feat(runs): graduate journal authority

[solomonneas]

Summary

• Make lifecycle journal authority the default for every new run.
• Remove BRIGADE_RUN_JOURNAL_AUTHORITY from the runtime path.
• Keep existing run directories without durable enrollment fields on the
  snapshot-only path.
• Document the brigade.run.v1 reader window, recovery path, and rollback
  boundary.

Migration and reader notes

New runs persist both lifecycle_journal_requested: true and
run_journal_authority_requested: true. Existing runs are classified only from
their stored artifacts. Brigade does not add enrollment fields or create a
journal for an existing snapshot-only run.

run.json remains a schema-version-1 compatibility snapshot with additive
fields. Previous readers can inspect it by ignoring unknown keys. Approval
pauses project the known nonterminal status running. Previous writers must not
resume, recover, or update a journal-authoritative run. Roll forward before
writing one of those run directories.

Verification

• Affected suite: 20260731-035716-work-verify-0425a2 (446 passed).
• Previous-reader compatibility pin:
  20260731-022543-work-verify-a46d80.
• Converted direct-run helper suites:
  20260731-022913-work-verify-725bfb.
• Closeout table reference audit: 20260731-041740-work-verify-dc28e1
  (49 cited test names found).
• Runtime dependency source contract:
  20260731-023317-work-verify-b04a90.
• Approval crash reconciliation RED:
  20260731-031308-work-verify-390e9c.
• Approval completion-receipt focused checks:
  20260731-031443-work-verify-4487de,
  20260731-031538-work-verify-95fa0c.
• Approval source-lock interleaving RED/GREEN:
  20260731-033919-work-verify-926a8a,
  20260731-034226-work-verify-86c71b.
• Approval reconciliation and surrounding regressions:
  20260731-034332-work-verify-f74938 (123 passed).
• No-network-service source contract:
  20260731-034936-work-verify-917f8d.
• Direct-run fixture remediation:
  20260731-040734-work-verify-f07456 (2 passed),
  20260731-040744-work-verify-27163b (54 passed).
• Full ./scripts/verify: 20260731-040757-work-verify-815c12
  (5,531 passed, 3 skipped, 82.99% coverage).

Issue #568 closeout

The external grader must sign off on this table before issue #568 closes.

#	Acceptance criterion	Test or receipt
1	Golden replay is byte-identical on repeated runs.	tests/test_run_projector.py::test_golden_replay_matches_expected_bytes, tests/test_run_projector.py::test_repeated_projection_is_byte_deterministic
2	Every current run.json field is mapped or derived.	tests/test_run_projector.py::test_full_field_fixture_preserves_deep_equality_and_copies_nested_values, tests/test_run_projector.py::test_unknown_base_key_raises_bounded_unknown_snapshot_field_error
3	Same idempotency key and digest replays without an append.	tests/test_run_journal.py::test_idempotent_replay_returns_existing_event_without_second_append
4	Same idempotency key with a different digest conflicts.	tests/test_run_journal.py::test_same_idempotency_key_different_digest_raises_without_mutation
5	Crash windows cover before append, during append, after journal sync, and before snapshot replacement.	tests/test_run_lifecycle.py::test_checkpoint_failure_leaves_journal_and_run_json_unchanged, tests/test_run_journal.py::test_append_event_rejects_partial_os_write, tests/test_run_lifecycle.py::test_retry_after_interruption_reuses_committed_event, real subprocess SIGKILL: tests/test_run_checkpoint.py::test_write_text_atomic_sigkill_during_temp_window_preserves_one_valid_payload
6	Recovery preserves and reports a partial tail before truncation.	tests/test_run_journal.py::test_recover_partial_tail_quarantines_suffix_then_truncates, tests/test_runs_cmd.py::test_runs_recover_quarantines_partial_journal_tail_then_verifies
7	Missing or corrupt run.json rebuilds to the same observable state.	tests/test_runs_cmd.py::test_runs_recover_restores_missing_run_json_from_latest_checkpoint, tests/test_runs_cmd.py::test_runs_recover_preserves_corrupt_run_json_and_restores_from_checkpoint
8	Gaps, digest errors, unknown schemas or types, and stale projections are bounded.	tests/test_run_journal.py::test_read_journal_detects_sequence_gap_without_mutation, tests/test_run_journal.py::test_read_journal_detects_previous_digest_mismatch_without_mutation, tests/test_run_events.py::test_validate_event_rejects_unknown_schema_version, tests/test_run_events.py::test_validate_event_rejects_unknown_event_type, tests/test_run_shadow.py::test_stale_projector_version_gate_returns_only_stale_reason
9	watch, show, steer, interrupt, recover, and resume remain compatible.	tests/test_runs_cmd.py::test_runs_watch_surfaces_stale_lock_recovery_and_returns_nonzero, tests/test_runs_cmd.py::test_runs_show_prints_summary, tests/test_run_control.py::test_run_records_control_socket_and_cli_steers_live_worker, tests/test_run_control.py::test_cli_interrupt_leaves_live_worker_resumable, tests/test_runs_cmd.py::test_runs_recover_accepts_covered_paired_status_event_and_preserves_fields, tests/test_run_resume.py::test_resume_reattaches_and_resynthesizes
10	A legacy run without lifecycle.jsonl still loads.	tests/test_run_lifecycle.py::test_legacy_run_dir_stays_snapshot_only_with_flag_on, tests/test_runs_cmd.py::test_runs_recover_no_journal_legacy_dead_owner_marks_terminal
11	A new run exposes run.json to the previous release.	tests/test_aboyeur.py::test_default_authority_run_json_remains_readable_by_previous_v1_reader, receipt 20260731-022543-work-verify-a46d80
12	A requested action without terminal observation is recovery work, never exactly-once.	tests/test_runs_cmd.py::test_runs_recover_prints_pending_dispatch_only_after_validated_recovery, tests/test_doctor.py::test_doctor_validates_checkpoint_before_reporting_pending_dispatch
13	A paused run releases its lock and resumes once after process exit.	tests/test_run_lifecycle.py::test_record_approval_pause_commits_events_snapshot_and_releases_lock, tests/test_daily_driver_cmd.py::test_daily_approval_pauses_real_run_and_cli_resume_consumes_store_once
14	Rejected, held, stale, and previously consumed approvals cannot resume.	tests/test_runs_cmd.py::test_resume_paused_records_terminal_daily_decision_without_consuming, tests/test_runs_cmd.py::test_rejected_marker_stays_approval_aware_and_never_reaches_provider, tests/test_runs_cmd.py::test_resume_paused_refuses_stale_daily_reference_before_consuming, tests/test_runs_cmd.py::test_resume_paused_daily_legacy_consumed_store_fails_closed, tests/test_runs_cmd.py::test_redeemed_retry_refuses_changed_source_decision, tests/test_runs_cmd.py::test_redeemed_retry_revalidates_current_blockers, tests/test_runs_cmd.py::test_redeemed_retry_refuses_claim_for_another_run, tests/test_runs_cmd.py::test_redeemed_reconciliation_holds_source_lock_through_journal_commit
15	A crash after consumption reconciles missing journal facts without another consumption or action.	tests/test_work_cmd_services.py::test_tools_redeemed_action_crash_reconciles_without_second_execution, tests/test_daily_driver_cmd.py::test_daily_approval_pauses_real_run_and_cli_resume_consumes_store_once, tests/test_runs_cmd.py::test_redeemed_daily_retry_requires_completed_action_receipt, tests/test_runs_cmd.py::test_redeemed_daily_retry_refuses_tampered_action_receipt, tests/test_runs_cmd.py::test_redeemed_reconciliation_holds_source_lock_through_journal_commit, RED receipts 20260731-031308-work-verify-390e9c and 20260731-033919-work-verify-926a8a, GREEN receipts 20260731-031443-work-verify-4487de, 20260731-031538-work-verify-95fa0c, 20260731-031504-work-verify-560b9c, and 20260731-034226-work-verify-86c71b
16	Approval pause uses a status known to the migration reader set.	tests/test_runs_cmd.py::test_approval_wait_uses_previous_reader_nonterminal_status, tests/test_runs_cmd.py::test_previous_resume_reader_refuses_new_approval_wait_before_provider
17	Allowlists reject unknown fields and private-data exclusions regressions pass.	tests/test_run_events.py::test_validate_event_rejects_unknown_payload_key_with_bounded_diagnostic, tests/test_run_events.py::test_validate_event_rejects_private_data_payload_keys
18	Size and latency were measured across 1,000 runs before flag removal.	Production receipt 20260730-102257-work-verify-89936b, MiseLedger item 42fa84331436564d51d01075, artifact SHA-256 d18ef7f2fd042332b281810d4fd122c8888a877e5f0eef45f73b5ed104874f50: 1,000 runs, 2,000 append samples, p50 5,332,407 ns, p95 8,031,038 ns, p99 11,976,013 ns, max 32,024,437 ns
19	No daemon, network service, or runtime dependency was introduced.	Receipt 20260731-023317-work-verify-b04a90 proves pyproject.toml is unchanged from pre-journal commit 1b143bf79b7653999d2f3895338a812978718ea0, changed-runtime source audit receipt 20260731-034936-work-verify-917f8d covers aboyeur.py, runs_cmd.py, the Daily run loop, both approval stores, direct run callers, and journal modules, and final ./scripts/verify receipt 20260731-040757-work-verify-815c12 completed with 5,531 passed, 3 skipped, and 82.99% coverage

Refs #568.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e5de5ff-9648-4c5b-b36c-753a20be06c9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}