Repository navigation
System improvements campaign: paired v16, runner hardening, human-review policy (stacked on #61) - #64
Draft
Aram164 wants to merge 18 commits into
Conversation
LOS-CI-Bootstrap: codex/system-improvements-20261027
LOS-CI-Bootstrap: codex/system-improvements-20261027
LOS-CI-Bootstrap: codex/system-improvements-20261027
Use schema admission and one production preflight/readiness port; move runner transport out of the CLI script. Bound lock waits and subprocesses by the remaining deadline without process environment mutation, preserve append-only checkpoint corrections, and remove parallel worker recovery modes. Declare task dispatch explicitly and collapse cache traits. Legacy worker counts remain accepted with serial execution; explicit plan version one requires migration.
…gine oracle ReportStore.record/correct append before sync can raise: the live row was relabelled ARTIFACT_FAILED while the checkpoint kept the ok event, so a recovered finalization disagreed with recovery evidence. Relabelled recorded rows are now reconciled with an append-only correction, unresolved reconciliations stay pending, and finalization refuses while any are outstanding. Unrecorded rows are never corrected and committed receipts are preserved. Freeze the d3d3b35 bytes of agent-plan-input.schema.json and task-scope.yaml in engine-contract-inputs: both are inventory inputs to the historical oracle but only their current bytes were present, leaking runner contract changes into all six neutrality cases.
Aram's 2026-10-27 decision: add human-review policy now; leave PRs for me. An agent operating rule only; no GitHub settings or identity provisioning changed.
LOS-CI-Bootstrap: codex/system-improvements-20261027
Regenerate surface.json for opcontext.session_id and opcontext.lock_timeout_s and add their single-use approval lines citing Aram's 2026-10-27 implementation authorization (hosted rest-2 failure in run 40552226102). This file is protected under OPERATOR-POLICY section 15; the lines record implementation authorization only and the PR remains Aram's to review and merge. LOS-CI-Bootstrap: codex/system-improvements-20261027
All 19 diffs were inspected line by line: manifest-v16 added to the backup inventory (256 to 257 entries), data-contract 62, task-scope entry_verb fields (item 15), health/bootstrap contract v16, and fixture commit hashes that follow the changed contract bytes. No status, error, or effect changed. Recorded with LOS_RECORD_SCENARIOS=1 for exactly those cases; the full scenario file was verified before and the subset after. LOS-CI-Bootstrap: codex/system-improvements-20261027
…ent state Retention counted an unfinalized marker report as disposable, so a crash after an uncertain write could lose the runner's only execution evidence to routine pruning. Unfinalized reports now occupy retention slots but are never deleted; only digest-bound finalized reports are pruned. dependency_ready's final observation now verifies the publication against canonical state instead of trusting the stored pair; the cheap unverified read remains only as an early hint. Both fixes carry regression tests from the 2026-10-27 engineering review.
…selines OD15: _json, _cluster_summary, _step_argv and _field crossed module boundaries; they are now public encode_json, cluster_summary, step_argv and field_value at their owner. A2: two non-canonical write sites (temporary envelope copy, disposable report pruning outside the data root) are recorded as approved exceptions. The OpContext spec list names the item 8 session_id and lock_timeout_s members. These were the hosted rest-1 failures in run 40557977568.
The gate compared test counts, which a duplicate plus an omission satisfies; it now maps every JUnit testcase to its canonical node ID and requires multiset equality with the fresh collection. The witness merge refuses same-named audit logs instead of overwriting. The dispatched UI SHA must equal Core's .github/ui-revision.txt pin. system_check_passed is caller-asserted via --system-check-passed (the gate passes it only after its own gates ran in that job) instead of an unconditional true; the receipt remains an artifact-integrity record, not CI provenance. Scenario recordings shift only for the receipt schema bytes and derived fixture commits. The agent-plans procedure now states the receipt-based dependency rule explicitly. LOS-CI-Bootstrap: codex/system-improvements-20261027
validate.yml still compared test counts while release-pair.yml compared node-ID multisets. The proof (manifest partition plus canonical node-ID multiset equality) now lives in tools/check_shard_completeness.py, invoked identically by both workflows, with a workflow test pinning both call sites. LOS-CI-Bootstrap: codex/system-improvements-20261027
A8 requires every tool to expose build_parser(); the parser was built inline in main (hosted rest-2 failure in run 40566122313). LOS-CI-Bootstrap: codex/system-improvements-20261027
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #61 (
codex/runner-write-classification-20261027) — review/merge #61 first, then this PR. Paired UI PR: Aram164/learningos-obsidian-ui#9Integrated system-improvements campaign (49-item disposition is recorded in the campaign outcome update). Commits above
17ce3dbimplement: paired-CI pins and branch-scoped bootstrap hook, manifest v16 strict schema pair, bounded report retention with append-only corrections, projection concurrency/immutable publication/read epochs, shared expansion/retention lease, historical-evidence digest pool with CLI usage normalization and the synthetic benchmark, and serial runner execution with deadline controls.Final repairs in this push:
ReportStoresync failure after the checkpoint append relabelled only the live row, so a recovered finalization could disagree with checkpoint recovery evidence. Relabelled recorded rows are now reconciled with an append-only correction; unresolved reconciliations stay pending and finalization refuses while any are outstanding. Unrecorded rows are never corrected; committed receipts are never erased. Regression tests cover one-shot failures after record and correction appends, persistent failure, and failure before append.agent-plan-input.schema.jsonandtask-scope.yamlare inventory inputs to the historical oracle but their current bytes were leaking in. Their d3d3b35 bytes are now frozen inengine-contract-inputs.json; all six cases match the unchanged oracle again..github/ui-revision.txtpins final UI3c9a5f664c147790c490fae0a256e7764b4b9157.system/OPERATOR-POLICY.mdsection 15 records Aram's 2026-10-27 human-review decision. It is an agent operating rule only: no GitHub settings, identities, or enforcement were changed, and no approval is claimed.Local verification on the exact heads: canonical focused suite 257 passed; ruff, mypy (19 files), system-map, reachability 287/287,
tools/validate.pyzero errors, warning baseline unchanged,git diff --checkclean. UI fullnpm run checkpasses. These are local results — integrated acceptance requires the hosted exact-pair gate for Core57c9d3bffc8b669f57b29bdcaa94cba6577fb594/ UI3c9a5f664c147790c490fae0a256e7764b4b9157. Gate history: run 40552226102 onb852c8efailed on stale transcript/surface/scenario pins (fixed in1ad4993,061e2a8,676c385); run 40557977568 on676c385failed rest-1 on OD15 private-name imports, two unrecorded A2 write sites, and the OpContext spec list. The subsequent engineering review's findings are fixed in90745ea(unfinalized reports are never pruned; dependency readiness verifies the current canonical state),4ea8c5b(public presentation helpers, A2 exceptions, OpContext spec), anddc7a6b9(gate proves executed node-ID multiset equality, witness merge refuses audit-log collisions, dispatched UI SHA must equal Core's pin, andsystem_check_passedis caller-asserted rather than self-proven; 8 scenario recordings shift only for the receipt schema bytes). Surface/ratchet approval lines cite Aram's implementation instructions; protected files still need his section 15 exact-head review before merge. The completeness proof is shared by validate.yml and release-pair.yml via tools/check_shard_completeness.py (6a6c271,build_parserexposed in57c9d3bafter the A8 doc-command gate caught the inline parser). Gate 40564225607 succeeded fordc7a6b9; the exact-pair gate for this final head, run 40568671113, succeeded (all five suite shards, all four zz shards, ui-check, and the final gate job).Per section 15, this PR changes protected paths and is left for Aram's exact-head review and merge. Not merged by the agent.