mirror of
https://github.com/boshu2/agentops.git
synced 2026-09-14 15:08:13 +08:00
main
20 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Bo
|
d972fa2090 |
Prepare AgentOps 4.0.0 plugins, skills and CLI release (#1143)
## What Prepare AgentOps 4.0.0 across the Claude plugin, Codex plugin, skills and CLI. Claude writers capture the supplied check status during its original invocation, and plugin conformance verifies exact skill membership and link destinations. Full release security now scans the repository and blocks on Python collection failures that previously produced a false green result. ## Why The 3.6.0-to-current interval removes published commands and 20 skill names, so this is a major release with migration instructions. Release validation also exposed stale skill assertions and test prerequisites that need to match the current product contracts without weakening acceptance. ## How I tested - Native Claude Opus/Haiku success, failing-check and direct-writer trials: each check ran once, and the direct child returned plain JSON. - Actual fresh installs and upgrades from 3.6.0 in isolated Codex and Claude homes: 34 skills, expected agents, and exact installed package bytes. - Exact candidate `b721d02559e1495be6095ad97b820e88ceb4a049`: all 73 full repository gates, regeneration parity, and the complete local release rehearsal passed. All 12 security tools ran with zero skips, tool errors, critical findings or high-severity security findings. The unchanged advisory policy reports 35 quality-high findings on unchanged files. - Python: 327 tests and 72 subtests passed. Hosted Bats: 1,509 passed, 31 environment-dependent skips, zero failures. Go lint/build/vet/race/shuffle checks and CLI smoke/integration passed. - All 11 hosted checks passed, including Windows correctness, macOS/Linux installation, security, and the six-target no-publish GoReleaser snapshot. Local archive checksums and a real macOS CLI initialization/status/version smoke also passed. - Fresh author-distinct review passed all four acceptance criteria and all 35 changed paths with no unchecked acceptance. Canonical subject and caller-intent verification passed; verdict digest `68af2c935ed0106cd91b3950f5d168e662f4071f660fcbd113c36b7cd0f0426e` binds manifest `7affc77e25eaff69ba36c5ce05582b4f0385c954b76b62c02b97f97041f489b2`. ## Checklist - [x] Breaking changes documented in the migration guide and complete release notes. - [x] No credentials or private runtime proof included. - [x] Final full release checks pass on the exact candidate. - [x] Fresh author-distinct final PASS is recorded before merge. This prepares the release candidate; it does not publish a tag or release. Coverage limits remain explicit: native plugin tests used isolated macOS homes and local marketplaces, guard installation remains opt-in, and reader instructions do not prove sandbox confinement. Semgrep retains pre-existing warning-level parser diagnostics. Snapshot metadata follows the existing 3.6.0 tag; this is a packaging rehearsal, not a published 4.0.0 archive. |
||
|
Bo
|
efcf4879c8 |
feat(gc): port gc-maintainer-ops into the ao gc command family (#1016)
## What Ports `scripts/gc-maintainer-ops.sh` (425 lines of bash: prepare / check / recover-affinity for stock Gas City rigs) into the Go CLI as **`ao gc prepare|check|recover-affinity`**, per ADR-0016 (skill logic ships in Go via `ao`; shell stays thin glue). **Why:** skills ship via plugin/npx as SKILL.md only — a user without a repo checkout could not run the commands the shipped `using-gc` skill teaches. The skill said "From an AgentOps checkout", which was disclosed but weak. ## Changes - **`cli/internal/gcmaintainer`** — full port: rig/import pin verification, bundled pack-cache resolution, PyYAML-capable python selection, atomic runtime staging, managed check wrappers, skill links into city/rig Codex sinks, macOS LaunchAgent + doctor/status health checks, bounded affinity recovery. Output and refusal-message parity with the shell script (incl. refuse-before-mutation ordering). - **`cli/internal/commands/gc` + `cmd/ao/gc_composition.go`** — cobra module on the shared `clicontract.HostOptions` seam; global `--dry-run` always overrides `--apply`. - **Skills source resolution without a checkout**: `--skills-source` > enclosing agentops checkout > installed skills root (`~/.agents/skills`, `~/.claude/skills`). Existing rigs stay recognized: the `managed-by: agentops gc-maintainer-ops` wrapper marker is unchanged. - **Tests migrated**: `tests/python/test_gc_maintainer_ops.py` (7 cases) → Go L2 tests in `cli/internal/gcmaintainer` with the same fake-`gc` harness, plus module wiring tests. `scripts/check-gc-executor.sh` no longer runs the python suite. - **`scripts/gc-maintainer-ops.sh`** reduced to a thin wrapper exec'ing `ao gc`, pinning `--skills-source` to its checkout to preserve historical semantics (`--ao-bin` now selects the ao binary). - **Docs/projections**: `skills/using-gc/SKILL.md` now teaches `ao gc ...`; codex, gemini, and executor-pack projections regenerated via their owning generators; spine/COMMANDS.md/surface artifacts regenerated. ## Verification - `go build ./... && go vet ./... && go test ./...` — 2923 passed, 73 packages - `golangci-lint run` on new/touched packages — clean - `shellcheck -S warning` on wrapper + gate script — clean - `bash scripts/check-gc-executor.sh` — OK - Smoke: built `ao`, ran wrapper → `ao gc` delegation end-to-end |
||
|
Bo
|
1f8468429b | fix Gas City maintainer operations | ||
|
Bo
|
9dd6e7d3f9 |
3.4.0 release prep: upstream-factories pivot, version bumps, release notes (#1013)
## Summary Everything-but-the-tag for v3.4.0, in four commits: - **docs(gc)**: the factory pivot — README and `using-gc` present the upstream [Gas City build pack](https://github.com/gastownhall/gascity-packs/tree/main/gascity) and [Agentic Coding Flywheel](https://agent-flywheel.com/) as the supported factory choices; the in-repo prototype (`deploy/gc/`) is retired in place. AgentOps' lane is the skills + evidence discipline either factory executes. - **chore(release)**: version 3.3.0 → 3.4.0 across all six surfaces (claude/codex/gemini plugin manifests, marketplace, image verify pin, `ao` source fallback). - **fix(gates)**: `check-orchestration-skill-boundaries.sh` exited 2 on every run — it probed adapter files deleted by the 3.3 single-pass refactor and three contract phrases removed by the skill-overhaul waves. The live ratchets (retired-skill absence, ATM-era naming) are kept. - **docs(release)**: 3.4.0 CHANGELOG section (root + docs mirror) and curated release notes; `validate-release-notes.sh` passes (tier minor, full area coverage). ## Verification - Full Go gate in a clean worktree: build ✓ vet ✓ test **2902 passed / 0 failed** (71 packages) - `scripts/regen-all.sh --check`: all 11 projection/doc checks ✓ (including the doc-release freeze gate) - `scripts/validate-release-notes.sh v3.4.0 --since v3.3.0`: PASS - `scripts/check-orchestration-skill-boundaries.sh`: exit 0 (was exit 2 on main) ## Notes - The earlier read that `go.cli-reference` needed unpinning from the negative-witness grandfather list was a **false positive**: gitignored session logs under `tests/claude-code/logs/` pollute the witness scan in a dirty checkout. On a clean tree the pin is correct; a follow-up task exists to make the scanner read only tracked files. - Tagging + Release Publisher run happen after merge, separately; an official-mode readiness artifact gets produced at the merged SHA **before** any tag (binding rule from the v3.3.0 record). |
||
|
Bo
|
a6359795bf |
Make fresh validation persistence optional (#1012)
Keep fresh author-distinct validation mandatory while making verdict and report persistence consumer-driven. Align the RPI/Validate contracts, executable behavior, current guidance, regression coverage, and generated projections; preserve the Gas City 1.4 cutover. |
||
|
Bo
|
25db3280ce |
feat(gc): integrate Gas City 1.4 packs and runs (#1011)
## Summary - pin and fail-close on Gas City v1.4.0, paired Beads v1.1.0, and the official `gascity` 0.1.6 registry release - compose the official workflow pack while binding its sibling roles at stock `defaults.rig.imports.gc`, so `do-work` resolves `gc.run-operator` and `gc.implementation-worker` - retire the v1.3 heartbeat workaround, use scoped `core.control-dispatcher` propulsion, and keep the Mayor as an on-demand operator door - update the canonical `using-gc` skill, generated projections, and the old-city retirement/new-city startup runbook ## Evidence - 38 focused Python tests pass (2 opt-in native skips) - `scripts/check-gc-executor.sh` passes: 34 tests (2 opt-in native skips) - `scripts/regen-all.sh --check` passes - pinned native v1.4 bootstrap/formula/roles/doctor/teardown qualification passes twice: author run 122.910s, independent Fable run 116.267s - fresh Claude Fable 5 semantic verdict: **PASS**, artifact digest `7ab1a3be2a63cb03e774936f1551176c6ab61f8214ae35e0a97d635edf4833c7` The live mixed-provider canary remains explicitly post-merge release qualification; this PR does not claim it already ran. |
||
|
Bo
|
894c190737 |
W8 coherence: corpus-level trigger separation, effects vocabulary, plan closeout (#1006)
## Summary
Final wave of the skill-overhaul reboot
(`age-skill-overhaul-reboot-sjv7v.9`), run after #998–#1005 merged.
**Closing corpus-level review** (the one check no per-wave review could
do — trigger routing, effects vocabulary, authority coherence,
reachability across all 49 skills): seven findings, all applied.
- Trigger separations: rpi↔implement ("execute this plan" = the loop;
"implement this bead" = the phase), plan↔craft-goal (Mayor/goal-runner
distinction made decisive), status↔reality-check (reality-check now
requires a claim to test), research↔codebase-recon (bare "investigate"
narrowed).
- Effects vocabulary: imperative `write_*`/`regenerate_*` forms
normalized (skill-builder), `authorized_` prefix made consistent
(reverse-engineer).
- `shared` marked explicitly non-routable.
- Authority coherence verified clean: only validate persists verdicts,
only rpi dispatches the loop, no specialist starts RPI.
**Deterministic evidence**: regen byte-idempotent (two runs, zero
drift); strict frontmatter 49/49 zero warnings; scenario-linkage PASS;
description budgets green; all skill validators pass.
**Plan closeout**: reboot plan marked complete with a completion record
(8 PRs, per-wave ledgers); structural beads .10/.11/.12 remain open as
explicitly deferred tracked work.
Full report:
`docs/audits/2026-07-28-skill-overhaul-reboot/wave-reports/w8.md`
Tracker: `age-skill-overhaul-reboot-sjv7v.9`
|
||
|
Bo
|
fd7af3174a |
W6 runtime wave: authorize-first host mutation, honest adapter contracts, fail-closed deadlines (#1004)
## Summary Wave W6 of the skill-overhaul reboot (`age-skill-overhaul-reboot-sjv7v.7`) — the eight runtime-adapter skills, every checklist item verified against the live tree first. - **rch** [P0] — shipped reference docs instructed "always do, never ask" for remote `sudo chown -R`/`chmod`, daemon lifecycle, and fleet toolchain sync. Now: a strictly read-only autonomous diagnosis tier; every mutating first-action/self-fix across all seven reference docs marked **(authorize first)** (mechanical sweep); authority banners on the previously-ungated catalog docs; re-running the original command is autonomous only when that command is itself read-only; config-threshold/force_remote/allowlist edits and local key repair all gated. - **agent-mail** [P0] — default coordination mode split from an explicitly-authorized admin/DR mode (gating `clear-and-reset-everything`); retired `python -m` CLI rewritten onto the verified `am` CLI; typed unavailable/timeout/cleanup outcomes. - **codex-exec** — wall-clock deadline is mandatory (declared 600s default), expiry is fail-closed, and process-group tree reaping is a precondition: a host that cannot guarantee it does not run (capability unavailable) — no disclosure escape hatch. - **using-gc** — the conditional `~/.codex/config.toml` trust write and the codex binary update are both gated behind explicit caller authorization. - **agent-native** — equal author/validator context ids rejected before any freshness attestation; reproducibility via `SOURCE_DATE_EPOCH`. - **swarm** — disjointness check case-folded; non-empty `write_scope.exclude` rejected instead of ignored; two new test witnesses. - **agy-native / ntm** — discovery commands named, unavailable/deadline/cleanup behavior explicit, effects declared. Ledger (31 fixed / 3 rejected-with-reason / 7 deferred-with-reason): `docs/audits/2026-07-28-skill-overhaul-reboot/wave-reports/w6.md`. ## Validation - 49/49 strict frontmatter; regen clean; liveness + anti-spiral bats green; scenario-linkage PASS; swarm tests 8/8 (2 new witnesses); agent-native fake-runner 5/5; python ratchet no-growth - Cross-family review, two rounds (ceiling): round 1 three findings fixed (read-only autonomous tier, gated updates, mandatory deadlines); round 2 residuals fixed with the exact prescriptions (read-only re-run rule, config-mutation gates, fail-closed reaping — the disclosure escape hatch removed) Tracker: `age-skill-overhaul-reboot-sjv7v.7` |
||
|
Bo
|
5ed0cb2088 |
Skill overhaul reboot: lean plan, salvaged evidence, validator liveness, anti-spiral hardening (W0+W1) (#998)
## Summary Reboots the stalled 2026-07-24 skill-system overhaul as a lean wave program and lands its first two beads, plus the anti-spiral hardening from the 2026-07-28 incident brief. **W0 — salvage + plan** (`age-skill-overhaul-reboot-sjv7v.1`) - Lean reboot plan (`docs/plans/2026-07-28-skill-overhaul-reboot.md`): per-skill enhancement in 8 waves via normal RPI; proof-epoch machinery explicitly abandoned; 07-24 plan marked superseded. - Salvages the four Sol-reviewed per-skill audits (49 canonical skills) + program validation from `/tmp` into `docs/audits/2026-07-28-skill-overhaul-reboot/raw/`, the 07-24 plan/duel docs, and the 07-25 progress review; distills them into four actionable checklists (231 tagged items, all hypotheses to re-verify). **W1 — validator liveness** (`age-skill-overhaul-reboot-sjv7v.2`) - Seven skill validators (rpi, plan, implement, learn, ms, scaffold, security) had `! grep` forbidden-phrase guards that are silent no-ops under `set -euo pipefail`. Witnessed RED, converted to the `if grep …; exit 1` house form, reworded learn's boundary sentence. - `tests/scripts/skill-validator-liveness.bats`: whitespace-class static sweep + seeded behavioral liveness with unseeded pre-check. **Anti-spiral hardening** (incident: 326 control artifacts, zero implementation commits, RPI never invoked) - **rpi**: automatic admission (orchestration/delegation/"execute this plan"); phase lock after an accepted plan; spiral breaker — two consecutive control artifacts with no new implementation evidence → `NOT_BUILT`; subject-first reporting. All pinned by validator greps. - **validate**: nonempty-implementation-candidate precondition; `store-verdict` CLI mechanically refuses an empty subject manifest. - **AGENTS.md**: constraint floor (a plan/duel frozen without the active ADRs/blocking gates is invalid) + ADR-0016 pointer; phase-lock/spiral-stop lines in the core loop. - `tests/scripts/anti-spiral-contract.bats`: stripping any pinned phrase fails the owning validator; empty-manifest refusal is behaviorally tested. - Placement report with proposed host-level `CLAUDE.md` rule and `dueling-idea-wizards` packet-completeness patch: `docs/audits/2026-07-28-skill-overhaul-reboot/anti-spiral-hardening.md`. ## Validation - RED→GREEN witnesses for all seven guards; 15/15 bats across both new suites - 16/16 validate-skill unit tests; 9/9 rpi kernel tests; 8/8 skill validators - `scripts/regen-all.sh --check` clean; `shellcheck -S warning` clean - Cross-family (Codex) review round 1: 3 findings, all fixed; delta re-review in flight (two-round ceiling per plan) Known pre-existing: `validate-skill-frontmatter.sh --strict` warns on skill-builder's missing optional `context_rel` (present on `origin/main`; assigned to W4). Tracker: `age-skill-overhaul-reboot-sjv7v`; waves W2–W8 follow as separate PRs. |
||
|
Bo
|
d9eeee9cb3 |
chore(release): prepare v3.3.0 changelog and version bump (#989)
## What Prepares the **v3.3.0** release cut (last shipped tag: `v3.2.0`, 2026-07-03). No tag and no GitHub release are created here — tagging is gated on the live GC canary and the operator's go. - **Changelog reframe.** The `[3.3.0]` headline now leads with the deliberate subtraction of the guardrail cathedral (strict verbose step contracts, enforcement gates, injection hooks, command tombstones, retired lifecycle surfaces, the heavy out-of-session orchestration layer) — removed because that scaffolding degrades frontier-class models rather than helping them. What remains is the judgment-boundary membrane: caller-owned intent, one fresh independent validation, durable verdicts, pinned provenance. Subtraction is git-concrete: `cli/internal` packages **79 → 43**; reference orchestrator **~29k lines → ~1,300-line thin pack** (one commit removed 29,418 lines for 1,334). - **Post-07-17 delta folded in:** Gas City factory pack (preview) — official checksummed GC/Beads binaries fetched by the installer (no compile), mayor-driven door (human attach or agent drive via mail/sling) with heartbeat shepherd, the `using-gc` mayor-orchestration skill + four-layer visibility doctrine, rig-scoped dispatch intake, three disclosed upstream v1.3.5 defects (#4586, the cross-store claim fix, gastownhall/gascity#3985) with the preview→supported promotion criteria, and plan/premortem ground-truth routing. - **Version bump:** source fallback `3.3.0-rc → 3.3.0` (`cli/cmd/ao/main.go`); plugin manifests were already `3.3.0`. Adds a release-guard test asserting the fallback carries no pre-release marker (resolves audit minor 1). - **Release-gate fix:** trimmed the `using-gc` skill description (195 → 117 prose chars) to satisfy the 180-char budget — a blocker that landed with the GC arc — and regenerated its Codex/Gemini/pack projections. ## Recommended version: **v3.3.0** `v3.3.0` was an in-progress RC (`main.go` at `3.3.0-rc`, plugin manifests at `3.3.0`, changelog `[3.3.0]` drafted) that was never tagged; the GC pack + loop doctrine landed on the RC line. This cut finalizes it. ## Go / No-Go checklist (deterministic bar: docs/audits/release-readiness-3.3-2026-07-20.md + docs/runbooks/release-process.md) | # | Criterion | Status | Evidence | |---|---|---|---| | 1 | `go build ./...` | PASS | exit 0 | | 2 | `go vet ./...` | PASS | exit 0 | | 3 | Full Go test suite (`go test ./... -count=1`) | PASS | 63 packages `ok`, 0 FAIL | | 4 | Cathedral Cut conformance (`check-cathedral-cut-conformance.py`) | PASS | "Cathedral Cut conformance: PASS" | | 5 | Skill-mesh drift (`generate-skill-mesh.py --check`) | PASS | "up to date (48 skills)" | | 6 | Derived-artifact drift (`make regen-check`) | PASS | "All generated projections are current." | | 7 | Docs + release-doc gate (`make docs-check`) | PASS | CLI ref current; 395 links, 0 broken; skill count 48; release freeze intact | | 8 | `ao gate check --full` | PASS* | 66/67 pass. Sole fail = `workflow.install-drift`, a worktree-local symlink artifact (tracked `workflows/` is byte-identical to origin/main; passes in a clean CI clone — the audit's 67/67) | | 9 | Fast release gate (`ci-local-release.sh --quick`) | PASS | "LOCAL CI QUICK SANITY PASSED": 44/44 install-surface smoke, 33/33 release smoke, init smoke | | 10 | Skill token budgets / lint | PASS | 100 budgets pass (fixed `using-gc` 195→117 prose) | | 11 | Install story smoke | PASS | README/MIGRATION document `ao skills link`; all 6 curl installers are refusing tombstones; `ao version` runs; npx-first | | 12 | Plugin manifest ↔ corpus parity | PASS | manifests carry 48 skills, 0 drift | | 13 | Version bump applied to owners | PASS | `main.go` 3.3.0-rc→3.3.0; manifests already 3.3.0 | | 14 | Changelog updated + synced | PASS | `CHANGELOG.md` == `docs/CHANGELOG.md` (changelog.sync gate) | | 15 | Command/test pairing gate | PASS | main.go bump paired with `version_test.go` release-guard test | | 16 | Full release gate (`ci-local-release.sh`: race + security + SBOM + readiness) | PASS | "LOCAL CI PASSED [102s]"; release-artifact manifest resolved `v3.3.0` | \* `workflow.install-drift` is an environment artifact of running the gate inside a nested worktree whose `.claude/workflows/` symlinks resolve to the primary checkout. It is not release content: `git diff origin/main -- workflows/` is empty, and the check passes in a fresh CI checkout (audit reported 67/67 at origin/main). ## Operator items (require a human or a live tag — NOT attempted here) - **Live GC canary** on the next official Gas City pin — the preview→supported promotion gate. - **Git tag `v3.3.0` + goreleaser publish** — gated on the canary and operator go. - **Docs-site publish** (mkdocs pipeline) — separate from this cut. No tag. No release. |
||
|
Bo
|
6e873fdd9e |
docs(gc): teach the four-layer visibility doctrine (#986)
Adds the four-layer visibility doctrine to the GC pack teaching surfaces, distilled from the 2026-07-22/23 live canary arc where every stall was invisible to at least one observability layer and visible in another (three provider wedge classes, all reported "active" by robot state). - skills/using-gc: "Visibility: the four layers" — robot state / bead graph / pane truth / health machinery, each with its command and its when-it-lies note; disagreement rule (trust the lower layer) tied to the stall protocol; gc dashboard noted as native aggregation, OTel/Grafana deferred to 3.3.1. - deploy/gc/README.md: matching 15-line Visibility block with the core warning. - All skill projections regenerated; insertion-only; frontmatter and mesh projections byte-stable. RPI: Opus implement, fresh Sol (codex) validator — PASS on all 7 acceptance criteria, verdict.v2 persisted. regen-all --check and docs-check green (run fresh by both author and validator). |
||
|
Bo
|
189bc81867 |
feat(gc): 3.3 flow is the mayor-driven door — human or agent orchestrated (#985)
## What The 3.3 GC pack flow becomes Gas City's native human door, drivable by humans and agents alike (operator decision). Five commits: 1. **a903c23f8** `feat(gc)`: Mayor prompt rewritten observe-only → **shepherd** — polls external rigs' ready step beads and dispatches each via `gc sling <gc.run_target> <bead> --nudge`. Never claims, never authors, never closes. 2. **e58aeb5cb** `feat(gc)`: `invoke.sh mayor start|status|tell` — the agent control surface over native primitives (`gc session wake`, `gc session list --json`, `gc mail send --notify`; mail chosen over sling-text to avoid v1.3.5's inline-text auto-create). Mayor is now a `mode=always` standing session. 3. **bd8c34df6** `docs(gc)`: README — two doors (human attaches, agent drives via mail), heartbeat propulsion, #4586 context. 4. **2b6ffe9cf** `feat(gc)`: `skills/using-gc` rewritten as the mayor-orchestration skill (drive loop, bead-ids-only doctrine, GC liveness truth stack with both codex wedge classes, stall protocol) + all regenerated projections. 5. **362f4af79** `fix(gc)` (cross-family review: 1 BLOCKER + 5 MAJORs, all fixed): **shepherd-heartbeat order** (native `gc order`, 3m cooldown — mode=always keeps the Mayor resident but nothing re-prompts it; the order is the liveness engine); HQ filtered from rig enumeration; stall recovery = `session wake` (re-sling documented as a no-op for routed beads); `mayor status` tri-state fail-closed; mail authority limited to dispatch/status with bodies treated as untrusted data (pause/resume dropped — stateless under fresh wake); test stubs reject non-allowlisted verbs. ## Why On v1.3.5, demand-driven worker spawning never fires for rig-routed work (upstream gastownhall/gascity#4586, ours, with a stock-pack no-LLM repro). Shepherd-dispatch by a standing Mayor is both the v1.3.5-functional propulsion path AND the stock-GC operating pattern (their mayor prompt: create → sling bead-id → monitor) — so this flow survives the upstream fix rather than fighting it. Intent stays caller-owned: drivers hand the Mayor bead IDs, never prose work. ## Verification - `tests.python.test_gc33_thin_pack`: 34 passed (2 integration-gated skips) - `shellcheck -S warning` + `bash -n` clean; `scripts/regen-all.sh --check`: all 11 projections current - Every gc primitive verified against v1.3.5 source (cmd_mail.go, cmd_session_wake.go, cmd_sling.go, cmd_rig.go, decode_sessions.go, orderdiscovery) - Codex adversarial review round: all findings fixed - **Not yet proven live**: heartbeat-order discovery/scheduling, mode=always residency, wake-based recovery, end-to-end propulsion — the live canary follows this merge. |
||
|
Bo
|
cbe7ddbb5f |
feat(gc): ship thin native AgentOps factory pack (#980)
## Outcome Ships AgentOps 3.3 as a thin native Gas City pack and removes the accidental second orchestration control plane. - Removes the custom GC delivery command/package, packet/schema family, feeder/program engine, reducer/order, reliability registry, Beads capability mirror, and fork-baseline runtime checks (about 29k deleted lines). - Retains six bounded adapters for pinned toolchain materialization, clean bootstrap, native sling/status/doctor invocation, bead-isolated worktrees, moving-main PR delivery, and teardown. - Uses official Gas City and Beads behavior as the state owners, with required OTEL configuration. - Preserves Fable Mayor/Refiner, Sol-high planning and fresh validation, Terra-high default implementation, Opus-medium overflow, and support-only Luna. - Supports automatic Refiner merge after hosted CI or a manual-review toggle without locking `main`. ## Evidence - Exact official GC: `8ffc009ded781a2ada2077f3a29bd712b2def0bf` - Exact official BD: `8e4e59d39f3459a43cf21a3236a13eca4dd874f7` - Full pinned native boundary: 9/9 passed in 114.047s - Exact source-bead route replay: passed in 98.051s - Release replay: manifest integrity, thin tests and both pack lints, generated projections, contract compatibility, Bats contract, ShellCheck, test-removal ratchet, and `go test ./...` all passed - Fresh independent semantic verdict: PASS (Sol-high) - Exact delivered head: `e805f0e26ce21c2eae9e720f57fff2a705f3185b` - Subject manifest: `8554d065076f70d0e639ca353409d2a75dca7ac01e4cb65cb4a118e98c0770fc` - Verdict: `3f89376b675de854832f38b46ccfa7ad7ca54079ffde578769c33e1f118c68c1` ## Release boundary After this PR merges, the release qualification runs one fresh mixed Terra/Opus canary from merged `main`, with at most one external repair and one terminal retry. No live city repairs itself. The only known local fast-gate exception is `workflow.install-drift`: the installed workflow symlink resolves to the separate dirty primary checkout, outside this candidate. All candidate-owned gates passed. |
||
|
Bo
|
faff55ac2a |
feat(gc): bind native 3.3 factory workflows (#972)
## Summary
- bind the GC 3.3 bead-native workflow: Fable Mayor, fresh Sol-high plan
and validation, Terra-high default or Opus-medium overflow
implementation, Luna support-only
- add the bounded one-shot graph feeder, strict packet/worktree
identity, semantic terminalization, and model-free protected delivery
sweep
- make official Gas City v1.3.5 plus Beads v1.1.0 bootstrap repeatable,
disable unstable event propulsion/hooks, and prove quiescent teardown
## Reliability boundaries
- no Gas City self-repair loop, daemon, private scheduler, model
fallback, or main mutex
- semantic completion is independent of delivery; protected
PR/CI/rebase/merge is deterministic and moving-main aware
- event hooks are disabled because 3.3 uses explicit program admission
and cooldown delivery; native controller bead observation remains active
## Evidence
- full local release CI PASS at
.agents/releases/local-ci/20260722T113355Z
- two pristine standalone-clone cycles with official GC v1.3.5 8ffc009d
and BD v1.1.0 8e4e59d: repeat bootstrap, exact rig Dolt context, absent
event hooks, bounded events, enabled sealed delivery, and delayed
zero-process teardown
- fresh independent Sol-high pre-delivery binding PASS over exact head
|
||
|
Bo
|
26120d8394 |
feat(gc): add crash-only delivery thin slice (#969)
## Outcome Adds the bounded GC33-6 delivery slice outside core ao: a separately built crash-only reducer, strict admission certificate binding, immutable handoff and branch/PR receipts, native graph.v2 formulas, one-step disabled Order glue, and one centralized stock claim wrapper. Semantic bead: ag-agentops-33-gc-refinery-4km81.7 (closed after independent validation). Binding PASS: d3ac5a566e0f5197814e2dbcf04d0540849f58636ed8bb49a0faca7d6af94639 over manifest 155a089b4b461bda61a7f1ad1987c66f5755ac7c5628aa648e70740be2580a5a. ## Verification - Full cli Go suite: PASS (2,887 tests) - Focused race-enabled reducer suite: PASS - GC factory/executor Python contracts: PASS - Full executor gate: PASS (123 Python + 25 Bats) - Exact official GC v1.3.5 pack lint and no-start discovery: PASS - Cold replay: exactly one delivery, branch, and PR; six emitted artifacts validate against shipped schemas - Production Go surface: 922 lines, under 3,000 tripwire ## Boundaries No ao command, core port, default install, live city, real Git/forge/CI/merge adapter, daemon, scheduler, or factory.py import. Real adapters and delivery completion remain GC33-7. |
||
|
Bo
|
247fcccb5f |
GC 3.3: define the one-loop factory role pack (#961)
## Outcome Defines the GC 3.3 factory as one semantic intelligence loop with deterministic delivery: - Fable Mayor plus a bounded, nonbinding ambiguity adviser - Sol-high for plan binding and fresh exact-subject validation - Terra-high as the default writer and Opus 4.8 medium as explicit overflow/repair - Luna dormant and unroutable until later qualification - no model-driven delivery-policy/refinery loop - native GC sling/claim/scale-from-zero semantics retained - exact provider/model/reasoning/fallback runtime attestation - legacy composed program/refinery entry points and opposite-provider lifecycle roles removed Controller dispatch to the Fable adviser stays fail-closed until GC33-4 proves process/filesystem isolation. This does not claim that manual operator sling to the named on-demand target is impossible. ## Evidence Fresh Sol-high `verdict.v2`: PASS (`bb31806fc5e0714363a9e539121ee7aa19231431fb04ddfee1fce8376b57d272`) over subject manifest `119b7a6db2380af47d87a24aced60d96858dd9e413a54dc640376e27767e8d1e` (52 paths, 18 deletions). - focused acceptance: 124 tests PASS - projection owner: 4 tests PASS - bootstrap fixtures: 25 Bats tests PASS - complete GC static contract: PASS - factory/executor doctors: PASS - generated projection check: PASS - exact official GC v1.3.5 and Beads v1.1.0 provenance replay: PASS - `git diff --check`: PASS No city, model session, supervisor, tmux session, Dolt server, or canary was started for this pre-canary bead. |
||
|
Bo
|
a5f7be8364 |
Qualify deterministic Gas City factory for AgentOps (#924)
## Summary - pin and materialize an exact colocated Gas City and official Beads toolchain without editing installed binaries - add deterministic isolated bootstrap, recovery, teardown, exact workspace binding, and tracked .gitignore preservation - add bead-native Mayor, plan review, isolated Codex/Claude workers, binding Validators, rejection-to-Mayor rescope, fenced Refinery, integration validation, qualification, and protected PR delivery - make the local quick release gate deterministic after CLI cleanup ## Validation - fresh GC-managed Codex Sol verdict: PASS (verdict d1a1e03808b4605e49cc97423c7570b04d581c9ee1fad9aa8f1daf6e72d6f0ef) - focused GC executor/factory/projection suite: PASS (32 packet + 77 factory + 4 projection + 21 bootstrap tests, plus doctors and static contracts) - teardown suite: 7/7 PASS - local-ci-fast: PASS - exact v16 mixed-provider live canary: Terra and Opus 4.8 workers in parallel, opposite-family candidate validators, Opus Refiner, Sol integration validator, all lifecycle beads closed, clean managed teardown ## Scope The follow-on Fable 5 Mayor/Refiner, Sol-every-bead validation, and Luna support-worker topology is deliberately not part of this historical v16 baseline; it will build on this foundation in a separate bead program. |
||
|
Bo
|
43e2971fd8 | fix(verdictcheck): U+2028/2029 canonical digest parity + duplicate-key rejection (age-gocli-audit-remediation-6fybr.1) | ||
|
Bo
|
64e93c0428 |
refactor(cli): complete the post-Cathedral-Cut Go CLI cleanup (#919)
Completes the Go CLI migration: one composition model, no tombstones, no dead packages, hermetic tests, and a cross-language verdict contract corpus. Net −88k lines. ## What - **Tombstones + prune deleted**: the 21 registered 'Removed in the Cathedral Cut' stubs, `zzz_default_spine.go`'s runtime prune, and the ~30 registered-but-pruned legacy command families are gone. The registered tree IS the production tree; retired verbs fail with exit 1 + a data-driven replacement hint pointing at docs/MIGRATION.md (now covering nested verbs). Non-runnable parents reject unknown subcommands instead of printing help with exit 0. - **~35 unreachable packages deleted** (cliapp, canon, pawl-era verdict parser, pool, harvest, knowledge, wiki engine, vibecheck, cli/embedded, …) after import analysis + script/CI consumer verification. Retained with named consumers: archcheck (arch gate scripts), eval island (rubric schema drift guards), drwitness/drrebuild (witness-crosscheck). - **Composition decision recorded**: single cmd/ao root + internal/commands/<family> modules + clicontract; the never-adopted cliapp.BuildRoot is removed. New overview: docs/architecture/go-cli.md (repairs two broken links). - **Hermetic tests**: flag_matrix_test.go builds the exec'd binary from package source — the stale cli/bin/ao failure class is closed; TestHermeticBinaryMatchesSourceSurface pins source↔binary correspondence. - **Verdict contract consolidated**: verification extracted from status.go into cli/internal/verdictcheck; 19-case golden corpus (tests/fixtures/verdict-contract) runs through Go + Python + JSON schema via blocking gate `contract.verdict-corpus`. One divergence closed (empty-string context ids now rejected by all three). - **Fossil guard chains retired**: embedded-sync (mirror had zero importers), retired-family compat baselines, dead go_cli_compatibility.bats, stale gate globs/grandfather entries. ## Evidence - Full-tier deterministic gate: **66/66 PASS** on the rebased tip (fresh source-built binary) - cli suite 2,795 tests green; race suite green on touched packages; vet + pinned golangci-lint clean - Cathedral Cut conformance PASS; CLI reference/surface projections regenerated and checked - Independent cross-family validation (fresh Codex context, frozen SHA): 5/6 claims CONFIRMED; 6th NOT_PROVEN only due to sandbox networking (its cached rerun of the same suite passed) - Test-count decrease is deliberate and carried by a Test-Removal-Reason trailer |
||
|
Bo
|
45818c82fd |
feat: add bead-native Gas City factory (#917)
## Summary - add a bead-native Gas City factory pack with Mayor, fresh plan review, Codex/Claude Worker and Validator pools, and a fenced Refiner - make the bead graph the sole work/lifecycle authority; JSON artifacts are digest-bound evidence only - isolate each experiment in its own branch, worktree, Git index, and lease, then admit exact PASSed candidates to Refinery - make lease, verdict, rejection, successor, assembly, reassembly, PR landing, and partial closure transitions crash-replayable - enforce fresh-worker rescope after FAIL/NOT_PROVEN and an atomic max-attempt HOLD - encode the operating contract, live canary, role archaeology, and Bun Rust-port lessons in AgentOps docs ## Validation - live GC canary: Claude Worker -> Codex Validator -> Claude integration Validator -> Codex Refiner -> PR #916 -> landed `b80a752aad3843af66160b08a823aaed57e07169` - `./scripts/check-gc-executor.sh`: 20 packet tests, 29 factory tests, 4 projection tests, and 8 bootstrap Bats tests PASS - both GC packs lint PASS - Ruff, ShellCheck, Python compile, and generated projection checks PASS - branch-built `ao gate check --fast`: 13/13 PASS - branch-built `ao gate check --full`: 66/66 PASS - independent fresh-context audit of exact head `1b18cf663ece790a12cd840f6eed2856852c552f`: PASS ## Contract The unit of work is the bead. The pack defines roles, prompts, commands, and policy; it does not own a parallel pack/JSON lifecycle. A rejected experiment must be terminal and closed before any Mayor rescope or successor reduction can proceed. |