forked from EduCraft/curriculum-project-hub
39 lines
1.9 KiB
Markdown
39 lines
1.9 KiB
Markdown
# Audit run lifecycle and data integrity under failure
|
|
|
|
Type: research
|
|
Status: resolved
|
|
|
|
## Question
|
|
|
|
Under process termination, restart, timeout, duplicate Feishu delivery,
|
|
database failure, or concurrent requests, which AgentRun, lock, session,
|
|
workspace, audit, and outbound-message invariants can be violated or leave work
|
|
lost, duplicated, or permanently stuck?
|
|
|
|
## Answer
|
|
|
|
The happy path and database lock uniqueness work, but the lifecycle is not
|
|
crash-safe. Deterministic fault injection confirmed permanent inbound loss,
|
|
terminal runs retaining locks, active runs losing locks, duplicate active
|
|
sessions, completion without outbound delivery, unconstrained audit run IDs,
|
|
and max-turn termination being stored as failure. Process-local queues,
|
|
non-transactional startup recovery, unused leases, silent audit/history writes,
|
|
and direct workspace mutation add restart and indefinite-hang failure modes.
|
|
|
|
The complete contract mapping, eight fault probes, recovery analysis, and
|
|
required release evidence are in the
|
|
[run lifecycle and data-integrity audit](../assets/run-lifecycle-integrity-audit.md).
|
|
|
|
The newly-clear implementation and decision frontier is:
|
|
|
|
- [Make Feishu intake and queued work durable](23-durable-feishu-inbox-and-queue.md)
|
|
- [Make run, session, lock, and recovery transitions safe](24-transactional-run-lock-recovery.md)
|
|
- [Make outbound Feishu delivery durable and idempotent](25-durable-outbound-delivery.md)
|
|
- [Decide workspace commit semantics for failed runs](26-decide-workspace-run-commit-semantics.md)
|
|
- [Reconcile the audit and run-history contract](27-reconcile-audit-history-contract.md)
|
|
|
|
Execution-time authorization remains owned by
|
|
[Bind and reauthorize deferred and card actions](18-bind-and-reauthorize-deferred-actions.md),
|
|
while cross-component metrics, alerts, and operator runbooks remain owned by
|
|
[Define production observability and incident recovery](04-define-observability-recovery.md).
|