Signal Resilience
Signal Protocol Hardening
Recovery, advisory reads, and prompt overrides were brought under one signal contract.
1 milestones 5 tasks 11 agents
2 plan 5 execute 6 review
211k peak context
130k median execute
10h 29m total 14m 32s per task
1h 1m execute 20m 21s review
49 edits 328 commands
codex harness
This run closed a prompt and channel failure mode where an agent could mean to raise a signal and still make the engine halt or miss it. The work was cut as a single milestone because the pieces all touched the same contract: how signal files are written, recovered, read, delivered to agents, and protected from stale overrides. The shape is unusually protocol-like for an agent run. First the on-disk value format became recoverable and canonical, then advisory reads lost their power to stop the run, then generated prompt text and override validation made sure the signal path stayed visible before documentation and conformance pinned the new behavior.
How this walkthrough is structured
Feature
What did the run build and ship?
The tree now preserves intended signal values through recovery, advisory degradation, generated contracts, stale override refusal, and documented prompt conformance.
Build
How did Gantry structure the work?
The cut held the signal protocol as one milestone, with green inner sprint boundaries and stress deferred to the final merge boundary.
Milestone 1
Signal Recovery Hardening
5 tasks 13 agents 1h 54m wall time 211k peak context
The resulting capability is spread across the engine rather than isolated in one file. Signal reading lives in the production pattern world, routing semantics live in the interpreter, prompt placeholder knowledge lives in configuration, and the reference documents describe the contract operators see. The files are still present in the current tree, although later work has edited some of them, so the milestone reads today as a surviving cross-module protocol rather than a sealed patch.
The milestone bundled every remaining signal and prompt protocol defect into one coherent unit. That gave the nested planner a shared vocabulary to preserve across recovery, advisory reads, generated prompt contracts, stale override checks, and documentation. Its inner sprints all completed through their local gates and reviews, so the decomposition itself did not need a recovery rewrite. The recorded stress appeared only after the milestone was reviewed, when integration reached the merge and resolver boundary.
Canonical Signal Recovery
2 agents 11m 34s wall time 99k peak context
The live reader still recovers empty or prose-only single-value signal files by rewriting them into declared TOML with comment-form reasons. The helper that chooses recoverable values keeps blocked signals tied to the blocked value while leaving multi-value channels outside the recovery path. Tests still pin empty blocked recovery, multi-line idempotence, and the multi-value ambiguity case, so this is not only documented intent.
This sprint had to establish the value contract before any later read policy could rely on it. Its brief scoped the agent to single-value signal files, canonical recovered output, preserved multi-line reasons, and unchanged ambiguity for multi-value channels. That is a compact boundary because it is about one reader behavior and its idempotent file shape. The sprint passed its own checks and review, giving the following sprints a stable recovery rule to consume.
Advisory Read Fallback
2 agents 31m 51s wall time 211k peak context
The interpreter now routes note-channel reads through an advisory helper that journals missing or broken values and returns no routing value. The older strict reader remains in place for required verdicts and other control-flow consumers, including the review verdict path. In the current tree that separation is explicit in separate advisory and required read functions rather than hidden in prompt wording.
This piece drew the line between reads that inform the journal and reads that steer execution. The agent did not need to redesign signal recovery; it inherited the recovered value contract and focused on note-only paths that should continue after unreadable, malformed, invalid, or missing channel files. That made the work small enough to verify without loosening the required control-flow reads. It also stayed green at its sprint boundary.
Generated Signal Contracts
2 agents 26m 4s wall time 130k peak context
The production prompt renderer still appends a declared channel contract for a blocked value channel, including the path, legal value, and note path when one exists. A root test confirms an execute prompt without an inline placeholder still receives the generated blocked contract. The configuration module also carries a curated engine-read placeholder registry that names the signal, prompt ids, and whether generated text protects it.
This sprint moved signal delivery out of editable prompt prose and into generated engine text. Its brief asked for execute and fix prompts to receive the blocked-channel instruction even when an inline placeholder was absent, while keeping that placeholder valid for prompts that still mention it. It also introduced the registry contract that later override validation would read. The sprint completed cleanly, which means the next piece could treat the registry as input rather than rediscovering prompt substitution sites.
Stale Override Refusal
2 agents 17m 31s wall time 147k peak context
Prompt resolution now validates live overrides against the engine-read placeholder registry before a run freezes its prompts. A stale project or global file that removes a signal placeholder is rejected with a message naming the override, signal, placeholder, and remedies. Tests cover stale project overrides and pristine global mirrors, and the docs describe the same refusal rule for operators.
With generated contracts in place for the blocked path, this sprint added the broader refusal rule for prompt overrides that drop signal-bearing placeholders. Its scope was validation at run start across project and global tiers, including nested prompt ids, while preserving cosmetic divergence. That was a clean policy boundary around the registry from the prior sprint. The run facts show no repair or re-plan at this unit boundary.
Prompt Docs Alignment
2 agents 8m 59s wall time 72k peak context
The prompt reference now explains declared signal files, generated blocked contracts, advisory note reads, canonical recovery comments, and stale override refusal. The prompt defaults themselves name the blocked value form, and the bundled prompt documentation tells operators that removing signal placeholders is no longer allowed. The conformance surface has also moved beyond top-level prompt ids, so nested prompt files participate in the same safety net.
The final sprint was intentionally lower-risk: it aligned conformance checks and durable documentation with the behavior the earlier units had already built. Its brief limited the agent to walking the bundled prompt tree, rejecting prompt text that still instructed prose into blocked signal files, and updating the analysis and prompt references. That made it a closure sprint rather than another runtime rewrite. It passed locally in the run before the milestone moved on to review and integration.