A broken run doesn't cost you the whole run

plan and design cleared their gates; four minutes into build, the tests gate comes back red. Cadora stops the run right there — it never lets a failed gate flow downstream. What matters for recovery: the workspace and the partial archive are left intact under runs/<id>. The two green stages are done; only build and below are unfinished.

Nothing is lost. The workspace still holds everything plan and design wrote, and the run's fingerprint is recorded. You resume from build — not from zero.

Point Cadora at the node you want to restart at. --resume-from build skips every node upstream of build — trusting their artifacts already in --cwd — then re-runs build itself and everything downstream. First, though, it verifies that trust: the current workspace is checked against the fingerprint of the run being resumed, and only a clean match proceeds.

Need finer control than a resume point? --skip plan,design names the trusted nodes directly — the same "trust their existing workspace artifacts" contract, one node at a time.

Resuming trusts the skipped nodes' artifacts. So Cadora makes that trust checked, not silent: if the workspace drifted since the run you're resuming — a file edited, something added or cleaned — it refuses, rather than certify gates over source that never passed the earlier stages. The refusal names exactly what moved.

You can override — deliberately. --allow-drift proceeds, and the drift is recorded in the evidence pack either way, so the resume stays honest about the ground it stood on.

Default is refuse. The drifted-workspace path is opt-in and self-documenting — the evidence pack shows the resume ran against a workspace that no longer matched its baseline.

Instead of stopping at the red gate, --remediate 2 feeds the failing gate's own output into a fresh, constrained session and re-runs — up to two attempts. Attempt 1's fix doesn't hold; attempt 2 clears it. Crucially, "cleared" is decided by re-running the same gate:tests check — not by the agent reporting success. The node completes green, tagged with its attempt count.

Each attempt runs in its own fresh, constrained session told not to weaken, skip, or bypass the gate. A gate that passes having run zero tests is a vacuous pass, not a fix — and it doesn't count as green.

Remediation is bounded, and a bound hit never becomes a fabricated pass. Exhaust the attempts and the run stops honest-blocked — the full attempt trail preserved, the gate still red. Add --remediate-max-cost 5.00 and it stops before the next attempt would cross the ceiling, rather than over-spending toward a fix that may not come.

Missing tooling is never handed to the loop: a blocked_prerequisite gate is not agent-repairable, so remediation doesn't engage — it stays truthfully blocked.

The run-detail view makes the two kinds of node unmistakable. Skipped nodes are badged trusted — dashed, muted, not re-run this run. The resume point and everything below are fresh — re-executed, gated green. A banner marks where the run picked up and what it verified against.