fix(runs): keep terminal artifact reads local

Terminal artifact and evidence readers now use only persisted controller state, while generated public URLs require recorded reachability before emission.

AI assistance: OpenAI gpt-5.6-sol via OpenCode was used to trace the artifact-reader and publication paths, implement the bounded-read invariant, and run focused verification. Chris Huber remains responsible for every line.

Author: Chris Huber

crates/homeboy-cli/src/commands/runs/tests/mod.rs

@@ -1524,7 +1524,7 @@ fn artifacts_command_suppresses_viewer_links_when_public_url_is_unreachable() {
             .find(|artifact| artifact.kind == "bench_artifact")
             .expect("bench artifact");
 
-        assert!(artifact.public_url.is_some());
+        assert_eq!(artifact.public_url, None);
         assert!(artifact.viewer_links.is_empty());
         assert_eq!(artifact.viewer_url, None);
         assert_eq!(

crates/homeboy-core/src/observation/runs_service/artifact_links.rs

@@ -2,13 +2,24 @@ use super::*;
 
 /// Enrich a single artifact record with public/viewer link metadata.
 ///
-/// Mirrors the original CLI helper exactly: derive a public URL (from
-/// stored artifact metadata or by treating the artifact path as the URL
-/// for `url`-typed artifacts), then resolve any cached viewer links.
+/// Derive a public URL from stored artifact metadata or, for explicitly
+/// URL-typed artifacts, from the recorded URL. Generated public URLs are only
+/// emitted after the persistence-time probe verified them, so a successful
+/// terminal handoff never advertises an already-broken tunnel URL.
 pub(crate) fn enrich_artifact_link(mut artifact: ArtifactRecord) -> ArtifactRecord {
     let public_url =
         public_artifact_url(&artifact).or_else(|| public_url_for_url_artifact(&artifact));
     if let Some(url) = public_url.clone() {
+        if artifact.artifact_type != "url"
+            && artifact
+                .metadata_json
+                .get("public_url_validation")
+                .and_then(|validation| validation.get("reachable"))
+                .and_then(Value::as_bool)
+                != Some(true)
+        {
+            return artifact;
+        }
         artifact.public_url = Some(url.clone());
         artifact.viewer_links = cached_validated_viewer_links(&artifact, &url);
         artifact.viewer_url = artifact.viewer_links.first().map(|link| link.url.clone());
@@ -51,13 +62,10 @@ pub fn related_lab_artifacts_for_runner_job(
     if run.kind != "runner-exec" {
         return Ok(Vec::new());
     }
-    // Resolve the runner-exec run's Lab job id. Prefer authoritative runner
-    // evidence; fall back to the persisted metadata in either shape.
-    let Some(job_id) =
-        runner_evidence::with_runner_evidence(|p| p.mirrored_runner_job_identity(run))
-            .map(|(_runner_id, job_id)| job_id)
-            .or_else(|| lab_remote_job_id(run).map(str::to_string))
-    else {
+    // The terminal envelope persists the Lab identity. Do not ask a live
+    // runner from a durable reader: the runner can be gone precisely when its
+    // already-recorded evidence is needed for review.
+    let Some(job_id) = lab_remote_job_id(run).map(str::to_string) else {
         return Ok(Vec::new());
     };
     let mut artifacts = Vec::new();
@@ -83,15 +91,15 @@ pub fn related_lab_artifacts_for_runner_job(
 
 /// List the enriched artifact records attached to a run.
 ///
-/// Side-effect ordering matches the CLI: refresh mirrored daemon evidence,
-/// then index nested publication artifact refs, then list and enrich.
+/// This reader only consults the durable local store. Runner reconciliation and
+/// remote manifest indexing are explicit operations, so a disconnected or
+/// stuck runner cannot block an artifact receipt, evidence report, or terminal
+/// handoff.
 pub fn list_artifacts_for_run(
     store: &ObservationStore,
     run_id: &str,
 ) -> Result<Vec<ArtifactRecord>> {
     let run = require_run(store, run_id)?;
-    refresh_mirrored_daemon_evidence_best_effort(&run.id);
-    crate::artifacts::index_remote_published_artifact_refs_for_run(store, &run.id)?;
     let artifacts = store.list_artifacts(&run.id)?;
     Ok(enrich_artifact_links(artifacts))
 }

crates/homeboy-core/src/observation/runs_service/tests.rs

@@ -690,6 +690,11 @@ fn require_run_reads_terminal_lab_review_alias_while_runner_probe_is_stalled() {
         store
             .import_run(&run)
             .expect("persist terminal Lab review run");
+        let artifact_path = _home.path().join("terminal-evidence.json");
+        std::fs::write(&artifact_path, br#"{"ok":true}"#).expect("artifact bytes");
+        store
+            .record_artifact(&run.id, "terminal_evidence", &artifact_path)
+            .expect("persist terminal evidence");
 
         let (entered_tx, entered_rx) = mpsc::channel();
         let (release_tx, release_rx) = mpsc::channel();
@@ -707,6 +712,10 @@ fn require_run_reads_terminal_lab_review_alias_while_runner_probe_is_stalled() {
         let resolved = require_run(&store, label).expect("durable local terminal record");
         assert_eq!(resolved.id, run.id);
         assert_eq!(resolved.status, RunStatus::Fail.as_str());
+        let artifacts = list_artifacts_for_run(&store, &run.id)
+            .expect("durable artifact reader must not wait for the runner");
+        assert_eq!(artifacts.len(), 1);
+        assert_eq!(artifacts[0].kind, "terminal_evidence");
         assert!(
             !stalled.is_finished(),
             "lookup completed before probe release"

crates/homeboy-extension/src/bench/artifact_persistence.rs

@@ -353,25 +353,27 @@ pub fn apply_recorded_bench_artifact_links(
 ) -> Option<BenchDiagnostic> {
     artifact.observation_artifact_id = Some(record.id.clone());
     let public_url = artifact_links::public_artifact_url(record)?;
-    artifact.public_url = Some(public_url.clone());
-    artifact.viewer_refs.viewer_links =
-        artifact_links::cached_validated_viewer_links(record, &public_url);
-    artifact.viewer_refs.viewer_url = artifact
-        .viewer_refs
-        .viewer_links
-        .first()
-        .map(|link| link.url.clone());
     let validation = record.metadata_json.get("public_url_validation")?;
     let reachable = validation
         .get("reachable")
         .and_then(serde_json::Value::as_bool)
         .unwrap_or(false);
-    (!reachable).then(|| {
+    if reachable {
+        artifact.public_url = Some(public_url.clone());
+        artifact.viewer_refs.viewer_links =
+            artifact_links::cached_validated_viewer_links(record, &public_url);
+        artifact.viewer_refs.viewer_url = artifact
+            .viewer_refs
+            .viewer_links
+            .first()
+            .map(|link| link.url.clone());
+        None
+    } else {
         let error = validation
             .get("error")
             .and_then(serde_json::Value::as_str)
             .unwrap_or("public artifact URL was not reachable");
-            bench_artifact_diagnostic(
+        Some(bench_artifact_diagnostic(
                 scenario_id,
                 run_index,
                 name,
@@ -384,8 +386,8 @@ pub fn apply_recorded_bench_artifact_links(
                     "status_code": validation.get("status_code").cloned().unwrap_or(serde_json::Value::Null),
                     "error": validation.get("error").cloned().unwrap_or(serde_json::Value::Null),
                 }),
-            )
-    })
+            ))
+    }
 }
 
 fn bench_artifact_metadata(