feat(runtime): enforce governed mutation boundaries
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
This commit is contained in:
parent
e3c6124e22
commit
20e6f381f6
28 changed files with 1068 additions and 154 deletions
|
|
@ -158,7 +158,7 @@ and T02–T06 can cite stable decisions rather than infer ownership from code.
|
|||
|
||||
```task
|
||||
id: REINAH-WP-0003-T02
|
||||
status: progress
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "31da4226-27c0-5e3c-baeb-de01e07cebb1"
|
||||
```
|
||||
|
|
@ -258,6 +258,22 @@ affected profiled-result and clean-baseline test setup. Full verification passes
|
|||
`209 passed, 1 skipped`. T02 remains `progress` until the named timeout, signal,
|
||||
and result-close lock-release cases are covered directly.
|
||||
|
||||
### Completion — 2026-09-04
|
||||
|
||||
Added direct integration proof that the canonical repository lock is released
|
||||
after an adapter timeout, Activity Core lease loss, process-signal cancellation,
|
||||
and a terminal result-close transport failure. The close-failure test also
|
||||
confirms transaction evidence survives in the bounded process result. Refusal
|
||||
coverage now proves both the checkout status and local remote-tracking refs are
|
||||
unchanged. Profiled tests use disposable repositories, and an autouse fixture
|
||||
keeps runtime state outside operator-owned paths. The documented full-suite
|
||||
command passes without an environment override: `212 passed, 1 skipped`.
|
||||
|
||||
Together with the existing cross-process contention, distinct-repository,
|
||||
dirty/staged/untracked, detached/moved-HEAD, metadata, remote-ref, bounded
|
||||
evidence, and lease-cancellation cases, all T02 exit criteria are met. T02 is
|
||||
`done`; T03 is unblocked.
|
||||
|
||||
## Verify accepted commits and reconcile metrics/reporting
|
||||
|
||||
```task
|
||||
|
|
@ -371,11 +387,41 @@ terminal evidence, and expired-lease behavior in message
|
|||
`1c13bfb1-9015-4b8a-8b30-ee748c1d8dc5`. No claim-loop or deployment change
|
||||
was requested.
|
||||
|
||||
### Local grant activation and metrics atomicity — 2026-09-04
|
||||
|
||||
Enabled the reviewed v1 `repository_grant` for local `TaskSpec` files now that
|
||||
T02 supplies the lease-bound transaction. Successful granted runs validate the
|
||||
exact commit count/ancestry, changed paths, clean post-state, protected Git
|
||||
metadata, and remote-tracking refs before reporting success. Their bounded
|
||||
transaction evidence includes grant and acceptance identities without raw
|
||||
grant paths, prompts, or provider output. Adversarial runner coverage rejects
|
||||
out-of-grant commits.
|
||||
|
||||
Chose the durable-external metrics branch of ADR-002's T03 decision. Granted
|
||||
runs cannot use `--no-metrics`; they atomically append a kaizen-compatible
|
||||
record under private `REIN_AHARNESS_STATE_DIR` storage and regenerate a summary
|
||||
plus projection descriptor without touching the accepted checkout. Ledger
|
||||
corruption or persistence failure is terminal for the granted result. A future
|
||||
kaizen-owned, separately granted projection may commit those files to the
|
||||
instance; the rein does not invalidate its own accepted post-state. Legacy
|
||||
grant-absent runs retain repository-local metrics during migration.
|
||||
|
||||
Full verification passes: `222 passed, 1 skipped`. T03 remains `wait`, not
|
||||
`done`, on two verified Activity Core contract gaps at current main `b72fdb5`:
|
||||
the queue schema carries no authoritative repository grant, and complete/fail
|
||||
accept only an actively leased claimed row while normalized result storage
|
||||
drops transaction/grant/acceptance identity. A response-lost retry therefore
|
||||
returns an ambiguous 409 and cannot be safely treated as delivered. Requested
|
||||
a separately typed grant field plus identity-preserving, conflict-detecting
|
||||
terminal reconciliation in State Hub message
|
||||
`6c4189a5-5971-4eb9-a7bd-62fe368f9a02`. Live outbox activation stays
|
||||
fail-closed until that exact upstream contract is available.
|
||||
|
||||
## Remove tenant logic from the shared runtime
|
||||
|
||||
```task
|
||||
id: REINAH-WP-0003-T04
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "f6c7f80c-3807-54ac-b44a-ef582433b927"
|
||||
```
|
||||
|
|
@ -407,11 +453,36 @@ and owner files. It identifies inputs, outputs, credentials, completion events,
|
|||
commit/push behavior, retry posture, rollback material, and migration gates.
|
||||
This is read-only preparation; T04 remains `wait` until T01 accepts ADR-002.
|
||||
|
||||
### Dated compatibility guard — 2026-09-04
|
||||
|
||||
Profile-absent `ops_run` dispatch now requires an explicit, non-expired ISO
|
||||
date in `AGENT_HARNESS_LEGACY_APPROACHES_UNTIL`. Missing, malformed, or expired
|
||||
values refuse terminally before target resolution or tenant executor dispatch.
|
||||
Authoritative `harness_profile_ref` rows bypass the legacy registry and this
|
||||
flag entirely. The deployment example currently declares `2026-12-31`, making
|
||||
the remaining four tenant migrations visible and time-bounded rather than a
|
||||
silent permanent default. Focused tests cover boundary-day, expired, malformed,
|
||||
missing, and pre-dispatch refusal behavior.
|
||||
|
||||
Removed the FI compatibility executor's `git push origin HEAD` path entirely.
|
||||
`FI_RESEARCH_BRIEF_PUSH` no longer widens behavior even when set; the executor
|
||||
creates a local commit only. A regression test observes every Git invocation
|
||||
and proves no push occurs. Any publication now requires a separate owner,
|
||||
grant, and evidence contract.
|
||||
|
||||
T04 remains `wait`: the FI and Binky definition owners still need to move
|
||||
their four scheduled behaviors to approved profiles/tenant-owned capabilities
|
||||
before the compatibility flag and tenant modules can be removed. Requests:
|
||||
Freedom Intelligence `d0b45acb-0002-405b-9620-cc44568170fb`, Binky
|
||||
`c941f47b-d100-4df3-b4f4-feb1e187d2d8`, kaizen-agentic
|
||||
`29a010f4-7a5c-42cd-a13e-3a13326f75ff`, and Glas
|
||||
`e91f3f67-2d5d-4ad2-923c-431ebafed77e`.
|
||||
|
||||
## Align deployment, recovery, and conformance with the supported runtime
|
||||
|
||||
```task
|
||||
id: REINAH-WP-0003-T05
|
||||
status: todo
|
||||
status: progress
|
||||
priority: high
|
||||
state_hub_task_id: "c4a3f08f-2874-5672-9f29-aecddd697d90"
|
||||
```
|
||||
|
|
@ -441,6 +512,20 @@ runtime boundary is unavailable; recovery drills leave no held repo lock,
|
|||
claimed row, orphan sandbox, or lost required evidence; and CI/release gates
|
||||
exercise the same contract versions as production.
|
||||
|
||||
### Supported topology declaration — 2026-09-04
|
||||
|
||||
Selected the existing railiance01 user systemd service as the authoritative
|
||||
production topology. It is the only runtime that owns real checkouts, private
|
||||
state, worker credentials, heartbeats, and signal shutdown. The Kubernetes
|
||||
Deployment is now explicitly labeled `packaging-smoke`; its source comments and
|
||||
deployment guide state that `sleep infinity` is neither ready to claim nor a
|
||||
failover worker and must never receive the Activity Core worker credential.
|
||||
|
||||
T05 remains `progress`. Reproducible pinned sibling packages, startup readiness,
|
||||
recovery/outbox controls, and non-skipped cross-package CI still need
|
||||
implementation; the currently catalogued local Glas profiles are also
|
||||
operationally `blocked` on `GLAS-IN-0002`.
|
||||
|
||||
## Re-prove one governed profiled run and close residuals
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue