From 3517cd8724b80cecec9a7cae7efd5747ce6993bf Mon Sep 17 00:00:00 2001
From: mptyl <mp@tylconsulting.it>
Date: Tue, 11 Aug 2026 19:37:11 +0200
Subject: [PATCH] fix: treat operator checkpoint exit 3 as a valid machine
 result

---
 tools/thothctl/internal/workspaceops/operations.go | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/tools/thothctl/internal/workspaceops/operations.go b/tools/thothctl/internal/workspaceops/operations.go
index 553a6299..f4fe2c9c 100644
--- a/tools/thothctl/internal/workspaceops/operations.go
+++ b/tools/thothctl/internal/workspaceops/operations.go
@@ -292,7 +292,10 @@ func Execute(ctx context.Context, installation config.Installation, runner Runne
 		return Result{}, err
 	}
 	result, err := runDocker(ctx, runner, StageComposeRun, args, bytes.NewReader(stdin))
-	if err != nil {
+	// The operator deliberately exits 3 for expected operator checkpoints/blocks
+	// (manual_review_required, evidence_materialization_required, lock/revision conflict).
+	// That exit is a valid machine result: the JSON payload on stdout is still authoritative.
+	if err != nil && !isExpectedOperatorExit(result, err) {
 		return Result{}, err
 	}
 	response, err := parseResponse(result.Stdout)
@@ -722,6 +725,14 @@ func ownedContainerName(installation config.Installation, request Request) strin
 	return strings.Join(parts, "-")
 }
 
+func isExpectedOperatorExit(result compose.Result, err error) bool {
+	if err == nil || result.ExitCode != 3 {
+		return false
+	}
+	var operationErr *OperationError
+	return errors.As(err, &operationErr) && operationErr.class == ExitClassNonzero
+}
+
 func runDocker(ctx context.Context, runner Runner, stage Stage, args []string, stdin ...io.Reader) (compose.Result, error) {
 	var input io.Reader
 	if len(stdin) > 0 {