Fix queued prompt cancellation state synchronization

[ColeMurray]

Summary

• expose server-authoritative cancellability on prompt queue items
• hide removal controls for processing and integration-owned prompts
• broadcast the authoritative queue before cancellation acknowledgements and rejections to prevent stale client state
• default missing cancellability to false for rolling-deployment compatibility

Testing

• npm run build -w @open-inspect/shared
• npm run typecheck -w @open-inspect/control-plane
• npm run typecheck -w @open-inspect/web
• npm test -w @open-inspect/shared -- --run src/types/server-messages.test.ts
• npm test -w @open-inspect/control-plane -- --run src/session/message-repository.test.ts src/session/message-queue.test.ts
• npm test -w @open-inspect/web -- --run src/components/queued-prompt-stack.test.tsx src/components/session-timeline.test.tsx src/components/session-timeline-scroll.test.tsx src/lib/session-socket/reducer.test.ts
• npm run test:integration -w @open-inspect/control-plane -- --run test/integration/websocket-client.test.ts

---

Created with Open-Inspect

Summary by CodeRabbit

• New Features

  • Prompt queue items now indicate whether they can be cancelled.
  • Cancellation eligibility is determined consistently for user-created, automated, and integration-owned prompts.
  • Older server responses remain compatible by treating missing cancellability information as non-cancellable.

• Bug Fixes

  • Remove controls are shown only for cancellable prompts, preventing unsupported cancellation attempts.
  • Prompt queue updates are broadcast before cancellation results, including when cancellation fails.

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: e0d31620-0697-428f-b238-698b4d1dad1b

📥 Commits

Reviewing files that changed from the base of the PR and between a9d8964 and 49716d0.

📒 Files selected for processing (20)

• packages/control-plane/src/routes/session-child-spawn.ts
• packages/control-plane/src/routes/session-prompt.ts
• packages/control-plane/src/scheduler/scheduler.ts
• packages/control-plane/src/session/enqueue-prompt-contract.ts
• packages/control-plane/src/session/http/handlers/child-sessions.handler.test.ts
• packages/control-plane/src/session/http/handlers/child-sessions.handler.ts
• packages/control-plane/src/session/http/handlers/child-summary.handler.test.ts
• packages/control-plane/src/session/http/handlers/messages.handler.test.ts
• packages/control-plane/src/session/message-queue.test.ts
• packages/control-plane/src/session/message-queue.ts
• packages/control-plane/src/session/message-repository.test.ts
• packages/control-plane/src/session/message-repository.ts
• packages/control-plane/src/session/schema.test.ts
• packages/control-plane/src/session/schema.ts
• packages/control-plane/src/session/services/message.service.test.ts
• packages/control-plane/src/session/types.ts
• packages/control-plane/test/integration/helpers.ts
• packages/control-plane/test/integration/prompt-enqueue.test.ts
• packages/control-plane/test/integration/service-auth.test.ts
• packages/control-plane/test/integration/websocket-client.test.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

Prompt queue items now include a cancellable field. The server derives this field from persisted ownership. The web client uses it to restrict prompt removal. Cancellation broadcasts now precede requester responses.

Changes

Prompt Queue Cancellability

Layer / File(s)	Summary
Ownership contract and schema packages/control-plane/src/session/enqueue-prompt-contract.ts, packages/control-plane/src/session/schema.ts, packages/control-plane/src/session/types.ts, packages/control-plane/src/session/schema.test.ts	Prompt enqueue requests and message rows now include cancellation ownership. Fresh schemas and migration 47 add the column and backfill eligible legacy messages.
Prompt enqueue and queue projection packages/control-plane/src/session/message-queue.ts, packages/control-plane/src/session/message-repository.ts, packages/control-plane/src/routes/..., packages/control-plane/src/scheduler/scheduler.ts, packages/control-plane/src/session/http/handlers/..., packages/control-plane/test/integration/*	Prompt producers assign cancellableByUser, message creation persists it, and queue projection derives cancellable from pending state and ownership.
Cancellation flow ordering packages/control-plane/src/session/message-queue.ts, packages/control-plane/src/session/message-repository.ts, packages/control-plane/src/session/message-queue.test.ts, packages/control-plane/src/session/message-repository.test.ts	Cancellation uses an ownership-constrained delete. The queue broadcasts after every attempt and before success or error feedback.
Server message and client controls packages/shared/src/types/server-messages.ts, packages/web/src/app/.../page.tsx, packages/web/src/components/queued-prompt-stack.tsx, packages/web/src/components/session-timeline*.test.tsx, packages/web/src/lib/session-socket/reducer.test.ts	Server messages default missing cancellability to false. The web client renders and handles removal only for cancellable prompts. Related fixtures define the new field.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🔵 Low · up to 49716

The PR makes prompt cancellation server-authoritative and backfills some legacy web prompts as user-cancellable. It is mergeable with owner awareness, but the migration should be confirmed not to classify integration-owned prompts as removable, and session-wide cancellation should be confirmed as the intended permission boundary.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 28 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: fixing queued prompt cancellation state synchronization.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/prompt-cancellation-state

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[open-inspect]

Summary

PR #1709: Fix queued prompt cancellation state synchronization by @ColeMurray updates 13 files (+105/-25). The change consistently projects server-authoritative cancellability, safely defaults older-server queue items to non-cancellable, and orders authoritative queue broadcasts before correlated cancellation results.

Critical Issues

None.

Suggestions

None.

Nitpicks

None.

Positive Feedback

• The UI hint and server-side cancellation guard use the same eligibility criteria, while the server remains authoritative.
• Defaulting the new schema field to false gives a safe rolling-deployment path.
• Tests cover successful and rejected ordering, integration-owned prompts, schema compatibility, and UI visibility. Focused verification passed: 258 unit tests, 41 integration tests, and both affected downstream typechecks.

Questions

None.

Verdict

Approve: Ready to merge; no blocking issues found.

[open-inspect]

The queue-before-ack ordering and fail-closed client compatibility are sound, but the new contract does not yet establish an authoritative cancellation boundary. cancellable duplicates the repository mutation predicate and derives ownership from caller-supplied provenance, so the projection can drift from deletion and malformed/spoofed enqueue metadata can create either unremovable web work or removable integration work. Please make cancellation ownership canonical at the authenticated enqueue boundary, reuse one policy for projection and mutation, and cover each ownership signal independently in integration tests.

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request