Omar SobhandClaude Opus 5
6e8785f159
Mission 01a00538 ("ClawHDF5 REsearch and Refactor") failed 19 minutes and 93,762
tokens into its research phase with `pair failed: 403 Forbidden`, and its coding
phase was then correctly skipped as unreachable. The cause was not the coding
phase and not the model — it was pairing.
A per-mission runtime is authenticated with a SINGLE-USE pairing code, and the
bearer token it returns was cached in memory only. Any restart of the server
discarded that token; the next turn re-paired with a code the gateway had
already spent and got 403 — permanently, for that mission. A deploy, a crash or
an OOM would each do it. The durable-run machinery exists precisely so work
survives a restart; pairing was the one thread that did not, and it failed
closed.
`missions.runtime_token` persists the token at the moment pairing succeeds, and
the worker seeds the executor's cache from it, so a new process reuses the
credential instead of re-pairing. Persisting is best-effort: failing to save
must not fail a turn that just paired successfully.
Verified by reproducing the original failure: launched a mission, confirmed the
token was written, restarted the server MID-PHASE, and watched the mission run
to completion with no pairing failure.
Co-Authored-By: Claude Opus 5 <[email protected]>
23 lines
1.2 KiB
SQL
23 lines
1.2 KiB
SQL
-- Persist the per-mission runtime's bearer token.
|
|
--
|
|
-- The pairing code in `runtime_pairing_code` is SINGLE USE: once the gateway is
|
|
-- paired it reports "already paired" and mints no new code. The token that pair
|
|
-- returns was cached in memory only (`ZeroClawDriveExecutor::token`), so any
|
|
-- restart of the server discarded it — and the next turn re-paired with a code
|
|
-- that had already been spent and got 403 Forbidden, permanently, for that
|
|
-- mission.
|
|
--
|
|
-- Mission 01a00538 ("ClawHDF5 REsearch and Refactor") died exactly that way: 19
|
|
-- minutes and 93,762 tokens into its research phase, killed by a server restart
|
|
-- it should have survived, and its coding phase was then correctly skipped as
|
|
-- unreachable. The durable-run machinery exists so work survives a restart;
|
|
-- pairing was the one thread that did not.
|
|
--
|
|
-- Nullable: a mission that has not paired yet has no token, and the pre-C3
|
|
-- missions never will.
|
|
ALTER TABLE missions
|
|
ADD COLUMN IF NOT EXISTS runtime_token TEXT;
|
|
|
|
COMMENT ON COLUMN missions.runtime_token IS
|
|
'Bearer token for this mission runtime gateway, persisted so a server restart reuses it instead of re-pairing with a spent single-use code.';
|