feat(runs): durable cursors and idempotent live control (#604)

[solomonneas]

Summary

• Adds lifecycle-only brigade runs events with opaque durable cursors (--after, --follow, NDJSON).
• Registers status-neutral control.requested / control.observed / control.failed event types (reference fields and digests only; no steering text).
• Makes app-server runs steer / runs interrupt idempotent via --request-id, with replay, conflict, and indeterminate semantics on the journal.

Closes #604.

Verify

brigade work verify run --target . --command "./scripts/verify" --capture brigade-work

Receipt ID: 20260801-032545-work-verify-0782e0

Acceptance criteria → tests

#604 criterion	Test
Stop follow, restart with last cursor, later events once in order	test_events_follow_restart_with_cursor_emits_each_later_event_once
Completed run + same cursor → same suffix	test_events_completed_run_same_cursor_produces_same_suffix
Wrong run / unknown sequence / digest mismatch / unsupported schema fails closed	test_events_cursor_failures_emit_no_unverified_suffix
Same request id + fingerprint → no second transport call	test_idempotent_request_id_replays_without_second_transport_call
Same request id + changed worker/text/op/turn → conflict	test_request_id_fingerprint_conflict
Crash before requested / after sync / after transport / after terminal	test_control_crash_points
Requested without terminal → indeterminate, not reissued	test_indeterminate_control_request_is_not_reissued
No steering text / private payloads in lifecycle events	test_control_payload_never_contains_steering_text, test_control_requested_rejects_*
Unknown event types/fields fail closed (#568 registry)	test_control_event_types_registered_with_closed_payload_keys, test_control_requested_rejects_unknown_payload_key_with_bounded_diagnostic
runs watch, control without --request-id, legacy artifacts compatible	existing tests/test_run_control.py + test_cli_explicit_request_id_on_legacy_run_fails / test_events_legacy_run_reports_legacy_no_journal
No daemon / broker / runtime dependency	stdlib-only modules run_event_cursor.py, run_control_journal.py

Notes for reviewers

• Cursor codec salvaged from abandoned codex/issue-604-* worktrees; run_id tightened to the journal alphabet.
• Control appends use append_event under checkpoint_event_pair and sync shadow afterward so authoritative runs do not trip journal-ahead-of-evidence.
• Golden lifecycle fixtures are unchanged.

Test plan

• ./scripts/verify via Brigade (receipt above)
• External grader review before merge

Made with Cursor

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c6a5909f-0da0-4ea6-a365-646e5280e7ce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[solomonneas]

Post-merge grading review found one Critical and two Major defects in the control-journaling half of this PR - the cursor codec and runs events reader are sound and unaffected. Until #651 lands, treat live 'runs steer'/'interrupt' against journal-backed runs as unsafe: the control CLI is a second OS process appending to the lifecycle journal under a process-local lock, and a collision with the run owner forks the hash chain with no recovery path (details, file:line evidence, and the fix contract are in #651). If the cross-process lock cannot land promptly, revert the control-journaling half and keep the reader.