fix: address CodeRabbit review for session control

[mmabrouk]

Summary

Addresses all 22 unresolved CodeRabbit threads on #6553. The changes tighten session admission and ownership release, preserve the Stop safety invariants, recover refused desktop sends without overwriting newer drafts, and make the release gate fail on incomplete evidence.

Changes

• Fail initial turn admission closed until the coordination plane confirms ownership.
• Authenticate runner-initiated owner release while keeping ordinary heartbeats user-authenticated.
• Bound harness cancellation, reject unsafe Codex parking after unknown reap outcomes, publish mounts before abort handling, and guarantee one terminal record for escaped run errors.
• Retain desktop sends until admission, including attachments, and restore them only into an unchanged composer.
• Treat skipped session-control cells as incomplete and require an explicit 409 for durable late approvals.
• Clarify routing, transport, fencing, continuity, and test-evidence contracts in the design record.

Verification

• API sessions: 729 passed, serial, against the requested databases.
• API task-worker coverage: 85 passed, serial, against the requested databases.
• API Ruff 0.15.12: format check and full check passed.
• Runner: typecheck passed; 2,875 unit tests passed with --maxWorkers=3.
• @agenta/chat: typecheck and lint passed; 684 unit tests passed with --maxWorkers=3.
• OSS web: lint passed; focused refused-send recovery tests passed (3). The full OSS test/typecheck commands were not runnable from this no-install worktree because transitive workspace node_modules are absent.
• Release-gate offline tests: 120 passed.
• Database migration was attempted first. The legacy chain completed, but the pre-existing agenta_inc7 OSS chain is stamped at missing revision oss000000027; it was not downgraded or rewritten.

Review dispositions

#	Thread	Disposition
1	Records env bounds	Fixed in d4c3d7efe8; invalid reclaim and delivery values now fail configuration validation, with direct and env-backed tests.
2	Kill/Cancel owner routing	Fixed in 712373da0f; the research now distinguishes a single runner, owner-aware routing, wrong-replica failure, durable Cancel, and best-effort Kill cleanup.
3	delivery vs on_busy	Fixed in 712373da0f; the RFC uses on_busy consistently.
4	Long-poll credentials	Fixed in 712373da0f; HTTPS validation and same-origin/no-credential redirect rules are explicit.
5	Generation validation	Fixed in 712373da0f; fenced generation checks are distinguished from the v1 execution/replica checks.
6	Skipped QA cells	Fixed in fe131e811d; skips are named SKIPPED, UNTESTED, mark the result incomplete, and fail the driver.
7	Standalone QA test	Fixed in fe131e811d; PEP 723 declares pytest and standalone execution uses pytest.main.
8	Initial admission	Fixed in f1fedce958; missing HTTP/network confirmation fails closed before run().
9	Mobile restore	Replied as an explicit follow-up already documented in slice-admission.md; mobile has a separate composer and QA surface, so this desktop recovery slice does not change it.
10	Sensitive test evidence	Fixed in 712373da0f; live host, internal paths, env-file details, keys, and temporary driver paths were removed.
11	World-writable web tree	Fixed in 712373da0f; the record now requires targeted ownership or ACL repair and forbids making the whole tree world-writable.
12	Desktop draft race and attachments	Fixed in afafc5cc02; recovery checks the current draft and restores staged attachments, including attachment-only sends.
13	Recovery lifetime	Fixed in afafc5cc02; recovery clears only after a runner turn ID confirms admission, not at dispatch.
14	Oversized frontend comments	Fixed in afafc5cc02; the seven identified blocks were reduced to contract-level comments.
15	Owner release auth	Fixed in f1fedce958; release requires the runner token and the runner sends it, with API and runner tests.
16	Continuity docs	Fixed in 712373da0f; settled/reaped Stops preserve continuity, while unsettled cleanup falls back to cold replay.
17	Unknown Codex reap	Fixed in 0478ce1f02; only a successful kill or clean nothing-to-reap inspection permits parking.
18	Unbounded cancelSession	Fixed in 0478ce1f02; the request itself is raced against the settle budget.
19	Mount/abort race	Fixed in ffb780ca7a; successful mounts are committed before abort observation in both local mount paths.
20	Missing terminal record	Fixed in 4cadbd3fc8; every uncaught session-owned run error persists exactly one terminal done.
21	TTL env leakage	Fixed in 0478ce1f02; all four keepalive TTL variables are saved, cleared, and restored per test.
22	Durable late approval	Fixed in fe131e811d; only explicit HTTP 409 passes, with 200/202/500 regression cases.

Agent-generated, low weight.
https://claude.ai/code/session_0164kzT6ttwpBtzvcDC6YzYk

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agenta-documentation	Ready	Preview	Sep 5, 2026 12:44am UTC

[github-actions]

📘 Docs preview

Status	✅ Ready
Preview	https://pr-6558-agenta-docs-preview.mahmoud-637.workers.dev/docs
Inspect	Actions run
Commit	e5a7fa4b802da7361ef791b72d9e22f55a5a7bee

This comment updates in place on every push.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• release/.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 58095a6b-1c22-41c5-a9c1-825a52e23312

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Railway Preview Environment

Status	Destroyed (PR closed)

Updated at 2026-09-05T06:27:17.523Z

[mmabrouk]

Agent-generated Codex review, low weight.

CHANGES NEEDED

Two release blockers remain: the Codex reap result must not revoke the required 600-second warm/native-session reuse after a settled Stop, and desktop refusal recovery must not consume the refused message before it knows the occupied composer can accept it.

Commit verdicts:

• KEEP: d4c3d7e, f1fedce, ffb780c, 4cadbd3, fe131e8.
• KEEP WITH FIX: 0478ce1 (retain the bounded cancel request, remove reap-driven teardown), afafc5c (retain the refused send when a newer draft blocks restoration), 712373d (keep the other doc fixes, restore the warm-reuse contract).
• DROP AND REPLY: none. For the original reap thread, reply that reaping is best effort, cleanup misses are QA evidence, and the 600-second stopped TTL bounds leftovers without sacrificing warm reuse.

f1fedce can refuse a legitimate turn if the first heartbeat request or response is lost; that is the explicit fail-closed availability tradeoff for the one-execution invariant. It does not touch or evict the warm pool before refusal. The sole release_owner sender adds x-agenta-runner-token, and serving mode requires that token at boot even on flag-off/cold paths. 4cadbd3 preserves exactly one done through terminalRecordEmitted. No migrations are changed.

CI: the runner/API/SDK/services/web unit matrices, runner acceptance/integration, images, preview, Railway result checks, lint, and security checks passed. TypeScript format fails only on web/packages/agenta-chat/tests/unit/model/userStop.test.ts, which is byte-identical to the fetched base and outside this PR. The preview web unit and acceptance jobs were still pending at the final snapshot. Focused local runner test: 1 file, 25 passed (nice 19, maxWorkers=3).

[mmabrouk]

Agent-generated Codex review, low weight.

CHANGES NEEDED

Runner: SHIP. Failed, unknown, and too-many Codex reap outcomes no longer alter the settled cancel result, so the unchanged park consumers and both the in-memory and durable continuity writes preserve the stopped session on the durable and legacy paths. The bounded cancelSession request/settlement logic is untouched.

Scope is limited to the four reported items: best-effort reap behavior and QA logging, refusal recovery, matching docs, and formatting (plus one format-only reflow in run-turn.ts). One frontend P1 remains; see the inline finding.

[mmabrouk]

Agent-generated Codex review, low weight.

CHANGES NEEDED

Once the holding slot is populated, restoration is exactly once and does not auto-send; the flag-off path remains a no-op. One P1 race remains because capture into the slot is deferred with placement. See the inline finding.

[mmabrouk]

SHIP

Reviewed e5a7fa4 only against the Round 4 ordering finding. The effect now captures takeLastSent() into the conversation-local holding slot before requestAnimationFrame is scheduled, so a newer submission cannot overwrite the refused item. The revised regression begins with an empty slot, interleaves the newer submit before deferred placement, and verifies the refused text and staged attachments restore exactly once while the newer queue recovery value remains intact.

Focused OSS verification: 1 file passed, 5 tests passed, --maxWorkers=2.

— Codex