The release build lane added on 2026-08-02 (SBOM/provenance work) first ran on
the v6.88.0 tag and carried two never-exercised defects:
- The linux/windows archive smokes checked repo.bundle at the archive root,
but PyInstaller 6 onedir places datas under _internal/ (the runtime already
resolves the bundle root across Resources/Frameworks/_internal, and the
macOS DMG smoke checks the .app Resources path that BUNDLE maps correctly).
- download_ripgrep_standalone.ps1 read the first whitespace token of the
upstream .sha256 sidecar as the digest; the windows zip sidecar is prose
("SHA256 hash of <name>:" + hex on the next line), so the parser compared
against the literal word 'sha256' and the pin always failed. The digest is
now the first 64-char hex token wherever it sits, failing loudly if absent.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Windows full-test died at ~16% of the parallel pass with a session-wide
KeyboardInterrupt: pid_is_alive used os.kill(pid, 0), and on Windows CPython
maps signal 0 to CTRL_C_EVENT delivered to the probed pid's console process
group — a liveness probe of a same-console pid (e.g. our own) interrupted the
whole pytest session. The probe now uses OpenProcess + GetExitCodeProcess
(PROCESS_QUERY_LIMITED_INFORMATION, explicit restype/argtypes so 64-bit handles
survive, ACCESS_DENIED reads alive, exit code STILL_ACTIVE reads alive); the
POSIX branch is byte-identical to before. Every caller is a boolean liveness
gate, so the semantic change is strictly "stop signaling".
With the interrupt gone the suite ran to completion and exposed four masked
Windows-only failures, fixed here:
- scripts/run_external_review.py: the staged-patch apply returns to text-mode
stdin, symmetric with its text-mode capture — the exact configuration Windows
CI was green with through v6.87.5. The bytes stdin introduced with v6.88.0
broke CRLF worktrees (capture strips CR, bytes write never restores it).
- tests/test_plan_review.py (schedule-failure panel test): a REAL event queue
(MagicMock read as non-live and clamped the window) plus a 30s scout window
replace the 0.25s window that slow runners raced into a pre-launch admission
refusal before _schedule_task could even fail; with every schedule failing the
collect loop still exits immediately, so the test stays sub-second.
- .gitattributes (new): *.svg pinned to LF so the public-site cache-buster hash
test sees the committed bytes under core.autocrlf=true checkouts; all 12
committed svg blobs are already CR-free, so nothing renormalizes on POSIX.
- tests/test_evolution_state_integrity_v3.py (nested-conftest child): the child
python gets SystemRoot and TEMP on Windows — it cannot boot without
SystemRoot, and the serial pass had never reached this test while the
parallel pass was still red.
Full 3-OS matrix green on this exact tree: workflow_dispatch runs 30941773079
and 30943332598 (full-test ubuntu/macos/windows, ui-smoke, docker-ui-smoke,
docker-portable-test, skill-smoke x3, integration-test all green).
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Community sprint release. PR #87 (@octo-patch): MiniMax as a first-class
direct provider with maintainer follow-ups (live model catalog, region
restart policy, deep-slot clear-instead-of-fill on the guaranteed 512K
floor, docs/secret-enum sync). PR #90 (@ndrew1337): managed-update gate
hardening — exact-SHA promotion under the update lock, serialized
restart, mandatory blocking assisted post-commit test gate with
auto-rollback, and the owner-decided Q1=C dirty-stash lifecycle (local
work never enters committed history; restored after boot finalize or on
rollback; conflicting restores keep a disclosed stash entry). PR #91
(@ndrew1337): the two-pass hermetic pytest commit gate mirroring CI's
parallel+serial split with fail-closed crash/plugin/parallelism/deleted-
suite blocks, process containment extracted to process_containment.py,
and 64-bit-safe Windows Job Object ABI declarations.
Windows CRLF hardening (first full 3-OS matrix on the merged tip): every
multi-line git stdin payload now rides a BINARY pipe — the evolution
orphan-ref transaction (text-mode pipes turned 'start' into 'start\r'
and every containment transaction silently degraded to the decomposed
CAS fallback), the hermetic gate's diff replay in _run_git, and the
operator review script's staged-patch apply. The shipped two-pass gate
is versioned v6.88.0 across docs/tests (the contribution's provisional
v6.89 labels are retargeted).
Version carriers: VERSION, pyproject.toml, web/package.json,
GATEWAY_CONTRACT_VERSION, README badge + Version History (6.83.0 rolled
off per the P9 minor-row cap), ARCHITECTURE header.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Move the macOS install flow to the top of README and /install/, add the approved drag-to-Applications visual, and package the Applications shortcut in the DMG.
Bind the shortcut to final-archive smoke and release proof, then remove only the copied shortcut from SBOM staging before Syft.
CI / build (tar.gz, ubuntu-latest, linux-x86_64, syft_1.50.0_linux_amd64.tar.gz, syft, bf7b29ff57f06da30918266a0e1c2885a8f99784798d1bdb1628886aa015d788) (push) Has been cancelled
CI / build (zip, windows-latest, windows-x64, syft_1.50.0_windows_amd64.zip, syft.exe, 815ee6973ec5dff6a671d7f41b0e78835a8c45b91d5a39f4743ea1cee833d3be) (push) Has been cancelled
CI / build (dmg, macos-latest, macos-arm64, syft_1.50.0_darwin_arm64.tar.gz, syft, e32fdb9d47823fa633748a1efca2528fd77c37469ea93c9e40ab835da44e4cce) (push) Has been cancelled
The README gains a Benchmarks section — the Terminal-Bench 2.1,
OSWorld-Verified, and CL-Bench state-of-the-art rows with model-matched
comparisons, the SWE-bench Pro and GAIA parity rows, and links to
submissions, public traces, and per-benchmark methodology. The public
homepage gets an evidence chapter with the headline charts and the same
submissions/traces links, and both surfaces replace the April interface
captures with current ones: the live subagent swarm, a project room with a
built-and-verified game, the OuroborosHub skills page, and the code-growth
chart. The README website badge moves to ouroboros-agent.ai, the site
metadata and og/social previews now name the benchmark results, and the
committed Pages output is rebuilt. The operator review wrapper now measures
its advisory size cap against the textual staged diff the production gates
actually review, with a conservative binary-patch fallback when git fails.
Reviewed: hermetic full-suite pytest preflight passed twice on this tree;
independent triple review (Fable 5 max, GPT-5.6 Sol high, Opus 5) returned
three SAFE TO COMMIT verdicts and the advisory findings were addressed.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Six reviewed phases land as one release.
Admission is the outer boundary: every migrated launcher records a manifest before
it can touch the filesystem, and finalizes a typed outcome on every path — success,
refusal, crash, and the real exit status. A structural audit enforces that boundary
across all fourteen launchers, together with confinement computed from the active
checkout and a single manifest publisher, judging by effect rather than by callee
name and failing closed on any write form it cannot resolve.
Harness exit codes are no longer trusted as run status: inspect returns zero for an
eval that raised and harbor returns zero for a job whose trials all errored, so the
launchers now read the harness's own artefact and keep "the harness failed", "it
scored nothing" and "it scored honest zeros" distinguishable.
The acceptance dialogue reconciles receipts through one typed identity that is an
equivalence by construction, so a passing check can no longer clear a red it never
addressed. Prompt caching is normalized at every send site and cached calls stop
under-reporting their input. The owner's context mode becomes explicit and
fail-closed, with one enforcement point for every writer of a disk-authored setting.
Deliberate limits are disclosed in each bench's METHODOLOGY.md rather than implied
by silence. Isolated benchmark egress and the multi-lane script generator are
deferred to a later release with restoration patches and carry-forward notes.
Operator phase 3, closing the owner-approved 6.65-6.67 release cycle.
Declarative widget schema v1 gains recursive group/metric/callout composition
with stable nested identity, bounded validation (depth 8 / 256 nodes), shared
safe fields, accessible chart fallbacks, and a native kanban Move-to path —
strictly additive, existing declarations unchanged. Visible UI completion now
requires vision-inspected evidence from a real consumer flow (risk-selected
states/viewports; mobile/WebKit are not universal). BIBLE gains the two
owner-approved one-line clarifications (P0 autonomous judgment, P2
smallest-class-fix scope); DEVELOPMENT records Pragmatic SOLID and the mutable
external-fact inventory without analyzers or runtime migrations; reviewer
prompts drop numeric finding pressure in favor of evidence-backed defects. The
operator review wrapper additionally probes the exact reviewer model per
candidate OpenRouter key.
Owner personally approved the rendered Widgets UI screenshots (desktop+narrow,
three live Hub skills) before review. Review: triad fable-5/gpt-5.6-sol/
gemini-3.5-flash + scope fable-5 all responded, aggregate PASSED first run
(20260716T230014Z, $14.32). Full non-serial+serial pytest, web node tests,
and the marker-gated UI browser smoke (12 passed) are green; ruff -F clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator phase 2 of the owner-approved 6.65-6.67 release cycle. The physical
mutation lease/holder subsystem was deliberately descoped by the owner:
attribution is evidence-only (root-task baseline, terminal candidate snapshot,
attributed commit staging, projection into acceptance/review evidence, no
structural outcome veto). Ships the surface-aware Python interpreter resolver,
auditable Skill Review rounds/history, the single task-tree disposition
authority with cancel-wins, the SSOT operator review wrapper with typed exit
codes, the parallel hermetic pytest preflight, and the chronic red-CI
light-model test fix.
Review: advisory=skipped (prompt-size cap, non-blocking), triad
fable-5/gpt-5.6-sol/gemini-3.5-flash all responded, scope fable-5 responded,
aggregate PASSED (run 20260716T221730Z, $16.38). Full non-serial+serial pytest
green; ruff -F clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pin the advisory/blocking enforcement decision to the owner with an
item-agnostic behavioral invariant in the frozen contract suite, so the agent
cannot hardcode findings to always-block. Restores the touched-file pack to
loud-fail on oversize (no silent functional-file omission) and adds a
standalone real triad+scope dry-run script.
Owner-approved big release (plan: большой_релиз_v6.26.0). Workstreams:
- WS-A lint gate: ruff F-rules step in CI quick-test; fixed the real F823
NameError class (supervisor/events.py utc_now_iso shadowing); make lint/health.
- WS-B memory integrity: atomic dialogue_blocks with corrupt-quarantine
(.corrupt-<ts>.bak + memory_store_corrupt event); honest scratchpad journal
(block_append_failed, corrupt storage renders as corruption not "(empty)");
full Pattern Register window (16K cap vs 3K cut); merge-aware scratchpad
consolidation under the sidecar lock; backlog writes through locked helpers;
chat omission notes ("[N older unconsolidated messages omitted]").
- WS-C provider SSOT: provider registry (prefixes/credentials/resolution) in
provider_models.py replacing 5 duplicated knowledge sites; credential-aware
consolidation model; pricing empty-fetch retry; direct-route correctness
(o-series max_completion_tokens, reasoning_effort, Anthropic error bodies,
per-request timeouts on cached clients); deep/plan review budgets reserve
output headroom inside the 1M window (min(SSOT, window − output − margin)).
- WS-D races/state: utils.update_json_locked (locked RMW, loud TimeoutError);
task_results merge under per-file lock (cancel-latch safe); update_state
migration for owner binding, evolution counters, budget_line, post-task
activation; queue-lock coverage (enqueue, timeouts, worker health, task_done,
snapshot); visible supervisor death (supervisor_error + owner notice + ghost
consciousness/chat-agent cleanup on re-init); chat.jsonl rotation via
os.replace under the append lock; unbounded _outbox removed; host-service
port probe + actual-port panic sweep; skill lifecycle lane deadline
(OUROBOROS_SKILL_LIFECYCLE_TIMEOUT_SEC, dedupe-leak-safe); consilium
force-plan structured flag (plan_review_aggregate from the FULL result);
atomic writers (update-intent, repo-manifest, metrics cache, post-task pair);
review_state.save_state raises on lock timeout (advisory ledger honesty);
apply_pending_request no-ops while a campaign is active;
api_update_apply kills workers only AFTER update validation, with respawn
on aborted checkout and "interrupted" terminal status.
- WS-E immune hardening: triad anti-refusal coverage contract (empty array
needs NO_FINDINGS sentinel or bare-[] body; refusal prose with [] is
parse_failure and never enters quorum); BIBLE P3 "Owner-chosen enforcement,
loud advisory" bound + CHECKLISTS sync; every advisory pass-through of a
blocking signal writes review_advisory_override + persistent
advisory_overrides (surfaced by review_status); ToolEntry.mutates_worktree
with dispatcher-level before/after worktree diff invalidation (covers error
paths; read-only runs no longer invalidate; redundant manual calls removed);
scope review fails closed without its checklist; advisory final write is a
locked re-read merge; synthesis severity defaults to critical with WARNING
fallbacks; find removed from SAFE_SHELL_COMMANDS; anti-thrashing state
survives advisory criticals; preflight env scrubs secret-class variables;
.git/index.lock age gate in worker startup checks.
- WS-F security: file-browser symlink containment on the RESOLVED path across
all endpoints (out-of-root symlink targets are listed but inert; tests
rewritten to the new contract deliberately); HMAC-signed session cookies
(server-side persisted key, 30-day TTL, Secure on TLS) replacing the
permanent password-derived cookie; password-class settings mask to a
constant placeholder; conservative SSRF guard for the MAIN agent (link-local
/cloud-metadata only, LAN stays reachable, per-request route re-validation);
ClawHub zip-slip hardening (":"/backslash segments rejected + post-join
containment) and lazy no-proxy OuroborosHub opener; single-execution
signature dispatch for extension handlers (no TypeError re-run after side
effects); onboarding postMessage origin checks; SHA256-pinned
python-standalone download with pipefail; payload-resident dependency
fingerprints only corroborate durable deps.json; skill payload re-hash
immediately before spawn (TOCTOU narrowing).
- WS-G process custody: ouroboros/process_custody.py — spawn_supervised
chokepoint + durable data/state/process_ledger.jsonl (pid, pgid,
fingerprint{start_time, cmd_sha256}, purpose, scope task|session|daemon,
owner_task, session_id); platform_layer.process_start_time primitive;
startup + periodic reaper killing ONLY strict-fingerprint matches from dead
generations/tasks (never by command-line class); migrations: services
(the orphan hole), workspace executor + local model + extension companions
(ledger write-through), worker_pids (write-through; legacy path retained);
parent lifelines (ppid watchdog, group-suicide only as group leader) in
worker_main, extension runner, Claude readonly child; conformance test
pinning the Popen allowlist; ARCHITECTURE/DEVELOPMENT/CHECKLISTS entries.
- WS-H native multimodal chat: supports_vision capability map (static
prefixes + OpenRouter /models input_modalities overlay); web chat uploads
ride the WS frame as structured attachments (additive ChatInbound field)
and image uploads become NATIVE image blocks via the existing Path B;
browser screenshots inject natively for vision models via the multipart
user-merge (tool result stays a string; file persisted under
data/uploads/screenshots for re-view); K=3 newest-image eviction with
caption placeholders carrying the vlm_query re-view path; image-aware token
estimates (fixed ~1.1K-token equivalent instead of base64 length, fixing
permanent emergency-compaction wedges); compaction renders images as
captions (no base64 into the summarizer); GigaChat/local lanes emit explicit
"[image omitted: model has no vision]"; internal _caption/_source_path
metadata stripped from provider payloads.
- WS-I housekeeping (partial): SETTLED_STATUSES SSOT (+ cycle-safe mirror pin);
owner_inject.py renamed to owner_mailbox.py; version-neutral envelope
wording; files.py import-block cleanup. Remaining WS-I/WS-J/WS-K items are
deferred with the owner's context-budget priority on review+release.
Review notes: triad+scope ran via scripts/run_external_review.py on the core
pack across 3 rounds to convergence (scope responded=PASS each round; round-2
criticals fixed: update_apply kill-order + respawn, lifecycle dedupe leak on
lane timeout, OUROBOROS_MAX_ROUNDS hot-reload + docs, toggle_evolution
NameError, async Anthropic timeout forwarding, supports_vision local check,
budget-update lock visibility, ChatInbound additive attachment contract,
file-browser doc sync). The FULL combined diff exceeds every triad model's
context window (~1.59M tokens > 1.05M) — reviewed in packs; remaining
cross-pack findings were verified as slicing artifacts. Adversarial critics
(GPT; Gemini/Opus rounds) ran on the working tree. Deliberate tradeoffs:
metadata-based eviction captions (no light-LLM call in the hot path);
worker ledger records use live-cmdline fingerprints with a synthetic-arg
fallback only where the OS offers no cmdline.
Introduce a derived code-intelligence layer with a read-only query tool, ripgrep-backed search, and clearer post-task self-improvement controls so Ouroboros can navigate larger codebases without regex-heavy guesswork.
Make headless Google Colab a first-class Ouroboros runtime controlled entirely
over Telegram, and treat reviewed transport/control skills as full replacements
for the local UI.
- Colab source-mode bootstrap: mounts Drive for persistent data/, role-based
remotes (managed=official, origin=personal fork), merges existing Drive
settings on re-run, and installs+enables the Telegram bridge in full_access
over the loopback gateway.
- Role-based GitHub remotes with auto-fork personal origin while preserving the
official managed update remote; a clone-default official origin is reclassified
as managed (never an origin conflict) and configure_personal_remote guarantees
managed exists before repointing origin.
- Transport/control-skill doctrine: a reviewed + token-bound + enabled +
owner-granted + owner-bound chat/control skill is a first-class control surface;
review judges actual safety properties, not breadth of control (CHECKLISTS,
CREATING_SKILLS, ARCHITECTURE).
- Owner-external slash TOFU so a real Telegram owner is authorized without ever
locking out the local web owner; external /review targets the requesting chat.
- Adaptive LLM request-parameter normalization (OpenRouter no longer drops Opus
on unsupported sampling params).
- official_hub review profile downgrades severity-driven hygiene/bug findings to
warnings for hash-verified official OuroborosHub payloads (re-verified via the
local sidecar on reload); trust-boundary items and deterministic gates stay
fail-closed. Deterministic preflight failures persist+aggregate to PENDING
(non-executable under every enforcement mode, surviving reload).
- Reviewed-skill auto-grants default on; rescue snapshots recoverable via real
git refs; ff-only restore of personal-origin self-mods across Colab sessions.
Structurally closes the subagent worker-crash, ghost-task, and stuck-spinner
classes across all platforms, makes Ouroboros usable with any single provider
key, and ships node-runtime skill support.
- Workers: macOS/Windows use spawn (Linux keeps fork); central OUROBOROS_IN_WORKER
no-proxy policy removes the macOS _scproxy fork SIGSEGV class. Signal crashes are
terminal (no retry) for all task types.
- Lifecycle: monotonic write_task_result guard (terminal/cancel sticky); live
cancel_task + cancel_requested latch; terminal task_done on every crash/kill/
timeout/cancel path; snapshot restore skips terminal; schedule fail-fast when the
worker pool is disabled. No ghosts, no perpetual spinner (incl. reconnect reconcile).
- Subagent UI: Variant A parent dashboard (in-place rows, child progress/terminal
routed to parent, no duplicate child card).
- Providers: Cloud.ru is a first-class exclusive-direct provider (review/scope
fallback + static pricing). New-user defaults: review claude-opus-4.8, Claude Code
opus[1m]; existing anthropic-only migrate 4.6->4.8.
- Skills: skill_preflight tolerates missing/killed validators; build bundles a
signed Node.js LTS (resolve_bundled_node) for node --check and node runtimes.
- Docs: README OuroborosHub badge/callout; ARCHITECTURE bundled-node + defaults.
Reviewed via multi-model adversarial (2 rounds) + Ouroboros triad/scope review
(converged). Local suite: 3207 passed, 1 skipped.
Consolidate repeated gateway, review, skill lifecycle, marketplace, memory/context, release, and web UI paths while preserving public API shapes, review gates, and runtime contracts.
Verification: python3 -m pytest tests -q --tb=short; external triad review PASS with scope review skipped only for context budget advisory.
Layered on top of rc.5..rc.7 catch-up reduction line. Preserves the
rc.7 prompt-injection fix in renderSkillRepairPrompt (web/modules/utils.js)
and the rc.6 docs/accounting cleanup. Adds the Quality, DX & Closed-loop
Skills wave from the user-approved finish plan:
- runtime_mode=light reframed as a minimal compatibility/self-modification
guard. Path-aware shell filter (_light_shell_repo_mutation): blocks
simple writer commands (cp, mv, rm, sed, sort -o, uniq, ...) only when
their target resolves inside the Ouroboros checkout, blocks shell-
wrapped writes via 'sh -c' / 'bash -c', blocks mutative direct git
through run_shell, and otherwise lets ordinary python/node/bash
diagnostics run. Removed the heavy Python AST scanner + script-content
scan that was over-blocking legitimate work.
- Chat scroll fixes: ResizeObserver re-attach, near-bottom threshold,
Playwright smoke now asserts scrollTop ~ scrollHeight after send.
- Recent-chat dedup: read_jsonl_tail_after_offset honours
dialogue_meta.last_consolidated_offset; provenance-aware via a chat
log generation signature (first_line_sha256 + size) so log rotation
cannot silently drop entries.
- Stable WORLD.md injected into context.build_memory_sections.
- plan_task and the commit triad accept duplicate model IDs as valid
reviewer slots (single-provider stochastic sampling); _get_review_models
no longer pads 2-slot configs to 3.
- Settings: OUROBOROS_AUTO_GRANT_REVIEWED_SKILLS owner-confirmed via the
desktop launcher bridge (request_auto_grant_reviewed_skills_change),
hot-read from settings.json so toggle changes take effect without
restart, /api/settings POST drops the key. Consistent truthy parsing
on JS + launcher sides.
- skill_review.py runs an optional fail-open Claude Code advisory over
the skill payload only (include_repo_diff=False), and injects its
output as inert evidence BEFORE the authoritative output contract.
- skill_exec emits skill_exec_finished / skill_exec_failed events;
worker enqueues them on ctx.event_queue, supervisor.events dispatches
them to logs/events.jsonl + the live log + the in-process event bus
for skill.lifecycle subscriptions. host_service_api allows manifest-
declared skill.lifecycle subscriptions without an extra grant.
- run_shell auto-rewrites grep "A\|B" argv-mode to grep -E "A|B" with
SHELL_REGEX_AUTO_CORRECTED prefix; explicit -E/-G/-P/-F still pass
through. SAFE_SHELL_COMMANDS no longer includes sort/uniq.
- Extension loader hardening: load_extension(drive_root=...) is
mandatory (no silent ~/Ouroboros/data fallback), TestClient lifespan
+ settings hot-reload pin to app.state.drive_root, _sweep_stale_-
extension_imports preserves the live import root via a keep-list,
fixture cleanup uses unload_extension. Adds clean_extension_runtime_-
state superset helper and tests for cleanup, drive_root requirement,
and live-root preservation.
- Test pollution: scripts/cleanup_test_pollution.py (dry-run-first
utility), tests/_shared._make_safe_mock_ctx for advisory-workflow
ctxs, _make_safe_mock_ctx adoption in test_advisory_workflow*.
- PluginAPI v1.2: PLUGIN_API_VERSION bumped, skill_job_dir added to
the frozen Protocol + the contract test.
- docs/ARCHITECTURE.md, docs/CHECKLISTS.md, docs/CREATING_SKILLS.md,
prompts/SYSTEM.md updated for new behavior (light-mode wording,
cleanup script, skill.lifecycle topic, advisory pre-review path,
duplicate reviewer slots, auto-grant settings + permissions wording).
VERSION 5.15.0-rc.8 / pyproject.toml 5.15.0rc8 / README badge + Version
History row + ARCHITECTURE.md header all in sync.
Two related fixes that close a same-process privilege-escalation path
demonstrated by the agent in a video-gen skill task and unblock the
natural light-mode workflow at the same time.
Q1 — light allows skills (Frame A): removes runtime_mode == "light"
blocks at ouroboros/tools/skill_exec.py::_handle_skill_exec, the
extension-tool dispatch in ouroboros/tools/registry.py::ToolRegistry.execute
and the runtime_mode_light short-circuit in
ouroboros/extension_loader.py::_extension_runtime_state /
load_extension. Skills already pass tri-model review_skill PASS +
enabled.json toggle + content-hash freshness + sandboxed subprocess
+ FORBIDDEN_SKILL_SETTINGS denylist; gating execution by runtime_mode
only denied owner-approved capabilities.
Q2 — elevation ratchet (multi-layer):
1. ouroboros/config.py::save_settings(allow_elevation=False) chokepoint
compares incoming OUROBOROS_RUNTIME_MODE against a boot-time
baseline (_BOOT_RUNTIME_MODE pinned by initialize_runtime_mode_baseline
from server.py::lifespan). The baseline is exported to
OUROBOROS_BOOT_RUNTIME_MODE env var so subprocesses (run_shell,
skill_exec, mp.spawn workers) inherit the pin via env. Once any
baseline source is available, allow_elevation=True becomes inert.
2. ouroboros/tools/core.py::_data_write blocks writes whose
Path.samefile resolves to SETTINGS_PATH (handles macOS APFS /
Windows NTFS case-insensitive bypass via parent-resolve +
name.lower() fallback).
3. server.py::_merge_settings_payload skips OUROBOROS_RUNTIME_MODE
from /api/settings POST body. api_settings_post adds belt-and-braces
revert. web/modules/settings.js no longer sends the key; the
Behavior tab segmented control becomes display-only with disabled
buttons + tooltip explaining the manual procedure.
4. ouroboros/tools/registry.py::_run_shell_safety_check runs two
substring filters on every run_shell invocation:
- Argv-level _detect_runtime_mode_elevation (conjunctive: BOTH
save_settings AND OUROBOROS_RUNTIME_MODE, OR the dotted path
ouroboros.config.save_settings) fires in ALL modes; the
module-level _LIGHT_MUTATION_INDICATORS (extended with
.write_text(, .write_bytes(, os.replace(, os.rename() fires only
in light.
- File-content scan (iter-3 fix for the file-based subprocess
bypass): _extract_script_file_args walks past interpreter flags
and resolves the script file argument; if it lives inside
repo_dir or drive_root, _scan_script_files reads up to 256 KB
and re-runs the same indicators on the content. Closes the
deterministic 2-step chain data_write helper.py + run_shell
python helper.py that previously poisoned settings.json directly.
5. ouroboros/file_browser_api.py guards api_files_write / delete /
transfer / upload via _is_owner_only_settings_file (samefile-aware).
6. supervisor/workers.py::worker_main calls
initialize_runtime_mode_baseline so spawn-method workers re-pin
from inherited env.
7. ouroboros/tools/registry.py extension dispatch now goes through
ouroboros.safety.check_safety (extracted to _dispatch_extension_tool
helper).
8. prompts/SAFETY.md gains a DANGEROUS clause naming the runtime_mode
self-elevation channels.
Tests: 2705 passed, 0 failed (added 47 new tests in
tests/test_runtime_mode_elevation.py covering chokepoint, downgrade,
data_write block with case-mismatch + symlink + env override, API
drop, set_tool_timeout regression, onboarding flow, boot-baseline
post-pin inert, env-var subprocess propagation, file-content scan
across all modes + light pathlib.write_text + benign-script
false-positive negative + interpreter parser unit tests; conftest.py
autouse fixture resets baseline between tests).
Pre-release went through two cycles of multi-model adversarial review
(Gemini + GPT + Opus critics) plus two cycles of the actual triad+scope
reviewer pipeline. Phase B (move owner settings outside drive_root
for OS-level containment) and the Privilege Boundary section in
prompts/SYSTEM.md are deferred per the minimal_safety profile and
recorded in data/memory/knowledge/improvement-backlog.md.
External review tool: scripts/run_external_review.py invokes
ouroboros.tools.parallel_review.run_parallel_review on the staged
diff with FULL raw triad+scope output (no truncation).
Note on changelog rolloff: the v4.42.1 patch entry was rolled off in
this release to respect the P7 5-patch-row cap. Its full body remains
at git tag v4.42.1.
Closes the re-audit cycle. Six non-committing advisory+triad+scope
cycles converged with 0 open findings before this commit.
Extension runtime:
- extension_loader.py stages each load under data/state/skills/<name>/__extension_imports/<uuid>/skill/
to defeat Python module caching on rapid in-place edits; fail-closed if
any symlink in the skill tree resolves outside the reviewed checkout.
- extensions_api.api_extension_manifest reports live-SSOT load_error,
not the stale discovery copy, so index and manifest agree.
- tools/registry.list_non_core_tools() now merges live ext.* tools.
Release / packaging guards (BIBLE.md P7):
- scripts/build_repo_bundle.py fail-closed if no release tag is resolved,
verifies the tag is annotated (git cat-file -t == tag), and that it
points at HEAD.
- build.sh / build_linux.sh / build_windows.ps1 enforce the same three
checks before invoking PyInstaller. Synthetic/fake tags no longer
accepted.
- _validate_source_branch no longer treats an ls-remote-only branch as
usable; requires local ref availability, symmetric with
_ensure_source_sha_tracks_branch.
- release_sync._normalize_pep440 now collapses alpha->a and beta->b per
PEP 440 canonical pre-release spelling.
Onboarding preservation:
- Wizard no longer silently wipes OPENAI_BASE_URL, OPENAI_COMPATIBLE_*,
CLOUDRU_FOUNDATION_MODELS_BASE_URL on re-run. The wizard only resets
keys it actually exposes.
Docs and prompts sync:
- ARCHITECTURE.md describes the bundle-bootstrap model, the
__extension_imports/ staging surface, the build-script release tag
prerequisite, the extension HTTP review endpoint, and
VALID_EXTENSION_ROUTE_METHODS as part of the frozen contract.
- BIBLE.md + prompts/SYSTEM.md release invariant now distinguishes
author-facing spelling (VERSION / README / tag / ARCHITECTURE) from
the PEP 440 canonical form required by pyproject.toml.
- prompts/SYSTEM.md Immutable Safety Files list matches
SAFETY_CRITICAL_PATHS exactly (BIBLE.md included).
- docs/CHECKLISTS.md row 1 explains the author-facing vs PEP 440 split.
Runtime SSOT:
- server.py::_run_supervisor feeds workers.init the manifest-driven
branch names from _runtime_branch_defaults() instead of hardcoded
ouroboros / ouroboros-stable.
- contracts/skill_manifest.py accepts body-only instruction-skill
markdown that starts with a --- thematic break.
Regression coverage added for every real fix above across
test_extension_loader, test_extensions_api, test_build_scripts,
test_build_repo_bundle, test_launcher_sync, test_onboarding_wizard,
test_packaging_sync, test_release_sync, test_contracts, plus a new
test_release_workflow guard for the CI release path.
VERSION carriers synchronized:
- VERSION = 4.50.0-rc.3 (author-facing)
- pyproject.toml = 4.50.0rc3 (PEP 440 canonical)
- README.md badge + Version History row = 4.50.0-rc.3
- docs/ARCHITECTURE.md header = 4.50.0-rc.3
Branch `ouroboros` was seeded from an `.app` bundle snapshot
(`6700358 Initial commit from app bundle`), not from `main`, so the
release pipeline (build scripts, PyInstaller spec, launcher runtime,
vendored Python framework, CI workflow) never landed on this branch.
Import those files verbatim from `origin/main` (76bf13c) so a tagged
push can trigger the existing tag-driven release pipeline.
Imported verbatim from `origin/main`:
- .github/workflows/ci.yml Three-tier CI (push -> quick
tests, stable/tag -> full matrix,
v* tag -> build + GitHub Release
with `prerelease: contains(...,
-rc|-alpha|-beta)`).
- build.sh / build_linux.sh / PyInstaller + Playwright Chromium
build_windows.ps1 / Dockerfile bundling for each target (the four
files `tests/test_build_scripts.py`
assertively requires).
- Ouroboros.spec PyInstaller entry spec.
- entitlements.plist macOS codesign entitlements.
- launcher.py Native launcher that bootstraps
the embedded python-standalone
interpreter and runs the agent as
a subprocess.
- scripts/download_python_standalone.sh / .ps1 / pyi_rth_pythonnet.py
- Python, Python.framework/ Vendored macOS launcher-side
Python 3.10 framework.
- certifi/, jsonschema/, Marker + data files consumed by
jsonschema_specifications/ the runtime-loaded agent deps.
Adapted for Phase 1-6:
- Ouroboros.spec datas now contains ('skills', 'skills') so the
bundled Phase 5 weather reference skill under `skills/weather/`
actually ships inside the .app / .exe / tarball. Without this the
Skills page on a packaged build would show "no skills discovered"
even with the bundled reference in source. Docstring updated to
document the new bundled payload.
Verification:
- `pytest tests/test_build_scripts.py tests/test_release_sync.py`
passes locally (47 asserts; all Playwright + PyInstaller ordering
invariants + release-sync carrier logic hold after the import).
- `python -c "import ast; ast.parse(open('Ouroboros.spec').read())"`
parses.
Not imported from main (intentional):
- `.pytest-tmp-run`, pytest-cache dirs, and other transient files.
- No existing file was overwritten by the checkout; the import is
purely additive on top of the Phase 1-6 tree.
