CL-6452: resolve launches from the hub-authored definition, never run-deploy clones - #182
Merged
Merged
Conversation
TheGreatAxios
force-pushed
the
cl-6452-authoritative-defs
branch
from
August 21, 2026 04:36
2c0ac4d to
ade3267
Compare
…lones
Every code-sourced run deploy ensures a same-named workflow_definition
sibling over the agent's asset, keyed by its per-run wire hash and
frozen with whatever projection was current at that deploy. Launch
resolution walked deployed siblings newest-first by name, so the newest
run clone's stale snapshot shadowed every hub-authored edit (skill
pins, instruction saves) after an agent's first run.
Make the data model say which row is which: a new workflow_definition
origin column ('authored' | 'run', default 'run') marks hub-authored
definitions at freeze time, backfilled as the earliest row per
(tenant, asset). Launch and refresh resolution now gather the asset's
deployed rows and resolve only authored candidates; the invitable
listing drops run clones; name-based sibling matching is gone.
A definition ensured by a plain code-sourced deploy is a real definition — the e2e echo agent is deployed exactly that way — so keying 'authoritative' on which writer minted the row wrongly hid it from the invite list. Only a folded run mints a per-run record: its deployed bytes carry per-run values, so the deploy's freeze ensures a sibling over the agent's asset and repoints the run at it. Default origin to 'authored' and have deployAtHead mark the row the deploy actually repointed its run at, so nothing else has to know the distinction. A deploy that left the run on its original definition marks nothing, which keeps a mis-set id from ever demoting an agent's own definition.
TheGreatAxios
force-pushed
the
cl-6452-authoritative-defs
branch
from
August 21, 2026 04:39
ade3267 to
fa05d84
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every code-sourced run deploy ensures a same-named
workflow_definitionsibling over the agent's asset, keyed by its per-run wire hash and frozen with whatever projection was current at that deploy. Launch resolution walked deployed siblings newest-first by NAME, so after an agent's first run the newest run clone's stale snapshot shadowed every hub-authored edit — skill pins and instruction saves never reached any later launch (validated live: 6fact-checkerrows after 5 runs, 3 post-pin invites all launched stale bodies).The freezer (#179) writes correctly; the resolver's candidate set was the bug, and name-collision resolution was the defect rather than the tiebreak order. This makes the data model say which row is which instead:
workflow_definition.origincolumn ('authored' | 'run', default'run'): a workbench delta onvendor/intx/db(migration0086, ledger note in VENDORED.md). Backfill marks the earliest row per (tenant, asset) authored — the hub-authored row always predates any run clone.freezeInertWorkflowDefinitionstampsorigin: 'authored'in the same transaction as the ensure+stamp; it is the sole writer of launch-authoritative rows (Agents page, template blocks, planner).refreezekeeps updating that row in place. The vendored ensure helper is untouched — run deploys keep minting their per-run frozen deploy records, which no longer masquerade as definitions.launchInviteandrefreshAgentInstanceFromDefinitiongather the asset's deployed rows and resolve only authored candidates (authoredDefinitionCandidates, newest-first, first with a projection); an empty authored set raises the existing namedDefinitionProjectionMissingError4xx.refreshAgentInstanceFromDefinitionmatters because the deploy repointsworkflow_run.definitionIdat the clone, so the old read-through-the-run path replayed the stale body forever.listInvitableDefinitionsdrops run clones, so the invite picker shows one row per agent. Name-based sibling matching is gone.Red→green at the resolver layer: authored row + newer run clone with a stale frozen prompt — launch must carry the post-pin projection; N clones never grow the candidate set (exactly one projection lookup); refresh recomputes from the authored sibling, not the run's clone. DB-gated: the freeze drizzle suite proves the freeze marks
authored, a bare per-run ensure mintsrun, and migration 0086 applies through the full ledger (run green against a scratch Postgres).Fixes CL-6452