Oliver Kieselbach 386f3e909f v2 codex-02: EffectRunner posts EffectInfrastructureFailure on critical fail ...

Closes Codex review follow-up #2. Before this commit, a
DecisionEffectKind.ScheduleDeadline / CancelDeadline failure raised
EffectRunResult.SessionMustAbort but the decision world never heard
about it — DecisionStepProcessor only logged and continued. A safety
deadline could live in DecisionState without ever being armed on the
scheduler, leaving the session to hang until the max-lifetime
watchdog tripped hours later.

Flow now:

  1. EffectRunner.TryRunCriticalDeadlineEffect fails.
  2. EffectRunner posts a synthetic
     DecisionSignalKind.EffectInfrastructureFailure signal onto the
     ingress before returning. Payload: reason + failingEffect.
  3. Ingress worker picks it up next iteration.
  4. HandleEffectInfrastructureFailureV1 (new, in DecisionEngine.Shared.cs)
     transitions Stage=Failed, Outcome=EnrollmentFailed, ClearDeadlines,
     and emits one EmitEventTimelineEntry effect for enrollment_failed
     with the reason from the payload.
  5. DecisionStepProcessor observes the terminal stage and fires the
     Terminated event; EnrollmentOrchestrator tears down normally.

EnrollmentFailed (not Aborted) distinguishes infrastructure-induced
failures from user/operator-initiated aborts in forensics. The ingress
post is wrapped in a try/catch so a full/closed channel cannot crash
the worker — the max-lifetime watchdog remains the last-resort exit.

Changes:
  - DecisionSignalKind: new EffectInfrastructureFailure enum value.
  - DecisionEngine: dispatch entry (v1).
  - DecisionEngine.Shared: HandleEffectInfrastructureFailureV1 handler,
    mirrors HandleSessionAbortedV1 shape but with EnrollmentFailed
    outcome and a failure timeline effect.
  - EffectRunner: PostEffectInfrastructureFailureSignal helper, called
    from the critical-effect path before returning SessionMustAbort.
  - EffectRunResult: XML-doc clarifies that SessionMustAbort is now
    observability-only (reducer terminates on its own).
  - DecisionStepProcessor: comment update — no code change needed, the
    synthetic signal reaches state naturally.
  - tests/fixtures/signal-kinds/effect-infrastructure-failure-v1.json:
    replay fixture per the enum's self-documented contract.

Tests (+8):
  - DecisionCore EffectInfrastructureFailureHandlerTests: transition
    shape, deadline clearing, enrollment_failed emission with reason,
    missing-reason fallback, double-post idempotency.
  - EffectRunnerTests: schedule-fail posts signal with correct payload,
    cancel-fail same, ingress-post exception tolerated.
  - FakeSignalIngressSink: ThrowOnPost toggle for the tolerance test.

All suites green: DecisionCore 144/144 (+5), Agent.V2.Core 633/633
(+3), Functions 727/727. Build 0 warnings.

Plan: .claude/plans/codex-02-effect-failure-to-decision.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-24 11:16:32 +02:00

..

enrollment-sessions

v2 single-rail 6.1: guard DeviceSetupProvisioningComplete terminal on Classic path

2026-04-23 17:09:14 +02:00

signal-kinds

v2 codex-02: EffectRunner posts EffectInfrastructureFailure on critical fail

2026-04-24 11:16:32 +02:00