[Bug]: Pipeline stages can skip links and accept artifacts written by the conductor

[akash-doshi]

Summary

Pipeline stages can repeat an earlier link, skip the final link, and still produce artifacts that look complete to the deterministic guards. The write audit records the tool and file but not the required pipeline actor, so conductor-written files can satisfy the same evidence as files written by the expected agent.

Enterprise customer feedback from a brownfield multi-repo microservices system exposed this sequence:

• The lead pipeline link ran four times.
• The required final link did not run.
• The conductor wrote the full declared artifact set.
• The stage guard could not distinguish those writes from valid final-link output.

The lifecycle state remained safe because the gate was never reached. The artifact store still accepted output from the wrong actor.

Reproduction matrix

Use a two-link pipeline and a two-repository intent. Exercise these cases:

Case	Expected result
Interrupt after link 1	Resume at link 2 without repeating link 1
Final link never runs	Gate remains closed
Conductor writes a declared final-link artifact	Write cannot satisfy final-link provenance
One repository has all artifacts, another is missing one	Completion guard refuses the stage
A repository has approved reuse evidence	Reused repository is exempt, remaining repositories are still complete

Current behavior has no durable link receipt, accepts actorless writes, and treats one matching CodeKB artifact as enough for Reverse Engineering.

Expected behaviour

• Pipeline links run once and in the declared order.
• Recovery resumes from the first missing link.
• The final link owns the declared stage artifacts.
• Completion requires every declared artifact for every selected repository.

Actual behaviour

• Pipeline ordering exists only in conductor guidance.
• There is no durable receipt for link completion or final-writer identity.
• Any Write or Edit can create the same native-write evidence.
• Reverse Engineering can pass its artifact precondition when only one matching file exists in one repository.
• Multi-repository produces paths can point at the workspace root instead of the registered repository set.

Root cause

• harness/copilot/skills/aidlc/SKILL.md:86,92,113 leaves pipeline dispatch and ordering to conductor prose.
• core/aidlc-common/stages/inception/reverse-engineering.md:43-48,150-194 requires developer then architect execution, but no link receipt enforces it.
• core/hooks/aidlc-write-audit-log.ts:133-168 records the tool, file, and context without the expected pipeline actor.
• core/aidlc-common/protocols/stage-protocol.md:817-819 does not require contribution evidence for pipeline stages.
• core/tools/aidlc-state.ts:1203-1209,1270-1356 accepts any matching artifact instead of the complete per-repository set.

Proposed remediation

The ask is durable link receipts plus actor-bound artifact writes:

• Record a durable receipt for each pipeline link with stage, link, agent, status, and output-summary hash.
• Recover at the first missing link instead of redispatching the lead.
• Bind native writes for declared artifacts to the expected active pipeline actor.
• Reject conductor writes to declared artifacts unless the stage explicitly permits conductor ownership.
• Resolve the active repository set from the intent registry before building produces paths.
• Require the full declared artifact matrix for all selected repositories, while retaining the existing human-approved reuse path.

Acceptance criteria

• A completed lead link is not repeated after interruption or restart.
• A missing final link is dispatched before the stage can open its gate.
• Conductor-written artifacts cannot satisfy final-link provenance.
• Reverse Engineering requires every declared artifact for every selected repository.
• Multi-repository output paths come from the active intent registry.
• Tests cover interruption after each link, missing-link recovery, wrong-actor writes, reuse exemptions, and incomplete repository matrices.

Verification plan

Extend these tests:

• tests/unit/t182-codekb-placement.test.ts for registered multi-repository output paths.
• tests/unit/t116-directive-path-resolution.test.ts for directive construction.
• tests/integration/t185-stage-artifact-guard.test.ts for the complete per-repository artifact matrix.
• tests/unit/t170-audit-logger-per-intent.test.ts for actor-bound write evidence.
• tests/integration/t166-multi-repo-construction.test.ts for multi-repository setup.
• tests/unit/t205-gate-revision-backstop.test.ts for gate refusal and approved reuse.
• tests/unit/t249-copilot-adapter.test.ts for Copilot write attribution.

Run:

bun test \
  tests/unit/t182-codekb-placement.test.ts \
  tests/unit/t116-directive-path-resolution.test.ts \
  tests/unit/t170-audit-logger-per-intent.test.ts \
  tests/integration/t166-multi-repo-construction.test.ts \
  tests/integration/t185-stage-artifact-guard.test.ts \
  tests/unit/t205-gate-revision-backstop.test.ts \
  tests/unit/t249-copilot-adapter.test.ts

Add a dedicated pipeline recovery test that persists link, actor, repository, and output-summary evidence. It must fail when the conductor writes agent-owned output or when any required repository artifact is missing.

Related issue

#739 prevents the repeated final stage directive that exposed this missing pipeline state.

Environment

• AI-DLC v2.5.60 at e3bf9be
• Copilot CLI 1.0.x
• Brownfield multi-repo microservices system

[akash-doshi]

Additional evidence and trust-boundary correction

A second enterprise customer session provides independent evidence that raw artifact audit rows cannot establish writer provenance.

The conductor directly invoked the write-audit hook in 13 command groups and created 39 artifact write events. These were structurally valid audit rows, but they did not prove that a native host write occurred or that the expected pipeline actor produced the artifact.

This corroborates #741, but it also requires a correction to the proposed remediation: ordinary command hooks running as the same OS user as the model cannot provide non-forgeable host attestation.

The revised approach is:

1. Persist one ordered pipeline-link state with stage, link, repository set and single-use operation ID.
2. Resume at the first missing link rather than redispatching the lead.
3. Require the final-link receipt and complete per-repository artifact matrix before completion.
4. Do not allow a raw ARTIFACT_CREATED or ARTIFACT_UPDATED row to satisfy pipeline-link provenance by itself.
5. Treat current hook-produced write rows as observational evidence.
6. Keep true tamper-resistant actor attestation as a separate host-broker or sandbox requirement.

The immediate acceptance criteria remain practical: repeated links are denied, missing links resume correctly, conductor-written files cannot satisfy final-link completion, and every selected repository must have its complete declared artifact set.

Ask: keep #741 focused on pipeline ordering, recovery and completion integrity. We should not claim cryptographic actor provenance from the current hook architecture.