Remove fully-dead Go CLI packages and orphan files per the independently
validated keep/delete/extract manifest (docs/audits/gocli-dead-weight-manifest-2026-07-19.md).
D1 already extracted the two live slices (constraint-index -> internal/constraintindex,
RedactBytes -> internal/redact), leaving internal/search and internal/llm as pure
dead remainder with zero production importers.
Deleted whole packages: internal/search, internal/llm, internal/notebook
(sole importer was search/inject_run.go), internal/reviewerhealth,
internal/adapters/reviewerhealth (both reachable only via the orphan
cmd/ao/reviewer_health_composition.go), internal/canon and internal/vibecheck
(empty-package TestMain husks).
Deleted orphan cmd/ao helper files: reviewer_health_composition.go,
advertised_commands.go, shell_quote.go, beads_json_compat.go, template_detect.go,
federation.go (each entry symbol appeared in exactly one file; no cobra command
wired; command surface projections regenerate unchanged).
Deleted the 12 dead internal/ports groups (agent_mail, ci_status, citation,
context_compiler, corpus_reader, corpus_writer, finding_compiler dead portion +
inmemory_finding_compiler, finding_recurrence, freshness_policy, harness, llm.go,
wiki_index) with zero external ports.X references. finding_compiler.go is a
PARTIAL keep: DetectorReplayResult and DetectorPrecisionEvidence stay (the
Precision field type forces the transitive keep; DetectorReplayResult is consumed
by the surviving constraint-index slice). gate_runner.go, inmemory_gate_runner.go,
frontmatter_codec.go, and doc.go are untouched keeps.
EXCLUDED (live, do not delete): internal/evidence + the flywheel compute block,
live via the aliased import ratchet "…/internal/evidence" in flywheel_metrics.go.
Regenerated command-surface projections (cli/docs/COMMANDS.md,
docs/cli-surface.{json,md}, evals/agentops-core/cli-command-surface-matrix.json,
evals cli-command-surface-smoke.sh) via their owning commands
(generate-cli-reference.sh, regen-command-surfaces.sh,
check-cmdao-surface-parity.sh --write-surface); no drift — the deleted files
carried no command surface.
Pruned stale FILENAME-pinned entries (deleted files only, list-shrinks-only) from
scripts/.atomic-write-grandfather (llm/review.go, llm/session_writer.go,
search/findings_ops.go) and scripts/.jsonl-scanner-grandfather (notebook/notebook.go,
search/{index,learnings,search_cass,sessions}.go).
go build ./... && go vet ./... && go test ./... green (2587 tests).
go list -deps ./cmd/... contains none of the deleted packages.
ao gate check --full: 67 checks, 67 pass (after ratchet-baseline pruning).
Test-Removal-Reason: Every deleted *_test.go file was the test of code deleted in this same commit as dead weight per the validated dead-weight manifest (no live production consumer). Covers all removed tests under internal/search, internal/llm, internal/notebook, internal/reviewerhealth, internal/adapters/reviewerhealth, internal/canon, internal/vibecheck, internal/ports (the 12 dead groups + inmemory_finding_compiler + finding_compiler_shadow), and cmd/ao (template_detect, federation). No behavioral test coverage was lost — the subjects under test no longer exist.
Registers the fully-built-but-never-wired eval module into the CLI spine
and repairs its one real instrument bug. Three commits, RPI-shaped: wire
+ fix, drift guards + docs, fixture counts.
## What
- **`ao eval` joins the spine** (cmd/ao/eval_composition.go):
deterministic suite runs, run-record
compare/baseline/scorecard/coverage, locked Tasks, holdout scenarios,
suite A/B verdicts with power-derived n-required, and the holdout-safe
Outcomes projection. This is the operating contract's *Learn* seat — a
read/measure consumer of evidence. It reports numbers and owns no retry,
scheduling, promotion, or lifecycle authority. The retired Aliases/Bench
seats stay nil and their subcommands are omitted.
- **Instrument bug fixed**: both scenario-ab arms were corpus-denied at
runtime — the with-gold treatment was only a prompt injection through
the retired `ao lookup`, so the A/B silently guaranteed a zero delta.
Treatment is now environment-shaped: the with-gold arm runs with the
corpus readable, the control arm stays sandbox-confined (the fail-closed
empty-deny guard is untouched), and judges are always corpus-denied.
- **Schema drift guards**: a run record persisted by the production
writer must validate against eval-run.v1.schema.json (and the minimal
suite against eval-suite.v1.schema.json) — closing the same silent-fork
class the verdict.v2 golden corpus closed.
- **Hermetic test builds hardened**: keep the real HOME's Go caches
(TestMain isolation was forcing module re-downloads) and skip VCS
stamping.
- docs/architecture/go-cli.md gains the eval section; MIGRATION.md notes
`ao eval`'s return; COMMANDS.md, cli-surface, and surface counts
regenerated; new leaves carry honest allowlist reasons; new cmd/ao L2
tests drive eval run/compare/help through the full production wiring.
## Evidence
- Full cli suite 2,801 green; race green on cmd/ao + the eval island;
vet clean
- Full-tier gate: 65/66 on the penultimate commit; the single failure
(surface counts) is the final fixture commit, re-verified PASS
standalone — no other check reads those fixtures
- Fresh independent validation (Codex, frozen subject 86022a3c6, clean
tree at start and end): **OVERALL PASS**, 6/6 — including a live
end-to-end `ao eval run` producing a passing run record
- Rubric-relocation decision honored: true holdout rubrics live in the
external measurement register; the repo keeps only leak-guarded
projections
Fixes the three gremlins observed 2026-07-18 (bead
age-gate-scripts-worktree-gitdir-p62wo):
1. **Gate scripts broke under hook env from linked worktrees** (#919
regression): new scripts/lib/repo-root.sh (GIT_*-scrubbed resolution,
BASH_SOURCE anchor, worktree-correct) swept across 32 scripts. Proof:
this PR's own push ran the pre-push gates from a linked worktree and
passed.
2. **core.bare=true recurrence**: mechanism proven (leaked GIT_DIR +
no-arg git init --bare rewrites the SHARED config); writer traced with
high confidence to a live Gas City city process (concrete suspect:
gascity cmd_rig_test.go runGitInTest, unscrubbed env + no-arg init
--bare — fork-side fix filed separately). Defense: new
always.git-config-hygiene gate fails fast on core.bare/test identities
with the repair command inline (--self-test proves fail-closed).
3. **Test/test@test.com identity leak**: writer convicted — our own
pre-push chain leaked GIT_DIR into go test, whose helpers wrote the
shared config via git -C (mechanism proven). Cut at both ends:
validate-go-fast scrubs env for children; every test git-helper set-site
scrubs; check-test-isolation gains a WARN-ratchet rule (baseline 3 →
FAIL at 0).
Gates: shellcheck rc=0 across 36 scripts; go build/vet clean;
655+379+149 tests; hygiene self-test; both originally-failing validators
pass under the repro env.
Completes the Go CLI migration: one composition model, no tombstones, no
dead packages, hermetic tests, and a cross-language verdict contract
corpus. Net −88k lines.
## What
- **Tombstones + prune deleted**: the 21 registered 'Removed in the
Cathedral Cut' stubs, `zzz_default_spine.go`'s runtime prune, and the
~30 registered-but-pruned legacy command families are gone. The
registered tree IS the production tree; retired verbs fail with exit 1 +
a data-driven replacement hint pointing at docs/MIGRATION.md (now
covering nested verbs). Non-runnable parents reject unknown subcommands
instead of printing help with exit 0.
- **~35 unreachable packages deleted** (cliapp, canon, pawl-era verdict
parser, pool, harvest, knowledge, wiki engine, vibecheck, cli/embedded,
…) after import analysis + script/CI consumer verification. Retained
with named consumers: archcheck (arch gate scripts), eval island (rubric
schema drift guards), drwitness/drrebuild (witness-crosscheck).
- **Composition decision recorded**: single cmd/ao root +
internal/commands/<family> modules + clicontract; the never-adopted
cliapp.BuildRoot is removed. New overview: docs/architecture/go-cli.md
(repairs two broken links).
- **Hermetic tests**: flag_matrix_test.go builds the exec'd binary from
package source — the stale cli/bin/ao failure class is closed;
TestHermeticBinaryMatchesSourceSurface pins source↔binary
correspondence.
- **Verdict contract consolidated**: verification extracted from
status.go into cli/internal/verdictcheck; 19-case golden corpus
(tests/fixtures/verdict-contract) runs through Go + Python + JSON schema
via blocking gate `contract.verdict-corpus`. One divergence closed
(empty-string context ids now rejected by all three).
- **Fossil guard chains retired**: embedded-sync (mirror had zero
importers), retired-family compat baselines, dead
go_cli_compatibility.bats, stale gate globs/grandfather entries.
## Evidence
- Full-tier deterministic gate: **66/66 PASS** on the rebased tip (fresh
source-built binary)
- cli suite 2,795 tests green; race suite green on touched packages; vet
+ pinned golangci-lint clean
- Cathedral Cut conformance PASS; CLI reference/surface projections
regenerated and checked
- Independent cross-family validation (fresh Codex context, frozen SHA):
5/6 claims CONFIRMED; 6th NOT_PROVEN only due to sandbox networking (its
cached rerun of the same suite passed)
- Test-count decrease is deliberate and carried by a Test-Removal-Reason
trailer
## Summary
- add a bead-native Gas City factory pack with Mayor, fresh plan review,
Codex/Claude Worker and Validator pools, and a fenced Refiner
- make the bead graph the sole work/lifecycle authority; JSON artifacts
are digest-bound evidence only
- isolate each experiment in its own branch, worktree, Git index, and
lease, then admit exact PASSed candidates to Refinery
- make lease, verdict, rejection, successor, assembly, reassembly, PR
landing, and partial closure transitions crash-replayable
- enforce fresh-worker rescope after FAIL/NOT_PROVEN and an atomic
max-attempt HOLD
- encode the operating contract, live canary, role archaeology, and Bun
Rust-port lessons in AgentOps docs
## Validation
- live GC canary: Claude Worker -> Codex Validator -> Claude integration
Validator -> Codex Refiner -> PR #916 -> landed
`b80a752aad3843af66160b08a823aaed57e07169`
- `./scripts/check-gc-executor.sh`: 20 packet tests, 29 factory tests, 4
projection tests, and 8 bootstrap Bats tests PASS
- both GC packs lint PASS
- Ruff, ShellCheck, Python compile, and generated projection checks PASS
- branch-built `ao gate check --fast`: 13/13 PASS
- branch-built `ao gate check --full`: 66/66 PASS
- independent fresh-context audit of exact head
`1b18cf663ece790a12cd840f6eed2856852c552f`: PASS
## Contract
The unit of work is the bead. The pack defines roles, prompts, commands,
and policy; it does not own a parallel pack/JSON lifecycle. A rejected
experiment must be terminal and closed before any Mayor rescope or
successor reduction can proceed.
## Summary
Closes the findings from the v3.3.0 release-viability audit of main.
**Surface truth (High):** `ao constraint`, `ao goals trace`, `ao session
memory`, and `ao skills edit` are production tombstones but
docs/cli-surface.md documented them as `public-tested`/`covered` (the
test binary keeps constraint live, and the generated doc reflected the
test build). Added `deprecated` allowlist rows, dropped the stale
constraint-subcommand rows, regrouped constraint with its tombstone
peers in the default spine, regenerated both surface projections, and
added `TestCathedralCutTombstonesSurvivePruning` pinning the invariant
that every Cathedral Cut verb keeps an executable tombstone.
**Installer hardening (Medium):** `install-bd.sh` now fails closed when
no published checksum exists for a release asset (explicit `--no-verify`
overrides), and the curl|bash path verifies the fetched
`installer-common.sh` against a pinned SHA-256 before sourcing it
(drift-guarded by a new install-bd.bats test).
**Docs (Medium/Low):** UPGRADING.md no longer links the MIGRATION-3.0.md
file the Cathedral Cut deleted; CHANGELOG 3.3.0 `### Removed` now names
`yield`, `constraint`, and the 3.2 `verify` front door and links the
MIGRATION.md map.
**Gate scripts (Low):** flywheel/provenance gate scripts build `ao` into
`mktemp -d` scratch dirs instead of fixed world-known /tmp paths
(symlink/TOCTOU on shared hosts).
**Bonus (surfaced by the push gate):** `scripts/lib/preamble.sh`
mis-resolved REPO_ROOT under git hook env (GIT_DIR without
GIT_WORK_TREE), which made `go.cli-architecture` refuse every
worktree-origin push touching `cli/cmd/ao/**`. Fixed by scrubbing the
hook-injected discovery env around the rev-parse.
## Validation
- `go build && go vet && go test ./...`: 5,085 tests green,
golangci-lint clean
- `ao gate check --fast`: 27/27 pass, including under simulated hook env
- bats install-bd suite 6/6 incl. new pin drift test; shellcheck clean
on all touched scripts
- markdownlint clean; doc-release gate passes; tombstone exit codes
verified on the built binary
Ship the Cathedral Cut on the 3.x line with the intentional semver deviation documented for v3.3.0. Includes the complete release rebadge, release-gate artifacts, removed-command tombstones, and a legacy config read fallback that preserves existing settings when saving the new canonical path.\n\nValidated by the full local Go/release suite and all required GitHub checks on head 78027b009c.
## Summary
- replace removed nightly retrieval commands with the maintained smoke
fixture and focused retrieval coverage
- repair Windows smoke, workflow/actionlint, skill projections,
installer fixtures, and stale Cathedral Cut tests
- refactor verdict validation below the complexity budget while
preserving its error contract
- incorporate the pending cross-runtime hook projection already
represented in the repository manifest
## Validation
- `go test -race -shuffle=on ./...`
- full Bats suite: 874/874 passed
- `scripts/ci-local-release.sh --quick`
- `ao gate check --full --json --workflow-coverage
--require-workflow-parity`: 65/65
- `ao gate check --fast --json`: 43/43
This PR repairs the common causes represented by open nightly issues
#900, #901, #903, #909, #910, and #912. Those issues will be closed only
after the corresponding workflows pass on `main`.
---------
Co-authored-by: boshu <241868352+boshu2@users.noreply.github.com>
Co-authored-by: Test <test@test.com>
The project config (tracker pin) moved from .agentops/config.yaml into
.agents/ao/config.yaml; the no-tracked-agents gate now permits exactly that
one file and still rejects any other tracked or staged .agents state and any
broader gitignore re-include.
Co-authored-by: Cursor <cursoragent@cursor.com>
Intent snapshots and verdict artifacts now default to
.agents/ao/{intents,verdicts}/sha256/ so all session/evidence state lives
under .agents/ as the single agent-state root. Updates validate.py defaults,
ao init/status/demo, the cathedral conformance probe, craft_score.py digest
resolution, and every doc/skill mention. Existing artifacts migrated in
place; .agentops/ retains only the tracked project config.yaml.
Co-authored-by: Cursor <cursoragent@cursor.com>
One canonical root for skill create/heal/audit. Mode routing table absorbs
all heal-skill triggers; every live consumer (gates seed, quality checks,
release scripts, bats, docs, catalogs, parity twins) updated to relocated
paths; all projections regenerated via owning commands.
Validated fresh: verdict PASS (e9b6cdb8), intent 26a4f2be, all five
acceptance scenarios re-executed by an independent context.
Co-authored-by: Cursor <cursoragent@cursor.com>
The cathedral cut removed the script while the local pre-push hook still
invokes it, which blocked pushes of otherwise-valid commits.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retire the 3.x plugin curl/PowerShell installers as tombstones, delete the
plugin-cache helpers, and rewire CI/doctor/conformance onto the canonical
checkout + ao skills link path. Keep install-bd and the opt-in operator scripts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Migrate SYSTEM and AGENTS-{WORKFLOW,CI,CODEX,RUNTIME} into docs owners,
retarget consumers, rewrite the split gate, and craft-densify AGENTS,
README, PRODUCT, and GOALS under the documentation authority graph.
Co-authored-by: Cursor <cursoragent@cursor.com>
## Why
Every PR since #906 has run red on the same 5 checks (correctness
ubuntu+windows, go-gate-shadow, security, summary) — #906 and #907 both
merged with identical red sets. A permanently-red backstop is worse than
none: a real regression is invisible in the noise. This PR fixes every
class and makes green the expected state again.
## What (three commits)
**Wave 1 — the four red check classes** (each verified by running the CI
job's own command):
- **correctness/bats (138 CI-only failures, ~6 env mismatches)**: pawl
verdict-edge fail-closed fires without a trusted `ao` on PATH →
`PAWL_EDGE_FAIL_OPEN=1` on the bats step (the 3 fail-closed regression
suites opt back out); gtimeout probe crashing setup() on Linux; gawk \\"
bracket-expression warning corrupting jq assertions; ripgrep missing on
runners; teardown/skip-path exit codes; taxonomy fixture missing the
now-required observations field.
- **go-gate-shadow (8 full-gate failures → 0)**: #906 landed without a
heal/regen pass — pre/post-mortem pointer skills missing
`hexagonal_role`; codex twins/hashes drift; shrink-only grandfather
lists; evolve SKILL.md referencing 3 deleted scripts;
@covered-by/allowlist conflicts; 3 go.lint findings.
- **security (BLOCKED_HIGH → PASS)**: 3 false positives suppressed
per-finding with justification (gosec G122 on the dev-time arch checker;
2 semgrep mis-traces).
- **correctness/windows**: tests set HOME but Go os.UserHomeDir() reads
USERPROFILE on Windows → cross-platform setHome helper.
**Wave 2 — 18 residual bats failures across 13 files**, each first
proven identical on pristine origin/main (differential run) before
fixing. Content drift (README golden-path literal, discovery references,
bootstrap↔install-bd wiring, pawl-review reachability via council, rpi
helper-rung tokens), validator regressions (validate-codex-rpi-contract
resolver routing, em-loop labels, goal-design fixture), and stale tests
updated only where provably behind a deliberate change (catalog
schema_version pin 1→2, SHA-pinned action regex, retired perf scenario,
drained dangler pin 2→0, tagged-ao test build).
**Commit 3**: the `ao skills unlink` train that landed on main mid-work
re-reddened security with the same semgrep value-struct FP — suppressed
like its skills_link sibling.
## Verification (rebased onto current main tip)
- `ao gate check --full`: **92/93 pass, 0 fail** (1 expected AP7 skip)
- `security-gate.sh --mode quick`: **PASS**
- `go vet` clean; **11,878 Go tests green** (149 packages)
- All 13 wave-2 bats suites **0 not-ok**; CI-sim (no-ao PATH) bats clean
on wave-1 suites
- Windows fix verified via GOOS=windows build+vet (needs the
windows-latest job for final confirmation)
**Acceptance: this PR's own validate.yml run going green.**
Bead: age-htrqp
---------
Co-authored-by: boshu <241868352+boshu2@users.noreply.github.com>
The integration net (FU1 capstone) over the five fresh-install staleness
classes fixed by sibling beads. Consumes the product the way a new user
receives it — clean HOME, fresh non-agentops git project, ao binary, offline
Codex bundle — and exercises first-run so the class cannot regrow:
- scripts/fresh-install-conformance.sh: build/acquire ao (tree default,
--release-tarball mode for the published binary, loud SKIP offline), install
the Codex bundle offline (AGENTOPS_BUNDLE_ROOT), then assert against the REAL
binary output: every quick-start-advertised `ao` command resolves against the
capability contract (extends #907's cobra-tree guard to the integration
level), every /skill mention exists in the installed bundle or repo skills/,
pristine-install `ao doctor` exits 0 with no warnings and names no
repo-relative script fix, and installer skill counts agree
(disk==meta==package_count==printed, the 66-vs-62 class). PASS/FAIL per
assertion + summary table; nonzero exit on any FAIL.
- .github/workflows/fresh-install-conformance.yml: tree-conformance
(ubuntu+macos) on push-to-main paths-filtered + nightly + dispatch;
release-conformance against the published asset on release/dispatch.
- tests/scripts/fresh-install-conformance.bats: proves the harness actually
catches a missing advertised command and a repo-relative doctor fix, passes
on a consistent binary, and loud-SKIPs offline — all offline via a fake ao.
Adopts scripts/lib/preamble.sh; relaxes set -e for record-and-continue.
shellcheck -S warning clean.
Ban CLAIMS of proven/automatic knowledge compounding (unproven — ADR-0004,
ADR-0011) and hookless-3.0-violating 'session hooks' language (docs/3.0.md,
ADR-0009) from user-facing CLI strings + seed/template assets. The claims kept
regrowing (#907, FU4 diet commit) because nothing gated them.
- docs/contracts/forbidden-claims.yaml: seeded lexicon (regex + rationale +
allowed_contexts). Tight patterns require an automatic/every-session qualifier
so the conditional escape-velocity model and the 'flywheel' subsystem name are
NOT banned; the honest 'whether the corpus compounds is unproven' never matches.
- scripts/check-honest-voice.sh: scans cli/cmd + cli/internal Go (excl. *_test.go)
+ seed/template assets; honest-voice:allow suppression; exit 1 naming
phrase+file+line+rationale. Registered contract.honest-voice in the Go gate
registry (Fast|Full, blocking) routed on cli/**, the lexicon, and self-ref.
- cli/cmd/ao/seed.go: sweep — rewrote the stale 'ao init --hooks / session hooks /
knowledge compounds automatically' next-steps + decision-record template to
honest hookless phrasing.
- tests/scripts/check-honest-voice.bats: proves fail on a seeded phrase, pass on
the current tree, suppression, test-file exclusion, and the flywheel/conditional
false-positive guard.
Installers now prove their claims before printing success: the installed
skill directory count, the manifest count `ao doctor` reads, and the
recorded metadata skill_count must all agree, the config-enable entry
must be present, and a sentinel skill must be readable. On any mismatch
the installer exits nonzero naming the delta instead of declaring
victory over a broken state.
Root cause of the audit's "install metadata says 66 skills but manifest
says 62": install-codex-plugin.sh counted on-disk SKILL.md directories
(66) and wrote that into install metadata, while `ao doctor`
(ReadCodexManifestSkillCount) reads the manifest's package_count and
falls back to len(skills[]) = 62 (implementation rows only) when
package_count is absent/stale. The two numbers came from independent
sources with nothing reconciling them. The new self-test computes the
count doctor will use (package_count, else len(skills[])) and refuses to
report success unless disk == manifest == metadata — closing the gap at
the true source rather than papering over it.
- install-codex-plugin.sh: manifest_doctor_count() mirrors doctor;
selftest_codex_plugin() enforces the three-way count identity + config
+ sentinel; success line -> "Verify it worked: restart Codex, /plan".
- install-opencode.sh: AGENTOPS_BUNDLE_ROOT local-source mode (offline);
self-test on linked-vs-source count + plugin link + sentinel.
- install.sh: AGENTOPS_BUNDLE_ROOT local-source mode; orchestrator
self-test tail; fix empty-array expansion under set -u on bash 3.2
(reachable now that local-source mode runs this path offline).
- install-agy.sh: self-test on plugin registration + sentinel skill.
- tests/scripts/installer-selftest.bats: offline coverage incl. the
seeded 66-vs-62 stale-manifest fixture that must fail, and a legacy
no-package_count-but-consistent manifest that must pass (doctor parity).
.ps1 parity (install-codex.ps1/install-ao.ps1) deferred: same latent
divergence exists but no pwsh on the dev host to verify; shipping
untested Windows installer code would undercut the first-run-trust goal.
Remove the vestigial in-repo homebrew-tap/Formula/agentops.rb (frozen at
version 2.31.0 + license MIT while the repo is 3.2.0 / Apache-2.0); the live
tap is generated by GoReleaser into boshu2/homebrew-agentops. Replace the tap
README with a pointer that documents this and forbids re-adding a formula.
Make the .goreleaser.yml archive files: list explicit (README.md, LICENSE,
CHANGELOG.md) so the packed README always matches the tagged commit rather than
relying on GoReleaser defaults.
Add scripts/check-release-parity.sh: asserts (a) tarball README sha256 == repo
README, (b) any in-repo formula license == LICENSE (Apache-2.0), (c) any in-repo
formula version == release tag. Wired into .github/workflows/release.yml as a
post-build gate over each dist/ tarball. Fixture-based bats coverage in
tests/scripts/check-release-parity.bats (red on stale README / wrong license /
stale version, green on parity).
Bo