fix(core): fence existing PR publication

[coreplane-switchboard]

Requested by justin · Thread

Existing-PR coding continuations now publish only when durable authority, the request, workspace, ownership, and fresh GitHub facts agree. Exact leased pushes prevent races, alternate refs, duplicate PRs, and silent checkpoint loss.

#2200 showed valid existing-PR work blocked or redirected by head/base confusion. #2328 reproduced it, while #2202 requires truthful handling of unpublished checkpoints.

Rendered by the plan runner from the coding run's submitted description; the run ended before it could open the pull request itself.

[coreplane-switchboard]

Changes requested: The exact-head fence still loses unpublished work on a concurrent lease rejection and permits PR mutations after publication is blocked.

Warning

Changes requested · head cf1bb1b · 2 findings: 2 major

Severity	Finding	Where
major	F1 Spec contradiction — docs/reference/specs/execution.md item 30: concurrent lease rejection releases unpublished work	src/core/dispatch/runLoop.ts:979
major	F2 Spec contradiction — docs/reference/specs/execution.md item 30: blocked publication can still mutate or recreate the PR	src/core/dispatch/runLoop.ts:1851

Full review

F1 — Major, high confidence. If verification admits head A, another actor moves the branch to C, and the child attempts to push B, the lease correctly rejects the push. However, that failure never changes existingPrPublication to blocked, so salvage reports failure and releaseWorkspace() discards the resident checkout containing B. Treat any leased-push rejection as a denied publication, retain the unpublished checkpoint under the same policy, and add the missing concurrent-movement regression.

F2 — Major, high confidence. The ordinary PR post-step remains enabled after exact-head verification fails. A blocked run with no local delta can submit a description and edit the moved PR using stale intent; if the PR closes after admission, open-or-edit can create a duplicate. Skip all PR writes when publication is blocked, or require another exact binding and head verification immediately before the post-step.

[coreplane-switchboard]

Changes requested: The prior findings are fixed, but compaction-time lease rejection does not revoke the already-open harness's stale push authority.

Warning

Changes requested · head 3e923cb · 1 finding: 1 major

Severity	Finding	Where
major	F3 Spec contradiction — docs/reference/specs/execution.md item 30: compaction rejection leaves stale push authority live	src/core/dispatch/runLoop.ts:1365

Full review

F3: After a compaction salvage push is rejected, this assignment blocks only the run-loop’s later salvage and PR post-step. The already-open harness still holds the original allowed rules.publication object passed at line 1382, and the compaction contract explicitly lets the loop continue. A later model-issued push can therefore still be authorized by the stale receipt, violating the requirement that denied publication remain denied. Mutate a shared publication fence or otherwise revoke/end harness push authority when the rejection lands.

[coreplane-switchboard]

LGTM: F3 is resolved: a rejected salvage push now revokes the shared live publication fence before any later model push.

Note

Approved · head e396c0c · no findings

Full review

F3 is resolved. The shared live publication fence is revoked after a rejected salvage push, and the regression proves a subsequent model-issued push is refused.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.

[coreplane-switchboard]

LGTM: The prior cancelled worker check was superseded by a successful check on the same head, with no code delta or unresolved findings.

Note

Approved · head e396c0c · no findings

Full review

No unresolved findings; the superseding worker check passed on the same head.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.