scripts/regen-all.sh content is byte-identical; only the mode moves
100644 -> 100755. Verified two independent ways: the git blob is unchanged at
0e3c47e39b (content sha256
88eb93e41392329115448c43ada1ed94fc6f028c754a99d627f6d25f95ca0583), and the
effect kernel classifies the path MODE_CHANGED rather than MODIFIED.
The script carried a #!/usr/bin/env bash shebang while tracked non-executable,
so direct invocation exited 126. Every shipped caller passes an explicit
interpreter and the existing suite copied then ran it as `bash <path>` -- blind
to the mode by construction -- which is why the regression stayed green.
Three direct-execution witnesses added. Right-reason RED observed before the
mode fix, with witnesses present and mode still 100644:
ok 1 regen-all stops before a later projection (old, mode-blind: still green)
not ok 2 regen-all.sh is tracked executable (failed on 100755*)
not ok 3 direct execution ... is not a 126 refusal (failed on -ne 126)
ok 4 a non-executable copy is refused with 126 (control already correct)
Test 4 is the discriminating control: asserting merely non-zero in test 3 could
not distinguish a mode regression from the seeded failure being proven.
After the fix: direct ./scripts/regen-all.sh --check exits 1, not 126, and the
suite is 4/4.
This is the LAST tracked mutation. The final subject manifest was frozen after
it and before any check ran, so every check-receipt.v1 binds the FINAL manifest
digest 347a3ff1aa6b8b4a35baa97a1d0333b795892186c0a8dbde7563761d44d9d367 -- the
repair3 defect being closed. No verdict was minted.
Claude-Session: https://claude.ai/code/session_013fqQZAMZVFswA3oFrCDAFf
Every prior witness runs against a synthetic fixture, which is exactly why all
15 stayed green while a normal --regenerate on the REAL repository grew the
tracked snapshot from five entries to seven. These four probe the real tree in
a disposable copy, because the integration condition Sol failed us on is
"regeneration is a no-op on the committed grandfather" and only a real-tree
probe can observe it.
Observed RED at 753e0aadb (4 new fail, 15 prior pass):
15 real tree: --regenerate is a NO-OP on the committed grandfather
-> after != before; snapshot moves a15f326f... -> bcdbf4d1...
16 real tree: cli/internal/evidence/citations.go does not trip
-> the path IS present in the regenerated grandfather
17 real tree: cli/internal/provenancegraph/store.go does not trip
-> the path IS present in the regenerated grandfather
18 real tree: --regenerate is idempotent AT the five-entry snapshot
-> idempotent, but only after the prohibited growth
Both offenders are named explicitly rather than asserting a bare count, so a
future regression says WHICH reader regressed instead of only that the number
moved. The disposable copy is mutated; the repository grandfather is
untouchable by construction and verified byte-identical after this run.
Claude-Session: https://claude.ai/code/session_013fqQZAMZVFswA3oFrCDAFf
Three baseline-first mutating-success witnesses, tests only, currently
failing: dead candidate enumeration, PARTIAL enumeration (path emitted then
death), and dead per-file whole-file scan each currently exit 0 and rewrite a
populated grandfather (header-only or partial) — the witnesses require
nonzero exit, a refusal, and byte-identical snapshot preservation. All 12
prior tests pass; the sane-regenerate baseline runs inside each witness
before hostility.
Claude-Session: https://claude.ai/code/session_01DUtFAN2gC4ryUmkMEhDVuR
Three baseline-first witnesses, tests only. Currently: an added-hunk
scan-helper death (awk shim on the lib's RATCHET_HUNK_ERE call) and a
whole-file scan death in file_trips (grep shim on the \.jsonl pattern) both
skip the seeded violation into a green PASS rc 0 — the two RED cases. The
third witness pins the NON-member of the class: a mid-loop dead git diff
degrades to the whole-file scan and still flags rc 1 naming the file, so the
fix may not satisfy the suite by reporting less. All 9 prior tests pass.
Claude-Session: https://claude.ai/code/session_01DUtFAN2gC4ryUmkMEhDVuR
Four discriminating N7-style witnesses, tests only, currently failing:
- preamble gate: failing collector -> exit 2 with lib stderr preserved and no
green certification; partial collector (row then death) -> exit 2 and the
truncated row is never surfaced. Today: rc 0, green PASS banner over a real
staged violation with a dead git diff.
- jsonl gate: same two shapes against the head-scope diff-tree collector.
Today: rc 0, green PASS banner over a real committed violation while the
lib's 'refusing to certify' stderr scrolls past unheeded.
Each witness seeds a real violation first, so a swallowed failure must
produce a visibly wrong green; shims target the collection git command, not
either implementation. All 15 pre-existing sibling tests still pass.
Claude-Session: https://claude.ai/code/session_01DUtFAN2gC4ryUmkMEhDVuR
Two fresh-Sol findings against scripts/check-skill-python-ratchet.sh, pinned as
failing witnesses before any source change.
1. The caller swallows the collector contract. scripts/lib/ratchet.sh documents
every chosen collection command as fail-closed rc 2 ("refusing to certify an
unchecked change set"), but the gate calls
`ratchet_changed_files_status ... 2>/dev/null || true`. A dead Git read
therefore becomes an EMPTY changed set, and an empty changed set certifies
"no new Python" over a diff nobody looked at. Reproduced with a diff-tree
shim over a tree carrying a real unpinned violation: the gate prints the
green PASS banner and exits 0.
2. head scope claims first-parent semantics and does not have them.
`git diff-tree -m --first-parent` does not mean "diff only against parent 1"
-- `-m` splits a merge into one block PER PARENT and emits them all. The
parent-2 block lists paths already settled on the first-parent line, so a
merge re-attributes them to itself.
RED witnesses added:
N7 gate: a failing changed-scope collector must exit 2, never a silent PASS
N8 gate: a merge must not re-attribute parent-2-block Python
N9 gate: a merge must still catch its real first-parent introduction (guard
against over-correcting; passes today and must keep passing)
lib: changed_files/_status head scope on a merge excludes the parent-2 block
N7, N8 and the lib case fail at this commit. N9 passes.
The pre-existing lib merge test cannot discriminate: its first-parent line gains
nothing after the branch point, so the parent-2 block is empty under either
reading. The new case uses a fixture where the two readings differ.
Refs: /tmp/agentops-adr0016-go-promotion-review-sol.md (REQUEST_CHANGES, "Two
ratchet corrections are still required")
P3 from the 2026-07-25 review: fix the inert-check CLASS, not just the two
instances #995 patched.
A gate verified only against a green tree is indistinguishable from `exit 0` --
delete its detector and CI stays green. Measured across the registry: 32 of 54
BLOCKING script-backed gates had no test anywhere under tests/ demonstrating
they FAIL on what they detect. 17 had no test at all, including skill.schema
and skill.triggers, which gate every SKILL.md in the corpus.
The closure lives in Go because the registry does. An earlier bash/Python
projection of seed.go undercounted by four -- some gates register outside that
file. The authority is gates.Default.All(), and reading it any other way
reproduces exactly the projection drift ADR-0016 is named after.
Mechanism is the repo's proven shrink-only ratchet: current gaps pinned in
scripts/.gate-negative-witness-grandfather; a NEW blocking gate must ship with a
witness; a gate that gains one must be pruned; a gate that leaves the registry
must be pruned; the growth guard reads HEAD so a change cannot exempt its own
new gate. The surviving count prints on every run.
Ratcheted down immediately to prove the mechanism moves rather than just counts:
tests/scripts/validate-skill-schema.bats is a real witness for skill.schema
(32 -> 31), driving the actual validator against a fixture tree.
Two things worth recording:
- The first draft's negatives passed for the WRONG reason. Descriptions in this
corpus embed `Triggers: "x"`; unquoted, that colon makes YAML read a nested
mapping, so the gate failed on a PARSE error rather than the schema violation
each test claimed to witness. Caught only because the positive case failed
too. A negative that fires for the wrong reason is not a witness.
- go.test-isolation is ON the allowlist as lacking a proven negative, and it
caught a real defect in this very PR (a git exec without per-command env
scrubbing). The pin measures TEST COVERAGE of a gate, not its efficacy. An
unproven gate may work fine; the point is that nothing would tell us if it
stopped.
All four of the meta-test's own failure directions were seeded and observed, so
the check-liveness ratchet is not itself an unproven check.
Two fixes from the 2026-07-25 skill-overhaul progress review, both independent
of the unlanded tranche fleet.
1. skill.python-ratchet — the gate ADR-0016 said it already had. Section 3
fixed "Python never ships in skills" on 2026-07-18 and called its own
violation "a gate failure, not a style nit", while zero checks enforced it.
Now a blocking shrink-only ratchet over skills/*/scripts/**/*.py: the 24
current files are pinned, new ones hard-fail, a promoted file must be
pruned, and the growth guard rejects a change that allowlists itself. The
surviving count prints on every run. ADR-0016 records the enforcing check by
name and the skills/*/tests/** carve-out with its rationale, so the
exemption cannot decay into the same inert prose.
2. The RPI/Validate acceptance-digest disagreement. run_once.py digested a
canonical-JSON re-serialization of the parsed intent mapping, validate.py
digested the raw intent bytes, and run_once.py hard-compared the two, so the
composed contract could not succeed. Both suites were green because RPI's
test mocked Validate with RPI's own digest function. RPI stops being a
second digest authority: it carries the digest Plan declares over the bytes
Plan snapshotted and cross-checks Validate's independently re-derived value.
3. The cathedral-cut probe, the same blind spot found again. It set
intent_bytes = canonical_bytes(resolved_intent) — precisely the one input
where the two digests coincide — so like the unit test it was built around
the coincidence and could not observe the bug.
Test shape is liveness-first: every gate negative is a seeded witness the gate
must be shown to FAIL on (12/12 bats), and the digest fix landed against a RED
witness that reproduces the real production error.
## Outcome
Ships AgentOps 3.3 as a thin native Gas City pack and removes the
accidental second orchestration control plane.
- Removes the custom GC delivery command/package, packet/schema family,
feeder/program engine, reducer/order, reliability registry, Beads
capability mirror, and fork-baseline runtime checks (about 29k deleted
lines).
- Retains six bounded adapters for pinned toolchain materialization,
clean bootstrap, native sling/status/doctor invocation, bead-isolated
worktrees, moving-main PR delivery, and teardown.
- Uses official Gas City and Beads behavior as the state owners, with
required OTEL configuration.
- Preserves Fable Mayor/Refiner, Sol-high planning and fresh validation,
Terra-high default implementation, Opus-medium overflow, and
support-only Luna.
- Supports automatic Refiner merge after hosted CI or a manual-review
toggle without locking `main`.
## Evidence
- Exact official GC: `8ffc009ded781a2ada2077f3a29bd712b2def0bf`
- Exact official BD: `8e4e59d39f3459a43cf21a3236a13eca4dd874f7`
- Full pinned native boundary: 9/9 passed in 114.047s
- Exact source-bead route replay: passed in 98.051s
- Release replay: manifest integrity, thin tests and both pack lints,
generated projections, contract compatibility, Bats contract,
ShellCheck, test-removal ratchet, and `go test ./...` all passed
- Fresh independent semantic verdict: PASS (Sol-high)
- Exact delivered head: `e805f0e26ce21c2eae9e720f57fff2a705f3185b`
- Subject manifest:
`8554d065076f70d0e639ca353409d2a75dca7ac01e4cb65cb4a118e98c0770fc`
- Verdict:
`3f89376b675de854832f38b46ccfa7ad7ca54079ffde578769c33e1f118c68c1`
## Release boundary
After this PR merges, the release qualification runs one fresh mixed
Terra/Opus canary from merged `main`, with at most one external repair
and one terminal retry. No live city repairs itself.
The only known local fast-gate exception is `workflow.install-drift`:
the installed workflow symlink resolves to the separate dirty primary
checkout, outside this candidate. All candidate-owned gates passed.
## Summary
- keep the city dispatcher and non-primary rig dispatchers suspended
- activate exactly the selected primary rig dispatcher
- seal Formula control records to that dispatcher before admission and
fail closed on malformed or foreign bindings
- verify the effective official GC agent inventory during bootstrap
## Evidence
- fresh Sol-high pre-delivery binding verdict: PASS
- candidate diff digest:
c7362c701f417e259194b97572734aed18ebc022f17abcd907681926f9db6fc2
- Python workflow tests: 18/18
- bootstrap Bats: 30/30
- GC executor gate: PASS
- full local release gate: PASS
- two fresh official GC v1.3.5 / BD v1.1.0 zero-model qualifications:
PASS
## Residual
Stable GC teardown sometimes leaves its private tmux session after gc
stop. Qualification cleanup was scoped and reached zero processes; this
upstream-owned residual is disclosed and is not changed here. The
post-merge mixed-provider canary remains a separate release gate.
## Summary
- bind Formula cook to concrete targets derived from the digest-bound
native rig
- decode Gas City v1.3.5's exact relative Ralph-attempt refs into
canonical AgentOps workflow keys
- fail closed on root, control, source-spec, attempt, route, replay, and
custom factory-binding drift
- retain official GC v1.3.5 and Beads v1.1.0 unchanged
## Why
The fifth release canary correctly stopped before model launch because
`rig/agentops.plan-reviewer` was not a valid Formula target. Exact
official qualification then exposed a second AgentOps assumption: stable
GC persists top-level Ralph attempt refs as `mayor.iteration.1`,
`plan.iteration.1`, `implement.iteration.1`, and `validate.iteration.1`,
while AgentOps had expected formula-qualified values.
This change supplies sealed concrete routes to the pinned stable release
and uses explicit one-to-one persisted-to-canonical maps. It does not
patch or depend on an unreleased Gas City/Beads fork.
## Evidence
- candidate: `21cbd7693819ae047d4ce3da4f95ef9453e2e80a`
- tree: `ede2b444217be5c8e2aa19bf5af81d231b70b360`
- official GC: `8ffc009ded781a2ada2077f3a29bd712b2def0bf` (v1.3.5)
- official BD: `8e4e59d39f3459a43cf21a3236a13eca4dd874f7` (v1.1.0)
- two fresh configured-not-started roots passed independently:
- route-fixture-g: build `rfg-bq0`, Terra `rfg-plb`, Opus `rfg-cio`
- route-fixture-h: build `rfh-eez`, Terra `rfh-86h`, Opus `rfh-jgc`
- both roots had zero sessions, zero running agents, clean Git, and
clean managed teardown
- fresh Sol-high binding verdict: PASS; file SHA-256
`0c9b14bcd0f04d782f67f815c029b267224a554a445c5d2a25feadac881d2e10`
## Checks
- `bash scripts/check-gc-executor.sh`
- 41 packet tests
- 41 GC 3.3 tests
- 4 projection tests
- 35 bootstrap Bats tests
- static contract PASS
- `bash scripts/ci-local-release.sh`
- LOCAL CI PASS in 89s
- race, security, SBOM, release binary, smoke, install, and contract
gates passed
- advisory readiness is 7 only because HIL is intentionally deferred to
the one post-merge mixed-provider canary
## Delivery boundary
The final required-telemetry mixed-provider canary will run once from
merged `main`. These stopped and qualification-only roots will not be
replayed.
Summary\n\n- Bind the bootstrap-generated canonical native delivery
context into the ready managed-city marker.\n- Make the managed invoker
verify and export the complete fixed delivery/tool identity before
imported pack execution.\n- Preserve the fourth bounded pre-admission
stop and classify it as an AgentOps integration
defect.\n\nValidation\n\n- scripts/check-gc-executor.sh: PASS\n- Full
local release gate at .agents/releases/local-ci/20260722T160625Z: PASS
on 8a3e3e066\n- Two clean official GC v1.3.5 / Beads v1.1.0
bootstrap-start-help-native-context-teardown cycles\n- Fresh Sol-high
binding verdict: PASS; file SHA-256
0b42389409a5c7c9026d44d20c6b5c9e50d9a5763009d63baceeaef62fb720e5\n\nThe
required-telemetry mixed-provider canary remains deferred until this
exact subject passes hosted CI and lands.
## Summary
- keep validating the exact managed-city marker, GC digest, private
supervisor, and telemetry policy
- enter the exact managed city for eager imported-command discovery
- execute GC without redundantly forwarding root `--city` or a literal
separator into the imported leaf
- make the parser-shaped regression reject either leaked root argument
- record the third bounded pre-admission stop and correct its ownership
classification
## Why
The third fresh 3.3 canary reached the eagerly discovered
`DisableFlagParsing` leaf, but the managed invoker still supplied
`--city <path>` to GC. GC intentionally gives the discovered leaf
ownership of its remaining argv, so `program_start.py` received that
root selector and rejected it. AgentOps already classified this as a
compatibility hazard it must handle; this correction makes the
implementation match that known no-root-selector contract. No Gas City
or Beads fork/source change is included.
## Evidence
- exact candidate: `a8dc3511fb6d47b8860c706bddeb3e85706695ee`
- exact tree: `ee9764561bebf0e196b5c2ac927dc866eb72d9c6`
- focused invoker Bats: 4/4 PASS
- focused + adjacent Bats under fresh Sol: 20/20 PASS
- combined GC adapter gate: 33 Bats plus packet/factory/projection
suites PASS
- official-GC read-only imported help from `/private/tmp`: PASS with no
stopped-cycle mutation
- full local release: `.agents/releases/local-ci/20260722T152302Z` PASS,
exact SHA bound
- two fresh bootstrap/start/help/quiescence/teardown cycles: PASS
- fresh Sol-high binding verdict: PASS (10/10), file SHA
`af2a41a42c75c632a58adbeb9fa0ff6ec2349fcfc18d94e1eb478a032077ceb8`
## Deferred
One wholly new required-telemetry mixed-provider canary remains after
hosted CI, exact protected-main landing, and post-merge conformance. The
stopped `ag-lb2` subject will not be replayed.
## Summary
- enter the exact marker-bound managed city before dispatching imported
AgentOps pack commands
- preserve direct leaf arguments without a literal `--` separator
- document the verified official GC v1.3.5 discovery limitation and the
bounded AgentOps workaround
- add a parser-shaped regression test that fails when dispatch occurs
outside the requested city
## Why
The second bounded 3.3 live canary exposed an official GC v1.3.5
CLI-ordering limitation: imported pack commands are discovered before
persistent `--city` is parsed. From outside the city, direct leaf flags
are rejected by GC; the lazy fallback reached with `--` forwards that
separator to the pack script. The managed invoker now enters the already
validated marker city before exact GC exec, allowing eager pack
discovery without changing the GC or Beads forks.
## Evidence
- exact candidate: `6eff4767297178c4cd9d7945795526d2e61d0e0b`
- exact tree: `8e57f213f9253e6880ee5f183783500dad729abb`
- invoker Bats: 4/4 PASS
- adjacent teardown/toolchain Bats: 16/16 PASS
- real official-GC read-only pack-help proof from outside the city: PASS
- full local release: `.agents/releases/local-ci/20260722T144624Z` PASS
- two clean exact qualification cycles: PASS
- fresh Sol-high binding verdict: PASS (10/10 criteria)
## Deferred
One entirely fresh live mixed-provider canary remains after hosted CI
and exact protected-main landing. The upstream CLI defect is retained
under the canonical 3.3.1 bead for a bounded contribution only if
current upstream still reproduces it.
## Outcome
Correct the one AgentOps-owned defect exposed by the first post-merge
3.3 canary: the operator README placed a literal argument boundary
inside the discovered Gas City command, so Python never received
source-bead.
This adds a managed invocation boundary that:
- consumes its own explicit wrapper separator and forwards
discovered-command flags directly;
- binds the schema-5 city marker, exact GC digest, private supervisor
home, and isolated mode;
- projects the marker-selected GC/BD telemetry endpoints or an explicit
disabled state;
- clears ambient generic OTLP fallback configuration;
- records the stopped pre-admission canary without claiming a Gas City
or Beads defect.
## Evidence
- focused managed-invocation Bats: 4/4 PASS
- combined Gas City contract gate: PASS (33 Bats plus Python/static
contracts)
- adjacent teardown/toolchain Bats: 16/16 PASS
- exact full local release gate: PASS at
.agents/releases/local-ci/20260722T141141Z
- two fresh exact-toolchain bootstrap/start/status/teardown cycles:
PASS, zero workers/sessions, clean teardown
- fresh Sol-high pre-delivery binding: PASS, 11/11 criteria
## Deferred boundary
This PR does not claim final 3.3 release readiness. After protected
merge and post-merge conformance, exactly one new required-telemetry
mixed Terra-high/Opus-medium live canary remains.
## Summary
- bind the GC 3.3 bead-native workflow: Fable Mayor, fresh Sol-high plan
and validation, Terra-high default or Opus-medium overflow
implementation, Luna support-only
- add the bounded one-shot graph feeder, strict packet/worktree
identity, semantic terminalization, and model-free protected delivery
sweep
- make official Gas City v1.3.5 plus Beads v1.1.0 bootstrap repeatable,
disable unstable event propulsion/hooks, and prove quiescent teardown
## Reliability boundaries
- no Gas City self-repair loop, daemon, private scheduler, model
fallback, or main mutex
- semantic completion is independent of delivery; protected
PR/CI/rebase/merge is deterministic and moving-main aware
- event hooks are disabled because 3.3 uses explicit program admission
and cooldown delivery; native controller bead observation remains active
## Evidence
- full local release CI PASS at
.agents/releases/local-ci/20260722T113355Z
- two pristine standalone-clone cycles with official GC v1.3.5 8ffc009d
and BD v1.1.0 8e4e59d: repeat bootstrap, exact rig Dolt context, absent
event hooks, bounded events, enabled sealed delivery, and delayed
zero-process teardown
- fresh independent Sol-high pre-delivery binding PASS over exact head
e8c1253b40
- binding verdict SHA-256:
4f8d81811cd5b2eb35159c98159db2f8917d3ef54167f3c0d59d8378de14b2d1
## Tracker
Beads: age-gc-scope-failclosed-release-gktia.2
The one bounded mixed-provider live canary remains a post-merge release
gate; this PR does not claim final 3.3 release readiness before that
proof.
## Summary
- replace the unreachable Python factory lifecycle with an optional
typed Go delivery reducer
- make Beads the delivery lifecycle authority with deterministic
moving-main successor epochs
- add native Git/worktree, PR, hosted-check, auto-merge, landing, and
cold-replay boundaries
- retire obsolete v1 role/factory schemas and preserve the pinned
historical capability harness
## Validation
- fresh Sol-high PASS over exact 43-path manifest
ec6a2a4bf0b180782411b1ae4afd4a2ad8384129ff037ce8c119480317626b02
- go test ./...
- go test -race ./internal/gcadapter/delivery
- go vet ./...
- scripts/check-gc-executor.sh
- GC 3.3 schema, migration, provenance, factory-doctor, and bootstrap
gates
Bead: age-gc-scope-failclosed-release-gktia.1
Bead: ag-agentops-33-gc-refinery-4km81.5\n\nThis delivers the GC33-4
deterministic proof kernel without starting Gas City or adding a second
agentic loop.\n\nWhat changed:\n- width-two per-bead lease and candidate
isolation, with overlap serialization and no main/global mutex\n- exact
candidate Git/worktree/index auditing and bounded PGID-scoped process
receipts\n- Draft 2020-12 typed delivery/ambiguity publication with
exhaustive construction-state routing\n- composed six-role native
query/sling firewall executed by factory doctor\n- fake-store-derived
loss, duplicate, expiry, and replay evidence\n- live Fable remains
closed pending supported confinement and GC33-11\n\nFresh Sol-high
binding evidence:\n- exact subject manifest:
9ec940be7b528fe9ed2181830d2261424af1865c2c4b9793d7f2c68158845790\n-
verdict.v2:
ef985788f1b28c66397a28e55e57cbaac620a51bdfad745812bcfe141df847f9\n- 8 of
8 criteria PASS, zero findings\n\nLocal gates:\n- 67 focused Python
tests\n- 25 of 25 bootstrap Bats cases\n- factory doctor\n- Python and
shell syntax\n- diff hygiene
## Outcome
Defines the GC 3.3 factory as one semantic intelligence loop with
deterministic delivery:
- Fable Mayor plus a bounded, nonbinding ambiguity adviser
- Sol-high for plan binding and fresh exact-subject validation
- Terra-high as the default writer and Opus 4.8 medium as explicit
overflow/repair
- Luna dormant and unroutable until later qualification
- no model-driven delivery-policy/refinery loop
- native GC sling/claim/scale-from-zero semantics retained
- exact provider/model/reasoning/fallback runtime attestation
- legacy composed program/refinery entry points and opposite-provider
lifecycle roles removed
Controller dispatch to the Fable adviser stays fail-closed until GC33-4
proves process/filesystem isolation. This does not claim that manual
operator sling to the named on-demand target is impossible.
## Evidence
Fresh Sol-high `verdict.v2`: PASS
(`bb31806fc5e0714363a9e539121ee7aa19231431fb04ddfee1fce8376b57d272`)
over subject manifest
`119b7a6db2380af47d87a24aced60d96858dd9e413a54dc640376e27767e8d1e` (52
paths, 18 deletions).
- focused acceptance: 124 tests PASS
- projection owner: 4 tests PASS
- bootstrap fixtures: 25 Bats tests PASS
- complete GC static contract: PASS
- factory/executor doctors: PASS
- generated projection check: PASS
- exact official GC v1.3.5 and Beads v1.1.0 provenance replay: PASS
- `git diff --check`: PASS
No city, model session, supervisor, tmux session, Dolt server, or canary
was started for this pre-canary bead.
## Summary
- pin the qualified AgentOps Gas City bootstrap to official Gas City
v1.3.5 and Beads v1.1.0
- materialize exact `gc`, `bd`, and repository-built `ao` binaries with
a portable identity receipt
- make bootstrap and teardown reject ambient substitution and persisted
identity drift
- prove repeat bootstrap projections and ownership-safe teardown
Bead: `ag-agentops-33-gc-refinery-4km81.2`
## Binding validation
Fresh Sol/high verdict: `PASS`
- verdict digest:
`abc7654f5e68d1d562a5e7b612d7d0cef3941f14bc7e02bbf22f4191a7f1c645`
- subject manifest:
`78011e248dda437bd0ac39a912cb6195df24d2789ed6c58016873f0f891775b2`
- exact changed scope: nine paths in `deploy/gc` and `tests/scripts`
A prior fresh verdict found that commit-only shallow fetches built Gas
City as `dev`. The repair now fetches and verifies each locked release
tag against the independently pinned commit before building. The prior
FAIL remains preserved as evidence.
## Checks
- real clean materialization: GC `1.3.5@8ffc009`, Beads `1.1.0@8e4e59d`,
receipt-bound AO source/tree/digest
- `37 tests, 0 failures` across toolchain, bootstrap, and teardown Bats
suites
- `bash -n deploy/gc/materialize-toolchain.sh deploy/gc/bootstrap.sh
deploy/gc/teardown.sh`
- `git diff --check`
No Gas City, Dolt, or suspended v17 city was started.
## Root cause (CI flake, run 29785505667 attempt 1, PR #944)
The bats test `adding only the temp-signal half to a file with an
EXISTING rename still trips` failed once on ubuntu with the ratchet
printing a clean `PASS … grandfathered=0` where the fixture
deterministically trips. Diagnosed by analysis per the test-isolation
discipline (not repro-chasing):
- bats errexit proves every fixture `git commit` succeeded; the fixture
repo is fully isolated.
- `grandfathered=0` in the PASS line fingerprints the run as in-fixture
(real repo = 4).
- Zero stderr in the captured output rules out every loud failure
handler.
What remains: **three silent paths where a scan helper (grep/awk/git)
dying under 4-way-parallel runner load reads as "no finding"** — the
gate then certifies an unchecked diff:
1. `file_trips`: strip/grep failure returned 1 ("does not trip") → file
silently skipped.
2. Detector loop read from `< <(ratchet_changed_files | sort)` — a
collector rc 2 inside process substitution is discarded, certifying an
EMPTY change set (the exact fail-open the ratchet-lib header warns
about).
3. `ratchet_added_hunk_matches`: helper death propagated as arbitrary
nonzero, swallowed by `|| continue`.
## Fix
- `file_trips` is tri-state (0 trips / 1 no / 2 refuse-to-certify,
loud); signal greps read full input (no `-q` early-exit) so pipefail can
never surface a SIGPIPE'd printf as a phantom failure on large files.
- Changed files are collected into a variable under pipefail with an
explicit `exit 2` handler.
- `ratchet_added_hunk_matches` maps fallback-grep/awk death to loud rc 2
(0/1 unchanged; existing `|| continue` consumers skip on 2 exactly as
before, now loudly).
- `compute_grandfather_set` aborts `--regenerate` on helper failure —
never a truncated grandfather list.
## Pinned
Dying-awk PATH-shim tests at gate and lib level: helper death is rc 2
"refusing to certify", never PASS. Same fail-closed class as the
pawl-refuted empty-stream certify (2026-07-10).
## Validation
- 58/58 in `check-atomic-write-ratchet.bats` + `ratchet-lib.bats` on
fresh origin/main
- All six ratchet-lib consumer gate suites green
- `shellcheck -S warning` clean; real-repo gate PASS (grandfathered=4);
`--regenerate` byte-identical
- 65 repetitions of the formerly-flaky test green
Residual: the external kill source is unprovable from one occurrence; a
recurrence now exits 2 naming the failed helper + file instead of
printing PASS.
## Summary
- pin and materialize an exact colocated Gas City and official Beads
toolchain without editing installed binaries
- add deterministic isolated bootstrap, recovery, teardown, exact
workspace binding, and tracked .gitignore preservation
- add bead-native Mayor, plan review, isolated Codex/Claude workers,
binding Validators, rejection-to-Mayor rescope, fenced Refinery,
integration validation, qualification, and protected PR delivery
- make the local quick release gate deterministic after CLI cleanup
## Validation
- fresh GC-managed Codex Sol verdict: PASS (verdict
d1a1e03808b4605e49cc97423c7570b04d581c9ee1fad9aa8f1daf6e72d6f0ef)
- focused GC executor/factory/projection suite: PASS (32 packet + 77
factory + 4 projection + 21 bootstrap tests, plus doctors and static
contracts)
- teardown suite: 7/7 PASS
- local-ci-fast: PASS
- exact v16 mixed-provider live canary: Terra and Opus 4.8 workers in
parallel, opposite-family candidate validators, Opus Refiner, Sol
integration validator, all lifecycle beads closed, clean managed
teardown
## Scope
The follow-on Fable 5 Mayor/Refiner, Sol-every-bead validation, and Luna
support-worker topology is deliberately not part of this historical v16
baseline; it will build on this foundation in a separate bead program.
## Doctrine flip: enforcement hooks on by default
Operator directive: hooks reach **every** user regardless of install
path. Injection hooks stay dead (#511, delta=0) — the
hookless-cold-start gate is untouched and passing.
### Delivery per install path
| Path | Delivery |
|---|---|
| Claude Code plugin (marketplace) | **Automatic** — new
`hooks/hooks.json` at plugin root; Claude wires the policy dispatcher on
install (`${CLAUDE_PLUGIN_ROOT}` paths, 10s timeout, Bash + Edit\|Write)
|
| npx skills / skills.sh copies | Skill package now carries its own
installer: `skills/cc-hooks/scripts/install-hooks.sh` (resolves
everything relative to the skill dir; works with no repo present) |
| git clone / brew | `scripts/install-policy-dispatch.sh` → thin
delegator to the skill-embedded installer |
### Also in this PR
- 4th registry policy `core.skills:edit-installed-copy` (Edit|Write,
`file_path`-only) — registry twin of the standalone guard, so dispatcher
users get the full protection set.
- Dispatcher hardening: malformed stdin now fully silent (fail-open,
zero stderr) — validator security-pass finding.
- README admission-control section; cc-hooks SKILL.md posture flip
(description, constraints, delivery table).
- Codex twin force-synced (incl. the new installer file), skill mesh +
catalog regenerated.
### Evidence
- 28/28 policy-dispatch bats (incl. plugin-layout registry-fallback
test); 16/16 on the injection-doctrine + standalone-guard suites.
- `ao gate check`: 28 pass / 0 fail on the exact subject.
- Fresh-context validation: first round returned FAIL (uncommitted regen
outputs + a stderr leak on malformed stdin) — repaired, amended,
re-validation in flight; merge follows a PASS verdict.
- Adversarial security pass on the dispatcher (it auto-activates for
plugin users): empty/malformed/1MB stdin, invalid registry, concurrent
fires — all fail-open, silent, correct.
Epic: age-4qw1 (H1/H2 landed previously as 0eaf21f0c). Out of scope:
Codex-plugin hook parity (follow-up on the epic).
Registers the fully-built-but-never-wired eval module into the CLI spine
and repairs its one real instrument bug. Three commits, RPI-shaped: wire
+ fix, drift guards + docs, fixture counts.
## What
- **`ao eval` joins the spine** (cmd/ao/eval_composition.go):
deterministic suite runs, run-record
compare/baseline/scorecard/coverage, locked Tasks, holdout scenarios,
suite A/B verdicts with power-derived n-required, and the holdout-safe
Outcomes projection. This is the operating contract's *Learn* seat — a
read/measure consumer of evidence. It reports numbers and owns no retry,
scheduling, promotion, or lifecycle authority. The retired Aliases/Bench
seats stay nil and their subcommands are omitted.
- **Instrument bug fixed**: both scenario-ab arms were corpus-denied at
runtime — the with-gold treatment was only a prompt injection through
the retired `ao lookup`, so the A/B silently guaranteed a zero delta.
Treatment is now environment-shaped: the with-gold arm runs with the
corpus readable, the control arm stays sandbox-confined (the fail-closed
empty-deny guard is untouched), and judges are always corpus-denied.
- **Schema drift guards**: a run record persisted by the production
writer must validate against eval-run.v1.schema.json (and the minimal
suite against eval-suite.v1.schema.json) — closing the same silent-fork
class the verdict.v2 golden corpus closed.
- **Hermetic test builds hardened**: keep the real HOME's Go caches
(TestMain isolation was forcing module re-downloads) and skip VCS
stamping.
- docs/architecture/go-cli.md gains the eval section; MIGRATION.md notes
`ao eval`'s return; COMMANDS.md, cli-surface, and surface counts
regenerated; new leaves carry honest allowlist reasons; new cmd/ao L2
tests drive eval run/compare/help through the full production wiring.
## Evidence
- Full cli suite 2,801 green; race green on cmd/ao + the eval island;
vet clean
- Full-tier gate: 65/66 on the penultimate commit; the single failure
(surface counts) is the final fixture commit, re-verified PASS
standalone — no other check reads those fixtures
- Fresh independent validation (Codex, frozen subject 86022a3c6, clean
tree at start and end): **OVERALL PASS**, 6/6 — including a live
end-to-end `ao eval run` producing a passing run record
- Rubric-relocation decision honored: true holdout rubrics live in the
external measurement register; the repo keeps only leak-guarded
projections
## Summary
- add a bead-native Gas City factory pack with Mayor, fresh plan review,
Codex/Claude Worker and Validator pools, and a fenced Refiner
- make the bead graph the sole work/lifecycle authority; JSON artifacts
are digest-bound evidence only
- isolate each experiment in its own branch, worktree, Git index, and
lease, then admit exact PASSed candidates to Refinery
- make lease, verdict, rejection, successor, assembly, reassembly, PR
landing, and partial closure transitions crash-replayable
- enforce fresh-worker rescope after FAIL/NOT_PROVEN and an atomic
max-attempt HOLD
- encode the operating contract, live canary, role archaeology, and Bun
Rust-port lessons in AgentOps docs
## Validation
- live GC canary: Claude Worker -> Codex Validator -> Claude integration
Validator -> Codex Refiner -> PR #916 -> landed
`b80a752aad3843af66160b08a823aaed57e07169`
- `./scripts/check-gc-executor.sh`: 20 packet tests, 29 factory tests, 4
projection tests, and 8 bootstrap Bats tests PASS
- both GC packs lint PASS
- Ruff, ShellCheck, Python compile, and generated projection checks PASS
- branch-built `ao gate check --fast`: 13/13 PASS
- branch-built `ao gate check --full`: 66/66 PASS
- independent fresh-context audit of exact head
`1b18cf663ece790a12cd840f6eed2856852c552f`: PASS
## Contract
The unit of work is the bead. The pack defines roles, prompts, commands,
and policy; it does not own a parallel pack/JSON lifecycle. A rejected
experiment must be terminal and closed before any Mayor rescope or
successor reduction can proceed.
## Summary
Closes the findings from the v3.3.0 release-viability audit of main.
**Surface truth (High):** `ao constraint`, `ao goals trace`, `ao session
memory`, and `ao skills edit` are production tombstones but
docs/cli-surface.md documented them as `public-tested`/`covered` (the
test binary keeps constraint live, and the generated doc reflected the
test build). Added `deprecated` allowlist rows, dropped the stale
constraint-subcommand rows, regrouped constraint with its tombstone
peers in the default spine, regenerated both surface projections, and
added `TestCathedralCutTombstonesSurvivePruning` pinning the invariant
that every Cathedral Cut verb keeps an executable tombstone.
**Installer hardening (Medium):** `install-bd.sh` now fails closed when
no published checksum exists for a release asset (explicit `--no-verify`
overrides), and the curl|bash path verifies the fetched
`installer-common.sh` against a pinned SHA-256 before sourcing it
(drift-guarded by a new install-bd.bats test).
**Docs (Medium/Low):** UPGRADING.md no longer links the MIGRATION-3.0.md
file the Cathedral Cut deleted; CHANGELOG 3.3.0 `### Removed` now names
`yield`, `constraint`, and the 3.2 `verify` front door and links the
MIGRATION.md map.
**Gate scripts (Low):** flywheel/provenance gate scripts build `ao` into
`mktemp -d` scratch dirs instead of fixed world-known /tmp paths
(symlink/TOCTOU on shared hosts).
**Bonus (surfaced by the push gate):** `scripts/lib/preamble.sh`
mis-resolved REPO_ROOT under git hook env (GIT_DIR without
GIT_WORK_TREE), which made `go.cli-architecture` refuse every
worktree-origin push touching `cli/cmd/ao/**`. Fixed by scrubbing the
hook-injected discovery env around the rev-parse.
## Validation
- `go build && go vet && go test ./...`: 5,085 tests green,
golangci-lint clean
- `ao gate check --fast`: 27/27 pass, including under simulated hook env
- bats install-bd suite 6/6 incl. new pin drift test; shellcheck clean
on all touched scripts
- markdownlint clean; doc-release gate passes; tombstone exit codes
verified on the built binary
## Summary
- replace removed nightly retrieval commands with the maintained smoke
fixture and focused retrieval coverage
- repair Windows smoke, workflow/actionlint, skill projections,
installer fixtures, and stale Cathedral Cut tests
- refactor verdict validation below the complexity budget while
preserving its error contract
- incorporate the pending cross-runtime hook projection already
represented in the repository manifest
## Validation
- `go test -race -shuffle=on ./...`
- full Bats suite: 874/874 passed
- `scripts/ci-local-release.sh --quick`
- `ao gate check --full --json --workflow-coverage
--require-workflow-parity`: 65/65
- `ao gate check --fast --json`: 43/43
This PR repairs the common causes represented by open nightly issues
#900, #901, #903, #909, #910, and #912. Those issues will be closed only
after the corresponding workflows pass on `main`.
---------
Co-authored-by: boshu <241868352+boshu2@users.noreply.github.com>
Co-authored-by: Test <test@test.com>
The project config (tracker pin) moved from .agentops/config.yaml into
.agents/ao/config.yaml; the no-tracked-agents gate now permits exactly that
one file and still rejects any other tracked or staged .agents state and any
broader gitignore re-include.
Co-authored-by: Cursor <cursoragent@cursor.com>
One canonical root for skill create/heal/audit. Mode routing table absorbs
all heal-skill triggers; every live consumer (gates seed, quality checks,
release scripts, bats, docs, catalogs, parity twins) updated to relocated
paths; all projections regenerated via owning commands.
Validated fresh: verdict PASS (e9b6cdb8), intent 26a4f2be, all five
acceptance scenarios re-executed by an independent context.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retire the 3.x plugin curl/PowerShell installers as tombstones, delete the
plugin-cache helpers, and rewire CI/doctor/conformance onto the canonical
checkout + ao skills link path. Keep install-bd and the opt-in operator scripts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Migrate SYSTEM and AGENTS-{WORKFLOW,CI,CODEX,RUNTIME} into docs owners,
retarget consumers, rewrite the split gate, and craft-densify AGENTS,
README, PRODUCT, and GOALS under the documentation authority graph.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bo