THREE changes from the TB2.1 trace-deepdive follow-up, plus all real fixes from the 3-way review
gauntlet (Ouroboros triad+scope, codex gpt-5.5, adversarial multimodel).
#1 (devtools/run_tb.apply_all_model): --all-model now defaults to ONE reviewer at low effort
(3 identical = monoculture, no diversity); configurable via --review-slots / --review-effort.
Bench env only; no config default change.
#2 (ouroboros/tools/shell._resolve_effective_timeout): SSOT hygiene. OUROBOROS_TOOL_TIMEOUT_SEC=600
was silently dropped to the in-code 360 (the `!= default_setting` skip). Rewritten as one
normalized pipeline (override>env>settings>config>fallback -> ceiling -> deadline-clamp -> >=1);
env/settings no longer bypass the clamp. + diagnostic TOOL_TIMEOUT message (start_service /
timeout_sec= / best-effort-before-deadline; no command-keyword classifier). RELEASE NOTE: ex-360
installs now get 600. (0 TOOL_TIMEOUT events in the TB run -- hygiene, not the benchmark fix.)
#3 (ouroboros/tools/vision.view_image + prompts/SYSTEM.md): new tool injecting a LOCAL image NATIVELY
into the active model's context (reusing _inject_native_screenshot + supports_vision + K=3
eviction). LOCAL PATHS ONLY (no URL/base64); reuses vlm_query's EXACT trust checks via shared
_load_local_image_payload. Registered OUTSIDE _WEB_TOOLS so allowed_resources.web=false no longer
blocks local vision. Resource class: local_file_to_model.
GAUNTLET FIXES (all verified real; rejected items were decided tradeoffs / cosmetic / pre-existing):
- CRITICAL (triad+adversarial): view_image was missing from the tool-visibility allowlists, so it was
INVISIBLE in workspace_mode (the benchmark!) and to subagents. Added to
registry._WORKSPACE_ALLOWED_TOOLS + tool_capabilities.{CORE,LOCAL_READONLY_SUBAGENT,ACTING_SUBAGENT}
(matching vlm_query/analyze_screenshot). (_EPHEMERAL_ALLOWED_TOOLS intentionally NOT added — vlm_query
isn't there either.)
- CRITICAL (triad): view_image had no safety.TOOL_POLICY entry (breaks the coverage invariant test).
Added "view_image": POLICY_SKIP (matches vlm_query/analyze_screenshot; a local-read tool, no shell/net).
- codex+adversarial: the K=3 image-eviction placeholder pointed re-view at vlm_query (web-blocked under
web=false); changed to view_image (loop.py).
- codex: view_image saved re-view copies with a doubled extension (chart.png.png); use stem + actual
(downscaled) mime ext.
- BLOCKER (codex+adversarial): stale tests updated to the new behavior — test_run_tb_methodology.py
(1 reviewer + low + a review_slots=3 case), test_shell_run_shell.py (360->600 SSOT), and
test_multimodal_chat.py (view_image re-view placeholder).
- adversarial: the new timeout tests now stub load_settings() for determinism.
- triad: documented view_image in docs/ARCHITECTURE.md (vision-tools paragraph).
Declined (evidence-based): shared native-injection helper extraction (advisory; eviction is already
centralized in _evict_stale_image_blocks so no drift; ~8-line duplication; no-overengineering);
rename _RUN_SHELL_DEFAULT_TIMEOUT_SEC (cosmetic); vlm_query message wording (cosmetic, no test breaks);
symlink-deny (confirmed safe: resolve()-then-contain). Version bump (6.40.1) happens at MERGE.
Tests: 275 focused tests green (vision, multimodal, shell, safety-policy invariant, tool_capabilities,
devtools, iteration-2).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Structural, additive, default-on fixes derived from a forensic analysis of three
benchmark runs (SWE-bench-Pro, SWE-Pro, Terminal-bench). The coding quality was
already high; the score drag was a handful of real-usage defects. Each fix is a
meta-solution per BIBLE (P2 meta-over-patch, P5 LLM-first, P7 minimalism), not a
per-bug prompt crutch.
T1 — honest task-acceptance review:
- `outcome_tier` + `completion_coach` are now REQUIRED reviewer JSON keys (the
best_effort completion-coach branch was dead because models ignored the prose).
- EVIDENCE-INDEPENDENCE and ENVIRONMENT-vs-DELIVERABLE reviewer directives (pure
LLM judgment, no regex on test paths).
- Host-forced `required` review is LABEL-ONLY: it records the verdict/tier on the
objective axis but no longer injects the review into the transcript or forces an
extra model round (that re-loop made the agent rewrite its deliverable into a
meta-essay and tanked metrics). `auto` stays truly auto.
- Aggregation splits parse_degraded vs actor_error so one bad slot can't drop a
clean quorum; the objective axis aggregates outcome_tier from only the
CONTRIBUTING PASS actors on a PASS run.
- The reviewer is fed a host-collected turn diff (tracked + untracked new files;
secrets redacted; any agent-supplied diff kept only under a labeled
non-independent key so EVIDENCE-INDEPENDENCE can't be steered).
T2 — path normalization for any external workspace:
- One shared `normalize_root_relative(root, path)` helper (relative string only,
never widens access) applied ONCE at the dispatch boundary so the handler and
every guard (protected-path, protected-artifact, shrink guard) resolve the same
target — closing a normalize-vs-guard desync class. Covers
search_code/list_files/query_code/read_file/write_file/edit_text.
T3 — per-call shell timeout:
- run_command/run_script accept `timeout_sec` (alias `timeout`), clamped by the
deadline and `OUROBOROS_PER_CALL_TIMEOUT_CEILING_SEC`; the outer tool-execution
timeout rises to match so long approved commands aren't cut at the static cap.
T4 — outcome-axis honesty:
- A one-shot `run_command`/`run_script` non-zero exit/shell error becomes a
non-degrading `execution.cosmetic_tool_errors` record (timeout stays blocking);
the execution axis means harness/capability health, while "did it work?" lives
on the objective/review axis. A structural `objective.warning =
residual_tool_errors_without_review` is surfaced (UI severity → warn) when
cosmetic errors exist and no review judged the objective.
T7 — core workspace.patch hygiene:
- Untracked build binaries, >5 MiB blobs, and junk artifacts are excluded and
recorded in the manifest (never silently lost); `_PATCH_EXCLUDE_RULES_VERSION`
bumped to 2.
Verification: targeted + broad isolated pytest green; Ouroboros's own triad
(gpt-5.5 + gemini-3.5-flash + opus-4.8) and scope (gpt-5.5) review converged clean
after fixing 6 review-surfaced edge cases; claudexor codex (gpt-5.5) final review.
All version carriers synced to 6.35.0.
Allow full local git inside a task workspace while deterministically blocking
any git that targets the Ouroboros self-repo/data via cwd, -C, --git-dir/
--work-tree, GIT_DIR/GIT_WORK_TREE env, positional path, or glued/newline/
backtick-separated segments. Adds segment-aware shell parsing helpers.
Light mode now permits external user deliverables through user_files, task_drive, artifact_store, process outputs, and claude_code_edit while preserving self-repo/control-plane protection.
Add auditable artifact collection, typed tool/outcome failures, task-status reconciliation, runtime docs/checklist updates, and regression coverage for light-mode artifact boundaries.
