Critical architecture fixes: data integrity, process lifecycle, guardrails

Phase A — Data integrity:
- WriteBack GraphQL endpoint: pass graphqlEndpoint explicitly instead of
  constructing wb.baseURL + "/graphql". Prevents double-append for GHES.
  TrimSuffix on apiURL prevents trailing-slash endpoint bugs.
- Pass 2 failure marks items as Pass2Failed. Eligibility checker rejects
  items with incomplete dependency data — prevents dispatching blocked
  items when Pass 2 GraphQL fails (was silently dropping all blockers).
- Pass2Failed propagated through: WorkItemRaw → NormalizedItem → WorkItem
  → IsEligible rejection.

Phase B — Process lifecycle:
- Claude CLI adapter: restructured Prompt() to use cmd.Start() + pipe
  reading + cmd.Wait() instead of cmd.Output(). Process tracked in c.proc
  AFTER Start(), so Cancel() can actually kill it during execution.
- Workspace FetchOrigin: run git fetch on continuation retries to ensure
  fresh base refs before commit detection and push.
- Template safety: dereference *int to int in workItemToMap to prevent
  <nil> rendering in gh CLI commands.

Phase C — Guardrails:
- Continuation retry backoff: increase delay from fixed 1s to exponential
  (5s → 10s → 20s → 30s cap). Prevents rapid-fire re-invocations that
  caused 755 sessions in one day.
- Max continuation retries (10) still enforced as hard limit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: shivamstaq

cmd/symphony/main.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"strings"
 	"syscall"
 	"time"
 
@@ -133,17 +134,14 @@ func main() {
 		os.Exit(1)
 	}
 
-	apiURL := cfg.GitHub.APIURL
+	apiURL := strings.TrimSuffix(cfg.GitHub.APIURL, "/")
 	if apiURL == "" {
 		apiURL = "https://api.github.com"
 	}
-	graphqlEndpoint := apiURL
-	if apiURL == "https://api.github.com" {
-		graphqlEndpoint = "https://api.github.com/graphql"
-	}
+	graphqlEndpoint := apiURL + "/graphql"
 
 	gqlClient := ghub.NewGraphQLClient(graphqlEndpoint, token)
-	writeBack := ghub.NewWriteBack(apiURL, token)
+	writeBack := ghub.NewWriteBack(apiURL, graphqlEndpoint, token)
 
 	// Fetch project field metadata for status updates (best-effort)
 	var projectMeta *ghub.ProjectFieldMeta

internal/adapter/claude_cli.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"log/slog"
 	"os"
 	"os/exec"
@@ -111,39 +112,56 @@ func (c *ClaudeCLI) Prompt(ctx context.Context, sessionID string, text string) (
 	cmd.Stdin = strings.NewReader(text)
 	cmd.Env = os.Environ()
 
+	// Capture stdout via pipe so we can track the process for cancellation
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return &PromptResult{StopReason: StopFailed, Summary: fmt.Sprintf("stdout pipe: %v", err)}, nil
+	}
+
 	slog.Info("claude CLI executing",
 		"session_id", sessionID,
 		"model", c.model,
 		"perm_mode", c.permMode,
 		"prompt_len", len(text),
 	)
 
-	// Track the process for cancellation
+	if err := cmd.Start(); err != nil {
+		return &PromptResult{StopReason: StopFailed, Summary: fmt.Sprintf("start: %v", err)}, nil
+	}
+
+	// Track the process for cancellation AFTER start
 	c.mu.Lock()
-	c.proc = nil
+	c.proc = cmd.Process
 	c.mu.Unlock()
 
-	// Capture stdout and stderr
-	output, err := cmd.Output()
+	// Read all output
+	output, readErr := io.ReadAll(stdout)
+
+	// Wait for process to finish
+	waitErr := cmd.Wait()
 
 	c.mu.Lock()
 	c.proc = nil
 	c.mu.Unlock()
 
-	if err != nil {
-		// Get stderr from the ExitError
+	if readErr != nil {
+		slog.Error("claude CLI read failed", "session_id", sessionID, "error", readErr)
+		return &PromptResult{StopReason: StopFailed, Summary: fmt.Sprintf("read: %v", readErr)}, nil
+	}
+
+	if waitErr != nil {
 		var stderr string
-		if exitErr, ok := err.(*exec.ExitError); ok {
+		if exitErr, ok := waitErr.(*exec.ExitError); ok {
 			stderr = string(exitErr.Stderr)
 		}
 		slog.Error("claude CLI failed",
 			"session_id", sessionID,
-			"error", err,
+			"error", waitErr,
 			"stderr", stderr,
 		)
 		return &PromptResult{
 			StopReason: StopFailed,
-			Summary:    fmt.Sprintf("claude CLI error: %v\n%s", err, stderr),
+			Summary:    fmt.Sprintf("claude CLI error: %v\n%s", waitErr, stderr),
 		}, nil
 	}
 

internal/github/graphql.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"strings"
 )
@@ -315,7 +316,9 @@ func (c *GraphQLClient) FetchIssueDetails(ctx context.Context, items []WorkItemR
 
 		data, err := c.doGraphQL(ctx, query, map[string]any{"id": item.IssueID})
 		if err != nil {
-			// Non-fatal: continue with partial data
+			// Mark item as having incomplete data — eligibility checker will skip it
+			items[i].Pass2Failed = true
+			slog.Warn("pass 2 fetch failed for item", "issue_id", item.IssueID, "error", err)
 			continue
 		}
 

internal/github/models.go

@@ -23,6 +23,7 @@ type WorkItemRaw struct {
 	URL           string
 	CreatedAt     string
 	UpdatedAt     string
+	Pass2Failed   bool // true if Pass 2 enrichment failed — dependency data may be incomplete
 }
 
 // BlockerRefRaw is a dependency/blocker reference from GitHub.

internal/github/source.go

@@ -95,6 +95,7 @@ func NormalizeWorkItem(raw WorkItemRaw, priorityMap map[string]int) NormalizedIt
 		URL:           raw.URL,
 		CreatedAt:     raw.CreatedAt,
 		UpdatedAt:     raw.UpdatedAt,
+		Pass2Failed:   raw.Pass2Failed,
 	}
 
 	// Derive work_item_id
@@ -172,6 +173,7 @@ type NormalizedItem struct {
 	URL             string
 	CreatedAt       string
 	UpdatedAt       string
+	Pass2Failed     bool
 	Repository      *NormalizedRepo
 	BlockedBy       []NormalizedBlocker
 	SubIssues       []NormalizedChild

internal/github/writeback.go

@@ -7,21 +7,25 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"strings"
 )
 
 // WriteBack handles deterministic GitHub write-back operations.
 type WriteBack struct {
-	baseURL string
-	token   string
-	client  *http.Client
+	baseURL         string // REST API base (e.g., https://api.github.com)
+	graphqlEndpoint string // GraphQL endpoint (e.g., https://api.github.com/graphql)
+	token           string
+	client          *http.Client
 }
 
 // NewWriteBack creates a new write-back client.
-func NewWriteBack(baseURL, token string) *WriteBack {
+// graphqlEndpoint should be the full GraphQL URL (not derived from baseURL).
+func NewWriteBack(baseURL, graphqlEndpoint, token string) *WriteBack {
 	return &WriteBack{
-		baseURL: baseURL,
-		token:   token,
-		client:  &http.Client{},
+		baseURL:         strings.TrimSuffix(baseURL, "/"),
+		graphqlEndpoint: graphqlEndpoint,
+		token:           token,
+		client:          &http.Client{},
 	}
 }
 
@@ -252,8 +256,7 @@ func (wb *WriteBack) graphqlPost(ctx context.Context, query string, variables ma
 		return nil, err
 	}
 
-	// GraphQL endpoint is baseURL + /graphql (or baseURL itself if it's the graphql endpoint)
-	endpoint := wb.baseURL + "/graphql"
+	endpoint := wb.graphqlEndpoint
 	req, err := http.NewRequestWithContext(ctx, "POST", endpoint, bytes.NewReader(jsonBody))
 	if err != nil {
 		return nil, err

internal/github/writeback_reuse_test.go

@@ -50,7 +50,7 @@ func TestWriteBack_ReusesExistingPR(t *testing.T) {
 	}))
 	defer server.Close()
 
-	wb := ghub.NewWriteBack(server.URL, "ghp_test")
+	wb := ghub.NewWriteBack(server.URL, server.URL+"/graphql", "ghp_test")
 	result, err := wb.UpsertPR(context.Background(), ghub.PRParams{
 		Owner:      "org",
 		Repo:       "repo",
@@ -107,7 +107,7 @@ func TestWriteBack_CreatesNewPRWhenNoneExists(t *testing.T) {
 	}))
 	defer server.Close()
 
-	wb := ghub.NewWriteBack(server.URL, "ghp_test")
+	wb := ghub.NewWriteBack(server.URL, server.URL+"/graphql", "ghp_test")
 	result, err := wb.UpsertPR(context.Background(), ghub.PRParams{
 		Owner: "org", Repo: "repo", Title: "New PR",
 		HeadBranch: "symphony/org_repo_1", BaseBranch: "main", Draft: true,

internal/github/writeback_test.go

@@ -35,7 +35,7 @@ func TestWriteBack_CreatePR(t *testing.T) {
 	}))
 	defer server.Close()
 
-	wb := ghub.NewWriteBack(server.URL, "ghp_test")
+	wb := ghub.NewWriteBack(server.URL, server.URL+"/graphql", "ghp_test")
 
 	result, err := wb.UpsertPR(context.Background(), ghub.PRParams{
 		Owner:      "org",
@@ -75,7 +75,7 @@ func TestWriteBack_CommentOnIssue(t *testing.T) {
 	}))
 	defer server.Close()
 
-	wb := ghub.NewWriteBack(server.URL, "ghp_test")
+	wb := ghub.NewWriteBack(server.URL, server.URL+"/graphql", "ghp_test")
 
 	url, err := wb.CommentOnIssue(context.Background(), "org", "repo", 42, "PR created: https://github.com/org/repo/pull/99")
 	if err != nil {

internal/orchestrator/convert.go

@@ -22,6 +22,7 @@ func ConvertNormalizedItem(n ghub.NormalizedItem) WorkItem {
 		URL:             n.URL,
 		CreatedAt:       n.CreatedAt,
 		UpdatedAt:       n.UpdatedAt,
+		Pass2Failed:     n.Pass2Failed,
 	}
 
 	if n.Repository != nil {

internal/orchestrator/eligibility.go

@@ -31,6 +31,11 @@ func IsEligible(item WorkItem, cfg EligibilityConfig, state *State, maxConcurren
 		return false, "missing title"
 	}
 
+	// Reject items with incomplete dependency data (Pass 2 failed)
+	if item.Pass2Failed {
+		return false, "incomplete data (dependency fetch failed) — will retry next poll"
+	}
+
 	// Content type must be executable
 	if !containsCI(cfg.ExecutableItemTypes, item.ContentType) {
 		return false, "content_type not executable: " + item.ContentType