feat(sdd): adopt native attempt authority

[barbatdev]

Summary

• Make Gentle AI's Git-common-dir sdd-attempt ledger the sole attempt and changed-line budget authority for OpenSpec and Engram flows.
• Require acquire before runtime-bearing sdd-apply, sdd-verify, or remediation work, and settle after the external run.
• Keep Pi from creating parallel counters, tokens, state machines, or attempt ledgers.

Advances #256 (track 3 of 10). Does not close #256.

Review path

1. Review assets/sdd-orchestrator-workflow.md for the exact acquire/settle routing and gatekeeper reconciliation.
2. Review assets/support/sdd-status-contract.md for artifact-store-agnostic authority and schema separation.
3. Review tests/native-sdd-attempt-authority.test.ts for the negative controls.

Verification

• Native attempt authority tests: 15/15
• Related structural tests: 68/68
• Runtime package harness: passed
• git diff --check: passed
• Native reliability review: no findings
• Native pre-commit and pre-push gates: allow

Scope

This PR covers only issue #256 track 3. Stable provider repinning and the other parity tracks remain out of scope.

Summary by CodeRabbit

• New Features

  • Added runtime attempt authorization for apply, verification, and remediation workflows.
  • Workflows now honor provider-controlled proceed, blocked, complete, and reset outcomes.
  • External runs require settlement with evidence and disposition details.
  • Gatekeeper reruns obtain fresh authorization before continuing.

• Documentation

  • Documented runtime attempt authority and workflow behavior.

• Tests

  • Added coverage for authorization, launch gating, settlement, resets, reruns, and compatibility behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 63cdea50-c536-40ee-ba8c-638218f08095

📥 Commits

Reviewing files that changed from the base of the PR and between e75d092 and 821ad50.

📒 Files selected for processing (1)

• tests/native-sdd-attempt-authority.test.ts

---

📝 Walkthrough

Walkthrough

The PR adds provider-managed attempt acquisition and settlement rules for runtime-bearing SDD operations. It updates workflow and status contracts and adds tests for routing, evidence, request IDs, reset restrictions, reruns, compatibility, and schema preservation.

Changes

Native runtime attempt authority

Layer / File(s)	Summary
Attempt authority contracts assets/sdd-orchestrator-workflow.md, assets/support/sdd-status-contract.md	The contracts require provider acquisition before runtime launches and settlement afterward. They define route states, opaque tokens, evidence fields, request IDs, reset restrictions, and provider-owned attempt state.
Contract validation tests/native-sdd-attempt-authority.test.ts	Tests validate section structure, launch gating, settlement semantics, request IDs, gatekeeper reruns, compatibility behavior, artifact-store independence, runtime-safe references, and the unchanged SDD v1 status schema.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SDDOrchestrator
  participant ProviderCLI
  participant RuntimeLaunch
  SDDOrchestrator->>ProviderCLI: acquire attempt authorization
  ProviderCLI-->>SDDOrchestrator: return proceed, blocked, or complete
  SDDOrchestrator->>RuntimeLaunch: launch runtime when route is proceed
  RuntimeLaunch-->>SDDOrchestrator: return run evidence
  SDDOrchestrator->>ProviderCLI: settle attempt with evidence and disposition

Loading

Possibly related issues

• fix(workflow): prevent SDD attempt and review recovery authority dead ends gentle-ai#1947 — Defines related provider-owned native SDD attempt authority, including acquisition, routing, resets, and continuation.
• bug(sdd): cross-version settle drops captured untracked files and inflates changed-line budget gentle-ai#2907 — Relates to native attempt acquisition and settlement semantics across versions.

Possibly related PRs

• Gentleman-Programming/gentle-pi#76 — Introduces workflow assets referenced by the updated contracts.
• Gentleman-Programming/gentle-pi#132 — Modifies related SDD status and workflow contracts and tests for provider authority and lifecycle routing.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adopting native SDD attempt authority.
Linked Issues check	✅ Passed	The PR satisfies #256's scoped native SDD acquire/settle authority requirements, including provider ownership, request IDs, gating, and no local ledger.
Out of Scope Changes check	✅ Passed	The documentation and tests directly support the scoped native attempt-authority objective, with no unrelated code changes identified.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/native-sdd-attempt-authority.test.ts`:
- Around line 60-67: Strengthen the acquire and settle contract assertions in
tests/native-sdd-attempt-authority.test.ts at lines 60-67 and 92-108. For
acquire, assert --cwd, --change, --request-id, --work-unit, --evidence-goal,
--max-attempts, and --max-changed-lines; for settle, assert --cwd, --change,
--token, and --request-id. Also constrain settle to the exact allowed outcome
values and require an evidence revision other than none, using the existing
workflow section assertions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e91e65a3-73b3-4831-9e72-99b46dfc90dd

📥 Commits

Reviewing files that changed from the base of the PR and between 19b0ed7 and 28d44a6.

📒 Files selected for processing (3)

• assets/sdd-orchestrator-workflow.md
• assets/support/sdd-status-contract.md
• tests/native-sdd-attempt-authority.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/native-sdd-attempt-authority.test.ts`:
- Around line 50-62: Update extractCommandLine to collect every command line
matching commandPrefix and assert that exactly one match exists before returning
it, so duplicate acquire or settle commands are rejected rather than silently
validating only the first. Preserve the existing command-prefix matching and
failure message context.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 29569489-fd79-44b4-a345-f4ca426ac904

📥 Commits

Reviewing files that changed from the base of the PR and between 28d44a6 and e75d092.

📒 Files selected for processing (1)

• tests/native-sdd-attempt-authority.test.ts