Pin the advisory/blocking enforcement decision to the owner with an
item-agnostic behavioral invariant in the frozen contract suite, so the agent
cannot hardcode findings to always-block. Restores the touched-file pack to
loud-fail on oversize (no silent functional-file omission) and adds a
standalone real triad+scope dry-run script.
Owner-approved big release (plan: большой_релиз_v6.26.0). Workstreams:
- WS-A lint gate: ruff F-rules step in CI quick-test; fixed the real F823
NameError class (supervisor/events.py utc_now_iso shadowing); make lint/health.
- WS-B memory integrity: atomic dialogue_blocks with corrupt-quarantine
(.corrupt-<ts>.bak + memory_store_corrupt event); honest scratchpad journal
(block_append_failed, corrupt storage renders as corruption not "(empty)");
full Pattern Register window (16K cap vs 3K cut); merge-aware scratchpad
consolidation under the sidecar lock; backlog writes through locked helpers;
chat omission notes ("[N older unconsolidated messages omitted]").
- WS-C provider SSOT: provider registry (prefixes/credentials/resolution) in
provider_models.py replacing 5 duplicated knowledge sites; credential-aware
consolidation model; pricing empty-fetch retry; direct-route correctness
(o-series max_completion_tokens, reasoning_effort, Anthropic error bodies,
per-request timeouts on cached clients); deep/plan review budgets reserve
output headroom inside the 1M window (min(SSOT, window − output − margin)).
- WS-D races/state: utils.update_json_locked (locked RMW, loud TimeoutError);
task_results merge under per-file lock (cancel-latch safe); update_state
migration for owner binding, evolution counters, budget_line, post-task
activation; queue-lock coverage (enqueue, timeouts, worker health, task_done,
snapshot); visible supervisor death (supervisor_error + owner notice + ghost
consciousness/chat-agent cleanup on re-init); chat.jsonl rotation via
os.replace under the append lock; unbounded _outbox removed; host-service
port probe + actual-port panic sweep; skill lifecycle lane deadline
(OUROBOROS_SKILL_LIFECYCLE_TIMEOUT_SEC, dedupe-leak-safe); consilium
force-plan structured flag (plan_review_aggregate from the FULL result);
atomic writers (update-intent, repo-manifest, metrics cache, post-task pair);
review_state.save_state raises on lock timeout (advisory ledger honesty);
apply_pending_request no-ops while a campaign is active;
api_update_apply kills workers only AFTER update validation, with respawn
on aborted checkout and "interrupted" terminal status.
- WS-E immune hardening: triad anti-refusal coverage contract (empty array
needs NO_FINDINGS sentinel or bare-[] body; refusal prose with [] is
parse_failure and never enters quorum); BIBLE P3 "Owner-chosen enforcement,
loud advisory" bound + CHECKLISTS sync; every advisory pass-through of a
blocking signal writes review_advisory_override + persistent
advisory_overrides (surfaced by review_status); ToolEntry.mutates_worktree
with dispatcher-level before/after worktree diff invalidation (covers error
paths; read-only runs no longer invalidate; redundant manual calls removed);
scope review fails closed without its checklist; advisory final write is a
locked re-read merge; synthesis severity defaults to critical with WARNING
fallbacks; find removed from SAFE_SHELL_COMMANDS; anti-thrashing state
survives advisory criticals; preflight env scrubs secret-class variables;
.git/index.lock age gate in worker startup checks.
- WS-F security: file-browser symlink containment on the RESOLVED path across
all endpoints (out-of-root symlink targets are listed but inert; tests
rewritten to the new contract deliberately); HMAC-signed session cookies
(server-side persisted key, 30-day TTL, Secure on TLS) replacing the
permanent password-derived cookie; password-class settings mask to a
constant placeholder; conservative SSRF guard for the MAIN agent (link-local
/cloud-metadata only, LAN stays reachable, per-request route re-validation);
ClawHub zip-slip hardening (":"/backslash segments rejected + post-join
containment) and lazy no-proxy OuroborosHub opener; single-execution
signature dispatch for extension handlers (no TypeError re-run after side
effects); onboarding postMessage origin checks; SHA256-pinned
python-standalone download with pipefail; payload-resident dependency
fingerprints only corroborate durable deps.json; skill payload re-hash
immediately before spawn (TOCTOU narrowing).
- WS-G process custody: ouroboros/process_custody.py — spawn_supervised
chokepoint + durable data/state/process_ledger.jsonl (pid, pgid,
fingerprint{start_time, cmd_sha256}, purpose, scope task|session|daemon,
owner_task, session_id); platform_layer.process_start_time primitive;
startup + periodic reaper killing ONLY strict-fingerprint matches from dead
generations/tasks (never by command-line class); migrations: services
(the orphan hole), workspace executor + local model + extension companions
(ledger write-through), worker_pids (write-through; legacy path retained);
parent lifelines (ppid watchdog, group-suicide only as group leader) in
worker_main, extension runner, Claude readonly child; conformance test
pinning the Popen allowlist; ARCHITECTURE/DEVELOPMENT/CHECKLISTS entries.
- WS-H native multimodal chat: supports_vision capability map (static
prefixes + OpenRouter /models input_modalities overlay); web chat uploads
ride the WS frame as structured attachments (additive ChatInbound field)
and image uploads become NATIVE image blocks via the existing Path B;
browser screenshots inject natively for vision models via the multipart
user-merge (tool result stays a string; file persisted under
data/uploads/screenshots for re-view); K=3 newest-image eviction with
caption placeholders carrying the vlm_query re-view path; image-aware token
estimates (fixed ~1.1K-token equivalent instead of base64 length, fixing
permanent emergency-compaction wedges); compaction renders images as
captions (no base64 into the summarizer); GigaChat/local lanes emit explicit
"[image omitted: model has no vision]"; internal _caption/_source_path
metadata stripped from provider payloads.
- WS-I housekeeping (partial): SETTLED_STATUSES SSOT (+ cycle-safe mirror pin);
owner_inject.py renamed to owner_mailbox.py; version-neutral envelope
wording; files.py import-block cleanup. Remaining WS-I/WS-J/WS-K items are
deferred with the owner's context-budget priority on review+release.
Review notes: triad+scope ran via scripts/run_external_review.py on the core
pack across 3 rounds to convergence (scope responded=PASS each round; round-2
criticals fixed: update_apply kill-order + respawn, lifecycle dedupe leak on
lane timeout, OUROBOROS_MAX_ROUNDS hot-reload + docs, toggle_evolution
NameError, async Anthropic timeout forwarding, supports_vision local check,
budget-update lock visibility, ChatInbound additive attachment contract,
file-browser doc sync). The FULL combined diff exceeds every triad model's
context window (~1.59M tokens > 1.05M) — reviewed in packs; remaining
cross-pack findings were verified as slicing artifacts. Adversarial critics
(GPT; Gemini/Opus rounds) ran on the working tree. Deliberate tradeoffs:
metadata-based eviction captions (no light-LLM call in the hot path);
worker ledger records use live-cmdline fingerprints with a synthetic-arg
fallback only where the OS offers no cmdline.
Introduce a derived code-intelligence layer with a read-only query tool, ripgrep-backed search, and clearer post-task self-improvement controls so Ouroboros can navigate larger codebases without regex-heavy guesswork.
Make headless Google Colab a first-class Ouroboros runtime controlled entirely
over Telegram, and treat reviewed transport/control skills as full replacements
for the local UI.
- Colab source-mode bootstrap: mounts Drive for persistent data/, role-based
remotes (managed=official, origin=personal fork), merges existing Drive
settings on re-run, and installs+enables the Telegram bridge in full_access
over the loopback gateway.
- Role-based GitHub remotes with auto-fork personal origin while preserving the
official managed update remote; a clone-default official origin is reclassified
as managed (never an origin conflict) and configure_personal_remote guarantees
managed exists before repointing origin.
- Transport/control-skill doctrine: a reviewed + token-bound + enabled +
owner-granted + owner-bound chat/control skill is a first-class control surface;
review judges actual safety properties, not breadth of control (CHECKLISTS,
CREATING_SKILLS, ARCHITECTURE).
- Owner-external slash TOFU so a real Telegram owner is authorized without ever
locking out the local web owner; external /review targets the requesting chat.
- Adaptive LLM request-parameter normalization (OpenRouter no longer drops Opus
on unsupported sampling params).
- official_hub review profile downgrades severity-driven hygiene/bug findings to
warnings for hash-verified official OuroborosHub payloads (re-verified via the
local sidecar on reload); trust-boundary items and deterministic gates stay
fail-closed. Deterministic preflight failures persist+aggregate to PENDING
(non-executable under every enforcement mode, surviving reload).
- Reviewed-skill auto-grants default on; rescue snapshots recoverable via real
git refs; ff-only restore of personal-origin self-mods across Colab sessions.
Structurally closes the subagent worker-crash, ghost-task, and stuck-spinner
classes across all platforms, makes Ouroboros usable with any single provider
key, and ships node-runtime skill support.
- Workers: macOS/Windows use spawn (Linux keeps fork); central OUROBOROS_IN_WORKER
no-proxy policy removes the macOS _scproxy fork SIGSEGV class. Signal crashes are
terminal (no retry) for all task types.
- Lifecycle: monotonic write_task_result guard (terminal/cancel sticky); live
cancel_task + cancel_requested latch; terminal task_done on every crash/kill/
timeout/cancel path; snapshot restore skips terminal; schedule fail-fast when the
worker pool is disabled. No ghosts, no perpetual spinner (incl. reconnect reconcile).
- Subagent UI: Variant A parent dashboard (in-place rows, child progress/terminal
routed to parent, no duplicate child card).
- Providers: Cloud.ru is a first-class exclusive-direct provider (review/scope
fallback + static pricing). New-user defaults: review claude-opus-4.8, Claude Code
opus[1m]; existing anthropic-only migrate 4.6->4.8.
- Skills: skill_preflight tolerates missing/killed validators; build bundles a
signed Node.js LTS (resolve_bundled_node) for node --check and node runtimes.
- Docs: README OuroborosHub badge/callout; ARCHITECTURE bundled-node + defaults.
Reviewed via multi-model adversarial (2 rounds) + Ouroboros triad/scope review
(converged). Local suite: 3207 passed, 1 skipped.
Consolidate repeated gateway, review, skill lifecycle, marketplace, memory/context, release, and web UI paths while preserving public API shapes, review gates, and runtime contracts.
Verification: python3 -m pytest tests -q --tb=short; external triad review PASS with scope review skipped only for context budget advisory.
Layered on top of rc.5..rc.7 catch-up reduction line. Preserves the
rc.7 prompt-injection fix in renderSkillRepairPrompt (web/modules/utils.js)
and the rc.6 docs/accounting cleanup. Adds the Quality, DX & Closed-loop
Skills wave from the user-approved finish plan:
- runtime_mode=light reframed as a minimal compatibility/self-modification
guard. Path-aware shell filter (_light_shell_repo_mutation): blocks
simple writer commands (cp, mv, rm, sed, sort -o, uniq, ...) only when
their target resolves inside the Ouroboros checkout, blocks shell-
wrapped writes via 'sh -c' / 'bash -c', blocks mutative direct git
through run_shell, and otherwise lets ordinary python/node/bash
diagnostics run. Removed the heavy Python AST scanner + script-content
scan that was over-blocking legitimate work.
- Chat scroll fixes: ResizeObserver re-attach, near-bottom threshold,
Playwright smoke now asserts scrollTop ~ scrollHeight after send.
- Recent-chat dedup: read_jsonl_tail_after_offset honours
dialogue_meta.last_consolidated_offset; provenance-aware via a chat
log generation signature (first_line_sha256 + size) so log rotation
cannot silently drop entries.
- Stable WORLD.md injected into context.build_memory_sections.
- plan_task and the commit triad accept duplicate model IDs as valid
reviewer slots (single-provider stochastic sampling); _get_review_models
no longer pads 2-slot configs to 3.
- Settings: OUROBOROS_AUTO_GRANT_REVIEWED_SKILLS owner-confirmed via the
desktop launcher bridge (request_auto_grant_reviewed_skills_change),
hot-read from settings.json so toggle changes take effect without
restart, /api/settings POST drops the key. Consistent truthy parsing
on JS + launcher sides.
- skill_review.py runs an optional fail-open Claude Code advisory over
the skill payload only (include_repo_diff=False), and injects its
output as inert evidence BEFORE the authoritative output contract.
- skill_exec emits skill_exec_finished / skill_exec_failed events;
worker enqueues them on ctx.event_queue, supervisor.events dispatches
them to logs/events.jsonl + the live log + the in-process event bus
for skill.lifecycle subscriptions. host_service_api allows manifest-
declared skill.lifecycle subscriptions without an extra grant.
- run_shell auto-rewrites grep "A\|B" argv-mode to grep -E "A|B" with
SHELL_REGEX_AUTO_CORRECTED prefix; explicit -E/-G/-P/-F still pass
through. SAFE_SHELL_COMMANDS no longer includes sort/uniq.
- Extension loader hardening: load_extension(drive_root=...) is
mandatory (no silent ~/Ouroboros/data fallback), TestClient lifespan
+ settings hot-reload pin to app.state.drive_root, _sweep_stale_-
extension_imports preserves the live import root via a keep-list,
fixture cleanup uses unload_extension. Adds clean_extension_runtime_-
state superset helper and tests for cleanup, drive_root requirement,
and live-root preservation.
- Test pollution: scripts/cleanup_test_pollution.py (dry-run-first
utility), tests/_shared._make_safe_mock_ctx for advisory-workflow
ctxs, _make_safe_mock_ctx adoption in test_advisory_workflow*.
- PluginAPI v1.2: PLUGIN_API_VERSION bumped, skill_job_dir added to
the frozen Protocol + the contract test.
- docs/ARCHITECTURE.md, docs/CHECKLISTS.md, docs/CREATING_SKILLS.md,
prompts/SYSTEM.md updated for new behavior (light-mode wording,
cleanup script, skill.lifecycle topic, advisory pre-review path,
duplicate reviewer slots, auto-grant settings + permissions wording).
VERSION 5.15.0-rc.8 / pyproject.toml 5.15.0rc8 / README badge + Version
History row + ARCHITECTURE.md header all in sync.
Two related fixes that close a same-process privilege-escalation path
demonstrated by the agent in a video-gen skill task and unblock the
natural light-mode workflow at the same time.
Q1 — light allows skills (Frame A): removes runtime_mode == "light"
blocks at ouroboros/tools/skill_exec.py::_handle_skill_exec, the
extension-tool dispatch in ouroboros/tools/registry.py::ToolRegistry.execute
and the runtime_mode_light short-circuit in
ouroboros/extension_loader.py::_extension_runtime_state /
load_extension. Skills already pass tri-model review_skill PASS +
enabled.json toggle + content-hash freshness + sandboxed subprocess
+ FORBIDDEN_SKILL_SETTINGS denylist; gating execution by runtime_mode
only denied owner-approved capabilities.
Q2 — elevation ratchet (multi-layer):
1. ouroboros/config.py::save_settings(allow_elevation=False) chokepoint
compares incoming OUROBOROS_RUNTIME_MODE against a boot-time
baseline (_BOOT_RUNTIME_MODE pinned by initialize_runtime_mode_baseline
from server.py::lifespan). The baseline is exported to
OUROBOROS_BOOT_RUNTIME_MODE env var so subprocesses (run_shell,
skill_exec, mp.spawn workers) inherit the pin via env. Once any
baseline source is available, allow_elevation=True becomes inert.
2. ouroboros/tools/core.py::_data_write blocks writes whose
Path.samefile resolves to SETTINGS_PATH (handles macOS APFS /
Windows NTFS case-insensitive bypass via parent-resolve +
name.lower() fallback).
3. server.py::_merge_settings_payload skips OUROBOROS_RUNTIME_MODE
from /api/settings POST body. api_settings_post adds belt-and-braces
revert. web/modules/settings.js no longer sends the key; the
Behavior tab segmented control becomes display-only with disabled
buttons + tooltip explaining the manual procedure.
4. ouroboros/tools/registry.py::_run_shell_safety_check runs two
substring filters on every run_shell invocation:
- Argv-level _detect_runtime_mode_elevation (conjunctive: BOTH
save_settings AND OUROBOROS_RUNTIME_MODE, OR the dotted path
ouroboros.config.save_settings) fires in ALL modes; the
module-level _LIGHT_MUTATION_INDICATORS (extended with
.write_text(, .write_bytes(, os.replace(, os.rename() fires only
in light.
- File-content scan (iter-3 fix for the file-based subprocess
bypass): _extract_script_file_args walks past interpreter flags
and resolves the script file argument; if it lives inside
repo_dir or drive_root, _scan_script_files reads up to 256 KB
and re-runs the same indicators on the content. Closes the
deterministic 2-step chain data_write helper.py + run_shell
python helper.py that previously poisoned settings.json directly.
5. ouroboros/file_browser_api.py guards api_files_write / delete /
transfer / upload via _is_owner_only_settings_file (samefile-aware).
6. supervisor/workers.py::worker_main calls
initialize_runtime_mode_baseline so spawn-method workers re-pin
from inherited env.
7. ouroboros/tools/registry.py extension dispatch now goes through
ouroboros.safety.check_safety (extracted to _dispatch_extension_tool
helper).
8. prompts/SAFETY.md gains a DANGEROUS clause naming the runtime_mode
self-elevation channels.
Tests: 2705 passed, 0 failed (added 47 new tests in
tests/test_runtime_mode_elevation.py covering chokepoint, downgrade,
data_write block with case-mismatch + symlink + env override, API
drop, set_tool_timeout regression, onboarding flow, boot-baseline
post-pin inert, env-var subprocess propagation, file-content scan
across all modes + light pathlib.write_text + benign-script
false-positive negative + interpreter parser unit tests; conftest.py
autouse fixture resets baseline between tests).
Pre-release went through two cycles of multi-model adversarial review
(Gemini + GPT + Opus critics) plus two cycles of the actual triad+scope
reviewer pipeline. Phase B (move owner settings outside drive_root
for OS-level containment) and the Privilege Boundary section in
prompts/SYSTEM.md are deferred per the minimal_safety profile and
recorded in data/memory/knowledge/improvement-backlog.md.
External review tool: scripts/run_external_review.py invokes
ouroboros.tools.parallel_review.run_parallel_review on the staged
diff with FULL raw triad+scope output (no truncation).
Note on changelog rolloff: the v4.42.1 patch entry was rolled off in
this release to respect the P7 5-patch-row cap. Its full body remains
at git tag v4.42.1.
Closes the re-audit cycle. Six non-committing advisory+triad+scope
cycles converged with 0 open findings before this commit.
Extension runtime:
- extension_loader.py stages each load under data/state/skills/<name>/__extension_imports/<uuid>/skill/
to defeat Python module caching on rapid in-place edits; fail-closed if
any symlink in the skill tree resolves outside the reviewed checkout.
- extensions_api.api_extension_manifest reports live-SSOT load_error,
not the stale discovery copy, so index and manifest agree.
- tools/registry.list_non_core_tools() now merges live ext.* tools.
Release / packaging guards (BIBLE.md P7):
- scripts/build_repo_bundle.py fail-closed if no release tag is resolved,
verifies the tag is annotated (git cat-file -t == tag), and that it
points at HEAD.
- build.sh / build_linux.sh / build_windows.ps1 enforce the same three
checks before invoking PyInstaller. Synthetic/fake tags no longer
accepted.
- _validate_source_branch no longer treats an ls-remote-only branch as
usable; requires local ref availability, symmetric with
_ensure_source_sha_tracks_branch.
- release_sync._normalize_pep440 now collapses alpha->a and beta->b per
PEP 440 canonical pre-release spelling.
Onboarding preservation:
- Wizard no longer silently wipes OPENAI_BASE_URL, OPENAI_COMPATIBLE_*,
CLOUDRU_FOUNDATION_MODELS_BASE_URL on re-run. The wizard only resets
keys it actually exposes.
Docs and prompts sync:
- ARCHITECTURE.md describes the bundle-bootstrap model, the
__extension_imports/ staging surface, the build-script release tag
prerequisite, the extension HTTP review endpoint, and
VALID_EXTENSION_ROUTE_METHODS as part of the frozen contract.
- BIBLE.md + prompts/SYSTEM.md release invariant now distinguishes
author-facing spelling (VERSION / README / tag / ARCHITECTURE) from
the PEP 440 canonical form required by pyproject.toml.
- prompts/SYSTEM.md Immutable Safety Files list matches
SAFETY_CRITICAL_PATHS exactly (BIBLE.md included).
- docs/CHECKLISTS.md row 1 explains the author-facing vs PEP 440 split.
Runtime SSOT:
- server.py::_run_supervisor feeds workers.init the manifest-driven
branch names from _runtime_branch_defaults() instead of hardcoded
ouroboros / ouroboros-stable.
- contracts/skill_manifest.py accepts body-only instruction-skill
markdown that starts with a --- thematic break.
Regression coverage added for every real fix above across
test_extension_loader, test_extensions_api, test_build_scripts,
test_build_repo_bundle, test_launcher_sync, test_onboarding_wizard,
test_packaging_sync, test_release_sync, test_contracts, plus a new
test_release_workflow guard for the CI release path.
VERSION carriers synchronized:
- VERSION = 4.50.0-rc.3 (author-facing)
- pyproject.toml = 4.50.0rc3 (PEP 440 canonical)
- README.md badge + Version History row = 4.50.0-rc.3
- docs/ARCHITECTURE.md header = 4.50.0-rc.3
Branch `ouroboros` was seeded from an `.app` bundle snapshot
(`6700358 Initial commit from app bundle`), not from `main`, so the
release pipeline (build scripts, PyInstaller spec, launcher runtime,
vendored Python framework, CI workflow) never landed on this branch.
Import those files verbatim from `origin/main` (76bf13c) so a tagged
push can trigger the existing tag-driven release pipeline.
Imported verbatim from `origin/main`:
- .github/workflows/ci.yml Three-tier CI (push -> quick
tests, stable/tag -> full matrix,
v* tag -> build + GitHub Release
with `prerelease: contains(...,
-rc|-alpha|-beta)`).
- build.sh / build_linux.sh / PyInstaller + Playwright Chromium
build_windows.ps1 / Dockerfile bundling for each target (the four
files `tests/test_build_scripts.py`
assertively requires).
- Ouroboros.spec PyInstaller entry spec.
- entitlements.plist macOS codesign entitlements.
- launcher.py Native launcher that bootstraps
the embedded python-standalone
interpreter and runs the agent as
a subprocess.
- scripts/download_python_standalone.sh / .ps1 / pyi_rth_pythonnet.py
- Python, Python.framework/ Vendored macOS launcher-side
Python 3.10 framework.
- certifi/, jsonschema/, Marker + data files consumed by
jsonschema_specifications/ the runtime-loaded agent deps.
Adapted for Phase 1-6:
- Ouroboros.spec datas now contains ('skills', 'skills') so the
bundled Phase 5 weather reference skill under `skills/weather/`
actually ships inside the .app / .exe / tarball. Without this the
Skills page on a packaged build would show "no skills discovered"
even with the bundled reference in source. Docstring updated to
document the new bundled payload.
Verification:
- `pytest tests/test_build_scripts.py tests/test_release_sync.py`
passes locally (47 asserts; all Playwright + PyInstaller ordering
invariants + release-sync carrier logic hold after the import).
- `python -c "import ast; ast.parse(open('Ouroboros.spec').read())"`
parses.
Not imported from main (intentional):
- `.pytest-tmp-run`, pytest-cache dirs, and other transient files.
- No existing file was overwritten by the checkout; the import is
purely additive on top of the Phase 1-6 tree.
