diff --git a/README.md b/README.md index 992f829..23cc69a 100644 --- a/README.md +++ b/README.md @@ -72,7 +72,7 @@ See [source ownership](docs/factory-definition.md) and [contributing](CONTRIBUTI | Step | Status and next work | | --- | --- | | Method and distribution | v0.1.23 completed the transition through #98, reconciling #85, #92 and #94. This export clarifies scoped project-service connections in Foundation. | -| Factory Lab | Notion/GitHub read and refusal checks and the Skills API export were run on 27 October; GitHub writes still need proof. A separate T3 v0.1.2 preflight observed lead skill loading and was held. Credential handling, workers and a complete task remain unqualified. [Native isolation #32](https://github.com/arcitai/factory/issues/32) and [host adoption #34](https://github.com/arcitai/factory/issues/34) remain open. | +| Factory Lab | Operator checks verified scoped Notion/GitHub access and the Skills API export on 27 October. The scoped GitHub connection also completed [PR #100](https://github.com/arcitai/factory/pull/100) and the 0.1.24 release. A separate T3 v0.1.2 preflight observed lead skill loading and was held. Provider credential handling, GitHub-token revocation and write-refusal checks, workers and one complete native task remain unqualified. [Native isolation #32](https://github.com/arcitai/factory/issues/32) and [host adoption #34](https://github.com/arcitai/factory/issues/34) remain open. | | Improvement | Later: [same-session comparisons #50](https://github.com/arcitai/factory/issues/50), [ZeroShot-style loops #97](https://github.com/arcitai/factory/issues/97), and [review quality #99](https://github.com/arcitai/factory/issues/99). Automations, reviewer defaults and update ownership remain open choices. | | Other factories | Adopt the reviewed method project by project through Foundation, after the Lab path works. | diff --git a/docs/qualification.md b/docs/qualification.md index 471157d..ed2b449 100644 --- a/docs/qualification.md +++ b/docs/qualification.md @@ -9,7 +9,7 @@ remain with the installation; public issues track the remaining acceptance work. | Boundary | Observed evidence | Limit / next check | | --- | --- | --- | -| Scoped connections and Foundation clarification (0.1.24 candidate) | 2026-10-27: the Lab's read-only Notion internal connection read its selected root and skills database (200), was refused on a known excluded private page (404), and could not write to a disposable canary (403). The native Skills API downloaded nine skills with eleven supporting files; those supporting files matched v0.1.23 at that observation. Native Notion SKILL.md formatting is recorded as a distinct snapshot. A new fine-grained GitHub token selects only Factory, with contents/issues/PR write and Actions/status/metadata read; repository/issue/CI reads succeeded, an existing private repository outside the grant returned 404 and secrets listing 403. Operator readback confirmed that main requires a PR with zero mandatory human approvals, enforces admins, and requires strict Method checks from GitHub Actions. The scoped token could not read these protection settings. Foundation's Notion original now names connection scope, credential ownership/storage, expiry/revocation, actual refusals and inherited-credential holds; its GitHub reference is deliberately exported here. Opus 5.5 High reviewed the source and three synthetic decisions, requested repairs, then accepted the repaired method text | Scope tests were native API/CLI checks. A separate T3 v0.1.2 environment observed native discovery/loading of the three selected lead skills; that preflight was held, not a completed pilot. Credential handling, separate worker execution, immutable reviewer input and the full delivery path still require qualification. Shared-host maintenance holds and other projects remain unchanged; no unattended backlog, native write/merge, revocation of the GitHub token or general isolation claim follows from these reads | +| Scoped connections and Foundation clarification (0.1.24) | 2026-10-27: the Lab's read-only Notion internal connection read its selected root and skills database (200), was refused on a known excluded private page (404), and could not write to a disposable canary (403). The native Skills API downloaded nine skills with eleven supporting files; those supporting files matched v0.1.23 at that observation. Native Notion SKILL.md formatting is recorded as a distinct snapshot. A new fine-grained GitHub token selects only Factory, with contents/issues/PR write and Actions/status/metadata read; repository/issue/CI reads succeeded, an existing private repository outside the grant returned 404 and secrets listing 403. Operator readback confirmed that main requires a PR with zero mandatory human approvals, enforces admins, and requires strict Method checks from GitHub Actions. The scoped token could not read these protection settings. Foundation's Notion original now names connection scope, credential ownership/storage, expiry/revocation, actual refusals and inherited-credential holds; its GitHub reference is deliberately exported here. Opus 5.5 High reviewed the source and three synthetic decisions, requested repairs, then accepted the repaired method text. The scoped GitHub credential subsequently completed the operator-driven push, PR #100, passing Method checks, ordinary merge and v0.1.24 publication | These are native API/CLI checks performed by the operator. A separate T3 v0.1.2 environment observed native discovery/loading of the three selected lead skills; that preflight was held, not a completed pilot. Provider credential handling, separate worker execution, immutable reviewer input and the full native AgentOps delivery path still require qualification. Shared-host maintenance holds and other projects remain unchanged. This does not qualify unattended backlog, GitHub-token revocation, refusal of direct-main or workflow writes, or general isolation | | Notion-led method and reconciled distribution (0.1.23 candidate) | 2026-10-26: #98 integrates the source work in #85, #92 and #94; the public guide owns the architecture and shared authoring edition, with complete portable core exports and an unchanged versioned YAML 0.2 snapshot. Existing-project alignment uses Foundation adoption. Source checks and independent final review are recorded in #98 | This is a source transition. The scoped Notion connection, native Skills API directory export/discovery, worker loading/access boundaries and one real Factory Lab task remain unqualified. Reviewer count, automations and update ownership remain open. No host, other project, installed method or existing hold is changed | | Package | Portable skills (nine from 0.1.20, with `factory-entry`; eight before), metadata/link checks and staging tests | Mechanical checks do not establish agent decisions | | OSM prerelease provenance (0.1.22 candidate) | 2026-10-23: the lead read the public GitHub API without authentication. The canonical repository is [onlinesourdough/OSM-plugin](https://github.com/onlinesourdough/OSM-plugin). [PR #80](https://github.com/onlinesourdough/OSM-plugin/pull/80) is merged, and [v0.30.0](https://github.com/onlinesourdough/OSM-plugin/releases/tag/v0.30.0) was published as a prerelease whose tag is that merge commit (`314dcf17`). Package CI passed on the PR's head commit. The tagged source declares 22 shared skills, and Codex and Claude select `osm@online-sourdough`. The lead also checked the pinned installation and migration documents against their Git blobs. The migration guide now names the canonical repository and this prerelease, links the pinned documents, and orders the cutover: install the new selector, disable the old active source before fresh-session acceptance, and retire the disabled registration only afterwards. Source candidate only | This is public metadata, not use. It is a prerelease, not stable. CI ran on the PR head, not on the tag commit. No Factory host or caller was observed adopting it, and none was authorized to; a peer's reported native use and a separate preview pull request were not verified or selected here. Working AIOS 0.29 calls stay on each host until that host qualifies its own cutover. OSM #62, #77 and #76 remain open with their owners. Package checks and independent review of this candidate are pending |