# Open Questions and Evidence Limits

## Q1 — Full historical ChatGPT incident corpus remains unavailable

The available ChatGPT personal-context/conversation search returned only a small set of summarized prior facts/constraints, not a systematic original-message archive with stable incident source identifiers. Lane E therefore did **not** use those summaries to inflate incident counts.

Direct `~/.claude` and `~/.codex` workstation histories supplied substantial original-message coverage, but this is still a source limitation relative to the assignment's request for all available historical ChatGPT reports.

**Disposition:** `NEEDS FURTHER EVIDENCE` if a future connector exposes original conversation records systematically.

## Q2 — Should nested worktrees inside an already-isolated AWP Workspace be supported or forbidden?

OD-005 proves that “tell the agent to create a worktree” plus “exclude `.worktrees` from collection” is a silent-loss trap. AWP's target model already makes the Workspace itself isolated, so nested worktrees may be unnecessary.

Two safe designs exist:

1. prohibit/guard creation of nested worktrees/repositories outside the declared collection contract; or
2. support them explicitly and make collector inventory/transport recursive enough to preserve them.

Either way RT-001 must fail closed on undiscovered/excluded recoverable Git state. The product/implementation choice can remain provider-specific if the invariant is universal.

**Affected lane:** C.

## Q3 — What is the exact durable Workspace collection manifest in I1?

Current target specs require exact checkpoint/candidate provenance but the implementation branch used for this harvest still has provider skeletons only. Lane C needs an executable answer for what is enumerated before cleanup: primary repo HEAD/tree, dirty/index state, untracked paths, nested Git repositories/worktrees, checkpoint digest, and collection receipt.

**Affected lanes:** C + A.

## Q4 — What exact DBOS/application lease fields will fence stale execution generations?

The corpus strongly supports generation/lease/CAS behavior, but Lane E should not invent the final schema. The implementation needs a stable way to prove RT-010/RT-011: logical lease identity, generation/attempt, owner, expiry/heartbeat semantics where used, and stale callback rejection.

**Affected lanes:** A + C.

## Q5 — Where exactly is mutable credential authority implemented for each initial provider?

The domain spec correctly requires one mutable authority, but provider integration must make the seam concrete for Subrouter/native provider credentials and any imported local credentials. A “SecretStore” reference alone does not prove refresh ownership.

Required evidence before I1 provider use: component that may refresh, components that may only read/project, migration/fencing rule, and dual-writer test RT-008/RT-009.

**Affected lane:** B.

## Q6 — How is runner/workspace execution-profile attestation represented?

Historical failures repeatedly came from reachable hosts whose runtime link, version, image, manifest or wrapper was stale. AWP already has `MachineCapability`/`PlacementDecision` concepts, but the implementation should decide which exact immutable/versioned fields form the I1 profile receipt.

This must be enough to prove RT-013/RT-014 and to explain *why* a host is ineligible without making the whole fleet unavailable.

**Affected lane:** C.

## Q7 — What are the default stall/deadline policies for I1 durable stages?

The evidence supports “no silent indefinite wait”, but not one universal timeout. GitHub publication, AgentProvider dispatch, model execution, K8s provisioning and human approval have different valid windows.

The invariant should remain stage + last-progress + explicit deadline/lease/policy rather than copy historical 20-minute/2h35m values into AWP.

**Affected lanes:** A + B + C + D.

## Q8 — Which destructive candidate anomalies are policy blockers versus attention signals?

OD-028 shows that 3,840 unexpected deletions must not slip through because logs were truncated. The universal invariant is structured full-tree validation. A numeric “large deletion” threshold is project policy, not a universal AWP constant.

Need owner/project policy design later for destructive path classes, protected paths, generated-tree exceptions and large change thresholds.

**Affected lanes:** A + B; later Policy UI D.

## Q9 — How far should semantic Incident correlation go beyond exact delivery/idempotency identity?

OD-018 proves exact string dedup is insufficient, while OD-019 proves repeated identical observations can create storms. Exact provider delivery/operation IDs should be deterministic. Similarity-based correlation is useful but risks merging distinct failures.

Recommendation for I0/I1: implement exact idempotency/delivery identity now; keep semantic incident clustering advisory/versioned until Incident automation activates.

**Affected lane:** A later I8.

## Q10 — What is the canonical recovery behavior when historical provider evidence is malformed/torn?

OD-023 had a concrete local journal tail problem. AWP's Postgres event/outbox is stronger, but provider adapters can still ingest malformed or partial observations. The target needs typed “malformed provider evidence” handling that preserves last good authoritative state and does not invent sequence/progress.

**Affected lanes:** A + B/C.

## Q11 — Which I1 read model owns operator “last activity / blocker / next action” completeness?

OD-015/OD-029 show this information is needed to prevent duplicate asks and abandonment mistakes. `Work`, Queue and Agent/Factory projections already contain pieces. Lane A/D should agree on one composable read model rather than duplicate writable status.

**Affected lanes:** A + D.

## Q12 — Can all priority failure-injection tests run in existing lane environments before dogfood?

The branch base used for this harvest contains only provider README skeletons for Lane B/C, so no executable proof exists here yet. Parallel implementation branches may be ahead. Before C1/I1 convergence, ownership should be reconciled so the 13 priority tests are either implemented or explicitly blocked with exact infrastructure reason.

**Affected lanes:** A/B/C/D.

## Contradictions resolved by evidence

- **“A dead PID means a lock/resource is safe to reclaim.”** False; inherited descriptors and replaced identities disproved it (OD-003).
- **“Agent committed successfully, so the controller has the work.”** False; transport exclusions disproved it (OD-005).
- **“Timeout/failure response means provider mutation did not happen.”** False; landing succeeded despite failure verdict (OD-006).
- **“A read-only health/usage component can harmlessly refresh credentials.”** False for one-time grant semantics (OD-007).
- **“Reachable node means usable runner.”** False; runtime/image/tool drift repeatedly blocked execution (OD-012).
- **“If the UI has no detail, the detail probably does not exist.”** False; persisted/API evidence was dropped by projections (OD-025).
- **“Process exit or empty diff tells us whether Task intent succeeded.”** False; already-satisfied and missing-output states were conflated (OD-027).

## No evidence-based need to change these AWP choices

The corpus did **not** produce evidence that AWP should abandon its current target choices of PostgreSQL authority, DBOS durable workflows, isolated Kubernetes Workspaces, trusted publication separation, immutable Attempt provenance, explicit Connection/CredentialReference, or revision-aware realtime projections. The incidents mostly reinforce those choices and demand stronger executable tests around them.