Date: 2026-09-13
Contract: eve.delivery-fault-game.v1 / preparation-frozen 1.0.0
Admission: blocked by Task 11.11; Task 11.5 remains open
Decision#
The Task 11.5 failure matrix now has one fail-closed, provider-free preparation lane. It exercises all eleven named disruptions with real local Git operations or real operating-system process groups. Every scenario plants an uncommitted operator-owned note in a separate primary clone and compares both its Git status and SHA-256 before and after the fault. A scenario passes only when the fault was actually observed, success was withheld during the fault, and the final state is recovered, reverted, or backed by a specific resumable checkpoint.
This is preparation, not admission. Task 11.11 is still open and the current
workbench WorkItemRow does not carry the required goalRevisionId,
planRevisionId, requirementRefs, dependencyRefs, and
verificationPlanRefs lifecycle bindings. Controlled fixtures cannot substitute
for their durable service-boundary invalidation and recovery. Consequently this
lane produces no Task 11.5 closure manifest, no direct gap-matrix evidence
mapping, no live-fleet count, and no verified claim.
Faults exercised#
| Fault | Live injection | Truthful recoverable end state |
|---|---|---|
| conflict | Two clones commit different content to the same tracked line; git merge reports an unmerged path |
The merge is aborted with the task commit unchanged, then explicitly resolved with both edits and pushed |
moving origin/main |
A competing clone advances the bare remote after the candidate commit | The first push is rejected; the remote head is fetched and merged without force, and the second push retains both changes |
| failed hook | An executable pre-push hook exits nonzero with a probe marker |
The candidate commit remains local and the remote does not move; after correcting the hook the same commit pushes |
| flaky/provider-sick test | A controlled dependency double returns an unavailable outcome, followed by two healthy runs | No green is claimed for the unavailable attempt; two stable passes are required for recovery |
| pre-existing failure | The same deterministic failure is measured before and after a candidate-only change | Its output digest and nonzero outcome remain attributed as pre-existing while the targeted candidate check is reported separately |
| dependency outage | A resumable worker starts while its dependency marker is absent | The empty checkpoint survives; restoration applies the candidate operation exactly once |
| partial commit | One task file is committed while another remains untracked | The partial state is detected, no push is attempted, and both exact byte sets remain available |
| agent crash | A detached child writes task state and is killed with SIGKILL |
The process group is gone while the task file and checkpoint remain |
| budget/kill switch | Two detached children are independently stopped with SIGTERM, once for budget exhaustion and once for an operator kill switch, before either completion sentinel |
No success is reported, neither process survives, and both bounded-work checkpoints remain |
| revert | A candidate commit is pushed and then reverted by a competing clone | Candidate content is absent at remote HEAD while both candidate and revert commits remain ancestors |
| resume | Attempt one exits after operation alpha and a durable checkpoint |
Attempt two applies only beta; neither operation duplicates and the original two-attempt budget remains in force |
Evidence integrity#
The frozen policy binds the governing instructions, Task 11.5 ledger clause, ADR-0076, Task 11.3 repository-execution contract, the existing fleet-drain recovery primitives, the current work-item persistence surface, and every source of this preparation lane by SHA-256. The retained measurement is evaluated by scenario-specific predicates rather than summary booleans. The semantic verifier also compares the exact scenario order and admission boundary, checks canonical timestamps and host cleanup claims, and rejects stale source bindings.
Negative controls independently remove a scenario, mutate operator work, hide a real conflict, discard an upstream commit, lose a hook-blocked commit, fabricate green around flaky or pre-existing failure, discard an outage checkpoint, push a partial commit, leave a crashed or stopped process alive, erase revert history, duplicate resumed work, grant dependency admission, stale a source binding, weaken the policy inventory, corrupt measurement time, or remove cleanup evidence. Each control must make the retained verifier red before the final green regression.
Exact limitations#
- Git operations use real local clones and a real bare remote, but not the live GitHub repository. No force push is used.
- Dependency and provider failures use deterministic local doubles. No external provider outage is induced and no coding model is run.
- Process supervision uses real detached Linux process groups, but it does not prove fleet authorization, tenant isolation, or durable database restart.
- The lane demonstrates recoverability of controlled task and operator state. It does not prove Task 11.11 revision invalidation, independent fleet review, or a production incident response.
- Task 11.5, Phase 11, and G12 remain open.