Local builder handoff: make takeover quiescent, Git-write capable, and runner-consistent

[jeffhuber]

Part of stabilization epic #979 and roadmap #900.

Part of roadmap #900. Follow-up from the v1.4.0 release dogfood in PR #959.

Problem

Code Mower validates an explicit source lane, destination lane, and exact handoff head, but the v1.4.0 recovery exposed three gaps in the execution boundary:

• The default Codex builder sandbox could not write Git metadata, so fetch, checkout, commit, and guarded push failed even though the dedicated worktree was writable.
• A source Devin session continued working after reporting that it had stood down, producing another local commit after the Codex takeover.
• This repository's checked-in dogfood runner recognizes only Codex and Claude even though the v1.4.0 generated runner supports Devin labels and source prefixes.

An accepted handoff therefore does not yet prove that the previous writer is quiescent, that the replacement can perform its normal Git duties, or that checked-in and generated runner contracts agree.

Outcome

A builder takeover starts exactly one capable destination writer only after Code Mower proves the source writer is stopped, cancelled, or suspended at the accepted head. The checked-in dogfood runner and generated runner use one canonical lane contract.

Acceptance criteria

• Under the default Codex builder posture, the dedicated checkout permits fetch, checkout, commit, and guarded push while preserving the checkout boundary and pre-push protection.
• An explicit handoff identifies the source transport/session or local process and stops, cancels, or suspends it through the existing provider-neutral lifecycle before the destination writer starts.
• If source-writer quiescence cannot be verified, the handoff fails closed with one owner action and does not start the destination writer.
• Existing expected-head validation remains effective before launch and at push; source-side head movement invalidates the handoff.
• Repeating the same handoff is idempotent and neither emits duplicate acceptance records nor starts duplicate writers.
• The checked-in dogfood runner and generated runner derive allowed lanes, builder labels, and source branch prefixes from one canonical configuration. CI detects semantic drift.
• A Devin-to-Codex fixture using a devin/ branch succeeds without local prefix patching.
• Tests cover local-process and hosted-session quiescence, cancellation failure, stale heads, Codex Git writes, generated/checked-in parity, and no writes outside the dedicated checkout.

Boundaries

Reuse the handoff validation from #751 and the provider-neutral session lifecycle from #906. Do not introduce another session state machine, automatic paid retry, force push, or broad host process scan. Keep public evidence metadata-only and exclude prompts, transcripts, source, diffs, credentials, raw provider output, and private paths.

Delivery

One independently reviewable PR with one Code Mower builder, one independent exact-head merge-authority audit, focused and relevant regression tests, and the normal Code Mower gate.

Completion dependency and PR map

One planned OSS PR; planned Code Mower Codex builder and independent eligible Code Mower Claude review. This unit precedes #963 when handoff/provenance files overlap. Its quiescence and Git-capability guarantees must be consumed before automatic takeover in #977/#920; #949 consumes the unified lineage through #963. Reuse existing #751/#906 contracts and the independent evidence vocabulary in #976. Invalid request-key/prose inputs must not be described as a provider rule against completed-session operations. No automatic create/recovery allowance is added.

[jeffhuber]

Additional live evidence from hosted Devin PR #966: the checked-in .github/workflows/code-mower-agent-pr-labeler.yml contains only the Cursor rule, while the v1.4.0 generated hosted-Devin setup includes the Devin rule. The label workflow completed successfully but left the devin/953-campaign-auth-intent PR unlabeled, requiring an orchestrator mutation. Extend the canonical generated/checked-in parity acceptance to the agent PR labeler as well as the Mac runner.

[jeffhuber]

Additional live evidence from hosted work-order delivery PR #966: the generated hosted-Devin setup includes Devin in the agent PR labeler rules, but this repository's checked-in .github/workflows/code-mower-agent-pr-labeler.yml still contains only the Cursor rule. Its successful run therefore added no builder label to a valid devin/ branch, and the orchestrator had to add builder:devin and the audit requests manually.

Please include the checked-in agent PR labeler in the canonical generated-versus-dogfood parity acceptance. A same-repository devin/ PR should receive exactly builder:devin without manual repair, and CI should fail when checked-in lane/label/prefix rules drift from the generated contract.

[jeffhuber]

PR #966 supplies a second live handoff/lifecycle fixture. Hosted Devin returned a structured completion at b5c5f5b39dad9f65746c854cc199da77e3186983; after both exact-head audits completed, the still-active provider pushed b0aa8852afbb643dea6922ad9c636971a4620c70. Code Mower correctly rejected the stale completion/audits, retained the single remote session, and completed a bounded fix round at final head ca51eb8ca8781a1272fd5950fae94278899ce504 without a duplicate create.

This demonstrates that a completion result does not itself quiesce the source writer. Acceptance should cover: stop or suspend the previous writer before treating a handoff/completion head as stable; invalidate exact-head evidence on any later push; and preserve the same remote-session identity through recovery.

[jeffhuber]

A further PR #970 fixture shows the other side of quiescence: canceling the hosted writer before audit kept the exact head stable, but a later fix request could not resume the terminal provider session (provider_unavailable) and left the reserved message request in inspect_provider_then_acknowledge uncertainty. A bounded replacement Devin work order was required for reviewer fixes.

The handoff/lifecycle contract should therefore distinguish suspend/resumable quiescence from terminal cancel, and it needs a truthful way to resolve a message known not to have been delivered instead of requiring acknowledge_delivered.

[jeffhuber]

(aside) Additional hosted lifecycle evidence from #935 / PR #972, with a correction to the preliminary handoff interpretation.

Early fix and cancel attempts returned invalid_request. The retained command evidence shows missing request keys on the input-file fix and cancellation attempts; the other fix did not provide a valid separated request/prose pair. These calls do not establish that the provider rejected a well-formed operation against a completed session: local validation can fail before contacting it, and the preview path does not validate those applied inputs.

The later recovery accepted a same-session message and an exact-head fix, reaching completion round 2 without another create. Direct provider observations then showed that the original writer was still running despite logical structured completion. Valid keyed cancellation through Code Mower succeeded for both the original and first recovery, and fresh provider observations confirmed both exited. The final recovery was separately cancelled and confirmed exited during an owner task stop.

Acceptance should distinguish logical result completion from writer quiescence, validate request/prose requirements in previews, and preserve whether a failure occurred before any provider operation. The earlier terminal-cancel/resume limitation recorded for PR #970 remains a separate fixture; do not infer it from these invalid-input calls. PR #973 began its controlled takeover only after all three #935 writers were independently confirmed exited.