feat: namespace scope, creator signal, queue/session dedup (PRs 1–3)

[jamestexas]

Summary

Implements the approved 3-PR plan for multi-team monorepo support. Ships as one mega PR (solo dev, no stars yet).

PR 1 — created_by: Option<String> on Bead

• Git username captured at bead creation via git config user.name
• Never hard-errors if git config fails — stores None
• SQLite + Dolt migrations, create_bead_full signature updated

PR 2 — Fix queue/session dedup bugs

• WorkQueue: composite (repo, bead_id) keys in in_queue and backoff
• SessionRegistry: register/unregister/touch all repo-aware
• QueueEntry::PartialEq now includes repo check
• New test: same bead_id in two repos can be enqueued simultaneously

PR 3 — scope: String on BeadRef + Bead

• Team/folder dimension for monorepos — "" for all existing beads (backward compat)
• #[serde(default)] on both structs
• 47 BeadRef + 17 Bead construction sites updated across 29 files
• create_bead_full gains scope: &str param
• SQLite schema + additive migration; Dolt 004_add_scope migration + BEADS_SCHEMA
• TODO(rosary-scope) marker for future BeadRef → WorkRef rename

Also includes (prior commits):

• ProvenanceRef polymorphic source reference on BeadSpec
• Pipeline dispatch hardening + orphan recovery
• Mache blast-radius + duplication check verify tiers
• CI: all GitHub Actions pinned to full commit SHAs

Test plan

• cargo test --bins — 589 unit tests passing
• cargo test --test cli_integration — 17 integration tests passing (Dolt end-to-end)
• cargo clippy -- -D warnings — zero warnings
• Same bead_id in two repos enqueued simultaneously (new composite-key test)
• rsry bead create captures created_by from git config

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens bead lifecycle handling for multi-repo/monorepo use by adding richer provenance/creator metadata, fixing cross-repo dedup collisions, and improving pipeline reliability (crash recovery, workspace cleanup, verify tier additions, and new hierarchical orchestration scaffolding).

Changes:

• Introduce ProvenanceRef (polymorphic source reference) for BDR bead specs and update decomposition logic/tests.
• Add created_by capture at bead creation, with additive migrations for SQLite/Dolt and plumbing through store APIs.
• Fix dedup/backoff/session tracking collisions by switching keying from bead_id to (repo, bead_id) and add pipeline hardening + new mache advisory verify tiers.

Reviewed changes

Copilot reviewed 45 out of 45 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
src/xref.rs	Update test bead construction for new created_by field.
src/workspace/tests.rs	Add regression test ensuring Workspace::cleanup() is safe for VcsKind::None.
src/workspace/mod.rs	Export ensure_thread_branch; add Workspace::cleanup(self) API.
src/verify.rs	Add mache blast-radius/duplication advisory tiers; update tier counts in tests.
src/testutil.rs	Update bead factory helper with created_by.
src/store_sqlite.rs	Add regression test for orphan/abandoned dispatch recovery behavior.
src/store.rs	Extend BeadStore::create_bead_full signature with created_by.
src/session.rs	Key session registry operations by (repo, bead_id) to avoid collisions.
src/serve/handlers.rs	Capture created_by from git config; update session registry calls to include repo.
src/scanner.rs	Update test bead construction for created_by.
src/reconcile/verify.rs	Add agent-closed fast path; feed orchestrator completion; improved deadletter-on-spawn-failure behavior.
src/reconcile/triage.rs	Use composite (repo, bead_id) queue APIs.
src/reconcile/threading.rs	Auto-thread decade/thread setup; ensure feature branch; add feature PR assembly phase.
src/reconcile/tests.rs	Update tests for new queue signatures and created_by field.
src/reconcile/persistence.rs	Startup recovery now abandons orphan dispatch records; remove unnecessary dead_code allow.
src/reconcile/orchestration.rs	New hierarchical orchestration integration (tick loop, crash recovery, dispatch/verify bridging).
src/reconcile/mod.rs	Wire orchestration config; add orchestrator map; invoke orchestrator tick + feature assembly.
src/reconcile/completion.rs	Update backoff handling to include repo; adjust retry logging.
src/queue.rs	Switch queue dedup/backoff keys to (repo, bead_id); add regression test for cross-repo enqueue.
src/pipeline.rs	Add active_dispatches() helper for crash recovery.
src/orchestrate/transcript.rs	New transcript parser for fork-style context sharing.
src/orchestrate/synthesis.rs	New synthesized prompt builder between phases.
src/orchestrate/plan_gate.rs	New plan validation/generation utilities.
src/orchestrate/mod.rs	New FeatureOrchestrator state machine + persistence types.
src/orchestrate/mailbox.rs	New file-based mailbox for mid-flight orchestrator/worker messaging.
src/orchestrate/fanout.rs	New research fan-out config + default queries.
src/main.rs	Add git_config_user_name() helper; pass created_by into bead creation; include orchestrate module.
src/import.rs	Pass created_by=None on imported beads.
src/epic.rs	Update test bead construction for created_by.
src/dolt/tests.rs	Update Dolt schema test table to include user_id and created_by.
src/dolt/query.rs	Update bead mapping structs for created_by field (currently unset).
src/dolt/mod.rs	Update Dolt schema to include user_id and created_by.
src/dolt/migrate.rs	Add Dolt migration 003_add_created_by.
src/dolt/bead_crud.rs	Write created_by on bead creation; update bead mappings (currently unset).
src/dispatch/tests.rs	Add regression test ensuring workspace cleanup on spawn failure; update test beads for created_by.
src/dispatch/mod.rs	Clean up workspace on spawn failure; pipeline-first lifecycle transitions in dispatch::run.
src/config.rs	Add OrchestrationConfig and plumb into global config.
src/bead_sqlite.rs	Add SQLite created_by column + additive migration; plumb into create/list/get; add test coverage.
src/bead_dolt.rs	Plumb created_by into Dolt BeadStore adapter.
src/bead.rs	Add created_by to Bead model and parsing defaults.
crates/bdr/src/provenance.rs	New ProvenanceRef enum with serde + helpers + tests.
crates/bdr/src/lib.rs	Export provenance module.
crates/bdr/src/decompose.rs	Replace source_adr with ProvenanceRef in BeadSpec and update tests.
Cargo.toml	Enable reqwest blocking feature for mache tiers.
.github/workflows/ci.yml	Pin GitHub Actions to commit SHAs for supply-chain hardening.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

QueueEntry’s equality is now (bead_id, repo), but Ord::cmp still only compares (score, enqueued_at). That breaks the Ord contract (two entries can compare Equal while eq is false), which can lead to incorrect behavior in BinaryHeap when scores/timestamps tie. Update cmp to include a deterministic tie-breaker (e.g., repo + bead_id) so it’s consistent with Eq.

[Copilot]

In hierarchical mode, dispatching only creates an orchestrator and marks the bead dispatched, but it does not initialize a BeadTracker / repo mapping for the bead. Later, completion/verification code paths rely on trackers[bead_id].repo to associate completed workdirs with a repo/language; without that, verification will fall back to unknown language and skip compile/test/lint. Ensure orchestrator-managed beads still register tracker/repo metadata (or otherwise plumb repo through completion/verification).

[Copilot]

create_orchestrator inserts into self.orchestrators keyed by bead_id only. If two repos contain beads with the same ID, one orchestrator will overwrite the other, breaking hierarchical mode and reintroducing the cross-repo collision this PR is trying to fix. Use a composite key (e.g., BeadRef or (repo, bead_id)) consistently throughout this module.

[Copilot]

After a successful spawn, the handle is stored in self.active, but the orchestrator never receives it (FeatureOrchestrator::set_worker_handle is never called). As a result, the orchestrator can’t distinguish “waiting for a spawn” vs “waiting for completion”, and subsequent phases can get stuck returning Idle (no further NeedsSpawn). Either pass the handle into the orchestrator (and/or store an explicit state flag) so tick() can correctly drive the lifecycle across phases.

Suggested change

	// Keep the orchestrator's lifecycle state in sync with the
	// successfully spawned worker so future ticks wait for
	// completion instead of treating this phase as idle.
	if let Some(orch) = self.orchestrators.get_mut(&bead_id) {
	orch.set_worker_handle(handle.clone());
	}

[Copilot]

This orchestrator-managed completion path calls verify_and_decide() and feeds a pass/fail boolean back to the orchestrator, but it never executes the resulting CompletionAction (no handoff write, no status update, no workspace checkpoint/cleanup, and no pipeline.complete_dispatch() for the dispatch record). That will leave pipeline/dispatch state inconsistent and likely leak completed_at = NULL dispatch records. Consider reusing execute_action() here (or an orchestrator-specific equivalent) so the same persistence + cleanup invariants apply in hierarchical mode.

[Copilot]

created_by is persisted in the schema, but Dolt reads always set created_by: None and the SELECTs here don’t include created_by. As a result, the field will never round-trip for Dolt backends (it will look unset everywhere except at write time). Update the relevant SELECT columns and row mapping to populate Bead.created_by (and do the same in the other Dolt bead queries in this file).

[Copilot]

created_by is being added to the Dolt schema, but this query mapping always sets created_by: None and the SQL SELECT doesn’t fetch it. This makes created_by effectively write-only for Dolt. Include created_by in the SELECT and map it into Bead.created_by so clients can actually observe it.

Suggested change

	created_by: None,
	created_by: row.try_get("created_by").ok(),

[Copilot]

has_commits is computed via git log ... --not origin/HEAD. Many repos don’t have origin/HEAD configured (or it may not point at the intended default branch), which will make this command fail and incorrectly treat the worktree as having no commits (leading to an unintended closed transition). Prefer comparing against a concrete base ref like origin/main / configured default branch, and treat a missing remote ref as an indeterminate state rather than no commits.

[Copilot]

orchestrators is keyed by bead_id only, which reintroduces the cross-repo collision problem this PR is addressing (same bead ID in different repos would overwrite the orchestrator). Key this map by a composite identifier (e.g., BeadRef or (repo, bead_id)) and update lookups accordingly.

[Copilot]

tick() returns Idle whenever state is AwaitingWorker and worker_handle is None (comment says the reconciler owns the handle). But on_worker_completed() transitions into Synthesizing/AwaitingWorker for the next phase without setting a handle, so the orchestrator will also return Idle when it actually needs the reconciler to spawn the next agent. Consider modeling a separate “NeedsSpawn”/“AwaitingSpawn” state, or have AwaitingWorker with worker_handle: None return NeedsSpawn for the current agent/phase.

[Copilot]

Pull request overview

Copilot reviewed 50 out of 50 changed files in this pull request and generated 11 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Dolt bead reads are discarding the new created_by and scope fields (always None/empty). This makes the new columns effectively write-only and breaks round-tripping for Dolt-backed repos. Update the SELECTs to include created_by/scope and populate these fields from the row (with sensible defaults for pre-migration DBs).

Suggested change

	created_by: None,
	scope: String::new(),
	created_by: row.try_get("created_by").ok(),
	scope: row.try_get("scope").unwrap_or_default(),

[Copilot]

list_beads is constructing Bead with created_by: None and scope: "", so Dolt-backed beads will never surface creator/scope metadata even after the migrations. Include created_by/scope in the query and read them from the row (using try_get + defaults for older schemas).

[Copilot]

The Dolt sandbox issues schema used in tests adds created_by but does not add the new non-null scope column (which is now part of BEADS_SCHEMA and create_bead_full). This will diverge from production schema and can cause test DB setup / inserts to fail once scope is exercised. Add scope VARCHAR(255) NOT NULL DEFAULT '' here as well.

Suggested change

	created_by VARCHAR(255),
	created_by VARCHAR(255),
	scope VARCHAR(255) NOT NULL DEFAULT '',

[Copilot]

FeatureOrchestrator::tick() always pulls self.pipeline.first() and hardcodes phase: 0, so the orchestrator can only ever request the first worker. After phase advancement, it will never emit another NeedsSpawn, stalling hierarchical mode. Use self.current_phase when selecting the next agent/phase and consider a separate state (e.g. ReadyToSpawn) so tick() can request spawns for later phases as well.

Suggested change

	// First tick — request the first pipeline agent.
	if let Some(agent) = self.pipeline.first().cloned() {
	let decision = self.session_decision(&agent);
	self.state = OrchestratorState::AwaitingWorker {
	agent: agent.clone(),
	phase: 0,
	};
	TickOutcome::NeedsSpawn {
	agent,
	phase: 0,
	// Request the pipeline agent for the current phase.
	let phase = self.current_phase;
	if let Some(agent) = self.pipeline.get(phase).cloned() {
	let decision = self.session_decision(&agent);
	self.state = OrchestratorState::AwaitingWorker {
	agent: agent.clone(),
	phase,
	};
	TickOutcome::NeedsSpawn {
	agent,
	phase,

[Copilot]

After a successful worker, on_worker_completed() transitions to Synthesizing or AwaitingWorker for the next agent, but tick() returns Idle when worker_handle is None. Since reconciler-managed handles are not set on the orchestrator, this prevents the next phase from ever spawning. Consider transitioning to a spawn-requesting state (or making tick() emit NeedsSpawn when awaiting a worker but no handle exists yet).

Suggested change

	let next_agent = self.pipeline[next_phase].clone();
	if self.config.synthesis {
	self.state = OrchestratorState::Synthesizing;
	} else {
	let decision = self.session_decision(&next_agent);
	self.state = OrchestratorState::AwaitingWorker {
	agent: next_agent,
	phase: next_phase as u32,
	};
	// Decision is used on the next tick().
	let _ = decision;
	}
	} else {
	self.worker_handle = None;
	let next_agent = self.pipeline[next_phase].clone();
	if self.config.synthesis {
	self.state = OrchestratorState::Synthesizing;
	} else {
	let decision = self.session_decision(&next_agent);
	self.state = OrchestratorState::NeedsSpawn {
	agent: next_agent,
	phase: next_phase as u32,
	decision,
	};
	}
	} else {
	self.worker_handle = None;

[Copilot]

recover_orchestrators() is scanning the repo root for directories named .rsry-ws-*, but workspaces are currently created under ~/.rsry/worktrees/{repo}/{id} (see workspace_dir). As written, crash recovery will not find persisted orchestrator records. Reuse the same workspace path derivation as the workspace module (or persist the exact workspace path and scan that location).

[Copilot]

These lookups allocate new Strings on every call (repo.to_string(), bead_id.to_string()), which can become a hot-path regression during triage/backoff checks. Consider introducing a key newtype with Borrow support (or storing an interned/Arc key) so HashMap::get/HashSet::contains can be done with (&str, &str) without allocations.

[Copilot]

get_bead similarly hardcodes created_by: None and empty scope, which prevents the new fields from round-tripping for Dolt. Update the SELECT to fetch these columns and populate them on the returned Bead.

[Copilot]

Target-bead mode derives target_repo from self.trackers and falls back to "". With repo-aware backoff keys, this can incorrectly treat a bead as having no pending backoff (and exit early) if the tracker entry is absent or removed. Consider storing the repo alongside target_bead (or adding a has_backoff_any_repo(bead_id) helper) so target mode can reliably detect pending retries.

[Copilot]

mache_call() builds a new reqwest::blocking::Client for every tool invocation. Since the mache tiers can call this repeatedly (per symbol), this adds avoidable overhead and can amplify timeouts. Consider reusing a single client (lazy static / once_cell) and/or adding a small connect timeout and a cap on the number of symbols queried per run.