Repository navigation
Integration: one stamped live service and shadow source - #219
Merged
Merged
Conversation
…capture non-repo turns Smallest end-to-end shadow loop on master, reusing existing code (z0#15 verified learning loop, z0int#54/#62): - Bring outcome_verifier, verification_density, loop_export and claude_code_engagement (+ their tests) from integrate/claude-code-z0-stack @b6abbd2 as files, not a branch merge: that branch predates master modules (hermes_decisions, outcome_observation, ...) and merging it would delete them. - Wire `z0int outcomes` (verify/density/export/join) and `z0int loop` into the CLI. - claude_code.on_opportunity: record turns whose cwd is not a git repo with an empty state packet instead of dropping them (Hermes already does this). On a host whose sessions start outside a repo, opportunity coverage was 0%, so the credit join could never reach evolution-lab's verified_loop. - Drop two engagement tests that cover branch-only features not brought over (workspace-packet hint wiring, MCP instructions); those stay on the integrate branch. Learning stays in evolution-lab (exp/verified-loop-v0, pre-registered); this branch only produces the privacy-safe z0int.loop.training_row.v0 table. Promotion is a report for the owner; nothing is promoted automatically. Full suite: 964 passed / 11 failed; master 914 passed / 11 failed, the same 11 pre-existing live/env failures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…pter and shims (z0int#62)
Behaviour contracts for C1-loop-core, written before the implementation:
- harness_id.turn_key + the six trace-id aliases + hook-harness detection (payload/env, explicit wins,
conflict reported)
- harness_capture record family z0int.<harness>.{opportunity_record,turn_outcome,failure}.v0 for all
seven harnesses: work item / attempt ids, explicit F-case failure rows, bounded spool (P-2/P-3),
P-7 task cwd, capture-time flags, freeze bundle, no authority from confidence, privacy
- lean hook adapter: hot path, import set, subprocess wall time, stdout inertness, subagent cohort,
#62 A1 round trip, capture-only seam for every harness but claude-code
- check_class extracted from the outcome verifier; agentsview_ro read-only connection
- shims: Claude Code hooks (+ SubagentStart/SubagentStop), hooks-only Codex plugin, Grok hooks file
- regression guard: the Claude Code export equals the 6fee859 export (golden from 6fee859)
- loop_export / engagement tests updated where the spec changes the contract (harness-injected turns
land in cohort harness from a capture flag; SubagentStart is registered, capture-only)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… hook adapter (z0int#62)
- harness_id: canonical turn_key(harness, session, turn) + TRACE_ALIASES for the six trace-id
conventions (hashed ones are verified, never guessed) + detect_hook_harness (payload/env, never the
hook file; explicit wins, conflicts reported)
- harness_capture: record family z0int.<harness>.{opportunity_record,turn_outcome,failure}.v0 with
turn_key, work_item_id/attempt_id (per-session ordinal, retry keeps the work item), cohort, model_id,
policy_revision, privacy_class (request text opt-in), recorded_at, content-free capture flags;
explicit failure rows (unsupported_harness/schema, stale_evidence, missing_verifier,
partial_measurement, uncertain_execution via mutation-outcome/v0, duplicate_event, misattribution);
bounded Spool with persisted drops and bounded close; bounded build slots for detached children;
P-7 task cwd (an unreadable git state blocks ACT); frozen bundle with one generic reader
- hook_entry / hook_adapter: `python -m z0int.hook_adapter --harness <id> {prompt,stop,subagent-start,
subagent-stop,session-start}`; stdlib + harness_capture/harness_id at import; only claude-code keeps
the automatic.* call and the opt-in SessionStart packet, every other harness is capture-only
- claude_code becomes a thin wrapper (CC transcript usage/behaviour stay there); loop_export reads the
capture-time cohort/flags instead of request text; check_class is moved out of outcome_verifier
(which imports it and classifies each Bash call); agentsview_ro: mode=ro, user_version 74/113 guard,
staleness; automatic imports urllib/receipt lazily (CC prompt hook latency); the engagement report
still recognises the z0 SessionStart hook under its new command
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ared hook adapter - claude-code-z0intelligence: every hook goes through `-m z0int.hook_adapter --harness claude-code`; adds SubagentStart/SubagentStop (agent-cohort opportunity + outcome joined on turn_key) - codex-z0intelligence: hooks-only Codex plugin (UserPromptSubmit, Stop, SubagentStart, SubagentStop), no MCP server, no skills, no env plumbing; local marketplace .agents/plugins/marketplace.json lists only this plugin, so z0intelligence@personal is neither shadowed nor modified - grok-z0intelligence/hooks/z0-capture.json: Grok global hooks file (capture only), attribution from GROK_HOOK_EVENT Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… legacy export rows, O(1) checks, spool race) - CC Stop measured per prompt: a Stop that fires before the reply is flushed still closes its turn, late messages are never credited to the next prompt, and a measurement error is a failure row, not silence - CC harness-injected prompts: outcome in cohort harness with its own work item - legacy opportunity rows (no capture flags) never export as user rows; the backfill restores the 6fee859 export (golden regenerated on 6fee859 with two legacy-shaped rows) - append duplicate check and stale-evidence check read no record history - Spool.put racing close() is written or counted, never lost - the PreToolUse fallback is closed by PostToolUse (real payload shapes), never by an invented SubagentStop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… user cohorts, O(1) Stop-time checks - claude_code.on_stop measures the root outcome from the Stop's own prompt (transcript promptId owners); with nothing measurable it writes the payload outcome (partial_measurement row), late messages of an earlier prompt close that prompt with a partial_measurement row (late_messages), errors become rows - CC harness-injected prompts open a turn (cohort harness) without the opportunity build - outcome_context finds the Stop's own turn among the session's recent turns - append dedups through per-session markers; source revisions kept in session state for the stale check; per-session memory bounded (KEEP=32) - Spool.put and close() agree under one lock - loop_export: rows without capture flags are cohort unknown; `z0int outcomes backfill-capture` flags them and drops their stored request text (one-shot, idempotent, in place under the writers' lock) - docs: the CC fallback pair is PreToolUse/PostToolUse on Agent|Task, never registered with SubagentStart Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…outer and inert shadow plane (z0int#62) Node tests drive harness-adapters/dsh-z0intelligence through a fake cordis ctx and a mocked spawn; the Python test sends the plugin's normalized events through hook_adapter --harness dsh and checks the opportunity/outcome join on the canonical turn_key (DSH lineage turn_key alias). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…0intelligence; router behind #95 gate Folds the hermes-jev-dsh agent/request work (hermes-jev-skills 9ea5777) into the z0 DSH shim: capture.mjs sends one prompt and one stop event per root user turn to hook_adapter --harness dsh (detached, fail-open, counted spawn_failed drops) and returns next() unchanged; lineage.mjs keeps the session-metadata lineage and adds the canonical turn_key; shadow.mjs reaches Jev only through a configured z0 service (/v1/plan), sampled and in-flight capped, off by default, port 11501 refused unless allow_live_service. The llm/stream router registers only with config.router === true and automatic.json dsh.enabled. No JEV route call, effort/model change, key-file read or memory.js. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-pi#109) turn_open/turn_close records via the detached core (turn_key join, cohort agent for subagents, unknown facts without a cwd, reply latency over 200 turns), no prompt text in bridge.jsonl, cognition-shadow hygiene (no rows for a dead backend, backend_unavailable count, structured actual_tool, no tool input), protocol parity with the canonical a9cbbed worker and bridge-current.json, the pinned install script, bun fake-pi tests for the shim and the OMO senpi re-export. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-shadow hygiene, pinned install - bridge runtime/worker: turn_open queues z0int.<omp|omo>.opportunity_record.v0 (task cwd from the shim, built in the detached child) and turn_close a turn_outcome.v0 on the same turn key, through one bounded spool per harness off the reply path; execution_completed is kept apart from verified_success (null at capture); bridge.jsonl stores capture flags, never the prompt; frames without the new fields (a9cbbed shim) still work - harness_capture.begin_turn: a bridge turn with parent_id / agent_kind=sub is cohort agent at capture - z0int-bridge shim: cwd, harness, subagent parent and model on turn_open; session id from ctx.sessionManager; one open turn per session; every capture handler returns undefined and fails open with a counted drop row; registerBridgeCapture for any pi-family host; omo.ts is the capture-only OMO/senpi entry (no routing, no route_worker tool) - cognition shadow: receipt rows only for answers, backend_unavailable counted otherwise; structured actual_tool, no state text or tool input persisted; local-cognition no longer sends the tool input - scripts/omp_bridge_install.py (salvaged from 815c680): repoints only the z0int-bridge and local-cognition links to a clean pinned checkout, saves the links listing first, idempotent, z0int-intelligence only with --include-routing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Behaviour contracts for C7-memory-core, written before the implementation: EventLog append(identity) idempotency/conflict/references-only, the worker-facing read-only ledger and the 1024-event nap cascade; the AgentsView capability (EvidenceRef + EventIdentity, mode=ro), scope before ranking, explicit unavailability, the TencentDB client (not_configured, deadline, bearer from env, provenance_ok, dedupe), cross-harness recall, one query across three layers, memory_snapshot_id on StatePacket/DecisionOpportunity, the secret scrub on every output, MemoryUseReceipt binding, memory_brief (bound, abstain, supersession, cross-process cache), memory bench, the MCP "memory" profile and memory doctor. Synthetic fixtures only; the memory modules are empty skeletons so the tests fail on missing behaviour. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… TencentDB - EventLog.append(identity=EventIdentity) is the canonical source-derived ingestion path (#23): idempotent on event_uid, conflict on a changed payload_hash, references only for harness transcript sources, off until the owner confirms (Z0INT_MEMORY_SOURCE_INGEST=references); a read-only view refuses every write (workers cannot write the ledger, #63 P0). - memory.surface: lexical (AgentsView FTS5 via agentsview_ro, mode=ro), temporal (EventLog + scoped BitemporalClaim supersession) and semantic (TencentDB, hard deadline, bearer from a configured env var, items without source_event_ids keep provenance_ok=false) layers; scope before ranking, merge on event_uid, explicit unavailable status, secret scrub on every output; memory_brief with a token bound, abstention and a snapshot-keyed persistent cache (MemoryPacketCache key rules); bench. - memory_snapshot_id on StatePacket and DecisionOpportunity. - MemoryUseReceipt rejects instruction_capability, round-trips through DecisionReceipt.extra.memory and opportunity_record.memory. - context_resolve kind=memory resolves only with allow_memory=True and a single injection owner per turn. - intelligence_mcp profile "memory" (server z0-memory): memory_search, orient, inspect, history, unknowns, verify; no route_worker, stdio and in-process, no service, port or new DB. - z0int memory doctor / bench. The semantic layer stays UNAVAILABLE until the owner runs the gateway (G-SEM); TencentDB canonical provenance (#63) stays UNMET. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…host merge and legacy imports Red tests for C2-loop-consumers (z0int#56 M1, z0int#54, z0int#62): the harness-generic verifier on a synthetic AgentsView DB with the Claude Code signal semantics, one join rule per harness (Hermes, Codex, Grok, OMP/OMO, DSH) with "unjoined" on ambiguity, the cohort classifier, the read-only reader guards (mode=ro, user_version 74/113, pending_index on a stale index), label_source_empty, per-harness x cohort tables with unsupported_schema and failure counts, the first_opp fix, `loop merge`, the OMP v1 / cognition-shadow / DSH jev importers, privacy of every new table and idempotent re-runs. The AgentsView fixture uses the real v0.44 schema of the four core tables (schema only, no rows). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t tables, loop merge, legacy imports - turn_readers: the AgentsView reader (agentsview_ro: mode=ro, user_version 74/113, staleness) builds turns in the Claude transcript reader's shape, so outcome_verifier keeps one signal semantics. One documented join rule per harness (Hermes, Codex [id mapping INFERRED], Grok, OMP, OMO, DSH): session + user-message ordinal; ambiguity is "unjoined" with a failure row, a stale index gives pending_index. classify_cohort separates interactive / agent / automated / harness / eval / unknown (Hermes cron/kanban/cluster, codex exec, subagents). - outcome_verifier: verify_harness / `z0int outcomes verify --harness X`; reader_unavailable (incl. agent_missing) and label_source_empty make the report degraded, never success; failure rows are written once. Claude Code rows are unchanged (byte-identical to 6fee859 on the CC fixture set). - loop_export: tables per harness x cohort (Table refuses pooling), unsupported_schema and failure counts in the index manifest, the first_opp fix (recorded_at when no packet was built), `z0int loop export|merge|import`. - legacy_import: OMP v1 spine (effective_tier gold/negative is the only label), cognition-shadow (served answers only, actual_tool without input), DSH jev receipts (y null) into cohort legacy, watermarked and idempotent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Behaviour contracts for harness-adapters/hermes-z0intelligence as the single Hermes capture vehicle: P-1 (no service host/port, no socket from any hook, port settings are counted warnings), P-2 (bounded close, nothing written after unload), P-3 (persisted drops, fresh-process rows_dropped), P-7 (task cwd from hook context; no ACT with every git fact unknown), P-9 (State Packet text only with persist_packet_text), P-10 (mode off registers nothing; never pre_tool_call), P-11 (config errors fail open; no __pycache__ from the child), A1-A4 (z0 sink, turn_outcome rows, canonical turn_key, bounded projection pool with the H3 flood), the double-capture guard, inertness, the inert automatic path, check-class-only tool rows, model/policy revision, capture-time automated cohort and fail-open when z0int is missing. Host tests (opt-in, Z0INT_TEST_HERMES_PYTHON) load the plugin through a real Hermes PluginManager in a scratch profile with the live toolsets shape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…(C4a) harness-adapters/hermes-z0intelligence becomes the single standalone Hermes plugin. In mode shadow its hooks build content-free jobs and put them on a bounded queue; one writer thread hands batches, in order, to the installed z0int (`python -m z0int.hermes_capture batch`, a detached child), which writes events, opportunity_record.v0 and turn_outcome.v0 rows to $Z0INT_HOME/state/hermes through harness_capture. Projections take a build slot without waiting and run detached (bounded by MAX_CHILDREN) or are counted as fanout_cap, so event writes never wait for them. Fixes carried into the moved capture: no service port and no socket (P-1), bounded close with drops counted before it returns (P-2), persisted drops and rows_dropped from disk (P-3), task cwd from Hermes's own resolver and never os.getcwd() (P-7), State Packet text digested unless persist_packet_text (P-9), nothing registered in mode off and never pre_tool_call (P-10), settings read inside try (P-11), canonical turn_key (A3), cohort automated for cron/kanban/cluster sessions, model_id and policy_revision on rows, a double-capture guard, fail-open with z0int_unavailable rows. The automatic pre_llm_call is registered only while automatic.json enables hermes (#95). The z0int-decisions plugin directory is retired; its tests now guard the moved behaviours. The core gains begin_turn(cohort=...), try_slot and opportunity_record(packet_text=...); existing callers are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ider/id) The shim sends ctx.model as provider/id on turn_open, while the close frame carries provider and model apart; the outcome row now joins the opportunity on model_id too. Found by the isolated omp e2e. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sponses and errored turns (z0int#62) - a configured shadow.path/endpoint or a base URL with a path can never move the shadow off /v1/plan - a shadow response with executed:true is counted, never recorded ok - agent/error closes an open root turn with a counted, content-free turn_errored drop row - the JS turn_key test now checks a known harness_id.turn_key vector - test 8 asserts only what the spec asks (no memory.js, no Hermes DB reader), not the exact export list Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ed, node contract tests in CI - shadow.mjs: the endpoint is always <url origin>/v1/plan; the config `path` knob is gone (it could point the shadow body at /v1/worker and dispatch real work around #95). executed:true answers are counted (shadow_executed) and written executed_unexpectedly. - capture.mjs: agent/error closes an open root turn with a z0int.dsh.drop.v0 turn_errored row (counted). - lineage.mjs: drop the unreachable parent walk (resolveRootSession/traceIdFor/mintTraceId); a root's trace id is unchanged; module-only helpers are no longer exported. - README: the turn-stopping steering and errored/aborted-turn limits. - core-unit: run node --test tests/test-dsh-plugin.mjs in the offline suite; trigger on harness-adapters/**. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… projection (P-9) The isolated e2e found the README open-item text in $Z0INT_HOME/state/state_packet/<repo>/latest.json: build_state_packet stores its own snapshot by default, the second place bend leaked packet text. The Hermes child now builds the packet from the task repo's git and docs only (as bend #385), never scans the Claude Code transcript store, and caches/stores the snapshot only with persist_packet_text. The capture core passes optional State Packet arguments through; other callers are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- dsh-jev: an orphan jev_decision never stalls the import; it is held only at the tail within a grace window, then imported as no_lineage; counts are not added twice when held lines are re-read - export: a scrub correction leaves one row per turn_key (export and merge); shadow tables keep the latest row per decision_id - importer guard refuses a symlink into /workspace/hermes-home - outcomes verify exits non-zero (3) on a degraded report - ordinal join: capture-time alignment check (ordinal_misaligned) - --since windows every captured turn and the join counts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…erify exit 3 on degraded - legacy_import: an orphan jev_decision is held only within the last JEV_TAIL_LINES lines and JEV_GRACE_S of its ts, then imported as no_lineage; later rows are always processed; the watermark records what was counted and held so re-reads count nothing twice; the hermes-home guard resolves symlinks - loop_export: imported_turn rows latest-wins by turn_key, shadow_decision rows by decision_id (scrub corrections replace the stale label) - outcome_verifier: `outcomes verify` exits 3 when the report is degraded; --since applies to every captured turn by its capture time - turn_readers: ordinal join checks capture-time alignment (ordinal_misaligned); codex rule doc matches the capture-order code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A spool thread inside the worker competed with the reply path for the GIL (a convoy on every file write) and starved itself under a burst of turns. Capture now follows the hook adapter: the reply pays only the hand-off (begin_turn + one detached spawn on open, the outcome rows on close), and the 1-3 s opportunity build stays in the detached child. The latency test now runs in a real task repo with the real detached spawn, alternates capture-off and capture-on turns, and bounds the median per-turn capture cost (< 4 ms; ~1.2-1.6 ms measured, ~8 ms with the build on the reply path) plus a loose p95 tail guard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ound The median per-turn capture cost (< 4 ms) is the discriminating bound; the p95 tail guard measured up to +18 ms of host noise at load ~4-7. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Credential shapes from env dumps and JSON configs, AgentsView secret_findings span redaction, scrub-before-truncate in inspect, one deadline budget per query against a gateway hung on every endpoint, no gateway call on the state-packet hook path or without the semantic layer, injector marker pruning, the no-turn_key double-inject guard and the pinned unscoped MCP behaviour. Also makes the nap-cascade and doctor tests hermetic and uses an obviously synthetic BWS UUID. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- scrub: AgentsView secret_findings spans (UTF-8 byte offsets, message location, matched on ordinal) are blanked before the regex backstop, as the kernel's _redact_secrets did; the key=value rule now covers prefixed names and quoted JSON keys; xai-/gsk_/hf_/github_pat_ added. - inspect scrubs the whole message or payload before bounding it. - TencentDB: one deadline budget per query shared by the revision probe and the search; the revision comes from the search response; a timed-out gateway is not asked again. A query without the semantic layer never calls the gateway. - state_packet's memory_snapshot_id is local only (short AgentsView timeout, last observed gateway revision), never a network call from the hook path. - context_resolve: allow_memory without a turn_key is an explicit double_inject_guard gap; `z0int context resolve --turn-key`. - injector markers older than a day are pruned on claim. - memory MCP: "project" documents that an unscoped call spans all projects. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- P-2: a projection in flight at close() writes nothing after close() returns and is counted as a closed drop - retired vehicle: `z0int hermes opportunity` writes no opportunity row, only a retired_vehicle failure - P-1: the child socket guard logs every connect (loopback on any port, AF_UNIX), not only :11501 - automatic path: invoke runs z0int_python with the gate's Z0INT_HOME, no source-tree PYTHONPATH - the opportunity regression guard runs through the one capture path; P-7/P-9 build before close() Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ions capture path - close() waits for running projections within its 2 s budget, then removes a per-instance gate file; a projection writes its row only while holding that gate, so nothing is written after close() returns and a projection cut off is counted as a closed drop (the batch child acks 'p' for each projection it starts) - harness_capture.record_built_opportunity: the write half of record_opportunity (callers unchanged) - hermes_decisions.on_opportunity removed; `z0int hermes opportunity` records one content-free retired_vehicle failure row and never an opportunity - automatic invoke uses the capture interpreter (z0int_python / Z0INT_PYTHON) and Z0INT_HOME of its gate - README: gate contract, retired command, unverified GitHub install and the git-archive fallback Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… divergence and the shadow request - the bridge default export registers no routing handler and no z0int_route_worker tool; routing loaded from its own z0int-intelligence link registers exactly once next to it - an unclosed turn stops blocking reload after an age bound (counted stale_turn); a new turn in a session whose last turn never closed is counted unclosed_turn - OMO: a host whose on() accepts any event (like the real senpi loader) is caught at run time; the senpi types come from SENPI_TYPES / module resolution / $BUN_INSTALL and an absent file is an explicit skip - the local shadow request carries the bounded tool input again (receipts stay input-free) - install: the routing link is reported kept; a missing one is refused unless --allow-no-routing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # .github/workflows/core-unit.yml # omp-extensions/local-cognition/index.ts # omp-extensions/z0-optchat/index.ts # omp-extensions/z0int-bridge/index.ts # src/z0int/cognition/shadow.py # src/z0int/context_resolve.py # src/z0int/optchat/__main__.py # src/z0int/optchat/compact.py # src/z0int/optchat/log.py # tests/test_optchat.py
# Conflicts: # omp-extensions/local-cognition/README.md # omp-extensions/local-cognition/index.test.ts # omp-extensions/local-cognition/index.ts # src/z0int/bridge/worker.py # src/z0int/cognition/shadow.py # tests/test_cognition_shadow.py
github-actions
Bot
added
area:docs
# Conflicts: # src/z0int/cognition/shadow.py
/v1/providers re-read and JSON-parsed the whole 35 MB decision stream once per provider (10x) on every 30 s cache miss, taking ~2.0 s. The k3s executor's /readyz waits 2 s on that call, so readiness flapped (1035 Unhealthy events). Skip non-matching lines before json.loads and reuse the parse while the stream's identity, size and mtime are unchanged (checked under the shared lock). Refresh now 0.056 s cold, 0.003 s warm.
The preserved live-WIP merge recorded free_only=False on every sidestep attempt, so the four test_sidestep_free_only cases (issue #139 / PR #141) failed. Cost enforcement already used free_required(), so paid sidesteps were still refused; the receipt simply misreported the policy. Record the policy that was actually enforced.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft ancestry-preserving integration: master6cae992 + preserved live-wip a2055b2 + loop-data2f442cf + self-contained shadow portfolio through49394b8. Final head fd2297b. Normal merge commits only; no rebase, force, tag publication, policy-branch integration or worktree deletion. Excludes in-flight #211/#212/#213 and #214 per sequencing decision. Exact-head MBP gate fleet-mbp-e33ceb32f27f40b3 exited0:528Python passed,2historical-canonical-checkout parity tests skipped,48native extension tests passed,0failed. No compilation/test suite ran on groot. Integration preserves bounded FFF/cached discovery, fresh-view OptChat, queued concurrent-session bridge reloads, binary observation privacy and structured label identity. Hermes OptChat callers migrated without compatibility shims. Bridge follows the stable installed release reference on respawn and fails closed on a broken link; evidence tool registration uses the existing native JSON-schema contract rather than requiring pi.zod. Includes immutable committed-source/runtime staging, atomic pointer switching, tested rollback lifecycle and operational docs. Initial CA/archive and fixture/native-registration failures were corrected before the final green gate, not suppressed/skipped. The separately authorized operational cutover and before/after/temporary-rollback receipts are documented in local operations/repo-distill/ONE-LIVE-COPY-DONE.md. This Draft remains the normal master review/merge path; publication is not policy promotion.