3 Commits

Author	SHA1	Message	Date
Bo	1f0e545a51	Executable spec layer (epic soc-58nt, F2–F5): GOALS as BDD acceptance criteria (#292) ... * feat(goals): F2.0 scenario-result artifact contract + producer/writer bead: soc-58nt.2.6 * docs(goals): F4.0 trace link convention ADR-0005 bead: soc-58nt.4.8 * docs(goals): F3.0 domain-slice manifest contract + ADR-0004 bead: soc-58nt.3.8 - schemas/domain-slice-manifest.v1.schema.json: JSON Schema (draft/2020-12, additionalProperties:false) for domain-slice manifests. All required fields: domain, version, bounded_context, directive_ids (d-<slug> pattern), scenario_ids, context_roots, allowed_read_globs, denied_read_globs, validation_commands, owner. - docs/adr/ADR-0004-domain-slice-manifest-contract.md: records four decisions: (A) command shape is ao rpi phased --domain <name>; (B) manifest is durable tracked artifact at docs/domains/<name>/manifest.yaml; (C) reconciles with the domain skill (vocabulary), context-map.md (architecture view), and skill frontmatter — no overlap; (D) Go model named domainSliceManifest, explicitly distinct from rpi_phased_manifest.go's phaseManifest. Cross-references ADR-0003. - docs/domains/README.md: explains the directory, field table, relationship to the three pre-existing domain surfaces, and how to add a new slice. - docs/domains/example/manifest.yaml: fully populated example; validated against the schema via jsonschema (PASSED). * feat(goals): F2.1 scenario-result aggregation reader bead: soc-58nt.2.1 * feat(rpi): F3.1 domainSliceManifest model + loader Implements the domainSliceManifest Go model and loader in cli/internal/domainslice/ per the F3.0 contract (ADR-0004, Decision D). Uses gopkg.in/yaml.v3 with KnownFields(true) to reject unknown fields, mirrors the schema's additionalProperties:false. Validates all required fields, directive_id pattern (^d-[a-z0-9][a-z0-9-]*$), context_roots minItems:1, and validation_commands sub-fields with field-named errors. Explicitly distinct from phaseManifest (rpi_phased_manifest.go). 28 tests pass (L1 unit + L2 fixture round-trip via docs/domains/example/manifest.yaml). bead: soc-58nt.3.1 * feat(goals): F4.1 read-only executable-spec trace graph walker bead: soc-58nt.4.1 * feat(goals): F2.2 per-directive scenario_satisfaction + threshold verdict bead: soc-58nt.2.2 * feat(rpi): F3.2 ao rpi phased --domain scoping bead: soc-58nt.3.2 * feat(goals): F4.2/F4.3 ao goals trace --from / --orphans beads: soc-58nt.4.2 soc-58nt.4.3 * feat(goals): F4.4 ao goals render — GOALS.md to Gherkin bead: soc-58nt.4.4 * feat(rpi): F3.3a domain-scope audit evidence bead: soc-58nt.3.3 * feat(goals): F2.3 scenario_satisfaction JSON field + --scenarios-only Per-directive scenario satisfaction added to ao goals measure: 0 -> 8 new JSON fields and a --scenarios-only mode that skips gate execution. bead: soc-58nt.2.3 * feat(rpi): F3.4 ao rpi phased --scaffold-domain bead: soc-58nt.3.4 * test(goals): commit missing goals-trace scenario-results fixture The F4.1/F4.2 walker tests reference a scenario-results.json fixture under a gitignored .agents/ subpath; it was never force-added and a clean checkout (and CI) lacks it, failing 5 scenario_result tests. Force-add it. bead: soc-58nt.4.1 * fix(goals): F4.1 tighten goalstrace scenario-claim heuristic bead: soc-58nt.4.9 - Tighten scenarioTokenRe: auto- tokens now require at least two hyphen-separated slug segments (auto-X-Y…), so single-word English compounds like auto-merge and auto-update are no longer matched. - Downgrade broken_bead_scenario_claim from error to warning when the claim comes from a heuristic (ConfidenceLow) free-text match; per ADR-0005 §4.1 only an explicit Scenarios: line constitutes a broken explicit link and may produce an error. - Add beads_test.go with table-driven tests covering: English auto-* false-positive rejection, real multi-segment auto-* ID detection, explicit missing scenario → error, heuristic missing → warning only, resolvable scenario → no defect, end-to-end Walk with auto-merge bead produces no error-severity finding. * test(goals): F2.T1 regression-coverage audit + gap fill bead: soc-58nt.2.4 * ci(goals): F1.6 wire executable-spec link lint + trace-orphans (warn-first) bead: soc-58nt.1.9 * feat(rpi): F3.3b runtime hook enforcement of domain scope bead: soc-58nt.3.9 * test(goals): F2.T2 e2e script for scenario-satisfaction gate bead: soc-58nt.2.5 * docs(goals): F5.0 re-steer policy + mutation-safety contract (ADR-0006) bead: soc-58nt.5.9 * docs(goals): fix streak-reset prose in ADR-0006 (cleanup) bead: soc-58nt.5.9 [no-sibling] prose fixup only, no structural change 0 → 0 schema fields changed * test(goals): F4.T1 regression-coverage audit + gap fill bead: soc-58nt.4.6 * feat(wiki): land wiki bounded context waves 1-4 (epic soc-behj) Phased strangler consolidating ao's .agents/-touching logic into one cli/internal/wiki bounded context. Each wave gated by the 102 cmd/ao integration tests staying green; legacy command surface untouched. - W1 soc-1lju FrontmatterCodec — all 5 frontmatter parsers delegate - W2 soc-36lw CorpusLocator — agentsDirIn moved, 17 call sites migrated - W2 soc-f4tr Artifact + Claim domain types with subtype invariants - W3 soc-vot0 persistent WikiIndex — JSONL, incremental by content-hash - W3 soc-r08p FreshnessPolicy — claim-level evidence-driven freshness - W4 soc-ijp8 WikiPipeline — subsumes llmwiki loop, 3 stages wired - W4 soc-q50a port conformance suite Also anchors .gitignore's bare wiki/ pattern with a !cli/internal/wiki/ negation — the new package was being silently ignored. Wave 5 (ao wiki command group) is not included in this commit. * test(goals): F4.T2 e2e script for trace chain bead: soc-58nt.4.7 * test(rpi): F3.T1 regression-coverage audit + gap fill bead: soc-58nt.3.6 * test(rpi): F3.T2 e2e script for domain-scoped RPI bead: soc-58nt.3.7 * feat(goals): F5.1 verdict ledger schema + writer bead: soc-58nt.5.1 * feat(goals): F5.2 re-steer policy engine + verdict-ledger producer hookup bead: soc-58nt.5.2 * feat(goals): F5.4 feedback-to-learning compiler Adds cli/internal/feedbackcompiler — scans the verdict ledger for fail->pass directive transitions and drafts a learning entry in docs/learnings/ for each transition found. Drafts carry status: draft and directive_id frontmatter (ADR-0005 §2.6). Never auto-promotes. Idempotent: skips existing drafts on re-run. Also documents the auto-draft workflow in skills/forge/references/feedback-compiler-drafts.md with a compact reference-link in skills/forge/SKILL.md (under 248-line limit). Synced to skills-codex/forge/ and regenerated codex hashes. bead: soc-58nt.5.4 * docs(goals): F5.5 compound-engineering retro in /post-mortem Extend the /post-mortem skill with a Compound-Engineering Retro section that compares iteration N vs N-1 for a domain slice using the F5.1 verdict ledger (.agents/goals/verdict-ledger.json). The mode emits a comparative delta — directives that improved (fail→pass, satisfaction up), regressed (pass→fail, satisfaction down), or held stable — plus learning yield since N-1, written as a status:draft learning to .agents/learnings/. Detailed step-by-step procedure (CE.0–CE.5) lives in references/compound-engineering-retro.md; SKILL.md carries a compact trigger/commands summary and links to it. Both files synced to skills-codex/post-mortem/ with updated codex hashes. bead: soc-58nt.5.5 * feat(goals): F5.3 ao goals steer --auto with human-gated confirmation bead: soc-58nt.5.3 * test(goals): F5.T1 regression-coverage audit + gap fill bead: soc-58nt.5.7 * test(goals): F5.T2 e2e script for auto re-steer bead: soc-58nt.5.8 * docs(goals): F2.4 docs regen for scenario-satisfaction gate + epic CLI artifacts Regenerate cli/docs/COMMANDS.md and registry.json from a clean worktree at HEAD so the soc-58nt command surface is documented without leaking unrelated peer WIP into the generated docs. F2 (soc-58nt.2.7): document scenario_satisfaction JSON shape, --scenarios-only, result-artifact resolution, and exit codes in skills/goals/SKILL.md + references/executable-spec-chain.md; cross-ref ao goals measure/trace from skills/scenario/SKILL.md. Epic-wide artifacts also landed here because they regenerate atomically across F2-F5: COMMANDS.md/registry.json (all new ao goals/rpi surface), cli-skills-map heading count, skills-codex hashes, ADR-0004/0005/0006 documentation-index links, and the F2-F5 e2e CI lanes in validate.yml. ao capabilities and ao robot-docs need no manual edits — both build their command/flag surface from the live cobra tree, so new commands register automatically (Global Rule G5 satisfied by construction). bead: soc-58nt.2.7 * docs(domain): F3.5 domain-as-loop docs for domain-scoped RPI Document the domain-slice runtime in skills/domain/SKILL.md (a "Domain as a scoped RPI loop" section connecting the Slice primitive to ao rpi phased --domain / --scaffold-domain / --force) and add the Domain-Slice row to the modes table in skills/scaffold/SKILL.md, mirroring the existing Project/ Component/CI mode-row shape. The scaffold skill's Domain-Slice Mode section already covered the workflow; this lands the missing modes-table entry so the mode count is 3 -> 4. The COMMANDS.md/registry/CI-lane regen for F3 landed in soc-58nt.2.7. skills-codex hashes for the two changed skills refreshed via scripts/regen-codex-hashes.sh; codex-parity audit clean. bead: soc-58nt.3.5 * docs(goals): F5.6 re-steer loop docs in /post-mortem Cross-reference the auto re-steer loop from the Compound-Engineering Retro section of skills/post-mortem/SKILL.md: when the compound retro names a chronically regressing directive, ao goals steer recommend prints policy-driven directive mutations from the same verdict ledger and ao goals steer apply writes the mutation to GOALS.md, human-gated via the non-lossy patcher (ADR-0006). Mirrors the existing "closing the loop" cross-ref shape used elsewhere in the skill's See Also prose. The ao goals steer recommend/apply COMMANDS.md surface, the F5 e2e CI lane, and the ADR-0006 documentation-index link landed atomically in soc-58nt.2.7's epic-wide regen; the re-steer contract detail lives in skills/goals/references/executable-spec-chain.md (also in 2.7). skills-codex/post-mortem hash refreshed; codex-parity audit clean. bead: soc-58nt.5.6 * docs(goals): F4.5 docs regen for goals trace + render (epic-subsumed) F4's docs deliverables — the `ao goals trace` and `ao goals render` entries in cli/docs/COMMANDS.md, the F4 trace-chain e2e CI lane in validate.yml, the ADR-0005 documentation-index link, and the Trace/Render mode sections plus the trace contract in skills/goals/SKILL.md + references/executable-spec-chain.md — all co-landed atomically in soc-58nt.2.7's epic-wide CLI-reference regen (commit 37798abe), because COMMANDS.md/registry.json regenerate as one unit across F2-F5 and cannot be split per-bead. This empty commit records soc-58nt.4.5 as complete with no further file changes. Matches the epic-subsumed-bead convention: regen artifacts land once, later beads point at the lead regen commit. bead: soc-58nt.4.5 * test(goals): fix flag-global leak breaking full goals-measure run TestGoalsIntegration ran 'goals measure --directives' via cobra, which sets the package-global goalsMeasureDirectives and never resets it. soc-58nt's new TestGoalsMeasure_FullMode* tests branch on that global, so the unfiltered 'go test ./cmd/ao/...' run failed (gates skipped, directives array emitted instead of the full snapshot+scenarios object). -run filters masked it. Restore the global after Execute. bead: soc-58nt.2.4 * fix(ci): correct soc-58nt skill/codex artifacts and CI-policy parity Resolves 6 red CI checks on PR #292 (crank/soc-58nt) after merging main: - skill-integrity: reword the "no scaffold subcommand" note in skills/scaffold/SKILL.md so it no longer trips the heal INVALID_AO_CMD substring check; copy skills/forge/references/examples.md into skills-codex/forge/references/ so the codex forge dead-link clears. - validate-codex-generated-artifacts: strip leaked non-Codex frontmatter from skills-codex/forge/SKILL.md down to name + description. - validate-codex-runtime-sections: remove the residual mixed-runtime "Cross-vendor analog" line (Anthropic Managed Agents) from codex forge; convert /forge slash-command refs to $forge Codex invocation style. - validate-ci-policy-parity: add executable-spec-link-integrity (non-blocking) to the AGENTS.md non-blocking list so it matches the workflow's continue-on-error classification (warn-only F1.6 gate added by soc-58nt without parity co-update). - doc-release-gate: the link-validation broken link was the same codex forge references/examples.md dead link, fixed above. - agentops-contract-canaries: update the cli-command-surface canary fixture + eval JSON for the 185->187 / 257->259 subcommand count after soc-58nt added `ao goals render` and `ao goals trace`. Also ports the soc-58nt "Closing the loop with re-steer" paragraph into skills-codex/post-mortem/SKILL.md and regenerates codex artifact hashes and registry.json after the merge. * fix(test): set repo-local git identity in rpi-phased-domain e2e CI runners have no global git identity; the temp-repo 'git commit' in the F3.7 e2e exited 128 (empty ident name). Configure a repo-local identity. bead: soc-58nt.3.7 * fix(goals): use canonical practice slug bdd-gherkin soc-58nt files cited the practice slug 'bdd'; the canonical slug in PRACTICE-REGISTRY.md is 'bdd-gherkin'. Clears the practice-citations advisory check (9 invalid slug citations -> 0). bead: soc-58nt.2.7 * fix(goals): add missing practices field to F5 gap-test file goals_steer_auto_gap_test.go lacked a // practices: header; the practice-citations --strict gate flags missing fields. Matches its sibling goals_steer_auto_test.go. bead: soc-58nt.5.7 * fix(security): resolve gosec G122 + golangci-lint errcheck/staticcheck HIGH findings Drive scripts/security-gate.sh --mode quick to 0 HIGH findings. gosec G122 (CWE-367 TOCTOU): goalstrace/artifacts.go reads files inside a filepath.WalkDir callback via an os.Root-scoped handle (os.OpenRoot), closing the check-to-use window and blocking symlink escape. golangci-lint errcheck (~25): unchecked defer Close / os.Remove returns. Resource-cleanup closes use explicit-ignore (defer func(){ _ = X.Close() }()). Durability-gating closes before a rename (llm/review.go tmp.Close) are checked and wrapped. golangci-lint staticcheck (~21): ST1005 (drop trailing punctuation from error strings), QF1001 (De Morgan's law), QF1002 (tagged switch), QF1012 (fmt.Fprintf over WriteString+Sprintf), S1016 (struct-literal -> conversion), S1017 (strings.TrimSuffix), S1040 (drop redundant type assertion), SA1012 (context.TODO over nil Context), SA4032 (drop dead GOOS branch under build constraint), SA9003 (remove empty branch). * ci(security): make security-toolchain-gate blocking Remove continue-on-error: true from the security-toolchain-gate job and drop the "(advisory)" name suffix so a CRITICAL/HIGH security-gate finding fails the validate summary job. The job is already in summary.needs, so removing continue-on-error promotes it into the contains(needs.*.result,'failure') fail-set. AGENTS.md: drop security-toolchain-gate from the (non-blocking) prose list and the Advisory Job Triage SLA table; update its CI-jobs-table row to describe the blocking failure mode. validate-ci-policy-parity confirms the AGENTS blocking set matches the workflow summary fail-set (7 non-blocking). --------- Co-authored-by: Codex <codex@example.invalid>	2026-05-17 15:31:15 -04:00
Bo	d8c50a9679	Improve Go path consistency and formatting (#224)	2026-05-03 08:01:04 -04:00
Boden Fuller	729eaf2783	feat(shellutil): sanitize bash invocations to bypass user shell aliases ... Adds cli/internal/shellutil package with: - SanitizedBashCommand(ctx, script) — bash --noprofile --norc -c with BASH_ENV and ENV stripped from the environment. - SanitizedEnv(env) — exported for composition. Wires two goals-package callsites through the helper: - MeasureOne (cli/internal/goals/measure.go) — user-authored goal check strings run via bash -c and could be silently rewritten by aliases defined in BASH_ENV + shopt -s expand_aliases. - AddGoal dry-run check (cli/internal/goals/commands.go). New tests cover env filter correctness, flag shape, BASH_ENV stripping from cmd.Env, context cancellation, and a regression guard that writes a real BASH_ENV rcfile aliasing echo -> 'printf HIJACKED' and asserts the alias does NOT leak into the sanitized command. Consumes swarm-post-mortem-findings 'Sanitize agent shell environment to bypass aliases'.	2026-04-15 15:53:15 -04:00