Build reviewed plans through the shared local ACP connector

[MaggieAppleton]

Builds on #419. A teammate can review a settled plan’s tasks, choose their paired workspace, and select Approve and build this plan. Approval durably binds the reviewed document, graph and checkout; the shared ACP connector starts an isolated local session and claims the graph before prompting the orchestrator. The interface shows dependencies, task states, blockers, session identity and per-task PR links after refresh.

The connector instructs the orchestrator to use sub-agents and produce small reviewable PRs. Its MCP credential fixes the document and run and exposes only implementation reads and lifecycle reports. Investigations and implementations share pairing, worktrees and workspace reservation. HTTP is selected when advertised by the ACP agent, with a stdio bridge otherwise; this handles the installed Copilot ACP version’s rejection of stdio MCP configuration.

A real Copilot session read the approved graph and reported the blocker shown below through MCP. Scripted browser tests cover both transports, persisted blockers, two reported PRs and successful verification. Real coding, parallel sub-agent delivery and actual multi-PR creation remain unvalidated. Automatic connector startup, implementation-decision resolution/resume, a graphical DAG and browser PR-creation controls remain follow-up slices.

Discussion outline in Chopin · Setup and recovery

Validation: focused task/MCP/connector tests; workspace and E2E type checks; repository CI; production browser pairing/build tests; opt-in real Copilot ACP tracer. No PRs were merged.

The earlier tracer screenshot below predates the Build-dialog review changes; it shows a real session’s saved blocker and its dependent task waiting.

Rebase and design-review follow-up

Rebased after #419 merged, preserving subsequent coworker rebases. The branch contains the implementation increment and its follow-up fixes.

• Move implementation review into the explicit Build dialog, preserving the ordinary document layout.
• Replace permanent two-second polling with initial snapshots and committed change notifications. Editing locks remain current when the dialog is closed and after reconnect.
• Add explicit, idempotent retry for failed startup and Return plan for changes for a stopped claimed run; no automatic replay.
• Wake the connector after durable enqueue, reject duplicate approvals that silently change owner/checkout, and exit cleanly on intentional disconnect.
• Local verification: 4,294 unit tests passed, 4 skipped; the formerly failing viewport/comment cases and focus-restoration case passed; both MCP transports, startup retry and stopped-run recovery passed; types and repository CI checks passed.

Fresh deployed-preview validation is complete on d7149821: detailed report with reviewed screenshots. The real read-only sandbox test passed handoff, blocker persistence, retry, recovery, and desktop/mobile review. Actual multi-PR creation remains unvalidated.

Merge review

Implementation recovery now removes tracked documents after deletion, so one missing document cannot prevent later build recovery. A regression test exercises deletion and repeated recovery sweeps. Repository CI, types, production build and focused connector/task tests pass.

The cancellation fixture now waits for the scripted Planner job to become active before aborting instead of relying on a 50ms sleep. The focused task/readiness rerun passed all 54 tests. An unrestricted full local run had 4,300 passes and two timing failures; both failing files passed independently (5 tests), and the readiness failure is now fixed. The unrelated research child-process timeout remains unchanged; final full-suite validation runs in CI.

[Krzysztof-Cieslak]

Live preview validation — passed for the agreed read-only scope

Tested final head d7149821c63e1e29bcbfb2adf46c547ed0cf27c8 on https://426-chopin.githubnext.com. The trusted preview-ready confirmation advanced to 2026-10-09 20:22:55 UTC. All final-head CI jobs passed.

Detailed report with eight pixel-reviewed screenshots · Live test document

Workflow checked

Step	Outcome	Evidence
Pair real OpenCode ACP connector	Passed; exact sandbox checkout bound to the reviewed document	Connection
Open Build without displacing document prose	Passed on desktop and compact layout	Mobile entry
Review tasks/dependency and approve on mobile	Passed; no local run before explicit approval	Mobile review
Execute the approved graph through real ACP/MCP	Passed for the expected permission preflight; first task reported the genuine write-access blocker and dependent task stayed queued	Real blocker
Retain state and editing lock after reload	Passed with Build closed; blocker/session identity persisted	Same retained blocker above
Return stopped work for changes	Passed after connector disconnect; editing unlocked and a new paragraph persisted	Recovery action
Revise stale graph against the edited document	Passed; Planner actually called the graph-edit tool and produced draft version 4 bound to document revision 22	Graph revision · Current draft
Explicit retry after startup failure	Passed in the preceding b7924f6e phase using a deliberately failing executable, followed by a fresh real OpenCode session	Controlled failure
Intentional connector shutdown	Passed; clean exit and lock release

Final real build: 09ad0d01-e0a5-4fa9-8b1d-6c82b5099980. Sandbox source: KC-Test-OSS/TestRepo at f7aab2fc09f592e231658f91ae4b1c88128563ce. The supplied and execution worktrees remained clean.

Design-review changes validated

• Implementation is an explicit Build workflow, not an always-on document preface.
• Committed notifications replace permanent two-second polling; locks update independently of the dialog.
• Startup retry is explicit and idempotent. A stopped claimed run can be returned for changes without replaying it.
• Stale approval is now explicit in the Planner read, and Revise tasks refreshes the graph's document binding.
• Build is reachable in the compact header as well as desktop controls.

The live test found the stale-graph instruction and missing compact entry; both were fixed, deployed, and retested. Coworker rebases and the Atomic upgrade were preserved. The report distinguishes earlier test phases from final-head evidence.

Scope limit

The operator chose current sandbox access. The local GitHub identity has READ, so stopping at the permission blocker was expected. No real PRs were created, no implementation delivery or parallel sub-agent delivery is claimed, and no PR links or verification evidence were fabricated. Scripted tests separately cover two reported PRs and successful graph verification.

Selected screenshots