Report spawn CAS outcome back to the spawn selector so admission-time reservations can track the true spawn result

[luizParreira]

Ask

decide() (the spawn selector seam, e.g. bip's BipSubagentSpawnSelector) returns before the journal's spawn_subagent_{invocation,batch} lease CAS runs. The CAS outcome — committed, failed, cancelled — is not observable from the selector, so any admission-time reservation (bip's per-issue work claims, unit reservations) cannot release or transfer ownership based on the true spawn result.

Concrete need: a post-CAS callback/notification to the selector (or an awaitable spawn-outcome handle returned from decide()) carrying {child ids, outcome} per accepted slot.

Why (evidence from bipa-app/bip#576, codex-gate rounds 8-10)

bip added an atomic per-Linear-card claim at spawn admission to prevent duplicate workers on one card. Three review rounds iterated on the claim lifetime and each ended at the same wall:

• Guard disarmed at commit → claim absent during the admission→bind window (SDK calls the CAS after decide() returns) → concurrent same-card spawn double-admits.
• Guard never disarmed → an unobservable CAS failure/cancellation strands the claim until daemon restart.
• Current compromise: transfer-to-store + 5-minute lease self-heal — sound but approximate; the lease bounds the damage of the unobservable failure rather than eliminating it, and crash-ordering interactions (orphan reconciliation vs fresh admissions) remain.

The reviewer's terminal finding and the lane's own conclusion agree: ownership semantics cannot converge while the spawn outcome is invisible at the seam that takes the reservation.

Related: this is adjacent to the existing daemon-side orphan reconciliation; a spawn-outcome signal would also let reconciliation seed accepted-orphan ownership before serving new admissions.

Filed from the wave-4 codex-gate program (bip PR #576 / ENG-9023).

[luizParreira]

Implementation design for the spawn-outcome seam (from the joint #358+#363 design, 2026-07-13)

#363 shipped as PR #369. This preserves the #358 half of the design, verified against main at 3e0746d (pre-#367/#369; re-verify line numbers — #367 landed spawn_mixed_children touching classify_batch/apply_batch_routing, so the DegradedToTool arm noted below is now the per-slot Committed arm).

3. Spawn-outcome seam (#358)

API: a provided (default no-op) callback on the existing trait — not an awaitable handle from decide():

#[async_trait]
pub trait SubagentSpawnSelector: Send + Sync {
    async fn decide(&self, parent_thread_id, tool_calls) -> Result<Vec<SubagentSpawnDecision>>;

    /// Fired once per admission attempt that produced ≥1 SpawnAsSubagent
    /// decision, immediately after the spawn store call settles.
    /// Must be cheap and must not panic; at-most-once (see below).
    async fn on_spawn_outcome(&self, report: SpawnOutcomeReport) {}
}

pub struct SpawnOutcomeReport {
    pub parent_thread_id: ThreadId,
    pub parent_task_id: AgentTaskId,   // trait moves to a location that can see it, or String
    pub slots: Vec<SpawnSlotOutcome>,
}
pub struct SpawnSlotOutcome {
    pub spawn_index: usize,
    pub tool_call_id: String,
    pub child_thread_id: ThreadId,     // echoed from the selector's own plan
    pub outcome: SpawnOutcome,
}
pub enum SpawnOutcome {
    Committed { invocation_task_id: AgentTaskId, child_root_task_id: AgentTaskId },
    Failed { error: String },   // store rejected atomically (CAS/lease/validation/IO); nothing persisted
    DegradedToTool,             // pre-#300 mixed batch: slot executed as a plain tool
    Superseded,                 // routing skipped this execution (defensive; see below)
}

Justification for callback over handle: decide() must stay deterministic and re-invocable across lease-expiry retries (documented trait contract) — a per-call awaitable handle creates retry-crossing state the suspension machinery would have to persist; the worker already owns the single post-CAS control point (apply_batch_routing, shared by both suspend paths); a default method is a non-breaking trait change; and a handle dangles on crash with identical at-most-once semantics but a leaked future. RootTurnDeps already carries the selector, so wiring is zero-plumbing.

Where it fires: in apply_batch_routing (root_turn.rs:3973), right after the store call settles, before wake_workers_for_batch — success ⇒ Committed per slot with ids from SpawnedSubagentInvocation/SpawnedSubagentBatch; store error ⇒ Failed for every accepted slot, then the error propagates unchanged (turn fails or is requeued; the retry re-calls decide(), giving bip the exact release→re-reserve lifecycle it needs). To report mixed-batch slots, classify_batch_for_inputs must retain a slot manifest (spawn_index, tool_call_id, child_thread_id) that classify_batch currently drops on UnsupportedMixedBatch — post-#300 this arm becomes per-slot Committed via spawn_mixed_children. The early idempotency-guard bail in suspend_at_tool_boundary (:3679, parent already WaitingOnChildren) returns BEFORE decide() runs, so no report fires there — the selector took no reservation in that execution (Superseded is kept for any future path where decide ran but routing was skipped).

Delivery guarantee — honest statement: at-most-once, in-process. A crash between the CAS and the callback loses the notification. A journaled outcome record is NOT warranted: the CAS outcome is already durable as first-class task rows — committed spawns exist as Subagent invocation tasks with linkage under the parent (AgentTaskStore::list_children(parent_id)), and a failed CAS persists nothing (single atomic store call). A second durable record could only agree with or contradict that truth. What reconciliation needs is the QUERY, not a new record.

Orphan reconciliation consumption: on daemon startup, before serving new admissions: enumerate parents in WaitingOnChildren on threads the daemon owns (ListThreadTasks gRPC / list_children) → each live Subagent child row yields {invocation_task_id, child_root_task_id, child_thread_id} → seed accepted-orphan ownership claims exactly as if Committed had been delivered; parents Pending/Running with no subagent children ⇒ the CAS never landed ⇒ release any stale claim. This turns bip's 5-minute lease self-heal into a crash-only backstop instead of the primary mechanism.

4. Interaction between #363 and #358

Spawn outcomes stay a process-local seam — they do not ride the lifecycle-event channel. Reasons: the consumer is the in-process admitting selector (latency-sensitive reservation windows); the durable truth is the task rows, and a wire event would add a second source of truth to the public replay contract with no wire consumer. The coherent contract story: durable task identity is the attribution key everywhere — #363 stamps it on the public journal (emitter_task_id), #358 hands the same ids to the admission seam synchronously (SpawnOutcomeReport), and the two join up downstream: a selector/daemon that reserved on Committed{child_root_task_id} can then follow the child thread's stream and causally match its Start/Done frames by the very same id. Shared plumbing is otherwise nil — the changes touch disjoint types (foundation event enum + host gate vs. server trait + worker routing), which is why two PRs are clean.

Test plan (selector portion)

Selector tests (root_turn_test.rs, FailingSpawnSelector precedent at :3958, with a recording selector):
8. Single spawn ⇒ one Committed with ids matching the returned SpawnedSubagentInvocation. 9. Fan-out ⇒ N slots in input order. 10. Mixed batch pre-#300 ⇒ DegradedToTool (post-#300: per-slot Committed). 11. Forced store CAS failure (wrong lease) ⇒ Failed per slot, error propagates, list_children empty. 12. Requeue-retry lifecycle: decide→Failed→decide observed in order (reservation release/re-take). 13. Idempotency-guard bail ⇒ decide not consulted, no report. 14. Crash between CAS and notify: not simulatable in-process as a real crash — pin the invariant instead: after a committed spawn with the callback never delivered, list_children(parent) reconstructs exactly the Committed payload (the reconciliation contract).