chore(orb): bump manifest target version to 0.4.1 - #5075
Merged
Conversation
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
JSONbored
added a commit
that referenced
this pull request
Jul 11, 2026
…ing loop's handoff signal (#2337) (#5054) * chore(orb): bump manifest target version to 0.4.1 (#5075) orb-v0.4.0 was cut stable earlier today (2026-07-11), but the manifest was never bumped afterward, so orb-beta-release's due-check correctly refused to cut another 0.4.0-suffixed beta -- blocking the automated beta channel for every feat/fix merged since, including #5071/#5072. * feat(miner-governor): propagate the kill-switch into shouldSubmit (submission-gate.ts) #2339's own deliverable: the manage-phase submission-gate function must check the kill-switch/dry-run state as its FIRST guard, before any other logic -- flipping the kill-switch must halt any pending submission-gate check immediately, the same way it already halts the Governor chokepoint (#2340). killSwitchScope is a new REQUIRED field on SubmissionGateCandidate (not optional-with-a-permissive-default) so a caller cannot forget to resolve and pass it. Reuses isMinerKillSwitchActive (kill-switch.ts, #2341) directly -- the single shared helper #2339 asks for, not a bespoke wrapper -- rather than duplicating the check; the sibling loop-reentry-policy.ts change (next commit) consults the identical function. * feat(miner-governor): propagate the kill-switch into shouldReenter (loop-reentry-policy.ts) The sibling half of #2339's own deliverable: the manage-phase loop- reentry function must ALSO check the kill-switch/dry-run state as its FIRST guard, before any other logic. killSwitchScope is a new REQUIRED field on LoopReentryCandidate, checked via the identical isMinerKillSwitchActive helper submission-gate.ts's shouldSubmit now consults (the "single shared helper, not duplicated per call site" this issue asks for) -- not a bespoke wrapper. Threads killSwitchScope through packages/gittensory-miner/lib/loop- reentry.js's attemptLoopReentry (validated fail-closed alongside its existing repoFullName/outcome checks) and into the audit event payload for traceability. * feat(miner-governor): wire the gated-submission trigger into the driving loop's handoff signal Adds evaluateHarnessSubmissionTrigger (packages/gittensory-engine/src/ miner/harness-submission-trigger.ts) + evaluateAndRecordHarnessSubmis sionTrigger (packages/gittensory-miner/lib/harness-submission- trigger.js): connects shouldSubmit (#2336) to the actual driving loop's own handoff signal -- iterate-loop.ts's (#2333) HandoffPacket, produced the moment a real run's self-review reaches a clean predicted-gate pass. Not wired into any scheduler as part of this change, per the issue's own "manual owner sign-off on the wiring before this ships to any default-on profile" deliverable. Adds the session-level circuit breaker this issue's own deliverable calls for, distinct from shouldSubmit's per-candidate signal checks: N consecutive allow:false decisions in one session pauses the run entirely pending human review (checked FIRST, before ever consulting shouldSubmit -- once tripped, only a human clearing the session's own tally can un-trip it, unlike a per-candidate block a later, different candidate can clear on its own merits). Session-scoped rather than per-repo, matching "pauses the run entirely" -- distinct from #2338's loop-reentry circuit breaker, which is deliberately per-repo. Every decision (allow or block) is appended to the local event ledger with full reasons, whether or not the circuit breaker was involved. This does NOT build or invoke buildOpenPrSpec (src/mcp/local-write- tools.ts) -- that lives in the private root src/ tree, unreachable from this portable package for the same cross-package-boundary reason self-review-adapter.ts's slop injection exists. A real call site (root-side integration, wired in a later issue) consults this function's allow:true before it builds that spec itself. On the referenced "harness driving loop": the issue cites both the old M4-era gittensory-mcp harness adapter (#781, a different package) and this session's own submission-gate.ts. Wired to iterate-loop.ts's HandoffPacket instead, since that's the actual, current, same-wave driving loop #2336 was built to compose with. Test-covered per the issue's own explicit deliverable: a full candidate -> gate-check -> submit (or correctly-blocked) cycle, plus the circuit breaker tripping and resetting, and fail-closed validation. * feat(miner-governor): thread killSwitchScope through the harness submission trigger #2339 makes SubmissionGateCandidate.killSwitchScope required on shouldSubmit -- this is the coupling fixup: evaluateHarnessSubmission Trigger (#2337) constructs a shouldSubmit candidate internally, so it now requires and forwards killSwitchScope from its own candidate rather than duplicating the kill-switch check itself (shouldSubmit's own guard covers it whenever the session circuit breaker hasn't already short-circuited first). Also closes a real, pre-existing codecov gap discovered while verifying this: submission-gate.ts had ZERO root-vitest scenarios for its null-predictedGateVerdict, null-slopAssessment, slop-exceeds- threshold, and observe-mode-would-have-blocked/would-have-allowed paths -- it's only reachable from the root vitest suite through this file's own integration test, and that test never exercised them. Added all five; submission-gate.ts now measures 100% branch coverage via the actual codecov-visible path, not just the engine's own node:test suite. * fix(miner-governor): add missing as-never casts for deliberately-invalid deps assertions Two "fails closed on malformed candidate" assertions in miner-harness-submission-trigger.test.ts passed a HarnessSubmissionCandidateInput missing slopThreshold/mode without the as-never cast the four other deliberately- invalid-shape assertions in the same test already use, so tsc rejected them once the type was fully threaded through. No behavior change -- the runtime fail-closed assertions themselves were always correct. Also carries forward the same stacked-branch rebase reconciliation as the two branches this one is built on (rerere replayed the loop-reentry.test.ts resolution automatically).
JSONbored
added a commit
that referenced
this pull request
Jul 11, 2026
…bsystem (#2339) (#5057) * feat(miner-governor): propagate the kill-switch into shouldSubmit (submission-gate.ts) #2339's own deliverable: the manage-phase submission-gate function must check the kill-switch/dry-run state as its FIRST guard, before any other logic -- flipping the kill-switch must halt any pending submission-gate check immediately, the same way it already halts the Governor chokepoint (#2340). killSwitchScope is a new REQUIRED field on SubmissionGateCandidate (not optional-with-a-permissive-default) so a caller cannot forget to resolve and pass it. Reuses isMinerKillSwitchActive (kill-switch.ts, #2341) directly -- the single shared helper #2339 asks for, not a bespoke wrapper -- rather than duplicating the check; the sibling loop-reentry-policy.ts change (next commit) consults the identical function. * feat(miner-governor): propagate the kill-switch into shouldReenter (loop-reentry-policy.ts) The sibling half of #2339's own deliverable: the manage-phase loop- reentry function must ALSO check the kill-switch/dry-run state as its FIRST guard, before any other logic. killSwitchScope is a new REQUIRED field on LoopReentryCandidate, checked via the identical isMinerKillSwitchActive helper submission-gate.ts's shouldSubmit now consults (the "single shared helper, not duplicated per call site" this issue asks for) -- not a bespoke wrapper. Threads killSwitchScope through packages/gittensory-miner/lib/loop- reentry.js's attemptLoopReentry (validated fail-closed alongside its existing repoFullName/outcome checks) and into the audit event payload for traceability. * test(miner-governor): add root-vitest coverage for submission-gate.ts (#2339, #2336) submission-gate.ts had zero root-vitest (Codecov-visible) coverage -- only an engine-level node:test file, which Codecov cannot see. #2339's new kill-switch check (2 lines) was the first change to this file Codecov could measure, and it correctly flagged 0% patch coverage as a result. Ports the existing, already-comprehensive engine-level test suite (18 scenarios: kill-switch x3, pass/pass, fail/pass, pass/fail, both-fail, null-verdict, null-slop, both-null, observe-mode x2, isSlopBandWithinThreshold x4, barrel check) into a new root vitest file importing directly from engine source, giving 100% statement/branch/function/line coverage on the whole file, not just the newly-changed lines. Also resolves the rebase onto current main: an add/add conflict on test/unit/miner-loop-reentry.test.ts (this branch's own commit history still referenced an orphaned, pre-fix copy of the now-merged #2338 commit) and the shared build-script line conflict (package.json), both cleanly reconciled with no functional change to either. * feat(miner-governor): wire the gated-submission trigger into the driving loop's handoff signal (#2337) (#5054) * chore(orb): bump manifest target version to 0.4.1 (#5075) orb-v0.4.0 was cut stable earlier today (2026-07-11), but the manifest was never bumped afterward, so orb-beta-release's due-check correctly refused to cut another 0.4.0-suffixed beta -- blocking the automated beta channel for every feat/fix merged since, including #5071/#5072. * feat(miner-governor): propagate the kill-switch into shouldSubmit (submission-gate.ts) #2339's own deliverable: the manage-phase submission-gate function must check the kill-switch/dry-run state as its FIRST guard, before any other logic -- flipping the kill-switch must halt any pending submission-gate check immediately, the same way it already halts the Governor chokepoint (#2340). killSwitchScope is a new REQUIRED field on SubmissionGateCandidate (not optional-with-a-permissive-default) so a caller cannot forget to resolve and pass it. Reuses isMinerKillSwitchActive (kill-switch.ts, #2341) directly -- the single shared helper #2339 asks for, not a bespoke wrapper -- rather than duplicating the check; the sibling loop-reentry-policy.ts change (next commit) consults the identical function. * feat(miner-governor): propagate the kill-switch into shouldReenter (loop-reentry-policy.ts) The sibling half of #2339's own deliverable: the manage-phase loop- reentry function must ALSO check the kill-switch/dry-run state as its FIRST guard, before any other logic. killSwitchScope is a new REQUIRED field on LoopReentryCandidate, checked via the identical isMinerKillSwitchActive helper submission-gate.ts's shouldSubmit now consults (the "single shared helper, not duplicated per call site" this issue asks for) -- not a bespoke wrapper. Threads killSwitchScope through packages/gittensory-miner/lib/loop- reentry.js's attemptLoopReentry (validated fail-closed alongside its existing repoFullName/outcome checks) and into the audit event payload for traceability. * feat(miner-governor): wire the gated-submission trigger into the driving loop's handoff signal Adds evaluateHarnessSubmissionTrigger (packages/gittensory-engine/src/ miner/harness-submission-trigger.ts) + evaluateAndRecordHarnessSubmis sionTrigger (packages/gittensory-miner/lib/harness-submission- trigger.js): connects shouldSubmit (#2336) to the actual driving loop's own handoff signal -- iterate-loop.ts's (#2333) HandoffPacket, produced the moment a real run's self-review reaches a clean predicted-gate pass. Not wired into any scheduler as part of this change, per the issue's own "manual owner sign-off on the wiring before this ships to any default-on profile" deliverable. Adds the session-level circuit breaker this issue's own deliverable calls for, distinct from shouldSubmit's per-candidate signal checks: N consecutive allow:false decisions in one session pauses the run entirely pending human review (checked FIRST, before ever consulting shouldSubmit -- once tripped, only a human clearing the session's own tally can un-trip it, unlike a per-candidate block a later, different candidate can clear on its own merits). Session-scoped rather than per-repo, matching "pauses the run entirely" -- distinct from #2338's loop-reentry circuit breaker, which is deliberately per-repo. Every decision (allow or block) is appended to the local event ledger with full reasons, whether or not the circuit breaker was involved. This does NOT build or invoke buildOpenPrSpec (src/mcp/local-write- tools.ts) -- that lives in the private root src/ tree, unreachable from this portable package for the same cross-package-boundary reason self-review-adapter.ts's slop injection exists. A real call site (root-side integration, wired in a later issue) consults this function's allow:true before it builds that spec itself. On the referenced "harness driving loop": the issue cites both the old M4-era gittensory-mcp harness adapter (#781, a different package) and this session's own submission-gate.ts. Wired to iterate-loop.ts's HandoffPacket instead, since that's the actual, current, same-wave driving loop #2336 was built to compose with. Test-covered per the issue's own explicit deliverable: a full candidate -> gate-check -> submit (or correctly-blocked) cycle, plus the circuit breaker tripping and resetting, and fail-closed validation. * feat(miner-governor): thread killSwitchScope through the harness submission trigger #2339 makes SubmissionGateCandidate.killSwitchScope required on shouldSubmit -- this is the coupling fixup: evaluateHarnessSubmission Trigger (#2337) constructs a shouldSubmit candidate internally, so it now requires and forwards killSwitchScope from its own candidate rather than duplicating the kill-switch check itself (shouldSubmit's own guard covers it whenever the session circuit breaker hasn't already short-circuited first). Also closes a real, pre-existing codecov gap discovered while verifying this: submission-gate.ts had ZERO root-vitest scenarios for its null-predictedGateVerdict, null-slopAssessment, slop-exceeds- threshold, and observe-mode-would-have-blocked/would-have-allowed paths -- it's only reachable from the root vitest suite through this file's own integration test, and that test never exercised them. Added all five; submission-gate.ts now measures 100% branch coverage via the actual codecov-visible path, not just the engine's own node:test suite. * fix(miner-governor): add missing as-never casts for deliberately-invalid deps assertions Two "fails closed on malformed candidate" assertions in miner-harness-submission-trigger.test.ts passed a HarnessSubmissionCandidateInput missing slopThreshold/mode without the as-never cast the four other deliberately- invalid-shape assertions in the same test already use, so tsc rejected them once the type was fully threaded through. No behavior change -- the runtime fail-closed assertions themselves were always correct. Also carries forward the same stacked-branch rebase reconciliation as the two branches this one is built on (rerere replayed the loop-reentry.test.ts resolution automatically).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Scope
Validation
Safety