feat(runtime): allow best-effort success with a secret-withheld report

[aviggiano]

Under the default best-effort completion policy, a final report rejected by the artifact secret gate no longer fails an otherwise successful campaign. The rejected report remains unavailable, its task remains failed, and ultrafuzz resume <run-id> --retry-failed regenerates it. Strict completion and other report verification failures still fail the campaign.

Apply the same policy to reports generated by multiple models and dynamically expanded report groups. Only failures fully explained by withheld reports are tolerated; ordinary failures, unfinished work, and missing task evidence remain blocking. Document the distinction between campaign success and report availability in the CLI, configuration, report, and security references.

Validation: runtime build and test compilation; four model-fanout integration cases; three single-report policy cases; two retry-recovery regressions; five focused aggregate-state tests covering missing, stale, unfinished, and independently failed children; strict lint, formatting, and documentation checks. Full CI must pass before merge.

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Best-effort campaigns can now succeed when the secret gate withholds their final reports.

• Best-effort campaigns can succeed when the secret gate withholds a report.

Review used source and test inspection; no tests were executed.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Final report verifier fails] --> B{Secret gate rejection?}
  B -->|No| C[Campaign fails]
  B -->|Yes| D[Report stays unavailable]
  D --> E{Strict completion?}
  E -->|Yes| C
  E -->|No| F{All other required work succeeded?}
  F -->|No| C
  F -->|Yes| G[Campaign succeeds; report task stays failed]
  G --> H[Retry failed tasks to regenerate report]

Loading

_{Reviews (1) · Last reviewed commit: "docs: clarify successful campaigns with ..." · Reviewed by Greptile}