Implement post-restart MCP reconciliation #662

New Issue

2026-07-10T15:32:04-05:00

jcwalker3 commented

2026-07-10 15:32:04 -05:00

Problem statement

After MCP restarts, sessions, leases, capabilities, worktrees, and interrupted mutations are not systematically reconciled; operators rebuild context from chat.

Operational impact

Silent orphan leases; duplicate work; unsafe mutation resume.

Scope

Post-restart must:

Verify service health
Reconnect or identify disconnected clients
Reconcile sessions vs checkpoints (#660)
Reconcile leases/locks
Reconcile capabilities/stale runtime (#610)
Reconcile worktree bindings
Detect interrupted mutations / partial work
Detect duplicates
Restore queue safely (allocator)
Notify next valid actions
Produce restart completion proof
File durable follow-up issues for unresolved recovery

Non-goals

HA multi-instance failover (roadmap child).
Automatic silent mutation replay without proof.

Required implementation investigation

#655 #660 #661 #658; merged cleanup; lease recovery #601; #630 contamination.

Proposed implementation direction

Boot hook reconcile_after_restart() + completion proof DTO; block mutations until reconcile complete or degraded mode documented.

Security / workflow-safety

Fail closed on ambiguous mutation; no blind resume of write ops.

Failure behavior

Partial reconcile → degraded mode + durable issues; not silent success.

Acceptance criteria

Boot reconcile runs automatically after restart.
Completion proof lists resolved/unresolved items.
Unresolved items become durable issues.
Tests for interrupted mutation detection.
Links #652 #653 #655.

Required tests

Fixture restart with open lease + pending mutation.

Observability and audit

Reconcile report audited.

Dependencies

Parent #655 · Depends #660 · Soft #661 · Vision #652 · Roadmap #653

Rollout

Log-only mode then enforce mutation hold.

Canonical issue state

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Implement post-restart reconciliation + completion proof
NEXT_PROMPT: Author post-restart reconcile under #655; PR; stop

Required proof

Code + tests + sample completion proof.

Required final response and handoff

Brief PR → reviewer.

## Problem statement After MCP restarts, sessions, leases, capabilities, worktrees, and interrupted mutations are not systematically reconciled; operators rebuild context from chat. ## Operational impact Silent orphan leases; duplicate work; unsafe mutation resume. ## Scope Post-restart must: * Verify service health * Reconnect or identify disconnected clients * Reconcile sessions vs checkpoints (#660) * Reconcile leases/locks * Reconcile capabilities/stale runtime (#610) * Reconcile worktree bindings * Detect interrupted mutations / partial work * Detect duplicates * Restore queue safely (allocator) * Notify next valid actions * Produce restart completion proof * File durable follow-up issues for unresolved recovery ## Non-goals * HA multi-instance failover (roadmap child). * Automatic silent mutation replay without proof. ## Required implementation investigation #655 #660 #661 #658; merged cleanup; lease recovery #601; #630 contamination. ## Proposed implementation direction Boot hook `reconcile_after_restart()` + completion proof DTO; block mutations until reconcile complete or degraded mode documented. ## Security / workflow-safety Fail closed on ambiguous mutation; no blind resume of write ops. ## Failure behavior Partial reconcile → degraded mode + durable issues; not silent success. ## Acceptance criteria 1. Boot reconcile runs automatically after restart. 2. Completion proof lists resolved/unresolved items. 3. Unresolved items become durable issues. 4. Tests for interrupted mutation detection. 5. Links #652 #653 #655. ## Required tests Fixture restart with open lease + pending mutation. ## Observability and audit Reconcile report audited. ## Dependencies * Parent **#655** · Depends **#660** · Soft **#661** · Vision **#652** · Roadmap **#653** ## Rollout Log-only mode then enforce mutation hold. ## Canonical issue state ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Implement post-restart reconciliation + completion proof NEXT_PROMPT: Author post-restart reconcile under #655; PR; stop ``` ## Required proof Code + tests + sample completion proof. ## Required final response and handoff Brief PR → reviewer.