source-control:babysit-prs: dispatching a worker to a PR under active human authorship produces fully redundant work

[kyle-sexton]

Lane: babysit, observed on #665, session 2026-07-20.

Triggering example: a worker was dispatched to #665 (the babysit-prs autopilot-merge-tier PR itself) while the author was actively, live-editing it — 5 pushes in ~20 minutes, replying to each codex finding with his own classification table in real time. The worker's full D1-D7 pass, independent fix, and verification were all redundant: every finding it would have addressed was already being handled by the author faster than the worker could act. Head moved 4x mid-cycle, all legitimate author pushes (not a lane race — the #645 pre-push recheck correctly distinguished this from a race and prevented clobbering).

No harm resulted (the worker correctly detected the redundancy and stood down without pushing/replying/resolving), but the dispatch itself cost a full worker run (176k tokens, 64 tool calls, ~25 minutes) for zero net contribution.

Expected: the snapshot/dispatch-decision layer should have a signal for "this PR has had N commits from its own author in the last M minutes" and either skip dispatching a worker that cycle, or dispatch a much lighter-weight check-only worker instead of a full fix-capable one, when the author appears to be actively driving the PR themselves.

Category: operational/efficiency. Not a correctness bug — the safety rails (verify-before-touching, #645's pre-push recheck) worked exactly as designed and prevented any real interference. This is purely about avoiding wasted dispatch cost on PRs where a human is already actively working.

[kyle-sexton]

This was generated by AI during triage.

Agent Brief

Type: Enhancement (operational/efficiency; not a correctness bug — existing safety rails already prevent harm)
Summary: Add an active-authorship dispatch suppressor to the babysit fan-out gate so a fresh worker is not dispatched to a PR whose own author is visibly mid-session (pushing multiple commits in a short window), where a full fix-and-verify pass is redundant with the author's own real-time work.

Current behavior

The per-PR classifier (the classify_pr surface in the babysit delta engine) computes a needs_worker boolean each cycle from deltas against the previous snapshot, gated by the two suppression arms it already carries: foreign_activity (another session under the same self-login is driving the PR) and refresh_accepted_awaiting_head. There is no signal for "the PR's own author is actively driving this PR right now." Consequently, when an author is live-editing their PR — pushing several commits in minutes and replying to review findings in real time — the ordinary delta arms (head_sha_changed, new_material_feedback, checks_changed, …) fire and a full fix-capable worker is dispatched. That worker's entire pass is redundant: every finding it would address is already being handled by the author faster than the worker can act. The safety rails (verify-before-touching, the pre-push head recheck) correctly cause it to stand down without pushing/replying/resolving, so no harm results — but a full worker run is spent for zero net contribution.

This is the same problem-space as the closed umbrella #534 (ad-hoc merge-readiness classification in babysit), resurfacing as a new, distinct signal gap: #534 shipped one shared authorship/finding/approval classifier for six specific misclassification bugs but did not cover "is the PR author actively driving this PR right now" as a pre-dispatch signal.

Desired behavior

A new active-authorship signal, computed purely and deterministically per cycle, that detects when the PR's own author has pushed N or more commits within the last M minutes (measured against the run's injected observation time). When it fires, worker dispatch for that PR is suppressed for that cycle and the reason is surfaced as a material finding on the PR's status line — never silently. It self-lifts automatically: because the predicate is purely a function of commit recency versus the observation time, once the author goes quiet (no qualifying recent commits), the ordinary delta arms resume dispatching on the next cycle with no state to unwind.

Key design points that must hold:

• Identity axis is the PR's own author, not the configured self-login set. This is the load-bearing difference from foreign_activity (which keys on self_logins). Keying on the PR author makes the signal correct in the autopilot tier too, where the watched author is not the operator. A commit counts as authored by the PR author when the PR author's login appears in that commit's author-login list (co-authored commits list multiple logins).
• Suppression semantics mirror foreign_activity exactly (full suppression, not just the suppressible-arm group): when the signal fires, needs_worker is forced false regardless of every other arm, the needs_worker reasons list is cleared to stay consistent with that, and the pending-worker-dispatch write-ahead fields are left empty (no obligation is recorded for a cycle that dispatched nothing). This matches the issue's "skip dispatching a worker that cycle" and reuses the proven, fixture-locked precedent rather than inventing new suppression semantics.
• Data source is the existing single PR-view call. Commit history carrying per-commit author logins and a commit timestamp is available from the same PR-view fetch the snapshot already performs, by adding the commit-history field to the view field set — no extra network round-trip. (Verified: the PR-view JSON exposes each commit's author-login list and both authored/committed dates.)
• Reuse the source-control:babysit-prs: one shared authorship/finding/approval classifier + golden fixtures; gate script owns the merge-ready boolean (6-issue class) #534 shared classifier. The recency predicate (count of recent commits authored by a given login within a window relative to an observation time) belongs as a new primitive in the shared authorship classifier module, consumed by a thin detector in the delta engine — the same layering foreign_activity uses (detector in the delta engine, authorship primitives in the shared classifier). Do not hand-roll the recency logic at the call site.
• Unlinkable commits fail toward dispatch. A commit whose author login cannot be resolved (e.g. an unlinked email) does not count toward the threshold — the safe direction is to under-suppress (dispatch a possibly-redundant worker) rather than over-suppress (skip a genuinely-needed one).
• Purity/testability contract. Recency is computed against the run's injected observation timestamp (the same one quiet_recheck_due already uses), so classify_pr stays pure and fixture-testable with synthetic commit timestamps.

Decision defaulted (single reversible fork): skip, not a lightweight check-only worker

The issue offers two directions: (a) skip dispatch this cycle, or (b) dispatch a lighter-weight check-only worker instead of a full fix-capable one. Default to (a) skip. Rationale: no lightweight/check-only worker tier exists today, so (b) requires inventing a whole new worker tier (agent, prompt, dispatch path) — disproportionate to the problem, and of near-zero value since the author is already resolving findings faster than any worker (even a light one) could. Skip reuses the existing foreign_activity suppressor machinery verbatim and self-lifts cleanly. This fork is reversible and maintainer-vetoable: if a future need for a light "observe-only" pass emerges, it can be added later without unwinding this suppressor.

Recommended thresholds and rollout (tunable knobs, not blocking design)

Following the established --max-quiet-recheck-seconds pattern, expose N and M as CLI flags with documented defaults:

• M (window): ~15 minutes.
• N (commits by the PR author within the window): ≥ 2. A single routine push-then-walk-away must still get a worker; requiring at least two commits in the window is what distinguishes an active iterating session (the waste case, e.g. the 5-pushes-in-20-minutes observation) from a lone push.
• Rollout: default-on, conservative, and disableable. An always-on suppressor that reduces worker coverage should be a conscious, documented default rather than a silent side effect; the conservative N/M keep false-positives low, and the flags let a maintainer tune or disable it.

Accepted, documented coverage edge (maintainer-vetoable refinement)

During suppressed cycles the state write still absorbs newly-seen feedback ids into the persisted previous-state. If suppression lifts purely on the timer and the head has not moved (the author paused mid-session leaving one finding unaddressed), those ids are no longer "new," so no delta arm re-fires until the periodic quiet_recheck_due fallback (default four hours). foreign_activity has the same property, but its lift condition (ledger reconciliation) implies the other driver did the work, whereas the timer lift here carries no such guarantee — so this is a genuine, minor coverage gap unique to this feature. Recommended default: accept and document it — the issue is about wasted dispatch, not coverage; the safety rails prevent any harm; and any head movement re-fires a delta immediately. Maintainer-vetoable refinement if tighter coverage is later wanted: preserve an unsuppressible-delta obligation across the suppressed window rather than letting it age into "already known."

Key interfaces

• Shared authorship classifier — add a pure recency primitive: given a commit collection (each with an author-login list and a commit timestamp), a target author login, an observation timestamp, and window/threshold parameters, return whether the target author authored at least N commits within the last M minutes (and, ideally, the qualifying commit evidence for the status-line finding). Unlinkable-author commits are excluded from the count.
• PR-view field set — include the commit-history field (author logins + commit timestamp per commit) so the data arrives in the existing single PR-view call.
• Delta engine — a thin detect_active_authorship-style detector mirroring detect_foreign_activity's shape (returns a {"detected": bool, "evidence": [...]} structure), fed the PR's commits, the PR author login, the observation timestamp, and the configured window/threshold from ClassifyConfig.
• ClassifyConfig / snapshot CLI — carry the window (M) and threshold (N) with safe defaults, plus a disable switch, surfaced as CLI flags in the snapshot entrypoint following the existing threshold-flag convention.
• needs_worker computation — add the new detector's detected result as an additional full-suppression term alongside foreign_activity["detected"], with the matching reasons-list and pending-dispatch clearing.
• Fan-Out Gate reference doc — document the new arm in the same suppressor list where foreign_activity and attribution_drift are described, noting the PR-author identity axis and the self-lift behavior.

Acceptance criteria

• The shared authorship classifier exposes a pure recency primitive; unit fixtures verify it counts only commits authored by the target login within the window relative to an injected observation time, excludes unlinkable-author commits, and respects N.
• A delta-engine detector mirroring the existing foreign-activity detector returns detected/not-detected with evidence; its tests mirror the existing detect_foreign_activity cases: active-author detected, inactive not-detected, and self-lifts once the newest qualifying commit ages past the window (advancing only the observation time).
• When the detector fires, a snapshot fixture shows needs_worker is false for that PR even though an otherwise-dispatching delta arm (e.g. head moved, new material feedback) is present, the reasons list is empty, and the pending-worker-dispatch write-ahead fields are empty; a material finding naming active authorship appears on that PR's status line.
• On the immediately following cycle with no qualifying recent commit (observation time advanced past the window, head unchanged), the ordinary arms resume and needs_worker reflects real deltas again.
• Recency is computed against the injected observation timestamp; classify_pr remains pure (no wall-clock read) and the new behavior is exercised entirely from fixtures.
• Commit data is obtained from the existing PR-view call (the commit field is added to the view field set); no new per-PR network round-trip is introduced.
• N and M are CLI flags with the documented defaults (≈15 min, ≥2 commits) and a disable switch; the feature ships default-on and conservative. The existing babysit test suite passes with the new arm active.
• The Fan-Out Gate reference documentation lists the new suppressor arm, its PR-author identity axis (contrasted with foreign_activity's self-login axis), and its self-lifting semantics.

Out of scope

• Inventing a lightweight/check-only worker tier (direction (b)); this brief deliberately chooses skip.
• Folding author comment/reply activity into the signal. The issue notes the author was also replying to findings in real time; commit-count-in-window is the tighter, unambiguous first cut matching the issue's explicit framing. Record author-reply activity as a deferred enhancement (trigger: if commit-only suppression proves too narrow to catch real active-authorship sessions).
• Changing any existing safety rail (verify-before-touching, the pre-push head recheck). Those worked as designed; this feature only avoids paying for the dispatch in the first place.
• Altering foreign_activity, attribution_drift, or the merge/readiness gates beyond adding the new parallel suppressor.

Confidence: MEDIUM (decision-defaulted) — Decision defaulted: skip dispatch (mirror foreign_activity) rather than invent a lightweight check-only worker tier; N/M shipped as conservative, tunable, default-on flags — veto before merge.

[kyle-sexton]

Reproduced this cycle (round 15/16): a separate active worker/autopilot-tier (or manual) actor merged 8 PRs and moved #895's head 4x within one safe-tier cycle, causing 2 stop-on-drift retries before a fix landed. Operator-approved fix direction: before dispatching a worker, skip a PR if its most recent commit is non-self-authored and within the last ~15min (cheap pre-dispatch check) rather than racing it — pairs with this issue's framing (redundant work under active foreign authorship), generalized from human-authorship to any foreign identity.