Capacity queue v1: worker evidence

Task: 54b70bd5-43d9-4c11-ba54-05f515b7b526 v2. Execution: ace1afa7-f9b3-465d-a2d6-9f525921f592. Repository: h8v6/heyaira; branch: heyaira/54b70bd5. Source and starting base: 93a2eb19b8baf01e2935423ec3e82c2fc3bf7d19. Starting parent: d498b01125f81a1cf97346191b6ce0417ef8cdf0. The starting tree was clean; there was no carried candidate. No history was rewritten. Subagents: none. This is worker evidence; Bridge owns independent verification and acceptance.

All commands ran from /Users/jablonskib/HeyAira-agents/.heyaira-worktrees/heyaira/54b70bd5-worker. Tests use installed Python 3.12.7 and synthetic project/account/task data. The existing PostgreSQL runner creates disposable databases using the prepared local admin connection; no URL, credential or real project contents are included here. The new regression fixture exercises real MCP JSON-RPC and Bridge HTTP handlers through ASGI, with real PostgreSQL and no listening socket. Git/provider artifacts and provider sessions are synthetic, as in the existing workflow fixtures.

Cause and implementation

Dispatch previously propagated bridge_at_capacity. Initial offers also expired at created_at + execution_seconds, spending the execution budget before claim. Valid dispatch now persists waiting_capacity and capacity_waiting_since without creating an execution when capacity or online presence is unavailable. The existing recovery promoter reads new work and CI corrections in one node FIFO, using waiting timestamp and workflow UUID. It takes one bounded transaction per item, rechecks authority and uses the same binding/capacity reservation as dispatch. New work and corrections ahead in the FIFO prevent later arrivals taking their slots.

The initial deadline begins at claim; the existing task deadline remains shared with subsequent verification and correction attempts. Queue age is independently bounded at 24 hours, with queue age exceeded. Promotion preserves the original waiting timestamp until claim. The queue projection exposes state, waiting position, timestamp and reason, including the latest node health.skipped_offers reason. Idempotent sends also return the queue projection. A carried candidate's CI feedback is frozen in the new contract so a waiting re-dispatch does not lose it.

Migration: 059_work_capacity_queue.sql, the only new migration. Number 058 is reserved for OpenCode by the frozen task. Changes also refresh tool descriptions, the exported manifest, protocol documentation and existing expectations that full or offline nodes reject dispatches. No Bridge implementation changes were made.

Actual checks

Before implementation, the ten-dispatch test was run against the source above:

TMPDIR="$PWD/.work-tmp" PYTHONPATH=src /Users/jablonskib/.local/share/mise/installs/python/3.12.7/bin/python scripts/test_postgres.py tests/test_capacity_queue.py -p no:cacheprovider

Exit 1, 1 failed in 2.27s. The second distinct send failed at assert not result.is_error, with:

Error executing tool workflow_send: bridge_at_capacity
FAILED tests/test_capacity_queue.py::test_ten_dispatches_are_accepted_in_fifo_order

The fixture was corrected before that baseline run: an invalid OAuth issuer host and an ASGI lifespan crossing pytest tasks initially caused setup/teardown errors. Those errors were harness errors, not the behavioral baseline.

Final targeted PostgreSQL command:

TMPDIR="$PWD/.work-tmp" PYTHONPATH=src /Users/jablonskib/.local/share/mise/installs/python/3.12.7/bin/python scripts/test_postgres.py tests/test_capacity_queue.py tests/test_mcp_runtime_contract.py -p no:cacheprovider

Exit 0, actual output:

..........................                                               [100%]
26 passed in 74.66s (0:01:14)
postgres_acceptance=passed: selected tests, zero skipped tests

The 10 queue cases cover sequential and racing admission, concurrent promoters, shared FIFO in both orders with a waiting CI correction, recovery in a new Python process, waiting past the execution limit, the full limit at claim, queue-age expiry both before offer and at claim, offline/asleep admission and recovery, skipped-offer visibility, account/capability checks while full, dispatcher revocation and CI feedback on a carried candidate. Both FIFO variants complete the running execution through the real Bridge handlers, then start a new interpreter that runs recover_once using only the database URL from the test environment.

Earlier iterations of this same selection passed 25 tests before the carried-CI regression was added. An earlier queue-only run passed 7 tests in 59.54s. During fixture development, one run reported 4 failed and 3 passed: the subprocess finished recovery but collection timed out at 30 seconds, and two offline fixture cases passed a string where asyncpg expected a timedelta. After fixing the interval and bounding subprocess collection at 90 seconds, all required cases passed. One diagnostic run then failed solely because an extra thread diagnostic did not match expected stdout; that diagnostic was removed. No interrupted run is counted as a pass.

Supplemental contract/view command:

TMPDIR="$PWD/.work-tmp" PYTHONPATH=src /Users/jablonskib/.local/share/mise/installs/python/3.12.7/bin/python -m pytest tests/test_docs_contract.py tests/test_mcp_runtime_contract.py tests/test_workflow_view.py -q -p no:cacheprovider

Exit 0: 53 passed in 63.19s (0:01:03).

Manifest commands:

PYTHONPATH=src /Users/jablonskib/.local/share/mise/installs/python/3.12.7/bin/python scripts/export_mcp_contract.py
PYTHONPATH=src /Users/jablonskib/.local/share/mise/installs/python/3.12.7/bin/python scripts/export_mcp_contract.py --check
PYTHONPATH=src /Users/jablonskib/.local/share/mise/installs/python/3.12.7/bin/python scripts/check_docs_contract.py

All exit 0; output respectively: wrote contracts/mcp-tools.json, MCP contract is up to date, and documentation contract passed: 46 MCP tools covered.

Execution limitations and unrun checks

Three supplemental legacy checks were attempted:

TMPDIR="$PWD/.work-tmp" PYTHONPATH=src /Users/jablonskib/.local/share/mise/installs/python/3.12.7/bin/python scripts/test_postgres.py tests/test_workflow_e2e.py::test_dispatch_respects_node_capacity_and_verifier_keeps_the_worker_slot tests/test_task_execution_review.py::test_expired_offer_reaped_without_claim tests/test_task_execution_review.py::test_initial_expired_offer_cannot_race_reaper -p no:cacheprovider

Exit 1: 3 skipped in 4.90s, each because listening sockets are not permitted here (agent sandbox); runs in CI. The runner correctly reported postgres_acceptance=failed: no test ran. These are execution limitations, not candidate defects, and are not counted as passing. The new PostgreSQL/ASGI cases cover the required criteria without a listener. The other legacy TCP modules, a full suite, live provider execution and deployment were not run. Bridge must run independent verification on the committed candidate.

continuity_context is absent from this execution's callable MCP tools; the fetched work contract v4 explicitly exempts Bridge workers from that interactive startup step. Identity, exact task v2, repository instructions and Bridge skills were read. There is no registered workflow_wait MCP tool in this revision; queue visibility uses the existing workflow_get projection and its polling clients. No new wait API was invented. Apple's default Git wrapper hit a sandbox cache error; the permitted direct Git binary worked. A process-list diagnostic was denied by the sandbox.

Frozen criterion records

Criterion	Frozen method
K1	Targeted pytest -> passed; RESULT states it failed before the change.
K2	Targeted pytest -> passed.
K3	Targeted pytest -> passed.
K4	Targeted pytest -> passed.
K5	Run the existing mcp-tools.json contract/manifest test -> passed.
K6	git diff --name-only ..HEAD -> only allowed paths.

criterion_id: K1
outcome: pass
evidence_path: docs/reports/2026-10-11-capacity-queue-worker-result.md
feedback: Targeted PostgreSQL pytest above exited 0 (26 passed, zero skipped). Ten distinct sends produce 1 queued and 9 waiting_capacity, positions 1-9. The same regression failed before the change with bridge_at_capacity (exit 1).

criterion_id: K2
outcome: pass
evidence_path: docs/reports/2026-10-11-capacity-queue-worker-result.md
feedback: Targeted PostgreSQL pytest above exited 0. Both shared FIFO orders pass after a running execution completes; a fresh Python process reads/promotes the database queue through recover_once.

criterion_id: K3
outcome: pass
evidence_path: docs/reports/2026-10-11-capacity-queue-worker-result.md
feedback: Targeted PostgreSQL pytest above exited 0. A 2-minute wait survives a 60-second execution limit and receives the full limit at claim; 25-hour waiting work and an unclaimed offer block with queue age exceeded.

criterion_id: K4
outcome: pass
evidence_path: docs/reports/2026-10-11-capacity-queue-worker-result.md
feedback: Targeted PostgreSQL pytest above exited 0. Real workflow_get returns queue.state, position, waiting_since and reason, including skipped by bridge: account busy from node health.skipped_offers.

criterion_id: K5
outcome: pass
evidence_path: docs/reports/2026-10-11-capacity-queue-worker-result.md
feedback: The existing runtime contract test passed in the 26-test run; export_mcp_contract.py --check exited 0 with MCP contract is up to date. Documentation contract exited 0 (46 tools).

criterion_id: K6
outcome: pass
evidence_path: docs/reports/2026-10-11-capacity-queue-worker-result.md
feedback: Intended staged scope is confined to src/heyaira/, tests/, docs/, contracts/mcp-tools.json and one migration (059). git diff --check exited 0. The exact post-commit git diff --name-only <base>..HEAD result and result SHA are recorded in the appended RESULT receipt.

The frozen methods are: K1 targeted pytest passed plus failed-before-change evidence; K2-K4 targeted pytest passed; K5 the existing manifest/contract test passed; K6 git diff --name-only <base>..HEAD contains only allowed paths. This report's result commit is the commit containing it, pinned explicitly by the RESULT receipt.