docs(vrs): define no-CAS launch drift boundary

[schickling-assistant]

Why

A healthy task is currently adopted by stable identity even when its current Agent Spec would launch it differently. That preserves R11 control-plane replacement safety, but desired-versus-running drift is invisible. Restarting on every declaration edit would be destructive, while making recovery depend on captured generations, journals, or CAS would make the ordinary catalog insufficient.

Nathan’s boundary is explicit: every st2 behavior and ordinary workflow must remain complete with a plain copied or synchronized catalog folder and without CAS. CAS needs separate review and may only be additive publication, history, or storage optimization.

What

Reduce the proposal to a minimal protected VRS contract:

• derive a versioned desired launch fingerprint only from backend kind, lowered shell/direct argv, resolved cwd, and st2-managed plus declared effective environment;
• persist an observed fingerprint only when st2 itself launches that runtime, bound to the launch’s exact runtime identity and creation incarnation;
• trust that observed fingerprint only while the current live runtime exactly matches the recorded binding; a missing or mismatched binding reports unknown;
• expose converged, drifted, and unknown;
• adopt healthy drifted or unknown work without implicit restart;
• launch absent/dead active work from the latest current declaration;
• keep live replacement explicit and fenced by selected catalog, host, effective PTY root, task set, and an exact runtime identity recheck immediately before disruption;
• leave preview and one/subset/all selection semantics open without reserving an unimplemented CLI name;
• make interruption after stop heal through ordinary absent/dead reconciliation to the latest desired contract;
• make retirement stop and prevent relaunch; and
• keep rename as explicit retire-old/add-new.

The prior captured-generation design is deliberately removed: no immutable old-generation launch snapshot, content-addressed boot-input capture, durable journal, operation ID, phase machine, terminal receipt, exact old-generation crash replay, or atomic old-to-new runtime transition.

Scope

Docs only: docs/vrs/requirements.md and docs/vrs/spec.md. No runtime, catalog, rollout, database, or CAS implementation.

Validation

Exact head: 0e7e317ee4adf354bc0e1273ad9f0bab5f5f1b49

• current-main ancestry: 16097daac413ea0babd128f58f710b3d00b38488
• semantic diff from current main: exactly 2 protected VRS files, +94/-0
• git diff --check origin/main: pass
• cargo test --workspace --all-targets -- --test-threads=1: pass
• cargo clippy --workspace --all-targets -- -D warnings: pass
• cargo doc --workspace --no-deps: pass with 5 pre-existing warnings
• local nix flake check --print-build-logs: unavailable because this host has no nix executable
• hosted Nix run 30546682829, job 90884502251: success on exact head
• review-thread audit: all 3 historical threads remain resolved and outdated; each has a current-scope reply explaining why its former snapshot/journal premise was removed

Related: #30, #40, #41, #44, #60.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9dbe863c65

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 652b71c96e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[schickling-assistant]

Refreshed onto current main (b868a07). Two things changed beyond a plain rebase, both flagged here rather than left to be discovered in a squash.

Requirement IDs moved to R29/R30. This branch was written on 2026-07-30 against a main that has since assigned R22 and R23 to unrelated requirements — R22 Quiet coordination after events and R23 Fail-closed task inventory. The two requirements here are now:

• R29 Visible, nondisruptive launch drift
• R30 Explicit replacement boundary

The DQ4 Relaunch boundary cross-reference in docs/vrs/spec.md moved with them, from (R22-R23) to (R29-R30). No pre-existing R22/R23 reference elsewhere in the file was touched.

They are numbered by appending rather than by filling the R12 and R18 gaps, so existing references stay unambiguous.

The branch is now one commit. It was six, and the intermediate commits proposed a contract this branch's own tip no longer holds — b9b6a8f reduced it to the no-CAS shape, and the earlier commits still carried the durable one-shot operation and captured launch contract that reduction removed. Replaying them onto current main would have meant resolving conflicts in states the branch had already abandoned. Since the repo squash-merges, the landed result is identical; the history is just no longer archaeological.

The content is unchanged from the reduced contract at 0e7e317: 94 insertions, 0 deletions, in docs/vrs/requirements.md and docs/vrs/spec.md only. Nothing main established was modified or removed.

Posted on behalf of @schickling

field	value
agent_name	unknown
agent_tool	Claude Code
agent_tool_version	2.1.220
agent_runtime	Claude Code 2.1.220
agent_session_lookup	unavailable
tooling_profile	dotfiles@unknown-dirty