[lukisch]

Summary

Addresses Ticket T-20261108-938423777:

1. Resume Guarantee Hardening (o1 finding):
   • Enclose pause and execution loop inside try/finally in worker.py.
   • Register all running providers before pause in to_resume; guarantee resume() is called in finally regardless of whether pause() returned True or False (e.g. process termination delays / 1.5s timeout).
   • Log warning/error if pause() or resume() fails or throws an exception.
2. Permanent Failure Handling & Fix Ticket Hook:
   • Tasks that fail permanently (blocked or failed_permanent) are audited in data_dir/failed.txt.
   • Support optional on_permanent_failure hook command template with placeholders {task_id}, {op}, {src}, {dst}, {error} (default None / OFF).
   • failure_reported: bool = False field on Task ensures reporting is strictly idempotent (at most once per task).
3. CLI Commands:
   • clf cancel : safely cancels a pending or blocked task (sets status to failed, last_outcome = permanent and failure_reported = True, saving queue.json).
   • clf list --failed: filters display to only failed and blocked tasks.
   • clf list --status : filters display by exact status.
4. Internationalization & Testing:
   • Complete tier-2 translations across 6 languages (DE, EN, ES, JA, RU, ZH) in i18n.py and locales/translations.json.
   • 13 new unit tests in tests/test_permanent_failures_and_cli.py (total 442 tests, 100% green, 0 real processes touched).
   • Documentation and contract test parity updated.

[github-actions]

Welcome! Thanks for your first pull request in this repository.

A maintainer will review it soon. Please make sure:

• Your changes are tested
• Documentation is updated if needed
• The PR description explains what changed and why

Thanks for contributing.

[lukisch]

Independent Second-Instance Review (Gemini Router)

Verdict: \APPROVE\ (after security & edge-case fixes in \�e1a8c3)

Verified Checks

• Pytest: 439 passed, 4 skipped, 0 failed (443 collected items)
• Ruff: All checks passed (0 errors)
• Translations Parity (\manage_translations.py --check): Passed (100% parity across all 6 languages: DE, EN, ES, JA, RU, ZH)
• Hermetic Isolation: All 14 new unit tests in \ ests/test_permanent_failures_and_cli.py\ use \FakeProvider\ and mocks (no real sync client processes started or stopped).

Resolved Review Findings (\�e1a8c3)

1. [HIGH] Command/Argument Injection in \on_permanent_failure: Removed \shell=True, tokenized command template via \shlex.split, passed contextual arguments safely with \shell=False\ and \CLF_*\ environment variables, and added \ est_on_permanent_failure_hook_injection_safety.
2. [MEDIUM] Defensive Directory Creation: Added \data_dir.mkdir(parents=True, exist_ok=True)\ prior to writing \ailed.txt.
3. [LOW] CLI Clarity & Idempotency: Added localized
   o_tasks_with_status\ message across all 6 languages and made \cancel_task\ idempotent on already failed tasks.

Note: PR remains in Draft state awaiting owner merge decision.