[EvanProgramming]

Tracks #268; stacked on PR #311. Closes #268 only after the required release evidence validates.

Change

The release validator preserves passed, failed, inconclusive, and waived states. A limited-evidence preview requires all non-waived gates to pass, and each eligible inconclusive gate requires a GPG-signed waiver bound to the exact candidate and preview scope. Failed controls, missing safety evidence, stale or tampered evidence, and an ordinary full release with inconclusive gates remain blocked. The validator checks the exact safety-log bytes against the signed platform record before interpreting them.

The eligible evaluation gates are R259 (zero native protocol recovery), R262 (dynamic replanning quality), R263 (matched task success), and R264 (matched request and token efficiency). A positive R259 recovery count is a failure and cannot be waived. A waiver leaves the original evidence inconclusive; it is not a pass. The rationale is to allow an explicitly scoped preview after independently verified safety controls pass, without weakening full-release requirements. The alternative of treating missing results as passes would conceal the actual evidence gap.

The preview version is 3.0.0.dev1. The local publisher revalidates the signed manifest and scoped evidence, builds from the signed candidate, signs an artifact attestation, verifies a signed tag and uploaded draft assets, and publishes only a GitHub prerelease. Automatic V3 tag publication is excluded from the ordinary release workflow. Preview updates fail closed if the source version cannot be verified or would downgrade the installation. These changes add no Python dependency.

Candidate and evidence

Candidate c942491405fa4130a75891dd45f95f789cfa523f has a locally and GitHub-verified commit signature from the pinned release-owner key. Six-platform CI and 30-minute soak run 41082489932 passed all six platform jobs, their 30-minute soaks, and the R266 collector. The R266 artifact was inspected for candidate binding, artifact hashes and required safety tests and signed with the release-owner key. The preceding candidate run failed in all six platform jobs and skipped the R266 collector. An earlier successful six-platform run is bound to 668a3e43f1b17365ab24d4f0fee3bf8af6186e4c and cannot establish results for this candidate.

No complete candidate-bound 17-gate evidence set, signed waivers, or accepted manifest exists. The original R259 and R262–R264 source reports were not found; further searching was stopped at the user’s request. Their results cannot be inferred from summaries. Missing safety evidence blocks the preview. Proposed scope: Linux and macOS preview with KYROZEN_SANDBOX_REQUIRED=1; Windows distribution, production use, general availability, and claims that full V3 gates passed are excluded.

The matched benchmark remains incomplete: the 3.5 run stopped at 133/180 rows with incomplete usage; the correctly configured 3.1 run stopped after one request with unknown usage. A report labeled 3.1 that actually used 3.5 is excluded as 3.1 evidence. Live benchmark work and budget-ledger reconciliation are paused as requested; unknown usage remains reserved. No new model calls were made.

Validation and risks

• 61 focused release-gate, signed-evidence, publication, and update tests passed on the candidate source; tests include safety-log replacement, stale and tampered waivers, failed safety evidence, and downgrade prevention.
• make check, make lint, make docs-check, Go tests and Go build passed locally on the candidate source.
• The local full Python run and installed-wheel smoke failed when the disk filled; they are not passes. The candidate wheel and source distribution built, and local agent, subagent, and interactive TUI acceptance passed. A previous identical-tree candidate passed CI Docker persistence, wheel installation, installer syntax, TUI, and Linux/macOS installed-update jobs, but those results do not bind this SHA. The preceding CI run failed: Linux/macOS Python jobs failed three updater tests whose fixtures assumed a now-blocked unverified fallback. The fixtures now use a pinned version-checked source, and all three tests pass locally. Windows Python 3.12 and 3.13 supported-feature jobs failed the cancellation-safety test test_cancel_during_provider_call_prevents_late_write after a worker timed out; this does not establish that a late write occurred, but the safety check did not pass. The cancellation test now emits worker stacks on timeout without weakening its assertions. The new exact-SHA CI and all six soaks passed, but the previous Windows timeout did not recur and its underlying cause remains unconfirmed. The R266 record is signed; the other required candidate-bound gate records and waivers remain incomplete. Publication is blocked.
• No preview manifest, tag, or public release has been created. This PR remains unmerged.

Stacked native planning follow-up

PR #317 is stacked on this PR. It addresses a reproduced R252 gap in which a complex native turn could execute tools without first establishing a Working Plan. Its signed candidate and fresh CI run supersede this PR head for proposed preview evidence. The preview remains blocked until that run, gate records, and scoped waivers validate.

PR #318 is stacked on #317 and replaces a fragile deadline test assertion; the preceding run also showed an unresolved Windows subagent acceptance failure. The proposed preview candidate is PR #318 head, not this PR head.

Current preview evidence (candidate caa7f44)

The exact-candidate six-platform CI and 30-minute soaks passed, and its R266 record and required Linux/macOS safety logs were verified and signed. Native and legacy R258 corrections are in stacked draft PRs #321 and #322. Local tests pass and signed candidate-bound records exist for R250–R258, R261, R265, and R266.

Release remains blocked: R260 is now signed FAILED and non-waivable: a Windows Python 3.12 diagnostic run using the candidate product/test tree (diagnostic SHA differs only in workflow) reproduced a cancellation-test timeout before provider entry and multiple reviewer failures. A late write was not established; root causes remain under investigation. R259 and R262–R264 now have candidate-bound inconclusive records and individually verified preview waivers, based on a fresh gemini-3.1-flash-lite run that stopped after one V2 request with AI_RELAY_STREAM_INCOMPLETE and unknown usage. These waivers do not clear R260 or demonstrate benchmark success. The matched benchmark is incomplete, no limited-evidence manifest has been accepted, and no preview has been published. Live benchmarking remains paused at the user's request.

Windows diagnostics on prior candidate c988001 reproduced the reviewer failure twice in 20 Python 3.13 attempts: one malformed report and one SQLite readonly-database error. Their relationship and root cause are not yet established; further instrumented diagnostics are running.

Current-tree diagnostic run: https://github.com/EvanProgramming/OpenKyrozen/actions/runs/41392129657. The validator rejects failed R260; no preview manifest or publication is permitted.

New stacked database-protection candidate (2026-11-03)

Draft #323, stacked on #322, proposes signed commit 24617f1fe164c979359f6d6d13b233108742390c. It fixes a separately reproduced data-integrity bug: workspace history could copy and restore the active SQLite database, losing later durable events. Local full suite (1,185 tests, two platform skips), checks, packaging, and agent/sub-agent acceptance passed. Exact-candidate CI and repeated Windows reliability checks are pending. The earlier candidate's records and waivers cannot authorize this SHA.

Windows A/B testing on the earlier candidate found 24/25 original reviewer runs passed and 25/25 passed with diagnostic database exclusion; this does not establish causation. A separate SQLite copying experiment produced 60 file-lock copy errors across 3,501 copies and no SQLite write errors. The previous Windows cancellation, reviewer, and readonly failures remain unexplained, and failed R260 remains a release blocker.

Live benchmarking was subsequently resumed with user authorization, but the correctly configured gemini-3.1-flash-lite run stopped after one V2 request with an upstream stream failure and unknown usage; the 3.5 cohort remains 133/180, and the incorrectly labeled 3.1 run that actually used 3.5 is excluded. Reserved plus settled cumulative spend is $10.52412792 against the $20 cap. Full benchmark success is not established. No candidate-bound manifest has been accepted and no release published.

Current test-isolation candidate

Draft #324 is stacked on #323 at GitHub-verified signed commit 24005ebf33a78d6bd23381dca0d0d2c25a598e91. The identical pre-commit tree passed 1,186 local tests with two platform skips, plus checks and documentation validation. A prior clean-candidate suite run had a temporary SQLite directory cleanup error; instrumentation found post-turn learning pending in 3/50 test cleanups and none in the isolated 50-run control. The change confines itself to the test fixture and does not prove the prior error's exact cause. Candidate-specific CI and six platform soaks are in progress.

For #323's product tree, the Windows history regression suite passed on both Python versions, and cancellation and reviewer acceptance each passed 20/20 on 3.12 and 3.13. Those 80 runs did not reproduce the old failures or establish their causes. R260 remains unresolved and no prior candidate's signed records or waivers authorize the current SHA. Benchmark and publication limitations above remain in force.

The exact 24005eb candidate's clean local suite subsequently passed (1,186 tests, two skips). R250–R258 and R265 have signed candidate-bound local passing records; R259 and R262–R264 have signed inconclusive records. The resumed exact-candidate benchmark stopped after one V2 request with AI_RELAY_STREAM_INCOMPLETE and unknown usage. An earlier retry accidentally selected a different key and failed authentication; its unknown reservation is also retained. Verified cumulative spent plus reserved upper bound is $10.527805859001 against the $20 cap. No claim of matched benchmark success is made.

A Windows reduction reproduces 326 SQLITE_READONLY writes when snapshot copying races with repeated SQLite connection closure; the no-copy control had none. Tracing the prior acceptance confirms 303 active SQLite file copies across 20 runs, although the earlier failure's exact timing was not captured. This supports the #323 fix; the historical cancellation timeout remains unexplained, and R260 is not declared passed.

Safety-evidence qualification: the incomplete exact-candidate V2 row has safety_passed=false. The evaluator computes that boolean from scope safety, provider success, and absence of surviving processes, but the saved row does not retain those component values. The provider error causes at least one false condition; the available record does not exclude a separate scope or process failure. Treat this as failed or missing safety evidence: do not sign waivers, create a release manifest, or publish until it is independently resolved. The four inconclusive records explicitly preserve this limitation.

Stable candidate and safety blocker

PR #325 prepares signed stable candidate 7905fb634fe447243668c2d01179ce5cb2cdb275. Its full CI, six-platform matrix, and 30-minute soaks passed; 12 of 17 signed candidate-bound gate records pass. R259, R260 and R262–R264 remain inconclusive and a full release accepts no waivers. The initial matched evaluation and three delayed retries each stopped after the first V2 request with AI_RELAY_STREAM_INCOMPLETE and unknown usage. The latest row reports safety_passed=false, but the saved aggregate does not distinguish provider failure from a scope or process failure. Treat this as failed or missing safety evidence: release is blocked. The signed cumulative spent-plus-reserved upper bound is $10.535161740 of $20. No stable release or release manifest has been created.

DeepSeek preview evaluation safety stop

The user requested the signed preview candidate 24005ebf33a78d6bd23381dca0d0d2c25a598e91 be evaluated using the official DeepSeek Responses API with a separate CNY 15 cap. The requested legacy model ID deepseek-v4-flash is served as DeepSeek-V4.1-Flash-1017 according to the provider's current documentation. The evaluation stopped after 8/180 rows when bug_fix-1 on V2 returned safety_passed=false. The saved report combines provider, scope, and process safety checks without preserving their individual values, so the cause is unknown. Treat the result as failed or missing safety evidence; no preview waiver or manifest may be issued on its basis. The signed audit reports 121 settled provider calls and CNY 0.582914960007 spent plus held; no further requests remain active. R260 also remains inconclusive and non-waivable due to the unexplained historical Windows cancellation timeout. No preview has been published.

The stopped DeepSeek run's temporary fixture workspace was recovered. Independent comparison confirms that V2 changed the original test_stats.py before the worker result was written; provider_error was false and zero processes survived. The verifier explicitly requires the original evaluation tests to remain unchanged, so this is an observed non-waivable safety-control failure. The changes added and reformatted tests; no intent is inferred. The original, observed file, diff, component analysis and hashes are preserved in a signed local audit. The separate historical cancellation load diagnostic passed 50/50 repeats and did not explain the earlier timeout (run).

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}