[workflow][controller] Make cross-role allocations consumable by independent required-role workers #843

New Issue

2026-07-23T01:32:27-05:00

jcwalker3 commented

2026-07-23 01:32:27 -05:00

Problem

A controller-created allocation targeting role=author remains owned by the allocating controller session. An independent author worker cannot canonically consume or adopt it. If the controller exits, the allocation becomes stale_dead_process and must be abandoned, creating an allocation/recovery loop instead of a usable handoff.

Confirmed evidence (controller investigation)

Failed assignment: asn-11f9f1ad52bb47dc
Failed lease: lease-9817e2823c14402b
Selected item: Issue #631
Allocating session: prgs-controller-69224-ad729ec8
Required downstream role: author
adopted_by_session_id remained null
Independent gitea-author session had no authorized consume/adopt path
Allocating controller exited, producing stale_dead_process
Lease was subsequently abandoned and authoritatively verified terminal
Active leases remaining for Issue #631: zero

Related but non-duplicate work

#840 (closed) delivered controller cross-role selection/allocation. It does not provide an independent required-role worker path to consume that allocation after the controller exits.
#601 (closed) covers general lease lifecycle adopt/release/expire/abandon; it does not define controller→worker cross-role assignment handoff with authoritative ownership transfer.

Required behavior

A controller-created cross-role assignment is claimable by an independent worker in the required role and namespace.
Consumption does not require the allocating controller process to remain alive.
A canonical, capability-governed operation performs the handoff.
Successful adoption records the worker in adopted_by_session_id or the equivalent authoritative ownership field.
Assignment and lease state transition atomically and consistently.
Workers with the wrong role/profile cannot consume the allocation.
A second worker cannot consume an allocation already adopted by another worker.
Expired, abandoned, superseded, or otherwise terminal allocations cannot be adopted.
A successful handoff does not require abandonment and reassignment.
process_work_queue results provide sufficient authoritative identifiers and instructions for the required-role worker to consume the allocation safely.
Existing same-role allocation behavior remains compatible.

Acceptance criteria

Controller allocates author work; an independent author adopts it successfully.
Author adoption succeeds after the allocating controller process exits.
Author adoption can occur without sharing the controller session identity.
Wrong-role adoption is rejected.
Concurrent or second adoption is rejected without corrupting state.
Terminal allocation adoption is rejected.
Successful adoption produces authoritative read-after-write ownership evidence.
Existing lease recovery behavior remains valid for genuinely abandoned allocations.
process_work_queue / allocate results include the identifiers and next-step instructions needed for safe consume.

Required regression coverage

Controller allocates author work; independent author adopts successfully.
Author adoption succeeds after allocating controller process exits.
Author adoption without sharing controller session identity.
Wrong-role adoption rejected.
Concurrent/second adoption rejected without state corruption.
Terminal allocation adoption rejected.
Successful adoption produces authoritative ownership evidence.
Existing lease recovery remains valid for genuinely abandoned allocations.

Affected areas (expected)

Control-plane assignment/lease ownership transfer
Allocator / process_work_queue response payload
Capability map / role routing for consume/adopt
Worker workflows for receiving controller allocations
Focused unit/integration tests

Non-goals

Epic/container queue exclusion (tracked separately)
Controller performing author/reviewer/merger mutations
Weakening role isolation

## Problem A controller-created allocation targeting `role=author` remains owned by the allocating controller session. An independent author worker cannot canonically consume or adopt it. If the controller exits, the allocation becomes `stale_dead_process` and must be abandoned, creating an allocation/recovery loop instead of a usable handoff. ## Confirmed evidence (controller investigation) - Failed assignment: `asn-11f9f1ad52bb47dc` - Failed lease: `lease-9817e2823c14402b` - Selected item: Issue #631 - Allocating session: `prgs-controller-69224-ad729ec8` - Required downstream role: `author` - `adopted_by_session_id` remained null - Independent gitea-author session had no authorized consume/adopt path - Allocating controller exited, producing `stale_dead_process` - Lease was subsequently abandoned and authoritatively verified terminal - Active leases remaining for Issue #631: zero ## Related but non-duplicate work - #840 (closed) delivered controller **cross-role selection/allocation**. It does not provide an independent required-role worker path to consume that allocation after the controller exits. - #601 (closed) covers general lease lifecycle adopt/release/expire/abandon; it does not define controller→worker cross-role assignment handoff with authoritative ownership transfer. ## Required behavior 1. A controller-created cross-role assignment is claimable by an independent worker in the required role and namespace. 2. Consumption does not require the allocating controller process to remain alive. 3. A canonical, capability-governed operation performs the handoff. 4. Successful adoption records the worker in `adopted_by_session_id` or the equivalent authoritative ownership field. 5. Assignment and lease state transition atomically and consistently. 6. Workers with the wrong role/profile cannot consume the allocation. 7. A second worker cannot consume an allocation already adopted by another worker. 8. Expired, abandoned, superseded, or otherwise terminal allocations cannot be adopted. 9. A successful handoff does not require abandonment and reassignment. 10. `process_work_queue` results provide sufficient authoritative identifiers and instructions for the required-role worker to consume the allocation safely. 11. Existing same-role allocation behavior remains compatible. ## Acceptance criteria - [ ] Controller allocates author work; an independent author adopts it successfully. - [ ] Author adoption succeeds after the allocating controller process exits. - [ ] Author adoption can occur without sharing the controller session identity. - [ ] Wrong-role adoption is rejected. - [ ] Concurrent or second adoption is rejected without corrupting state. - [ ] Terminal allocation adoption is rejected. - [ ] Successful adoption produces authoritative read-after-write ownership evidence. - [ ] Existing lease recovery behavior remains valid for genuinely abandoned allocations. - [ ] `process_work_queue` / allocate results include the identifiers and next-step instructions needed for safe consume. ## Required regression coverage - Controller allocates author work; independent author adopts successfully. - Author adoption succeeds after allocating controller process exits. - Author adoption without sharing controller session identity. - Wrong-role adoption rejected. - Concurrent/second adoption rejected without state corruption. - Terminal allocation adoption rejected. - Successful adoption produces authoritative ownership evidence. - Existing lease recovery remains valid for genuinely abandoned allocations. ## Affected areas (expected) - Control-plane assignment/lease ownership transfer - Allocator / `process_work_queue` response payload - Capability map / role routing for consume/adopt - Worker workflows for receiving controller allocations - Focused unit/integration tests ## Non-goals - Epic/container queue exclusion (tracked separately) - Controller performing author/reviewer/merger mutations - Weakening role isolation