Bug: collect-pr-context-shared-path-race-across-concurrent-children

[drmoisan]

• Work Mode: full-bug

Summary

mcp__drm-copilot__collect_pr_context reports artifact paths inside the caller's workspace_root but actually writes artifacts/pr_context.summary.txt and artifacts/pr_context.appendix.txt into the MAIN checkout. That is a single shared location for every concurrently running epic or parallel child, so two children that collect PR context at overlapping times silently overwrite each other. A child that then reads "its" context gets a sibling's branch, commits, diff, and evidence enumeration, with nothing in the return value indicating the substitution. Authoring a PR body from that content describes the wrong change on the wrong pull request.

The defect has two independent halves, and each is separately worth fixing: the tool reports a path it does not write, and the path it does write is unsafe for concurrent callers.

Environment

(not provided in potential file)

Steps to Reproduce

(not provided in potential file)

Expected Behavior

(not provided in potential file)

Actual Behavior

(not provided in potential file)

Logs / Screenshots

(not provided in potential file)

Impact / Severity

(not provided in potential file)

Source

From: docs/features/potential/2026-08-22-collect-pr-context-shared-path-race-across-concurrent-children.md

[drmoisan]

collect-pr-context-shared-path-race-across-concurrent-children (Issue #589)

• Date captured: 2026-08-22

• Author: Dan Moisan

• Status: Promoted -> docs/features/active/collect-pr-context-shared-path-race-across-concurrent-children/ (Issue Bug: collect-pr-context-shared-path-race-across-concurrent-children #589)

• Found during: epic child Bug: quickfiler-explorer-controller-latent-defects #449 PR authoring (epic quickfiler-suite-determinism-foundation)

• Issue: Bug: collect-pr-context-shared-path-race-across-concurrent-children #589

• Issue URL: Bug: collect-pr-context-shared-path-race-across-concurrent-children #589

• Last Updated: 2026-08-22

Summary

mcp__drm-copilot__collect_pr_context reports artifact paths inside the caller's workspace_root but actually writes artifacts/pr_context.summary.txt and artifacts/pr_context.appendix.txt into the MAIN checkout. That is a single shared location for every concurrently running epic or parallel child, so two children that collect PR context at overlapping times silently overwrite each other. A child that then reads "its" context gets a sibling's branch, commits, diff, and evidence enumeration, with nothing in the return value indicating the substitution. Authoring a PR body from that content describes the wrong change on the wrong pull request.

The defect has two independent halves, and each is separately worth fixing: the tool reports a path it does not write, and the path it does write is unsafe for concurrent callers.

Observed Failure

During epic child #449, the tool was invoked with workspace_root set to that child's worktree:

C:\Users\DanMoisan\repos\TaskMaster\.claude\worktrees\agent-a5600546d71e73061

It returned ok: true and reported these artifacts:

C:/Users/.../agent-a5600546d71e73061/artifacts/pr_context.summary.txt
C:/Users/.../agent-a5600546d71e73061/artifacts/pr_context.appendix.txt

Neither file existed at that path. Both had been written to C:/Users/DanMoisan/repos/TaskMaster/artifacts/ instead. When the files were copied from the main checkout into the child's worktree, their content belonged to a DIFFERENT child:

• Head ref (resolved): bug/quickfiler-test-form1-live-form-491-exec @ bec83397e8ef0280c86e70009087d945bf23ba3b — sibling child Bug: quickfiler-test-form1-live-form #491, not Bug: quickfiler-explorer-controller-latent-defects #449.
• The Additional context files section enumerated 14 artifacts under docs/features/active/2026-08-07-quickfiler-test-form1-live-form-491/.

Sibling #491 had run its own collect_pr_context in the interval between #449's collection and #449's copy. Both children were legitimately active in the same wave.

Why It Is Dangerous

• It fails silently and plausibly. The return value is ok: true, the files exist, and the format is correct. Nothing signals that the content belongs to another branch. The only way to notice is to compare the summary's resolved head SHA against the caller's own HEAD, which no contract currently requires.
• The consumer is a PR body. The pr-author skill is instructed to source content only from this bundle. A contaminated bundle therefore produces a confidently wrong PR description, attached to a real pull request, citing another feature's evidence files.
• The blast radius scales with concurrency. Epic runs default to 4 parallel children and permit up to 8; the parallel surface permits up to 32. Every additional concurrent child widens the race window.
• The reported-path/actual-path mismatch hides it. A caller that trusts the returned paths finds no file and may assume the call failed, rather than suspecting that a shared file elsewhere was written and then overwritten.

Impact

• Correctness of PR descriptions across every concurrent epic and parallel run.
• Auditability: a PR body citing a sibling's evidence paths corrupts the audit trail for both children.
• No production runtime code is affected; the damage is to process artifacts and the review record.

Proposed Direction (not yet decided)

1. Write where the caller says. Honor workspace_root and write the artifacts under that root. This alone removes the race, because each child's worktree is private. Verify the returned artifact paths are the paths actually written.
2. If a shared location must be retained for some caller, namespace the filenames by branch or by head SHA (for example pr_context.<head-sha>.summary.txt) so two children cannot collide.
3. Make the mismatch loud. If the tool cannot write to the requested root, it should report that as a non-ok result rather than returning success with paths it did not write.
4. Until fixed, the consuming contract in .claude/skills/pr-context-artifacts/SKILL.md should require the caller to verify ownership before use by asserting that the summary's Head ref (resolved) SHA equals the caller's HEAD.

Related Defects Observed in the Same Bundle

These are recorded because they affect the same file and the same consumer, and a fix should consider them together:

• The summary reports GitHub CLI unavailable: GitHub CLI (gh) is not installed even when gh is installed and authenticated. In the Bug: quickfiler-explorer-controller-latent-defects #449 run gh auth status succeeded and gh issue view 449 returned live data from the same session. The false report suppresses the verified autoclose list.
• The Auto-close issues (author asserted) list is unusable as a source of issue numbers. In the Bug: quickfiler-explorer-controller-latent-defects #449 bundle it contained #AC-1 through #AC-16 — acceptance-criterion identifiers scraped as issue numbers — alongside #136, #435, and #491, none of which were that child's to close.

Verification Notes

• Reproduce by invoking collect_pr_context with workspace_root set to any .claude/worktrees/<agent-id> path and then listing that path's artifacts/ directory.
• The race itself reproduces by invoking it from two worktrees in close succession and comparing Head ref (resolved) in the resulting file against each caller's HEAD.

Next Step

• Promote to GitHub issue (bug template)