kandev/docs/plans/noninteractive-git-execution/task-03-network-budgets.md

id, title, status, wave, depends_on, plan, requirements, acceptance_criteria, system_design

id	title	status	wave	depends_on	plan	requirements	acceptance_criteria	system_design
03-network-budgets	Cover network callers and failure recovery	done	3	02-owned-cleanup	plan.md	REQ-PLATFORM-GIT-SUBPROCESS-ADMISSION-002	AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.2 AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.3 AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.4 AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.5 AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.6	../../specs/platform/system-design/git-subprocess-execution.md

Task 03: Cover network callers and failure recovery

Summary

Every network caller has a recorded finite post-admission budget; selected credentials remain authoritative and subsequent recovery succeeds.

In scope

Complete the caller inventory in plan.md using repository-wide construction, runner, and manual admission searches. Record each network operation's execution budget, selected environment, admission class, and required/optional error owner. An inherited context alone is not proof of a finite post-admission execution budget.

Migrate GitOperator and local checkout preparation to AfterAcquire builders. Keep existing operation-specific budgets. For uncovered ordinary fetch/pull use 30 seconds; use five minutes for uncovered clone, submodule update, and push. A shorter parent lifetime still wins. These defaults are internal operation constants, not new public settings. Preserve worktree manager fetch/pull budgets, tracker ten-second commands, Office 30-second commands, and fresh-branch/refresh 30-second commands.

Keep repoclone's managed-helper isolation and existing transport selection. Preserve argument validation and push error sanitization. Replace duplicate prompt implementations only after shared enforcement covers their direct starts. Audit bootstrap, clone fetch/checkout, submodules, backendapp, and all network verbs including ls-remote. Add focused tests for every modified caller package; record the exact added test names in Results.

Write TestGitOperatorAuthenticationFailureAndRecovery with a local HTTP fixture. Assert a required failure returns a usable sanitized error and releases the operation lock, then restore fixture credentials and retry on the same operator. Add TestLocalCheckoutFetchDeadline and TestCloneDeadlineAfterAdmission for the uncovered lifecycle routes. Use existing scheduler test patterns for canceled queues and queue waits exceeding the execution budget before a successful admitted command. Preserve fresh-branch's documented best-effort fetch behavior and repository refresh cooldown/singleflight cleanup.

Merged host bridge compatibility

Reuse the real Git/fake CLI fixtures in executor_host_gh_bridge_test.go and executor_host_gh_bridge_profile_test.go. Extend them to exercise the production final Git runner with the effective routed environment, not only raw git credential fill. Add TestExecutorHostGHBridgeNoninteractiveExecution and TestExecutorHostGHBridgeRecoveryAfterUnavailableProbe. Cover Local/Worktree host-helper success without global setup, selected profile credential directories, and an absolute CLI path containing spaces. Preserve earlier user helpers, explicit public/enterprise token precedence, unrelated-host/remote exclusion, and managed-helper failure without host invocation. Exercise launch/resume/prepared-workspace propagation and reconfiguration that removes an obsolete marker-owned helper while retaining user entries.

Separate two recovery cases. An installed helper which fails can succeed on a later operation in the same instance. An absent bridge is re-evaluated by the existing launch/resume/prepared-start path; assert recovery on the same backend without adding per-command probes. Use fake CLI responses and isolated configuration for these tests. Do not use a developer's stored login. The local HTTP fixture remains necessary to prove successful authenticated network Git, while credential-fill tests prove host-specific bridge routing.

Out of scope

Credential-authority changes, transport fallback, live-instance changes, and unrelated refactors.

Acceptance

• Every network caller has a recorded finite post-admission budget; selected credentials remain authoritative and subsequent recovery succeeds.
• Run new behavioral tests before implementation and record the expected failure, then the passing result.
• Preserve the contracts and exclusions in the linked design.

Verification

(cd apps/backend && go test ./internal/agentctl/server/process ./internal/agent/runtime/lifecycle ./internal/repoclone ./internal/gitbootstrap ./internal/task/service ./internal/office/configloader ./internal/backendapp ./internal/worktree -count=1 -timeout=10m)
(cd apps/backend && go test ./internal/common/subproc ./internal/gitconfigenv -count=1 -timeout=5m)
(cd apps/backend && go test ./internal/orchestrator/executor ./internal/agent/runtime/environment ./internal/agent/runtime/agentctl ./internal/agentctl/server/config ./internal/agentctl/server/api -count=1 -timeout=10m)
rg -n 'NewGitCommand|AcquireGit|RunGit|ExecGit' apps/backend --glob '*.go' --glob '!**/*_test.go'

Files likely touched

• apps/backend/internal/orchestrator/executor/executor_host_gh_bridge_test.go (available after dependency integration)

• apps/backend/internal/orchestrator/executor/executor_host_gh_bridge_profile_test.go (available after dependency integration)

• apps/backend/internal/agentctl/server/process/manager_temp_test.go (existing reconfiguration coverage)

• apps/backend/internal/agentctl/server/process/git.go

• apps/backend/internal/agentctl/server/process/git_auth_test.go (new)

• apps/backend/internal/agent/runtime/lifecycle/env_preparer_local.go

• apps/backend/internal/agent/runtime/lifecycle/env_preparer_local_test.go

• apps/backend/internal/repoclone/clone.go

• apps/backend/internal/repoclone/clone_auth_test.go

• apps/backend/internal/gitbootstrap/gitbootstrap.go

• apps/backend/internal/task/service/fresh_branch.go

• apps/backend/internal/task/service/repository_fetch.go

• apps/backend/internal/office/configloader/git.go

• apps/backend/internal/backendapp/ (network Git callers found by inventory)

Dependencies

02-owned-cleanup.

Risks

Credential helper and process-lifecycle compatibility require real subprocess evidence. Do not infer success from environment assertions alone.

Parallelism

sequential

Inputs

• Execution design.
• Plan evidence and caller inventory.
• Scoped AGENTS.md and relevant fix, TDD, and E2E skills.

Results

Implemented after Task 02 on the verified PR #3635 descendant 9cc146ee21c296d553ae684531219a5c711a4213.

Results: network-capable Git callers now choose finite post-admission budgets while preserving established operation-specific deadlines, selected credential environments, refresh cooldowns, and required/optional error ownership. GitOperator authentication failures release the operation lock and a later operation can recover. Comparison-target recovery re-evaluates unavailable targets only from an explicit fresh status request, and moving internal comparison refs are force-updated only at their exact cache ref.

Checks passed:

• (cd apps/backend && go test ./internal/agent/runtime/lifecycle ./internal/repoclone ./internal/gitbootstrap ./internal/task/service ./internal/office/configloader ./internal/backendapp ./internal/worktree -count=1 -timeout=10m)
• (cd apps/backend && go test ./internal/common/subproc ./internal/gitconfigenv -count=1 -timeout=5m)
• (cd apps/backend && go test ./internal/orchestrator/executor ./internal/agent/runtime/environment ./internal/agent/runtime/agentctl ./internal/agentctl/server/config ./internal/agentctl/server/api -count=1 -timeout=10m)
• Production Git source audit in internal/common/subproc.