OBS-11 — stop/resume killed pure-native runs over a phantom external pin.
Role templates' preferred_external_agent leaked into execution identity even
when the user requested native and execution actually ran native; on resume
the availability gate trusted the pin and failed every non-terminal item.
Root fixes across the whole chain:
- Staffing card per-role defaults are now the RESOLVED backend (explicit
session agent choice > runnable template preference > native), never a
hardcoded external default; seat enrichment and the dispatch selector's
locked branch downgrade provably unavailable externals to native and
record the wish in execution_agent_unavailable.
- The resume availability gate fails closed only when a resumable external
session actually exists; a bare pin heals to native (snapshot AND task
durable identity) and the run resumes — mirroring dispatch fallback.
- Suspend-checkpoint replies: force_resume (chat/headless spelling) is
recognized alongside ui_force_resume, and bare continuation tokens
(English and Chinese spellings) take the plain-resume path instead of
being routed to the final decider as content, which reopened the
already-approved intake card.
OBS-5 — failed runs never closed and dropped new input. The dispatcher's
convergence exit now settles terminally-failed runs (status=failed,
lifecycle=closed_failed, run_failure metadata) and emits a
company_run_failure_review card whose replies never swallow messages:
dismiss acknowledges, content falls through so normal routing starts a
fresh run. _maybe_resume_existing_company_runtime no longer re-executes a
terminally-failed tree: control replies get an honest closed status,
content-bearing input starts a new run.
OBS-6 — provider quota exhaustion terminally failed work items. Rate-limit
rejections are classified (LLMProvider.is_rate_limit_error, covering
status codes, exception types, and English/Chinese provider error text),
the agent runtime raises typed ProviderQuotaExhaustedError instead of
burning conversation-feedback retries, and the company dispatcher parks:
the item returns to READY (attempt interrupted, no terminal failure), the
member session idles, and claiming backs off exponentially (60s doubling
to a 900s cap; a quiet 30min resets the streak) before resuming
automatically.
Verified end-to-end on the real minimax-m3 campaign: same goal, same 300s
stop point, same run shape that previously killed the whole tree within
90s now resumes cleanly and completes with all items approved; staffing
defaults native for all 11 roles.
Tests: test_stop_resume_native_pin (10), test_run_failure_settlement (6),
test_provider_quota_park (9); attempt-ledger, recruiter, and
suspend-resume suites updated to the new contracts (their old assertions
pinned the defective behaviors).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Suite went from 27 failures plus one permanent hang (never finished) to
1846 passed / 0 failed in ~85s, including under FORCE_COLOR.
- office_shutdown_lifecycle: construct WSHandler via the real __init__
(helper) instead of hand-copied __new__ stubs that drift from the
constructor (#11 added _runtime_status_sync_task and the stubs hung);
the formerly-hanging wait now has a 5s wait_for.
- import-time patch hygiene: company_recruiter / company_reorg /
engine_session_defaults replaced module-level permanent
tempfile.TemporaryDirectory monkeypatching with paired
setUpModule/tearDownModule, fixing order-dependent sqlite failures in
transcript_pagination during full runs.
- stale tests updated to current product semantics: resume stubs use
status="done" (failed is deliberately non-resumable), fix4 asserts the
native review contract through build_company_work_item_contract,
delivery fixture carries user_visible/feedback_scope=final, ownership
doc names progress_log, session compression calls
maybe_compact_session(force=True) explicitly, hard delete removes the
work item row, parallel-isolation asserts delegate rebind and stubs
_get_project_delegate, role update goes through OrgService on an
editable custom org (plus read-only rejection case), collab_rpc patches
the single os.name decision point instead of poisoning pathlib, codex
no-pty builds inside the patch, identity-guard false positives reworded.
- cli_board actions rewritten against the real OfficeServiceFactory seam
with a tempdir OPC_HOME (old direct-engine stubs were never consulted
and the tests wrote into the real OPC home).
- cli_app assertions strip ANSI via _plain_output so a color-forcing
shell (FORCE_COLOR) cannot break plain-text expectations.
- deleted never-runnable test_org_concurrency (pytest.mark.asyncio
without the plugin, stdlib-only assertions) and three dead skipped
filesystem-handoff tests.
- pyproject: dev extra (pytest, pytest-timeout) and a 300s per-test
timeout backstop so a wedged test fails instead of stalling the suite.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
cgycorey