Authenticate failed pre-provider candidate recovery (#9067)

* fix: prefer controller attempt plan in Lab handoff

* fix: allow failed pre-provider candidate adoption

* fix: authenticate failed pre-provider recovery

Author: chubes4

crates/homeboy-agents/src/agent_task_finalization.rs

@@ -546,8 +546,10 @@ fn validate_durable_publication_eligibility(
         .pointer("/candidate/fingerprint/head")
         .and_then(serde_json::Value::as_str);
     let adoption_model = promotion.provenance["adoption"]["ai_model"].as_str();
-    let authenticated_adoption = lifecycle.execution.state == RunExecutionState::Cancelled
-        && lifecycle.provider_runtime.is_empty()
+    let authenticated_adoption = matches!(
+        lifecycle.execution.state,
+        RunExecutionState::Cancelled | RunExecutionState::Failed
+    ) && no_real_provider_execution(lifecycle)
         && promotion.provenance["adoption"]["source_run_id"]
             == promotion.source.run_id.clone().unwrap_or_default()
         && candidate_ref.is_some_and(is_git_commit_identity)
@@ -609,6 +611,14 @@ fn validate_durable_publication_eligibility(
     Err(Error::validation_invalid_argument("run_id", "durable run must have succeeded execution and succeeded provider runtime before publication; the only exceptions are an applied, green, fingerprinted candidate-adoption recovery with durable zero-execution pre-provider transport provenance or an applied, green, committed-change-provenance-bound authenticated external candidate adoption", None, None))
 }
 
+fn no_real_provider_execution(lifecycle: &RunLifecycleRecord) -> bool {
+    lifecycle.external_runtime_ids.is_empty()
+        && lifecycle.provider_runtime.iter().all(|runtime| {
+            runtime.external_runtime_ids.is_empty()
+                && runtime.metadata["evidence_source"] == "canonical_executor_outcome"
+        })
+}
+
 fn is_concrete_model(value: &str) -> bool {
     !value.trim().is_empty()
         && value == value.trim()

crates/homeboy-agents/src/agent_task_finalization/tests.rs

@@ -835,6 +835,36 @@ fn durable_finalization_accepts_only_authenticated_pre_provider_candidate_adopti
     assert_eq!(report.review_dossier.ai_assistance.model, "GPT-5.5");
     assert!(backend.committed && backend.pushed && backend.created);
 
+    let mut failed_recovery_lifecycle = recovery_lifecycle.clone();
+    failed_recovery_lifecycle.execution.state = RunExecutionState::Failed;
+    failed_recovery_lifecycle
+        .provider_runtime
+        .push(ProviderRuntimeLifecycle {
+            task_id: "task".to_string(),
+            backend: "opencode".to_string(),
+            state: ProviderRuntimeState::Failed,
+            stream_uri: None,
+            external_runtime_ids: Vec::new(),
+            metadata: json!({ "evidence_source": "canonical_executor_outcome" }),
+        });
+    let mut failed_backend = MockBackend {
+        changed_files: vec!["src/lib.rs".to_string()],
+        lifecycle: Some(failed_recovery_lifecycle.clone()),
+        gate_proof: Some({
+            let mut proof = pre_provider_adoption_gate_proof();
+            proof.promotion.changed_files = vec!["src/lib.rs".to_string()];
+            proof
+        }),
+        ..Default::default()
+    };
+    let mut failed_finalization_options = options();
+    failed_finalization_options.manual_finalization = false;
+    failed_finalization_options.changed_files = vec!["src/lib.rs".to_string()];
+    let failed_report = finalize_pr_with_backend(failed_finalization_options, &mut failed_backend)
+        .expect("authenticated failed transport recovery publishes");
+    assert_eq!(failed_report.status, "review_ready");
+    assert!(failed_backend.committed && failed_backend.pushed && failed_backend.created);
+
     let rejected = |lifecycle: RunLifecycleRecord, gate_proof: AgentTaskPrDurableGateProof| {
         let mut backend = MockBackend {
             changed_files: vec!["src/lib.rs".to_string()],
@@ -850,49 +880,54 @@ fn durable_finalization_accepts_only_authenticated_pre_provider_candidate_adopti
         assert!(!backend.committed && !backend.pushed && !backend.created);
     };
 
-    rejected(recovery_lifecycle.clone(), successful_gate_proof());
+    rejected(failed_recovery_lifecycle.clone(), successful_gate_proof());
 
-    let mut provider_executed = recovery_lifecycle.clone();
+    let mut provider_executed = failed_recovery_lifecycle.clone();
     provider_executed
         .provider_runtime
         .push(ProviderRuntimeLifecycle {
             task_id: "task".to_string(),
             backend: "provider".to_string(),
             state: ProviderRuntimeState::Cancelled,
             stream_uri: None,
-            external_runtime_ids: Vec::new(),
+            external_runtime_ids: vec![ExternalRuntimeId {
+                kind: "provider_run_id".to_string(),
+                value: "provider-actual-run".to_string(),
+                provider: Some("provider".to_string()),
+                url: None,
+            }],
             metadata: serde_json::Value::Null,
         });
     rejected(provider_executed, pre_provider_adoption_gate_proof());
 
     let mut legacy = pre_provider_adoption_gate_proof();
     legacy.promotion.provenance["adoption"]["recovery"] = serde_json::Value::Null;
-    rejected(recovery_lifecycle.clone(), legacy);
+    rejected(failed_recovery_lifecycle.clone(), legacy);
 
     let mut mismatched = pre_provider_adoption_gate_proof();
     mismatched.promotion.provenance["adoption"]["source_run_id"] = json!("other-run");
-    rejected(recovery_lifecycle.clone(), mismatched);
+    rejected(failed_recovery_lifecycle.clone(), mismatched);
 
     let mut unbound_candidate = pre_provider_adoption_gate_proof();
     unbound_candidate.promotion.provenance["candidate"] = serde_json::Value::Null;
-    rejected(recovery_lifecycle.clone(), unbound_candidate);
+    rejected(failed_recovery_lifecycle.clone(), unbound_candidate);
 
     let mut mismatched_head = pre_provider_adoption_gate_proof();
     mismatched_head.promotion.provenance["candidate"]["fingerprint"]["head"] =
         json!("0000000000000000000000000000000000000000");
-    rejected(recovery_lifecycle.clone(), mismatched_head);
+    rejected(failed_recovery_lifecycle.clone(), mismatched_head);
 
     let mut missing_head = pre_provider_adoption_gate_proof();
     missing_head.promotion.provenance["candidate"]["fingerprint"]["head"] = json!("");
-    rejected(recovery_lifecycle.clone(), missing_head);
+    rejected(failed_recovery_lifecycle.clone(), missing_head);
 
     let mut missing_model = pre_provider_adoption_gate_proof();
     missing_model.promotion.provenance["adoption"]["ai_model"] = serde_json::Value::Null;
-    rejected(recovery_lifecycle.clone(), missing_model);
+    rejected(failed_recovery_lifecycle.clone(), missing_model);
 
     let mut non_green = pre_provider_adoption_gate_proof();
     non_green.promotion.gate_results[0].status = HomeboyGateStatus::Failed;
-    rejected(recovery_lifecycle, non_green);
+    rejected(failed_recovery_lifecycle, non_green);
 }
 
 #[test]

crates/homeboy-agents/src/agent_task_lifecycle/lifecycle_ops.rs

@@ -1260,28 +1260,44 @@ pub(crate) fn is_accepted_runner_handoff(record: &AgentTaskRunRecord) -> bool {
     record.has_accepted_lab_handoff()
 }
 
-/// Reconstruct the only aggregate-free failure that can safely admit an
-/// externally prepared immutable candidate: an expired handoff before the
-/// runner recorded a job or consumed a provider execution.
+/// Reconstruct an authenticated pre-provider transport failure that can safely
+/// admit an externally prepared immutable candidate. Expired handoffs retain
+/// their aggregate-free legacy shape; preacceptance failures retain their
+/// canonical failure aggregate and its synthetic runtime projection.
 pub fn candidate_adoption_recovery_outcome(
     record: &AgentTaskRunRecord,
     task: &AgentTaskRequest,
 ) -> Option<AgentTaskOutcome> {
-    let handoff = record.lab_handoff.as_ref()?;
-    let eligible = record.state == AgentTaskRunState::Cancelled
-        && record.aggregate_path.is_none()
-        && record.totals.is_none()
-        && record.artifact_refs.is_empty()
-        && record.provider_handles.is_empty()
-        && record.latest_executor_evidence.is_none()
-        && record.lab_handoff_validation_error().is_none()
-        && handoff.state == AgentTaskLabHandoffState::Expired
-        && handoff.runner_job_id.is_none()
-        && record.metadata["phase"] == "handoff_rejected"
+    let expired_handoff = record.lab_handoff.as_ref().is_some_and(|handoff| {
+        record.state == AgentTaskRunState::Cancelled
+            && record.aggregate_path.is_none()
+            && record.totals.is_none()
+            && record.artifact_refs.is_empty()
+            && record.provider_handles.is_empty()
+            && record.latest_executor_evidence.is_none()
+            && record.lab_handoff_validation_error().is_none()
+            && handoff.state == AgentTaskLabHandoffState::Expired
+            && handoff.runner_job_id.is_none()
+            && record.metadata["phase"] == "handoff_rejected"
+            && record.metadata["provider_executions_consumed"] == 0
+            && record.metadata["handoff_acceptance"]["state"] == "expired"
+            && record.metadata["handoff_acceptance"]["reason"] == EXPIRED_LAB_HANDOFF_REASON
+    });
+    let failed_preacceptance = record.state == AgentTaskRunState::Failed
+        && record.metadata["phase"] == "lab_handoff_preacceptance"
         && record.metadata["provider_executions_consumed"] == 0
-        && record.metadata["handoff_acceptance"]["state"] == "expired"
-        && record.metadata["handoff_acceptance"]["reason"] == EXPIRED_LAB_HANDOFF_REASON;
-    eligible.then(|| {
+        && record.provider_handles.is_empty()
+        && no_runner_job_recorded(record)
+        && record.lifecycle.external_runtime_ids.is_empty()
+        && record.lifecycle.provider_runtime.iter().all(|runtime| {
+            runtime.external_runtime_ids.is_empty()
+                && runtime.metadata["evidence_source"] == "canonical_executor_outcome"
+        })
+        && record.metadata["pre_execution_failure"]["phase"] == "lab_handoff_preacceptance"
+        && is_pre_provider_transport_recovery(
+            &record.metadata["pre_execution_failure"]["candidate_adoption_recovery"],
+        );
+    (expired_handoff || failed_preacceptance).then(|| {
         build_pre_execution_failure_outcome(
             &record.run_id,
             task,
@@ -1291,6 +1307,22 @@ pub fn candidate_adoption_recovery_outcome(
     })
 }
 
+fn no_runner_job_recorded(record: &AgentTaskRunRecord) -> bool {
+    record.runner_job_id().is_none()
+        && record
+            .lab_handoff
+            .as_ref()
+            .is_none_or(|handoff| handoff.runner_job_id.is_none())
+        && record.metadata["runner_job_id"].is_null()
+        && record.metadata["job_id"].is_null()
+}
+
+fn is_pre_provider_transport_recovery(recovery: &Value) -> bool {
+    recovery["schema"] == "homeboy/agent-task-candidate-adoption-recovery/v1"
+        && recovery["reason"] == "pre_provider_transport_failure"
+        && recovery["provider_executions_consumed"] == 0
+}
+
 fn expire_unaccepted_lab_handoff(run_id: &str) -> Result<bool> {
     // An expired pending request may have been accepted immediately before its
     // response was lost. Querying its key is read-only; never replay here.

crates/homeboy-agents/src/agent_task_lifecycle/tests/terminal_and_reconcile.rs

@@ -233,6 +233,85 @@ fn detached_cook_preacceptance_failure_terminalizes_attempt_proxy() {
     });
 }
 
+#[test]
+fn failed_lab_preacceptance_reconstructs_only_authenticated_zero_execution_recovery() {
+    with_isolated_home(|_| {
+        let run_id = "cook-preacceptance-recovery";
+        let plan = test_plan();
+        record_lab_offload_phase(
+            run_id,
+            "homeboy-lab",
+            "materializing",
+            None,
+            None,
+            None,
+            Some(&plan),
+        )
+        .expect("pre-acceptance attempt record");
+        record_pre_execution_failure(
+            run_id,
+            &plan,
+            "lab_handoff_preacceptance",
+            &Error::internal_unexpected("truncated Lab handoff payload"),
+        )
+        .expect("terminal preacceptance failure");
+
+        let mut record = status(run_id).expect("failed record");
+        record.metadata["phase"] = json!("lab_handoff_preacceptance");
+        assert_eq!(record.state, AgentTaskRunState::Failed);
+        assert!(record.aggregate_path.is_some());
+        assert!(!record.artifact_refs.is_empty());
+        assert_eq!(record.lifecycle.provider_runtime.len(), 1);
+        assert_eq!(
+            record.lifecycle.provider_runtime[0].metadata["evidence_source"],
+            "canonical_executor_outcome"
+        );
+        assert!(candidate_adoption_recovery_outcome(&record, &plan.tasks[0]).is_some());
+
+        let mut wrong_phase = record.clone();
+        wrong_phase.metadata["phase"] = json!("provider_dispatch");
+        assert!(candidate_adoption_recovery_outcome(&wrong_phase, &plan.tasks[0]).is_none());
+
+        let mut consumed_execution = record.clone();
+        consumed_execution.metadata["provider_executions_consumed"] = json!(1);
+        assert!(candidate_adoption_recovery_outcome(&consumed_execution, &plan.tasks[0]).is_none());
+
+        let mut provider_handle = record.clone();
+        provider_handle
+            .provider_handles
+            .push(AgentTaskRunProviderHandle {
+                kind: Default::default(),
+                task_id: "task-a".to_string(),
+                backend: "test".to_string(),
+                provider_run_id: "provider-actual-run".to_string(),
+                stream_uri: None,
+                state: Some(AgentTaskState::Failed),
+                metadata: Value::Null,
+            });
+        assert!(candidate_adoption_recovery_outcome(&provider_handle, &plan.tasks[0]).is_none());
+
+        let mut runner_job = record.clone();
+        runner_job.metadata["runner_job_id"] = json!("job-actual-provider");
+        assert!(candidate_adoption_recovery_outcome(&runner_job, &plan.tasks[0]).is_none());
+
+        let mut provider_runtime = record.clone();
+        provider_runtime.lifecycle.provider_runtime[0]
+            .external_runtime_ids
+            .push(homeboy_core::run_lifecycle_record::ExternalRuntimeId {
+                kind: "provider_run_id".to_string(),
+                value: "provider-actual-run".to_string(),
+                provider: Some("test".to_string()),
+                url: None,
+            });
+        assert!(candidate_adoption_recovery_outcome(&provider_runtime, &plan.tasks[0]).is_none());
+
+        let mut changed_recovery = record;
+        changed_recovery.metadata["pre_execution_failure"]["candidate_adoption_recovery"]
+            ["reason"] = json!("provider_failure");
+        assert!(candidate_adoption_recovery_outcome(&changed_recovery, &plan.tasks[0]).is_none());
+    });
+}
+
 #[test]
 fn failed_lab_handoff_retry_recovers_the_materialized_user_plan() {
     with_isolated_home(|_| {