v0.0.7.0 feat: decision inbox v1 — trigger-based prompt + claude --resume fix

[Fullstop000]

Summary

Reland of decision-inbox after the dogfood revert. Two distinct bugs surfaced during the postmortem; both are fixed here.

• Decision Inbox v1. Agents call dispatch_decision (renamed from the brand-prefixed name) when an incoming request asks for a verdict — PR review, A-vs-B implementation, config flag. Human picks in a sidebar inbox; the agent's session resumes with the picked option's body inlined and acts on it. Server-side stores rows with CAS-protected resolve and reverts on delivery failure so picks aren't silently lost. Bridge MCP tool with structural validator at the boundary.
• Trigger-based prompt rewrite. Replaces the v0 "when you need" permissive language with mandatory triggers for verdict-shaped requests. Splits the conversational channel (send_message) from the verdict channel (dispatch_decision) instead of conflicting "your only output channel" + buried exception. Drops the "things you can act on unilaterally" loophole.
• Claude --resume guard. Pre-existing bug: chorus passed stale session_id to claude --resume, claude hard-errored with error_during_execution and zero downstream events, surfacing in chorus as immediate reason=Natural turn end. Driver now verifies ~/.claude/projects/<encoded-cwd>/<session_id>.jsonl exists before passing --resume; falls back to a fresh session with a warn! on miss. Regression test included.
• AGENTS.md principles. Added YAGNI and "no cheating for the goal" (hard constraint). Both surfaced as load-bearing during the dogfood revert.

Test Coverage

[+] src/store/decisions.rs               — 4/6 paths ★★★ TESTED (CAS, double-resolve, revert, list filters)
[+] src/server/handlers/decisions.rs     — 5/8 paths ★★ TESTED (round-trip, 409, 400 channel, 400 picked_key)
[+] src/agent/drivers/claude.rs          — resume guard ★★★ TESTED (missing_session_file_drops_resume_flag)
[+] src/agent/drivers/prompt.rs          — 3/3 paths ★★★ TESTED (mandatory framing, anti-loophole, prefix)
[+] src/agent/manager.rs::resume_with_prompt — surface tested via MockLifecycle; real impl branches GAP
[+] src/bridge/mod.rs::validate_decision_payload — 12 branch GAPs (boundary defense, exercised through e2e)
[+] ui/src/components/decisions/DecisionsInbox.tsx — 0/N (consistent with project's UI test convention)

Coverage: ~58%. Backend store + handlers strong (~75%); bridge validator + UI ~15%.
Coverage gate: OVERRIDDEN at 58% — gaps are the predictable shape (UI + boundary
defense), not unsafe paths. Validator failures surface as INVALID_PARAMS to the
agent. Codex (gpt-5.5 medium) independently ran cargo test on the new code and
confirmed no blocking findings.

Tests: 528 cargo + 85 vitest, all pass.

Pre-Landing Review

Codex (gpt-5.5, reasoning_effort=medium) ran as the outside voice. No blocking findings. Verdict: Merge (option M of M/H/R). The agent independently:

• Cloned a worktree and ran cargo test decision, cargo test missing_session_file_drops_resume_flag, cargo test claude_session_file_encodes_dots_and_slashes — all passed.
• Verified the claude_session_file encoding matches actual files in ~/.claude/projects/.
• Confirmed the CAS via UPDATE ... WHERE status = 'open' and the revert path in handle_resolve_decision.
• Flagged the same follow-ups already in the PR: codex/opencode resume liveness + gemini MCP TTL.

Cross-driver verification (live, real models)

All five drivers verified emitting dispatch_decision autonomously on fresh agents:

driver	model	result
claude	sonnet	✅ emits + full resolve→resume round-trip
kimi	kimi-code/kimi-for-coding	✅ end-to-end — agent received envelope, edited members.rs
codex	gpt-5.4-mini, gpt-5.5	✅ all conventions (H2 sections, evidence prefixes, key)
gemini	gemini-2.5-flash	✅ emits autonomously
opencode	deepseek/deepseek-chat	✅ emits with H2 sections

Plan Completion

All r7 design items shipped: decisions table + CAS resolve, resume_with_prompt lifecycle method, channel-inference contract, dispatch_decision MCP tool + bridge validator, real handlers (create/list/resolve), envelope builder, UI inbox with sidebar toggle, claude --resume guard, prompt rewrite, e2e tests. Plus the post-revert tool rename (chorus_create_decision → dispatch_decision) per pre-merge feedback.

Known follow-ups (queued in TODOS.md, not gating ship)

1. Codex / opencode resume liveness guard — same shape as the claude fix; both runtimes silently exit Natural on stale thread/session id rather than erroring loudly.
2. rmcp StreamableHttpService session TTL — long agent turns (>20 min) cause MCP session expiry; tool calls return Unauthorized: Session not found even with valid payloads.
3. Coverage gaps — bridge validator branches, real resume_with_prompt Active/Asleep paths, resume-failure → revert e2e, UI component tests.

Test plan

• cargo test — 528 tests pass (339 lib + 80 e2e + 22 store + 61 store_tests + 26 others)
• cargo clippy --all-targets -- -D warnings clean
• cargo fmt --check clean
• cd ui && npx tsc --noEmit clean, 85/85 vitest tests pass
• Live cross-driver: 5/5 drivers emit dispatch_decision autonomously with valid payloads
• Live full round-trip: kimi received resolution envelope and acted on it (edited members.rs per the picked option's body)
• Codex (gpt-5.5 medium) outside-voice review: no blocking findings, recommends merge

Lineage: chorus-design-reviews — 2026-04-30 vertical-slice design (commit 3a38b22).

🤖 Generated with Claude Code