Integrate and harden long-running goals end to end

[integry]

Context

Final integration task for #2002. Start only after the integration PRs for #2003, #2004, and #2005 are merged into 2002-epic-long-running-goals.

Scope

Resolve cross-stream integration, finish end-to-end and recovery coverage, document operation/API behavior, and validate the complete product through the final epic branch. This issue must not weaken provider, lifecycle, security, or durability semantics to make integration easier.

End-to-end scenarios

Automate representative flows using realistic fakes plus pinned-image smoke coverage where provider credentials are not appropriate for CI:

1. Create a small goal that produces one issue PR and a final epic PR.
2. Create a larger goal with two sub-epics, dependencies, and a configurable active-task cap; verify independent work runs concurrently and same-branch merges serialize.
3. Kill the provider container during output/tool work, restart the daemon with Redis cleared, resume the same provider session, and prove no duplicate messages, issues, branches, PRs, or accepted turns.
4. Pause with active work, observe pausing then paused, restart services, resume, and verify active/paused time plus concurrency accounting.
5. Send “what’s done?”, “what’s left?”, and a free-form correction; verify FIFO state, controller-derived status, provider response, and replay after reconnect.
6. Request a model change during work and verify requested/effective/audit/token attribution before and after the safe boundary.
7. Exercise Claude, Codex, and Antigravity contract fixtures for resume, steering, pause, model change, cancel, and completion.
8. Run Ultrafix/CI/merge gating through leaf, sub-epic, and final epic readiness, including failure and manual circuit-breaker cases.
9. Attempt cross-user HTTP/socket access and stale fenced-worker writes; prove both are rejected.
10. Run demo/read-only flows and existing Planner/Task/issue execution regressions.

Operational behavior

• Add architecture and operator documentation for durable storage, leases, recovery, retention, pause semantics, safe-boundary model changes, message delivery, hierarchy, parallelism, Ultrafix, and completion.
• Document authenticated REST and realtime APIs with request/response/event examples suitable for running ProPR remotely or from a Dockerized client; a CLI implementation is not required.
• Document supported provider CLI/image version floors and actionable diagnostics for missing resume/App Server capabilities.
• Add upgrade/migration and rollback notes plus storage/retention implications.
• Add observability for controller lease changes, recovery attempts, queue depth, active caps, message lag, event lag, provider/model usage, and terminal failure reasons without logging objectives, messages, credentials, or transcript contents.
• Ensure shutdown drains or checkpoints active goal sessions within a bounded timeout and reports sessions needing recovery.

Final epic validation

• Merge this issue PR only into 2002-epic-long-running-goals.
• Confirm the final draft epic PR targets main, links/closes the complete issue hierarchy, and contains no unrelated changes.
• Run the repository’s full CI/typecheck/test/security suites on the integrated branch.
• Trigger a dedicated final /ultrafix goal=9 max=8 loop on the epic PR and resolve all authorized findings.
• Keep the epic PR draft/unmerged for human approval after all automated gates are green.

Acceptance criteria

• All scenarios above have reproducible evidence in tests or documented smoke runs.
• SQL-only recovery reconstructs authoritative state; Redis loss changes performance, not correctness.
• No leaf or sub-epic implementation PR targets main.
• No provider goal state crosses goal/user boundaries.
• Existing one-shot issue, review, indexing, planner, socket, and demo behavior remains green.
• Final epic PR CI and Ultrafix reach the specified gate with a concise validation summary.

[integry]

Owner final-integration acceptance addendum

1. One canonical wire contract. Remove/replace every temporary UI goal-contract mirror with one versioned @propr/shared contract. Black-box test real Express/Socket.IO producers through actual UI decoders for create/list/detail, every mutation, message cancel/retry, forward/backward event pages, and list/detail envelopes. Cover hierarchy/node vocabulary, message states, recovery, completion blockers/HTTPS epic URL, stats units, and events. Unknown/malformed required data fails closed; no adapter fabricates defaults, capabilities, stats, cursors, or IDs.

2. Production durability bridge. Wire runtime state/transition/terminal/event/message ports to the Persist goals, hierarchy, lifecycle, and fenced controller leases #2006/Add durable goal output, steering, realtime replay, and statistics #2008 SQL repositories—never InMemoryGoalSessionPorts or Redis as truth. Map controller lease epoch to runtime fences and one canonical per-goal sequence. Inject crashes between control-plane commit, provider acceptance, event/message ack, scheduler/GitHub receipt; after daemon/container replacement plus Redis/queue/socket loss, preserve exact goal/session/provider/worktree/branch/turn/execution identities with no split-brain or duplicate effects.

3. Real create→list→detail flow. Exercise UI and documented direct API with trimmed Unicode objective limits (10..4000 code points), repository authorization, concurrency/Ultrafix bounds, response-loss idempotent create, immediate list/detail visibility, lifecycle states, requested/effective model, URL filter/search/repository/cursor preservation across Back/Cancel/success, and restart/refresh.

4. Provider/catalog routing. From the real catalog assert the fail-closed intersection of enabled agent, goalCapable, goalCapableModels, supported model, credentials/runtime availability, and pinned CLI floor. Claude/Codex/Antigravity must launch only the selected adapter/model and persist its native identity. Stale/unknown models, incapable agents, below-floor images, and provider switching fail before session mutation with actionable UI/API diagnostics.

5. Lifecycle, steering, and model concurrency. Add two-operator/response-loss cases: pause prevents new dispatch and reaches provider-declared safe boundary without cancellation; restart from pausing/paused; resume the same session and refill capacity once; cancel remains terminal. FIFO canned/free-form steering, pending cancellation, uncertain retries, controller status + ordered provider reply, and draft preservation survive reconnect. Rapid model requests and crash during application retain ordered requested/effective/audit state, apply once at the supported boundary, attribute tokens correctly, and reject stale versions.

6. Realtime/compaction. Through real socket authorization, cover disconnect/reconnect + REST fallback from exclusive cursor, duplicates/out-of-order, multi-page gaps >1,000, advancing targets during drain, process restart, and list invalidation under sustained events. Define/test expired-compacted-cursor reset/bootstrap (or lifetime replay); strict contiguous recovery must not loop. Assert one bounded reconciliation, no gap/duplicates, exact 1,000 client retention, viewport/follow-tail preservation, and socket teardown/re-auth on identity/permission changes.

7. Authoritative hierarchy/stats/terminal. Durable ProPR nodes—not provider todos—drive checklist/completion. Compare UI/list/detail stats to SQL for retry/no-code/recovered attempts, per-provider/model input/output/cache/reasoning tokens, issues/PRs, and elapsed/active/paused/recovery time with explicit units. Stream chunk-boundary and >1,000-event output containing ANSI/HTML, hostile URI/metadata, secrets, and long lines; assert server redaction, safe render/copy, bounded client/server memory, search/filter, older-page anchor, and live arrivals.

8. Hierarchy/parallelism/GitHub conflict matrix. Provider-internal agents cannot bypass ProPR’s active-task cap; dependency-ready leaves run concurrently; integration-branch merges serialize; every leaf/sub-epic/final base/head is correct; final epic remains draft until gates pass. Induce base drift and conflicts with auto-resolution enabled/disabled, conflict-agent success/failure, failed CI/Ultrafix, circuit breaker, no-code leaf, deleted/recreated branch, and closed/reopened PR. Restart/redelivery creates at most one conflict job/artifact and never advances readiness without authoritative evidence.

9. Non-enumeration/revocation. For another user and permission revoked mid-session, test list/detail/events plus every mutation/message route and socket subscribe/reconnect. Cross-owner IDs/cursors—including encoded variants—are indistinguishable from absent, emit no room/data/branch/session metadata, and do not alter sequence/idempotency. UI promptly unsubscribes, aborts stale work, clears list/detail/terminal/clipboard state, and reauthorizes. Demo/read-only remains isolated; logs/metrics contain no objectives, messages, transcripts, credentials, or paths.

10. Composed accessibility/mobile and executable remote-client evidence. Run keyboard-only desktop+narrow browser flows over real routes: one main landmark, focus order/trap/return, live/busy/offline announcements, draft preservation, reduced motion, terminal navigation, and clipboard failure feedback. From a separate Docker client, execute documented REST/realtime examples against a running ProPR instance for auth, create/list/detail, pause/resume/model/message, and cursor reconnect. Also include upgraded pre-goal DB + active-goal restart and bounded shutdown/checkpoint smoke evidence. This must prove the programmatic long-running goal path works like remote exec, not merely document it.

[integry]

Integration contract addendum — do not start #2015 until #2003, #2004, and #2005 are merged into #2002. Use Codex GPT-5.6 Sol only.

The final integration must resolve these seams explicitly, not with permissive adapters:

1. One versioned @propr/shared wire contract

• Replace the temporary UI goal-contract mirror.
• Unify node readiness/evidence states, message pending/delivering/failed/cancelled and response fields, the closed event registry, detail/recovery/blocker/epic fields, and one time unit.
• Use header Idempotency-Key canonically with the documented body fallback.
• Enforce one trimmed Unicode objective rule and exact code-point bounds.
• Bind every response/event/message to the decoded requested goal ID before applying it client-side.

2. API and pagination

• Implement cancel-message and retryOfMessageId.
• Support canonical opaque forward/backward owner+repository+filter-bound cursors with previous/next/reset semantics; no numeric cursor compatibility once the versioned contract is active.
• Return bounded detail from one SQL read snapshot with asOfVersion/asOfSequence and count+byte limits.

3. Production SQL runtime bridge

• Connect GoalSessionRuntimePorts to durable SQL; no in-memory production fallback.
• Persist exact goal/session/controllerEpoch/turn/execution/attempt/providerOperationGeneration identities, runtime CAS state, initialization/recovery/resume/cancel/model intents, provider barriers, receipts, and bounded histories.
• Use one atomic per-goal sequence allocator and transactionally couple state/message/terminal changes with audit events.
• Map orchestration lease epoch to runtime fence and recover after daemon/container replacement with Redis, queues, and sockets empty.

4. Fail-closed capability catalog
   A create or model-change candidate is goal-capable only when the agent is enabled, explicitly configured, model-supported and allowlisted, a compatible adapter is registered, credentials/runtime are available, and the pinned CLI/schema floor passes. Creation and live model change must call the same predicate before state mutation. Resolve catalog and core-index merge conflicts deliberately.

5. Authenticated realtime
   Use typed Socket.IO subscribe/ack/event/reset envelopes, SQL replay as truth, atomic high-watermark replay-to-live join, bounded backpressure, repository authorization, periodic permission revalidation, and forced eviction/clear on revocation or identity change.

6. Required integrated proof

• Realistic fake stack: single-PR and nested sub-epic goals, concurrency cap, serialized merges, pause/resume/cancel, FIFO canned/free-form steering, uncertain retries, rapid model changes, no-code/recovered stats, final epic readiness.
• Crash matrix around provider ID/output/tool/message/model/cancel/terminal/GitHub side effects, then restart with volatile infrastructure empty and prove stable identities and no duplicate effects/artifacts.
• Pinned real smokes: Claude 2.1.220, Codex App Server 0.146.0, Antigravity agy 1.1.13.
• Separate authenticated Docker client exercising REST plus Socket.IO end to end, proving /goal works programmatically like remote exec.
• Real browser desktop/narrow/keyboard/a11y/offline/reconnect/terminal behavior.
• Hostile output/security, byte-retention, 1,000-client-event cap, upgrade/restart, branch drift/conflict, exact-SHA CI/review/Ultrafix invalidation, and sustained soak.

Before the final draft 2002 -> main epic PR, verify every leaf/sub-epic base and head, run full repository and provider validation, then /ultrafix goal=9 max=8 with gpt-5.6-sol. Leave the epic PR draft and unmerged for human approval.