Manage the complete browser-session lifecycle #5

New issue

Closed

opened 2026-08-28 19:24:38 +00:00 by dikka · 1 comment

dikka commented

2026-08-28 19:24:38 +00:00

Owner

What to build

Make browser-created sessions durable workspace records through their whole lifecycle while keeping process ownership directly in the hub. A project's plus action creates and opens a Starting record before spawning Pi. Readiness binds the exact Pi identity and path when one exists. The hub may stop only the process group it launched; no separate supervisor is introduced.

Stop retains the record, history, drafts, and placement. An untouched stopped session remains an empty New session record and Continue starts a fresh Pi process for that same workspace identity. A persisted stopped session continues by its exact canonical path. Continue selects an already-live session instead of duplicating it and never adopts an independent process.

Handle start failure, hub restart, duplicate declared IDs, duplicate resume races, missing working directories or files, and stale management authority explicitly. Forget is stopped-only and removes Pilcrow metadata without deleting or rewriting Pi JSONL.

Acceptance criteria

The project plus action creates a durable Starting record before spawn and navigates to it immediately.
Input becomes usable only after matching Pi authority is ready; start failure retains actionable Continue and Forget controls.
Stop terminates only the exact hub-owned process group and retains the workspace record and all Pi history.
Hub shutdown stops its owned Pi processes; after restart the records are stopped and Continue-able.
Continue resumes a persisted session by exact canonical path or starts a fresh process for an empty record without changing workspace identity.
An already-live independent session is selected rather than adopted or duplicated.
Duplicate identity/path races leave at most one live owner and clean up a losing hub-owned process.
Missing cwd, missing file, corrupt file, and duplicate declared ID states are bounded and never trigger silent relocation.
Forget is unavailable for a hub-owned running process and never deletes or modifies Pi session files.
Process, authority, HTTP/SSE, and browser rendered-contract tests cover new, stop, restart, continue, failure, and forget.

Blocked by

#4 — Persist terminal-observed sessions as workspace records

Human checkpoint note: Do not request routine per-ticket approval. The implementing agent may make the internal architecture, refactoring, testing, and UI-detail decisions needed to satisfy the acceptance criteria. Pause only if implementation requires a material product or ownership change, a destructive or hard-to-reverse action, excluded security or deployment scope, credentials or spending, or a real-browser design fork with no safe default. Forgejo completion updates may be batched with the rest of the completed frontier. The user performs final hub and Pi restart steps. Agents must not start, restart, replace, or stop the user-run Pilcrow development server.

## What to build Make browser-created sessions durable workspace records through their whole lifecycle while keeping process ownership directly in the hub. A project's plus action creates and opens a Starting record before spawning Pi. Readiness binds the exact Pi identity and path when one exists. The hub may stop only the process group it launched; no separate supervisor is introduced. Stop retains the record, history, drafts, and placement. An untouched stopped session remains an empty New session record and Continue starts a fresh Pi process for that same workspace identity. A persisted stopped session continues by its exact canonical path. Continue selects an already-live session instead of duplicating it and never adopts an independent process. Handle start failure, hub restart, duplicate declared IDs, duplicate resume races, missing working directories or files, and stale management authority explicitly. Forget is stopped-only and removes Pilcrow metadata without deleting or rewriting Pi JSONL. ## Acceptance criteria - [ ] The project plus action creates a durable Starting record before spawn and navigates to it immediately. - [ ] Input becomes usable only after matching Pi authority is ready; start failure retains actionable Continue and Forget controls. - [ ] Stop terminates only the exact hub-owned process group and retains the workspace record and all Pi history. - [ ] Hub shutdown stops its owned Pi processes; after restart the records are stopped and Continue-able. - [ ] Continue resumes a persisted session by exact canonical path or starts a fresh process for an empty record without changing workspace identity. - [ ] An already-live independent session is selected rather than adopted or duplicated. - [ ] Duplicate identity/path races leave at most one live owner and clean up a losing hub-owned process. - [ ] Missing cwd, missing file, corrupt file, and duplicate declared ID states are bounded and never trigger silent relocation. - [ ] Forget is unavailable for a hub-owned running process and never deletes or modifies Pi session files. - [ ] Process, authority, HTTP/SSE, and browser rendered-contract tests cover new, stop, restart, continue, failure, and forget. ## Blocked by - #4 — Persist terminal-observed sessions as workspace records > **Human checkpoint note:** Do not request routine per-ticket approval. The implementing agent may make the internal architecture, refactoring, testing, and UI-detail decisions needed to satisfy the acceptance criteria. Pause only if implementation requires a material product or ownership change, a destructive or hard-to-reverse action, excluded security or deployment scope, credentials or spending, or a real-browser design fork with no safe default. Forgejo completion updates may be batched with the rest of the completed frontier. The user performs final hub and Pi restart steps. Agents must not start, restart, replace, or stop the user-run Pilcrow development server.

dikka added the

ready-for-agent

label

2026-08-28 19:24:38 +00:00

dikka referenced this issue

2026-08-28 19:24:39 +00:00

Browse, import, continue, and search cold sessions #7

dikka referenced this issue

2026-08-28 19:24:40 +00:00

Make placement and Later scheduling durable #8

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#4 Persist terminal-observed sessions as workspace records

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#7 Browse, import, continue, and search cold sessions

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#8 Make placement and Later scheduling durable

dikka commented

2026-08-28 22:50:59 +00:00

Author

Owner

Implemented in jj revision 7c615132 (feat(hub): persist browser session lifecycle and exact-path continuation).

What changed:

Browser + creates, persists, emits, and selects an opaque starting workspace record before spawn. Input remains unavailable until the exact launch is durably registered and bound.
Workspace catalog v2 persists managed and observed starting, ready, stopped, and safety-quarantined blocked records with bounded failure diagnostics and no migration or Pi JSONL rewrite.
Hub ownership is fenced by opaque workspace ID, per-launch token, authority revision, and exact process group. Stop and shutdown signal only groups launched by this hub.
An absolute readiness watchdog aborts the exact process group when no extension connects or registration is malformed, incompatible, timed out, stale, or bound to changed resume-file identity.
Continue atomically reserves one stopped managed record, preserves workspace identity, resumes only its exact validated Pi JSONL path, starts fresh only for untouched empty records, selects live independent exact-path sessions without adopting them, and rejects duplicate concurrent Continue.
Independent runtimes permanently transition matching non-authoritative records to durable observed authority, so temporary disconnection can never grant later Continue authority.
Unproven shutdown survivors become durable blocked records rather than ordinary stopped records. They remain non-Continue-able after restart until safe reconciliation or Forget.
Added a narrow SessionHistorySource precursor for bounded, timed, non-symlink exact-file validation with Pi session-header checks and dev/inode/size/time identity rechecks before spawn and binding.
Owned-exit persistence callbacks are tracked and surfaced without unhandled rejection. Forget tombstones/reserves before durable deletion, rejects concurrent authority changes, rolls back on failure, and never deletes or rewrites Pi JSONL.
Catalog loading now enforces current-user ownership, private mode, regular non-symlink/single-link state, mutation checks, and existing atomic 0600 replacement.
Browser Starting, failed, stopped, and blocked states expose only controls that are safe for the current authority.

Audit and regression coverage:

Fresh review found missing readiness cleanup, incorrect managed→independent authority, unsafe shutdown-survivor projection, weak/unbounded resume validation, unhandled exit persistence, a Forget deletion race, and unsafe catalog-load permissions. All findings were fixed before closure.
Added real no-connect/trickled/incompatible/malformed launch abortion, persist+SSE-before-spawn, concurrent exact-path race, resume mutation/oversize/symlink cases, managed shutdown failure + restart quarantine, callback rejection, Forget race/rollback/order, and unsafe catalog-state tests.
Exact-path race stress passed 25 consecutive runs.

Validation:

Supervisor focused verification passed: 8 files / 154 tests.
Full suite passed: 62 files / 450 tests.
TypeScript no-emit check, hub build, production browser build, changed-file formatting checks, and git diff --check passed.
Whole-tree vp check is blocked only by the unchanged pre-existing formatting finding in .dev/agents/triage-labels.md.

No supervisor process, migration path, cold History UI, observed Stop authority, or Pi JSONL mutation was introduced. No dev server was managed.

Implemented in jj revision `7c615132` (`feat(hub): persist browser session lifecycle and exact-path continuation`). What changed: - Browser `+` creates, persists, emits, and selects an opaque `starting` workspace record before spawn. Input remains unavailable until the exact launch is durably registered and bound. - Workspace catalog v2 persists managed and observed `starting`, `ready`, `stopped`, and safety-quarantined `blocked` records with bounded failure diagnostics and no migration or Pi JSONL rewrite. - Hub ownership is fenced by opaque workspace ID, per-launch token, authority revision, and exact process group. Stop and shutdown signal only groups launched by this hub. - An absolute readiness watchdog aborts the exact process group when no extension connects or registration is malformed, incompatible, timed out, stale, or bound to changed resume-file identity. - Continue atomically reserves one stopped managed record, preserves workspace identity, resumes only its exact validated Pi JSONL path, starts fresh only for untouched empty records, selects live independent exact-path sessions without adopting them, and rejects duplicate concurrent Continue. - Independent runtimes permanently transition matching non-authoritative records to durable observed authority, so temporary disconnection can never grant later Continue authority. - Unproven shutdown survivors become durable `blocked` records rather than ordinary stopped records. They remain non-Continue-able after restart until safe reconciliation or Forget. - Added a narrow `SessionHistorySource` precursor for bounded, timed, non-symlink exact-file validation with Pi session-header checks and dev/inode/size/time identity rechecks before spawn and binding. - Owned-exit persistence callbacks are tracked and surfaced without unhandled rejection. Forget tombstones/reserves before durable deletion, rejects concurrent authority changes, rolls back on failure, and never deletes or rewrites Pi JSONL. - Catalog loading now enforces current-user ownership, private mode, regular non-symlink/single-link state, mutation checks, and existing atomic `0600` replacement. - Browser Starting, failed, stopped, and blocked states expose only controls that are safe for the current authority. Audit and regression coverage: - Fresh review found missing readiness cleanup, incorrect managed→independent authority, unsafe shutdown-survivor projection, weak/unbounded resume validation, unhandled exit persistence, a Forget deletion race, and unsafe catalog-load permissions. All findings were fixed before closure. - Added real no-connect/trickled/incompatible/malformed launch abortion, persist+SSE-before-spawn, concurrent exact-path race, resume mutation/oversize/symlink cases, managed shutdown failure + restart quarantine, callback rejection, Forget race/rollback/order, and unsafe catalog-state tests. - Exact-path race stress passed 25 consecutive runs. Validation: - Supervisor focused verification passed: 8 files / 154 tests. - Full suite passed: 62 files / 450 tests. - TypeScript no-emit check, hub build, production browser build, changed-file formatting checks, and `git diff --check` passed. - Whole-tree `vp check` is blocked only by the unchanged pre-existing formatting finding in `.dev/agents/triage-labels.md`. No supervisor process, migration path, cold History UI, observed Stop authority, or Pi JSONL mutation was introduced. No dev server was managed.

dikka closed this issue

2026-08-28 22:50:59 +00:00