kandev/docs/plans/noninteractive-git-execution/task-03-network-budgets.md

---
id: "03-network-budgets"
title: "Cover network callers and failure recovery"
status: done
wave: 3
depends_on: ["02-owned-cleanup"]
plan: "plan.md"
requirements:
  - REQ-PLATFORM-GIT-SUBPROCESS-ADMISSION-002
acceptance_criteria:
  - AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.2
  - AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.3
  - AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.4
  - AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.5
  - AC-PLATFORM-GIT-SUBPROCESS-ADMISSION-002.6
system_design:
  - ../../specs/platform/system-design/git-subprocess-execution.md
---

# Task 03: Cover network callers and failure recovery

## Summary

Every network caller has a recorded finite post-admission budget; selected credentials remain authoritative and subsequent recovery succeeds.

## In scope

Complete the caller inventory in plan.md using repository-wide construction, runner, and manual admission searches.
Record each network operation's execution budget, selected environment, admission class, and required/optional error owner.
An inherited context alone is not proof of a finite post-admission execution budget.

Migrate GitOperator and local checkout preparation to AfterAcquire builders.
Keep existing operation-specific budgets. For uncovered ordinary fetch/pull use 30 seconds; use five minutes for uncovered clone, submodule update, and push.
A shorter parent lifetime still wins. These defaults are internal operation constants, not new public settings.
Preserve worktree manager fetch/pull budgets, tracker ten-second commands, Office 30-second commands, and fresh-branch/refresh 30-second commands.

Keep repoclone's managed-helper isolation and existing transport selection. Preserve argument validation and push error sanitization.
Replace duplicate prompt implementations only after shared enforcement covers their direct starts.
Audit bootstrap, clone fetch/checkout, submodules, backendapp, and all network verbs including ls-remote.
Add focused tests for every modified caller package; record the exact added test names in Results.

Write `TestGitOperatorAuthenticationFailureAndRecovery` with a local HTTP fixture.
Assert a required failure returns a usable sanitized error and releases the operation lock, then restore fixture credentials and retry on the same operator.
Add `TestLocalCheckoutFetchDeadline` and `TestCloneDeadlineAfterAdmission` for the uncovered lifecycle routes.
Use existing scheduler test patterns for canceled queues and queue waits exceeding the execution budget before a successful admitted command.
Preserve fresh-branch's documented best-effort fetch behavior and repository refresh cooldown/singleflight cleanup.

### Merged host bridge compatibility

Reuse the real Git/fake CLI fixtures in `executor_host_gh_bridge_test.go` and `executor_host_gh_bridge_profile_test.go`.
Extend them to exercise the production final Git runner with the effective routed environment, not only raw `git credential fill`.
Add `TestExecutorHostGHBridgeNoninteractiveExecution` and `TestExecutorHostGHBridgeRecoveryAfterUnavailableProbe`.
Cover Local/Worktree host-helper success without global setup, selected profile credential directories, and an absolute CLI path containing spaces.
Preserve earlier user helpers, explicit public/enterprise token precedence, unrelated-host/remote exclusion, and managed-helper failure without host invocation.
Exercise launch/resume/prepared-workspace propagation and reconfiguration that removes an obsolete marker-owned helper while retaining user entries.

Separate two recovery cases. An installed helper which fails can succeed on a later operation in the same instance.
An absent bridge is re-evaluated by the existing launch/resume/prepared-start path; assert recovery on the same backend without adding per-command probes.
Use fake CLI responses and isolated configuration for these tests. Do not use a developer's stored login.
The local HTTP fixture remains necessary to prove successful authenticated network Git, while credential-fill tests prove host-specific bridge routing.

## Out of scope

Credential-authority changes, transport fallback, live-instance changes, and unrelated refactors.

## Acceptance

- Every network caller has a recorded finite post-admission budget; selected credentials remain authoritative and subsequent recovery succeeds.
- Run new behavioral tests before implementation and record the expected failure, then the passing result.
- Preserve the contracts and exclusions in the linked design.

## Verification

```bash
(cd apps/backend && go test ./internal/agentctl/server/process ./internal/agent/runtime/lifecycle ./internal/repoclone ./internal/gitbootstrap ./internal/task/service ./internal/office/configloader ./internal/backendapp ./internal/worktree -count=1 -timeout=10m)
(cd apps/backend && go test ./internal/common/subproc ./internal/gitconfigenv -count=1 -timeout=5m)
(cd apps/backend && go test ./internal/orchestrator/executor ./internal/agent/runtime/environment ./internal/agent/runtime/agentctl ./internal/agentctl/server/config ./internal/agentctl/server/api -count=1 -timeout=10m)
rg -n 'NewGitCommand|AcquireGit|RunGit|ExecGit' apps/backend --glob '*.go' --glob '!**/*_test.go'
```

## Files likely touched

- `apps/backend/internal/orchestrator/executor/executor_host_gh_bridge_test.go` (available after dependency integration)
- `apps/backend/internal/orchestrator/executor/executor_host_gh_bridge_profile_test.go` (available after dependency integration)
- `apps/backend/internal/agentctl/server/process/manager_temp_test.go` (existing reconfiguration coverage)

- `apps/backend/internal/agentctl/server/process/git.go`
- `apps/backend/internal/agentctl/server/process/git_auth_test.go (new)`
- `apps/backend/internal/agent/runtime/lifecycle/env_preparer_local.go`
- `apps/backend/internal/agent/runtime/lifecycle/env_preparer_local_test.go`
- `apps/backend/internal/repoclone/clone.go`
- `apps/backend/internal/repoclone/clone_auth_test.go`
- `apps/backend/internal/gitbootstrap/gitbootstrap.go`
- `apps/backend/internal/task/service/fresh_branch.go`
- `apps/backend/internal/task/service/repository_fetch.go`
- `apps/backend/internal/office/configloader/git.go`
- `apps/backend/internal/backendapp/ (network Git callers found by inventory)`

## Dependencies

02-owned-cleanup.

## Risks

Credential helper and process-lifecycle compatibility require real subprocess evidence. Do not infer success from environment assertions alone.

## Parallelism

`sequential`

## Inputs

- [Execution design](../../specs/platform/system-design/git-subprocess-execution.md).
- [Plan evidence and caller inventory](plan.md).
- Scoped AGENTS.md and relevant fix, TDD, and E2E skills.

## Results

Implemented after Task 02 on the verified PR #3635 descendant `9cc146ee21c296d553ae684531219a5c711a4213`.

Results: network-capable Git callers now choose finite post-admission budgets while preserving established operation-specific deadlines, selected credential environments, refresh cooldowns, and required/optional error ownership. GitOperator authentication failures release the operation lock and a later operation can recover. Comparison-target recovery re-evaluates unavailable targets only from an explicit fresh status request, and moving internal comparison refs are force-updated only at their exact cache ref.

Checks passed:

- `(cd apps/backend && go test ./internal/agent/runtime/lifecycle ./internal/repoclone ./internal/gitbootstrap ./internal/task/service ./internal/office/configloader ./internal/backendapp ./internal/worktree -count=1 -timeout=10m)`
- `(cd apps/backend && go test ./internal/common/subproc ./internal/gitconfigenv -count=1 -timeout=5m)`
- `(cd apps/backend && go test ./internal/orchestrator/executor ./internal/agent/runtime/environment ./internal/agent/runtime/agentctl ./internal/agentctl/server/config ./internal/agentctl/server/api -count=1 -timeout=10m)`
- Production Git source audit in `internal/common/subproc`.