Skip to content

feat(rrsi): prepare governed Fable/Codex harness evolution and implementation work order - #436

Closed
rhein1 wants to merge 9 commits into
mainfrom
work/rrsi-codex-implementation-20260929
Closed

rhein1 wants to merge 9 commits into
mainfrom
work/rrsi-codex-implementation-20260929

Conversation

@rhein1

@rhein1 rhein1 commented Sep 29, 2026 •

Copy link
Copy Markdown
Collaborator

Add the source-only Agoragentic RRSI Domain adapter for Fable-5/Codex harness improvement. Strict experiment packets bind source, evaluator, model, policy, edit and budget identities. Synthetic replay keeps a fixed denominator, preserves missing/unknown cost, rejects duplicated evidence and blocks safety violations. The actual upstream Domain ABI is pinned to google-research/rrsi@be50316.

Run/smoke/acceptance remain fail-closed. History artifacts are proposals, not Memory writes, installed changes or promotion authority. Worktrees are not treated as execution isolation. The implementation work order remains agent-os/harness-evolution/rrsi/CODEX_IMPLEMENTATION.md; follow-up host-accounting and reviewed-Memory contracts are in #448, with source/evaluator work in rhein1/fable5-codex#26.

Current head 557a66f includes #446's shared dependency, Windows audit and reviewed inventory-hold repairs. Local validation against the exact upstream source passes 36/36 tests with zero skips. Machine-surface/count checks, n8n's clean audit and its eight tests also pass. Hosted checks on 557a66f: 52 successful, 0 pending, 0 failed at this update. Required independent approval remains outstanding.

This prepares source interfaces; it does not run RRSI search, call paid models, install Fable, ingest user Memory, activate OpenShell or promote a candidate. Actual host authority/accounting, representative private evaluation, isolated trials and owner-bound promotion/rollback remain separate qualification work.

The shared hosted MCP repair updates its actual lock and embedded fast-uri implementation to 3.1.8, refreshes ip-address to 10.7.3, and regenerates integrity records and notices. A regression now rejects a lock that disagrees with the advertised, installed and attested dependency. All 16 hosted artifact tests, source/artifact verification, packaging and zero-vulnerability audits pass locally. The bundle remains private and publication-disabled.

…entation packet

Add dependency-free offline contracts, synthetic replay, inert upstream Domain
adapter, source pins, 36 tests, cross-platform CI, and staged Codex work order.
No model execution, provider activation, installed-skill promotion, or deployment.
@@ -0,0 +1,325 @@
import copy
import hashlib

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT))
from domain.contract import ContractError, compile_packet, data, digest, history_proposal, replay

rhein1 commented Sep 29, 2026

Copy link
Copy Markdown
Collaborator Author

Final implementation handoff and verified checks

Codex owner task: rhein1/fable5-codex#24

Head remains 268e230c71e85858313e5e9a00c7038b53092cea. All 20 committed file contents match the locally authored/tested package: the 18-file RRSI subtree matches Git tree 692404b951350e3a02c9c69bc8e969bc25c5538b, and the parent README and workflow blob hashes match individually.

Passing

Merge blocker: MCP dependency audit

Validate Machine Surfaces failed in Validate MCP package, not in the new RRSI workflow. I read the failed job log: all 58 MCP tests passed, then npm audit --audit-level=moderate exited 1 for ip-address <=10.5.0, reporting GHSA-rpw4-54j3-4h4q and GHSA-2vr4-cq9g-pvrc. No MCP files/dependencies were changed in this PR.

Failure evidence: https://github.com/rhein1/agoragentic-integrations/actions/runs/36540438800/job/109314291315

Codex should verify the dependency path and compatible remediation in a separately scoped change, rerun the package audit/tests/packed-install checks, and then run the entire validation pipeline. Do not suppress the audit or assume later checks passed: schema, integration counts, rename-preflight and other downstream steps were skipped after this failure. This comment is not a claim that the dependency's application-level exploitability has been assessed.

The source-only preparation is ready for Codex to continue through issue #24, but this draft PR is not merge-ready. No live search, paid model run, installed Fable mutation, authenticated Memory ingestion, qualified OpenShell runtime, promotion, release or deployment was performed.

@rhein1
rhein1 marked this pull request as ready for review October 1, 2026 23:36
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 1, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-01T23:43:43.995536Z c5c10ab Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c5c10ab455

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread risk-fork-hosted-mcp/dist/runtime/index.mjs
@rhein1 rhein1 closed this Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants