Operational Fixes
Gantry hardens run control, reporting, lint checks, and source-review packaging.
3 milestones 11 tasks 25 agents
4 plan 11 execute 14 review
187k peak context
119k median execute
2h 46m total 10m 29s per task
1h 29m execute 34m 9s review
150 edits 890 commands
codex harness
This run is a compact hardening pass over operational promises that operators and reviewers already depended on: state writes should be visible, command invocations should route predictably, local assistant tools should stay confined, reports should avoid invented values, the advertised lint policy should be real, and the source-review archive should prove itself from its own contents. The decomposition is milestone-shaped. Runtime safety came first, reporting and lint enforcement followed, and archive self-containment closed the run after those contracts were already standing.
How this walkthrough is structured
Feature
What did the run build and ship?
The tree still carries the hardened command paths, runtime guards, stats model, lint gate, and source-review archive checks this run introduced.
Build
How did Gantry structure the work?
The build split a broad external review into contract-sized milestones, with only the reporting cut needing a repair pass before the rest composed cleanly.
Milestone 1
Runtime Safety
4 tasks 11 agents 57m 33s wall time 187k peak context
The current tree still shows this layer across runtime documentation and engine code. Journaling names its observability policy, CLI parsing has explicit resume and end-of-options tests, assistant sockets and scratch state resolve through a protected runtime directory, and gate execution carries a configurable timeout. Later work has edited nearby modules, but the contracts from this milestone remain visible.
This milestone grouped the operator-facing safety contracts that shape whether a run can be trusted after something goes wrong. The briefs divide that work by boundary: state persistence, argument dispatch, assistant-local execution, and gate supervision. Each child sprint reached its boundary without a recorded repair or replan, so the milestone reads as a set of independent hardening cuts rather than a discovery-driven redesign.
Durable Write Policy
2 agents 9m 5s wall time 108k peak context
The journal code still states that history replay is observability rather than correctness, warns once when an append fails, and suppresses repeated noise. The finish path still treats ledger state as something that must travel with the merge, so terminal progress is not left behind as disposable runtime output. The surviving shape is a visible policy distinction instead of silent best-effort writes everywhere.
This sprint was asked to separate resume-critical writes from observability writes and make both failure modes operator-visible. It was a good first cut because later runtime work could then assume failures were surfaced through normal run channels instead of disappearing. The gate stayed green around that boundary, so the policy landed before the later safety sprints depended on it.
Invocation Contract Repair
2 agents 12m 29s wall time 130k peak context
The live dispatcher still keeps management verbs ahead of resume alias normalization, rewrites resume shortcuts into the canonical resume path, and preserves operands after an end-of-options marker. The resume resolver now uses the same resumable run set for unnamed and most-recent resume cases, with tests covering those edges. Documentation and exported reference data were updated alongside the parser, so the public contract and implementation still match.
This sprint owned the command line contract around verbs, resume aliases, most-recent resume, and operands that begin with a dash. That scope was narrow enough for a fresh agent because the desired behavior was all in dispatch and reference alignment. It passed through its gates without a repair, which suggests the ambiguity was localized rather than spread through the run engine.
Protected Local Execution
2 agents 10m 44s wall time 114k peak context
The assistant MCP host still creates short Unix sockets under a per-user protected runtime directory, and the shared attach resolver relocates over-long socket paths into the same protected area. The `run_bash` implementation scopes commands to the run worktree, mirrors the configured sandbox wrapper, applies an escaped-write backstop, and reports timeout results as structured tool output. Process-group termination remains in the local action path through the shared system helpers.
This sprint isolated the assistant-facing local execution problem from broader assistant design. Its brief was about placement and process hygiene: protect sockets and temporary command capture, run commands inside Gantry's existing process fence, and stop timed-out shell work as a group. The run facts show a clean boundary, with no review replan or gate repair attached to this sprint.
Gate Timeout Guard
2 agents 16m 14s wall time 187k peak context
Gate commands now receive a resolved timeout from configuration, and the gate runner terminates the spawned process group when the deadline expires. The log receives an explicit timeout note, the returned verdict is classified as a timed-out gate failure, and run tests cover durable baseline timeout reporting. Runtime and configuration documentation still describe the environment and config setting that control the guard.
This sprint added the hard runtime guard after the earlier write-policy sprint, because a timeout verdict had to be recorded honestly when possible. The brief treated a timed-out gate as an ordinary red gate, not a special recovery path. It landed green, so the configurable timeout and failure classification were accepted as part of the existing gate model.
Milestone 2
Honest Reporting
4 tasks 12 agents 58m 6s wall time 161k peak context
The current tree still contains the reporting corrections and the lint standard they made enforceable. Stats now model ambiguous concurrent work as absent rather than measured, terminal rendering paths count display columns, and the root gate runs the denied-warnings lint tier. The milestone's result is visible both in user-facing output code and in the test script that guards future changes.
This milestone moved from safety of execution to honesty of what Gantry reports and enforces. Its sprints intentionally start with the stats model, then terminal width, then the lint-clean contract, then gate enforcement of that contract. The first reporting sprint was where the run came under stress: a gate failed after review and a troubleshoot pass repaired it before the remaining work proceeded.
Honest Stage Stats
3 agents 19m 44s wall time 161k peak context
The stats model now keys live stages by task, stage, and milestone, so overlapping work can remain attributable where the event stream is specific. Singular current-stage elapsed time and current-stage token values disappear when multiple live stages make them ambiguous, while aggregate and per-unit values continue where they are still valid. Tests cover overlapping fan-out, same-key overlap, non-overlapping fallback, and retry attribution.
This sprint carried the hardest reporting change: preserve useful aggregate data while refusing per-stage values that cannot be attributed under concurrent fan-out. The gate went red after review, and troubleshooting repaired the sprint before it closed. That failure locates the complexity in the ambiguity rules, not in later display or lint wiring.
Width-Based Truncation
2 agents 13m 18s wall time 151k peak context
Terminal reporting and TUI code now use display-column measurement through the Unicode width library instead of raw character counts. The surviving changes cover stats tables, process command summaries, chat markdown, modal text, ticker content, and wrapped pager rows. Focused tests exercise wide glyphs and combining marks without freezing unrelated copy.
This sprint was deliberately limited to Gantry-owned terminal presentation, leaving vendored widget behavior out of scope. The brief asked for display-width-aware truncation and wrapping across wide glyphs and combining marks. It passed cleanly after the repaired stats foundation, so visual correctness remained a contained rendering problem.
Clean Lint Pass
2 agents 13m 43s wall time 137k peak context
The workspace manifest still carries the clippy policy for readability and panic shortcuts, with test exemptions kept in the clippy configuration. The codebase changes touched many production modules to remove warnings or replace shortcut panics with handled errors. The root test script now has a lint tier, and later enforcement coverage checks that this tier remains advertised and active.
This sprint made the advertised lint command true before the gate was allowed to enforce it. Its brief separated mechanical warning cleanup from real production error handling, while keeping test-code panic shortcuts under the existing exemption policy. The sprint stayed green, which gave the final lint-gate sprint a concrete contract to consume.
Enforce Lint Gate
2 agents 4m 11s wall time 83k peak context
The root `bin/test` script still invokes the all-target clippy check with warnings denied before the behavioral suite. A dedicated integration test reads the script and fails if that lint tier is removed or weakened below the advertised command shape. The agent and reliability documentation now describe the root gate as including that lint standard.
This sprint was small because the previous sprint had already made the workspace clean under the intended policy. Its job was to turn that state into a gate invariant and align the docs that describe the root check. The boundary held without a repair or replan, so enforcement landed as a focused test-script change.
Milestone 3
Self-Contained Archive
3 tasks 9 agents 34m 8s wall time 119k peak context
The source-review archive builder still carries the lint configuration, redacts or rewrites markdown that would point to withheld internal files, and checks staged markdown references before writing a successful archive. The Rust stripping tool and shell archive script still share an allow-list contract. Integration coverage exercises both accepted closed references and rejected missing archive targets.
This milestone took the lint contract into the source-review packaging path. The sequence is linear: ship the verification input, rewrite shipped markdown so it stands alone, then fail archive creation when markdown references escape the archive. The run facts show a clean milestone, with each sprint completing without repair after the earlier reporting milestone had absorbed the only gate failure.
Verification Config
2 agents 4m 23s wall time 59k peak context
The archive include list still names the clippy configuration beside the manifest and lockfile. The comment-strip tree allow-list mirrors that entry, and the compliance test checks that the two inclusion policies stay identical. A source-review recipient can therefore evaluate the lint policy from the shipped tree instead of relying on files outside the archive.
This sprint established that lint configuration is a build input for source review rather than a local convenience. It fit cleanly at the start of the archive milestone because later self-containment checks could assume the shipped tree contained the policy it claimed to verify. The gate stayed green around a narrow allow-list and transform update.
Standalone Markdown
2 agents 12m 27s wall time 115k peak context
The archive script still rewrites the root README into a source-review-facing form, replaces the comment-strip README with archive-safe text, and reruns the agent-prompts redaction script over the staged tree. The compliance test opens the produced archive and checks that shipped markdown no longer names withheld documentation or packaging paths. The redaction sits inside the reproducible packaging path, not in a manual release edit.
This sprint owned the content rewrite before the final invariant existed. The brief kept the archive policy intact while requiring shipped markdown to stop naming deliberately withheld docs and release scripts. It passed without repair, leaving the next sprint a canonical staged-markdown form to validate.
Reference Closure
2 agents 10m 14s wall time 119k peak context
The archive builder now walks staged markdown files, extracts relative markdown links and path-like code references from the archive-visible surfaces, resolves them against the staged tree, and fails before writing output when a target is absent. Integration tests cover both closed references and missing targets, including nested manual pages. That check keeps future release changes from reintroducing references to files the source-review archive intentionally withholds.
This final sprint consumed the staged markdown contract and made it enforceable. Its scope was not to add more documentation, but to reject archive output when relative links or path-like references point outside the staged tree. It landed green, closing the milestone with a packaging invariant rather than another prose cleanup.