Concurrency Mission Control

Component turns quiet

concurrency_mission_control turns that moment into a checkable verdict.

Copies real coordination

It copies the real coordination builder and bridge fixtures, runs them over synthetic lanes and a work log seed-speed snapshot, and emits metadata-only records of refs, digests, and verdicts. The component imports the real coordination specimen builder and its public provider and work log bridge fixtures as exact copies, runs the copied builder over synthetic multi-agent lanes, and reads a public snapshot of the work log's seed-speed topology. It emits metadata-only result records: refs, digests, counts, and verdicts, with no session bodies, model-output data, or proof text.

Is no live

It is no live scheduler, private runtime, or production safety evidence; it demonstrates fail-closed transaction gating over declared copied bodies and fixtures. It is not a live scheduler, not the private mission-control runtime, not external model access, and outside production claims concurrency-safety evidence. It demonstrates fail-closed transaction gating over declared copied bodies and fixtures.

Purpose

Is acting on a dirty path safe

Given a dirty path and its live claim topology, each case resolves to one named classification and one allowed action, so a lane proceeds, hands off, or waits. The question the component answers is narrow: given a dirty path and the live claim topology around it, is acting on that path safe, and if not, what must happen first. A loose answer like "probably fine" is exactly the failure mode. Each case resolves to a named classification and one allowed action, so a lane can decide to proceed, hand off, or wait.

Real builder and two cautious classifiers

The evidence runs the real specimen builder over synthetic lanes, reading claims, heartbeats, and collisions, with two classifiers that default to the cautious verdict when evidence is thin. The evidence does not come from a re-implemented scheduler. The component runs the same specimen builder the private system uses, over public synthetic lanes, and reads who holds which claim, whether their heartbeat is current, and where path claims collide. Two classifier functions carry the judgment, and both default to the cautious verdict when the evidence is thin. That default is the behaviour the page is about.

How it works

Two entry points share one SPEC

run and run_concurrency_mission_control_bundle both hand a shared SPEC to run_crown_jewel_organ with _evaluate and evaluate_negative_case, the bundle validating the same contract from a shipped copy. run and run_concurrency_mission_control_bundle are the two entry points. Both hand a shared SPEC to run_crown_jewel_organ with _evaluate as the evaluator and evaluate_negative_case as the negative-case checker. The bundle entry sets input_mode to the exported bundle so a reader can validate the same contract from a shipped copy.

_evaluate runs the builder and five gates

_evaluate loads the exercise manifest, runs the copied builder, then five gates, passing only when all six engines pass and every expected engine id is present. _evaluate loads concurrency_mission_control_exercise_manifest.json, runs the copied builder, then runs five gates. It passes only when all six engines pass and every expected engine id is present.

The generated-surface lens and its verdicts

The generated-surface lens intersects drift paths with the generated entry surfaces, returning owned_live, owned_stale, unowned_generated_drift, unrelated_dirty_state, or clean with a matching allowed action. The generated-surface lens intersects a case's drift paths with GENERATED_ENTRY_SURFACES (ORGANS.md, ARCHITECTURE.md, AGENT_ROUTES.md, atlas/agent_task_routes.json). If a live owner holds one of those paths it returns owned_live with the action do_not_patch_from_sibling_lane. Drift on other paths is unrelated_dirty_state, and no drift is clean.

Separating closed from looks-closed

The closure-state lens folds classification, validation, commitability, and residuals to separate genuinely closed work from cases that only look done, defaulting to open_unclassified when evidence is insufficient. The closure-state lens folds that generated classification together with validation state, commitability, and any open residual. It separates closed_and_committed (product closed, validation complete, commit landed) from the cases that only look done: closed_validation_deferred when validation is parked under host pressure with a stated reason, closed_uncommitted_authority when event authority exists but shared append logs are unsafe to stage, false_residual_stale when a residual is left open against a passing generator check, and owned_live_handoff or owned_stale_reentry when a live or stale owner still holds the path. When the closure evidence is insufficient it returns open_unclassified, which is the default, so absent evidence never reads as success.

flowchart TD Builder["_run_original_builder copied specimen builder in temp seed root"] Matrix["_failure_matrix_gate counts and failure classes"] Membrane["_bridge_authority_membrane bridges green, authority-collapse zero, forbidden claims blocked"] Seed["_work_ledger_seed_speed_gate heartbeat, counts, collision-free claims"] Surface["classify_generated_surface_claim_lens owner live / stale / absent"] Closure["classify_concurrency_closure_state_lens closed vs looks-closed"] Record["metadata-only result record refs, digests, counts, verdicts"] Builder --> Matrix Builder --> Membrane Matrix --> Record Membrane --> Record Seed --> Record Surface --> Record Closure --> Record

Negative cases

Five cases that must each block

evaluate_negative_case drives five stable cases that must each block with a named code, and any non-block counts as a wrong-kind pass the checker treats as a failure. evaluate_negative_case drives five stable cases, each expected to block with a named code. missing_seed_root runs the builder against an empty temporary root and expects CONCURRENCY_MISSION_CONTROL_SEED_ROOT_MISSING. provider_bridge_missing sets the provider repair bridge status to missing and expects the authority membrane to block with CONCURRENCY_MISSION_CONTROL_PROVIDER_BRIDGE_BLOCKED. authority_collapse_claim sets an authority-collapse count of one and expects CONCURRENCY_MISSION_CONTROL_AUTHORITY_COLLAPSE. private_runtime_claim drops private_mission_control_runtime from the manifest's forbidden claims and expects CONCURRENCY_MISSION_CONTROL_PRIVATE_RUNTIME_OVERCLAIM. work_ledger_seed_speed_collision injects a claim collision into the seed-speed snapshot and expects CONCURRENCY_MISSION_CONTROL_WORK_LEDGER_COLLISION_UNRESOLVED. A case that does not produce its code counts as a pass of the wrong kind, so the checker treats a non-block as a failure.

Prior Art Grounding

Airflow, Kubernetes leases, two-phase commit

The design borrows coordination shapes from Airflow DAGs, Kubernetes leases, two-phase commit, and GitHub Actions concurrency, keeping only the fail-closed synthetic gating shape, not their runtimes. The component borrows established coordination shapes without claiming their runtimes. Apache Airflow DAGs separate task dependency and scheduling from task internals. Kubernetes lease-based leader election is the lease-holder and renewal pattern behind live-versus-stale owner state. IBM Research on two-phase commit is the transaction-consistency pattern under participant failure. GitHub Actions workflow syntax is the declared workflow-concurrency control. This component keeps only the fail-closed synthetic gating shape.

Validation Result record Path

From microcosm-substrate, validate with throwaway result outputs first:

What a pass proves, and drift repair

A pass proves fail-closed coordination evidence over the declared copied bodies and synthetic fixtures, with source-copy digest drift repaired through microcosm_exact_copy_refresh, not here. A pass means the fixture and bundle runs proved fail-closed coordination evidence over the declared copied bodies and synthetic fixtures. Source-copy digest drift is repaired through microcosm_exact_copy_refresh, not here.