Backend

Crash-safe task ledger with lease takeover

Tested in CILabPersonal labboundedcode-crash-resume· cited on the résumé

Claim

After the runner process is killed with SIGKILL mid-task, a second runner is refused while the lease is fresh, takes over once it is stale, marks the orphaned attempt rejected, keeps the killed attempt's edits, and completes the task from a resume pack rebuilt from the SQLite ledger.

Status

tested: An automated test in CI asserts the claimed behaviour, including a failure case where relevant, and passes at the verified commit.
lab: Local machine, local clusters or CI runners.
personal lab: My own public repositories.

Verified commit

repository: akynte/boundedcode
release: v0.1.0-alpha.3
commit: be1aa9f87ec5ea92567d29c48bf1982ce018c227
committed: 8 October 2026
CI: ci.yml #37773301609 success at be1aa9f

Curated source: paths, test names and the CI conclusion were checked against this commit by the evidence sync.

Implementation

Evidence

Testinternal/orchestrator/crash_test.go (GitHub, pinned to commit)
Asserted by TestSIGKILLResume
Testinternal/orchestrator/runner_test.go (GitHub, pinned to commit)
Asserted by TestRunFailEscalateCrashResumeAndComplete
Testinternal/contextplan/plan_test.go (GitHub, pinned to commit)
Asserted by TestResumePackRebuildsFromAuthoritativeSources
ADRADR-0002: Embedded SQLite for control-plane state (GitHub, pinned to commit)
CI runci.yml run 37773301609 (GitHub, pinned to commit)
success

Environment

ci runner: GitHub-hosted ubuntu
go: 1.27.1
state store: embedded SQLite

Limitations

Single machine and a single SQLite file; this is crash recovery, not distributed consensus.
The test shortens the stale-lease timeout to 50 ms and uses a scripted agent.

Multi-node coordination or replicated state: NOT CLAIMED.

Appears in

BoundedCode

Related claims

Tested in CILab

Task-branch isolation and git integrity checks

Agent work is checkpointed as commits on a task branch without modifying main, and a worktree whose git admin directory has been redirected to a planted repository blocks the task with an integrity decision before host git can run the planted filter.

Securityboundedcode v0.1.0-alpha.32 test files, 5 artifactsEvidence