mirror of
https://github.com/razzant/ouroboros.git
synced 2026-08-15 13:43:13 +00:00
1244fbb19d
One coherent hardening commit for the v6.57.0..v6.61.0 megasprint, produced by
the full external review loop: adversarial multimodel round 1 (Fable/Gemini/GPT,
all FIX FIRST), the real triad+scope loop (7 rounds, run_external_review.py on
the staged sprint diff), and adversarial round 2 (verdicts: SAFE TO COMMIT /
FIX-FIRST items all resolved at this tree). Squashed from seven fix-forward
commits before the single convergence push (P9 — one version, one commit;
nothing was pushed).
Security / anti-cheat:
- bytes_equal confinement: both operands clear _confine_artifact_path + the
protected-artifacts read_bytes denial; executor operands must be
workspace-relative (no absolute//.. oracle over hidden graders); mode rejected
for non-run contract kinds and for a non-empty `expected` (receipt honesty);
cmp exit >1 reads as an infra error, not byte divergence.
- attach_snapshot_init excludes credential-shaped files (sensitive SSOT shared
with workspace patch / coop checkpoint), keeps them untracked via
.git/info/exclude, and disclosed init_git_skipped rides the API response.
- api_fs_dirs checks home confinement BEFORE existence — no outside-home
existence oracle; inside-home missing paths keep their honest 404.
Q7 effort-ceiling disclosure (BIBLE P1 — never silent):
- A learned-ceiling clamp records reasoning_effort_clamped={requested, applied,
reason, model} into THAT call's usage event on all clamping lanes: the note is
set thread-locally at payload build (reset per build), popped in
_normalize_remote_response (OpenRouter + OpenAI-compatible direct) and
_normalize_anthropic_response; the GigaChat normalizer (a lane that never
clamps) does not consume it.
- OpenRouter nested carrier: extra_body.reasoning.effort rejections now
classify as parameter rejections ("reasoning" spelling), retry with ONLY the
nested reasoning key removed (provider routing survives), learn the ceiling,
and strip via an "extra_body.reasoning" sentinel in the rejected-params cache.
- Anthropic-direct maps our "minimal" to the provider floor "low";
_record_effort_ceiling floors at "low" so the lowest thinking tiers can never
poison a route to "none"; ceilings are keyed by NORMALIZED MODEL IDENTITY —
disclosed as a deliberate model-property simplification in
capability_evidence + ARCHITECTURE.
Projects/rooms integrity:
- POST /api/projects: 409 project_exists for an existing id with a requested
source (checked BEFORE clone/attach side effects); source-less repeat create
is a pure idempotent lookup that preserves provenance/clone_url/trusted_at;
creation broadcasts projects_changed like its update/delete siblings.
- Non-git attach refused on BOTH surfaces before registry mutation (gateway 400
attach_requires_git unless init_git; promote path typed PROJECT_SOURCE_ERROR)
— task admission requires a git worktree root, so no born-dead project rooms.
- a git-URL source for an already-bound project id conflicts BEFORE the clone
side effect (no dangling clone behind a refusal, r7); the direct-Anthropic
rejection path is pinned by a 400-then-200 test and the classifier knows the
strict pydantic "not permitted" wording.
- promote_chat_to_task(source=...) without project_id/name derives the id from
the source name and registers the project (the documented one-liner never
silently skips registration); re-sourcing a project whose folder differs is
refused (mirrors the 409); same-folder re-attach is idempotent.
Release/tree hygiene and honesty:
- MagicMock test artifact logs/events.jsonl removed; repo-root /logs/ gitignored
(anchored); suites verified to leave the tree clean.
- SYSTEM.md subagent-yield line reworded (the line-wrapped marker phrase evaded
the plain substring pin); both pinning tests assert whitespace-normalized.
- README Version History back under the P9 patch-row cap (6.53.4 rolled off).
- plan_task JSON schema requires [plan, goal] only — context_level stays
host-enforced (explicit for self_mod, defaults minimal otherwise).
- Contract mirrors: UiPreferencesResponse.project_hidden, FsDirsResponse.
truncated (+ picker note), Project*/FsDirs* TypedDicts exported; ARCHITECTURE
gains the update/delete/fs-dirs endpoint rows, the OUROBOROS_REVIEW_MAX_TOKENS
env row, and the current effort-scale wording; EFFORT_OPTIONS documents the
deliberate owner-facing subset (minimal is per-call tactical).
- Answer chip mirrors the runtime extractor exactly (leading whitespace, LAST
marker authoritative, removal by index); chat parent card task_done meta shows
own cost + children rollup; Safety skip counter labels its recent-events
window; OUROBOROS_SAFETY_MODE excluded from the generic settings POST
(owner-only keys travel via their audited endpoints).
- New OUROBOROS_REVIEW_MAX_TOKENS knob (floor 8192, never above the 65536
default): shrinks only the reviewer RESPONSE reservation so a mega-diff's full
input pack fits reviewer endpoint caps — evidence is never trimmed, reviewer
models never change.
Tests: full suite green on the final tree; new regressions for every fix above
(confinement/traversal/black-box/executor-relative, clamp disclosure unit +
Anthropic payload + remote-lane pop-once, ceiling floor + phantom-ceiling +
nested-carrier retry/learn/strip, projects 409/provenance/derived-pid/conflict/
attach-requires-git, fs/dirs no-oracle, cmp infra-exit, review budget knob).
ruff F clean.
|
||
|---|---|---|
| .. | ||
| ARCHITECTURE.md | ||
| CHECKLISTS.md | ||
| CREATING_SKILLS.md | ||
| DEPLOYMENT.md | ||
| DEVELOPMENT.md | ||