coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(runtime): enforce governed mutation boundaries

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
This commit is contained in:
tegwick 2026-09-04 11:25:07 +02:00
parent e3c6124e22
commit 20e6f381f6
28 changed files with 1068 additions and 154 deletions
Download patch file Download diff file Expand all files Collapse all files

34
SCOPE.md
View file

@ -1,6 +1,6 @@
# SCOPE
> Capability snapshot: 2026-08-23. `INTENT.md` states the destination and
> Capability snapshot: 2026-09-04. `INTENT.md` states the destination and
> boundaries; this file records what the repository currently implements and
> has evidence for.
@ -22,8 +22,10 @@ retains a legacy set of local task executors for unattended repository work.
actor `agt`, returns the complete `GatewayResult`, and never falls back to a
legacy approach after profile refusal or failure.
- Profile-absent rows use the coexistence registry in `approaches.py`.
Unmatched rows fail visibly. JSON task files remain available for local
development, and issue-core polling remains as a legacy compatibility path.
Dispatch requires an explicit, non-expired
`AGENT_HARNESS_LEGACY_APPROACHES_UNTIL` date; unmatched or disabled routes
fail visibly. JSON task files remain available for local development, and
issue-core polling remains as a legacy compatibility path.
- The production claim loop is a single-concurrency user systemd service on
railiance01. Claim failures use the configured poll interval and active runs
receive lease heartbeats.
@ -34,6 +36,9 @@ retains a legacy set of local task executors for unattended repository work.
kaizen-agentic persona bundle, invoke Claude Code in the target checkout,
impose a wall-clock timeout and named Claude tool allow-list, and require a
new Git `HEAD` before reporting success.
- Local task files may carry an explicit v1 `repository_grant`. These runs
validate commit ancestry/count, changed paths, clean post-state, protected Git
metadata, and remote refs under the repository transaction before success.
- Optional Claude stream JSON is reduced to tool/hook audit events and can be
reported to State Hub.
- Versioned profiled rows delegate profile, rein, model, tool, sandbox, and
@ -58,9 +63,10 @@ retains a legacy set of local task executors for unattended repository work.
session to repository read/edit operations and selected local Git commands;
lane itself is metadata and consistency validation, not an OS security
boundary.
- Runs can append `.kaizen/metrics/<agent>/executions.jsonl`, regenerate the
summary, emit State Hub progress/tool/token events, and close an associated
Hub task. These reporting operations are best-effort.
- Grant-absent compatibility runs can append repository-local kaizen metrics.
Granted runs instead require private, durable external metrics with a
projection descriptor so accepted checkouts remain clean. State Hub
progress/tool/token events and task closing remain best-effort.
- llm-connect HTTP errors retain only bounded, allowlisted provider diagnosis.
### Packaging and deployment
@ -87,12 +93,11 @@ retains a legacy set of local task executors for unattended repository work.
- Direct legacy agent sessions rely on Claude Code's own tool mediation and
the host checkout. They are not an OS-level sandbox and do not prove that
no push/network activity occurred after the run. Unattended mutation now
takes a process-safe repository lock (ADR-002 / T02); commit acceptance
is still the `HEAD`-changed check until T03.
- Commit acceptance currently means only that `HEAD` changed. It does not yet
validate the changed-file set, branch/parent shape, clean working tree,
remote state, or provenance of the new commit. Metrics are written after
this check and can leave target-repo changes for a later commit.
takes a process-safe repository lock (ADR-002 / T02).
- Explicitly granted local task files have full repository acceptance and
clean external metrics. Grant-absent compatibility and profiled queue runs
still use their prior result contracts because Activity Core carries no
authoritative repository grant. Durable queue-close replay is also not live.
- The worker is sequential and repository mapping is host configuration. There
is no multi-worker repository lease, per-tenant process isolation, generic
credential broker, or tenant onboarding API.
@ -109,8 +114,9 @@ retains a legacy set of local task executors for unattended repository work.
- Profile routing and rein selection belong to Glas.
- Sandbox lifecycle and isolation belong to sand-boxer.
- Provider abstraction belongs to llm-connect.
- Durable work history and decisions belong to State Hub; agent memory and
metrics remain in the consuming repository.
- Durable work history and decisions belong to State Hub; agent memory remains
in the consuming repository. Granted-run metrics remain external until a
separately granted kaizen projection commits them to the instance.
## Orientation