feat: Phase 2 automatic isolated Firebreak closed loop

[9thLevelSoftware]

Summary

Implements Phase 2 of the production plan: automatic isolated Firebreak closed loop with approval queue.

When a run completes OutOfControl (correct but exceeds containment) with authorized reviewers configured:

1. Select authorized reviewer
2. Open isolation workspace
3. Invoke reviewer backend (generate_with_backend)
4. Re-verify candidate with the same verification plan
5. Rank with absolute tree metrics (consistent original vs candidate)
6. If smaller + within containment + floor pass:
   • Sensitive / require_firebreak_approval → AwaitingApproval (tif approve|reject)
   • Else if auto_apply_firebreak (default true) → apply with baseline + sticky restore
7. Persist isolation session before apply; audit outcomes; adaptation record
8. Fail-safe always: never apply unverified / larger / out-of-containment candidates

Key changes

• RunOrchestrator::run_firebreak_auto production path (not permanently fail-closed when backends exist)
• Config: approval.auto_apply_firebreak (default true), optional approval_ttl_hours
• CLI: tif firebreak --auto, tif approve <run_id>, tif reject <run_id>
• Apply prefers session.candidate_path (reviewer output); skips .tif-candidate on overlay
• Adaptation stats persisted in local SQLite (tif adaptation)
• Docs: ROADMAP Phase 2 Done, CHANGELOG, schema, protocol, threat model

Test plan

• cargo fmt --all
• cargo clippy --workspace --all-features -- -D warnings
• cargo test --workspace --all-features (114 tests)
• E2E mock: oversized metrics → generate → re-verify → apply → rollback
• Failed backend preserves source
• Larger candidate not applied
• Approval required path does not auto-apply; approve applies after re-check

Manual smoke (optional)

# with mock reviewer + auto_apply_firebreak
tif run begin --task "…"
tif run complete <id> --auto-firebreak --deps-added 1 …
tif approve <id>   # if AwaitingApproval
tif reject <id>
tif rollback <id>

Safety

• Correctness floor never lowered
• Egress still enforced; process env scrub remains
• Simulated metrics never authorize apply

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 826e1573ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Persist auto Firebreak state before propagating apply errors

In the auto reviewer branch, the ? here exits before the post-call record_run when run_firebreak_auto returns an apply error. That method can already have preserved a baseline and set restore_pending on the session, so the audit DB still contains only the pre-call record without isolation_session/baseline_path; a subsequent tif rollback cannot locate the recovery data for a partially modified workspace. Capture the result, record the mutated run, then propagate the error as the explicit-candidate path does.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Do not let --auto override disabled auto-apply

When a repo sets [approval].auto_apply_firebreak = false, tif run complete --auto-firebreak honors it by passing authorize_apply=false, but tif firebreak --auto sets authorization to true because auto is ORed in here. A smaller non-sensitive candidate will therefore be applied even though the repository explicitly disabled automatic Firebreak apply; --auto should start the closed loop, not bypass the approval policy.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Hold verified candidates for approval when auto-apply is disabled

For automatic flows that pass authorize_apply = config.approval.auto_apply_firebreak, setting auto_apply_firebreak=false produces a smaller verified candidate with apply authorization turned off, but this approval predicate still returns false unless the candidate is sensitive or approval is globally required. The outcome becomes candidate_ready/requires_approval=false, so finalize_firebreak immediately restores instead of entering AwaitingApproval, leaving tif approve unable to apply the held candidate.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Make adaptation recording idempotent per run

This appends aggregate counters every time a run is recorded, but the new CLI calls it after run complete, again after firebreak, and again after approve/rollback for the same run. A single run that goes OutOfControl → AwaitingApproval → Applied is counted as multiple total runs and multiple outcomes, skewing the fire-level and reviewer recommendations; persist per-run adaptation state or update the aggregate idempotently by run id.

Useful? React with 👍 / 👎.