[P2-018] Repair claiming, handoff, follow-up and coordination

[deku2026]

Implements the execution-system repair for ArcForges-Design-B#3 (DLV-26/27/29/40/41/42) and addresses the independent review findings. The baseline is unchanged: complete through WP03.02, and WP03.03 has not started.

Tool (tools/delivery.py)

• Authoritative state. ready, status, show, claim, update and release read only merged Design and Plan main plus the claims/*, leases/* and roles/* branches. These are fetched into a private per-call ref namespace, so shared worktree refs never race.
  • They work from any checkout or retained worktree; the Design default is now the sibling of the Plan primary checkout.
  • ready --local shows unreviewed working-tree state for review only.
• Fails closed. Graph or ledger errors stop ready (exit 1). An unknown claim state, a timestamp without a timezone or a malformed record makes its item unavailable and is reported, instead of making it available or raising a TypeError.
• Claims, leases and roles. Each write is a compare-and-swap on the exact observed record commit: creation is parentless, and every append names the observed commit as its only parent.
  • update and release require the claimant and the current epoch.
  • Re-claim, takeover (expired lease plus a one-hour grace and a recorded reason) and completion follow-up append the next epoch.
  • delivered and complete are refused until the merged ledger says so.
  • A lease requires a live claim on its task. Integration roles are integration:<Repository>.
• Durable handoff. The claim record carries repository, branch, worktree, pull requests, head, reviewed and merge commits, done/next, validation, blocker and note.
• Discoverability and follow-up. status shows every holder, expired and released claims (resume points), delivered tasks still waiting, and vacant integration roles. ready lists completion follow-ups.
• Workstation build slot. build-slot run holds an atomically created lock directory in the user profile with an owner record and heartbeat, recovers stale locks and returns the command's exit code.
• Windows-safe keys. con-02: Git for Windows rejects claims/con.02, task/con.02 and ledger/tasks/CON.02.md, which was reproduced locally. check now also validates the ledger and planned ledger write scopes.
• Tests. tools/tests/test_delivery.py has 17 offline tests that use local bare repositories as remotes.

Documents

• arcforges-implementation.md is rewritten around the tool. It covers sessions and roles, work selection, claiming, durable handoff checkpoints, review/merge fencing (--match-head-commit, and --subject that keeps task IDs), completion and follow-ups, interruption/handoff/recovery, and leases, roles and the build slot. The policy sections are unchanged.
• single-task-command.md now holds complete entry prompts for Worker (any scope, including pasted task rows), Resume, Coordinator and Integration owner.
• execution-policy.md, ledger/README.md (record schema, key naming, evidence fields including PRs, reviewed and merge commits, remaining actions) and AGENTS.md are updated.
• The retired arcforges-implementation-remote.md and list-remote.md are deleted along with their references. This does not affect the Web product.
• list.md and tasks/*.md are regenerated: adoption slices now have rows and self-contained prompts, and every task prompt names its claim, task branch, ledger record and integration role.

Validation

• 17 offline tests passed:
  • readiness fails closed on graph and ledger errors, invalid state and naive timestamps;
  • creation races; compare-and-swap against a stale observation; claimant and epoch enforcement; release/re-claim epoch fencing;
  • takeover grace and reason; ledger-gated completion; the AND.08 follow-up;
  • authoritative versus local state; worktree defaults; Windows-safe keys;
  • lease binding; role transfer; build-slot exclusivity, stale recovery and release.
• check passed against the Design pull request branch (529 tasks, 58 slices, 110 views current, ledger valid). A link and anchor check over the changed documents found no problems.
• A read-only ready and status against the real remotes, run from a retained worktree, listed ADOPT.01 only and no records.
• Not tested: claim contention and takeover against GitHub itself. No real claim branch is created for testing, because claim branches are never deleted. Branch-protection rulesets on claims/*, leases/* and roles/* are not configured.

Merge after ArcForges-Design-B#3.

🤖 Generated with Claude Code