v1.2.0 — orchestrate: production hardening (substrate choice, cleanup, timeouts, verified delivery)

[choiyounggi]

Four changes asked for after a production-readiness review, built and verified by running orchestrate on the tmux substrate — which is also the path that needed the work, since it had a quarter of the Orca path's test coverage.

What changed

① Orca no longer wins by default. Phase 3 said Orca was "the default when Orca is present, not optional", so a detected Orca was delegated to without the user ever being told. Now a non-zero orca-detect.sh still goes to tmux silently, but exit 0 produces a choice the user must answer — Orca (native trust-screen handling, event-driven waits, native liveness) vs tmux (mid-flight steering via send-prompt.sh, no extra dependency) — folded into the Gate 1 turn so it costs no extra round trip. No default, no remembered choice, no environment override.

② Cleanup that finds what a dead run left behind. safe-cleanup.sh gains a run-scoped sweep, --dry-run on every destructive verb, and git worktree prune. The split is deliberate: read-only list-orphans is unscoped (it can see another run's leftovers), destructive sweep is scoped to LO_RUN_ID and REFUSEs without one — a sweep that can remove more than the old code had to be harder to trigger, not easier. Unregistered .worktrees/ directories are reported, never deleted (they may hold uncommitted work).

③ Timeouts, and the third worker state. watch-status.sh gains per-phase deadlines. New tmux-worker-stalled.sh gives the tmux path the ALIVE-but-stuck answer the Orca path already had (0 progressing / 1 stalled / 2 unknown; unknown is never treated as stalled). The signal was chosen by measurement — #{window_activity} was rejected because it is byte-driven and fooled by TUI repaint, the same trap lastOutputAt set on the Orca side, and the rejected candidate is pinned in a test.

④ Prompt delivery you can branch on. New send-prompt.sh — send (delivered / queued / session-gone as distinct outcomes), wait (bounded wait for pickup), state (read-only, one token). launch-session.sh now confirms the prompt was actually submitted: exit 0 means "launched and submission confirmed", and the new exit 5 means "sent but could not confirm", distinct from exit 4 "the REPL never came up".

Plus worker-guardrails.sh emits rules.worktree_escape.allowPaths: [".orchestration"], the dev-loop half of choiyounggi/groundwork#2.

The field evidence this was built from

Every item above came from running the skill, not from reading it:

Observed	Became
launch-session.sh printed ok: prompt injected while the prompt sat unsubmitted as [Pasted text #1 +1 lines] for 45 minutes — one extra Enter ran it; two sibling workers launched seconds earlier were fine	④ submission confirmation + exit 5
Three worktree_escape escalations, each aborting the whole watch (exit 5) for a legitimate status/plan write	allowPaths emission
A lo-test tmux session orphaned for over a day, invisible to kill-sessions	② sweep / list-orphans
Orca detected, user wanted tmux, coordinator had to override the skill by hand	①

The submission failure is intermittent and its cause is not proven — length (500–2000 chars) and Enter-delay (0 / 0.2 / 1s) were both tested in a plain shell and did not reproduce it. The fix is designed against the symptom, and the not-proven part is recorded as such rather than asserted.

Verification

• npx bats tests/ — 307/307, was 183. Every exit code measured on its own, never through a pipe.
• tmux-path coverage 32 → ~150, closing most of the asymmetry with the Orca path (116).
• All 15 orchestrate scripts pass sh -n; new tests invoke them with sh, not bash, so the #!/bin/sh shebang is actually exercised.
• Each worktree's suite verified independently by the coordinator (209 / 230 / 231 / 307) rather than taken from the worker's report; test-quality-auditor cross-called on the largest test file → PASS, with four negative controls proving the assertions can fail.
• No existing test deleted or weakened; Gate 1, Gate 2, the no-push rule and the bundled-agent restriction all verified present.
• guardrails self-test.sh still 10/10 with the new worker sandbox config.

.worktrees/ is now gitignored — this skill creates its worker worktrees there, so a plain git add -A in the main checkout commits them as gitlinks (which happened once while preparing this branch and was reverted).

Tag v1.2.0 after merge.

🤖 Generated with Claude Code