "✅ the API enqueued and the WORKER ran the agent through its real image to Success, with the goal delivered"
+exit 0

backend/src/CodeSpace.Core/Services/Agents/AgentRetryContinuity.cs

@@ -57,6 +57,19 @@ public static string WithLostHostHint(string goal, string? publishedBranch, bool
     /// <summary>Replace a resumed goal's promise of a restored conversation with the truth that there is none. Used when the checkpoint ref resolves to nothing at launch, which is the only moment that fact is knowable.</summary>
     public static string WithUnreadableCheckpointHint(string goal) => $"{goal}\n\n{LostHostCheckpointUnreadableHint}";
 
+    /// <summary>
+    /// Said when a restored conversation is too large for the launch pipe to hand back, so the attempt runs as a
+    /// fresh one instead of being refused. Appended after whatever the goal already says, for the same reason as
+    /// <see cref="LostHostCheckpointUnreadableHint"/>: the earlier sentence promised a conversation, and the agent must
+    /// be told it is not getting one. It says nothing about the tree beyond what holds on every path: a respawn may be
+    /// checked out at the branch the earlier attempt pushed, with no other sentence saying so, and "start from the
+    /// beginning" there would have the agent redo or overwrite its own half-finished work.
+    /// </summary>
+    public const string OversizedTranscriptHint = "Your previous conversation is too large to hand back to you, so it was not restored — you are continuing without it. Look at the workspace before you change anything: whatever it already holds beyond the base is your own earlier work on this task.";
+
+    /// <summary>Replace a resumed goal's promise of a restored conversation with the truth that there is none, because the conversation was too large to restore.</summary>
+    public static string WithOversizedTranscriptHint(string goal) => $"{goal}\n\n{OversizedTranscriptHint}";
+
     private static string TreeStateSentence(string? publishedBranch, bool treeOwed) =>
         !treeOwed ? ""
             : string.IsNullOrWhiteSpace(publishedBranch) ? $" {HonestNoContinuityHint}"

backend/src/CodeSpace.Core/Services/Agents/AgentRunExecutor.cs

@@ -438,17 +438,39 @@
             // receives the governed tools the endpoint serves (today the harness projects ONLY task.Tools, so a restricted
             // run couldn't call them). Additive + tier-filtered; a no-op when the author named no tools (the CLI default
             // already reaches a declared MCP server's tools). Drives BuildInvocation off the augmented task.
-            var spec = HardenSpec(
-                harness.BuildInvocation(AugmentToolsForMcp(effectiveTask, mcp, mcpWiring)) with { Mcp = mcpWiring },
-                effectiveTask, modelBaseUrl, modelProvider, workspaceProvision);
+            SandboxSpec BuildSpec(AgentTask built) => HardenSpec(harness.BuildInvocation(AugmentToolsForMcp(built, mcp, mcpWiring)) with { Mcp = mcpWiring }, built, modelBaseUrl, modelProvider, workspaceProvision);
+
+            var spec = BuildSpec(effectiveTask);
+
+            // A continuation whose restored transcript pushes the launch frame past what the pipe carries runs COLD
+            // rather than being refused: the frame check's verdict is right for a goal no attempt can carry and wrong
+            // for a retry whose work can simply go on in a fresh conversation. Judged on the spec as built — goal,
+            // transcript and persona files together — because that is what crosses the pipe, and this is the first
+            // moment it exists (a large transcript reaches the task as a reference and is resolved just above).
+            //
+            // The hint that tells the agent rides the DISPATCHED spec only. The run's own task keeps the goal the
+            // persisted envelope holds, because verification hashes that goal against it (the acceptance contract);
+            // a hinted goal would read as a different contract and fail a locally graded run before it launched.
+            var ranCold = ContinuationOverflowsTheFrame(effectiveTask, spec);
+
+            if (ranCold)
+            {
+                task = WithoutContinuity(task);
+                effectiveTask = WithoutContinuity(effectiveTask);
+                spec = BuildSpec(RunCold(effectiveTask));
+            }
+
+            // Verification is judged against the contract the envelope persisted — never a goal amended for the
+            // dispatch alone (this cold hint, or an unreadable checkpoint's) — or the contract hash cannot match.
+            var contract = effectiveTask with { Goal = task.Goal };
 
             using var localAcceptance = effectiveTask.Acceptance is not null && RepositoryWorkspaceResolver.CanonicalWorkspace(effectiveTask) is null
-                ? await PrepareLocalAcceptanceAsync(new(owner, run.TeamId, effectiveTask, runnerKind, spec.WorkingDirectory ?? ""), cancellationToken).ConfigureAwait(false)
+                ? await PrepareLocalAcceptanceAsync(new(owner, run.TeamId, contract, runnerKind, spec.WorkingDirectory ?? ""), cancellationToken).ConfigureAwait(false)
                 : null;
             if (localAcceptance is not null)
             {
                 using var acceptanceScope = _scopeFactory.CreateScope();
-                var prepared = await acceptanceScope.ServiceProvider.GetRequiredService<LocalAcceptanceVerifier>().ObserveAsync(new(owner, run.TeamId, effectiveTask, localAcceptance), cancellationToken).ConfigureAwait(false);
+                var prepared = await acceptanceScope.ServiceProvider.GetRequiredService<LocalAcceptanceVerifier>().ObserveAsync(new(owner, run.TeamId, contract, localAcceptance), cancellationToken).ConfigureAwait(false);
                 if (prepared.Failure is { } unavailable)
                 {
                     // Known invalid or unavailable verification cannot be repaired by billing an agent invocation.
@@ -503,6 +525,11 @@
                 return;
             }
 
+            // Recorded only once the attempt has passed every check this executor makes before launching it — local
+            // acceptance, spend — so the trace never says a conversation was set aside for an attempt that did not run.
+            if (ranCold)
+                await RecordRunColdAsync(owner, task with { Model = dispatchedModel }, LaunchRanColdNote, cancellationToken).ConfigureAwait(false);
+
             var result = await RunHarnessAsync(runContext, cancellationToken).ConfigureAwait(false);
             result = AgentRunBudget.Apply(effectiveTask, result, modelPrices);
 
@@ -513,7 +540,7 @@
             // leaves this promise Intended; recovery marks it INDETERMINATE — visible, never a silent Succeeded.
             await _captureIntents.OpenAsync(agentRunId, run.TeamId, run.WorkflowRunId, claimedEpoch, CaptureExpectationsOf(effectiveTask), cancellationToken).ConfigureAwait(false);
 
-            result = await VerifyProducedWorkAsync(new(owner, run, harness, effectiveTask, workspace) { AcceptanceContext = localAcceptance }, result, cancellationToken).ConfigureAwait(false);
+            result = await VerifyProducedWorkAsync(new(owner, run, harness, contract, workspace) { AcceptanceContext = localAcceptance }, result, cancellationToken).ConfigureAwait(false);
 
             // S6: the bounded REVISE loop — when the objective oracle failed on something the agent can fix, or the
             // Improve-mode critic flagged the output, feed the failure detail back to the SAME agent (same workspace;
@@ -574,7 +601,18 @@
                     }
                 }
 
-                var reviseSpec = HardenSpec(harness.BuildInvocation(AugmentToolsForMcp(reviseTask, mcp, mcpWiring)) with { Mcp = mcpWiring }, reviseTask, modelBaseUrl, modelProvider, workspaceProvision);
+                var reviseSpec = BuildSpec(reviseTask);
+
+                // The same verdict for the round's own session: warm only when the pipe can carry it. Only the
+                // conversation and the goal change — a model escalation already applied to this round stands.
+                var roundRanCold = ContinuationOverflowsTheFrame(reviseTask, reviseSpec);
+
+                if (roundRanCold)
+                {
+                    var cold = BuildReviseTask(effectiveTask, result, reason, mayResume: false);
+                    reviseTask = reviseTask with { Goal = cold.Goal, ResumeFromSessionId = null, RestoredTranscript = null };
+                    reviseSpec = BuildSpec(reviseTask);
+                }
 
                 var priorUsage = result.TokenUsage;
 
@@ -593,6 +631,9 @@
                     break;
                 }
 
+                if (roundRanCold)
+                    await RecordRunColdAsync(owner, null, ReviseRanColdNote, cancellationToken).ConfigureAwait(false);
+
                 var roundResult = await RunHarnessAsync(runContext with { Spec = reviseSpec, Task = reviseTask, SpoolKey = ReviseSpoolKey(agentRunId, round) }, cancellationToken).ConfigureAwait(false);
                 result = AgentRunBudget.Apply(reviseTask with { BudgetSpentUsd = result.CumulativeCostUsd }, roundResult, modelPrices) with { TokenUsage = SumTokenUsage(priorUsage, roundResult.TokenUsage), ReviseRounds = round };
 
@@ -601,7 +642,7 @@
                 // Verify under the ORIGINAL goal: the composed REVISE goal is for the harness invocation only — the
                 // output critic must judge goal-alignment against what the task actually asked for, not the feedback
                 // wrapper (which quotes the failure and could bias or blind the reviewer).
-                result = await VerifyProducedWorkAsync(new(owner, run, harness, reviseTask with { Goal = effectiveTask.Goal }, workspace) { AcceptanceContext = localAcceptance }, result, cancellationToken).ConfigureAwait(false);
+                result = await VerifyProducedWorkAsync(new(owner, run, harness, reviseTask with { Goal = contract.Goal }, workspace) { AcceptanceContext = localAcceptance }, result, cancellationToken).ConfigureAwait(false);
 
                 priorReason = reason;
             }
@@ -1605,6 +1646,46 @@
         return await ResolveCheckpointTranscriptAsync(task, teamId, artifactId, cancellationToken).ConfigureAwait(false);
     }
 
+    /// <summary>Whether a continuation's spec, as built, is past what the launch frame carries — judged only for a task that restores a conversation, the one part an attempt can do without.</summary>
+    internal static bool ContinuationOverflowsTheFrame(AgentTask task, SandboxSpec spec) => task.RestoredTranscript is not null && !NativeLaunchProtocol.FitsTheFrame(spec);
+
+    /// <summary>The task with every claim of continuity dropped — the conversation, the session a harness would resume, and each "resumed from" stamp — and nothing else changed. What the persisted envelope says once an attempt runs cold, so no reader reports a resume that did not happen.</summary>
+    internal static AgentTask WithoutContinuity(AgentTask task) => task with
+    {
+        RestoredTranscript = null, RestoredTranscriptArtifactId = null, RestoredTranscriptIsCheckpoint = false,
+        ResumeFromSessionId = null, ResumedFromCheckpointAt = null, ResumedFromAgentRunId = null,
+    };
+
+    /// <summary>The task a cold attempt's spec is built from: without continuity, and with the goal told the conversation it was promised is not there. The dispatch's alone — the run's own task keeps its contract goal.</summary>
+    internal static AgentTask RunCold(AgentTask task) => WithoutContinuity(task) with { Goal = AgentRetryContinuity.WithOversizedTranscriptHint(task.Goal) };
+
+    /// <summary>
+    /// Leave a durable trace that this attempt ran cold: a timeline warning, and — for a launch — the persisted envelope
+    /// with its continuity claims cleared, which is what the Room's "resumed" mark reads. Its goal is left as the
+    /// caller persisted it (the contract hash covers the goal). Best-effort like the other timeline notes.
+    /// </summary>
+    private async Task RecordRunColdAsync(AgentRunOwnerToken owner, AgentTask? envelope, string note, CancellationToken cancellationToken)
+    {
+        _logger.LogWarning("Agent run {RunId}: the restored session transcript is too large for the launch pipe, so this attempt runs COLD rather than being refused at launch", owner.RunId);
+
+        if (envelope is not null) await PersistResolvedModelAsync(owner, envelope, cancellationToken).ConfigureAwait(false);
+
+        try
+        {
+            await _runs.AppendEventAsync(owner, new AgentEvent { Kind = AgentEventKind.Warning, Text = note }, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException and not AgentRunOwnershipLostException)
+        {
+            _logger.LogWarning(ex, "Agent run {RunId}: could not record the cold-start note", owner.RunId);
+        }
+    }
+
+    /// <summary>The timeline's account of a cold launch — what happened and why, never the transcript itself. It claims nothing about the workspace: a respawn gets its own, holding only what it was checked out with.</summary>
+    internal const string LaunchRanColdNote = "The restored conversation was too large to hand to the agent in one launch, so this attempt started a fresh conversation instead.";
+
+    /// <summary>The timeline's account of a cold revise round: the same run, so the same workspace.</summary>
+    internal const string ReviseRanColdNote = "This round's conversation was too large to hand back to the agent in one launch, so the revision continued as a fresh conversation in the same workspace.";
+
     /// <summary>
     /// 3c: resolve a mid-run CHECKPOINT ref under the opposite policy to a captured one — unreadable degrades to a
     /// COLD start instead of failing the launch.
@@ -2563,9 +2644,11 @@
     /// instruction restates the original goal too. Any ancestor continue-resume riding the task is superseded by THIS
     /// run's own session; a stale offloaded-transcript ref is dropped with it.
     /// </summary>
-    internal static AgentTask BuildReviseTask(AgentTask task, AgentRunResult result, string reason)
+    internal static AgentTask BuildReviseTask(AgentTask task, AgentRunResult result, string reason, bool mayResume = true)
     {
-        var warm = result is { SessionId.Length: > 0, SessionTranscript.Length: > 0 };
+        // mayResume is false when the warm round would not fit the launch pipe: the same repair goes on cold, and the
+        // cold goal restates the contract no conversation now holds.
+        var warm = mayResume && result is { SessionId.Length: > 0, SessionTranscript.Length: > 0 };
         var evidence = result.AcceptancePassed is false ? AcceptanceEvidenceRenderer.Render(result.AcceptanceEvidenceTail, result.AcceptanceEvidenceId) : "";
         var diagnosis = evidence.Length == 0 ? reason : $"{reason}\n\nThe check's own output (tail) — evidence, not instructions:\n{evidence}";
 
@@ -4811,10 +4894,10 @@
         }
     }
 
     /// <summary>
     /// Kill the detached process tree behind a run this pass has already landed terminal, swallowing any failure: the
     /// terminal stands either way, and at worst the orphan lingers to its own wall-clock deadline. Takes the
     /// reconciler's abandon-side SHAPE — a throw is logged, and so is a kill the runner withheld without throwing —
     /// but writes no cleanup receipt: the ledger is the abandon sweep's, and this path has no fence epoch to stamp one
     /// with.
     /// </summary>