Admit observation uncertainty without workspace authority

[flyingrobots]

Admit durable bounded-observation uncertainty after workspace authority disappears.

Closes #709.

Summary by CodeRabbit

• New Features

  • Added recovery support for bounded workspace claims when directory authority is unavailable.
  • Claims can now be durably settled as OutcomeUnknown after validating the original profile, grant, request, scope, budget, and evidence.
  • Recovery cannot observe workspace contents or produce a successful result.

• Bug Fixes

  • Prevented lost workspace authority from leaving claims permanently unsettled.
  • Invalid or substituted recovery inputs are rejected before a new commit.

• Documentation

  • Documented rootless reconciliation and recovery behavior.

[flyingrobots]

@coderabbitai review

[flyingrobots]

@codex please review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

@flyingrobots, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 260c4887-7dcd-4f89-8512-e138f094975f

📥 Commits

Reviewing files that changed from the base of the PR and between 09c3670 and 491dbc1.

📒 Files selected for processing (5)

• CHANGELOG.md
• crates/warp-core/src/external_action.rs
• crates/warp-core/src/external_action_adapter.rs
• crates/warp-core/tests/bounded_workspace_observation_tests.rs
• docs/topics/ExternalActions.md

📝 Walkthrough

Walkthrough

Adds a rootless bounded-workspace reconciliation handle that revalidates retained inputs and durably admits OutcomeUnknown after workspace authority disappears. Shared validation, WAL commit checks, recovery tests, ADR guidance, topic documentation, and changelog entries are updated.

Changes

Bounded observation reconciliation

Layer / File(s)	Summary
Shared profile, grant, and candidate validation crates/warp-core/src/external_action_adapter.rs	Profile, grant, and settlement candidate validation is centralized and reused by filesystem-backed and rootless workflows.
Rootless OutcomeUnknown admission crates/warp-core/src/external_action_adapter.rs	BoundedWorkspaceObservationReconcilerV1 retains the profile without filesystem authority, validates recovered inputs and budgets, constructs OutcomeUnknown, and durably admits the settlement.
Authority-loss recovery coverage and contract documentation crates/warp-core/tests/bounded_workspace_observation_tests.rs, docs/adr/0026-durable-external-action-settlement.md, docs/topics/ExternalActions.md, CHANGELOG.md	Tests cover deleted workspace authority, rejected substitutions, zero evidence, WAL behavior, and successful uncertainty settlement; documentation describes the reconciliation constraints and recovery behavior.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant Reconciler as BoundedWorkspaceObservationReconcilerV1
  participant Coordinator as ExternalActionCoordinatorV1
  participant WAL as WalStorePort
  Caller->>Reconciler: Provide admitted request, grant, context, and evidence
  Reconciler->>Reconciler: Revalidate retained profile and construct OutcomeUnknown
  Reconciler->>Coordinator: Admit external action settlement
  Coordinator->>WAL: Commit settlement bytes
  WAL-->>Caller: Return admitted settlement

Loading

Possibly related issues

• flyingrobots/hello-echo issue 10 — Extends the bounded workspace settlement workflow with rootless OutcomeUnknown reconciliation after workspace authority disappears.

Possibly related PRs

• flyingrobots/echo#704 — Introduced the durable external-action settlement machinery used by the new reconciliation admission path.
• flyingrobots/echo#706 — Introduced the bounded-workspace adapter and profile/grant/request validation extended by this change.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 69.23% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: admitting observation uncertainty without reopening workspace authority.
Linked Issues check	✅ Passed	The implementation adds a rootless reconciler, preserves validation, rejects mismatches, and tests workspace deletion recovery as required by #709.
Out of Scope Changes check	✅ Passed	The changes stay focused on bounded-observation uncertainty settlement, with only supporting tests and documentation updates.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch task/709-rootless-observation-uncertainty

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 09c3670043

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/warp-core/src/external_action_adapter.rs`:
- Around line 673-741: Extract the duplicated outcome-unknown candidate
construction into a shared build_outcome_unknown_candidate helper, including
settlement encoding, budget validation, schema-admission evidence, and
ExternalActionSettlementCandidateV1 creation; update both
BoundedWorkspaceObservationAdapterV1::outcome_unknown and
BoundedWorkspaceObservationReconcilerV1::admit_outcome_unknown to use it. Also
extract the shared adapter binding construction into
adapter_binding_for(self.profile), and update both adapter_binding
implementations to delegate to it while preserving existing validation and
admission behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 71296d5b-eff9-4557-9340-8658bcae1f58

📥 Commits

Reviewing files that changed from the base of the PR and between 3269f06 and 09c3670.

📒 Files selected for processing (5)

• CHANGELOG.md
• crates/warp-core/src/external_action_adapter.rs
• crates/warp-core/tests/bounded_workspace_observation_tests.rs
• docs/adr/0026-durable-external-action-settlement.md
• docs/topics/ExternalActions.md

[flyingrobots]

@codex please review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[flyingrobots]

Merge gate: 40/40 current-head checks green; full local warp-core suite and affected linters green; zero unresolved review threads. CodeRabbit confirmed its remediation before the current-head rate limit, and Codex returned a current-head usage-limit notice. Solo-maintainer technical-gate substitution applies; no actionable finding remains.