[6] Recover accepted work links after restart

[tautvydasLiekis]

When you continue a saved plan, its planning requests now join the implementation work even if the evidence was missing at that moment or Kimchi restarted. Before this, those planning costs could stay unassigned and drop out of the PR total.

Linked issue

Depends on #1350. No public issue is linked.

What does this PR do?

Kimchi saves each accepted continuation with a hash of the accepted plan bytes, the account, repository and accepting input, and the producing request when it is known. It retries the link at startup and during background reconciliation, and links only when:

• the plan matches the accepted version, or a native artifact matches its saved edit;
• the original producer, input, account and repository agree;
• you have not already corrected or revoked that link (your choice wins).

Missing or competing evidence stays unresolved. Only the planning input is confirmed; other inputs stay separate.

flowchart TD
    A[Saved continuation] --> B{History readable and valid?}
    B -->|No| W[Wait for repaired evidence]
    B -->|Yes| C{Accepted version and one scoped producer?}
    C -->|No| W
    C -->|Yes| D{User correction already exists?}
    D -->|Yes| K[Keep the correction]
    D -->|No| L[Confirm the planning input]

Loading

It also hardens the journal that recovery reads:

• A crash mid-write no longer blocks later records. The next append starts a new line, and readers skip the cut-off record, including journals written by released versions.
• Other damage still blocks confirmation, and the warning names the journal and its first damaged line. The continued work is still adopted and remembered for work matching.
• A record of an unknown type, for example from a newer Kimchi, blocks only the works and requests it names.
• When a background pass has examined every remaining receipt without confirming one, later passes skip reading history until a journal changes. Once no receipt can still be confirmed, later passes read only the journals changed since.

The choice is saved under continuations in ~/.config/kimchi/harness/work/<workId>/work.json; a successful link appears under workLinks. Recovery makes no model or authentication calls and keeps request IDs and prices.

Evidence

On 92822475b, after the final review fixes:

• CI: build, pr-checks, master-checks, TUI e2e in 4 shards, ACP e2e and MCP e2e pass on this head. A duplicate tui-e2e entry from a superseded workflow run shows as cancelled.
• The stack top 95614e7c6 (#1389) contains this PR. On it, pnpm check passes and the full unit suite passes except 5 tests that need tools this machine lacks: a DAP js-debug adapter, a built validate-skill.mjs and a binary rebuilt for the smoke test.
• New tests: an input naming an ADR owned from another worktree stays unresolved without reading every journal; a full pass over confirmed receipts reads each journal once and no retained plan; receipts that can never link drop out, so passes over more than 25 of them settle; a deleted plan keeps its owner.
• Lab on a binary built from 95614e7c6 (scripted model; local GitHub, billing and report fixtures): 73/73 default scenarios pass.
• On an earlier head, an idle background pass on a generated history with every plan already confirmed took about 90–140 ms for the first pass and 4 ms for later ones at 15,000 requests (38 MiB of journals); 340–380 ms, then 7–10 ms, at 60,000 requests (154 MiB).

Model replies are scripted.

Limits

• Plan choices saved by older versions without a content hash stay unresolved.
• While journals keep changing, each 30-second pass still reads every journal synchronously: about 90 ms at 15,000 requests and 340–380 ms at 60,000. Journals are never pruned, so heavy users will eventually need an incremental reader.
• A retained plan file restored by hand is checked only after the next journal write.
• No e2e test restarts Kimchi and waits for the background repair; unit and integration tests cover the repair and its scheduling.

Checklist

• I have read CONTRIBUTING.md and agree to the CLA
• This PR links to an open issue above
• Tests pass locally (pnpm run test)
• Lint passes (pnpm run check)
• Documentation updated if behavior changed

🤖 Generated with Claude Code

[kimchi-review]

Kimchi Code Review

Property	Value
Commit	73d174d
Author	@tautvydasLiekis
Files changed	14
Review status	Completed
Comments	0
Duration	21s

Summary

🚫 Merge request too large to review

📏 Size: 14 file(s) changed, +1029 / −60 lines

🧠 Cognitive load: 4/5 (1 = trivial, 5 = extremely demanding)

One feature but many interlocking invariants: content-hash identity of accepted bytes, producer pinning, and bounded background repair with lease, budget and rotation rules, all forbidden from overriding corrections. Large failure-mode/concurrency test additions dominate the diff and must be verified against those invariants.

✂️ Suggested split

1. Hash accepted plan bytes into continuation evidence — Captures content hashes at match time so later edits cannot rewrite accepted evidence.
   • src/extensions/work-attribution/continuation.ts
   • src/extensions/work-attribution/continuation.test.ts
2. Add budget-checked, validity-reporting ledger scans — Lets record readers bound scan time and surface malformed history rows.
   • src/extensions/work-attribution/summary.ts
   • src/extensions/work-attribution/summary.test.ts
3. Pin producers and build the continuation repair engine — Core link construction, producer pinning, and bounded repair over saved receipts.
   • src/extensions/work-attribution/links.ts
   • src/extensions/work-attribution/links.test.ts
4. Record continuation receipts when accepting saved work — Extension persists accepted evidence with scope and pins producers at input time.
   • src/extensions/work-attribution.ts
   • src/extensions/work-attribution.test.ts
   • src/extensions/work-attribution/continuation.integration.test.ts
5. Run continuation repair in the reconciliation supervisor — Schedules repair after PR and billing passes under the shared lease and budget.
   • src/extensions/work-attribution/reconcile-supervisor.ts
   • src/extensions/work-attribution/reconcile-supervisor.test.ts
6. Cover continuation recovery in e2e tests and docs — End-to-end receipt assertions and documentation of retention and repair behavior.
   • tests/e2e/acp/work-continuation.test.ts
   • tests/e2e/tui/work-attribution.test.ts
   • docs/work-attribution.md

👉 Please split this merge request into the smaller merge requests suggested above — the AI review will run automatically on each of them.

⚠️ Full review skipped — this merge request exceeds the reviewable size limit. See the split proposal above.

What to expect

Kimchi will analyze the changes in this pull request and post:

• A summary of the overall changes
• Inline comments on specific lines with findings categorized by issue type

The review typically completes within a few minutes. This comment will be updated once the review is ready.

Interact with Kimchi

• @getkimchi review — re-trigger a full review on the latest commit
• @getkimchi summary — regenerate the PR summary
• @getkimchi ignore — skip this PR (no review will be posted)
• Reply to any inline comment to ask follow-up questions or request clarification

Configuration

Reviews are configured by your organization admin.
Review instructions, excluded directories, and severity thresholds can be adjusted per repository in the Kimchi dashboard.

---

Powered by Kimchi — AI-powered code review by CAST AI

[kimchi-review]

🚫 Merge request too large to review

📏 Size: 14 file(s) changed, +1029 / −60 lines

🧠 Cognitive load: 4/5 (1 = trivial, 5 = extremely demanding)

One feature but many interlocking invariants: content-hash identity of accepted bytes, producer pinning, and bounded background repair with lease, budget and rotation rules, all forbidden from overriding corrections. Large failure-mode/concurrency test additions dominate the diff and must be verified against those invariants.

✂️ Suggested split

1. Hash accepted plan bytes into continuation evidence — Captures content hashes at match time so later edits cannot rewrite accepted evidence.
   • src/extensions/work-attribution/continuation.ts
   • src/extensions/work-attribution/continuation.test.ts
2. Add budget-checked, validity-reporting ledger scans — Lets record readers bound scan time and surface malformed history rows.
   • src/extensions/work-attribution/summary.ts
   • src/extensions/work-attribution/summary.test.ts
3. Pin producers and build the continuation repair engine — Core link construction, producer pinning, and bounded repair over saved receipts.
   • src/extensions/work-attribution/links.ts
   • src/extensions/work-attribution/links.test.ts
4. Record continuation receipts when accepting saved work — Extension persists accepted evidence with scope and pins producers at input time.
   • src/extensions/work-attribution.ts
   • src/extensions/work-attribution.test.ts
   • src/extensions/work-attribution/continuation.integration.test.ts
5. Run continuation repair in the reconciliation supervisor — Schedules repair after PR and billing passes under the shared lease and budget.
   • src/extensions/work-attribution/reconcile-supervisor.ts
   • src/extensions/work-attribution/reconcile-supervisor.test.ts
6. Cover continuation recovery in e2e tests and docs — End-to-end receipt assertions and documentation of retention and repair behavior.
   • tests/e2e/acp/work-continuation.test.ts
   • tests/e2e/tui/work-attribution.test.ts
   • docs/work-attribution.md

👉 Please split this merge request into the smaller merge requests suggested above — the AI review will run automatically on each of them.

⚠️ Full review skipped — this merge request exceeds the reviewable size limit. See the split proposal above.