Maintainer digest — 2026-10-12 #337

Maintainer digest — outerloop-science/outerloop at 2c59980d on 2026-10-12; scanned by terra.

Advisory findings from outerloop. The maintainer decides: items marked Decision need a call before any change; the rest are mechanical and may be taken as work orders. The scan edits nothing.

16 items: 7 need a decision, 9 are mechanical, 0 are notes.

duplication

• Decision. Choose one owner for the tick environment allowlist. [architecture] The 48-name Python TICK_ENV_KEYS tuple is repeated in scripts/tick_deploy.sh; tests only spot-check that a newly added key appears in both. Generate or share the deployment allowlist so a setting cannot work for local start yet be omitted from resident deployment. (src/outerloop/cli.py:56; high)
• Replace cross-module private-helper imports with owned public interfaces. [duplication] The AST scan found 19 production imports of underscore-prefixed helpers across 10 importing modules and 9 owners; endpoint_wait imports runstate._save_record, while other cases connect inbox/syscall, session_evidence/harness, and tick/attempt. Promote or relocate shared operations so each contract has an explicit owner. (src/outerloop/endpoint_wait.py:17; high)
• Extract the duplicated submission-path callback. [pathways] The same four-line changed_paths closure occurs at lines 1798-1801 and 4902-4905, differing only in the memory-exclusion boolean; both call submission_paths with refs/remotes/origin/{base_branch}. Use a small helper to keep wake and first-pass scope behavior aligned. (src/outerloop/attempt.py:1798; high)

structure

• Decision. Choose ownership boundaries and split attempt_once into tested transition handlers. [architecture+docs+duplication+general+pathways] attempt_once spans 1,272 lines (1297-2568), has roughly 35-41 parameters and 174 branch nodes, and combines sessions, syscalls, measurement, suite gating, panel/inbox processing, and result construction. Select persisted-state and compatibility boundaries, then extract session, admission/dispatch, measurement, panel, and publish-resume phases behind typed context/collaborators. (src/outerloop/orchestrator.py:1297; high)
• Decision. Choose lifecycle ownership seams before splitting attempt.py and its coupled tests. [architecture+general+performance+structure+tests+upgrades] attempt.py is about 6,146 lines, with _resume_run (664 lines), publish (668), and live_attempt (600); its paired end-to-end test module is 8,612 lines. Decide cohesive module ownership for wake/reintegration, publishing, author-leg orchestration, persistence, and terminal handling before extracting the concentrated lifecycle paths. (src/outerloop/attempt.py:2815; high)
• Extract the climb-board page assets from the Python renderer. [structure] render_html spans 541 lines and embeds a 332-line, 15,511-character JavaScript literal plus CSS in a 1,485-line module. Move static shell/assets behind a focused renderer while preserving self-contained file:// behavior and hostile-text escaping. (src/outerloop/climbboard.py:359; high)

upgrades

• Decision. Decide whether to re-verify and refresh the separately locked Codex bridge runtime. [docs+general+tests+upgrades] The version-sensitive bridge pins LiteLLM 1.103.1 and FastAPI 0.136.3 while newer releases are available (1.105.0 and 0.143.0); its lock has 27 available updates. Its focused compatibility suite is an upgrade gate, so choose an upgrade window and re-verify deliberately rather than changing pins opportunistically. (src/outerloop/bridge_runtime/pyproject.toml:5; high)
• Refresh the root lockfile for available compatible patch releases. [architecture+docs+duplication+general+pathways+performance+structure+tests] The root declares pydantic>=2 while the lock has pydantic 2.14.0 and pydantic-core 2.50.0; outdated checks report 2.14.1 and 2.50.1. The dry run also reports filelock 4.1.0→4.1.1 and virtualenv 21.14.6→21.14.7; regenerate the lock and run the existing gates. (uv.lock:1; high)
• Update setup-uv from v10.2.0 to v10.3.0 across workflows. [upgrades] Ten setup-uv uses in seven workflow files are pinned to v10.2.0 while v10.3.0 is current. Update the shared action pin and retain the existing green root validation gates. (.github/workflows/ci.yml:27; high)

tests

• Decision. Decide whether the documented slow, llm, and slurm test tiers should be populated or removed. [pathways+tests] Documentation and configuration advertise slow, llm, slurm, and serial markers, but scans found no tests carrying slow, llm, or slurm. Serial is used (nine tests), so retain it; populate the other tiers or remove their advertised reserved interfaces. (pyproject.toml:92; high)
• Exercise the locked Codex bridge proxy compatibility tests in CI. [architecture+docs+duplication+general+performance+tests+upgrades] CI syncs only the root environment, leaving four offline bridge-proxy compatibility tests skipped when the separately locked bridge runtime is absent. After syncing that runtime and setting OUTERLOOP_BRIDGE_TEST_PYTHON, tests/test_codex_bridge.py passed 31 tests with only two intentional opt-in Codex skips; add that provisioned path to CI so this integration contract is gated. (.github/workflows/ci.yml:30; high)

performance

• Index run ownership before attributing scheduler jobs. [performance] On every capped GPU admission, usage() scans all run IDs for every scheduler GPU job and reads each first matched state file, making the path O(jobs*runs); check_batch() and report() call it. Precompute an owner index while preserving the current full-ID-over-prefix collision rule. (src/outerloop/operator_limits.py:105; medium)

docs

• Redact deployment-specific infrastructure details from the public design note. [docs] CLAUDE.md prohibits public deployment specifics, but lines 118-128 and 219-227 name an account, partitions, GPU inventory, a host, and live deployment status. The scan found 100 matching deployment terms across public docs. (docs/design/multi-cluster.md:118; high)
• Make the contributor serial-test command match CI. [pathways] CONTRIBUTING.md tells contributors to run uv run pytest -m serial, while CI uses uv run pytest -n0 -m serial and the project states serial tests run alone. Document the isolated CI-equivalent command. (CONTRIBUTING.md:34; high)

architecture

• Decision. Define a backend descriptor registry instead of scattering three-backend cases. [architecture] Harness construction branches across Claude, Codex, and Hermes, and at least 20 further validations or mappings repeat those backend cases across endpoints, panels, attempts, initialization, credentials, CLI choices, and installation. Introduce a descriptor seam that owns those capabilities so adding a backend does not require kernel edits throughout the repository. (src/outerloop/role_runner.py:88; high)
• Decision. Choose a versioning policy for reusable workflow callers pinned to main. [upgrades] review.yml has three reusable-workflow calls and maintenance.yml has one, all using outerloop-science/outerloop@main. Pinning to a release tag or commit prevents unreviewed upstream main changes from altering scheduled review or maintenance behavior, at the cost of an explicit upgrade process. (.github/workflows/review.yml:30; high)

Each scan replaces this body; earlier digests are in the edit history. Run a scan by hand from the Actions tab (maintenance → Run workflow).