Repository navigation
Conversation
) Headless session records currently lack an explicit declaration of the change being evaluated and its expected effect. Configure `rollout.active` to attach `change_id`, an intentional UTC `effective_at`, descriptive skills/backends/roles scope, and a required nonblank `expected_effect` to Claude Code and Codex headless runs. The executor captures the declaration and logical run start after final launch admission, then preserves that snapshot through contract nudges, terminal logging, and crash recovery. Summary and index records carry the same marker; inactive runs write null and historical records without markers remain readable. Session index schema 17 and trace enrollment schema 3 carry the additions. Documentation covers declaring predictions before cutover, retaining a stable declaration across the observation window, and streaming retained-index comparisons using exact parsed timestamps. Before/after deltas prompt investigation and do not establish causality. Validation passed: - `pre-commit run --all-files` - Configured `test_check` gate (`task test-local-gate`) - Independent `task test-check` Closes #4653.
Managed headless launches currently leave lineage records visible to Git, so the clone gate can treat AutoSkillit's runtime state as user changes and refuse a clean checkout. This change gives the existing lineage namespace its own ignore marker, validates that marker before creating record directories, and repairs missing markers when a store operation reads an older namespace. The temp directory and lineage store share the marker writer. Doctor and the root guards share the marker predicate; committed project directories are classified explicitly. Real-Git tests cover launch cleanliness, legacy repair, dispatch state, and continued detection of user edits. The static guard rejects unclassified `.autoskillit` children in production source. Related issue: #5258. This PR remains draft pending the maintainer-owned policy registration. ## Validation - `pre-commit run --all-files` passed before each commit. - Manual real-Git probe: `before=[]`, `after=[]`; tracked ignore file unchanged; doctor OK. - Mutation checks rejected both literal-root and root-variable path spellings; the temporary mutations were removed. - Configured `test_check` (`task test-local-gate`) passed on `068f570b6`: 47,307 passed, 610 skipped, 29 xfailed. - The independent catalog row-count oracle is synchronized with the added guard row. - `core/io/io.py` measures 749 non-import lines against its 750-line limit. ## Required before completion A maintainer must add this prescribed entry to `POLICY_SURFACES` in `tests/arch/_acceptance_policy_surfaces.py`, then rerun the configured `test_check` gate after that policy change: ```python PolicySurface( "tests/arch/test_autoskillit_root_children_registered.py", "_CLASSIFIED_ELSEWHERE", "int_map", default=0, ), ``` The verified plan explicitly reserves that file for human edits, so it is unchanged in this PR. The post-merge E2E replay and PR #5255 commissioning remain operator-run checks. Separate follow-up trackers should be linked before closing #5258; this PR does not close the issue automatically. ## Audit response The audit's blocking REQ-006 finding used physical lines (`wc -l`) instead of the repository's defined budget count. `tests/arch/_line_budget.py::count_budget_lines` excludes import-statement spans, and `scripts/check_file_lengths.py` delegates to that function. | Revision | Physical lines | Excluded import lines | Enforced budget lines | |---|---:|---:|---:| | Plan base `265f1e00e` | 766 | 23 | 743 | | PR implementation | 772 | 23 | 749 | The unchanged cap is 750 non-import lines. The plan's starting and final budget counts were correct, and its stop-and-report condition was not triggered. Direct `check_file(io.py)` returns no violation. No exemption, counter/cap change, unrelated trim, or module split was needed. The three ODD test identifiers now exactly match the verified plan in `6194da647`; their assertions and production behavior are unchanged. The gated rerun found one additional integration omission: the independent catalog-count oracle still expected the old table. `068f570b6` synchronizes that oracle while retaining its strict equality assertion, and the next full configured gate passed. E-3 remains deferred for the reason stated in both the plan and audit: it requires the post-merge integration state and operator-run E2E commissioning. The human-owned policy registration above remains a separate prerequisite; no official re-audit GO verdict or merge completion is claimed.
) Model-written plans could fail the sealed plan-set gate because the planning templates did not show the required allocation grammar. Rejected binds could then return empty feedback, causing a replan to repeat the same mistake. Failed E2E runs also discarded the plans and orchestrator transcripts needed to diagnose the rejection. This change: - Makes the make-plan and rectify templates conform to the actual verifier, tests their worked examples, and tells dry-walkthrough to preserve the form. - Returns actionable feedback for every defective part and rejects coverage-failure results with blank feedback, including empty-allocation cases. - Makes recipes use the producer's captured part list, documents terminal failure dispositions, and guards the existing bounded replan routes. Regenerates compiled recipes and derived hashes, and updates measured delivery baselines without changing budget limits. - Retains pipeline plans and Claude transcripts for unsuccessful E2E runs, skips symlinks, records collection errors without changing the verdict, and carries the evidence through existing redaction and upload steps. Validation: each phase independently passed the configured test_check gate and pre-commit run --all-files. The final gate reported 50,558 passed, 609 skipped, and 29 xfailed. All three recipes validate successfully with no new semantic findings; existing advisory findings remain. Related to #5259. The README documents the real-model bind check required after merge and before CI commissioning; that operator check has not been run. The original discarded MiniMax plans remain unavailable.
Runtime launches could create or backfill `.autoskillit/.gitignore`, turning AutoSkillit's own work into Git-visible changes. Init's `.state.yaml` was also missing from the canonical ignore rules, and the fleet diagnostic filter could erase a useful clone-gate failure merely because it named the managed lineage directory. This change separates runtime temp creation from explicit project setup. Init and direct install maintain the canonical ignore file; temp creation maintains only its own self-ignore marker. Init covers `.state.yaml` before writing it, preserves existing state fields, and leaves ignore files untouched when state validation fails. Fleet failure reasons retain `bootstrap_clone`/`uncommitted_changes` while redacting private paths and capture metadata; the raw L3 payload remains exact. The root-child classification flags return to the integer-map format required by the existing acceptance-policy reader. Regression coverage exercises absent/stale tracked ignore files, real user edits, zero-valued flags, state-write ordering, and directory/record/mixed/private-only fleet reasons. The core gateway/stub and existing snapshot are synchronized; the IO file remains within its existing line budget. ## Validation - `pre-commit run --all-files`: passed before each commit. - Affected task-based checks: 331 passed, 1 skipped. - Source-inventory guard checks: 39 passed. - Configured `test_check` (`task test-local-gate`): 51,233 passed, 615 skipped, 29 xfailed on `5854498a6f980782aa0b9f883b1e90a282c7f8f3`. ## Completion requirements for #5258 This PR delivers the code fixes, including the three adjacent defects. It does not close #5258 by itself. - [ ] After this integer-map restoration lands in the trusted comparison base, a maintainer registers `_CLASSIFIED_ELSEWHERE` in `tests/arch/_acceptance_policy_surfaces.py` as `int_map` with `default=0`, then runs the configured gate. The authority file is intentionally untouched here. Adding the row against the current set-shaped base would fail the policy parser's base comparison. - [ ] Integrate the completed code and policy registration into #5255's existing implementation scenario branch and run E-3 twice against the unchanged sandbox seed. Both envelopes must clear `bootstrap_clone` without `uncommitted_changes`; record actual run/attempt/head evidence in #5258's body. - [ ] Record completed code/policy/replay evidence in #5258 before closing it. Full #5255 commissioning and its later #5259 allocation blocker retain their separate acceptance criteria. Refs #5258. No new tickets or review comments are created by this change.
The runtime-state root classification map was restored in #5263, but it was still absent from the acceptance-policy registry. Future additions to its exemptions could therefore escape the policy comparison. Register `_CLASSIFIED_ELSEWHERE` as an `int_map` with `default=0`. The registration now compares against the dictionary-shaped base containing #5263, preserving the existing policy reader and approval mechanism. Validation: policy comparison against `dbc689db57d3d847758ec08dd5bad31105f39730` and `pre-commit run --all-files` passed. The configured MCP `test_check` (`task test-local-gate`, conservative filtering) passed against that actual PR base: 11,771 passed, 197 skipped, 12 xfailed on `3a0a9f8eae7a4d84a7e14d8b0b899ea76b30bd07`. The first gate compared against stale local `develop` at `0bf84f3`, whose value still had the old set shape: 51,229 passed and one policy-comparison test failed. The runner's comparison base was temporarily pinned to the fetched, dictionary-shaped PR base for the successful rerun, then restored. Both results are preserved locally. Refs #5258. After merge, integrate the registered policy and runtime repairs into the existing #5255 scenario branch, perform both E-3 replays against the unchanged seed, and record the actual clone-admission evidence in #5258 before closing it. This PR supplies the remaining policy entry; it does not claim the live replay has already happened.
Trecek
force-pushed
the
impl-e2e-ownership-evidence-20261012
branch
from
October 13, 2026 15:17
9dcdff4 to
71b6b4e
Compare
Trecek
merged commit Oct 13, 2026
4adccdb
into
impl-issue-5233-20261008-implementation
3 checks passed
This was referenced Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Real E2E transcripts used the plugin MCP namespace and row-level structured replies, so the collector missed the claim, published branch, and launched workers. Teardown could then silently leave a branch behind when no PR or claim label remained.
This change decodes both canonical namespaces and authoritative structured receipts, adopts dispatch-valid workers through paired launch/acknowledgement/recovery receipts, and reports unexplained sessions. The harness records sandbox head refs before the run and after cleanup, preserving and failing cleanup for new branches without ownership proof. Sanitized captured CI evidence exercises ownership, concurrency, and teardown after a failed run.
Stacked on #5255, targeting
impl-issue-5233-20261008-implementation, where the collector was introduced.Validation:
pre-commit run --all-filesand the configuredtask test-local-gatethrough the MCP test gate.Live GitHub head-ref listing will be confirmed by the first E2E run after merge.
Fixes #5267