fix(omo-senpi): preserve plan gate evidence across session transitions

Merged
GT
5d ago
+322-17

Summary

Preserve plan-gate evidence across same-process extension reloads and session transitions.

The skill invocation tracker currently clears its instance-local state on every session shutdown. When the host replaces the tracker while retaining the conversation's session ID, a previously authorized plan-reviewer request is rejected as if the human never requested planning.

This change hands the session's observed request, invoked-skill, and plan-artifact records to the replacement tracker. It also restores records when returning through the same tracker instance.

Authorization boundaries

  • Extension-injected input still cannot authorize planning.
  • Records are scoped to the original session ID.
  • Prior ulw-execute invocation continues to prohibit plan review.
  • Quit and shutdown without a recognized survival reason discard records.
  • No transcript replay or unconditional gate bypass.

Verification

  • Before fix: new lifecycle suite had 4 passing and 4 failing tests.
  • After fix: tracker suites passed 52 tests.
  • Task component suite passed 839 tests in one process.
  • Adapter typecheck passed.
  • git diff --check passed.

Limitations

This is an in-process handoff, not persistence across application restarts. It fixes a reproduced lifecycle failure; it does not establish that this mechanism caused the particular live-session rejection that prompted the investigation. The installed desktop application was not modified.

Summary by cubic

Preserves plan-gate evidence across session transitions when the task tracker is rebuilt, so a prior plan-authorization is not lost after reload, new, resume, or fork handoffs. Previously, shutdown cleared the tracker's instance-local records, denying a legitimate plan-reviewer request.

Plan-gate evidence (requested skills, invoked skills, and plan-artifact touches) now moves to a module-level, session-keyed handoff store on shutdown. A rebuilt tracker adopts the record on first touch of that session; adoption removes it from the store, and the store is capped at 256 sessions (oldest first out). Returning through the same tracker instance also restores evidence.

  • Records are scoped to the same session ID only; quit and shutdown without a recognized survival reason discard them, and a forked child inherits nothing.
  • Extension-injected input still cannot authorize review, and a prior ulw-execute invocation still blocks it.
  • The handoff is in-process only and does not survive application restarts.
  • The bundled omo-task.js extension was regenerated so the build ships the tracker change.