Attempt log: S6-04 — RemediationOrchestrator + 5-node subgraph + Phase-5 `_validate_stage6` seam¶

Attempt 1 — 2026-05-21 — BLOCKED (Stage-1 gate failure — story drifted from now-GREEN deps)¶

Skill: phase-story-executor (scheduled autonomous run).

Outcome: No code written. Stage 1 (context loading) surfaced structural contradictions between the story (HARDENED 2026-05-19) and the shipped, now-GREEN surfaces of its own dependencies (S5-01 RecipeEngine, S6-03 SubgraphState, S1-03 Applied/RecipeOutcome). The contradictions cannot be resolved by an executor making "reasonable defaults" — they require redesigning the cross-node data model and revising AC-9's pinned node-constructor signatures, which is a phase-story-validator re-hardening decision, not an implementation detail. Per the executor Stage-1 hard gate (open ambiguities ⇒ stop, do not invent answers — Rule 1) the story is marked BLOCKED pending re-hardening.

Why this happened¶

S6-04 was HARDENED on 2026-05-19. Validation note #12 in the story explicitly records that at hardening time S6-01 and S6-02 were not yet on disk, and S6-03/S5-01/S5-02 were HARDENED-not-GREEN. All of those dependencies have since shipped GREEN (S5-01/S5-02 on 2026-05-20; S6-01/S6-02/S6-03 on 2026-05-21) with concrete surfaces that differ from what S6-04's prose assumes. S6-04 was never re-validated against the shipped reality.

Blocking contradictions (evidence)¶

B1 — SubgraphState has no accumulator slot for a VulnerabilityRecord. Shipped SubgraphState (src/codegenie/plugins/subgraph.py:92-99, S6-03 GREEN, extra="forbid") has exactly eight fields: workflow_id, cve, resolution, bundle, recipe_outcome, transform, trust_outcome, branch. state.cve is a CveId (a bare NewType("CveId", str) — identifiers.py:84). But the shipped match_recipes(...) walker (recipe_engine.py:156-161) requires cve: VulnerabilityRecord, not a CveId string. IngestCveNode is the node that resolves CveId → VulnerabilityRecord via VulnIndex, but there is no SubgraphState field to carry that record forward to MatchRecipeNode.

B2 — RecipeOutcome / Applied cannot carry the ApplicationPlan. AC-9 (story line 110) says ApplyRecipeNode "consumes state.recipe_outcome's plan". But SubgraphState.recipe_outcome is typed RecipeOutcome | None, and RecipeOutcome = Applied | Skipped | RecipeNotApplicable | RecipeFailed (outcomes.py:298-301). Applied (outcomes.py:247-256) carries transform_id, plugin_id, recipe_id — no plan field. The ApplicationPlan lives only on MatchedRecipe.plan (recipe_engine.py:121-136), the walker's return payload, and SubgraphState has no slot for a MatchedRecipe or an ApplicationPlan either.

B3 — RecipeEngine.apply signature mismatch. Story Implementation-outline line 209 prescribes recipe_engine.apply(plan, bundle, ctx). The shipped RecipeEngine Protocol (recipe_engine.py:82-91) is async def apply(self, repo: SandboxedPath, plan: ApplicationPlan, capability: NpmInstallCapability) -> RecipeOutcome. Three of the four arg names/types differ.

B4 — ApplyRecipeNode(event_log) (AC-9, line 110) cannot be wired from its pinned constructor. To run a recipe the node needs: the recipe engine(s) (or plugin.transforms()[recipe.kind]), a repo: SandboxedPath, an NpmInstallCapability, and — to turn the returned Applied.transform_id into the Transform object that SubgraphState.transform is typed against — a TransformRegistry (per ADR-0014, the RecipeEngine surfaces its produced Transform via a constructor-injected TransformRegistry). AC-9 injects only event_log. The node as specified cannot produce a Transform.

B5 — Applied carries transform_id, not transform. Story outline line 209 ("On Applied(transform) returns Advance(...transform...)") assumes Applied exposes the Transform object. It exposes a TransformId (outcomes.py:254). Resolving id → object needs the TransformRegistry (see B4).

Resolvable-but-deviating contradictions (not blocking on their own)¶

R1 — SubgraphState has no apply_context field. Story TDD test test_run_with_no_context_builds_fresh_apply_context (story lines 320-330) reads state.apply_context; shipped SubgraphState has no such field. Resolvable by constructor-injecting the ApplyContext into Stage6ValidateNode at run()-time wire-up — but that deviates from AC-9's pinned 2-param Stage6ValidateNode(validate_fn, event_log) signature, which feeds the S6-06 contract snapshot. A validator must decide: amend SubgraphState (additive field) vs. constructor-inject vs. close validate_fn over ctx.

R2 — stale "Notes for implementer" bullet (story line 620). "The node must call self._orchestrator._validate_stage6(transform, ctx)" directly contradicts AC-9 + D-P2 (line 627) + validation note #9, which mandate constructor-injected validate_fn and forbid any orchestrator import from nodes/. Line 620 is stale prose left un-synced by the 2026-05-19 hardening pass. The AC wins; line 620 should be deleted during re-hardening.

Recommended resolution path¶

Run /phase-story-validator on S6-04 to re-harden against shipped reality. The validator (or an arch decision) must resolve:

Where the inter-node data lives. Either (a) amend S6-03's SubgraphState additively with the missing accumulator slots (vulnerability_record: VulnerabilityRecord | None, application_plan: ApplicationPlan | None, apply_context: ApplyContext | None) — note subgraph.py is then a new "Files to touch" entry and an S6-03 amendment; or (b) redesign the node dataflow so each node carries what it needs without a shared typed bag. Option (a) is the smaller change and matches the story's existing intent.
ApplyRecipeNode's real dependency set — engine(s)/plugin.transforms(), repo, NpmInstallCapability, TransformRegistry — and rewrite AC-9's constructor + the Implementation-outline apply_recipe.py bullet against the shipped RecipeEngine.apply(repo, plan, capability) signature and ADR-0014's TransformRegistry lookup.
MatchRecipeNode's real inputs — match_recipes needs a VulnerabilityRecord + Bundle + RecipeRegistry + PluginId; confirm how a PluginResolution exposes the RecipeRegistry and PluginId.
R1 (apply_context threading) and R2 (delete stale line 620).
Re-check S6-06's contract-snapshot expectations stay consistent with any revised node constructor signatures (the orchestrator's three signatures — AC-3/4/5 — are the Phase-5 frozen contract and must NOT change; the node constructors in AC-9 are not frozen and may be revised).

Stage-1 reconnaissance already done (carry forward — saves the next run)¶

Confirmed shipped surfaces (all GREEN): - outcomes.py — RemediationOutcome = Validated | RequiresHumanReview | RemediationNotApplicable | RemediationFailed (discriminator kind: validated / requires_human_review / not_applicable / failed). Validated(branch: BranchName, report_path: str, passed: bool, failing: list[SignalKind]) with the _passed_iff_no_failing model validator (passed == (failing == [])). RemediationFailed(error: RemediationError, partial_report_path: str | None = None). RemediationError(error_id: ErrorId, message: str, details=None). NodeTransition = Advance | ShortCircuit | Escalate; Advance(state: SubgraphState), ShortCircuit(outcome: RemediationOutcome), Escalate(reason: EscalationReason). EscalationReason has 7 members; in-subgraph: filesystem_race, subprocess_jail_unavailable, audit_chain_corrupted, vuln_index_corrupted. - trust_scorer.py — TrustScorer(event_log: EventLog); .score(signals: list[TrustSignal]) -> TrustOutcome is synchronous. TrustOutcome / TrustSignal are defined in outcomes.py and re-exported from trust_scorer.py. No StageOutcome alias exists yet — AC-6 wants StageOutcome: TypeAlias = TrustOutcome added here + to __all__. - subgraph.py — SubgraphNode is a @runtime_checkable Protocol with async def run(self, state: SubgraphState) -> NodeTransition. SubgraphState fields listed in B1. - apply_context.py — ApplyContext(workflow_id: WorkflowId, attempt: AttemptNumber = 1, prior_attempts: tuple[AttemptSummary, ...] = (), capabilities: CapabilityBundle). extra="forbid", frozen=True. A bare ApplyContext() raises ValidationError (no defaults for workflow_id / capabilities) — AC-4 already accounts for this. - transform.py — Transform is an abc.ABC with class-level annotations transform_id: TransformId, diff_bytes: bytes, files_changed: tuple[...], provenance: TransformProvenance. Direct instantiation raises TypeError. - recipe_engine.py — RecipeEngine Protocol apply(repo, plan, capability); match_recipes(registry, plugin_id, cve: VulnerabilityRecord, bundle) -> MatchedRecipe | RecipeNotApplicable. - transforms/__init__.py — the re-export aggregator; AC-2/AC-6 need RemediationOrchestrator + StageOutcome added to its imports + __all__.

Files NOT yet read this attempt (the next run / validator still needs them): plugins/events.py (907 lines — the EventLog API + the internal/spanning event taxonomy AC-16/AC-27/AC-29 depend on), sandbox_jail.py + sandbox/{bwrap,sandbox_exec}.py, engines/npm_lockfile.py, transform_registry.py, plugins/{registry,resolver,bundle}.py, report.py, vuln_index/index.py, exec/__init__.py, signal_kinds.py, plugins/recipe_registry.py.

Lesson for next attempt: S6-04 needs /phase-story-validator before any executor run. Do not retry the executor until the story's data model + node constructors are re-hardened against the GREEN dependency surfaces above.

Validator report: did not reach Stage 2 or Stage 3.

Attempt 2 — 2026-05-21 — STILL BLOCKED (re-validation verdict RESCUE — escalated to `/phase-architect`)¶

Skill: phase-story-validator (scheduled autonomous run — the resolution path Attempt 1 recommended).

Outcome: No code written; executor not run. The re-validation read the dependency surfaces Attempt 1 had explicitly not reached (vuln_index/index.py, plugins/protocols.py, plugins/recipe_registry.py, plugins/resolver.py, transforms/engines/npm_lockfile.py) and found that underneath the patchable dependency-drift (B1–B5 above, now expanded to B1–B9) the story sits on a genuine architectural gap the validator is not authorised to close by editing acceptance criteria. Verdict: RESCUE.

The gap (not patchable by validator or executor):

G1 — RepoContext has no ingress. BundleBuilder.build(resolution, repo_ctx, vuln, vuln_index) (arch §C7 + §Control-flow step 6) needs a RepoContext. The ADR-0001-frozen RemediationOrchestrator.run(repo, cve, context) and __init__(registry, vuln_index, event_log, *, sandbox) signatures (AC-3/AC-4, S6-06-snapshotted) have no slot to receive one. Arch §Control-flow step 1 says the CLI loads repo-context.yaml — structurally impossible to then pass through the frozen surface. This is an internal Consistency contradiction in the design docs.
G2 — no CveId → VulnerabilityRecord path. The frozen run takes cve: CveId, but match_recipes(...) and BundleBuilder.build(...) need a full VulnerabilityRecord. Shipped VulnIndex (S3-02) has lookup(name, ecosystem), affecting_range(cve), digest() — none maps CveId → VulnerabilityRecord. A CVE spans multiple (package, ecosystem) rows; picking the repo's actual one needs the RepoContext from G1. G2 collapses into G1.

Resolution path (changed): route to /phase-architect for a new Phase-3 ADR that decides (a) RepoContext ingress, (b) CveId → VulnerabilityRecord resolution + the additive VulnIndex surface, (c) where the mandatory bundle build lives (the story's 5-node flow has no bundle node). Then re-run /phase-story-validator to fold in the dependency-drift list B1–B9 documented in ../_validation/S6-04-remediation-orchestrator.md §"Re-validation — 2026-05-21". Do not run the executor on S6-04 until that ADR lands.

Lesson for next attempt: S6-04 is not an executor problem and not a validator problem — it is an architecture problem. The next autonomous run should NOT retry the executor or the validator on S6-04; it should either invoke /phase-architect (or a targeted ADR pass) on the G1/G2 decision, or pick up unrelated work in a phase that is not transitively blocked on the orchestrator's data model.

Attempt 3 — 2026-05-22 — BLOCKED-PARTIAL (ADR-0015 support surface landed; story still needs re-harden)¶

Skill: phase-story-executor + phase-story-validator fallback. The local phase-story-executor skill was available, but Stage 1 found S6-04 still explicitly BLOCKED pending a post-ADR-0015 validator pass. Per the executor hard gate, the full S6-04 implementation did not run.

Outcome: Code written only for the smallest ADR-0015 unblocking surface, using RED → GREEN TDD:

VulnIndex.find_by_cve(cve) -> list[VulnerabilityRecord] landed as an additive query surface, sorted with the existing _sort_key.
src/codegenie/transforms/repo_context.py landed with InstalledDependency, RepoContextLoadError, CveResolution, load_installed_dependencies(...), and pure resolve_cve(...).
SubgraphState gained ADR-0015 accumulator slots: installed_dependencies, vulnerability_record, application_plan, and apply_context.
NotApplicableReason / HumanReviewReason gained CVE_NOT_IN_DEPENDENCY_SET / MULTI_PACKAGE_CVE.
StageOutcome: TypeAlias = TrustOutcome now lives in trust_scorer.py and is re-exported from codegenie.transforms.

RED evidence: the new focused tests initially failed during collection with ModuleNotFoundError: No module named 'codegenie.transforms.repo_context' and ImportError: cannot import name 'StageOutcome' from 'codegenie.transforms'.

GREEN evidence:

.venv/bin/pytest -q --no-cov tests/unit/vuln_index/test_find_by_cve.py tests/unit/transforms/test_repo_context_resolution.py tests/unit/transforms/test_adr0015_surface.py → 11 passed.
Nearby affected suite: .venv/bin/pytest -q --no-cov tests/unit/vuln_index/test_index.py tests/unit/vuln_index/test_find_by_cve.py tests/unit/transforms/test_repo_context_resolution.py tests/unit/transforms/test_adr0015_surface.py tests/unit/plugins/test_subgraph_protocol.py tests/unit/transforms/test_trust_scorer.py tests/unit/transforms/test_outcomes.py → 223 passed.
Focused lint/format/type gates clean: ruff check, ruff format --check, and mypy --strict src/codegenie/transforms/repo_context.py src/codegenie/vuln_index/index.py src/codegenie/transforms/trust_scorer.py src/codegenie/plugins/subgraph.py.

Remaining blocker: S6-04 is not Done and must stay blocked until a post-ADR-0015 /phase-story-validator pass rewrites the story ACs, Implementation outline, TDD plan, and Files-to-touch around these now-shipped surfaces plus the remaining B1-B9 dependency-drift resolutions. Do not execute S6-05 or later Step-6/7/8/9 stories before that re-harden lands.

Attempt log: S6-04 — RemediationOrchestrator + 5-node subgraph + Phase-5 _validate_stage6 seam¶