Implement pre-restart drain proof and hard gate #661

New Issue

2026-07-10T15:31:50-05:00

jcwalker3 commented

2026-07-10 15:31:50 -05:00

Problem statement

Even with drain mode, restart can proceed without a machine-verifiable proof that unsafe work is clear and checkpoints complete.

Operational impact

False “ready to restart” claims; data loss; dogfooding fails.

Scope

DrainProof artifact: signed/hashed checklist results (no in-flight mutations, assignments stopped, checkpoints complete, handoffs ok, leases handled, acks or explicit timeout policy).
Hard gate: coordinator apply_restart requires valid unexpired drain proof (except break-glass path).
Failed drain → durable incident issue + no restart.

Non-goals

Break-glass implementation (separate).
UI approval (console child).

Required implementation investigation

#655 #658 #659 #660; final_report style validators; crypto/hash for proof id.

Proposed implementation direction

DrainProof schema + verify_drain_proof() fail closed; wire into restart apply.

Security / workflow-safety

Proof non-forgeable within process; short TTL; audit.

Failure behavior

Missing/stale/failed proof → deny restart; create incident work item.

Acceptance criteria

Restart apply without proof fails closed.
Successful drain produces verifiable proof.
Unsafe mutation open → proof fails.
Tests for pass/fail/expired.
Links #652 #653 #655.

Required tests

Gate unit tests; multi-session unsafe mutation case.

Observability and audit

Proof id in restart audit events.

Dependencies

Parent #655 · Depends #659 #660 #658 · Vision #652 · Roadmap #653

Rollout

Enforce in dogfood after dry-run period.

Canonical issue state

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Implement drain proof + hard gate
NEXT_PROMPT: Author drain proof under #655; PR; stop

Required proof

Code + tests + sample proof JSON.

Required final response and handoff

Brief PR → reviewer.

## Problem statement Even with drain mode, restart can proceed without a machine-verifiable proof that unsafe work is clear and checkpoints complete. ## Operational impact False “ready to restart” claims; data loss; dogfooding fails. ## Scope * DrainProof artifact: signed/hashed checklist results (no in-flight mutations, assignments stopped, checkpoints complete, handoffs ok, leases handled, acks or explicit timeout policy). * Hard gate: coordinator apply_restart requires valid unexpired drain proof (except break-glass path). * Failed drain → durable incident issue + no restart. ## Non-goals * Break-glass implementation (separate). * UI approval (console child). ## Required implementation investigation #655 #658 #659 #660; final_report style validators; crypto/hash for proof id. ## Proposed implementation direction `DrainProof` schema + `verify_drain_proof()` fail closed; wire into restart apply. ## Security / workflow-safety Proof non-forgeable within process; short TTL; audit. ## Failure behavior Missing/stale/failed proof → deny restart; create incident work item. ## Acceptance criteria 1. Restart apply without proof fails closed. 2. Successful drain produces verifiable proof. 3. Unsafe mutation open → proof fails. 4. Tests for pass/fail/expired. 5. Links #652 #653 #655. ## Required tests Gate unit tests; multi-session unsafe mutation case. ## Observability and audit Proof id in restart audit events. ## Dependencies * Parent **#655** · Depends **#659** **#660** **#658** · Vision **#652** · Roadmap **#653** ## Rollout Enforce in dogfood after dry-run period. ## Canonical issue state ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Implement drain proof + hard gate NEXT_PROMPT: Author drain proof under #655; PR; stop ``` ## Required proof Code + tests + sample proof JSON. ## Required final response and handoff Brief PR → reviewer.