[denniyahh]

Phase 50: Addressable Monitor Liveness (SUPV-01)

"Is this run's monitor alive?" is now answerable from disk state alone, with no PID read, in three distinguishable states (GONE, STALE, ALIVE). A stalled unattended run is recoverable by design rather than by diagnosis.

Breaking change: refactor(50-16)! removes State's monitor pid field (devflow-core public API). This is the milestone's planned breaking change; DevFlow has no users needing state migration.

Also folds backlog items 999.128, 999.134, 999.138, 999.139 and 999.141.

How this branch was cut

• scripts/cut-pr-branch.sh from feature/phase-50: 100 phase-scoped code commits replayed, 113 planning-only commits excluded, zero forbidden paths.
• Cherry-picked on top, because the script's scope filter does not match them: the nine (50-review) fix/docs commits from the external review, and test(48): check the response before the state in the park control (a flake fix made during this phase).
• Diff against feature/phase-50 outside workspace-only paths: only .gitignore and the plan-bashism linter update (a pre-phase workspace chore(lint) commit, deliberately not part of this PR).

CI fix in this PR

The first CI run failed 18 stop/shutdown tests on GitHub only. Cause: a job container's PID 1 is tail -f /dev/null, which never reaps orphans, so a killed agent's orphaned children stayed zombies and the tests' kill(-pgid, 0) "group gone?" probes read them as alive. Reproduced locally: the same 18 fail under tail as PID 1 and pass under --init.

• fix(50): every group probe now counts only live (non-zombie) members via test_support::live_group_members, the rule the backstop census already used; recover's group_empties_within uses the backstop census too. After the fix the full workspace suite passes under tail as PID 1 (1660 passed, 0 failed).
• ci(50): Test and Sequential 2-CPU check run with options: --init, matching the pre-push gate's reaping PID 1.

graphify-labs review triage

One advisory finding, cleanup --force removing a worktree on a failed probe (commands.rs:952): deliberate per plan 50-12 (--force overrides ProbeFailed like STALE; ALIVE or a live agent is refused even with --force). The realistic trigger, a ping during a stop's kill grace, is tracked in backlog 999.164 item 2. Coupling notes skipped: the bot's baseline is main at v2.12.0, 1,967 commits behind develop.

Verification

• Phase verification: passed, 8/8 roadmap success criteria (re-verified 2026-10-21 after gap closure).
• Known residuals, filed in the backlog, not fixed here:
  • Ship finalization retry loop checks for a stop only once before the loop. A stop accepted in the same second the operator approves a retry gate after a failed first merge/tag/push lets that finalization run (999.166 item 7, deferred by operator). Unattended runs cannot reach this gate alone.
  • A stop arriving after the agent has already exited kills no group (999.164 item 5); the exit file keeps the agent's code 0 while the stopped reply says 143 (999.166 item 6).
• Not established: stop paths were exercised by tests, not by a live run; timing-based tests were run once on one machine (flake rate unknown); macOS is compile-only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RGzZZbfn3r9638yptqPL47

[graphify-labs]

Graphify reviewed this change.

Code graph out of date: Health delta baseline: last indexed commit 71a5192, 198 commit(s) behind this PR's base. Health delta baseline was built by an older engine whose node ids do not match this review's — delta is approximate. Impact and hotspot numbers below may be wrong.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

Not checked: tests were not run; formal verification proved 0 of 131 changed function(s) (131 not verified).

Formal verification. PR-changed functions: 0/131 verified (0 proven, 0 may-equivalent, 0 distinguished) · 131 not verified (25 unsupported, 106 over cap).

Not verified on this run: a\_deleted\_root\_contributes\_nothing\_to\_the\_reachable\_set (unsupported), agreeing\_facts (unsupported), build\_phase\_facts (unsupported), cleanup (unsupported), doctor (unsupported), doctor\_finds\_a\_real\_stray\_and\_never\_signals\_it\_across\_two\_runs (unsupported), doctor\_is\_read\_only\_on\_a\_mismatched\_project (unsupported), doctor\_json\_body (unsupported), doctor\_json\_body\_carries\_planning\_doc\_staleness\_as\_a\_third\_key (unsupported), doctor\_json\_body\_carries\_stray\_processes\_as\_a\_fourth\_key (unsupported), and 15 more; 106 changed function(s) beyond the cap and 0 skipped when the time budget ran out.

---

Graphify review — findings

Replaces the shell-script monitor with a detached __monitor supervisor that owns the agent in its own process group, publishes a per-launch Unix socket, answers ping and shutdown, and runs the advance in-process when the agent exits on its own. Liveness becomes ALIVE / STALE / GONE from probing that socket instead of trusting a recorded pid, and devflow stop tries a gate rejection first, then the socket (with a guarded SIGTERM/SIGKILL backstop for stale ones), then the lock holder, never signalling a pid read from state. Gate waits inside a supervisor's advance now poll about once a second and unwind within about a second of a stop, and cleanup --force and recover --clean lean on the same liveness answer to decide whether a phase is safe to remove.

Worth a look

• cleanup --force removes the worktree when the probe failed, breaking fail-closed — crates/devflow-cli/src/commands.rs:952 · Escalate · medium
  • NOT verified (no proof, no reproducing execution) — needs human review

Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 2487 functions depend on the 2414 functions this change touches.

Health — this change adds coupling hotspots:

• new: hermetic_devflow() — 80 callers, 4 callees
• new: handle_validate_outcome() — 31 callers, 8 callees
• new: advance_with() — 7 callers, 21 callees
• new: supervise_stream_child() — 12 callers, 11 callees
• new: reconcile_phase() — 16 callers, 7 callees
• new: resume() — 15 callers, 7 callees
• new: run_preflight() — 15 callers, 5 callees
• new: clean_report() — 7 callers, 10 callees
• …and 173 more — each is listed as a finding

Verification — 2487 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 71a5192, 198 commit(s) behind this PR's base.

Health delta baseline was built by an older engine whose node ids do not match this review's — delta is approximate.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 2487 function(s) in the blast radius were not formally verified this run

Risky patterns (advisory)

• medium no-stderr-to-stdout in crates/devflow-core/src/monitor.rs:3296: stderr redirected to stdout: ( cat <&3 > /dev/null; printf 'EOF\n' > '{eof}' ) > /dev/null 2>&1 &
• medium no-stderr-to-stdout in crates/devflow-core/src/monitor.rs:4615: stderr redirected to stdout: ( cat <&3 > /dev/null; printf 'EOF\n' > '{eof}' ) > /dev/null 2>&1 &
• medium no-stderr-to-stdout in crates/devflow-core/src/monitor.rs:5458: stderr redirected to stdout: "{preamble}sleep 60 </dev/null >/dev/null 2>&1 &\n\
• medium no-stderr-to-stdout in crates/devflow-core/src/monitor.rs:5731: stderr redirected to stdout: "{preamble}sh -c 'printf %s \"${R_F_VARIABLE}\" > \"$1\"; exec sleep 60' sh '{env_out}' </dev/null >/dev/null 2>&1 &\n\
• medium no-stderr-to-stdout in crates/devflow-core/src/monitor.rs:5808: stderr redirected to stdout: "exec 2>&1\n"
• medium no-stderr-to-stdout in crates/devflow-core/src/monitor.rs:6918: stderr redirected to stdout: "sleep 300 </dev/null >/dev/null 2>&1",

Docs that may be stale (advisory)

• CHANGELOG.md § 2.11.0 — 2026-08-27 (lines 40-44): references changed symbols agent, phase
• CHANGELOG.md § Added (lines 45-51): references changed symbols agent, phase
• CHANGELOG.md § Added (lines 66-72): references changed symbols launch, run
• CHANGELOG.md § What's new (lines 114-129): references changed symbols agent, git
• CHANGELOG.md § What's new (lines 174-200): references changed symbols agent, release, run
• CHANGELOG.md § 2.5.0 — 2026-08-15 (lines 207-222): references changed symbols git, start
• CHANGELOG.md § What's new (lines 223-271): references changed symbols phase, release, run, start
• CHANGELOG.md § Fixed (lines 272-292): references changed symbols git
• CHANGELOG.md § Changed — breaking (lines 305-333): references changed symbols events, git, label, phase, state
• CHANGELOG.md § Removed — breaking (lines 334-343): references changed symbols git

…and 10 more.

Formal verification

Could not verify: Could not verify a\_deleted\_root\_contributes\_nothing\_to\_the\_reachable\_set.

The verifier did not have enough to check a\_deleted\_root\_contributes\_nothing\_to\_the\_reachable\_set, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify agreeing\_facts.

The verifier did not have enough to check agreeing\_facts, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: PhaseFacts

Could not verify: Could not verify build\_phase\_facts.

The verifier did not have enough to check build\_phase\_facts, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: PhaseFacts

Could not verify: Could not verify cleanup.

The verifier did not have enough to check cleanup, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: Result<(),CliError>

Could not verify: Could not verify doctor.

The verifier did not have enough to check doctor, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: Result<(),CliError>

Could not verify: Could not verify doctor\_finds\_a\_real\_stray\_and\_never\_signals\_it\_across\_two\_runs.

The verifier did not have enough to check doctor\_finds\_a\_real\_stray\_and\_never\_signals\_it\_across\_two\_runs, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify doctor\_is\_read\_only\_on\_a\_mismatched\_project.

The verifier did not have enough to check doctor\_is\_read\_only\_on\_a\_mismatched\_project, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify doctor\_json\_body.

The verifier did not have enough to check doctor\_json\_body, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: could not parse Rust function

Could not verify: Could not verify doctor\_json\_body\_carries\_planning\_doc\_staleness\_as\_a\_third\_key.

The verifier did not have enough to check doctor\_json\_body\_carries\_planning\_doc\_staleness\_as\_a\_third\_key, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify doctor\_json\_body\_carries\_stray\_processes\_as\_a\_fourth\_key.

The verifier did not have enough to check doctor\_json\_body\_carries\_stray\_processes\_as\_a\_fourth\_key, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify doctor\_json\_is\_a\_single\_object\_with\_environment\_and\_reconciliation.

The verifier did not have enough to check doctor\_json\_is\_a\_single\_object\_with\_environment\_and\_reconciliation, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify live\_run\_refusal.

The verifier did not have enough to check live\_run\_refusal, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: signature changed ((phase: PhaseId, verb: LaunchVerb, live: &[(&str,u32)]) -> String) → ((phase: PhaseId, verb: LaunchVerb, sockets: &[LiveSocket], agent: Option<u32>) -> String) — a single call cannot feed both versions

Could not verify: Could not verify reachable\_pids\_are\_excluded\_from\_both\_the\_findings\_and\_the\_reap\_candidates.

The verifier did not have enough to check reachable\_pids\_are\_excluded\_from\_both\_the\_findings\_and\_the\_reap\_candidates, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify reconcile\_phase.

The verifier did not have enough to check reconcile\_phase, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: Vec<PhaseFinding>

Could not verify: Could not verify reconcile\_phase\_ordering\_is\_input\_order\_independent.

The verifier did not have enough to check reconcile\_phase\_ordering\_is\_input\_order\_independent, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify recover\_cmd.

The verifier did not have enough to check recover\_cmd, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: Result<(),CliError>

Could not verify: Could not verify recovery\_hints.

The verifier did not have enough to check recovery\_hints, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: signature changed ((state: &State, liveness: Liveness) -> Vec<String>) → ((state: &State, liveness: &PhaseLiveness) -> Vec<String>) — a single call cannot feed both versions

Could not verify: Could not verify refuse\_launch\_over\_a\_live\_run.

The verifier did not have enough to check refuse\_launch\_over\_a\_live\_run, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: signature changed ((project_root: &Path, phase: PhaseId, verb: LaunchVerb) -> Result<(),CliError>) → ((project_root: &Path, phase: PhaseId, verb: LaunchVerb, cache_dir: Option<&Path>) -> Result<(),CliError>) — a single call cannot feed both versions

Could not verify: Could not verify refuse\_resume\_over\_a\_live\_run.

The verifier did not have enough to check refuse\_resume\_over\_a\_live\_run, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: Result<(),CliError>

Could not verify: Could not verify refuse\_start\_over\_a\_live\_run.

The verifier did not have enough to check refuse\_start\_over\_a\_live\_run, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: Result<(),CliError>

Could not verify: Could not verify registry\_reachable\_pids.

The verifier did not have enough to check registry\_reachable\_pids, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: HashSet<u32>

Could not verify: Could not verify render\_reconciliation\_json.

The verifier did not have enough to check render\_reconciliation\_json, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: serde_json::Value

Could not verify: Could not verify stage\_launched\_ts\_reflects\_event\_age\_not\_phase\_started\_at.

The verifier did not have enough to check stage\_launched\_ts\_reflects\_event\_age\_not\_phase\_started\_at, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

Could not verify: Could not verify status.

The verifier did not have enough to check status, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unsupported return type: Result<(),CliError>

Could not verify: Could not verify status\_reading\_monitor\_liveness\_writes\_no\_state\_and\_no\_event.

The verifier did not have enough to check status\_reading\_monitor\_liveness\_writes\_no\_state\_and\_no\_event, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: unit-returning functions have no value to compare

· 20 grounded finding(s) anchored inline below; 113 more finding(s) on lines outside this diff (see the check run); 48 additional anchorable finding(s) not shown (cap).

[graphify-labs]

⚠️ Health regression — hermetic_devflow()

80 callers depend on it (afferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — start_wedge_arm_interrupted_start_leaves_a_define_gate_nothing_answers()

fans out to 7 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — start_defaults_to_worktree()

fans out to 6 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — start_worktree_mode_ignores_main_checkout_divergence()

fans out to 7 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — start_no_worktree_uses_feature_branch()

fans out to 6 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — hermes_hung_process_is_detected_not_left_running()

fans out to 7 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — assert_start_refuses_live_run()

fans out to 6 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — start_refuses_a_phase_whose_recorded_monitor_is_alive()

fans out to 6 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — start_refuses_a_phase_whose_recorded_agent_is_alive()

fans out to 6 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

[graphify-labs]

⚠️ Health regression — start_proceeds_when_no_state_exists_even_if_the_agent_pid_file_names_a_live_process()

fans out to 6 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.