diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 0cef942..7a028f1 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -1,3 +1,18 @@ +# Current source acceptance — 2026-10-13 + +B-159's named SEO source gaps are closed by accepted SEO main1e86edf and its +complete gate; [closure evidence](evidence/runs/2026-10-13-fw01-referral-closure.md) +preserves every original row and the limits. This owner scanner correction +merged atb332a92 through [normal checks](evidence/runs/2026-10-13-fw01-discovery/normal-integration.json). +Published package0.28.2 bytes remain unchanged; source-test acceptance does not +claim new installed behavior. + +Next: coordinator integrates this docs-only reconciliation after peer and +genuine checks, then continues the existing native/runtime and family-wave +prerequisites. Earlier entries below are dated history, not current instructions. + +--- + # FW01 source discovery correction — 2026-10-13 The [source packet and receipt](evidence/runs/2026-10-13-fw01-discovery/README.md) diff --git a/docs/evidence/backlog.md b/docs/evidence/backlog.md index 036e6e1..59bcb24 100644 --- a/docs/evidence/backlog.md +++ b/docs/evidence/backlog.md @@ -46,7 +46,7 @@ row per line, appended, so two runs closing two rows do not land on the same lin | B-158 | **The residue-ledger check misses an aliased temp-dir call.** `TEMP_MAKERS` (`test/validate.py`) excludes every dotted receiver but `tempfile.`, so `import tempfile as tf; tf.mkdtemp()` and `from tempfile import mkdtemp as m` pass. make-skill 0.31.0 ported this check and closed the gap there (any receiver, renamed from-imports refused, two negative controls); port that back. No current file here uses an alias. | make-skill W4-B seam reading, 2026-10-12 | 1 | 0 | 1 | **1** | **closed in v0.27.1 (2026-10-12)** — `TEMP_MAKERS` is make-skill 0.31.0's pattern (any single receiver, one-line renaming from-import refused); the alias and renamed-import negative controls in `test/validate.py` were watched failing on the old pattern (`B-158 self-test: a temp-dir call through a module alias (\`tf.\`) was not found`, `… a renamed from-import of a temp-dir maker was not found`), then passed. Evidence: verification.md, v0.27.1 | | AG-06a | **A temp tree created outside `test/` is still invisible.** `check_temp_trees_go_through_the_residue_ledger` reads this repository's own suite. A tree made by anything else — a script under `plugins/`, a future helper outside `test/` — is not accounted for, and `residue.report()` counts only what `workspace()` handed out. The mechanism catches a *reviewed* bypass; it does not observe `$TMPDIR`. Observing it would mean a run claiming ownership of directories it cannot prove it made, which is the reaping mistake `agent-sync` refuses by design. | AG-06 port, 2026-08-20; plan R28 of the hub's 2026-10-11 integration waves | 1 | 0 | 1 | **1** | **closed in v0.27.1 (2026-10-12)** for the static half: the check now reads every `*.py` the repository ships or runs (`test/` recursively, `plugins/`, `bin/`) with exact-path, exact-count, reasoned exemptions (`test/residue.py` 1, `agent-harness/scripts/audit_agent.py` 2). Its first run refused a real bypass, `test/audit_regressions/instruction_budget.py` line 21, now `residue.workspace()`. Plants: an aliased maker in a plugin script, a renamed from-import under `bin/`, a third maker in `audit_agent.py` — each refused by file and line. What stays true: the check reads source, it does not observe `$TMPDIR`; that half stays with AG-06b's content fingerprint. Evidence: verification.md, v0.27.1 | | AG-06b | **The 2592 existing trees are reported and left alone.** `find "$TMPDIR" -maxdepth 4 -type f -path '*/copy/sub/b.sh' \| wc -l` → **2592** on 2026-08-20, of which **16 were added by this run's own verification** — one run of the leaking fixture before the port, and one of the v0.12.0 archive's copy of it. They are plain `tmpXXXXXXXX` and indistinguishable from every other program's, so they are named rather than swept. The identical fixture still leaks in **`seo-aeo-audit`**, which another agent holds; referred, not edited. | AG-06 port, 2026-08-20; plan R28 of the hub's 2026-10-11 integration waves | 2 | 0 | 1 | **2** | **closed in v0.27.1 (2026-10-12)** — the trees ARE identifiable by content, so they are reapable without claiming another program's directory: `python3 test/residue.py --reap-own` (dry run by default, `--apply` to remove) claims only an `mkdtemp()`-named, non-symlink child of the temp root holding exactly one of the fixture's five end-state file sets and its directory set byte for byte, plus optionally its own manifest, unchanged for 24 h; root, age floor and the removal window hardened after the PR #45 reading (verification.md, v0.27.1). `test/reap_own_test.py` 6/6 in a sandbox temp root; a planted permissive reaper (any tree holding `sub/b.sh`) was refused: `near-misses were claimed as own: ['tmpextrab01', 'tmpextraf01']`. Real `$TMPDIR`, dry, 2026-10-12: `0 tree(s) match`; the `find` count is 0 — the 2592 trees are already gone, and both leaking suites (`agent-stack`, `seo-aeo-audit`) now use `residue.workspace()`. Nothing in the real `$TMPDIR` was deleted | -| B-159 | **`seo-aeo-audit` still has the AG-06a/B-158 hole.** Its temp-tree check reads less than the whole repository and misses aliased calls, and `test/negatives.py:195` makes a bare `tempfile.mkdtemp(prefix="tp-negatives-snap-")` outside any residue ledger (read on its `origin/main`, 2026-10-12). Port agent-stack 0.27.1's whole-repository scan, any-receiver pattern and exact-shape exemptions there, and route that snapshot through the ledger. | agent-stack PR #45 blind reading, 2026-10-12 | 1 | 0 | 1 | **1** | **partial, open** — snapshot ledger fixed in SEO; whole-repository source guard still missing at reviewed cut. See [FW00 evidence](runs/2026-10-13-fw00-referrals.md). | +| B-159 | **`seo-aeo-audit` still has the AG-06a/B-158 hole.** Its temp-tree check reads less than the whole repository and misses aliased calls, and `test/negatives.py:195` makes a bare `tempfile.mkdtemp(prefix="tp-negatives-snap-")` outside any residue ledger (read on its `origin/main`, 2026-10-12). Port agent-stack 0.27.1's whole-repository scan, any-receiver pattern and exact-shape exemptions there, and route that snapshot through the ledger. | agent-stack PR #45 blind reading, 2026-10-12 | 1 | 0 | 1 | **1** | **closed 2026-10-13, bounded source** — both snapshot accounting and whole-repository source guard accepted in SEO main1e86edf after its complete gate and genuine PR checks. [Owner evidence and scope](runs/2026-10-13-fw01-referral-closure.md); dynamic/race completeness and installed behavior are not claimed. | | B-160 | **make-skill's temp-tree check reads `test/` only.** make-skill 0.31.0 has the any-receiver pattern but walks `test/` alone, so a maker in a shipped script is invisible there exactly as AG-06a described here. Port agent-stack 0.27.1's whole-repository scan with exact-path, exact-count, exact-shape exemptions back to make-skill. | agent-stack PR #45 blind reading, 2026-10-12 | 1 | 0 | 1 | **1** | **closed 2026-10-13, bounded source scope** — make-skill whole-repository guard accepted; [FW00 evidence](runs/2026-10-13-fw00-referrals.md) and verification ledger. Runtime/language limits retained. | | B-161 | **The owner validator accepted duplicate declarations and a disabled release ancestry check.** Eight real-validator plants passed on cb8f699; the same seam also hid an even-backslash Markdown pipe in AG-06b. | hub R30, 2026-10-13 | 2 | 0 | 1 | **2** | **closed, source/publication scope** — PR47/PR48 integrated, v0.27.2 published with44 exact payload files. [Release receipt](runs/2026-10-13-release-0.27.2.md#published-readback); family pin/install remains separate. [Packet](runs/2026-10-13-r30-owner-gates.md) | diff --git a/docs/evidence/runs/2026-10-13-fw01-discovery/README.md b/docs/evidence/runs/2026-10-13-fw01-discovery/README.md index d8bee7e..e09d19e 100644 --- a/docs/evidence/runs/2026-10-13-fw01-discovery/README.md +++ b/docs/evidence/runs/2026-10-13-fw01-discovery/README.md @@ -77,3 +77,12 @@ No provider, native-host or model behavior was exercised. Next: commit this documentation freeze, promote the existing draft PR once, and require genuine eligible PR jobs before normal integration. Hosted checks and merge remain pending; no release or installed update is needed for this excluded source. + +## Normal integration observed + +[Eligible checks and merge receipt](normal-integration.json) records all genuine +PR jobs succeeding at the frozen head, followed by normal squash integration at +[b332a92](https://github.com/ssheleg/agent-stack/commit/b332a92e62417d615543c6398f7a01f6d85663bf). +The complete accepted Git tree equals the checked candidate tree. This follow-up +receipt is a documentation-only branch update; the accepted source above is the +pin target. No tag, registry publication or installed runtime update was performed. diff --git a/docs/evidence/runs/2026-10-13-fw01-discovery/normal-integration.json b/docs/evidence/runs/2026-10-13-fw01-discovery/normal-integration.json new file mode 100644 index 0000000..ee23e58 --- /dev/null +++ b/docs/evidence/runs/2026-10-13-fw01-discovery/normal-integration.json @@ -0,0 +1,47 @@ +{ + "repo": "ssheleg/agent-stack", + "number": 54, + "head": "5b167788a64f4ed5885403ccc63737c0ababe2e0", + "observed": { + "headRefOid": "5b167788a64f4ed5885403ccc63737c0ababe2e0", + "mergeCommit": { + "oid": "b332a92e62417d615543c6398f7a01f6d85663bf" + }, + "state": "MERGED", + "statusCheckRollup": [ + { + "__typename": "CheckRun", + "completedAt": "2026-10-13T11:10:44Z", + "conclusion": "SUCCESS", + "detailsUrl": "https://github.com/ssheleg/agent-stack/actions/runs/38388336640/job/115265568115", + "name": "validate", + "startedAt": "2026-10-13T11:10:03Z", + "status": "COMPLETED", + "workflowName": "validate" + }, + { + "__typename": "CheckRun", + "completedAt": "2026-10-13T11:10:13Z", + "conclusion": "SUCCESS", + "detailsUrl": "https://github.com/ssheleg/agent-stack/actions/runs/38388336640/job/115265567881", + "name": "House skill audit", + "startedAt": "2026-10-13T11:10:04Z", + "status": "COMPLETED", + "workflowName": "validate" + } + ], + "url": "https://github.com/ssheleg/agent-stack/pull/54" + }, + "merge_attempt": { + "exit": 0, + "stdout": "", + "stderr": "" + }, + "done": true, + "outcome": "MERGED", + "candidate_tree": "8b7d95d4b2a9b8a27d498b4be0ae1e1a9564610f", + "accepted_merge_tree": "8b7d95d4b2a9b8a27d498b4be0ae1e1a9564610f", + "tree_equal": true, + "release_required": false, + "reason": "Only excluded owner test/docs source changed; payload parity retained." +} diff --git a/docs/evidence/runs/2026-10-13-fw01-referral-closure.json b/docs/evidence/runs/2026-10-13-fw01-referral-closure.json new file mode 100644 index 0000000..fcb8d82 --- /dev/null +++ b/docs/evidence/runs/2026-10-13-fw01-referral-closure.json @@ -0,0 +1,193 @@ +{ + "base": "b332a92e62417d615543c6398f7a01f6d85663bf", + "original_issue_cells_unchanged": true, + "changed_status_only": "B-159", + "packaged_files_equal_base": 44, + "files": [ + { + "path": "CHANGELOG.md", + "sha256": "0fce6df83bb875438bbcd2dd1609665ae19348284405c1b2c7b075514a375e7e" + }, + { + "path": "LICENSE", + "sha256": "826df230e15df9b208c1e08c42ef3b764b21c4abec5a91a38976748e92a82e9d" + }, + { + "path": "README.md", + "sha256": "49953599fcd54dfcba0f1254636ddd46fca0e0ac6c141091bf72552c53131f3e" + }, + { + "path": "SECURITY.md", + "sha256": "87715bb85d820beb6179cf5294fc7ed461cb234657df810031c0eb527fb00b62" + }, + { + "path": "bin/agent-stack.js", + "sha256": "5706481b1f1266174eeefebc1f2fc5ff6f30f77b395289490b182e95d5c97b00" + }, + { + "path": "package.json", + "sha256": "42cbab0ed2a00d1bc950ada5688221b8d291bf82f1a681df6e3994935066ceed" + }, + { + "path": "plugins/agent-stack/.claude-plugin/plugin.json", + "sha256": "678aa34cceef4ff51bedad7f718baa901af911fdf33afd9bf22b091ac1461a3f" + }, + { + "path": "plugins/agent-stack/skills/agent-evals/references/multi-agent.md", + "sha256": "e0c3175aa8858de1ba8117c613d2e201e32ff581453078c927a3ebddcff6c0bb" + }, + { + "path": "plugins/agent-stack/skills/agent-evals/references/otel-genai.md", + "sha256": "d2cadad0a6a0632d234a51621b136f3001f5a7422e256f84d261d7c0ff1660d5" + }, + { + "path": "plugins/agent-stack/skills/agent-evals/references/statistics.md", + "sha256": "77cd03cc4f258a097888f81b817e8c9487b4d777d9ac092f76fe48de8de692ca" + }, + { + "path": "plugins/agent-stack/skills/agent-evals/SKILL.md", + "sha256": "8f533ce3e320e0416163a39a98207cd347a0d22332c4072afa1d628f77204b8b" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/audit.md", + "sha256": "b91b966250438edd91b87c392113404d830b06301518d9120246321c88d9a1aa" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/context-lifecycle.md", + "sha256": "f682b0d4894f7f58baf4f39e622ed1bf8bc773d3c76c552a09aecab4c1e23fef" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/instruction-budget.md", + "sha256": "3962dbe1643ca1f867575786597cfeea93a28b1d0cc940811020e2d4b49fc6a6" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/layers.md", + "sha256": "e2f4fd73424b0896c493616dbb98e7bd973eaad3b8365b3c1b31964fbac46d89" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/pi-sdk.md", + "sha256": "b7eb9375934887ed5f85e597e80c5f3d83c02c37cd585aff13960104a31ddcd5" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/pi.md", + "sha256": "684616062c9d109ff13eed83a5b9a10544040f1ee22790ee70e8d8156b286c08" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/system-prompt.md", + "sha256": "f8577ebfeb8ae7448b36b5cd7fcca1ef4ab7065d1aef9baf6f7946eb5ea2905a" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/techniques.md", + "sha256": "4198c8d2d8a0d6da2f8ba7f2370310578167819abbb9bd351a722491ee8f31e8" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/tools.md", + "sha256": "572822bc05a710019fc5454f2ddb3750537dbf3667fc73fad0c8bcdcd0f1346a" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/references/workbench-contracts.md", + "sha256": "a17af9cc84dcc8661085ebb606b09ac08ebe39f6c1fc436ab547ac21747bca80" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/scripts/audit_agent.py", + "sha256": "f0193565dd3851d3ea779a05f018099b9f2bca3eccacc370b9a43048baba656a" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/scripts/instruction_budget.py", + "sha256": "0f88ff1764cc5a87a2b523126c871e71af750bc29128e05b97f9e6955db999ab" + }, + { + "path": "plugins/agent-stack/skills/agent-harness/SKILL.md", + "sha256": "003866190df99a02ea862860050c03c2ce8971479ced5ba75bfe42057a0ba4e0" + }, + { + "path": "plugins/agent-stack/skills/agent-interop/references/a2a.md", + "sha256": "e39c4c6d1f19b39e09720c40a09a50e8f2a59824aeb83c5336443f8b709a6c34" + }, + { + "path": "plugins/agent-stack/skills/agent-interop/references/gateway.md", + "sha256": "e74e8585eb6a1fba08af5b419a67c41f38689a29886a89dc149ef3465b9319a0" + }, + { + "path": "plugins/agent-stack/skills/agent-interop/references/mcp-scale.md", + "sha256": "c69b0bfd73e189776fcc6ecdd7d3e88964073ab19a66ffcf79aab579b341a892" + }, + { + "path": "plugins/agent-stack/skills/agent-interop/references/mcp-ship.md", + "sha256": "2918ca0beed94ca7f7e34bb30e2609495c421121d3a94a0e43e743fc76b644a2" + }, + { + "path": "plugins/agent-stack/skills/agent-interop/references/mcp.md", + "sha256": "9b427194659408ae7f521ea689b8b23cbfd216f918f313cc961dce360b7e80b4" + }, + { + "path": "plugins/agent-stack/skills/agent-interop/references/registry.md", + "sha256": "648e7649369b9aa5dac5f424c9a4373292e5d73c90d9466b58171934e5c7b51f" + }, + { + "path": "plugins/agent-stack/skills/agent-interop/SKILL.md", + "sha256": "3e70a38f204edc6822814335dc6dfc4e8c3b825117137239da46b96fdd60bfec" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/context-engineering.md", + "sha256": "57811d800b75f25a5a242505e8e6be2b33775fb156893ebec51af5ea18fcfc1e" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/governance.md", + "sha256": "bb2e3389779a56d4ace610bb14b5df05ace7fa6efc1e5810b0ae929f7050e435" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/graph-engineering.md", + "sha256": "c594d1b0a4813f0d47e60a26e2b7905a964c3017556a400fcbd534f390811e70" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/kv-cache.md", + "sha256": "b8ae7c5ba9531ebb02ded2e403a8fcb4ae2b944940076a4f15f966d05f6caeae" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/llm-proxy-billing.md", + "sha256": "84c2144d6a5a917c042c5e31ecfacfe6238c60870da567abc00bd770e3bccccd" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/memory-architecture.md", + "sha256": "860466e4e54d0116063146401c3df54a25bbf07cdfba18b63d0fb0e06a285f1a" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/memory-landscape.md", + "sha256": "b297b121ebb07c50579f929f0e5361598625b024dbf49653b82e12b1dc0b4f4d" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/memory-lifecycle.md", + "sha256": "6c7252553bc6308e6f5ec88bb802a62e4bacd98f7946ec5b2e82fef8c1aa0073" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/patterns.md", + "sha256": "a239bc4549339b049b54b154f88536bed68256ffffdcdc4a0f41cf7185eeb360" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/pipeline.md", + "sha256": "89f160068715136c6f7793b305f78371831ebef9527cdb481e15b5af9a1af40b" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/provider-lifecycle.md", + "sha256": "d9b4462baf1c805daf05612d7ee8556ac5e666f72de62609666f1ee469294de3" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/references/runtime.md", + "sha256": "4c49fe64e16256fd78529e4a557782c5ccd9be8af8a5703bb92a773bdea12d70" + }, + { + "path": "plugins/agent-stack/skills/agent-orchestrator/SKILL.md", + "sha256": "8a80583133707ea69c9e7c0963a68f74b138b74e5148e31ceeea12097af32aba" + } + ], + "npm_test": { + "exit_code": 0, + "log_sha256": "e151183ca4b3a420a4d87d9b1390ea8de5e771067daa46eae90575aed852a97a" + }, + "limits": "Docs-only reconciliation; scanner guarantees remain bounded and installed behavior unchanged.", + "board_rows_unchanged": 29, + "expanded_board_ids_unchanged": 31, + "board_conservation_method": "Use actual member_gates.cells/label; locate unique eight-column primary header from owner validator, compare each primary row in order, expand grouped first-cell identifiers and preserve umbrella namespace; every row identical except B-159 final status cell.", + "peer_correction": "Original17 counted only a subset; independent review found29 primary rows and31 expanded IDs. Original receipt remains in prior commit." +} diff --git a/docs/evidence/runs/2026-10-13-fw01-referral-closure.md b/docs/evidence/runs/2026-10-13-fw01-referral-closure.md new file mode 100644 index 0000000..b066f9c --- /dev/null +++ b/docs/evidence/runs/2026-10-13-fw01-referral-closure.md @@ -0,0 +1,25 @@ +# FW01 referring board closure + +Source-first packet. Owner base b332a92e62417d615543c6398f7a01f6d85663bf; +the operator requested lossless board reconciliation after accepted fixes. +B-159 still says SEO lacks the whole-repository source guard, although +[SEO PR40](https://github.com/ssheleg/seo-aeo-audit/pull/40) now normally merged +at1e86edf178f0445ad2bace5fbbf79013de43f605. + +[SEO source and complete local gate](https://github.com/ssheleg/seo-aeo-audit/blob/1e86edf178f0445ad2bace5fbbf79013de43f605/docs/evidence/runs/2026-10-13-fw01-source-guard/README.md) +retain the actual ordinary/alias/exemption and unreadable-directory controls, +all11 focused groups and the complete npm run test:all result. The earlier +[snapshot-ledger owner receipt](https://github.com/ssheleg/seo-aeo-audit/blob/1e86edf178f0445ad2bace5fbbf79013de43f605/docs/evidence/runs/2026-10-13-fw01-snapshot.md) +owns the other part of B-159. + +Plan: close only B-159's two named source gaps with these accepted owner links; +retain original wording and every board ID. Advance the current HANDOFF while +preserving earlier sections as dated history. Integrate the already published +branch-only normal scanner receipt. No source, package, version, workflow or +installed behavior changes. + +Acceptance: exact old/new board-ID set and original B-159 issue wording match; +only its status changes. All44 packaged file bytes remain identical to the +accepted base. Run owner npm test and independent bounded peer before genuine +frozen-PR checks and normal integration. No arbitrary dynamic-call or race-proof +scanner completeness claim; this closes the specified tested source contracts.