officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

measure what a handoff actually survives

Browse Source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-07 10:32:18 +00:00
co-authored by Claude Opus 5
parent df00f6d7a5
commit 3ab57a5839
1 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/agent-coordination.md
+33
View File
@@ -480,6 +480,39 @@ a human watches and steers a conversation that continues without it — which is
§1.15 shows the chat system was rebuilt to support (durable event log, cursor replay, agent-as-writer,
session outliving the socket).
**Measured, 2026-08-07 — the durability claim above is no longer an argument.** Six tests run live
against the running system, deliberately looking for the break. Method and raw evidence:
`COMMS/handoff-durability-2026-08-07.md`.
| what was done to it mid-handoff | turn completed | narration durable |
|---|---|---|
| nothing (control) | ✅ | ✅ |
| `pm2 restart officer` | ✅ | ✅ |
| **`officer` stopped for 25 s** | ✅ | ✅ **6 events written while the server was down** |
| target's `claude` process SIGKILLed | ❌ lost | ⚠️ partial, with an explicit error row |
| next handoff to that same agent | ✅ | ✅ same Claude session resumed |
| handoff POSTed while `officer` is down | ❌ lost | ❌ no queue, no retry |
Three things follow, and they change how the outstanding work should be read:
- **The "no browser open" requirement is satisfied, and so is the harder one.** Not one of these runs had
a page open, and the middle row is the proof that officer is genuinely off the delivery path: the agent
sidecar committed the model's own words to Postgres during a 25-second server outage.
- **A restart costs a *turn*, not an *agent*.** After being killed mid-turn, the receiver resumed the
identical Claude session on the next handoff and volunteered which work had been lost. Continuity —
`sessionKey` minted once, write-through map on disk — does the job it was built for. That makes the
outstanding claude **stage 5** a smaller problem than its position on the list suggests.
- **The remaining hole is on the *sending* side.** A handoff POSTed while officer is down is refused and
dropped, and nothing in the introduction text tells the agent to retry — so the sender can believe it
handed off when it did not. That, not the receiving side, is where store-and-forward would earn its
keep.
One topology fact found while setting this up, worth stating here because it is the practical limit on
working unattended: **`officer-agent` is `sidecar/claude/user-instance.ts`, and every `claude` process on
the machine is its direct child.** `pm2 restart officer-agent` therefore kills every agent on every
dashboard at once, mid-turn. `CLAUDE.md` reassures that restarting *officer* is safe — it is, and that is
verified above — but is silent on this one.
### 1.17 The restart payload is temporary — the protocol is not
> The restart thing is giving me pain right now. Pretty soon that won't be a problem, because I won't