The Windows Claude live run remained active, but one status projection hit a
`.git/objects/*/tmp_obj_*` name between Git's create/rename and returned
ENOENT. Polling now retries at most three reads only for that exact transient
path shape; unrelated ENOENT and every run/auth/artifact failure remain hard
red. Focused tests prove both the eligible race and an unrelated missing
artifact. The underlying control projection race is ledgered for an engine
post-release fix.
Co-authored-by: Claudexor <noreply@claudexor.dev>
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Windows write_text materializes CRLF, while mutation_evidence reads normalized
text; the retry eligibility used raw bytes and therefore denied Windows its
one allowed retry. Use the same normalized seed comparison on every OS and
pin it with a CRLF regression test. Strengthen the live prompt to require a
filesystem tool action and read-back verification, and run the Codex lane on
gpt-5.4 medium: low effort twice returned successful prose without editing.
The single bounded retry and all hard-red failure classes remain unchanged;
a final no-edit includes a bounded answer preview for diagnosis.
Co-authored-by: Claudexor <noreply@claudexor.dev>
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Stable live CI exposed two test-layer problems after the 3-OS fixture path
went green. A successful Ubuntu Codex run returned a complete EOF-read
artifact but ignored the one-word README edit; the live lane now permits
exactly one second model attempt only for that typed no-mutation condition,
with a fresh idempotency key and both run IDs recorded. Any routing, auth,
engine, process, artifact, timeout, wrong edit, or second no-edit remains
hard red; fixture remains one attempt.
Windows full-test also exposed three host-shaped Node fixtures: tests created
POSIX bin/node while production correctly selected node.exe, and one assertion
spelled `/`. They now inject their intended fake Node layout explicitly and
compare path components, without changing product behavior.
Co-authored-by: Claudexor <noreply@claudexor.dev>
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Ouroboros now delivers the Claudexor engine it integrates (PR #101 shipped
the integration without the runtime; a user upgrading in-app hit a dead
`claudexord_not_installed` Connect). This lands the owner-locked design:
- one exact pin (`ouroboros/claudexor_runtime_pin.json`, now bound to the
public Claudexor 3.3.7 bytes: build a4b004d7, sha256 fe07b839…, official
Node 24.16.0 for all five platforms) drives seed, download, verify and
next-spawn selection; a filled pin never degrades to a PATH binary;
- hybrid delivery: the release archive ships as an offline seed in new
DMG/tar/zip bundles and downloads foreground-only for upgraded old
installs, strictly inside an explicit user action (Connect, Repair or a
delegated/review start) with visible progress;
- one morphing Connect button (Install/Update/Fix & connect); updates stage
side-by-side and activate at the next natural daemon start or Ouroboros
restart, never hot-swapping a live daemon; a repair never replaces the
serving target of a live matching daemon;
- 3-OS CI gate and release-artifact smokes now exercise the real managed
chain (install → exact probe → owned daemon → delegated run →
identity-bound graceful stop) instead of `npm install -g claudexor@next`;
- Windows fail-fast helper for critical PowerShell 5.1 steps, utf-8-pinned
subprocess decoding, handshake reads the frozen `engine.sha` contract.
Review: triad (fable, sol scope, gemini) + adjudicated batch + confirmation
+ pin confirmation, all SAFE; suites on this base: Python 7775/1 skipped,
web 138/138, delivery tests 17/17, managed fixture smoke end-to-end.
Co-authored-by: Claudexor <noreply@claudexor.dev>
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Brings the public line's 23 commits — MiniMax direct provider, crash-safe
managed updates, the two-pass hermetic commit gate, and the Windows/release
CI fixes — into the Claudexor-integration line (v6.89.0).
Union resolutions of note (15 conflicted files):
- Version carriers stay 6.89.0 (this line IS the next feature release on top
of 6.88.0); the README Version History carries both lines' rows.
- config.py keeps the SSOT refactors (_clamped_number_setting,
settings_env_keys()) — the MiniMax keys ride automatically via
SETTINGS_DEFAULTS.
- gateway/control.py restart callback carries BOTH fixes: owner=True (the
runtime-mode re-read on owner restarts) and the bool return their restart
serialization reads.
- supervisor/workers.py terminal emission: their terminal_task_metadata
projection (a superset of the evolution_transaction carry) + this line's
cost-emission discipline (`emitted`, unavailable projections never publish
None placeholders).
- scope_review keeps the reviewer-window SSOT (the per-model window helpers
their side still carried are deleted); MiniMax window probing moves into
reviewer_window.reviewer_route/resolve (region-derived base_url +
authenticated catalog probe). The delegated session branch coexists with
their _ScopePromptContext/represent_binary call shape.
- shell.py keeps the claude_code_edit retirement (D10): their copies of the
retired helpers are deleted, their now-unused resolver import dropped.
- platform_layer keeps OUROBOROS_BUNDLE_DIR bundled-resource bases and gains
their ripgrep-pin dataclass; updates.js takes their redesigned
preflight/plan/typed-apply flow whole (it subsumes this line's
always-merge-aware intent); settings.js keeps the D10/6.1 picker removals
and gains the MiniMax region field.
Verified: import smoke, ruff F clean, 11 focused pytest files green
(including their test_update_apply_routing), web tests 136/136.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
CI / build (dmg, macos-latest, macos-arm64, syft_1.50.0_darwin_arm64.tar.gz, syft, e32fdb9d47823fa633748a1efca2528fd77c37469ea93c9e40ab835da44e4cce) (push) Has been cancelled
CI / build (tar.gz, ubuntu-latest, linux-x86_64, syft_1.50.0_linux_amd64.tar.gz, syft, bf7b29ff57f06da30918266a0e1c2885a8f99784798d1bdb1628886aa015d788) (push) Has been cancelled
CI / build (zip, windows-latest, windows-x64, syft_1.50.0_windows_amd64.zip, syft.exe, 815ee6973ec5dff6a671d7f41b0e78835a8c45b91d5a39f4743ea1cee833d3be) (push) Has been cancelled
The release build lane added on 2026-08-02 (SBOM/provenance work) first ran on
the v6.88.0 tag and carried two never-exercised defects:
- The linux/windows archive smokes checked repo.bundle at the archive root,
but PyInstaller 6 onedir places datas under _internal/ (the runtime already
resolves the bundle root across Resources/Frameworks/_internal, and the
macOS DMG smoke checks the .app Resources path that BUNDLE maps correctly).
- download_ripgrep_standalone.ps1 read the first whitespace token of the
upstream .sha256 sidecar as the digest; the windows zip sidecar is prose
("SHA256 hash of <name>:" + hex on the next line), so the parser compared
against the literal word 'sha256' and the pin always failed. The digest is
now the first 64-char hex token wherever it sits, failing loudly if absent.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Windows full-test died at ~16% of the parallel pass with a session-wide
KeyboardInterrupt: pid_is_alive used os.kill(pid, 0), and on Windows CPython
maps signal 0 to CTRL_C_EVENT delivered to the probed pid's console process
group — a liveness probe of a same-console pid (e.g. our own) interrupted the
whole pytest session. The probe now uses OpenProcess + GetExitCodeProcess
(PROCESS_QUERY_LIMITED_INFORMATION, explicit restype/argtypes so 64-bit handles
survive, ACCESS_DENIED reads alive, exit code STILL_ACTIVE reads alive); the
POSIX branch is byte-identical to before. Every caller is a boolean liveness
gate, so the semantic change is strictly "stop signaling".
With the interrupt gone the suite ran to completion and exposed four masked
Windows-only failures, fixed here:
- scripts/run_external_review.py: the staged-patch apply returns to text-mode
stdin, symmetric with its text-mode capture — the exact configuration Windows
CI was green with through v6.87.5. The bytes stdin introduced with v6.88.0
broke CRLF worktrees (capture strips CR, bytes write never restores it).
- tests/test_plan_review.py (schedule-failure panel test): a REAL event queue
(MagicMock read as non-live and clamped the window) plus a 30s scout window
replace the 0.25s window that slow runners raced into a pre-launch admission
refusal before _schedule_task could even fail; with every schedule failing the
collect loop still exits immediately, so the test stays sub-second.
- .gitattributes (new): *.svg pinned to LF so the public-site cache-buster hash
test sees the committed bytes under core.autocrlf=true checkouts; all 12
committed svg blobs are already CR-free, so nothing renormalizes on POSIX.
- tests/test_evolution_state_integrity_v3.py (nested-conftest child): the child
python gets SystemRoot and TEMP on Windows — it cannot boot without
SystemRoot, and the serial pass had never reached this test while the
parallel pass was still red.
Full 3-OS matrix green on this exact tree: workflow_dispatch runs 30941773079
and 30943332598 (full-test ubuntu/macos/windows, ui-smoke, docker-ui-smoke,
docker-portable-test, skill-smoke x3, integration-test all green).
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Community sprint release. PR #87 (@octo-patch): MiniMax as a first-class
direct provider with maintainer follow-ups (live model catalog, region
restart policy, deep-slot clear-instead-of-fill on the guaranteed 512K
floor, docs/secret-enum sync). PR #90 (@ndrew1337): managed-update gate
hardening — exact-SHA promotion under the update lock, serialized
restart, mandatory blocking assisted post-commit test gate with
auto-rollback, and the owner-decided Q1=C dirty-stash lifecycle (local
work never enters committed history; restored after boot finalize or on
rollback; conflicting restores keep a disclosed stash entry). PR #91
(@ndrew1337): the two-pass hermetic pytest commit gate mirroring CI's
parallel+serial split with fail-closed crash/plugin/parallelism/deleted-
suite blocks, process containment extracted to process_containment.py,
and 64-bit-safe Windows Job Object ABI declarations.
Windows CRLF hardening (first full 3-OS matrix on the merged tip): every
multi-line git stdin payload now rides a BINARY pipe — the evolution
orphan-ref transaction (text-mode pipes turned 'start' into 'start\r'
and every containment transaction silently degraded to the decomposed
CAS fallback), the hermetic gate's diff replay in _run_git, and the
operator review script's staged-patch apply. The shipped two-pass gate
is versioned v6.88.0 across docs/tests (the contribution's provisional
v6.89 labels are retargeted).
Version carriers: VERSION, pyproject.toml, web/package.json,
GATEWAY_CONTRACT_VERSION, README badge + Version History (6.83.0 rolled
off per the P9 minor-row cap), ARCHITECTURE header.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Second pass over the cross-repo review backlog. One finding needed adjudicating
because a pinned test appeared to forbid it; the rest is small fixes and
sentences corrected against the code they describe.
THE WAIT THAT OUTLIVED THE TASK
`delegate_wait` is deliberately absent from `_DEADLINE_CLAMPED_TOOLS`, and a test
pins that absence with a docstring explaining it: neither escape hatch applies,
which is why the ToolEntry value (2100s) really is the bound. The finding claimed
the task deadline is bypassed. Those are two different concerns, so it was
settled by execution rather than by believing either one.
Measured. With ten seconds of deadline left, `web_search` gets its outer timeout
clamped to 1s while `delegate_wait` keeps all 2100 -- nothing upstream cuts it.
Then a real call: a run held RUNNING with its cursor still, a 2s deadline, and
`wait_sec=8`. It returned after 8.0s, with `deadline_remaining_sec` at -6.03. The
task slid six seconds past its own deadline inside one tool call, which is
exactly the defect that set was built for after the TB2.1 gpt2-codegolf
post-mortem.
So the finding is real and the pinned invariant survives untouched, because the
bound belongs in the tool rather than in that set. The outer clamp is a
thread-kill; this tool's entire contract is the graceful typed `no_progress`
return, and clamping it from outside would buy back the KILLED call the pinned
test exists to prevent. The window narrows to the remaining deadline instead --
narrow-only, the same shape `_bounded_max_seconds` already uses two hundred lines
up for the delegated run's own ceiling. The same call now returns in 1.0s with
0.98s of deadline still in hand, and its `waited_sec` reports the window it
really waited. A nanny with no deadline, and one whose deadline has already
passed, are both left alone: `deadline_remaining_sec` answers 0.0 for both, and
forced finalization owns the expired case.
THE THIRD SITE OF ONE CLASS
`non_final_rows` is `cost_final`'s disclosed cause and rides with it by contract,
"a flag no reader can reconstruct" otherwise. The root branch of
`_authoritative_terminal_cost` re-derives `cost_final` against the SUBTREE and
carried three subtree fields across -- but not this one. A root whose own rows are
all settled, turned non-final purely by a child's open row, reported a cause of
zero: not final, caused by nothing.
DELETIONS
* `settle_run` and `run_delegated_review_session` each derive the same applied
facts from the same `summary`, and each fell back differently when the engine
disclosed no model: `custody.model` in one, `route.model` in the other. Both are
the REQUEST. The durable ledger row and the reviewer's actor record could
therefore disagree about the same run, and the same duplication already forced
`applied_access` to be fixed twice in the previous commit. Both fallbacks
deleted; the two derivations are now textually identical.
* `_poll_session_terminal` timed a session out and said the run "was cancelled",
unconditionally -- while its own `cancel_and_verify` sits in a try/except that
logs and moves on. The claim was made whether or not the cancel landed, which is
the shape `record_containment_fault` forbids by name. The message now states the
budget it exceeded and stops there.
SMALLER, AND ONE RACE
* The owned-daemon spawn timeout raised its typed refusal and walked away from the
child it had just started. That child is ours and alive, and `self._proc` still
pointed at it, so the next `ensure_running` spawned a second daemon beside the
first -- one more per retry. `stop()` could not clean up either: by contract it
terminates only a daemon we successfully started. It is killed and forgotten
now, through the kill path `stop()` already had, which moves into a helper
instead of existing twice.
* `record_reviewer_slot_executions` was an unguarded read-modify-write, and
`run_parallel_review`'s own first line says the triad and scope surfaces run
concurrently. Two threads, one file: both read the same "before", and the slower
one wrote its rows over the faster one's, so whichever surface finished first
lost its whole «Выполняется как» line. `write_text_atomic` makes the write
untearable and says nothing about the read before it. An in-process
`threading.Lock` closes it -- the concurrency is threads, so nothing more is
needed.
* `_breakdown_bucket` summed `int(row.get(field) or 0)`, collapsing an ABSENT
token count into a reported zero at the aggregation layer -- undoing
`disclosed_tokens`, which keeps null as null at the row layer on the control
schema's own instruction ("never render null as 0"). A page of sessions that
reported no counts displayed a confident "0 tokens". A bucket is now absent only
when not one contributing row has the number, a partially-reporting bucket sums
the rows that did, and a measured zero stays a zero.
* Three bootstrap dependency-install failures logged at ERROR. Each is RETURNED as
the function's value and every caller consumes it, so an offline or flaky-mirror
bootstrap -- which continues, and may already have every package it needs -- read
as a crash in the launcher log. Warning.
THE UI SAID THINGS IT COULD NOT SEE
* The account card painted a window red off a snapshot the RUNTIME ignores. The
runtime skips any quota snapshot that is not `fresh` ("an old reading must not
block a lane"), so a stale spent window still dispatches while the card reported
it as down. Same bar on both sides of the glass now. The card also read
exhaustion off the single highest `used_ratio`, so a cooling constraint hid
behind a busier one -- and vanished entirely when it carried no ratio at all,
since a non-finite ratio was skipped before the cooldown could be read. Any
spent constraint counts, which is what the runtime does. `freshness` is a
required member of the daemon's snapshot schema; the fixtures carried none, and
now carry it as the wire does.
* A saved credential-account pin that discovery no longer returns matched no
option, so the select fell back to its first entry and redrew the row as
"automatic rotation". The pin only LOOKED gone until the panel was saved, which
then really did widen which account the reviewer may spend. Carried through as
"(not in discovery)", mirroring what the model list beside it already did, and
the select is drawn whenever there is something to show rather than only when
discovery is non-empty -- the daemon being down is the very case that needed it.
* The executor chip's tooltip said the work "ran on your <harness> subscription".
The chip cannot see the run's spend at all, and the ledger's own rule is that a
session is free only when the harness says so. It states where the work ran.
CLAIMS CORRECTED, CODE UNTOUCHED
`_apply_scope_authority` never said WHOSE window a retrieving row's authority is
about. It is the acked harness ROUTE's -- `reviewer_window.reviewer_route`
fingerprints the row under its own provider precisely so the ack lands on the
route it travels. It is not the model the engine reports back, which arrives only
after the run and is absent on older telemetry. Re-keying that lookup to the
reported model was measured: it fails every session scope row and closes a
delivery path the owner deliberately opened. When the engine resolves something
else, `capability_delta` already carries it on its own axis.
Four sites said a truncated primary output "could not be fetched and verified"
without naming the check. The engine publishes no content hash, so verification
is an equal byte count or the preview carried as a prefix -- enough to catch a
truncated, empty or wrong-length read, not enough to bind the bytes to a digest.
Each now names it, including the platform smoke, whose "tied to the run's own
claim" invited the strong reading.
`close_absent_run` asserted "Nothing is mutating, so this is not a containment
fault". Absent is a fact about the daemon that ANSWERED. Under the D30 owned
daemon Ouroboros provisions the engine itself and `ensure_running` will restart
one and rediscover its descriptor, so across that boundary a 404 can come from a
different daemon than the one holding the run. Unreachable and unknowable, not
quiet. Closing anyway stays the deliberate trade it always was, now stated as one.
`executor_route` was documented in three places as the route the work "really ran
on". It is the route resolved once at dispatch -- a request, not a receipt -- and a
landing below it is disclosed on `capability_delta`, not by rewriting the field.
`custody_durable` joins `_session_usage`: whether the durable start row landed is
already a fact the caller acts on, and carrying it into the actor record makes a
verdict delivered without custody legible afterwards. One key, disclosure only.
The login card's claim that a copy-paste command "is only ever issued for a job
that really is client_pty" is true of the CREATE route only; the poll route still
returns one for every job. The client reads the create answer alone, so the
comment is corrected to say what makes that safe rather than the server being
made to stop -- which costs more lines than the one already ignoring it.
NOT CHANGED, AND WHY
`applied_access`'s `summary["access"]` fallback was reported as still present at
two sites; the previous commit had already deleted both. Three subtractions, not
four. The double-bill relaunch is closed by that commit's `_settled_failure`
guard at the executor -- verified by disabling it and watching two pins fail -- and
the duplicated-facts half of the same finding is closed above by deletion rather
than by a shared reader, so no rejection layer was built. One finding was left
entirely alone as agreed.
VERIFICATION
Every behavioural fix proven by execution, and every pin mutation-tested by
reverting the fix and watching that pin, and only that pin, fail -- eight mutants
in all, including two for the wait clamp (removing it, and dropping its
positive-remaining guard) so the deadline-less control cannot be satisfied by the
same code as the clamped case. 643 tests across the fifteen touched suites pass,
`ruff check . --select F` is clean, and the web suite is 93/93 (91 before, two new
pins). Production is +153 lines across fifteen files, of which 88 are comments and
about 56 are docstring or message prose; executable production lines are +58/-32.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Five adversarial lenses BLOCKED a6a3c1f. Two defects were code; the rest were the
candidate describing itself untruthfully, which is not a lesser category. Every fix
below was reproduced by execution first and is pinned by a regression that fails on
the old behaviour (mutation-checked with PYTHONDONTWRITEBYTECODE=1 and cleared
__pycache__).
A2 (critical, code) — the P3 blocking scope gate FAILED OPEN. Measured on one panel
shape: api_chat status=sub_floor -> BLOCKED=True, agent_session
status=session_advisory -> BLOCKED=False. A panel of retrieving rows produced ZERO
authoritative verdicts and committed, because partial_quorum_shortfall only fires
above zero responders. Fixed in the ROW, not the aggregate: session_scope_authority
now returns blocked=True with the twin of the api row's sub-floor message, so
authority keeps ONE owner per delivery and the quorum stays a discloser. Widening the
aggregate to responded<required was rejected — it would make the aggregate a second
decider and turn sanctioned floor SKIPS (budget_exceeded, low-context) into blocks.
A2 second half — the >=200K floor was decorative. Retrieving rows were excluded from
Capability-Evidence probing, and their opaque harness[=model] target does not resolve
through provider_for_model, so no product path could ever reach confirmed/asserted:
advisory-only was the mode's only possible outcome. Session rows now fingerprint under
their own agent_session provider (never filed under a guessed openrouter), the
scope-slot save offers them the SAME owner-capability-ack the api slot uses against
their own floor, and the floor rides the notice as floor_tokens so the UI asks about
the number that route is judged by. No new mechanism: probe/owner-ack/notice/confirm
flow are the shipped ones.
A4 (critical, code) — two write vocabularies in one module, and the weaker one signed
the proof. Nine ordinary stdlib writes (shutil.copy/move/copytree, Path.touch,
os.symlink/truncate/chmod, extractall, unpack_archive) parsed to a fully-resolved AST
with ZERO targets while _INTERPRETER_ANY_WRITE_RE in the same file called all nine
writes — so "no targets, nothing unknown", the callers' proof of read-only, was handed
out for a payload that writes. NOT a runtime regression (identical on fc9c152), but the
claim marked a failure class closed. SSOT repair: the walker now models every spelling
the regex enumerates, resolving the destination where an argument names it (so an
out-of-repo copy still runs) and answering UNKNOWN where none does. Two adjacent holes
of the same class closed while there: a `.write` on a receiver the walker cannot trace
is UNKNOWN rather than a proven read, and the chained `open(p,"w").write(x)` form
resolves instead of being lost. Scoped to the regex's own discrimination, so
`dict.copy()` / `yaml.dump()` are not newly refused.
A1 (critical, docs) — the constitution stated a falsehood about this tree. BIBLE and
three ARCHITECTURE sites said the retrieving scope mode was PENDING IMPLEMENTATION and
that `low` was the only selectable path, while CHECKLISTS, README, the selector, the UI
and the executor all shipped it. Stale sentences deleted, five surfaces aligned on the
already-correct CHECKLISTS wording (D13 authorises the BIBLE edit).
A3 (critical, honesty) — BIBLE declared a constitutional bound with no implementation:
"the artifacts the session opened are recorded as FORENSIC evidence". A grep across
ouroboros/ and supervisor/ finds nothing. The bound now says the recording awaits an
upstream Claudexor read-event capability and is not performed today.
B1/B2 (high, false disclosure) — README:291 claimed drive was untouched and that a
provable write elsewhere still runs. Measured base->candidate with identical inputs: a
node inline READ and a node SCRIPT invocation of another task's drive both went
ALLOW->BLOCK, and with the DEFAULT cwd (the repo) every non-python inline invocation is
refused. Guard kept (the narrowing is defensible); the DISCLOSURE fixed at full size in
README, in the fence comment, and mirrored into the CHECKLISTS item-21 standing block.
B3 (high) — no sixth self-lowering detector built. The legacy reviewer-model keys were
equally reachable, so the marginal delta was thin; the escalation was A2, and A2 is
fixed. The BIBLE bound now describes owner INTENT and names what is actually enforced.
B4 (high) — a breached run's ad-hoc cancel swallowed every exception and then told the
agent "The run was cancelled" unconditionally, exactly what record_containment_fault's
own contract forbids. Now goes through custody.cancel_and_verify and builds the sentence
from its typed outcome.
C1 — containment_faults.jsonl documented (module map + drive tree); "no parallel store"
corrected. C2 — the one harness-name branch left in the core is a named residual in
DELEGATED_ADMISSION §7 with its removal condition; the branch is load-bearing for D30.
D1 the 5000->5100 raise is disclosed in the release line (measured 5049). D2
non_final_rows, declared on ChatOutbound in both mirrors, now actually reaches it. D3
the delegate_wait ceiling is clamped to the tool's own timeout and pinned to it by test
— above it the setting bought a killed call, not a longer wait. D4 the dead
agent.resolve_dispatch_executor entry point is removed and three ARCHITECTURE
references now name the real resolver. D5 two unused parameters dropped. D6 accepted as
inherited from the base, unchanged here.
Also, by request: the --scope-only exemption is removed from run_external_review.py
entirely — flag, _RAW_DIFF_CAP_LANES and _raw_diff_cap_decision. The whole-tree scope
pass it existed for was dropped from the plan, it had no caller and no test, and it
relaxed a refusal gate. The cap is byte-identical to its pre-exemption form.
And one defect the panel missed: a6a3c1f introduces two F401s that fc9c152 does not,
so the CI quick tier (ruff check . --select F) would have failed. Fixed; ruff clean.
VERSION unchanged at 6.89.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Hermetic full suite on 74a7330: exit 1, nine failures — every one classified by
EXECUTION before any change; none is a code regression, none is base-pre-existing
(all five pre-existing tests pass on fc9c152 in a detached worktree).
(b) H2 fence, 3x test_runtime_mode_core tripwire tests: pinned the retired
enumerate-and-detect contract (vector admitted, write executed, post-hoc tripwire
reports). The full inverted fence refuses those inline vectors UPFRONT with
nothing executed — proven identical on the H2 winner's own head (all three red on
cxi/p2-axes@5e97465 exactly like the candidate). The tripwire layer itself is
alive and now tested with vectors that legitimately pass the inverted fence
(script-file invocations — the fence judges only payloads it can read): probed
first by hand, the write happens and LIGHT_MODE_REPO_WRITE_BLOCKED fires. A new
pin (test_light_mode_inline_writer_is_refused_upfront) records the contract
change explicitly: upfront refusal, file untouched. fence_probe re-run: PASS.
(b) p6 seam, 2x test_claudexor_owned_daemon: pinned p6's decision-object feed of
_record_executor_facts; the fusion re-homed the fact to the ONE stamped task
record (p6's own stated principle - a projection of the decision, never a second
derivation - one level stronger). Assertions unchanged, feed ported.
(b) H3 seam, 2x test_max_tokens_constants: pinned p7a's _fit_shared_review_prompt
name; the fused candidate keeps p5x's api/session-split _fit_triad_prompt with
p7a's window internals. Tests now drive the surviving function through the same
assemble seam the production caller uses; both semantic pins (quorum sizing;
local-route window) unchanged.
(b) 2x source-carrier pins red on p6's OWN head (proven by execution on 1534e97):
test_page_chrome_static effort round-trip (6.3 moved the carrier to per-slot
reviewer_slots.js) and test_ws5_carryover probe-gate pin (the gate grew the 6.1
OUROBOROS_REVIEWER_SLOTS key and wrapped; still route-affecting-gated - the
ported pin asserts the surviving expression).
Also lands the review-runner change (scope_only_cap_scope.diff, +70/-8):
--scope-only exempts a scope-only run from the raw-diff cap that governs the
advisory/triad lanes (scope assembles its own atlas pack under its own budget)
with a loud no-advisory/no-triad-coverage disclosure; the p5x trusted-rerun list
entry (review_execution.py) the pre-p5x patched copy lacked is preserved, and the
call-site import the patch orphaned is removed. ISO-SPAWN (suite children with
scrubbed envs writing to the live data root) is measured as a RIPPLE
(44 import sites + derived import-time constants), NOT fixed here per the hard
limit, and ledgered as a precisely-diagnosed disclosed residual.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 3-OS Claudexor platform gate (D20/D26): claudexor-platform-gate.yml on
ubuntu/windows/macos runners with explicit API keys, honestly named as a platform
smoke (subscription auth NOT covered), + scripts/claudexor_platform_smoke.py and
its tests (27 green). Conflicts were the six version carriers only, resolved to
the base side per the single-final-bump policy. Guard PASS with all 8 contribs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The review lanes: AgentSessionReviewExecutor via the review_execution seam,
scope_review_session retrieving mode (SESSION_WINDOW_FLOOR=200_000 agreeing with
BIBLE.md:281 — H7 both halves landed and speak one number), D19 typed verdict with
light-model extraction gated on outputConformance, delegated advisory route.
delegate_custody (19 hunks) and delegate.py (17 hunks) resolved per plan §2a: p34's
34 post-fork fixes win (SETTLED_UNREAD, containment-fault projection, pending
invocations, _validated_invocation retry truth, canonical ledger root, disclosed
truncation), p5x's unique route-pool pin ('harnesses': [route_id]) taken; p5x's
inline staging cluster NOT re-added (p34's delegate_output.py is the one copy —
AST-verified identical bodies). Fixed one merge artifact: a duplicated
invocation_id/owned_project_id re-init after gateway construction clobbered the
retry token (caught by the transport suite). H2 files stayed on the full inverted
stack; fence_probe PASS. Guard PASS with p5x refactor moves dispositioned
(prompt assembly -> review_execution.py with alias re-imports; _FALLBACK_* regex
window superseded by the D19 light-model extractor; start_was_requested dead
surface not carried).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Range transplant via merge-tree with merge-base=7caf7c1 (contaminated-history
branch contributes its post-terminal delta only; D27). 65 files. All 8 conflict
blocks were version carriers, resolved to the base side (6.87.6) per the
single-final-bump policy (C7); the api_types.js conflict additionally dropped
the terminal typedef block the incoming side inherited from 7caf7c1, and the
README conflict dropped intermediate 6.88.x changelog rows carrying private
SHAs. PTY scan of the result: clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Move the macOS install flow to the top of README and /install/, add the approved drag-to-Applications visual, and package the Applications shortcut in the DMG.
Bind the shortcut to final-archive smoke and release proof, then remove only the copied shortcut from SBOM staging before Syft.
CI / build (tar.gz, ubuntu-latest, linux-x86_64, syft_1.50.0_linux_amd64.tar.gz, syft, bf7b29ff57f06da30918266a0e1c2885a8f99784798d1bdb1628886aa015d788) (push) Has been cancelled
CI / build (zip, windows-latest, windows-x64, syft_1.50.0_windows_amd64.zip, syft.exe, 815ee6973ec5dff6a671d7f41b0e78835a8c45b91d5a39f4743ea1cee833d3be) (push) Has been cancelled
CI / build (dmg, macos-latest, macos-arm64, syft_1.50.0_darwin_arm64.tar.gz, syft, e32fdb9d47823fa633748a1efca2528fd77c37469ea93c9e40ab835da44e4cce) (push) Has been cancelled
The README gains a Benchmarks section — the Terminal-Bench 2.1,
OSWorld-Verified, and CL-Bench state-of-the-art rows with model-matched
comparisons, the SWE-bench Pro and GAIA parity rows, and links to
submissions, public traces, and per-benchmark methodology. The public
homepage gets an evidence chapter with the headline charts and the same
submissions/traces links, and both surfaces replace the April interface
captures with current ones: the live subagent swarm, a project room with a
built-and-verified game, the OuroborosHub skills page, and the code-growth
chart. The README website badge moves to ouroboros-agent.ai, the site
metadata and og/social previews now name the benchmark results, and the
committed Pages output is rebuilt. The operator review wrapper now measures
its advisory size cap against the textual staged diff the production gates
actually review, with a conservative binary-patch fallback when git fails.
Reviewed: hermetic full-suite pytest preflight passed twice on this tree;
independent triple review (Fable 5 max, GPT-5.6 Sol high, Opus 5) returned
three SAFE TO COMMIT verdicts and the advisory findings were addressed.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Six reviewed phases land as one release.
Admission is the outer boundary: every migrated launcher records a manifest before
it can touch the filesystem, and finalizes a typed outcome on every path — success,
refusal, crash, and the real exit status. A structural audit enforces that boundary
across all fourteen launchers, together with confinement computed from the active
checkout and a single manifest publisher, judging by effect rather than by callee
name and failing closed on any write form it cannot resolve.
Harness exit codes are no longer trusted as run status: inspect returns zero for an
eval that raised and harbor returns zero for a job whose trials all errored, so the
launchers now read the harness's own artefact and keep "the harness failed", "it
scored nothing" and "it scored honest zeros" distinguishable.
The acceptance dialogue reconciles receipts through one typed identity that is an
equivalence by construction, so a passing check can no longer clear a red it never
addressed. Prompt caching is normalized at every send site and cached calls stop
under-reporting their input. The owner's context mode becomes explicit and
fail-closed, with one enforcement point for every writer of a disk-authored setting.
Deliberate limits are disclosed in each bench's METHODOLOGY.md rather than implied
by silence. Isolated benchmark egress and the multi-lane script generator are
deferred to a later release with restoration patches and carry-forward notes.
Operator phase 3, closing the owner-approved 6.65-6.67 release cycle.
Declarative widget schema v1 gains recursive group/metric/callout composition
with stable nested identity, bounded validation (depth 8 / 256 nodes), shared
safe fields, accessible chart fallbacks, and a native kanban Move-to path —
strictly additive, existing declarations unchanged. Visible UI completion now
requires vision-inspected evidence from a real consumer flow (risk-selected
states/viewports; mobile/WebKit are not universal). BIBLE gains the two
owner-approved one-line clarifications (P0 autonomous judgment, P2
smallest-class-fix scope); DEVELOPMENT records Pragmatic SOLID and the mutable
external-fact inventory without analyzers or runtime migrations; reviewer
prompts drop numeric finding pressure in favor of evidence-backed defects. The
operator review wrapper additionally probes the exact reviewer model per
candidate OpenRouter key.
Owner personally approved the rendered Widgets UI screenshots (desktop+narrow,
three live Hub skills) before review. Review: triad fable-5/gpt-5.6-sol/
gemini-3.5-flash + scope fable-5 all responded, aggregate PASSED first run
(20260716T230014Z, $14.32). Full non-serial+serial pytest, web node tests,
and the marker-gated UI browser smoke (12 passed) are green; ruff -F clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator phase 2 of the owner-approved 6.65-6.67 release cycle. The physical
mutation lease/holder subsystem was deliberately descoped by the owner:
attribution is evidence-only (root-task baseline, terminal candidate snapshot,
attributed commit staging, projection into acceptance/review evidence, no
structural outcome veto). Ships the surface-aware Python interpreter resolver,
auditable Skill Review rounds/history, the single task-tree disposition
authority with cancel-wins, the SSOT operator review wrapper with typed exit
codes, the parallel hermetic pytest preflight, and the chronic red-CI
light-model test fix.
Review: advisory=skipped (prompt-size cap, non-blocking), triad
fable-5/gpt-5.6-sol/gemini-3.5-flash all responded, scope fable-5 responded,
aggregate PASSED (run 20260716T221730Z, $16.38). Full non-serial+serial pytest
green; ruff -F clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pin the advisory/blocking enforcement decision to the owner with an
item-agnostic behavioral invariant in the frozen contract suite, so the agent
cannot hardcode findings to always-block. Restores the touched-file pack to
loud-fail on oversize (no silent functional-file omission) and adds a
standalone real triad+scope dry-run script.
Owner-approved big release (plan: большой_релиз_v6.26.0). Workstreams:
- WS-A lint gate: ruff F-rules step in CI quick-test; fixed the real F823
NameError class (supervisor/events.py utc_now_iso shadowing); make lint/health.
- WS-B memory integrity: atomic dialogue_blocks with corrupt-quarantine
(.corrupt-<ts>.bak + memory_store_corrupt event); honest scratchpad journal
(block_append_failed, corrupt storage renders as corruption not "(empty)");
full Pattern Register window (16K cap vs 3K cut); merge-aware scratchpad
consolidation under the sidecar lock; backlog writes through locked helpers;
chat omission notes ("[N older unconsolidated messages omitted]").
- WS-C provider SSOT: provider registry (prefixes/credentials/resolution) in
provider_models.py replacing 5 duplicated knowledge sites; credential-aware
consolidation model; pricing empty-fetch retry; direct-route correctness
(o-series max_completion_tokens, reasoning_effort, Anthropic error bodies,
per-request timeouts on cached clients); deep/plan review budgets reserve
output headroom inside the 1M window (min(SSOT, window − output − margin)).
- WS-D races/state: utils.update_json_locked (locked RMW, loud TimeoutError);
task_results merge under per-file lock (cancel-latch safe); update_state
migration for owner binding, evolution counters, budget_line, post-task
activation; queue-lock coverage (enqueue, timeouts, worker health, task_done,
snapshot); visible supervisor death (supervisor_error + owner notice + ghost
consciousness/chat-agent cleanup on re-init); chat.jsonl rotation via
os.replace under the append lock; unbounded _outbox removed; host-service
port probe + actual-port panic sweep; skill lifecycle lane deadline
(OUROBOROS_SKILL_LIFECYCLE_TIMEOUT_SEC, dedupe-leak-safe); consilium
force-plan structured flag (plan_review_aggregate from the FULL result);
atomic writers (update-intent, repo-manifest, metrics cache, post-task pair);
review_state.save_state raises on lock timeout (advisory ledger honesty);
apply_pending_request no-ops while a campaign is active;
api_update_apply kills workers only AFTER update validation, with respawn
on aborted checkout and "interrupted" terminal status.
- WS-E immune hardening: triad anti-refusal coverage contract (empty array
needs NO_FINDINGS sentinel or bare-[] body; refusal prose with [] is
parse_failure and never enters quorum); BIBLE P3 "Owner-chosen enforcement,
loud advisory" bound + CHECKLISTS sync; every advisory pass-through of a
blocking signal writes review_advisory_override + persistent
advisory_overrides (surfaced by review_status); ToolEntry.mutates_worktree
with dispatcher-level before/after worktree diff invalidation (covers error
paths; read-only runs no longer invalidate; redundant manual calls removed);
scope review fails closed without its checklist; advisory final write is a
locked re-read merge; synthesis severity defaults to critical with WARNING
fallbacks; find removed from SAFE_SHELL_COMMANDS; anti-thrashing state
survives advisory criticals; preflight env scrubs secret-class variables;
.git/index.lock age gate in worker startup checks.
- WS-F security: file-browser symlink containment on the RESOLVED path across
all endpoints (out-of-root symlink targets are listed but inert; tests
rewritten to the new contract deliberately); HMAC-signed session cookies
(server-side persisted key, 30-day TTL, Secure on TLS) replacing the
permanent password-derived cookie; password-class settings mask to a
constant placeholder; conservative SSRF guard for the MAIN agent (link-local
/cloud-metadata only, LAN stays reachable, per-request route re-validation);
ClawHub zip-slip hardening (":"/backslash segments rejected + post-join
containment) and lazy no-proxy OuroborosHub opener; single-execution
signature dispatch for extension handlers (no TypeError re-run after side
effects); onboarding postMessage origin checks; SHA256-pinned
python-standalone download with pipefail; payload-resident dependency
fingerprints only corroborate durable deps.json; skill payload re-hash
immediately before spawn (TOCTOU narrowing).
- WS-G process custody: ouroboros/process_custody.py — spawn_supervised
chokepoint + durable data/state/process_ledger.jsonl (pid, pgid,
fingerprint{start_time, cmd_sha256}, purpose, scope task|session|daemon,
owner_task, session_id); platform_layer.process_start_time primitive;
startup + periodic reaper killing ONLY strict-fingerprint matches from dead
generations/tasks (never by command-line class); migrations: services
(the orphan hole), workspace executor + local model + extension companions
(ledger write-through), worker_pids (write-through; legacy path retained);
parent lifelines (ppid watchdog, group-suicide only as group leader) in
worker_main, extension runner, Claude readonly child; conformance test
pinning the Popen allowlist; ARCHITECTURE/DEVELOPMENT/CHECKLISTS entries.
- WS-H native multimodal chat: supports_vision capability map (static
prefixes + OpenRouter /models input_modalities overlay); web chat uploads
ride the WS frame as structured attachments (additive ChatInbound field)
and image uploads become NATIVE image blocks via the existing Path B;
browser screenshots inject natively for vision models via the multipart
user-merge (tool result stays a string; file persisted under
data/uploads/screenshots for re-view); K=3 newest-image eviction with
caption placeholders carrying the vlm_query re-view path; image-aware token
estimates (fixed ~1.1K-token equivalent instead of base64 length, fixing
permanent emergency-compaction wedges); compaction renders images as
captions (no base64 into the summarizer); GigaChat/local lanes emit explicit
"[image omitted: model has no vision]"; internal _caption/_source_path
metadata stripped from provider payloads.
- WS-I housekeeping (partial): SETTLED_STATUSES SSOT (+ cycle-safe mirror pin);
owner_inject.py renamed to owner_mailbox.py; version-neutral envelope
wording; files.py import-block cleanup. Remaining WS-I/WS-J/WS-K items are
deferred with the owner's context-budget priority on review+release.
Review notes: triad+scope ran via scripts/run_external_review.py on the core
pack across 3 rounds to convergence (scope responded=PASS each round; round-2
criticals fixed: update_apply kill-order + respawn, lifecycle dedupe leak on
lane timeout, OUROBOROS_MAX_ROUNDS hot-reload + docs, toggle_evolution
NameError, async Anthropic timeout forwarding, supports_vision local check,
budget-update lock visibility, ChatInbound additive attachment contract,
file-browser doc sync). The FULL combined diff exceeds every triad model's
context window (~1.59M tokens > 1.05M) — reviewed in packs; remaining
cross-pack findings were verified as slicing artifacts. Adversarial critics
(GPT; Gemini/Opus rounds) ran on the working tree. Deliberate tradeoffs:
metadata-based eviction captions (no light-LLM call in the hot path);
worker ledger records use live-cmdline fingerprints with a synthetic-arg
fallback only where the OS offers no cmdline.
Introduce a derived code-intelligence layer with a read-only query tool, ripgrep-backed search, and clearer post-task self-improvement controls so Ouroboros can navigate larger codebases without regex-heavy guesswork.
Make headless Google Colab a first-class Ouroboros runtime controlled entirely
over Telegram, and treat reviewed transport/control skills as full replacements
for the local UI.
- Colab source-mode bootstrap: mounts Drive for persistent data/, role-based
remotes (managed=official, origin=personal fork), merges existing Drive
settings on re-run, and installs+enables the Telegram bridge in full_access
over the loopback gateway.
- Role-based GitHub remotes with auto-fork personal origin while preserving the
official managed update remote; a clone-default official origin is reclassified
as managed (never an origin conflict) and configure_personal_remote guarantees
managed exists before repointing origin.
- Transport/control-skill doctrine: a reviewed + token-bound + enabled +
owner-granted + owner-bound chat/control skill is a first-class control surface;
review judges actual safety properties, not breadth of control (CHECKLISTS,
CREATING_SKILLS, ARCHITECTURE).
- Owner-external slash TOFU so a real Telegram owner is authorized without ever
locking out the local web owner; external /review targets the requesting chat.
- Adaptive LLM request-parameter normalization (OpenRouter no longer drops Opus
on unsupported sampling params).
- official_hub review profile downgrades severity-driven hygiene/bug findings to
warnings for hash-verified official OuroborosHub payloads (re-verified via the
local sidecar on reload); trust-boundary items and deterministic gates stay
fail-closed. Deterministic preflight failures persist+aggregate to PENDING
(non-executable under every enforcement mode, surviving reload).
- Reviewed-skill auto-grants default on; rescue snapshots recoverable via real
git refs; ff-only restore of personal-origin self-mods across Colab sessions.
Structurally closes the subagent worker-crash, ghost-task, and stuck-spinner
classes across all platforms, makes Ouroboros usable with any single provider
key, and ships node-runtime skill support.
- Workers: macOS/Windows use spawn (Linux keeps fork); central OUROBOROS_IN_WORKER
no-proxy policy removes the macOS _scproxy fork SIGSEGV class. Signal crashes are
terminal (no retry) for all task types.
- Lifecycle: monotonic write_task_result guard (terminal/cancel sticky); live
cancel_task + cancel_requested latch; terminal task_done on every crash/kill/
timeout/cancel path; snapshot restore skips terminal; schedule fail-fast when the
worker pool is disabled. No ghosts, no perpetual spinner (incl. reconnect reconcile).
- Subagent UI: Variant A parent dashboard (in-place rows, child progress/terminal
routed to parent, no duplicate child card).
- Providers: Cloud.ru is a first-class exclusive-direct provider (review/scope
fallback + static pricing). New-user defaults: review claude-opus-4.8, Claude Code
opus[1m]; existing anthropic-only migrate 4.6->4.8.
- Skills: skill_preflight tolerates missing/killed validators; build bundles a
signed Node.js LTS (resolve_bundled_node) for node --check and node runtimes.
- Docs: README OuroborosHub badge/callout; ARCHITECTURE bundled-node + defaults.
Reviewed via multi-model adversarial (2 rounds) + Ouroboros triad/scope review
(converged). Local suite: 3207 passed, 1 skipped.
Consolidate repeated gateway, review, skill lifecycle, marketplace, memory/context, release, and web UI paths while preserving public API shapes, review gates, and runtime contracts.
Verification: python3 -m pytest tests -q --tb=short; external triad review PASS with scope review skipped only for context budget advisory.
Layered on top of rc.5..rc.7 catch-up reduction line. Preserves the
rc.7 prompt-injection fix in renderSkillRepairPrompt (web/modules/utils.js)
and the rc.6 docs/accounting cleanup. Adds the Quality, DX & Closed-loop
Skills wave from the user-approved finish plan:
- runtime_mode=light reframed as a minimal compatibility/self-modification
guard. Path-aware shell filter (_light_shell_repo_mutation): blocks
simple writer commands (cp, mv, rm, sed, sort -o, uniq, ...) only when
their target resolves inside the Ouroboros checkout, blocks shell-
wrapped writes via 'sh -c' / 'bash -c', blocks mutative direct git
through run_shell, and otherwise lets ordinary python/node/bash
diagnostics run. Removed the heavy Python AST scanner + script-content
scan that was over-blocking legitimate work.
- Chat scroll fixes: ResizeObserver re-attach, near-bottom threshold,
Playwright smoke now asserts scrollTop ~ scrollHeight after send.
- Recent-chat dedup: read_jsonl_tail_after_offset honours
dialogue_meta.last_consolidated_offset; provenance-aware via a chat
log generation signature (first_line_sha256 + size) so log rotation
cannot silently drop entries.
- Stable WORLD.md injected into context.build_memory_sections.
- plan_task and the commit triad accept duplicate model IDs as valid
reviewer slots (single-provider stochastic sampling); _get_review_models
no longer pads 2-slot configs to 3.
- Settings: OUROBOROS_AUTO_GRANT_REVIEWED_SKILLS owner-confirmed via the
desktop launcher bridge (request_auto_grant_reviewed_skills_change),
hot-read from settings.json so toggle changes take effect without
restart, /api/settings POST drops the key. Consistent truthy parsing
on JS + launcher sides.
- skill_review.py runs an optional fail-open Claude Code advisory over
the skill payload only (include_repo_diff=False), and injects its
output as inert evidence BEFORE the authoritative output contract.
- skill_exec emits skill_exec_finished / skill_exec_failed events;
worker enqueues them on ctx.event_queue, supervisor.events dispatches
them to logs/events.jsonl + the live log + the in-process event bus
for skill.lifecycle subscriptions. host_service_api allows manifest-
declared skill.lifecycle subscriptions without an extra grant.
- run_shell auto-rewrites grep "A\|B" argv-mode to grep -E "A|B" with
SHELL_REGEX_AUTO_CORRECTED prefix; explicit -E/-G/-P/-F still pass
through. SAFE_SHELL_COMMANDS no longer includes sort/uniq.
- Extension loader hardening: load_extension(drive_root=...) is
mandatory (no silent ~/Ouroboros/data fallback), TestClient lifespan
+ settings hot-reload pin to app.state.drive_root, _sweep_stale_-
extension_imports preserves the live import root via a keep-list,
fixture cleanup uses unload_extension. Adds clean_extension_runtime_-
state superset helper and tests for cleanup, drive_root requirement,
and live-root preservation.
- Test pollution: scripts/cleanup_test_pollution.py (dry-run-first
utility), tests/_shared._make_safe_mock_ctx for advisory-workflow
ctxs, _make_safe_mock_ctx adoption in test_advisory_workflow*.
- PluginAPI v1.2: PLUGIN_API_VERSION bumped, skill_job_dir added to
the frozen Protocol + the contract test.
- docs/ARCHITECTURE.md, docs/CHECKLISTS.md, docs/CREATING_SKILLS.md,
prompts/SYSTEM.md updated for new behavior (light-mode wording,
cleanup script, skill.lifecycle topic, advisory pre-review path,
duplicate reviewer slots, auto-grant settings + permissions wording).
VERSION 5.15.0-rc.8 / pyproject.toml 5.15.0rc8 / README badge + Version
History row + ARCHITECTURE.md header all in sync.
Two related fixes that close a same-process privilege-escalation path
demonstrated by the agent in a video-gen skill task and unblock the
natural light-mode workflow at the same time.
Q1 — light allows skills (Frame A): removes runtime_mode == "light"
blocks at ouroboros/tools/skill_exec.py::_handle_skill_exec, the
extension-tool dispatch in ouroboros/tools/registry.py::ToolRegistry.execute
and the runtime_mode_light short-circuit in
ouroboros/extension_loader.py::_extension_runtime_state /
load_extension. Skills already pass tri-model review_skill PASS +
enabled.json toggle + content-hash freshness + sandboxed subprocess
+ FORBIDDEN_SKILL_SETTINGS denylist; gating execution by runtime_mode
only denied owner-approved capabilities.
Q2 — elevation ratchet (multi-layer):
1. ouroboros/config.py::save_settings(allow_elevation=False) chokepoint
compares incoming OUROBOROS_RUNTIME_MODE against a boot-time
baseline (_BOOT_RUNTIME_MODE pinned by initialize_runtime_mode_baseline
from server.py::lifespan). The baseline is exported to
OUROBOROS_BOOT_RUNTIME_MODE env var so subprocesses (run_shell,
skill_exec, mp.spawn workers) inherit the pin via env. Once any
baseline source is available, allow_elevation=True becomes inert.
2. ouroboros/tools/core.py::_data_write blocks writes whose
Path.samefile resolves to SETTINGS_PATH (handles macOS APFS /
Windows NTFS case-insensitive bypass via parent-resolve +
name.lower() fallback).
3. server.py::_merge_settings_payload skips OUROBOROS_RUNTIME_MODE
from /api/settings POST body. api_settings_post adds belt-and-braces
revert. web/modules/settings.js no longer sends the key; the
Behavior tab segmented control becomes display-only with disabled
buttons + tooltip explaining the manual procedure.
4. ouroboros/tools/registry.py::_run_shell_safety_check runs two
substring filters on every run_shell invocation:
- Argv-level _detect_runtime_mode_elevation (conjunctive: BOTH
save_settings AND OUROBOROS_RUNTIME_MODE, OR the dotted path
ouroboros.config.save_settings) fires in ALL modes; the
module-level _LIGHT_MUTATION_INDICATORS (extended with
.write_text(, .write_bytes(, os.replace(, os.rename() fires only
in light.
- File-content scan (iter-3 fix for the file-based subprocess
bypass): _extract_script_file_args walks past interpreter flags
and resolves the script file argument; if it lives inside
repo_dir or drive_root, _scan_script_files reads up to 256 KB
and re-runs the same indicators on the content. Closes the
deterministic 2-step chain data_write helper.py + run_shell
python helper.py that previously poisoned settings.json directly.
5. ouroboros/file_browser_api.py guards api_files_write / delete /
transfer / upload via _is_owner_only_settings_file (samefile-aware).
6. supervisor/workers.py::worker_main calls
initialize_runtime_mode_baseline so spawn-method workers re-pin
from inherited env.
7. ouroboros/tools/registry.py extension dispatch now goes through
ouroboros.safety.check_safety (extracted to _dispatch_extension_tool
helper).
8. prompts/SAFETY.md gains a DANGEROUS clause naming the runtime_mode
self-elevation channels.
Tests: 2705 passed, 0 failed (added 47 new tests in
tests/test_runtime_mode_elevation.py covering chokepoint, downgrade,
data_write block with case-mismatch + symlink + env override, API
drop, set_tool_timeout regression, onboarding flow, boot-baseline
post-pin inert, env-var subprocess propagation, file-content scan
across all modes + light pathlib.write_text + benign-script
false-positive negative + interpreter parser unit tests; conftest.py
autouse fixture resets baseline between tests).
Pre-release went through two cycles of multi-model adversarial review
(Gemini + GPT + Opus critics) plus two cycles of the actual triad+scope
reviewer pipeline. Phase B (move owner settings outside drive_root
for OS-level containment) and the Privilege Boundary section in
prompts/SYSTEM.md are deferred per the minimal_safety profile and
recorded in data/memory/knowledge/improvement-backlog.md.
External review tool: scripts/run_external_review.py invokes
ouroboros.tools.parallel_review.run_parallel_review on the staged
diff with FULL raw triad+scope output (no truncation).
Note on changelog rolloff: the v4.42.1 patch entry was rolled off in
this release to respect the P7 5-patch-row cap. Its full body remains
at git tag v4.42.1.
Closes the re-audit cycle. Six non-committing advisory+triad+scope
cycles converged with 0 open findings before this commit.
Extension runtime:
- extension_loader.py stages each load under data/state/skills/<name>/__extension_imports/<uuid>/skill/
to defeat Python module caching on rapid in-place edits; fail-closed if
any symlink in the skill tree resolves outside the reviewed checkout.
- extensions_api.api_extension_manifest reports live-SSOT load_error,
not the stale discovery copy, so index and manifest agree.
- tools/registry.list_non_core_tools() now merges live ext.* tools.
Release / packaging guards (BIBLE.md P7):
- scripts/build_repo_bundle.py fail-closed if no release tag is resolved,
verifies the tag is annotated (git cat-file -t == tag), and that it
points at HEAD.
- build.sh / build_linux.sh / build_windows.ps1 enforce the same three
checks before invoking PyInstaller. Synthetic/fake tags no longer
accepted.
- _validate_source_branch no longer treats an ls-remote-only branch as
usable; requires local ref availability, symmetric with
_ensure_source_sha_tracks_branch.
- release_sync._normalize_pep440 now collapses alpha->a and beta->b per
PEP 440 canonical pre-release spelling.
Onboarding preservation:
- Wizard no longer silently wipes OPENAI_BASE_URL, OPENAI_COMPATIBLE_*,
CLOUDRU_FOUNDATION_MODELS_BASE_URL on re-run. The wizard only resets
keys it actually exposes.
Docs and prompts sync:
- ARCHITECTURE.md describes the bundle-bootstrap model, the
__extension_imports/ staging surface, the build-script release tag
prerequisite, the extension HTTP review endpoint, and
VALID_EXTENSION_ROUTE_METHODS as part of the frozen contract.
- BIBLE.md + prompts/SYSTEM.md release invariant now distinguishes
author-facing spelling (VERSION / README / tag / ARCHITECTURE) from
the PEP 440 canonical form required by pyproject.toml.
- prompts/SYSTEM.md Immutable Safety Files list matches
SAFETY_CRITICAL_PATHS exactly (BIBLE.md included).
- docs/CHECKLISTS.md row 1 explains the author-facing vs PEP 440 split.
Runtime SSOT:
- server.py::_run_supervisor feeds workers.init the manifest-driven
branch names from _runtime_branch_defaults() instead of hardcoded
ouroboros / ouroboros-stable.
- contracts/skill_manifest.py accepts body-only instruction-skill
markdown that starts with a --- thematic break.
Regression coverage added for every real fix above across
test_extension_loader, test_extensions_api, test_build_scripts,
test_build_repo_bundle, test_launcher_sync, test_onboarding_wizard,
test_packaging_sync, test_release_sync, test_contracts, plus a new
test_release_workflow guard for the CI release path.
VERSION carriers synchronized:
- VERSION = 4.50.0-rc.3 (author-facing)
- pyproject.toml = 4.50.0rc3 (PEP 440 canonical)
- README.md badge + Version History row = 4.50.0-rc.3
- docs/ARCHITECTURE.md header = 4.50.0-rc.3
Branch `ouroboros` was seeded from an `.app` bundle snapshot
(`6700358 Initial commit from app bundle`), not from `main`, so the
release pipeline (build scripts, PyInstaller spec, launcher runtime,
vendored Python framework, CI workflow) never landed on this branch.
Import those files verbatim from `origin/main` (76bf13c) so a tagged
push can trigger the existing tag-driven release pipeline.
Imported verbatim from `origin/main`:
- .github/workflows/ci.yml Three-tier CI (push -> quick
tests, stable/tag -> full matrix,
v* tag -> build + GitHub Release
with `prerelease: contains(...,
-rc|-alpha|-beta)`).
- build.sh / build_linux.sh / PyInstaller + Playwright Chromium
build_windows.ps1 / Dockerfile bundling for each target (the four
files `tests/test_build_scripts.py`
assertively requires).
- Ouroboros.spec PyInstaller entry spec.
- entitlements.plist macOS codesign entitlements.
- launcher.py Native launcher that bootstraps
the embedded python-standalone
interpreter and runs the agent as
a subprocess.
- scripts/download_python_standalone.sh / .ps1 / pyi_rth_pythonnet.py
- Python, Python.framework/ Vendored macOS launcher-side
Python 3.10 framework.
- certifi/, jsonschema/, Marker + data files consumed by
jsonschema_specifications/ the runtime-loaded agent deps.
Adapted for Phase 1-6:
- Ouroboros.spec datas now contains ('skills', 'skills') so the
bundled Phase 5 weather reference skill under `skills/weather/`
actually ships inside the .app / .exe / tarball. Without this the
Skills page on a packaged build would show "no skills discovered"
even with the bundled reference in source. Docstring updated to
document the new bundled payload.
Verification:
- `pytest tests/test_build_scripts.py tests/test_release_sync.py`
passes locally (47 asserts; all Playwright + PyInstaller ordering
invariants + release-sync carrier logic hold after the import).
- `python -c "import ast; ast.parse(open('Ouroboros.spec').read())"`
parses.
Not imported from main (intentional):
- `.pytest-tmp-run`, pytest-cache dirs, and other transient files.
- No existing file was overwritten by the checkout; the import is
purely additive on top of the Phase 1-6 tree.
