From 8154c2d51e4f9049805aa752dc32d20f49b69c23 Mon Sep 17 00:00:00 2001 From: Lu Nelson Date: Wed, 5 Aug 2026 14:29:39 +0200 Subject: [PATCH 1/2] FE-1317: Close host-landing oracle identity Include every behavior-bearing PTY input in the immutable oracle pack and pin per-input hash sensitivity so retained comparisons cannot reuse a stale identity. Co-authored-by: Cursor --- docs/archive/PLAN_HISTORY.md | 6 +++ memory/PLAN.md | 20 +-------- src/dev/execution-comparison-operator.ts | 2 + .../operator-oracle-dispatch.test.ts | 44 +++++++++++++++++++ 4 files changed, 53 insertions(+), 19 deletions(-) diff --git a/docs/archive/PLAN_HISTORY.md b/docs/archive/PLAN_HISTORY.md index 180ce7266..cf6891004 100644 --- a/docs/archive/PLAN_HISTORY.md +++ b/docs/archive/PLAN_HISTORY.md @@ -3,6 +3,12 @@ This file is the active POC-line plan archive for `memory/PLAN.md`. Legacy pre-`next` history was moved out of the live docs tree with the old archived implementation. +## 2026-08-05 FE-1317 host-landing oracle identity closeout + +`host-landing-oracle-identity` ([FE-1317](https://linear.app/hash/issue/FE-1317/close-host-landing-oracle-identity-over-pty-behavior)) closed FE-1316 R13 on branch `ln/fe-1317-host-landing-oracle-identity`, stacked after FE-1316, without changing PTY-driver behavior. The compiled `brunch-host-landing-oracles-v1` implementation set now includes `tui-driver.ts`, `session.ts`, `screen.ts`, `keys.ts`, and `driver.exp`; a focused regression proves that changing each input independently changes `oraclePackSha256` while byte-identical inputs remain stable. + +The bounded hardening preserved the FE-1230 compile-time-closed oracle boundary and `src/dev/TOPOLOGY.md`'s immutable implementation-set rule. The existing non-slow controller/Git/refusal contracts and slow built-candidate public-TUI scenarios remained green; no retained comparison or outer evidence was run. + ## 2026-08-06 FE-1316 system reorientation audit closeout `system-reorientation-audit` closed a bounded six-lane review of thirteen post-cleanup concerns. It found no deleted or stranded required behavior, separated merged executor mechanisms from their still-open outer witnesses, confirmed the comparison scenario layers are distinct, and routed tracing, dual-host, theme, and KA evidence work to their existing owners. diff --git a/memory/PLAN.md b/memory/PLAN.md index 9865b97bd..893c60fc8 100644 --- a/memory/PLAN.md +++ b/memory/PLAN.md @@ -52,6 +52,7 @@ ### Recently Completed +- 2026-08-05 `host-landing-oracle-identity` (FE-1317) — **✓ complete:** the immutable host-landing oracle pack now includes all five behavior-bearing PTY inputs, with regression coverage for one-file-at-a-time hash sensitivity and identical-input stability. - 2026-08-06 `system-reorientation-audit` (FE-1316) — **✓ complete:** thirteen post-cleanup concerns received evidence-backed dispositions; one stale exchange-guidance defect was fixed, two bounded frontiers were admitted, and existing owners absorbed the remaining promoted work without creating a parallel queue. - 2026-08-05 `integrity-cleanup` (FE-1311) — **✓ complete:** the verified deletion/consolidation sweep and final five-row closure aligned the published package, probe topology, comparison public root, path-existence ownership, DB test naming, and portable repo-root Pi extension discovery without reopening falsified deletion targets. - 2026-07-22 `brownfield-comparison-cases` (FE-1241) — **✓ complete, learning-first:** frozen Brunch and Petrinaut packets, pinned-source preparation, deterministic oracles, publication-compatible attempt evidence, and portable CI are built. @@ -61,7 +62,6 @@ Older completion history and archived completed frontier definitions live in [`d ### Next - `canonical-document-reconciliation` — earned closure over the exact normative-looking drift promoted by FE-1316: demote the unadopted PLAN-replacement prescription, archive/thin the enumerated superseded design notes, and correct comparison case/profile prose. Definition below. -- `host-landing-oracle-identity` — close the immutable host-landing oracle pack over every behavior-bearing PTY input before its next comparison use. Definition below. - `saved-mission-comparison-witness` — later operator-owned frontier: FE-1215 is landed, so the remaining work is scheduling the real Brunch + Claude `/compare-specs` witness, then revising/rerunning the saved mission to prove historical snapshots remain immutable. Definition below. - `comparison-mission-isolation-hardening` — admitted from FE-1215 smoke (`TESTING_FINDINGS.md` CS2): move the private mission outside the target-reachable tree (or equivalently jail the target's file tools) so the D134-L/I67-L mission boundary is structural, not conduct-dependent. Definition below. - `shared-session-host-tracer` — prove the one-host TUI attachment seam that FE-1200 deliberately left open. Definition below. @@ -109,20 +109,6 @@ Legacy link target; see Horizon. - **Depends on:** FE-1316 disposition audit. - **Traceability:** AGENTS.md §topology files; `docs/praxis/ln-skills.md` canonical-state ownership; D98-L, D110-L, D116-L, D132-L–D134-L. -### host-landing-oracle-identity - -- **Name:** Close host-landing oracle identity over PTY behavior -- **Linear:** unassigned — create at pickup in Frontend / brunch. -- **Branch:** tbd at pickup; stack after FE-1316 independently of the docs closure. -- **Kind:** bounded verification hardening. -- **Certainty:** earned. -- **Objective:** make the immutable host-landing oracle-pack hash change for every behavior-bearing `tui-driver` input. -- **Closes:** FE-1316 R13's concrete identity gap; it does not redesign or split the PTY driver. -- **Acceptance:** the compiled host-landing implementation set includes `tui-driver.ts`, `session.ts`, `screen.ts`, `keys.ts`, and `driver.exp`; changing any one changes `oraclePackSha256`; identical inputs produce a stable hash. -- **Verification:** focused oracle-pack identity regression plus current host-landing oracle contract tests. -- **Depends on:** FE-1316 disposition audit; must land before the next retained host-landing comparison attempt or any claim that its current oracle identity covers PTY behavior. -- **Traceability:** FE-1230 execution-comparison oracle boundary; `src/dev/TOPOLOGY.md`; `src/dev/execution-comparison-operator.ts`. - ### walkthrough-remediation-2 - **Name:** Walkthrough chapter closure — remediation, evidence, and design follow-through (absorbs FE-1167) @@ -237,10 +223,6 @@ next: dependency_satisfied: FE-1316 disposition audit closes: FE-1316 R06 | R07 | R12 classification: buildable-now earned docs closure - host-landing-oracle-identity - dependency_satisfied: FE-1316 disposition audit - closes: FE-1316 R13 - blocks: next retained host-landing comparison attempt saved-mission-comparison-witness gated_by: operator availability depends_on: landed FE-1215 workflow diff --git a/src/dev/execution-comparison-operator.ts b/src/dev/execution-comparison-operator.ts index 81810166e..5fc41d705 100644 --- a/src/dev/execution-comparison-operator.ts +++ b/src/dev/execution-comparison-operator.ts @@ -81,6 +81,8 @@ const COMPILED_ORACLES: Readonly> = { fileURLToPath(new URL('./tui-driver.ts', import.meta.url)), fileURLToPath(new URL('./tui-driver/session.ts', import.meta.url)), fileURLToPath(new URL('./tui-driver/screen.ts', import.meta.url)), + fileURLToPath(new URL('./tui-driver/keys.ts', import.meta.url)), + fileURLToPath(new URL('./tui-driver/driver.exp', import.meta.url)), ], run: async ({ appDir }) => await runBrunchHostLandingOracle({ candidateRoot: appDir }), }, diff --git a/src/dev/execution-comparison/__tests__/operator-oracle-dispatch.test.ts b/src/dev/execution-comparison/__tests__/operator-oracle-dispatch.test.ts index c854e3f33..ae6b8098e 100644 --- a/src/dev/execution-comparison/__tests__/operator-oracle-dispatch.test.ts +++ b/src/dev/execution-comparison/__tests__/operator-oracle-dispatch.test.ts @@ -15,6 +15,16 @@ import { loadControllerOraclePack } from '../oracle-pack.js'; const petrinautCaseDir = fileURLToPath( new URL('../../../../testing/execution-comparisons/cases/petrinaut-optimization/', import.meta.url), ); +const hostLandingCaseDir = fileURLToPath( + new URL('../../../../testing/execution-comparisons/cases/brunch-host-landing/', import.meta.url), +); +const hostLandingPtyInputNames = [ + 'tui-driver.ts', + 'session.ts', + 'screen.ts', + 'keys.ts', + 'driver.exp', +] as const; describe('execution comparison compiled oracle dispatch', () => { it('keeps shared framing neutral across browser and backend delivery contracts', () => { @@ -134,6 +144,40 @@ describe('execution comparison compiled oracle dispatch', () => { expect(rivalPack.packSha256).not.toBe(knownPack.packSha256); }); + + it('content-addresses every behavior-bearing host-landing PTY input independently', async () => { + const oracle = resolveCompiledExecutionOracle('brunch-host-landing-oracles-v1'); + const ptyInputs = oracle.implementationFiles.filter((path) => + hostLandingPtyInputNames.some((name) => path.endsWith(name)), + ); + expect(ptyInputs.map((path) => path.split('/').at(-1))).toEqual(hostLandingPtyInputNames); + + const [knownPack, identicalPack] = await Promise.all([ + loadControllerOraclePack({ + caseDir: hostLandingCaseDir, + implementationFiles: oracle.implementationFiles, + }), + loadControllerOraclePack({ + caseDir: hostLandingCaseDir, + implementationFiles: oracle.implementationFiles, + }), + ]); + expect(identicalPack.packSha256).toBe(knownPack.packSha256); + + for (const inputPath of ptyInputs) { + const root = await mkdtemp(join(tmpdir(), 'brunch-host-landing-pty-rival-')); + const rivalPath = join(root, inputPath.split('/').at(-1) ?? ''); + await writeFile(rivalPath, Buffer.concat([await readFile(inputPath), Buffer.from('\n')])); + const rivalPack = await loadControllerOraclePack({ + caseDir: hostLandingCaseDir, + implementationFiles: oracle.implementationFiles.map((path) => + path === inputPath ? rivalPath : path, + ), + }); + + expect(rivalPack.packSha256, inputPath).not.toBe(knownPack.packSha256); + } + }); }); function snapshot() { From c69463b0df747eb425864d3819d07a7a46eb2e7c Mon Sep 17 00:00:00 2001 From: Lu Nelson Date: Wed, 5 Aug 2026 15:02:22 +0200 Subject: [PATCH 2/2] Fix environment-sensitive full-gate tests Keep deterministic Tier-2 boots isolated from ambient provider credentials and make provenance fixtures independent of global Git signing configuration. Co-authored-by: Cursor --- src/dev/__tests__/tier-2-harness.test.ts | 32 +++++++++++++----------- src/dev/comparison-provenance.test.ts | 2 +- src/dev/tier-2-harness.ts | 11 +++++--- 3 files changed, 26 insertions(+), 19 deletions(-) diff --git a/src/dev/__tests__/tier-2-harness.test.ts b/src/dev/__tests__/tier-2-harness.test.ts index d7ce5ac9a..22e350ef9 100644 --- a/src/dev/__tests__/tier-2-harness.test.ts +++ b/src/dev/__tests__/tier-2-harness.test.ts @@ -6,7 +6,7 @@ import { readFile } from 'node:fs/promises'; -import { describe, expect, it } from 'vitest'; +import { describe, expect, it, vi } from 'vitest'; import { openWorkspaceGraphRuntime } from '../../graph/index.js'; import { assistantMessage, userMessage } from '../../probes/test-helpers.js'; @@ -211,21 +211,25 @@ describe('origination-kick-live — the product originates the opening turn on i }); it('a boot with no available model does not kick (content boots stay deterministic)', async () => { - const boot = await bootTier2RuntimeThroughRunBrunchTui({ dev: false }); + vi.stubEnv('ANTHROPIC_API_KEY', 'ambient-key-must-not-enable-tier-2-models'); try { - // No auth/provider in this boot — the model-availability guard must keep - // the trigger silent rather than firing a turn that errors at startup. - await new Promise((resolve) => setTimeout(resolve, 100)); - const entries = boot.runtime.session.sessionManager.getBranch(); - expect(customEntries(entries, 'brunch.kick')).toHaveLength(0); - // The synthetic present_* pair includes a sentinel-provenance assistant - // toolCall; "no kick turn ran" means no provider-produced assistant message. - expect( - messagesByRole(entries, 'assistant').filter((message) => message.provider !== 'brunch'), - ).toHaveLength(0); + const boot = await bootTier2RuntimeThroughRunBrunchTui({ dev: false }); + try { + // Ambient provider credentials must not turn this deterministic content boot into a live turn. + await new Promise((resolve) => setTimeout(resolve, 100)); + const entries = boot.runtime.session.sessionManager.getBranch(); + expect(customEntries(entries, 'brunch.kick')).toHaveLength(0); + // The synthetic present_* pair includes a sentinel-provenance assistant + // toolCall; "no kick turn ran" means no provider-produced assistant message. + expect( + messagesByRole(entries, 'assistant').filter((message) => message.provider !== 'brunch'), + ).toHaveLength(0); + } finally { + await boot.runtime.dispose(); + boot.restoreEnv(); + } } finally { - await boot.runtime.dispose(); - boot.restoreEnv(); + vi.unstubAllEnvs(); } }); diff --git a/src/dev/comparison-provenance.test.ts b/src/dev/comparison-provenance.test.ts index 6e285f7cb..545548ddb 100644 --- a/src/dev/comparison-provenance.test.ts +++ b/src/dev/comparison-provenance.test.ts @@ -174,7 +174,7 @@ async function createControllerRepository(input: { readonly tag?: string } = {}) await git(root, ['config', 'user.email', 'comparison@example.test']); await git(root, ['add', 'package.json']); await git(root, ['commit', '-m', 'fixture']); - if (input.tag !== undefined) await git(root, ['tag', input.tag]); + if (input.tag !== undefined) await git(root, ['tag', '--no-sign', input.tag]); return { root, commitSha: await git(root, ['rev-parse', 'HEAD']), diff --git a/src/dev/tier-2-harness.ts b/src/dev/tier-2-harness.ts index 5f47653d5..c5aa87f46 100644 --- a/src/dev/tier-2-harness.ts +++ b/src/dev/tier-2-harness.ts @@ -297,11 +297,14 @@ export async function withTier2FauxAgentServices( } async function createNoModelAgentServices(): Promise { + const modelRuntime = await ModelRuntime.create({ + credentials: new InMemoryCredentialStore(), + modelsPath: null, + }); + modelRuntime.getAvailable = async () => []; + modelRuntime.getAvailableSnapshot = () => []; return { - modelRuntime: await ModelRuntime.create({ - credentials: new InMemoryCredentialStore(), - modelsPath: null, - }), + modelRuntime, }; }