fix(runtime): preserve exhaustive continuation policy and task integrity

[aviggiano]

New exhaustive runs can reconcile a partial report after the property-catalog aggregation group exhausts its attempts. The group now uses failure_policy: continue, and refreshed controllers derive optional dependency edges from the run's recorded graph for both static tasks and dynamic templates.

Publication and verification share the same derivation. Tasks whose policy is unchanged retain their exact serialized form, and verification accepts the exact pre-refresh recorded derivation as well as the refreshed derivation. Tampered optional edges remain rejected.

Scope: refresh repairs missing optional metadata already authorized by the saved graph. It does not replace a historical run's sealed halt policy with the latest packaged topology. Related to #1292; migration of those older halted runs remains separate.

Validation:

• 25 dynamic-expansion tests, including refreshed-policy integrity, legacy readability, and tamper rejection.
• 14 packaged-topology tests and 2 compiler/current-controller regressions.
• The 3 previously failing dynamic lifecycle tests.
• Runtime build, test compilation, strict ESLint, and formatting.

Confidence Score: 5/5

The PR appears safe to merge; the remaining test-coverage suggestion is non-blocking.

Findings

1.  Dynamic templates go untested ▶

Fix with agent prompt

### Issue 1
packages/runtime/test/runtime.test.ts:11263-11267
This test only checks tasks in `tasks.tasks`. It never supplies `dynamic_groups`, so it does not cover the new call to `applyCurrentDependencyPolicy` on `taskTemplates`. That branch could stop applying the policy while this test stays green.

Add a dynamic template that depends on a newly continuing static producer. Assert that its serialized `optionalDependencyArtifactDirs` includes that producer.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR lets new exhaustive runs continue after property-catalog fails.

• Exhaustive audits continue after the property-catalog group runs out of attempts.
• Dynamic refresh restores optional inputs allowed by the run's sealed graph.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  G[Sealed graph policy] --> P[Shared optional-input rule]
  T[Recorded tasks and templates] --> P
  P --> C[Refreshed controller]
  P --> D[Dynamic task publication]
  D --> V[Compare full tasks and graph]
  T --> L[Recorded derivation fallback]
  L --> V

Loading

_{Reviews (2) · Last reviewed commit: "Merge remote-tracking branch 'origin/uns..." · Reviewed by Greptile}

[greptile-apps]

Dynamic templates go untested

This test only checks tasks in tasks.tasks. It never supplies dynamic_groups, so it does not cover the new call to applyCurrentDependencyPolicy on taskTemplates. That branch could stop applying the policy while this test stays green.

Add a dynamic template that depends on a newly continuing static producer. Assert that its serialized optionalDependencyArtifactDirs includes that producer.

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/runtime/test/runtime.test.ts
Line: 11188-11192

Comment:
**Dynamic templates go untested**

This test only checks tasks in `tasks.tasks`. It never supplies `dynamic_groups`, so it does not cover the new call to `applyCurrentDependencyPolicy` on `taskTemplates`. That branch could stop applying the policy while this test stays green.

Add a dynamic template that depends on a newly continuing static producer. Assert that its serialized `optionalDependencyArtifactDirs` includes that producer.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!