Retire the first-parent manifest history replay and re-anchor the size
ratchet on the official repository line (owner decisions Q7-C, Q18-A,
Q19-A of the update-flow redesign sprint). A locally evolved fork can now
take a managed update without being trapped by inherited structural debt,
while the official line keeps ratcheting pairwise.
- ouroboros/review.py: validate_size_ratchet loses
_audit_committed_manifest_history and the BASELINE==HEAD bootstrap trap.
The previous manifest resolves merge-aware (HEAD's tree, else ANY parent
whose tree carries it, else bootstrap accepted from the current tree with
tree-seeded immutable baselines). New entry points:
validate_size_ratchet_candidate (in-memory candidate validation for the
generator) and validate_size_ratchet_transition_against_base (pairwise
base-vs-tip shrink-only check for CI: an all-zeros or missing/unresolvable
base degrades to the tip's parent manifest, verified against the parent's
own tree - never a skip; a resolvable base without the manifest fails
closed, so genuine first adoption re-runs with a post-adoption base; only
a checkout with no parent manifest at all bootstraps with the transition
skipped). Manifest-vs-live-tree
exactness, validate_manifest_transition shrink-only semantics,
staged-tree checks, and MAX_TOTAL_FUNCTIONS are unchanged.
- scripts/regenerate_size_ratchet.py: typed refusal on an unmerged index
("merge in progress: resolve conflicts first") before any inventory
work, merge-aware previous resolution, and candidate validation BEFORE
the manifest is written - a red regeneration no longer clobbers the
checked-in file (it also creates the manifest directory on a fresh
bootstrap).
- New pytest marker `size_ratchet` carries the live-repo size gates:
test_no_oversized_modules, test_size_ratchet_manifest_matches_live_tree,
test_no_extremely_oversized_functions, the generator --check half of the
render-determinism test (split in two), and the new pairwise transition
test reading OURO_SIZE_RATCHET_BASE_REF. The three pinned exclusion
surfaces gain " and not size_ratchet" synchronously
(preflight_runner.LANE_EXCLUSION_EXPR, pyproject addopts, all four
ci.yml markexprs; the preflight pin tests stay green through their
SSOT). quick-test and full-test run a dedicated blocking
`python -m pytest tests/ -m size_ratchet` step with the event base
(PR base SHA / push event.before) in the env, and marker-guards gains
the lane's non-empty canary. fetch-depth stays 0.
- Local warning surfaces: check_worktree_readiness appends the validator's
findings as "official CI will enforce: ..." warnings (try/except, never
blocking); codebase_health reports the same findings in a dedicated
section.
- check_worktree_version_sync moves to ouroboros/tools/release_sync.py
(version-sync logic lives with its authority) with a compatibility
re-export in review_helpers.py: the module hard gate caught
review_helpers.py crossing 1600 lines with the new warning check, and
the extraction pays the debt instead of grandfathering it.
- Docs (frozen-file edits owner-sanctioned): CHECKLISTS.md row 7 and
reviewer item 2(c); DEVELOPMENT.md "Module Size & Complexity",
compliance checklist, and "Pytest marker lanes"; ARCHITECTURE.md
structural smoke gates and the CI paragraph in section 8.
- tests/test_repo_health_smoke.py: the history-replay pins are retired or
rewritten as contract tests for the new semantics (merge-aware previous
through a merge parent for validator and generator, pairwise transition
with explicit/degraded/all-zeros/pre-bootstrap bases, bootstrap-from-tree
acceptance, bootstrap-baseline tree match, unmerged-index refusal,
candidate-mode write-nothing-on-red and write-validated-on-green).
Accepted tradeoff (Q18-A): intra-interval archaeology (transient states,
same-interval retire+re-enter) is no longer detected anywhere.
- Manifest regenerated: tests/test_repo_health_smoke.py enters the
1001-1500 band with its rationale.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Centralize provider role policies and compile subscription seats declaratively so new installs receive the intended models, budgets, and reviewer topology without a growing combination matrix.
The pre-implementation gate reviewed an unbounded prose plan with a ~100k-token
governance pack, planning-scout subagents and an Atlas, and every rewritten plan
minted a fresh fingerprint that bought a whole new paid wave from cold reviewers.
Convergence was structurally impossible: the reviewer was asked to author a
competing plan every wave, REVISE_PLAN could not be dispositioned, and nothing
capped the cycles.
plan_task now reviews an INTENTION — the same organ whether the work is code,
research, a deliverable or an action in the world:
- a typed domain-neutral SPEC (goal, in_scope, non_goals, acceptance_claims,
invariants, decisions with rejected alternatives, deferred, affected_resources,
evidence) with host-minted ids that are the only valid `breaks` targets;
- ONE structural fact tiers the governance pack: `constitutional` iff a declared
target resolves under the system repo (never prose, never a plan-kind taxonomy);
- agent-declared evidence, bounded, with EVERY absence named, the runtime data
plane denied outright, and the exploration log redacted through the same SSOT
task acceptance uses;
- typed findings (blocking with a `breaks` id | note | need_evidence) with the
HOST computing the aggregate through adaptive_quorum — no reviewer emits GREEN
as authority, none writes a competing plan;
- ONE owner setting OUROBOROS_REVIEW_MAX_CYCLES (default 2, unlimited available)
bounds paid cycles for plan review, task acceptance (passes = cycles - 1) and
the commit gate's identical-diff attempt cap; an identical envelope replays for
free and a DEGRADED wave costs nothing;
- under blocking, an open plan holds implementation and a spent cap escalates
with a typed review_cycles_exhausted reason and an honest blocked terminal;
under advisory the agent may proceed with the wave open and a loud disclosure.
Deleted: planning scouts, the plan Atlas, plan_class, context_level, the
governance mega-pack, the generative reviewer stance, the hidden 32-wave limit
and the api_chat-only pin. Net effect on the tree is negative.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Require the installed user-unit check in every native-package smoke receipt and keep the stop-timeout documentation aligned with the actual cgroup lifecycle.
Keep the opt-in native-package unit on the existing launcher path, leave restart and panic policy with the launcher, correct readiness and shutdown guidance, and verify the installed unit in the package smoke.
Запущенный из десктопного лаунчера Ouroboros попадает в transient scope
systemd со сгенерированным именем вида run-p497094-i8877010.scope. Имя
меняется при каждом старте, поэтому остановку нельзя записать в скрипт:
приходится сперва выяснять имя через cgroup процесса.
Замена на pkill не годится. Лаунчер порождает server.py и пул воркеров;
если убить только родителя, воркеры остаются держать порт 8765, и
следующий старт падает с address already in use.
Юнит даёт стабильное имя: systemctl --user stop ouroboros.
Пакеты deb и rpm ставят его в /usr/lib/systemd/user, поэтому после
установки имя доступно сразу. Активации при этом нет: включать
десктопного агента за пользователя неправильно, у него уже есть запись
рабочего стола. Юнит из домашнего каталога имеет приоритет над
пакетным — это и есть поддерживаемый способ переопределить ExecStart
для headless-узла.
Выбран пользовательский юнит, а не системный: состояние живёт в домашнем
каталоге, а десктопной сборке нужна сессия пользователя. Системный
работал бы от другого пользователя и молча использовал бы другой каталог
данных.
KillMode=control-group доводит сигнал до всей группы процессов, что и
делает обычную остановку достаточной. TimeoutStopSec оставляет запас на
незавершённый вызов инструмента. Ограничение частоты перезапусков
прекращает бесконечный цикл вместо того, чтобы хоронить первую реальную
ошибку под десятками повторов; оба ключа размещены в секции Unit, где их
ожидает systemd начиная с версии 229.
Отдельно описана готовность, поскольку сигналов три и совпадают они не
всегда. Активность юнита означает лишь запуск процесса. Ответ HTTP и
даже заполненный пул воркеров готовности не означают: поданная в этот
момент задача отклоняется кодом 503. Авторитетный признак —
supervisor_ready в ответе /api/state. Скриптам, которые всё равно подают
работу, рекомендован повтор на 503: так поступает собственная обвязка
бенчмарков проекта.
Добавлен тест состава пакетов: он требует наличия юнита в обеих ветках
сборки и запрещает включение или запуск из установочных сценариев.
Проверено на живой системе: остановка снимает всю группу процессов и
освобождает порт за секунду с небольшим, запуск даёт готовность за
десять секунд, задача подаётся без отказа и доходит до completed.
Отдельно собран deb с заглушкой вместо полезной нагрузки: юнит попадает
в пакет по пути /usr/lib/systemd/user/ouroboros.service с правами 644 и
проходит валидацию после извлечения.
Phase C of the poltergeist delegation sprint, squash-landed onto the v6.99.0
nanny release. A mutating delegated run never edits the shared tree: the host
provisions a private execution snapshot of the authority target (baseline built
with the sensitive-veto decided before anything is hashed, pinned by a
refs/ouroboros/delegated/ ref), records the durable binding {execution_root,
baseline_sha, target_root, authority_source} on the custody rows BEFORE the
POST, and replays it byte-identically on explicit retry — pending-invocation
recovery carries the full binding so the startup GC (settled && patch_disposed)
never deletes the snapshot holding the child's only work. Terminal
reconciliation captures a settled run's diff through one drive-rooted capture
core, eagerly only at PROVEN terminality; an absent or unreadable close
captures nothing, capture-at-disposition is the retry point (C1-R2), a capture
failing there is the typed INTEGRATE_DELEGATED_CAPTURE_FAILED refusal for both
decisions, and patch_captured means a usable artifact exists (C1-R3 — a failed
manifest never mints the row and reject re-checks before releasing the
snapshot). Nothing lands without the explicit integrate_delegated_patch
apply/reject flow (proven baseline drift, NUL-safe touched paths, cleanup
following the durable disposition row, the protected-path gate scoped to the
Ouroboros body), and open obligations surface via undisposed_patches. Beside
it: SSOT cost projection (accounted_upper_bound_usd beside deprecated
cost_usd, $0-fabrication fixes, honest web cost presentation),
delegated_runs_failed on the evidence receipt, notification chat routing,
byte-accurate argv/env budgeting with --prompt-file transport, and hash-bound
skill repair.
Merge resolution UNIONS phase B's delegate module split (delegate_shared stays
the one refusal/emit/ownership author; delegate_integration imports it),
delegate_answer beside integrate_delegated_patch on every child surface, the
instructions-bearing idempotency digest, and BR2's additive terminal_detail
carry in cancel_and_verify with C's absent-branch no-capture semantics. Size
gates cleared by extraction, no grandfathering: delegate_evidence.py
(task_execution_evidence out of delegate_custody) and synthesis_cost_text.py
(synthesis cost renderers out of agent_task_pipeline), both re-exported
same-object; _delegate_start hands its started payload to one extracted
author.
The formal six-lane exact-SHA gate plus two verified fix rounds (CR1: the
startup GC fails closed over an unreadable custody log, the capture artifact
is readable across a split-drive boundary through a narrow rebind, a durable
apply intent precedes any tree mutation so a crash replay can never record a
false rejection, and delegate_start tells the snapshot truth; CR2: the
AMBIGUOUS apply state gained an explicit owner-acknowledged exit through the
normal disposition guards, a lost prune-skip row is escalated loudly, and a
failed verdict write can no longer strand a pending intent) are squashed into
this landing.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Give nested extract-and-run AppImages independent runtime ownership and make the smoke wait for the owning runtime cleanup. Pin the generated runtime lock to LF so Windows builds remain clean after uv export, while preserving the strict bundle gate.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Validate lock freshness, preserve the pip runtime capability and N-1 updater bridge, synchronize the uv root version during releases, and align install documentation and regression tests.
Build PyInstaller from a portable-Python venv, exercise the desktop launcher on Ubuntu 22.04, and keep RPM staging valid across filesystems.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Linux-релиз состоял из одного .tar.gz, который пользователь распаковывал
вручную. Теперь тот же payload дополнительно поставляется как нативные
пакеты, устанавливаемые штатным пакетным менеджером.
Добавлено три ассета, собираемых из уже проверенного dist/Ouroboros:
- ouroboros_<version>_amd64.deb — Debian, Ubuntu, Astra Linux;
- ouroboros-<version>-1.x86_64.rpm — Fedora, RHEL;
- ouroboros-<version>-1.red80.x86_64.rpm — РЕД ОС 8.
Все три ставятся в /opt/ouroboros, добавляют симлинк /usr/bin/ouroboros
и desktop-запись. Payload побайтово совпадает с содержимым .tar.gz,
поэтому пакеты переиспользуют его SBOM.
scripts/build_linux_packages.sh собирает пакеты через dpkg-deb и rpmbuild.
Payload раскладывается один раз и подключается жёсткими ссылками: полная
копия многогигабайтного бандла трижды не помещается на раннере.
Сканирование зависимостей, strip и debuginfo отключены — бандл
самодостаточен, а автозависимости привязали бы пакет к набору библиотек
сборочной машины. Оба rpm собираются из одного spec, отличаясь только
release-тегом.
scripts/smoke_linux_packages.sh ставит пакеты в контейнерах и проверяет,
что CLI запускается после реальной установки. Две полосы:
- official — образы Docker Hub (ubuntu:24.04, fedora:42), блокирует релиз;
- vendor — образы Astra Linux и РЕД ОС из реестров вендоров,
информационная.
Разделение сделано намеренно: vendor-полоса обращается к сторонним
реестрам, доступность которых с раннеров не контролируется проектом.
Блокировать публикацию тега на чужом простое означало бы менять реальный
сбой публикации на чужую аварию, поэтому job vendor-package-smoke
помечен continue-on-error и не входит в needs у release. По той же
причине проверка на Astra не может быть обязательным чеком в receipt:
то, что не блокирует, не может требоваться как доказательство.
Каждый пакет получает собственный proof id, smoke-receipt, SBOM и
attestation, попадает в SHA256SUMS, release-evidence.json и список
ассетов релиза. locate по-прежнему находит ровно один платформенный
архив: суффиксы разделены на архивные и полный набор ассетов.
Проверено: сборка всех трёх пакетов в контейнере ubuntu:24.04;
установка и запуск в ubuntu:24.04, fedora:42, Astra Linux 1.8 и РЕД ОС 8.
The Windows Claude live run remained active, but one status projection hit a
`.git/objects/*/tmp_obj_*` name between Git's create/rename and returned
ENOENT. Polling now retries at most three reads only for that exact transient
path shape; unrelated ENOENT and every run/auth/artifact failure remain hard
red. Focused tests prove both the eligible race and an unrelated missing
artifact. The underlying control projection race is ledgered for an engine
post-release fix.
Co-authored-by: Claudexor <noreply@claudexor.dev>
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Windows write_text materializes CRLF, while mutation_evidence reads normalized
text; the retry eligibility used raw bytes and therefore denied Windows its
one allowed retry. Use the same normalized seed comparison on every OS and
pin it with a CRLF regression test. Strengthen the live prompt to require a
filesystem tool action and read-back verification, and run the Codex lane on
gpt-5.4 medium: low effort twice returned successful prose without editing.
The single bounded retry and all hard-red failure classes remain unchanged;
a final no-edit includes a bounded answer preview for diagnosis.
Co-authored-by: Claudexor <noreply@claudexor.dev>
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Stable live CI exposed two test-layer problems after the 3-OS fixture path
went green. A successful Ubuntu Codex run returned a complete EOF-read
artifact but ignored the one-word README edit; the live lane now permits
exactly one second model attempt only for that typed no-mutation condition,
with a fresh idempotency key and both run IDs recorded. Any routing, auth,
engine, process, artifact, timeout, wrong edit, or second no-edit remains
hard red; fixture remains one attempt.
Windows full-test also exposed three host-shaped Node fixtures: tests created
POSIX bin/node while production correctly selected node.exe, and one assertion
spelled `/`. They now inject their intended fake Node layout explicitly and
compare path components, without changing product behavior.
Co-authored-by: Claudexor <noreply@claudexor.dev>
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Ouroboros now delivers the Claudexor engine it integrates (PR #101 shipped
the integration without the runtime; a user upgrading in-app hit a dead
`claudexord_not_installed` Connect). This lands the owner-locked design:
- one exact pin (`ouroboros/claudexor_runtime_pin.json`, now bound to the
public Claudexor 3.3.7 bytes: build a4b004d7, sha256 fe07b839…, official
Node 24.16.0 for all five platforms) drives seed, download, verify and
next-spawn selection; a filled pin never degrades to a PATH binary;
- hybrid delivery: the release archive ships as an offline seed in new
DMG/tar/zip bundles and downloads foreground-only for upgraded old
installs, strictly inside an explicit user action (Connect, Repair or a
delegated/review start) with visible progress;
- one morphing Connect button (Install/Update/Fix & connect); updates stage
side-by-side and activate at the next natural daemon start or Ouroboros
restart, never hot-swapping a live daemon; a repair never replaces the
serving target of a live matching daemon;
- 3-OS CI gate and release-artifact smokes now exercise the real managed
chain (install → exact probe → owned daemon → delegated run →
identity-bound graceful stop) instead of `npm install -g claudexor@next`;
- Windows fail-fast helper for critical PowerShell 5.1 steps, utf-8-pinned
subprocess decoding, handshake reads the frozen `engine.sha` contract.
Review: triad (fable, sol scope, gemini) + adjudicated batch + confirmation
+ pin confirmation, all SAFE; suites on this base: Python 7775/1 skipped,
web 138/138, delivery tests 17/17, managed fixture smoke end-to-end.
Co-authored-by: Claudexor <noreply@claudexor.dev>
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Brings the public line's 23 commits — MiniMax direct provider, crash-safe
managed updates, the two-pass hermetic commit gate, and the Windows/release
CI fixes — into the Claudexor-integration line (v6.89.0).
Union resolutions of note (15 conflicted files):
- Version carriers stay 6.89.0 (this line IS the next feature release on top
of 6.88.0); the README Version History carries both lines' rows.
- config.py keeps the SSOT refactors (_clamped_number_setting,
settings_env_keys()) — the MiniMax keys ride automatically via
SETTINGS_DEFAULTS.
- gateway/control.py restart callback carries BOTH fixes: owner=True (the
runtime-mode re-read on owner restarts) and the bool return their restart
serialization reads.
- supervisor/workers.py terminal emission: their terminal_task_metadata
projection (a superset of the evolution_transaction carry) + this line's
cost-emission discipline (`emitted`, unavailable projections never publish
None placeholders).
- scope_review keeps the reviewer-window SSOT (the per-model window helpers
their side still carried are deleted); MiniMax window probing moves into
reviewer_window.reviewer_route/resolve (region-derived base_url +
authenticated catalog probe). The delegated session branch coexists with
their _ScopePromptContext/represent_binary call shape.
- shell.py keeps the claude_code_edit retirement (D10): their copies of the
retired helpers are deleted, their now-unused resolver import dropped.
- platform_layer keeps OUROBOROS_BUNDLE_DIR bundled-resource bases and gains
their ripgrep-pin dataclass; updates.js takes their redesigned
preflight/plan/typed-apply flow whole (it subsumes this line's
always-merge-aware intent); settings.js keeps the D10/6.1 picker removals
and gains the MiniMax region field.
Verified: import smoke, ruff F clean, 11 focused pytest files green
(including their test_update_apply_routing), web tests 136/136.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
CI / build (dmg, macos-latest, macos-arm64, syft_1.50.0_darwin_arm64.tar.gz, syft, e32fdb9d47823fa633748a1efca2528fd77c37469ea93c9e40ab835da44e4cce) (push) Has been cancelled
CI / build (tar.gz, ubuntu-latest, linux-x86_64, syft_1.50.0_linux_amd64.tar.gz, syft, bf7b29ff57f06da30918266a0e1c2885a8f99784798d1bdb1628886aa015d788) (push) Has been cancelled
CI / build (zip, windows-latest, windows-x64, syft_1.50.0_windows_amd64.zip, syft.exe, 815ee6973ec5dff6a671d7f41b0e78835a8c45b91d5a39f4743ea1cee833d3be) (push) Has been cancelled
The release build lane added on 2026-08-02 (SBOM/provenance work) first ran on
the v6.88.0 tag and carried two never-exercised defects:
- The linux/windows archive smokes checked repo.bundle at the archive root,
but PyInstaller 6 onedir places datas under _internal/ (the runtime already
resolves the bundle root across Resources/Frameworks/_internal, and the
macOS DMG smoke checks the .app Resources path that BUNDLE maps correctly).
- download_ripgrep_standalone.ps1 read the first whitespace token of the
upstream .sha256 sidecar as the digest; the windows zip sidecar is prose
("SHA256 hash of <name>:" + hex on the next line), so the parser compared
against the literal word 'sha256' and the pin always failed. The digest is
now the first 64-char hex token wherever it sits, failing loudly if absent.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Windows full-test died at ~16% of the parallel pass with a session-wide
KeyboardInterrupt: pid_is_alive used os.kill(pid, 0), and on Windows CPython
maps signal 0 to CTRL_C_EVENT delivered to the probed pid's console process
group — a liveness probe of a same-console pid (e.g. our own) interrupted the
whole pytest session. The probe now uses OpenProcess + GetExitCodeProcess
(PROCESS_QUERY_LIMITED_INFORMATION, explicit restype/argtypes so 64-bit handles
survive, ACCESS_DENIED reads alive, exit code STILL_ACTIVE reads alive); the
POSIX branch is byte-identical to before. Every caller is a boolean liveness
gate, so the semantic change is strictly "stop signaling".
With the interrupt gone the suite ran to completion and exposed four masked
Windows-only failures, fixed here:
- scripts/run_external_review.py: the staged-patch apply returns to text-mode
stdin, symmetric with its text-mode capture — the exact configuration Windows
CI was green with through v6.87.5. The bytes stdin introduced with v6.88.0
broke CRLF worktrees (capture strips CR, bytes write never restores it).
- tests/test_plan_review.py (schedule-failure panel test): a REAL event queue
(MagicMock read as non-live and clamped the window) plus a 30s scout window
replace the 0.25s window that slow runners raced into a pre-launch admission
refusal before _schedule_task could even fail; with every schedule failing the
collect loop still exits immediately, so the test stays sub-second.
- .gitattributes (new): *.svg pinned to LF so the public-site cache-buster hash
test sees the committed bytes under core.autocrlf=true checkouts; all 12
committed svg blobs are already CR-free, so nothing renormalizes on POSIX.
- tests/test_evolution_state_integrity_v3.py (nested-conftest child): the child
python gets SystemRoot and TEMP on Windows — it cannot boot without
SystemRoot, and the serial pass had never reached this test while the
parallel pass was still red.
Full 3-OS matrix green on this exact tree: workflow_dispatch runs 30941773079
and 30943332598 (full-test ubuntu/macos/windows, ui-smoke, docker-ui-smoke,
docker-portable-test, skill-smoke x3, integration-test all green).
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Community sprint release. PR #87 (@octo-patch): MiniMax as a first-class
direct provider with maintainer follow-ups (live model catalog, region
restart policy, deep-slot clear-instead-of-fill on the guaranteed 512K
floor, docs/secret-enum sync). PR #90 (@ndrew1337): managed-update gate
hardening — exact-SHA promotion under the update lock, serialized
restart, mandatory blocking assisted post-commit test gate with
auto-rollback, and the owner-decided Q1=C dirty-stash lifecycle (local
work never enters committed history; restored after boot finalize or on
rollback; conflicting restores keep a disclosed stash entry). PR #91
(@ndrew1337): the two-pass hermetic pytest commit gate mirroring CI's
parallel+serial split with fail-closed crash/plugin/parallelism/deleted-
suite blocks, process containment extracted to process_containment.py,
and 64-bit-safe Windows Job Object ABI declarations.
Windows CRLF hardening (first full 3-OS matrix on the merged tip): every
multi-line git stdin payload now rides a BINARY pipe — the evolution
orphan-ref transaction (text-mode pipes turned 'start' into 'start\r'
and every containment transaction silently degraded to the decomposed
CAS fallback), the hermetic gate's diff replay in _run_git, and the
operator review script's staged-patch apply. The shipped two-pass gate
is versioned v6.88.0 across docs/tests (the contribution's provisional
v6.89 labels are retargeted).
Version carriers: VERSION, pyproject.toml, web/package.json,
GATEWAY_CONTRACT_VERSION, README badge + Version History (6.83.0 rolled
off per the P9 minor-row cap), ARCHITECTURE header.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Second pass over the cross-repo review backlog. One finding needed adjudicating
because a pinned test appeared to forbid it; the rest is small fixes and
sentences corrected against the code they describe.
THE WAIT THAT OUTLIVED THE TASK
`delegate_wait` is deliberately absent from `_DEADLINE_CLAMPED_TOOLS`, and a test
pins that absence with a docstring explaining it: neither escape hatch applies,
which is why the ToolEntry value (2100s) really is the bound. The finding claimed
the task deadline is bypassed. Those are two different concerns, so it was
settled by execution rather than by believing either one.
Measured. With ten seconds of deadline left, `web_search` gets its outer timeout
clamped to 1s while `delegate_wait` keeps all 2100 -- nothing upstream cuts it.
Then a real call: a run held RUNNING with its cursor still, a 2s deadline, and
`wait_sec=8`. It returned after 8.0s, with `deadline_remaining_sec` at -6.03. The
task slid six seconds past its own deadline inside one tool call, which is
exactly the defect that set was built for after the TB2.1 gpt2-codegolf
post-mortem.
So the finding is real and the pinned invariant survives untouched, because the
bound belongs in the tool rather than in that set. The outer clamp is a
thread-kill; this tool's entire contract is the graceful typed `no_progress`
return, and clamping it from outside would buy back the KILLED call the pinned
test exists to prevent. The window narrows to the remaining deadline instead --
narrow-only, the same shape `_bounded_max_seconds` already uses two hundred lines
up for the delegated run's own ceiling. The same call now returns in 1.0s with
0.98s of deadline still in hand, and its `waited_sec` reports the window it
really waited. A nanny with no deadline, and one whose deadline has already
passed, are both left alone: `deadline_remaining_sec` answers 0.0 for both, and
forced finalization owns the expired case.
THE THIRD SITE OF ONE CLASS
`non_final_rows` is `cost_final`'s disclosed cause and rides with it by contract,
"a flag no reader can reconstruct" otherwise. The root branch of
`_authoritative_terminal_cost` re-derives `cost_final` against the SUBTREE and
carried three subtree fields across -- but not this one. A root whose own rows are
all settled, turned non-final purely by a child's open row, reported a cause of
zero: not final, caused by nothing.
DELETIONS
* `settle_run` and `run_delegated_review_session` each derive the same applied
facts from the same `summary`, and each fell back differently when the engine
disclosed no model: `custody.model` in one, `route.model` in the other. Both are
the REQUEST. The durable ledger row and the reviewer's actor record could
therefore disagree about the same run, and the same duplication already forced
`applied_access` to be fixed twice in the previous commit. Both fallbacks
deleted; the two derivations are now textually identical.
* `_poll_session_terminal` timed a session out and said the run "was cancelled",
unconditionally -- while its own `cancel_and_verify` sits in a try/except that
logs and moves on. The claim was made whether or not the cancel landed, which is
the shape `record_containment_fault` forbids by name. The message now states the
budget it exceeded and stops there.
SMALLER, AND ONE RACE
* The owned-daemon spawn timeout raised its typed refusal and walked away from the
child it had just started. That child is ours and alive, and `self._proc` still
pointed at it, so the next `ensure_running` spawned a second daemon beside the
first -- one more per retry. `stop()` could not clean up either: by contract it
terminates only a daemon we successfully started. It is killed and forgotten
now, through the kill path `stop()` already had, which moves into a helper
instead of existing twice.
* `record_reviewer_slot_executions` was an unguarded read-modify-write, and
`run_parallel_review`'s own first line says the triad and scope surfaces run
concurrently. Two threads, one file: both read the same "before", and the slower
one wrote its rows over the faster one's, so whichever surface finished first
lost its whole «Выполняется как» line. `write_text_atomic` makes the write
untearable and says nothing about the read before it. An in-process
`threading.Lock` closes it -- the concurrency is threads, so nothing more is
needed.
* `_breakdown_bucket` summed `int(row.get(field) or 0)`, collapsing an ABSENT
token count into a reported zero at the aggregation layer -- undoing
`disclosed_tokens`, which keeps null as null at the row layer on the control
schema's own instruction ("never render null as 0"). A page of sessions that
reported no counts displayed a confident "0 tokens". A bucket is now absent only
when not one contributing row has the number, a partially-reporting bucket sums
the rows that did, and a measured zero stays a zero.
* Three bootstrap dependency-install failures logged at ERROR. Each is RETURNED as
the function's value and every caller consumes it, so an offline or flaky-mirror
bootstrap -- which continues, and may already have every package it needs -- read
as a crash in the launcher log. Warning.
THE UI SAID THINGS IT COULD NOT SEE
* The account card painted a window red off a snapshot the RUNTIME ignores. The
runtime skips any quota snapshot that is not `fresh` ("an old reading must not
block a lane"), so a stale spent window still dispatches while the card reported
it as down. Same bar on both sides of the glass now. The card also read
exhaustion off the single highest `used_ratio`, so a cooling constraint hid
behind a busier one -- and vanished entirely when it carried no ratio at all,
since a non-finite ratio was skipped before the cooldown could be read. Any
spent constraint counts, which is what the runtime does. `freshness` is a
required member of the daemon's snapshot schema; the fixtures carried none, and
now carry it as the wire does.
* A saved credential-account pin that discovery no longer returns matched no
option, so the select fell back to its first entry and redrew the row as
"automatic rotation". The pin only LOOKED gone until the panel was saved, which
then really did widen which account the reviewer may spend. Carried through as
"(not in discovery)", mirroring what the model list beside it already did, and
the select is drawn whenever there is something to show rather than only when
discovery is non-empty -- the daemon being down is the very case that needed it.
* The executor chip's tooltip said the work "ran on your <harness> subscription".
The chip cannot see the run's spend at all, and the ledger's own rule is that a
session is free only when the harness says so. It states where the work ran.
CLAIMS CORRECTED, CODE UNTOUCHED
`_apply_scope_authority` never said WHOSE window a retrieving row's authority is
about. It is the acked harness ROUTE's -- `reviewer_window.reviewer_route`
fingerprints the row under its own provider precisely so the ack lands on the
route it travels. It is not the model the engine reports back, which arrives only
after the run and is absent on older telemetry. Re-keying that lookup to the
reported model was measured: it fails every session scope row and closes a
delivery path the owner deliberately opened. When the engine resolves something
else, `capability_delta` already carries it on its own axis.
Four sites said a truncated primary output "could not be fetched and verified"
without naming the check. The engine publishes no content hash, so verification
is an equal byte count or the preview carried as a prefix -- enough to catch a
truncated, empty or wrong-length read, not enough to bind the bytes to a digest.
Each now names it, including the platform smoke, whose "tied to the run's own
claim" invited the strong reading.
`close_absent_run` asserted "Nothing is mutating, so this is not a containment
fault". Absent is a fact about the daemon that ANSWERED. Under the D30 owned
daemon Ouroboros provisions the engine itself and `ensure_running` will restart
one and rediscover its descriptor, so across that boundary a 404 can come from a
different daemon than the one holding the run. Unreachable and unknowable, not
quiet. Closing anyway stays the deliberate trade it always was, now stated as one.
`executor_route` was documented in three places as the route the work "really ran
on". It is the route resolved once at dispatch -- a request, not a receipt -- and a
landing below it is disclosed on `capability_delta`, not by rewriting the field.
`custody_durable` joins `_session_usage`: whether the durable start row landed is
already a fact the caller acts on, and carrying it into the actor record makes a
verdict delivered without custody legible afterwards. One key, disclosure only.
The login card's claim that a copy-paste command "is only ever issued for a job
that really is client_pty" is true of the CREATE route only; the poll route still
returns one for every job. The client reads the create answer alone, so the
comment is corrected to say what makes that safe rather than the server being
made to stop -- which costs more lines than the one already ignoring it.
NOT CHANGED, AND WHY
`applied_access`'s `summary["access"]` fallback was reported as still present at
two sites; the previous commit had already deleted both. Three subtractions, not
four. The double-bill relaunch is closed by that commit's `_settled_failure`
guard at the executor -- verified by disabling it and watching two pins fail -- and
the duplicated-facts half of the same finding is closed above by deletion rather
than by a shared reader, so no rejection layer was built. One finding was left
entirely alone as agreed.
VERIFICATION
Every behavioural fix proven by execution, and every pin mutation-tested by
reverting the fix and watching that pin, and only that pin, fail -- eight mutants
in all, including two for the wait clamp (removing it, and dropping its
positive-remaining guard) so the deadline-less control cannot be satisfied by the
same code as the clamped case. 643 tests across the fifteen touched suites pass,
`ruff check . --select F` is clean, and the web suite is 93/93 (91 before, two new
pins). Production is +153 lines across fifteen files, of which 88 are comments and
about 56 are docstring or message prose; executable production lines are +58/-32.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Five adversarial lenses BLOCKED a6a3c1f. Two defects were code; the rest were the
candidate describing itself untruthfully, which is not a lesser category. Every fix
below was reproduced by execution first and is pinned by a regression that fails on
the old behaviour (mutation-checked with PYTHONDONTWRITEBYTECODE=1 and cleared
__pycache__).
A2 (critical, code) — the P3 blocking scope gate FAILED OPEN. Measured on one panel
shape: api_chat status=sub_floor -> BLOCKED=True, agent_session
status=session_advisory -> BLOCKED=False. A panel of retrieving rows produced ZERO
authoritative verdicts and committed, because partial_quorum_shortfall only fires
above zero responders. Fixed in the ROW, not the aggregate: session_scope_authority
now returns blocked=True with the twin of the api row's sub-floor message, so
authority keeps ONE owner per delivery and the quorum stays a discloser. Widening the
aggregate to responded<required was rejected — it would make the aggregate a second
decider and turn sanctioned floor SKIPS (budget_exceeded, low-context) into blocks.
A2 second half — the >=200K floor was decorative. Retrieving rows were excluded from
Capability-Evidence probing, and their opaque harness[=model] target does not resolve
through provider_for_model, so no product path could ever reach confirmed/asserted:
advisory-only was the mode's only possible outcome. Session rows now fingerprint under
their own agent_session provider (never filed under a guessed openrouter), the
scope-slot save offers them the SAME owner-capability-ack the api slot uses against
their own floor, and the floor rides the notice as floor_tokens so the UI asks about
the number that route is judged by. No new mechanism: probe/owner-ack/notice/confirm
flow are the shipped ones.
A4 (critical, code) — two write vocabularies in one module, and the weaker one signed
the proof. Nine ordinary stdlib writes (shutil.copy/move/copytree, Path.touch,
os.symlink/truncate/chmod, extractall, unpack_archive) parsed to a fully-resolved AST
with ZERO targets while _INTERPRETER_ANY_WRITE_RE in the same file called all nine
writes — so "no targets, nothing unknown", the callers' proof of read-only, was handed
out for a payload that writes. NOT a runtime regression (identical on fc9c152), but the
claim marked a failure class closed. SSOT repair: the walker now models every spelling
the regex enumerates, resolving the destination where an argument names it (so an
out-of-repo copy still runs) and answering UNKNOWN where none does. Two adjacent holes
of the same class closed while there: a `.write` on a receiver the walker cannot trace
is UNKNOWN rather than a proven read, and the chained `open(p,"w").write(x)` form
resolves instead of being lost. Scoped to the regex's own discrimination, so
`dict.copy()` / `yaml.dump()` are not newly refused.
A1 (critical, docs) — the constitution stated a falsehood about this tree. BIBLE and
three ARCHITECTURE sites said the retrieving scope mode was PENDING IMPLEMENTATION and
that `low` was the only selectable path, while CHECKLISTS, README, the selector, the UI
and the executor all shipped it. Stale sentences deleted, five surfaces aligned on the
already-correct CHECKLISTS wording (D13 authorises the BIBLE edit).
A3 (critical, honesty) — BIBLE declared a constitutional bound with no implementation:
"the artifacts the session opened are recorded as FORENSIC evidence". A grep across
ouroboros/ and supervisor/ finds nothing. The bound now says the recording awaits an
upstream Claudexor read-event capability and is not performed today.
B1/B2 (high, false disclosure) — README:291 claimed drive was untouched and that a
provable write elsewhere still runs. Measured base->candidate with identical inputs: a
node inline READ and a node SCRIPT invocation of another task's drive both went
ALLOW->BLOCK, and with the DEFAULT cwd (the repo) every non-python inline invocation is
refused. Guard kept (the narrowing is defensible); the DISCLOSURE fixed at full size in
README, in the fence comment, and mirrored into the CHECKLISTS item-21 standing block.
B3 (high) — no sixth self-lowering detector built. The legacy reviewer-model keys were
equally reachable, so the marginal delta was thin; the escalation was A2, and A2 is
fixed. The BIBLE bound now describes owner INTENT and names what is actually enforced.
B4 (high) — a breached run's ad-hoc cancel swallowed every exception and then told the
agent "The run was cancelled" unconditionally, exactly what record_containment_fault's
own contract forbids. Now goes through custody.cancel_and_verify and builds the sentence
from its typed outcome.
C1 — containment_faults.jsonl documented (module map + drive tree); "no parallel store"
corrected. C2 — the one harness-name branch left in the core is a named residual in
DELEGATED_ADMISSION §7 with its removal condition; the branch is load-bearing for D30.
D1 the 5000->5100 raise is disclosed in the release line (measured 5049). D2
non_final_rows, declared on ChatOutbound in both mirrors, now actually reaches it. D3
the delegate_wait ceiling is clamped to the tool's own timeout and pinned to it by test
— above it the setting bought a killed call, not a longer wait. D4 the dead
agent.resolve_dispatch_executor entry point is removed and three ARCHITECTURE
references now name the real resolver. D5 two unused parameters dropped. D6 accepted as
inherited from the base, unchanged here.
Also, by request: the --scope-only exemption is removed from run_external_review.py
entirely — flag, _RAW_DIFF_CAP_LANES and _raw_diff_cap_decision. The whole-tree scope
pass it existed for was dropped from the plan, it had no caller and no test, and it
relaxed a refusal gate. The cap is byte-identical to its pre-exemption form.
And one defect the panel missed: a6a3c1f introduces two F401s that fc9c152 does not,
so the CI quick tier (ruff check . --select F) would have failed. Fixed; ruff clean.
VERSION unchanged at 6.89.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Hermetic full suite on 74a7330: exit 1, nine failures — every one classified by
EXECUTION before any change; none is a code regression, none is base-pre-existing
(all five pre-existing tests pass on fc9c152 in a detached worktree).
(b) H2 fence, 3x test_runtime_mode_core tripwire tests: pinned the retired
enumerate-and-detect contract (vector admitted, write executed, post-hoc tripwire
reports). The full inverted fence refuses those inline vectors UPFRONT with
nothing executed — proven identical on the H2 winner's own head (all three red on
cxi/p2-axes@5e97465 exactly like the candidate). The tripwire layer itself is
alive and now tested with vectors that legitimately pass the inverted fence
(script-file invocations — the fence judges only payloads it can read): probed
first by hand, the write happens and LIGHT_MODE_REPO_WRITE_BLOCKED fires. A new
pin (test_light_mode_inline_writer_is_refused_upfront) records the contract
change explicitly: upfront refusal, file untouched. fence_probe re-run: PASS.
(b) p6 seam, 2x test_claudexor_owned_daemon: pinned p6's decision-object feed of
_record_executor_facts; the fusion re-homed the fact to the ONE stamped task
record (p6's own stated principle - a projection of the decision, never a second
derivation - one level stronger). Assertions unchanged, feed ported.
(b) H3 seam, 2x test_max_tokens_constants: pinned p7a's _fit_shared_review_prompt
name; the fused candidate keeps p5x's api/session-split _fit_triad_prompt with
p7a's window internals. Tests now drive the surviving function through the same
assemble seam the production caller uses; both semantic pins (quorum sizing;
local-route window) unchanged.
(b) 2x source-carrier pins red on p6's OWN head (proven by execution on 1534e97):
test_page_chrome_static effort round-trip (6.3 moved the carrier to per-slot
reviewer_slots.js) and test_ws5_carryover probe-gate pin (the gate grew the 6.1
OUROBOROS_REVIEWER_SLOTS key and wrapped; still route-affecting-gated - the
ported pin asserts the surviving expression).
Also lands the review-runner change (scope_only_cap_scope.diff, +70/-8):
--scope-only exempts a scope-only run from the raw-diff cap that governs the
advisory/triad lanes (scope assembles its own atlas pack under its own budget)
with a loud no-advisory/no-triad-coverage disclosure; the p5x trusted-rerun list
entry (review_execution.py) the pre-p5x patched copy lacked is preserved, and the
call-site import the patch orphaned is removed. ISO-SPAWN (suite children with
scrubbed envs writing to the live data root) is measured as a RIPPLE
(44 import sites + derived import-time constants), NOT fixed here per the hard
limit, and ledgered as a precisely-diagnosed disclosed residual.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 3-OS Claudexor platform gate (D20/D26): claudexor-platform-gate.yml on
ubuntu/windows/macos runners with explicit API keys, honestly named as a platform
smoke (subscription auth NOT covered), + scripts/claudexor_platform_smoke.py and
its tests (27 green). Conflicts were the six version carriers only, resolved to
the base side per the single-final-bump policy. Guard PASS with all 8 contribs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The review lanes: AgentSessionReviewExecutor via the review_execution seam,
scope_review_session retrieving mode (SESSION_WINDOW_FLOOR=200_000 agreeing with
BIBLE.md:281 — H7 both halves landed and speak one number), D19 typed verdict with
light-model extraction gated on outputConformance, delegated advisory route.
delegate_custody (19 hunks) and delegate.py (17 hunks) resolved per plan §2a: p34's
34 post-fork fixes win (SETTLED_UNREAD, containment-fault projection, pending
invocations, _validated_invocation retry truth, canonical ledger root, disclosed
truncation), p5x's unique route-pool pin ('harnesses': [route_id]) taken; p5x's
inline staging cluster NOT re-added (p34's delegate_output.py is the one copy —
AST-verified identical bodies). Fixed one merge artifact: a duplicated
invocation_id/owned_project_id re-init after gateway construction clobbered the
retry token (caught by the transport suite). H2 files stayed on the full inverted
stack; fence_probe PASS. Guard PASS with p5x refactor moves dispositioned
(prompt assembly -> review_execution.py with alias re-imports; _FALLBACK_* regex
window superseded by the D19 light-model extractor; start_was_requested dead
surface not carried).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Range transplant via merge-tree with merge-base=7caf7c1 (contaminated-history
branch contributes its post-terminal delta only; D27). 65 files. All 8 conflict
blocks were version carriers, resolved to the base side (6.87.6) per the
single-final-bump policy (C7); the api_types.js conflict additionally dropped
the terminal typedef block the incoming side inherited from 7caf7c1, and the
README conflict dropped intermediate 6.88.x changelog rows carrying private
SHAs. PTY scan of the result: clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Move the macOS install flow to the top of README and /install/, add the approved drag-to-Applications visual, and package the Applications shortcut in the DMG.
Bind the shortcut to final-archive smoke and release proof, then remove only the copied shortcut from SBOM staging before Syft.
CI / build (tar.gz, ubuntu-latest, linux-x86_64, syft_1.50.0_linux_amd64.tar.gz, syft, bf7b29ff57f06da30918266a0e1c2885a8f99784798d1bdb1628886aa015d788) (push) Has been cancelled
CI / build (zip, windows-latest, windows-x64, syft_1.50.0_windows_amd64.zip, syft.exe, 815ee6973ec5dff6a671d7f41b0e78835a8c45b91d5a39f4743ea1cee833d3be) (push) Has been cancelled
CI / build (dmg, macos-latest, macos-arm64, syft_1.50.0_darwin_arm64.tar.gz, syft, e32fdb9d47823fa633748a1efca2528fd77c37469ea93c9e40ab835da44e4cce) (push) Has been cancelled
The README gains a Benchmarks section — the Terminal-Bench 2.1,
OSWorld-Verified, and CL-Bench state-of-the-art rows with model-matched
comparisons, the SWE-bench Pro and GAIA parity rows, and links to
submissions, public traces, and per-benchmark methodology. The public
homepage gets an evidence chapter with the headline charts and the same
submissions/traces links, and both surfaces replace the April interface
captures with current ones: the live subagent swarm, a project room with a
built-and-verified game, the OuroborosHub skills page, and the code-growth
chart. The README website badge moves to ouroboros-agent.ai, the site
metadata and og/social previews now name the benchmark results, and the
committed Pages output is rebuilt. The operator review wrapper now measures
its advisory size cap against the textual staged diff the production gates
actually review, with a conservative binary-patch fallback when git fails.
Reviewed: hermetic full-suite pytest preflight passed twice on this tree;
independent triple review (Fable 5 max, GPT-5.6 Sol high, Opus 5) returned
three SAFE TO COMMIT verdicts and the advisory findings were addressed.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Six reviewed phases land as one release.
Admission is the outer boundary: every migrated launcher records a manifest before
it can touch the filesystem, and finalizes a typed outcome on every path — success,
refusal, crash, and the real exit status. A structural audit enforces that boundary
across all fourteen launchers, together with confinement computed from the active
checkout and a single manifest publisher, judging by effect rather than by callee
name and failing closed on any write form it cannot resolve.
Harness exit codes are no longer trusted as run status: inspect returns zero for an
eval that raised and harbor returns zero for a job whose trials all errored, so the
launchers now read the harness's own artefact and keep "the harness failed", "it
scored nothing" and "it scored honest zeros" distinguishable.
The acceptance dialogue reconciles receipts through one typed identity that is an
equivalence by construction, so a passing check can no longer clear a red it never
addressed. Prompt caching is normalized at every send site and cached calls stop
under-reporting their input. The owner's context mode becomes explicit and
fail-closed, with one enforcement point for every writer of a disk-authored setting.
Deliberate limits are disclosed in each bench's METHODOLOGY.md rather than implied
by silence. Isolated benchmark egress and the multi-lane script generator are
deferred to a later release with restoration patches and carry-forward notes.
Operator phase 3, closing the owner-approved 6.65-6.67 release cycle.
Declarative widget schema v1 gains recursive group/metric/callout composition
with stable nested identity, bounded validation (depth 8 / 256 nodes), shared
safe fields, accessible chart fallbacks, and a native kanban Move-to path —
strictly additive, existing declarations unchanged. Visible UI completion now
requires vision-inspected evidence from a real consumer flow (risk-selected
states/viewports; mobile/WebKit are not universal). BIBLE gains the two
owner-approved one-line clarifications (P0 autonomous judgment, P2
smallest-class-fix scope); DEVELOPMENT records Pragmatic SOLID and the mutable
external-fact inventory without analyzers or runtime migrations; reviewer
prompts drop numeric finding pressure in favor of evidence-backed defects. The
operator review wrapper additionally probes the exact reviewer model per
candidate OpenRouter key.
Owner personally approved the rendered Widgets UI screenshots (desktop+narrow,
three live Hub skills) before review. Review: triad fable-5/gpt-5.6-sol/
gemini-3.5-flash + scope fable-5 all responded, aggregate PASSED first run
(20260716T230014Z, $14.32). Full non-serial+serial pytest, web node tests,
and the marker-gated UI browser smoke (12 passed) are green; ruff -F clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator phase 2 of the owner-approved 6.65-6.67 release cycle. The physical
mutation lease/holder subsystem was deliberately descoped by the owner:
attribution is evidence-only (root-task baseline, terminal candidate snapshot,
attributed commit staging, projection into acceptance/review evidence, no
structural outcome veto). Ships the surface-aware Python interpreter resolver,
auditable Skill Review rounds/history, the single task-tree disposition
authority with cancel-wins, the SSOT operator review wrapper with typed exit
codes, the parallel hermetic pytest preflight, and the chronic red-CI
light-model test fix.
Review: advisory=skipped (prompt-size cap, non-blocking), triad
fable-5/gpt-5.6-sol/gemini-3.5-flash all responded, scope fable-5 responded,
aggregate PASSED (run 20260716T221730Z, $16.38). Full non-serial+serial pytest
green; ruff -F clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pin the advisory/blocking enforcement decision to the owner with an
item-agnostic behavioral invariant in the frozen contract suite, so the agent
cannot hardcode findings to always-block. Restores the touched-file pack to
loud-fail on oversize (no silent functional-file omission) and adds a
standalone real triad+scope dry-run script.
Owner-approved big release (plan: большой_релиз_v6.26.0). Workstreams:
- WS-A lint gate: ruff F-rules step in CI quick-test; fixed the real F823
NameError class (supervisor/events.py utc_now_iso shadowing); make lint/health.
- WS-B memory integrity: atomic dialogue_blocks with corrupt-quarantine
(.corrupt-<ts>.bak + memory_store_corrupt event); honest scratchpad journal
(block_append_failed, corrupt storage renders as corruption not "(empty)");
full Pattern Register window (16K cap vs 3K cut); merge-aware scratchpad
consolidation under the sidecar lock; backlog writes through locked helpers;
chat omission notes ("[N older unconsolidated messages omitted]").
- WS-C provider SSOT: provider registry (prefixes/credentials/resolution) in
provider_models.py replacing 5 duplicated knowledge sites; credential-aware
consolidation model; pricing empty-fetch retry; direct-route correctness
(o-series max_completion_tokens, reasoning_effort, Anthropic error bodies,
per-request timeouts on cached clients); deep/plan review budgets reserve
output headroom inside the 1M window (min(SSOT, window − output − margin)).
- WS-D races/state: utils.update_json_locked (locked RMW, loud TimeoutError);
task_results merge under per-file lock (cancel-latch safe); update_state
migration for owner binding, evolution counters, budget_line, post-task
activation; queue-lock coverage (enqueue, timeouts, worker health, task_done,
snapshot); visible supervisor death (supervisor_error + owner notice + ghost
consciousness/chat-agent cleanup on re-init); chat.jsonl rotation via
os.replace under the append lock; unbounded _outbox removed; host-service
port probe + actual-port panic sweep; skill lifecycle lane deadline
(OUROBOROS_SKILL_LIFECYCLE_TIMEOUT_SEC, dedupe-leak-safe); consilium
force-plan structured flag (plan_review_aggregate from the FULL result);
atomic writers (update-intent, repo-manifest, metrics cache, post-task pair);
review_state.save_state raises on lock timeout (advisory ledger honesty);
apply_pending_request no-ops while a campaign is active;
api_update_apply kills workers only AFTER update validation, with respawn
on aborted checkout and "interrupted" terminal status.
- WS-E immune hardening: triad anti-refusal coverage contract (empty array
needs NO_FINDINGS sentinel or bare-[] body; refusal prose with [] is
parse_failure and never enters quorum); BIBLE P3 "Owner-chosen enforcement,
loud advisory" bound + CHECKLISTS sync; every advisory pass-through of a
blocking signal writes review_advisory_override + persistent
advisory_overrides (surfaced by review_status); ToolEntry.mutates_worktree
with dispatcher-level before/after worktree diff invalidation (covers error
paths; read-only runs no longer invalidate; redundant manual calls removed);
scope review fails closed without its checklist; advisory final write is a
locked re-read merge; synthesis severity defaults to critical with WARNING
fallbacks; find removed from SAFE_SHELL_COMMANDS; anti-thrashing state
survives advisory criticals; preflight env scrubs secret-class variables;
.git/index.lock age gate in worker startup checks.
- WS-F security: file-browser symlink containment on the RESOLVED path across
all endpoints (out-of-root symlink targets are listed but inert; tests
rewritten to the new contract deliberately); HMAC-signed session cookies
(server-side persisted key, 30-day TTL, Secure on TLS) replacing the
permanent password-derived cookie; password-class settings mask to a
constant placeholder; conservative SSRF guard for the MAIN agent (link-local
/cloud-metadata only, LAN stays reachable, per-request route re-validation);
ClawHub zip-slip hardening (":"/backslash segments rejected + post-join
containment) and lazy no-proxy OuroborosHub opener; single-execution
signature dispatch for extension handlers (no TypeError re-run after side
effects); onboarding postMessage origin checks; SHA256-pinned
python-standalone download with pipefail; payload-resident dependency
fingerprints only corroborate durable deps.json; skill payload re-hash
immediately before spawn (TOCTOU narrowing).
- WS-G process custody: ouroboros/process_custody.py — spawn_supervised
chokepoint + durable data/state/process_ledger.jsonl (pid, pgid,
fingerprint{start_time, cmd_sha256}, purpose, scope task|session|daemon,
owner_task, session_id); platform_layer.process_start_time primitive;
startup + periodic reaper killing ONLY strict-fingerprint matches from dead
generations/tasks (never by command-line class); migrations: services
(the orphan hole), workspace executor + local model + extension companions
(ledger write-through), worker_pids (write-through; legacy path retained);
parent lifelines (ppid watchdog, group-suicide only as group leader) in
worker_main, extension runner, Claude readonly child; conformance test
pinning the Popen allowlist; ARCHITECTURE/DEVELOPMENT/CHECKLISTS entries.
- WS-H native multimodal chat: supports_vision capability map (static
prefixes + OpenRouter /models input_modalities overlay); web chat uploads
ride the WS frame as structured attachments (additive ChatInbound field)
and image uploads become NATIVE image blocks via the existing Path B;
browser screenshots inject natively for vision models via the multipart
user-merge (tool result stays a string; file persisted under
data/uploads/screenshots for re-view); K=3 newest-image eviction with
caption placeholders carrying the vlm_query re-view path; image-aware token
estimates (fixed ~1.1K-token equivalent instead of base64 length, fixing
permanent emergency-compaction wedges); compaction renders images as
captions (no base64 into the summarizer); GigaChat/local lanes emit explicit
"[image omitted: model has no vision]"; internal _caption/_source_path
metadata stripped from provider payloads.
- WS-I housekeeping (partial): SETTLED_STATUSES SSOT (+ cycle-safe mirror pin);
owner_inject.py renamed to owner_mailbox.py; version-neutral envelope
wording; files.py import-block cleanup. Remaining WS-I/WS-J/WS-K items are
deferred with the owner's context-budget priority on review+release.
Review notes: triad+scope ran via scripts/run_external_review.py on the core
pack across 3 rounds to convergence (scope responded=PASS each round; round-2
criticals fixed: update_apply kill-order + respawn, lifecycle dedupe leak on
lane timeout, OUROBOROS_MAX_ROUNDS hot-reload + docs, toggle_evolution
NameError, async Anthropic timeout forwarding, supports_vision local check,
budget-update lock visibility, ChatInbound additive attachment contract,
file-browser doc sync). The FULL combined diff exceeds every triad model's
context window (~1.59M tokens > 1.05M) — reviewed in packs; remaining
cross-pack findings were verified as slicing artifacts. Adversarial critics
(GPT; Gemini/Opus rounds) ran on the working tree. Deliberate tradeoffs:
metadata-based eviction captions (no light-LLM call in the hot path);
worker ledger records use live-cmdline fingerprints with a synthetic-arg
fallback only where the OS offers no cmdline.
Introduce a derived code-intelligence layer with a read-only query tool, ripgrep-backed search, and clearer post-task self-improvement controls so Ouroboros can navigate larger codebases without regex-heavy guesswork.
