[LIghtJUNction]

Refs #82, #84 and #85. Merged as 4c46671. This fixes concrete completion paths, not the full acceptance issues.

Changes

• Tool output and native bundle-push Git ref publication now share a transaction-local state/attempt/deadline check with notification completion and retry. Matching expired or missing leases persist uncertainty even without another worker's sweep. Superseded or terminal attempts are untouched; expired work is not automatically resent.
• Maintenance result and terminal job state are written atomically under the same fence, removing the second unprotected status write.
• Successful result formats, current authorization checks and sandbox policy are preserved.

Effective application/test files: src/msg/workers/leases.py, src/msg/workers/effects.py, src/msg/extensions/repositories.py and tests/test_effect_completion_fencing.py. The branch also contained #110's byte-identical CI evidence changes before #110 was squash-merged; those are not additional application changes here.

Completed verification

Exact-head CI 36353193024 is success: 1,109 tests across four complete, disjoint shards (265/289/300/255), 8 conformance checks, wheel/sdist and contracts gate. All reports have zero failures, errors and skips. All 11 new regressions ran successfully with the unchanged PostgreSQL fixture: five maintenance states and six signed tool/Git cases, including real local Git import/ref checks.

All four artifacts were downloaded, their SHA-256 digests matched the provider, and the exact-node-ID gate was independently rerun. The merged tree d36cab213c5a997a6b52fdcc78f92e860f9982e6 exactly matches the verified head tree. Local maintenance reproduction was 4 failed/1 passed before and 5 passed after; that SQLite adapter result was only preliminary, not substituted for PostgreSQL CI. The 44 notification regressions also remain passing.

Boundaries

This does not cancel an external operation already in progress or promise exactly-once execution. Imported/staged bytes are not claimed to roll back: expired tool output is not published as a file and bundle-push refs/generation do not advance. This is not complete SSH/HTTP receive-pack or real-network acceptance.

Publication used a checksum-verified branch-only materializer which removed itself; no temporary workflow remains in the merged tree. Squash merge excludes temporary publication history. No production deployment, restore, external notification, authority expansion or schema migration. #81–85 remain open for their uncompleted acceptance requirements.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-27T21:54:57.968935Z	d63414d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

Source review at the exact head: helper, effects.py, repositories.py and the 11-case regression module match the locally reviewed blobs; no temporary materializer remains. The tool/Git expiry paths return from inside the write transaction, so the uncertainty record commits rather than being rolled back by an exception. All result publication is guarded before creating the file/moving bundle-push refs. PostgreSQL serializes write transactions with its existing advisory transaction lock; no independent authority decision or database bypass was added. Maintenance preserves the prior successful result shape while making its state/status update atomic. Existing tool revocation and native Git successful-push regression paths are retained. Scope is the durable bundle-push worker, not a claim that all SSH/HTTP receive-pack acceptance matrices are complete. CI 36353193024 is still pending; this review does not authorize merging before that complete gate succeeds.

[LIghtJUNction]

Verification update: all four exact-head artifacts from run 36353193024 are downloaded and their SHA-256 digests match the provider. Independently ran the exact-ID gate: 1,109 tests, complete and disjoint (265/289/300/255), zero failures/errors/skips. All 11 new regressions passed in the unchanged PostgreSQL CI fixture, including all six signed tool/Git tests and five maintenance transitions. Conformance has 8 passes and no failures/errors/skips; wheel/sdist are present. Current main after #110 has tree d271014d45a864b3a3c679437b39d7426c8bb903, exactly the already-tested foundation of this branch. The two CI files in GitHub's history-based diff are byte-identical to main; effective source/test changes remain the three completion modules and one regression module. The final GitHub contracts job is still queued; do not treat this independent evidence review as an overall success conclusion until that job finishes.