feat(fleet): qualify scoped dispatch with durable Buzz receipts

[mfethe1]

Summary

Buzz CML tasks currently have no qualified path into the fleet’s durable execution receipts. Add an on-demand adapter that verifies a signed plan and host-local scope, freezes outgoing transitions before publication, records an attempt before execution, and stores its result before submitting signed evidence for review. Stable attempt IDs and payload digests prevent duplicate delivery from re-executing completed work and refuse automatic replay of an unknown outcome.

This initial capability only reads an approved repository’s HEAD and indexed entry count. It does not run models, modify repositories, or approve completion. Windows admission is blocked until process-tree containment is qualified. POSIX process groups are only used for the fixed probe; this is not a sandbox or a server-side atomic lease for arbitrary agents.

Related issue

Related foundations: #10 and #15. Searched existing issues and PRs; no duplicate durable qualification adapter found.

Testing

At head 7fce31123409df3c2e32a176099d9b80473b79dd, all 16 adapter tests passed, including duplicate delivery, lost publication replies, scope tampering, unknown outcomes, and cancellation. Independent review reproduced the Git-filter execution risk and Windows containment gap, then verified the fixed probe and Windows admission denial.

A native signed plan-to-review run passed. The scoped network candidate also completed Mack scheduler dispatch to Mack, Airy, and Rosie. Each host's receipt used the same task UUID as its signed CML task and human task record; the task comment records the attempt and signed result IDs. Replaying the finished envelope to each installed host preserved receipt timestamps, results, journals, and outgoing-event records. All three installed hosts identically rejected eight scope expansions. An independent reviewer checked Mack's live receipt, installed files, signed reduction, task, and channel memberships. CML remains review, human tasks remain in_progress, and acceptance remains unverified. These network checks used separately staged operator wrappers; this PR adds the adapter, not a continuous scheduler or task-row subscription.

Full just ci failed at this exact head: the mobile suite reported 2,241 passed and eight failed agent-activity golden comparisons. The same eight tests fail at unchanged base adeec6eb5c4ff425aa03d8a744a295da4429f67f; this PR does not change mobile files or expected images. The network probe exercised no model inference or provider fallback. Rosie used an index-only clone, and Airy used the temporary candidate checkout; physical-phone operation and Windows execution remain unqualified.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 821bb3d5-abb6-44f8-beb7-16d70f2eaad6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mfethe1]

🧪 Jev PR-Triage Pilot

PR #19: feat(fleet): qualify scoped dispatch with durable Buzz receipts — verdict: BLOCK

question	answer	confidence
sensitive_path	P(yes)=0.79	—
test_coverage	P(yes)=0.99	—
size_concern	P(yes)=0.90	—
risk	1.71/2	0.57
route	needs_review	0.78
block_reason	none	0.44

Block reason (if any): none
Pilot: Jev (System One) typed triage. Verdict thresholds in code; escalate on low confidence.

[mfethe1]

🧪 Jev PR-Triage (v3)

PR #19: feat(fleet): qualify scoped dispatch with durable Buzz receipts — verdict: REVIEW

dimension	metric	value
Correctness	problem resolved	P(yes)=0.41
Correctness	rework needed	0.88/2
Quality	code quality	1.84/2
Quality	test coverage	P(yes)=0.98
Architecture	integration compatibility	1.85/2
Architecture	future proof	1.37/2
Governance	sensitive path	P(yes)=0.89
Governance	size concern	P(yes)=0.85
Synthesis	merge risk	1.30/2
Synthesis	route	needs_review (0.89)
Diff	security exposure	P(yes)=0.18
Diff	performance impact	0.02/2

🔍 Reviewer focus

• File: scripts/fleet/fleet.py
• Concern: security

Block reason (if any): none
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

[mfethe1]

🧪 Jev PR-Triage (v3)

PR #19: feat(fleet): qualify scoped dispatch with durable Buzz receipts — verdict: REVIEW

dimension	metric	value
Correctness	problem resolved	P(yes)=0.42
Correctness	rework needed	0.83/2
Quality	code quality	1.83/2
Quality	test coverage	P(yes)=0.98
Architecture	integration compatibility	1.86/2
Architecture	future proof	1.37/2
Governance	sensitive path	P(yes)=0.88
Governance	size concern	P(yes)=0.84
Synthesis	merge risk	1.27/2
Synthesis	route	needs_review (0.91)
Diff	security exposure	P(yes)=0.19
Diff	performance impact	0.02/2

🔍 Reviewer focus

• File: scripts/fleet/fleet.py
• Concern: security

Block reason (if any): none
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.