#380: closed_label_reconciler run_once per-item fail-soft

[loning]

摘要

修复 #380:closed_label_reconciler daemon 的 crash-loop —— run_once() 对每个 CLOSED managed item 调 apply_plan()/verify_plan(),任一抛 RuntimeError(缺 canonical phase/human label)即让整个 daemon tick 崩溃,导致进程退出→重启→再崩,release-gate 的 fresh_heartbeats 信号长期红。

• Old:run_once() per-item apply/verify 无异常隔离,单个 label-drift 的 closed item 抛 RuntimeError crash 整 tick。
• New:per-item try/except RuntimeError fail-soft —— 失败时打印 closed-label-reconciler failed: <kind> #<number> terminal=<label> error=<message>(_format_failure)后 continue 下一 item;live_plan is None 的 stale skip 语义保持;daemon-log-only,不新增 label bootstrap、issue/PR lifecycle、generic gh-label/gh-edit、pending-event 或任何 durable alert/authority surface。

根因:仓库有 80+ migration 前 legacy-only CLOSED item 只带 emoji legacy label,缺 canonical phase/human;reconciler 按 #238 不能补 human label,故 verify 必抛 → fail-soft 是正解(逐个跳过而非崩溃)。

范围

5 文件 +133/-8:

• closed_label_reconciler.py:run_once() per-item try/except RuntimeError + _format_failure
• test_closed_label_reconciler.py:+2 fail-soft behavior test(missing-canonical-label / post-edit-invariant 均 continue)
• test_runtime_exception_authorization_sources.py:daemon-log-only / fail-soft / no pending-event / no label-bootstrap source-regression token
• SKILL.md / authorizations/runtime-exceptions.md:Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238 per-item fail-soft 合同各补 1 句

全 suite 970 tests OK(278s,skipped=1)。HOST_REFACTOR_COMMENT_POLICY=none:源码不加 # Refactor 注释,rationale 在 commit/PR body。

共识

design-consensus #380 r4 structural 3/3 consensus(minimal/structural/delete 三 solver 一致 propose,meta-judge 仲裁 consensus;完整推理见本 issue #380 上方各 solver/meta-judge 评论)。落地后解除 release-gate fresh_heartbeats 红信号 —— v1.0.0-beta.6 最后一个 blocker。

Closes #380

🤖 Auto-loop / codex-refactor-loop

⟦AI:AUTO-LOOP⟧

[loning]

📊 当前状态 — review-gate r1(不需要人介入)

维度	值
阶段	review-gate r1(architect / tests / quality 3 reviewer 并行)
PR	#384(draft)← refactor/iter380-issue-380 → auto-refact-dev
关联 issue	#380(closed_label_reconciler crash-loop fail-soft)
controller 自测	✅ 全 suite 970 OK(278s)
共识	✅ design-consensus #380 r4 structural 3/3
是否需要人介入	❌ 否

下一步自动会做:3 reviewer verdict + CI 绿 + mergeable → 真值表 reject=0 则 ready+merge 到 auto-refact-dev;有 reject → fix r2。merge 后解除 release-gate fresh_heartbeats 红 → 推进 v1.0.0-beta.6。

🤖 controller status banner

⟦AI:AUTO-LOOP⟧

[loning]

🤖 质量审查拒绝：PR 范围混入多条无关变更

TL;DR

• 这是什么:PR 384 的 quality/readability 独立审查。
• 结论:reject,不是因为 closed_label_reconciler 的 fail-soft 实现难读,而是 PR diff 混入大量无关 release/workflow/prompt/source-language 变更。
• 下一步:请把 closed_label_reconciler crash-loops on missing canonical label (should fail-soft per-item) #380 fail-soft 修复收窄成独立 PR,其余主题拆到各自 PR。

---

详细说明

closed_label_reconciler.py:47 开始的 per-item RuntimeError fail-soft 路径本身是局部、可读的。问题是三点:PR 标题和 body 指向 #380 daemon crash-loop,但实际三点 diff 是 83 个文件、1417 行新增、955 行删除;同时 required_checks.py:16 改 release required-check 合同,test_source_language_policy.py:1 新增 310 行源码语言策略扫描器,SKILL.md:41 和 SKILL.md:101 改入口/host.env 合同。这些都不是 closed-label-reconciler fail-soft 的同一审查单元。

从代码质量角度,这会让 review 噪声过大:一个小 daemon 修复下面带着多个独立政策/运行时合同变更,后续很难判断命名、复杂度、死代码和范围是否合理。建议保留 #380 相关文件和窄合同文档,其余主题拆分。

---

📎 完整 codex 原始输出(存档备查)

---

pr: 384
role: quality
verdict: reject

Verdict

Reject: the closed-label-reconciler fail-soft code is readable, but this PR carries large unrelated release, workflow, prompt, and source-language-policy changes, so the branch is not reviewably focused for #380.

Evidence

• skills/codex-refactor-loop/scripts/codex_refactor_loop/closed_label_reconciler.py:47 keeps the intended per-item RuntimeError fail-soft path simple and localized; this part is not the quality problem.
• skills/codex-refactor-loop/scripts/codex_refactor_loop/release/required_checks.py:16 introduces a new host-env required-check configuration path and changes the runtime contract for release checks. That is release-gate scope, not closed-label-reconciler fail-soft scope.
• skills/codex-refactor-loop/scripts/test_source_language_policy.py:1 adds a new 310-line source-language/refactor-history scanner with AST/tokenization helpers and allowlist maintenance. That is a separate policy/lint feature, not a daemon crash-loop fix.
• skills/codex-refactor-loop/SKILL.md:41 rewrites the loop entry-mode contract, and skills/codex-refactor-loop/SKILL.md:101 adds $HOST_GITHUB_RELEASE_REQUIRED_CHECKS; both are unrelated contract changes for this PR title/body.
• PR diff is 83 files, 1417 insertions, 955 deletions, while the implementation summary claims a 5-file closed-label-reconciler fail-soft change. That mismatch makes naming/scope/readability review noisy and increases the chance that unrelated cleanup ships under a behavior-fix PR.

What would change your verdict (only if comment or reject)

Split or rebase the branch so PR 384 contains only the #380 fail-soft change: closed_label_reconciler.py, its focused behavior/source-regression tests, and the narrow #238 fail-soft contract docs. Move release required-check configurability, source-language policy scanning, workflow-spec wording, prompt rewrites, and broad refactor-history comment removal into separate PRs with their own review context.

⟦AI:AUTO-LOOP⟧
REVIEW_DONE:384:quality:reject

⟦AI:AUTO-LOOP⟧

[loning]

🤖 Tests review approve

TL;DR

• 这是什么: PR 384 的 tests 角度独立 review。
• 结论: approve, 新增 fail-soft 行为和相关 helper 都有具体行为断言。
• 下一步: controller 可把此 reviewer 视为 tests 通过信号。

---

详细说明

我检查了三点: 新增行为是否有测试、测试是否只是 bump line-count、以及有没有新增 sleep/skip/弱化断言。closed_label_reconciler.run_once 的每项 fail-soft 行为有两条直接测试: apply_plan 抛错后继续处理下一项,以及 verify_plan 抛错后继续处理下一项。相关 release required checks、release-countdown projection、HostWorkflowSpec projection 也都有具体输出断言和 forbidden-field/source-regression 覆盖。

我在干净 PR worktree 跑过目标套件: test_closed_label_reconciler.py 16 个、test_required_release_checks.py 8 个、test_wakeup_plan.py 52 个、test_host_workflow_spec.py 7 个,全部通过。未发现新增 skip/xfail/manual、测试节奏 sleep/delay、assert True 占位或明显弱化断言。

---

📎 完整 codex 原始输出(存档备查)

---

pr: 384
role: tests
verdict: approve

Verdict

Approve: the PR's net-new behavior has concrete behavior tests and matching source-regression coverage, with no added skip/pacing-sleep/assertion-loosening issues found.

Evidence

• skills/codex-refactor-loop/scripts/test_closed_label_reconciler.py:320 covers the new per-item fail-soft path when apply_plan raises, asserting item [refactor-design] 自动发布 pipeline:版本 bump + tag/release + dogfood 测试(维护者要求) #32 still applies/verifies and the failure is reported for item [refactor-design] 建立项目 CI harness:Actions + lint + 版本同步 + 分支保护(维护者要求) #31.
• skills/codex-refactor-loop/scripts/test_closed_label_reconciler.py:371 covers the post-edit invariant failure path when verify_plan raises, asserting the next plan still runs and the failed item is reported without aborting run_once.
• skills/codex-refactor-loop/scripts/test_required_release_checks.py:123 and :132 cover the new host-owned required-check parser and fail-closed behavior when HOST_GITHUB_RELEASE_REQUIRED_CHECKS is missing, including the no-API-call outcome.
• skills/codex-refactor-loop/scripts/test_wakeup_plan.py:660, :674, and :719 cover release-countdown status projection, non-dispatchability, and ordering preservation for release-target milestone handling.
• skills/codex-refactor-loop/scripts/test_host_workflow_spec.py:88 covers the new workflow projection surface and asserts forbidden lifecycle fields are absent from the projected data.
• Targeted verification on a clean PR worktree passed: python3 -m unittest skills/codex-refactor-loop/scripts/test_closed_label_reconciler.py (16 tests), test_required_release_checks.py (8 tests), test_wakeup_plan.py (52 tests), and test_host_workflow_spec.py (7 tests).
• Added test hunks were scanned for sleep/delay pacing, skip/xfail/manual markers, assert True placeholders, and weakened assertion patterns; no in-scope blocker was found.

⟦AI:AUTO-LOOP⟧
REVIEW_DONE:384:tests:approve

⟦AI:AUTO-LOOP⟧

[loning]

🤖 架构审查: comment, #380 代码边界 OK 但 PR diff 需要收口

TL;DR

• 这是什么:PR #380: closed_label_reconciler run_once per-item fail-soft #384 的 architect 角度独立审查。
• 结论是什么:comment-only, closed_label_reconciler crash-loops on missing canonical label (should fail-soft per-item) #380 的 closed-label-reconciler fail-soft 没越过 Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238 窄授权。
• 下一步:建议刷新/rebase PR,让三点 diff 只包含声明的 5 文件范围,或补 SCOPE_EXTEND 说明。

---

详细说明

#380 的核心改动是在 closed_label_reconciler.py 里对每个 CLOSED managed item 的 RuntimeError 做 daemon-log-only fail-soft,失败时打印 closed-label-reconciler failed: ... 并继续处理后续 item。它没有新增 label bootstrap、pending-event、durable alert、通用 gh-label/gh-edit,也没有引入新的 lifecycle actor。从 CLAUDE.md 的 #238 carveout 看,这条主链路是合规的。

我保留 comment 的原因是 scope honesty:按 prompt 要求看的 git diff origin/auto-refact-dev...origin/refactor/iter380-issue-380 --name-only 当前有 83 个文件,而 PR body 声明的是 5 文件 +133/-8。最后一个提交 b35cd69^..b35cd69 确实只有 5 文件,所以这更像 branch/update-base review surface 漂移,不是 #380 代码本身的架构违规。建议刷新 PR 基线,或者显式写 SCOPE_EXTEND。

---

📎 完整 codex 原始输出(存档备查)

---

pr: 384
role: architect
verdict: comment

Verdict

comment-only: #380's fail-soft change stays inside the #238 closed-label-reconciler carveout, but the PR review surface is wider than the declared five-file implementation scope.

Evidence

• git diff origin/auto-refact-dev...origin/refactor/iter380-issue-380 --name-only reports 83 changed files, while PR #380: closed_label_reconciler run_once per-item fail-soft #384's body declares "5 文件 +133/-8"; the last commit (b35cd69^..b35cd69) is indeed five files, so this looks like branch/update-base scope drift rather than a closed_label_reconciler crash-loops on missing canonical label (should fail-soft per-item) #380 code violation. CLAUDE scope basis: "变更必须可验证:行为约束必须落到机械验证手段(behavior test / source-regression test / 段落 lint);仅靠"agent 应该记得"承载的约束视为未落地。"
• skills/codex-refactor-loop/scripts/codex_refactor_loop/closed_label_reconciler.py:47 wraps only per-item apply_plan() / verify_plan() RuntimeError, logs through _format_failure, and continues later items; it does not add label bootstrap, pending events, lifecycle edits, or a parallel actor. This matches CLAUDE's Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238 carveout: "Closed issue/PR phase-label reconciliation is detected by peek but never auto-applied — stale crnd:phase:* labels accumulate #238 是唯一 closed managed item phase-label reconciliation carveout:active-controller owner 的 checked-in closed-label-reconciler 只可对 CLOSED crnd:lifecycle:managed issue/PR 做 phase-label reconciliation,移除 phase/cleanup/stuck label 并加 exactly one terminal phase crnd:phase:merged 或 crnd:phase:closed;禁止 open item mutation、issue/PR create/close/reopen/body/title edit、PR merge、human/triage/milestone/lifecycle label mutation、tag/release、generic lifecycle actor。"
• skills/codex-refactor-loop/SKILL.md:318 and skills/codex-refactor-loop/authorizations/runtime-exceptions.md:191 mirror the new per-CLOSED-item daemon-log-only fail-soft contract and explicitly preserve no label bootstrap / no pending-event / no durable alert authority. This maps to CLAUDE: "强类型边界,窄扩展点:任何 controller-runtime 例外必须 narrow allowlist + no lifecycle authority by default;授权来源必须 durable artifact + 仓库级文档双重锚定。"
• skills/codex-refactor-loop/scripts/test_closed_label_reconciler.py adds behavior coverage for apply-time and verify-time RuntimeError continuation, and skills/codex-refactor-loop/scripts/test_runtime_exception_authorization_sources.py adds source-regression tokens for the mirrored authorization/forbidden surfaces. This satisfies CLAUDE: "CI / 守卫:任何 controller-runtime 例外(narrow allowlist daemon、observability、decision-artifact 等)必须配套机械验证手段(behavior test + source-regression test)。"

What would change your verdict (only if comment or reject)

Rebase or otherwise refresh PR #384 so the required three-dot review diff against origin/auto-refact-dev contains only the declared #380 scope, or document an explicit SCOPE_EXTEND explaining why the additional files are intentionally part of this PR.

⟦AI:AUTO-LOOP⟧
REVIEW_DONE:384:architect:comment

⟦AI:AUTO-LOOP⟧

[loning]

🤖 关闭:#380 已被 #370 在 dev/auto-refact-dev 上更彻底修复(本 PR 冗余)

排查发现 #380 描述的 closed_label_reconciler crash-loop 已由 #370(Refactor (iter370/issue-370))修复,且该修复已随 rollup #369/#376/#383 合入 dev 与 auto-refact-dev:

• closed_label_reconciler 单 item invariant 失败崩死 daemon → 卡死 release-gate fresh_heartbeats → beta.6 blocker #370 的 run_once() 用 try/except Exception 包住每个 per-item 的 apply_plan() + verify_plan()(本 PR 只 catch RuntimeError,更窄),并加 finally: beat() 在 tick 内续 heartbeat —— 严格优于本 PR。
• 本 PR(#380: closed_label_reconciler run_once per-item fail-soft #384)基于 stale local base(merge-base 早于 closed_label_reconciler 单 item invariant 失败崩死 daemon → 卡死 release-gate fresh_heartbeats → beta.6 blocker #370 落地),与 dev 的 closed_label_reconciler 单 item invariant 失败崩死 daemon → 卡死 release-gate fresh_heartbeats → beta.6 blocker #370 改动在同 5 文件上 CONFLICTING,且不带来额外价值。

真因:本会话 daemon 仍 crash 是因为 controller 本地 checkout 落后 origin/dev 6 commits,跑的是 pre-#370 旧码。已 git pull --ff-only origin dev 拉入 #370 + restart-daemons,daemon 现跑 fail-soft 码,不再 crash。

→ 关闭本 PR(冗余),关闭 #380(已解决)。worktree/branch 清理。

🤖 controller status banner

⟦AI:AUTO-LOOP⟧