Implement managed recovery and daily coding continuations

.config/nextest.toml

@@ -162,7 +162,7 @@ binary_id(cyber-account)
 | binary_id(cyber-snapshot)
 | binary_id(cyber-snapshot::file_copy_platform)
 | binary_id(cyber-snapshot::snapshots)
-| binary_id(cyber-store) & (test(writer::tests::) | test(migrate::tests::messaging_) | test(migrate::tests::usage_origin_))
+| binary_id(cyber-store) & (test(writer::tests::) | test(store::paired_tests::) | test(migrate::tests::snapshot_worker_) | test(migrate::tests::messaging_) | test(migrate::tests::usage_origin_))
 | binary_id(cyber-store::store)
 | binary_id(cyber-tools) & (test(tools::bash::shell_tests) | test(plugin_host::) | test(browser::) | test(dev_server::) | test(permissions::engine::tests::message_send) | test(permissions::engine::tests::remote_attach) | test(remote_skills) | test(lsp::) | test(mcp::stdio::tests) | test(mcp::roots::tests) | test(mcp::elicitation::tests) | test(mcp::sampling::tests) | test(tools::process::tests) | test(tools::tool_search::tests) | test(mcp::pool::tests) | test(mcp::launch::tests) | test(mcp::http::tests) | test(mcp::oauth) | test(hook_commands::launch::tests) | test(sandboxing::tests) | test(permissions::filesystem) | test(tools::background::tests) | test(tools::monitor::) | test(tools::deliver::tests) | test(tools::powershell::tests) | test(permissions::dry_run) | test(sandboxing::tests::refusal_lines) | test(permissions::engine::tests::sandbox_boundary_needs_an_explicit_user_allow) | test(permissions::engine::tests::workflow_run) | test(permissions::taint::) | test(untrusted::))
 | binary_id(cyber-tools::agent_context)

.github/workflows/binary-editor-proof.yml

@@ -3,6 +3,7 @@ on:
   pull_request:
     paths:
       - crates/cyber-core/src/binary/**
+      - crates/cyber-core/src/worktrees/**
       - crates/cyber-core/Cargo.toml
       - Cargo.lock
       - .github/workflows/binary-editor-proof.yml

.github/workflows/non-git-snapshot-proof.yml

@@ -1,23 +1,81 @@
-name: Non-Git snapshot native proof
+name: Snapshot native proof
 on:
   pull_request:
     paths:
       - crates/cyber-snapshot/**
+      - crates/cyber-app/Cargo.toml
+      - crates/cyber-app/src/**
+      - crates/cyber-app/tests/support/scripted_model.rs
+      - crates/cyber-app/tests/support/snapshot*.rs
+      - crates/cyber-app/tests/support/managed_retirement_cut.rs
+      - crates/cyber-app/tests/support/location_retirement.rs
+      - crates/cyber-server/src/runtime/snapshot*.rs
+      - crates/cyber-server/src/runtime/snapshot_reclamation/**
+      - crates/cyber-server/src/runtime/rewind*.rs
+      - crates/cyber-server/src/runtime/drain.rs
+      - crates/cyber-server/src/runtime/structured*.rs
+      - crates/cyber-server/src/runtime/model.rs
+      - crates/cyber-server/src/runtime/mod.rs
+      - crates/cyber-server/src/runtime/events.rs
+      - crates/cyber-server/src/runtime/requests.rs
+      - crates/cyber-server/src/runtime/requests/**
+      - crates/cyber-server/tests/requests.rs
+      - crates/cyber-server/tests/structured_root.rs
+      - crates/cyber-server/tests/support/structured_terminal_fault.rs
+      - crates/cyber-server/src/http/sessions.rs
+      - crates/cyber-app/tests/snapshot_git_runtime.rs
+      - crates/cyber-app/tests/snapshot_reclamation.rs
+      - crates/cyber-app/tests/instructions.rs
+      - crates/cyber-core/src/config/**
+      - crates/cyber-core/src/rules.rs
+      - crates/cyber-core/src/import/snapshot.rs
+      - crates/cyber-core/src/memory/windows.rs
+      - crates/cyber-core/tests/import_snapshot.rs
+      - crates/cyber-core/src/import/mod.rs
+      - crates/cyber-core/src/lib.rs
+      - crates/cyber-core/tests/config.rs
+      - crates/cyber-tools/src/host.rs
+      - crates/cyber-tools/src/tools/fs.rs
+      - crates/cyber-tools/src/tools/patch.rs
+      - crates/cyber-server/src/runtime/auto_override.rs
+      - crates/cyber-tools/tests/instruction_config.rs
+      - crates/cyber-tools/tests/path_skills.rs
+      - crates/cyber-tools/tests/shell_patch.rs
+      - crates/cyber-server/src/runtime/context*.rs
+      - crates/cyber-server/src/runtime/instructions.rs
+      - crates/cyber-server/src/runtime/instructions/**
+      - crates/cyber-server/src/runtime/host.rs
+      - crates/cyber-server/tests/context_compaction.rs
+      - crates/cyber-server/tests/http.rs
+      - crates/cyber-tui/src/context_inspection.rs
+      - crates/cyber-server/tests/support/mod.rs
+      - crates/cyber-cli/Cargo.toml
+      - crates/cyber-cli/src/**
+      - crates/cyber-cli/tests/branches_cli.rs
+      - crates/cyber-cli/tests/exec_stream_input.rs
+      - crates/cyber-cli/tests/exec_output_schema.rs
+      - crates/cyber-cli/tests/support/**
+      - crates/cyber-server/src/workspace.rs
       - crates/cyber-core/src/binary/native/**
       - crates/cyber-core/src/binary/native.rs
+      - crates/cyber-core/src/worktrees/**
       - Cargo.lock
       - .github/workflows/non-git-snapshot-proof.yml
   workflow_dispatch:
 permissions:
   contents: read
 concurrency:
   group: non-git-snapshots-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  # Let explicit native proofs finish and retain evidence while a newer run waits.
+  # Pull-request checks still cancel obsolete heads.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   native:
-    name: File-copy snapshots (${{ matrix.os }})
+    name: Snapshot native (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
+    # Intel's complete matrix can exceed 45 minutes while compiling the final
+    # structured-result binaries after all native recovery checks have passed.
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
@@ -32,15 +90,163 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           key: non-git-snapshot-proof
+      - name: Sandbox prerequisites
+        if: runner.os == 'Linux'
+        run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.* && sudo apt-get update && sudo apt-get install -y bubblewrap
+          # Ubuntu 24.04 restricts the user namespaces required by bubblewrap.
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          cargo build --locked -p cyber-sandbox --bin cyber-sandbox-exec
       - name: Native storage, conflict and process-kill proof
         shell: bash
         run: |
           set -euo pipefail
           cargo test --locked -p cyber-snapshot -- --nocapture 2>&1 | tee non-git-snapshot-proof.log
+      - name: Read-only checkout acknowledgement requirement
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo test --locked -p cyber-core --lib worktrees::activity::snapshot::acknowledgement::tests::maintenance_requires_an_existing_acknowledgement_without_publishing_one -- --exact --nocapture 2>&1 | tee managed-checkout-ack-proof.log
+      - name: Owned Git runtime acceptance candidate
+        # App proxy sockets include the Session ID. Short roots fit Linux
+        # sockaddr_un; the same root is retained by the artifact step below.
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-snapshot --features native-git-acceptance -- --nocapture 2>&1 | tee git-adapter-proof.log
+          cargo test --locked -p cyber-app --features native-git-acceptance --test snapshot_git_runtime -- --nocapture 2>&1 | tee git-runtime-proof.log
+      - name: Exact acknowledged checkout retirement and resumption
+        if: ${{ !cancelled() }}
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-core --lib worktrees::activity::snapshot::retirement:: -- --nocapture 2>&1 | tee checkout-retirement-proof.log
+      - name: Store-bound fallback collection and reclamation
+        if: ${{ !cancelled() }}
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-app --features native-git-acceptance --test snapshot_reclamation -- --nocapture 2>&1 | tee fallback-collection-proof.log
+      - name: Managed Git CLI process-death recovery and cancellation candidate
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-cli --features native-git-acceptance --test branches_cli managed_git_ -- --nocapture --test-threads=1 2>&1 | tee git-cli-recovery-proof.log
+      - name: Pre-effect preparation and TUI lost-reply reconciliation
+        if: ${{ !cancelled() }}
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-cli --features native-git-acceptance --test branches_cli preparation_ -- --nocapture --test-threads=1 2>&1 | tee preparation-client-proof.log
+      - name: Prepared cancellation metadata retirement
+        if: ${{ !cancelled() }}
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-cli --features native-git-acceptance --test branches_cli fully_prepared_pre_effect_cancellation_reclaims_only_persisted_target_inodes -- --exact --nocapture --test-threads=1 2>&1 | tee preparation-retirement-proof.log
+      - name: Paired metadata retirement after native source kill
+        if: ${{ !cancelled() }}
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-cli --features native-git-acceptance --test branches_cli managed_keep_and_rollback_after_real_partial_restore_kill_preserve_owner_files_and_never_replay -- --exact --nocapture --test-threads=1 2>&1 | tee paired-retirement-proof.log
+      - name: Zero-payload preparation and paired retirement after native cuts
+        if: ${{ !cancelled() }}
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-cli --features native-git-acceptance --test branches_cli zero_payload:: -- --nocapture --test-threads=1 2>&1 | tee zero-payload-retirement-proof.log
+      - name: JSONL driver and atomic last-message regressions
+        if: ${{ !cancelled() }}
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-server --lib runtime::requests::input_owners:: -- --nocapture 2>&1 | tee jsonl-driver-proof.log
+          cargo test --locked -p cyber-server --test requests -- --nocapture 2>&1 | tee -a jsonl-driver-proof.log
+          cargo test --locked -p cyber-cli --features native-git-acceptance --bin cyber commands::exec:: -- --nocapture 2>&1 | tee -a jsonl-driver-proof.log
+          cargo test --locked -p cyber-cli --features native-git-acceptance --test exec_stream_input -- --nocapture 2>&1 | tee -a jsonl-driver-proof.log
+      - name: Root structured result recovery and CLI stop regressions
+        if: ${{ !cancelled() }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo test --locked -p cyber-server -p cyber-cli --features cyber-cli/native-git-acceptance --test structured_root --test exec_output_schema -- --nocapture 2>&1 | tee structured-result-proof.log
+      - name: Instruction limits and context observation regressions
+        if: ${{ !cancelled() }}
+        env:
+          TMPDIR: /tmp/c${{ github.run_number }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$TMPDIR"
+          cargo test --locked -p cyber-core --test config instruction_limits -- --nocapture 2>&1 | tee instruction-limits-proof.log
+          cargo test --locked -p cyber-core --lib rules:: -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-core --test import_snapshot -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-core --test config rule_definition_bytes -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-server --lib runtime::context:: -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-server --lib runtime::instructions:: -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-server --lib runtime::context_sources:: -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-server --lib runtime::drain::skill_reminder_tests:: -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-server --test context_compaction -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-server --test http context_inspection -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-app --features native-git-acceptance --test instructions -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-tools --test instruction_config -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-tools --test path_skills -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-tools --test shell_patch -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
+          cargo test --locked -p cyber-cli --features native-git-acceptance --bin cyber commands::doctor::instruction_tests:: -- --nocapture 2>&1 | tee -a instruction-limits-proof.log
       - name: Retain native evidence
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: non-git-snapshot-proof-${{ matrix.os }}
-          path: non-git-snapshot-proof.log
+          path: |
+            non-git-snapshot-proof.log
+            managed-checkout-ack-proof.log
+            checkout-retirement-proof.log
+            git-adapter-proof.log
+            git-runtime-proof.log
+            fallback-collection-proof.log
+            git-cli-recovery-proof.log
+            preparation-client-proof.log
+            preparation-retirement-proof.log
+            paired-retirement-proof.log
+            zero-payload-retirement-proof.log
+            jsonl-driver-proof.log
+            structured-result-proof.log
+            instruction-limits-proof.log
+          if-no-files-found: warn
+      - name: Retain failed CLI fixture evidence
+        if: ${{ failure() && !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: snapshot-failed-cli-fixtures-${{ matrix.os }}
+          path: /tmp/c${{ github.run_number }}
+          include-hidden-files: true
           if-no-files-found: warn

crates/cyber-app/Cargo.toml

@@ -37,6 +37,7 @@ mdns-sd = { version = "0.21", default-features = false }
 url = "2"
 
 [dev-dependencies]
+blake3 = "1"
 aws-lc-rs = "1"
 jsonwebtoken = { version = "=10.3.0", default-features = false, features = ["aws_lc_rs"] }
 cyber-client = { path = "../cyber-client" }
@@ -62,3 +63,6 @@ windows-sys = { version = "0.61.2", features = ["Win32_Foundation", "Win32_Syste
 
 [lints]
 workspace = true
+
+[features]
+native-git-acceptance = ["cyber-snapshot/native-git-acceptance"]