conductor-state-machine-review

name	conductor-state-machine-review
description	Review task lifecycle, conductor orchestration, and restart recovery invariants before changing task states, arbiter controls, merge flow, or crash recovery. Use this for risky conductor edits.
owner	any
trigger	null
version	1

Conductor State Machine Review

Use this before changing conductor logic that affects task ownership or lifecycle.

Primary Files

• crates/swx-core/src/task.rs
• crates/swx-actors/src/conductor.rs
• crates/swx-actors/src/recovery.rs
• crates/swxd/src/http.rs
• crates/swxd/src/main.rs
• crates/swxd/src/task_control.rs

Review Checklist

1. State transition legality. Confirm every new path is allowed in TaskState::valid_transitions().
2. Fail-closed behavior. Parent completion, merge, retry, and recovery paths should stop on partial failure instead of continuing optimistically.
3. Ownership boundaries. API layers should validate and send commands; conductor should mutate orchestration state.
4. Restart semantics. Ask which states should redispatch directly, which should defer to conductor startup, and which should stay held.
5. Retry semantics. Ensure amend, Gate 3, Gate 6, and budget-resume flows preserve persisted context.
6. Test coverage. Add or update targeted tests in the same subsystem for each new lifecycle branch.

Required Questions

• What happens if the daemon restarts in this state?
• What happens if one child fails and others succeed?
• What happens if the same command is repeated?
• What state owns the next step after approval, rejection, pause, resume, or veto lift?

Minimum Verification

• targeted tests for the changed path
• cargo test --workspace

Do not make conductor changes without answering the restart and ownership questions explicitly.