mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-12 23:12:23 -06:00
Patrick Buckley
d0e9aa3dbe
Field incident: the coordinator LLM hand-copied a child ws_id and collapsed its aaa run to a, producing a 30-char id. inspect said "not found", wait called it "denied", neither offered recovery, and the model concluded the child was dead and dropped the lane — silent report degradation while the child kept working. - validate model-supplied ws_id args at the tool boundary (send/close/cancel/delete/inspect/wait): full 32-hex ids pass through at unchanged storage cost; a child's exact legacy id still resolves; anything else fails fast with a did-you-mean (capped Levenshtein <=3 over the coord's own children) plus a child roster. Near-misses never auto-resolve; display names are not addresses (mutable, non-unique) — a name ref errors with a pointer at the right id - wait_for_workstream: rename per-entry state "denied" -> "not_found" with an honest sentinel; malformed refs error before any waiting (invalid_ws_ids); a well-formed id that is foreign, missing, or hard-deleted mid-wait aborts the wait on the tick that observes it instead of burning the timeout (mode=all was unsatisfiable) or riding along to complete=True (silent lane loss); mode=all completes only when every id is real-terminal; entries carry the child display name - one not-found payload across all verbs: foreign and nonexistent stay byte-identical (no existence oracle), hints reference only the coord's own children, echoed refs clipped in error strings; invalid_ws_ids and not_found share one per-ref shape with the roster hoisted top-level - inspect ownership now requires user_id parity via _row_in_own_subtree, matching the wait/mutating gates (#506) — closes the forged-parent cross-tenant read - session exec serializes the structured recovery payload (results + did_you_mean + children) on unresolvable-id wait errors instead of collapsing to the bare error string - tool JSON descriptions + coordinator docs updated to the new contract; incident regression test pins the captured aaa-collapse ids