Production Parallel Lifecycle

parallel-specialists is planning-only until schema-v2 production lifecycle reaches complete and shared artifact validator reconciles it. The exact-plan dispatch record, including workflow-default, proves only the chosen route; it never proves execution, integration, or source application and must not be described as plan-specific user approval. The route is local to code-remediate, and generic write_parallel_promoted remains false.

Inspect PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/parallel_worktrees.py --help, then use its parent-owned commands in this order: prepare, one create-handover per terminal child, one join containing every handover file, one collect per joined node, integrate, reconcile if integration reports a collision, apply-source, then cleanup. Handover and reconciliation files must remain inside source-local run directory. If selected work is indivisible, dependent, or capacity is unavailable, use an available parent-owned or sequential route and record the concrete reason and actual mode. Do not ask permission to use that fallback. Unsafe operations still stop at the affected action unless a verified isolation alternative makes them safe.

Preparation requires no merge, cherry-pick, revert, or rebase in progress and no unmerged index entries; exact plan and dispatch-record digests; matching baseline HEAD/tree; exact new lifecycle-state basename in plan/run directory; two to four independent buckets; concrete owned paths with only exact shared-file overlap; compatible resource locks; actual source-local context-pack paths and SHA-256 values; fixed code-remediate-shared-quality-gates reference; and generated detached worktrees. Tracked, staged, and untracked source changes may remain when they do not overlap owned paths or paths an operation may overwrite; record their baseline state and preserve them. Reject an operation only when it has a concrete damage mechanism on an identified path and no safe isolation alternative. Re-hash every context pack at preparation and each authority transition. Reject arbitrary bucket fields such as plan-driven shell commands, caller-selected or pre-existing state/output paths, source drift, path aliases or ancestor overlap, symlinks, ignored or untracked child output, commits, staged child content, deletes, renames, file-mode/type changes, undeclared paths, or operation-state changes. Every declared owned path is required to change.

Use the supported sibling .codex-rig-worktrees location or a source-local Git-ignored .reports/codex/code-remediate-worktrees/<run-id> root, preferring source-local when available. A worktree root must resolve to the source repository or one child directory, must not traverse a symlink or escape its allowed boundary, and the run-specific root must not already exist. Do not broaden filesystem permissions to make a root eligible.

Each parallel child context pack must preserve zero ignored or untracked output at handover by naming exact no-cache or no-output verification commands for every required child check. Prefer tool-native flags or environment controls that suppress disposable caches, coverage files, bytecode, reports, and equivalent generated output; parent integration still runs the authoritative shared quality gates after source application. Before hashing the plan, preflight every exact child verification command against the unchanged baseline in a disposable clean worktree; require unchanged tracked files and zero ignored or untracked output. Record expected baseline regression failures separately from command-launch, configuration, or output-boundary failures; a failing assertion that the selected fix must repair does not block dispatch. Do not create planned postimages before dispatch. Freeze only byte-identical command text that passed preflight’s command and output-boundary checks. Changing a command or its environment after preflight requires a new plan digest and dispatch record. A child must not delete verification output after the command because deletion would hide an observed boundary violation. When a required check cannot meet the output boundary, record the concrete limitation and continue that work parent-owned or sequentially without an approval prompt.

Freeze one dependency-ready wave before child dispatch. Each child receives one worktree; its terminal handover contains canonical status, summary, changed paths, and patch SHA-256 without committing.

After implementation and before handover, require exit zero on every exact approved child check, unchanged intended tracked postimages, and zero ignored or untracked output. Expected baseline regression failures are no longer acceptable at this stage. A failing postimage check blocks handover and integration; preserve its evidence and return control to parent. This postimage gate precedes structural collection and integration steps below.

The parent re-derives every patch from child worktree, validates its report and exact ownership, joins all required terminal handovers, then applies parent-derived patches to separate integration worktree in lexical bucket ID order. Exact shared files may integrate without conflict. On a patch collision, leave authoritative source untouched and record needs-reconciliation; the parent resolves the integration worktree, writes a run-local record binding the baseline, joined patch hashes, failed node, approved paths, and final postimage hashes, then runs reconcile to verify it before source application. A missing or invalid reconciliation blocks completion. Lifecycle integration verifies Git structure, exact paths, and postimage hashes and records structurally-verified; it does not execute or claim plan-provided commands. After parent source application, run existing shared quality-gate phase and require its validated gates.json before passing remediation result.

Only the parent may apply the integrated bundle to the authoritative repository. Immediately before application, recheck the exact HEAD/tree, clean operation state, and every approved path preimage. Persist one durable reverse patch plus its SHA-256 before writing; preflight one parent-generated forward bundle; apply it once; then verify every expected postimage. This is parent-authoritative operational postcondition containment with capability_sandbox_verified=false, not per-child capability isolation and not a hostile-child security boundary. Without a repository-wide external lock, source application is conditionally reversible rather than globally atomic.

If any affected path after apply failure matches neither its recorded preimage nor expected postimage, record rollback-ambiguous, retain all worktrees and patches, and stop without automatic restoration. Otherwise restore only known approved paths to frozen baseline, recompute every path hash, and record failed-rolled-back only when all restored hashes equal frozen preimages; restore error or mismatch becomes rollback-ambiguous. Retain durable reverse patch as independent recovery evidence. Perform non-force cleanup only after durable source application and exact postcondition verification; cleanup failure retains evidence and blocks completed.

Bind the final lifecycle projection into CODE_REMEDIATE_METADATA.resolution_workplan.production_lifecycle with its run-relative path, SHA-256, and status. The projection must reconcile the plan digest, baseline, joined node/path/patch hashes, every retained parent-derived child patch, deterministic structural integration order, source preimages/postimages, the retained parent forward bundle, source-application status, rollback artifact, cleanup outcome with force=false, and containment limitation. Never emit a completed remediation result from plan metadata alone or without passing shared-gate evidence.