mirror of
https://github.com/boshu2/agentops.git
synced 2026-09-14 15:08:13 +08:00
ao-pre-reduction@5b334a13f
58 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Bo
|
b008e22f9b |
feat(domain): name silent-contract-violation + verdict.v1 finding taxonomy (ag-twl8 #verdict-category-taxonomy) (#759)
## What First slice of the RubricRefine integration epic (**ag-5elx**). Moves the paper's sharpest idea into the verification membrane — and it's the dependency that **blocks the flagship** pre-execution gate (ag-rjvf). - **`skills/domain/references/silent-contract-violation.md`** — new draft anti-pattern entry. Names the failure class the whole membrane exists to catch: tool-use code that **runs clean, raises no exception, and is still wrong** (wrong routing, mismatched output shape, broken argument provenance). Full Signature / Cost / Cause / Refusal + `bd` incident citation, indexed in `INDEX.md` under a new "Verification membrane concepts" section. - **`schemas/verdict.v1.schema.json`** — adds RubricRefine's 4-category contract-check taxonomy as an **optional** `category` enum on findings: `tool-choice | output-contract | call-signature | data-provenance`. Backward compatible — existing uncategorized findings stay valid (`additionalProperties:false` preserved), an unknown category is rejected so the taxonomy can't drift. - **`tests/scripts/check-verdict-category-taxonomy.bats`** — behavioral schema tests via python `jsonschema` (valid accepted · all four accepted · omit valid · unknown rejected · enum exact). Written test-first: confirmed failing against the unmodified schema, then green. - **`registry.json`** — regenerated (domain `reference_count` 18→19; scope-only diff). ## Why RubricRefine (Anduril, arxiv 2605.09730v3) formalizes the failure AgentOps' no-self-grade membrane targets, but AgentOps had no name for it and no shared bucket vocabulary for findings. This slice supplies both, so every downstream gate (and the pre-execution gate ag-rjvf) can categorize and ablate contract violations. ## Verification - `bats tests/scripts/check-verdict-category-taxonomy.bats` → 5/5 (CI runs it via the bats job; surfaces changed: schemas/skills/docs/bats). - `scripts/generate-registry.sh --check` → up to date. - `scripts/check-bead-scenario-coverage.sh --run` → PASS (1/1 scenario covered & passing). - Full `pre-push-gate.sh --fast`: green except `corpus-freshness` (env-local snapshot 8d old; CI sets `AGENTOPS_CORPUS_FRESHNESS_SKIP=1` — not a PR blocker). Closes-scenario: ag-twl8#verdict-category-taxonomy Bounded-context: BC1-Corpus Evidence: schemas/verdict.v1.schema.json |
||
|
Bo
|
853d781e66 |
feat(memory): inject canon memory during session bootstrap (#740)
## Summary Implements ag-11bi W2.3 canon-gated T2 bootstrap memory for `ao session bootstrap`. - Selects only canon-promoted established learnings plus high/critical severity canon anti-patterns from `.agents/canon/learnings`. - Ranks by `utility * confidence * freshness`, caps selection at 1200 estimated tokens, and warns on stderr when eligible canon memory exceeds the cap. - Computes reach through the existing search reach helper, so established canon memory surfaces as `reach=always` without author-set reach. - Emits the memory payload in JSON/robot output and prints selected memory in the default human bootstrap output. - Extends `schemas/session-bootstrap.v1.schema.json` and tests the filter, budget, warning, and human-output paths. ## Validation Focused checks: - `go test ./cmd/ao -run 'TestSessionBootstrap'` - `go test ./internal/search ./internal/types` - `git diff --check` - `python3 -m json.tool schemas/session-bootstrap.v1.schema.json` Required regen: - `bash scripts/regen-all.sh` regenerated artifacts but exited on the known CMDAO `wiki query` parity red. Required pre-push after rebase: - `PRE_PUSH_FAIL_FAST=false bash scripts/pre-push-gate.sh` completed with 4 known non-diff failures: - test-fixture parity: `scripts/gc-stale-worktrees.sh` - worktree disposition: canonical root dirty/untracked operator state - corpus freshness: newest local snapshot older than threshold - contract canaries: known `agentops-core.pre-push-gate-governance` Bats failure Diff-relevant gates passed in the pre-push run, including changed-scope Go race tests, command/test pairing, goals validate, registry drift, CLI docs parity, command-surface matrix canary, schema checks, CI policy parity, and shellcheck. ## Review Ask Requesting cross-model ACK/AMEND/BLOCK before merge. Primary attacks to run: - Does any non-canon or candidate/provisional learning enter bootstrap memory? - Can the 1200-token cap be bypassed or hidden from callers? - Does the default human path actually expose the selected memory, not just JSON? - Is the generated CLI-surface drift acceptable as regen output on this branch? No self-grade for merge. |
||
|
Bo
|
6c8cb223ea |
feat(corpus): add reach blast-radius tier {bead|pull|always} (ag-bsf6 #reach-field) (#721)
W2.1 of epic ag-lhu0 (memory-system re-architecture). Adds the **reach**
blast-radius axis, orthogonal to maturity, per the locked duel
architecture.
- `reach {bead|pull|always}` on FrontMatter + Learning; `reach:`
frontmatter round-trips.
- `SanitizeReach` normalizes + defaults absent/invalid → `pull`, and
**never** promotes to `always` (the computed-not-authored invariant —
`always` is derived from maturity==established ∩ canon in ag-oqha).
- `learning.v1.schema.json`: reach enum + default pull; domain vocab
`skills/domain/references/reach.md`.
- Tests: SanitizeReach + frontmatter round-trip/default (88 search-pkg
tests green).
Closes-scenario: ag-bsf6#reach-field
Bounded-context: BC1-Corpus
Evidence: cli/internal/search/learnings.go
|
||
|
Bo
|
ab138a5418 |
feat(skills): add scan_descriptions --probe deterministic trigger ranker (ag-7led #trigger-probe) (#722)
## Summary Adds a `--probe "<phrase>"` mode to `skills/skill-builder/scripts/scan_descriptions.py` that ranks every skill against a lexical trigger phrase **deterministically** (no live model, byte-stable output). Introduces an optional `trigger_probes:` skill-frontmatter field so a skill can self-declare phrases it must rank #1 for; the probe asserts the declaring skill wins its own phrases against the corpus. Epic: ag-czzf. **INFORMATIONAL-only tooling — not a blocking gate.** The probe is a self-check authors can run; no CI gate is wired to it. ## Changes - `skills/skill-builder/scripts/scan_descriptions.py` — `--probe` ranker + `trigger_probes` parser (flow + block YAML forms). - `schemas/skill-frontmatter.v2.schema.json` — optional `trigger_probes` array field. - `tests/scripts/scan-descriptions-probe.bats` — 4 scenarios (rank-#1, determinism, demotion-on-mutation, usage-error exit codes). ## Validation - New bats suite: 4/4 pass. - `scripts/pre-push-gate.sh` reds are pre-existing main-red (context-packet-ab canary + its downstream pre-push-gate-governance nested bats), not caused by this diff; CI is changed-files-scoped. Closes-scenario: ag-7led#trigger-probe Bounded-context: BC2-Validation Evidence: skills/skill-builder/scripts/scan_descriptions.py --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
Bo
|
a36abd3675 |
chore(provenance): align relation enum to W3C PROV-O vocabulary (ag-lmdx.7 #prov-o-vocabulary) (#660)
## What Rename the provenance ledger relation enum from AgentOps-local `subject_verb_object` names to the standard **W3C PROV-O / PROV-DM** verbs so an external auditor recognizes the term, and document the **columns-not-JSON-paths** guard-read principle in the schema. Schema changes are single-writer on `main`. Implements ag-lmdx.7. ### Relation mapping (atomic contract change) | Prior AgentOps-local | W3C PROV-O | |---|---| | `decision_produces_artifact` | `wasGeneratedBy` | | `decision_authorizes` | `wasAssociatedWith` | | `artifact_derived_from` | `wasDerivedFrom` | | `scenario_covers_artifact` | `wasInformedBy` | | `verdict_attests_artifact` | `wasAttributedTo` | | `bead_scopes_decision` | `wasInfluencedBy` | | `commit_implements_decision` | `wasRevisionOf` | | `learning_revises_decision` | `wasInvalidatedBy` | ## Scenarios - **Relations use PROV-O vocabulary** — the enum now contains only PROV-O verbs; an edge with the colloquial `derives_from` (or the prior `artifact_derived_from`) is REJECTED in favor of `wasDerivedFrom`. Enforced by two new bats cases (accept PROV-O, reject legacy vocabulary). - **Guard-read field is a column not a JSON path** — the schema description now states that guard-read/queryable fields (`from_id`, `to_id`, `relation`, `trust_tier`, the hash-chain anchors) are first-class top-level columns, never nested JSON payload paths, because Dolt JSON-path generated-column indexing is unreliable. The `judge_id` verdict guard already reads a first-class struct field in `evidencedturn`; **no Dolt migration is invented** (no Dolt projection schema exists in this repo — the principle is encoded in the contract). ## Ripple (every merged consumer, atomic) - `schemas/agentops-sdlc-provenance.v1.schema.json` (enum + description) - `cli/internal/provenancegraph/edge.go` (`Relations` + godoc) - schema-driven validator via `tests/scripts/validate-provenance-ledger.bats` (PROV-O accept + legacy reject) - consumers: `drrebuild`, `drwitness`, `evidencedturn`, `cmd/ao/provenance_*`, `cmd/ao/turn_verify` - all hash-chained fixtures **re-sealed via the canonical hasher** (`drrebuild` ledger + frozen `expected-graph-hash.txt`, `committed-witness.jsonl`); witness dolt-rows + provenance JSON fixtures updated - generated `cli/docs/COMMANDS.md` regenerated ## Verification - `cd cli && go build ./... && go vet ./...` clean; **`go test ./...` → 11942 passed in 72 packages** - `bats validate-provenance-ledger.bats witness-dolt-jsonl-crosscheck.bats` → 20/20 - `bats provenance-orphan-fixtures.bats check-provenance-orphans.bats` → 7/7 - `scripts/check-contracts-structural-floor.sh` → PASS (45 contracts) - `docs/provenance/ledger.jsonl` does not exist (no real entries to migrate); `.agents/ao/provenance/graph.jsonl` is a separate transcript-mining graph (no `relation` field) and out of scope. Closes-scenario: ag-lmdx.7#prov-o-vocabulary Bounded-context: BC4-Factory Evidence: schemas/agentops-sdlc-provenance.v1.schema.json |
||
|
Bo
|
004fcbc249 |
feat(provenance): agentops-sdlc-provenance.v1 ledger-event schema (ag-x31t.2 #provenance-schema) (#637)
## What
Adds `schemas/agentops-sdlc-provenance.v1.schema.json` — the JSON Schema
(draft-07) that formally defines one event of the committed, per-record
hash-chained provenance ledger at `docs/provenance/ledger.jsonl` (schema
id `agentops-sdlc-provenance.v1`, referenced by CLAUDE.md and the
ag-x31t council architecture).
Each event = one typed provenance edge `{from_id, from_type, to_id,
to_type, relation, evidence_ref, trust_tier(authored|inferred|mined),
ts}` plus export-time hash-chain fields `{prev_hash, payload_hash,
hash}` mirroring `cli/internal/rpi/ledger.go` chaining semantics
(`payload_hash` = sha256 over the edge payload; `hash` =
sha256(payload_hash + "\n" + prev_hash)).
## Acceptance (ag-x31t.2)
> First failing test: validates a `decision_produces_artifact` edge,
rejects one missing `trust_tier`.
- `scripts/validate-provenance-ledger.sh` — python `jsonschema` (Draft7)
validator with `--selftest` and `--jsonl` modes, mirroring
`validate-outcomes-rubric.sh`; SKIPs gracefully when jsonschema is
unavailable.
- `tests/scripts/validate-provenance-ledger.bats` — 12 checks. A
`decision_produces_artifact` edge VALIDATES; an otherwise-identical edge
missing `trust_tier` is REJECTED. Structural-JSON checks are the
always-on guard (run without jsonschema).
-
`tests/fixtures/provenance/{valid-decision-produces-artifact,invalid-missing-trust-tier}.json`
— fixtures with real sha256 chain hashes.
TDD verified: the selftest FAILS when the schema is edited to drop the
`trust_tier` requirement, PASSES when restored.
## Scope
Schema + validator + test only. Does **not** create/edit
`docs/provenance/ledger.jsonl`, the write-model (ag-x31t.4), export
(ag-x31t.5), or gate (ag-x31t.6). No symlinks. No holdout data.
```
gates: validator --selftest pass · bats 12/12 pass
```
Closes-scenario: ag-x31t.2#provenance-schema
Bounded-context: BC4-Factory
Evidence: schemas/agentops-sdlc-provenance.v1.schema.json
|
||
|
Bo
|
0f16a574bc |
feat(eval): outcomes-rubric projection contract + schema (ag-hguuf #outcomes-rubric) (#624)
## What
Defines the machine-checkable contract for projecting the **locked eval
substrate** into an **Outcomes-style grading payload** (Anthropic
Managed Agents Outcomes analog) — holdout-safe by construction *and* by
schema.
The schema validates the **actual** output of `ao eval outcomes compile`
(`evalsubstrate.Rubric`), not the bead's pre-implementation prose sketch
(which imagined `suite_id`/`metric`/`decision_rule`/`split`). Per
source-of-truth precedence (executable > narrative), the shipped
projection deliberately emits *fewer* fields — a smaller cloud boundary
is a smaller leak surface. The "deliberately NOT projected" rationale is
documented in the contract.
## The load-bearing invariant
**Managed Agents are not ZDR** — a rubric crossing the cloud boundary
must never carry a ground-truth answer / holdout value / `target` /
`expected_output`. Enforced three ways:
1. **By construction** — `ProjectRubric` can't copy ground truth
(existing).
2. **By re-scan** — `Rubric.ContainsAny` guard (existing).
3. **By schema (this PR)** — `additionalProperties:false` at **every
nesting level** → a malformed compiler emission that smuggles a leak
field **fails schema validation**, not merely a code check.
## Files
- `schemas/outcomes-rubric.v1.schema.json` — the contract schema
-
`tests/fixtures/outcomes-rubric/{valid-dev,valid-holdout-criteria-only,invalid-contains-target}.json`
- `scripts/validate-outcomes-rubric.sh` — standalone validator (python
`jsonschema`, mirrors `validate-next-work.sh`); `--selftest` asserts
pass/pass/fail
- `tests/scripts/validate-outcomes-rubric.bats` — 9 acceptance tests
- `cli/internal/evalsubstrate/rubric_schema_test.go` — Go schema↔struct
drift guard (reflection)
- `docs/contracts/outcomes-rubric-projection.md` —
SCHEMA-field→Outcomes-field mapping; catalogued in doc index;
cross-linked from `eval-verdict-pipeline.md`
The contract **references** the LOCKED `~/.agents/evals/SCHEMA.md`
§rc2/§4 — it never edits it. Substrate EXTENDED, never relitigated.
## Evidence
- `scripts/validate-outcomes-rubric.sh --selftest` → PASS/PASS/FAIL
(exit 0)
- `bats tests/scripts/validate-outcomes-rubric.bats` → 9/9 ok
- `go test ./internal/evalsubstrate/` → 82 passed; `go vet` clean; `go
build ./...` success
- `check-contract-compatibility.sh` → contract catalogued + schema
reference OK
- `shellcheck scripts/validate-outcomes-rubric.sh` → clean
Closes-scenario: ag-hguuf#outcomes-rubric-projection-contract
Bounded-context: BC4-Evaluation
Evidence: schemas/outcomes-rubric.v1.schema.json
|
||
|
Bo
|
e4e32a3374 |
feat(orchestration): dual-runtime OrchestrationPort foundation (ag-nk67 #orchestration-foundation) (#598)
## What
The **dual-runtime OrchestrationPort foundation** — the seam that gates
the
`[EPIC] AgentOps × Claude Managed Agents integration (dual-runtime)`
application epics.
Implements the 3-category model (Claude Workflow / NTM swarm / plain
skill) behind a
single `OrchestrationPort` with safe degradation **NTM → Claude-native →
beads floor**
and a global `AGENTOPS_ORCHESTRATION=off` opt-out.
Derived from a live 3-legged spike (`~/dev/agentops-3cat-spike/`): safe
degradation is
solvable at the selection layer; parallel buys quality/independence not
wall-clock at
small N; NTM is a multi-vendor control plane that runs Claude/Codex as
panes.
## What's in it (10 slices, agent-team driven)
- **Port + adapters** — `cli/internal/ports/orchestration.go` (idiomatic
to existing ports pattern) + new `cli/internal/orchestration/` pkg:
`Selector`, `ntm_probe` (capability detection via `ntm
--robot-capabilities`, not `command -v`), `beads_floor` +
`OrchestrationResult` parity type, degradation-conformance test.
- **Live CLI** — `ao orchestrate select` (`--pin`/`--opt-out`/`--json`);
COMMANDS.md regenerated.
- **Contracts** — `schemas/orchestration-{backend,result}.v1` + paired
`docs/contracts/` docs (structural-floor gated: 41 contracts).
- **Prose** — swarm/shared/crank rewritten NTM>native>beads; **gc
demoted** (soc-2rtm0); `rpi_phased_stream.go` doc-comment fixed.
- **Skills** — `automation-shape-routing` (the 3-category router) +
`workflow-builder` + meta-skill authoring chain wired (`context_rel`);
skill counts synced.
- `lib/orchestrate-select.sh` selector seam.
## Verification (local)
`go build ./...` clean · `go vet` clean · **56 Go tests pass**
(orchestration 31, ports 10, cmd/ao orchestrate 15) · structural-floor
PASS (41) · `lib/orchestrate-select.sh --self-test` 6/6 · live command:
`--json`→claude (NTM absent), `--opt-out`→beads, `--pin claude`→claude.
## Notes
- Bundles the foundation + the routing/authoring skills as one coherent
dual-runtime arc.
- NTM/Claude executors are stubs (the parity contract is real); concrete
executors land in the application epics this gates.
- Two-ladders distinction preserved (spawn-backend ladder A vs CLI
phase-executor ladder B) — see `docs/contracts/orchestration-ports.md`.
Closes-scenario: ag-nk67#orchestration-foundation
Bounded-context: BC5-Runtime
Evidence: cli/internal/orchestration/conformance_test.go
|
||
|
Bo
|
3e069b278a |
feat(corpus): machine-checkable schema + validator for next-work harvest (ag-yma #typed-next-work-contract) (#564)
## Summary Makes `.agents/rpi/next-work.jsonl` — the post-mortem → /evolve harvest queue — a machine-checkable **typed contract**. Previously the shape was only a human-readable doc plus jq enum logic duplicated across scripts; there was no committed JSON Schema. - **`schemas/next-work-item.v1.schema.json`** + **`schemas/next-work-batch.v1.schema.json`** — draft-07. Enums, required fields, and conditional `proof_ref` rules; `additionalProperties: true` for forward-compat (readers MUST tolerate unknown fields). - **`scripts/validate-next-work.sh`** — reusable validator. Advisory by default; `--strict` exits non-zero naming the offending `file:line` + field; `--json` emits a machine-readable verdict. It **reads enums/required lists from the schema files** so the committed schema is the single source of truth. jq is authoritative and runs everywhere; a `python jsonschema` structural pass runs when present (catches type-shape gaps jq can't); `ajv` is recorded but non-gating. - **`tests/scripts/validate-next-work.bats`** — golden valid fixture + broken fixtures (bad type/severity, missing title, malformed `proof_ref`, malformed JSON). Auto-run by CI's `bats tests/scripts/*.bats`. - Skill + contract docs (`skills/post-mortem/SKILL.md`, `references/harvest-next-work.md`, `docs/contracts/next-work.schema.md`) name the schema + validator canonical; the inline bash stays as a dependency-free fallback. **No Go change** (repo validates schemas via shell) — `go build`/`vet` stay green. ## Scope / staging Gate ships **advisory only** this PR. The advisory run over the live queue found exactly **1 finite legacy violation** (line 14, `source=evolve-scouting`, epic `soc-owed.7` — data-only, no producer emits it). Follow-ups filed: - `ag-blp` — backfill the legacy `evolve-scouting` row (blocks promotion). - `ag-taa` — promote `--strict` to a required CI gate after the backfill lands. - `ag-jda` — de-dup the enum source of truth onto the schema. ## Test plan - [x] `bats tests/scripts/validate-next-work.bats` — 13/13 green - [x] `scripts/validate-next-work.sh` advisory run vs live `.agents/rpi/next-work.jsonl` — 1 finite legacy violation, exit 0 - [x] `--strict` structural-gap check (e.g. `consumed:"yes"`) rejected via python jsonschema pass - [x] `shellcheck -x scripts/validate-next-work.sh` clean - [x] `scripts/validate-next-work-contract-parity.sh` / `check-contracts-structural-floor.sh` / `check-contract-compatibility.sh` / `heal.sh --strict` pass - [x] `cd cli && go build ./... && go vet ./cmd/ao` clean; `ao autodev validate --file PROGRAM.md` → valid Closes-scenario: ag-yma#typed-next-work-contract Bounded-context: BC1-Corpus Evidence: tests/scripts/validate-next-work.bats + scripts/validate-next-work.sh advisory run vs .agents/rpi/next-work.jsonl |
||
|
Bo
|
ee748d580d |
feat(rip)!: retire factory command + contract corpus (soc-2rtm0 #cascade-rip) (#512)
**Wave 1 of the orchestration-substrate cascade rip** (soc-2rtm0). The
full cascade (daemon + dream/overnight + schedule/plans/watch + gc-glue
+ factory) is ~50K LOC across deeply-entangled packages — far past one
reviewable PR. Per the bead's slice directive and the recon map's
serial-by-wave verdict, this ships as sequential PRs by wave. **This is
the factory wave** (the only cleanly-disjoint slice — no KEEP-feature
entanglement).
## What this retires (operator-confirmed FULL factory retire)
**Go command surface** (no external non-test caller — clean delete):
- `cmd/ao/factory.go`, `factory_admit.go`, `factory_pilot.go`,
`factory_admission_adapter.go` (+ all tests)
- `internal/ports/factory_admission.go` +
`inmemory_factory_admission.go` (+ test) — the port was only wired to
the daemon by the deleted production adapter
- severed factory flag save/restore + command-tree assertions from
`cobra_commands_test.go` / `testutil_test.go`
**Contract corpus** (scripts, schemas, contract docs, runbooks,
fixtures, tests):
- `scripts/check-factory-{admission,claim-ledger,yield-ledger}.sh`
- `schemas/factory-{admission,work-order,yield}.v1.schema.json`
- `docs/contracts/factory-{admission,claim-ledger,yield-ledger}.*`
-
`docs/runbooks/{factory-manual-merge,daemon-factory-admission,cloud-frontier-pilot}.md`
- `tests/e2e/factory-operator-canary.sh`,
`tests/integration/test-factory-claim-ledger-ci-job.sh`,
`tests/scripts/test-factory-admission-contracts.py`,
`tests/fixtures/factory-*`
- orphaned `aggregate-observation-log` subsystem (script + integration
test + fixtures) — its only data source was the deleted
`factory-claim-ledger-strict` CI job
**CI / generated reconciliation:**
- removed 3 factory jobs from `validate.yml` (+ both `needs:` arrays +
verdict echoes); removed entries from `ci-jobs.yaml`; regenerated
`AGENTS-CI.md` (63 jobs)
- removed factory gate-ids from `GOALS.md`; trimmed
`contracts-structural-floor` factory references
- regenerated `registry.json` (177→174 CLI commands), `COMMANDS.md` (−70
lines), `cli-skills-map.md` (73→72 headings)
- updated `cli-command-surface-matrix` canary spec + fixture counts
(`top=72 sub=194 all=266`); scrubbed deleted-file links from
`documentation-index.md`, `SCHEMAS.md`, `contracts/index.md`,
`agentopsd-control-plane.md`, `insert-schema-practices.py`
## Deliberately left for the daemon-carve wave
Daemon-owned factory job types (`factory.admission`,
`factory.local-pilot`) and the `agentopsd` routing-policy schema remain
— they belong to `internal/daemon/` and retire when the daemon does.
## Gates verified green locally
`gofmt`/`go build`/`go vet`, full Go test (**11830 pass**),
`validate-ci-policy-parity`, `contract-compatibility`,
`contracts-structural-floor`, `registry --check`, `doc-release` (0
broken links), `smoke-test`, `json-flag-consistency` (0 errors),
**`contract-canaries` (failures=0)**, codex-hashes, `pre-push-gate.bats`
(55).
Diff: 66 files changed, ~16 insertions / ~5680 deletions.
Closes-scenario: soc-2rtm0#cascade-rip
Bounded-context: BC5-Runtime
Evidence: .agents/discovery/2026-05-24-rip-caller-map.md
|
||
|
Bo
|
e431339c40 |
feat(hookless)!: remove all hooks — skills + CLI only (soc-57b7f #remove-all-hooks) (#511)
## What AgentOps 3.0 goes **fully hookless**. This removes the entire hook product surface — the product is now skills + the `ao` CLI with **zero hooks**. CI is the authoritative gate. ## Deleted - `hooks/` — 46 hook scripts + `hooks.json` + examples (whole directory) - `cli/embedded/hooks/` + embedded `hooks.json` + `embedded/lib/hook-helpers.sh` - `lib/hook-helpers.sh` - `ao hooks` CLI command: `cli/cmd/ao/hooks.go`, `hooks_run.go` + 5 hook test files; `cli/internal/bridge/hooks.go`; `cli/internal/doctor/fix_hooks.go` + test - Codex hook manifest (`hooks/codex-hooks.json`) + handler/audit scripts (`scripts/audit-codex-hooks.sh`, `install-dev-hooks.sh`, `test-hooks-output.sh`, `test-codex-hookless-lifecycle.sh`, `test-hookless-rpi-phased.sh`) - Hook lease surface: `docs/contracts/hook-lease-*`, `schemas/hook-lease.v1.schema.json`, `scripts/check-hook-lease-inventory.sh`, `check-hook-port-replacements.sh`, `generate-hook-lease-inventory.py` - Hook docs: `docs/HOOKS.md`, `cli/docs/HOOKS.md`, `docs/architecture/hook-noise-audit.md`, `docs/contracts/hook-runtime-contract.md` - `tests/hooks/` (whole dir) + hook test scripts; 5 hook eval suites + fixtures ## CI gates removed `hook-preflight`, `validate-hooks-doc-parity`, `hook-output-schema-lint` (+ scripts/bats), the hook eval suites, the `test-runtime-codex-smoke` / `test-codex-native-install` / `test-codex-plugin-install` hook-handler assertions, the cli-integration hook-lifecycle steps, the bats `tests/hooks/*` glob + orphan-hooks audit, and the `--with-hooks` install path. `embedded-sync` now validates only lib/skills. Both summary `needs:` lists + the summary echo + `docs/contracts/ci-jobs.yaml` updated; `validate-ci-policy-parity` passes (66 rows). `.codex-plugin/plugin.json` drops the "Hooks" capability. ## Load-bearing PRESERVED (reported, not forced) - **`cli/cmd/ao/codex_runtime.go`** — the codex runtime *lifecycle profile* (`HookCapable`/`HookConfigured` detection) is a runtime-capability abstraction used by 6 `validate-codex-*` CI gates, distinct from the hook product. Deleting it is a separate refactor. - **`hooks-authoring` skill** + `schemas/hooks-manifest.v1.schema.json` — reframed as an opt-in "author your own hooks" guide. Deleting the skill cascades into catalog/domain-map/dispositions/context-map golden files (skill-count sync), out of scope for the hook-product removal. - **`scripts/pre-push-gate.sh`** — retired local gate (not in CI); self-skips deleted hook scripts via `[[ -x ]]` guards; its 55 bats tests still pass. - Domain-enforcement audit keeps the `enforced`-mode schema for backward-compatible JSON readers, but the hookless resolver only returns `audited`/`unavailable`. ## Verification `go build` / `go vet` clean; `go test ./...` = **11849 passed, 0 failed** (68 pkgs). gofmt clean on all touched files. Green: registry `--check` (0 hooks), `regen-codex-hashes --check`, `validate-ci-policy-parity`, `check-wiring-closure`, `validate-embedded-sync`, `validate-manifests`, `validate-agents-split`, `doc-release` (0 broken links), `generate-cli-reference --check`, `heal.sh --strict`, codex/claude/plugin smoke tests, baseline-audit (0 stale). Diff: 231 files, +354 / −39803. Closes-scenario: soc-57b7f#remove-all-hooks Bounded-context: BC5-Runtime Evidence: .github/workflows/validate.yml |
||
|
Bo
|
2d2b806ab8 |
feat(evolve): per-repo preferences.yaml schema + loader + ao evolve config --show (soc-6svt #preferences-yaml) (#396)
## Why Different repos have different /evolve physics. Hardcoded defaults force ADRs per-repo to override. Per-repo YAML separates skill-doctrine from repo-policy. ## What changed | Surface | Change | |---|---| | `schemas/evolve-preferences.v1.schema.json` | New JSON Schema draft-07 for the v1 preferences shape | | `cli/internal/evolve/preferences.go` | New loader: `Load(ctx) (*Prefs, error)` with file:line error context | | `cli/cmd/ao/evolve_config.go` | New `ao evolve config --show [--json]` subcommand | | `.agents/evolve/preferences.yaml.template` | New starter template | | `.gitignore` | Negation rules for the template path | ## Resolution order defaults < preferences.yaml < CLI flag (caller-applied) Invalid keys/types -> exit 1 with `preferences.yaml:line:col` context. Never silent fallback. ## How tested - L2: malformed YAML -> `ao evolve config --show` exits 1, stderr has file:line - L1: `preferences.Load()` table tests cover defaults, valid, invalid types, out-of-range, unknown keys - `go test ./cli/internal/evolve/ ./cli/cmd/ao/` green (299+ tests across both) See: docs/plans/2026-05-21-evolve-loop-epic-design.md §A2 (created by parallel worker W1a in soc-hwax PR) Closes-scenario: soc-6svt#preferences-yaml Bounded-context: BC5-Runtime Evidence: cli/internal/evolve/preferences.go |
||
|
Bo
|
1a7e2cb748 |
feat(ao session bootstrap): universal init prompt (soc-vuu6.25 #ao-session-bootstrap) (#390)
## Summary
`ao session bootstrap` — every agent spawned into an AgentOps repo runs
this first. Output shape is identical regardless of model (the
fungibility contract: swap Claude for Codex on any bead without
re-orienting).
## What
Four fail-open substeps emit fields in
`schemas/session-bootstrap.v1.schema.json`:
| Field | Source | Fallback |
|---|---|---|
| `agents_md_read` + `agents_siblings_read` | `AGENTS.md` +
post-soc-vuu6.3 siblings | `false` / empty array |
| `onboard_phase` | `onboard --auto` (soc-vuu6.9 future) |
`skipped:not-implemented` |
| `ready_beads_count` | `bd ready --json` | `null` |
| `mail_unread_count` | mcp-agent-mail | `null` (wiring is follow-up
bead) |
## Why
The fungibility philosophy mandates one init prompt for every agent
regardless of type. Today every operator hand-rolls orientation; two
agents spawned by two different operators don't share a starting frame.
`ao session bootstrap` is the operational primitive that closes the gap.
Tiny (~270 LOC including helpers), fail-open, deterministic.
## Files
- New: `cli/cmd/ao/session_bootstrap.go` + `_test.go` (8 cases)
- New: `schemas/session-bootstrap.v1.schema.json` (draft-07)
- New: `skills/session-bootstrap/SKILL.md` +
`skills-codex/session-bootstrap/SKILL.md` (mirrored)
- Catalog: `skills/SKILL-TIERS.md`, `skills/using-agentops/SKILL.md`,
`skills-codex/using-agentops/SKILL.md`
- Regenerated: `cli/docs/COMMANDS.md` (sub 196→197, all 269→270),
`registry.json` (cli_commands 173→174),
`PRODUCT.md`/`docs/ARCHITECTURE.md`/`docs/SKILLS.md` (count sync 79→80),
`evals/agentops-core/cli-command-surface-{matrix.json,fixtures/cli-command-surface-smoke.sh}`
(fixture bump)
## Verification
```
cd cli && go build ./... && go test ./cmd/ao/ -run TestSessionBootstrap -count=1
# 8 passed
bash evals/agentops-core/fixtures/cli-command-surface-smoke.sh
# cli-command-headings: top=73 sub=197 all=270 / cli-help-matrix-ok
bash tests/docs/validate-doc-release.sh
# PASS: doc-release gate succeeded
```
Closes-scenario: soc-vuu6.25#ao-session-bootstrap
Bounded-context: BC5-Runtime
Evidence: cli/cmd/ao/session_bootstrap.go
Evidence: cli/cmd/ao/session_bootstrap_test.go
Evidence: schemas/session-bootstrap.v1.schema.json
Evidence: skills/session-bootstrap/SKILL.md
|
||
|
Bo
|
35f9b25b2f |
feat(schemas): stale-claim-event.v1 schema (soc-vuu6.27 slice 1 #stale-claim-event-schema) (#382)
## Why
The fungibility doctrine ("Dead agent? Start another.") needs an
operational primitive: detect stale claims, transfer them atomically.
Without it, a 30-agent overnight swarm degrades to a halt every time an
agent dies mid-bead. soc-vuu6.27 is the M2 fungibility primitive; it
also unblocks soc-vuu6.29 (Fungibility Charter) which CANNOT land until
at least vuu6.25 and vuu6.27 ship per the Charter bead's own risk gate.
Per the soc-vuu6.4 slicing pattern proven this session, ship the
contract slice first so subsequent code (list cmd, resume cmd, daemon
job) can be built against a stable shape.
## What
Slice 1 of soc-vuu6.27 ships only the schema:
- **`schemas/stale-claim-event.v1.schema.json`** — JSON Schema Draft
2020-12 for the event written when a claim is detected stale or
atomically transferred. One shape covers both event types
(`stale_detected` and `claim_transferred`); `allOf if/then` enforces
that `claim_transferred` carries `new_claimant` + `transfer` fields.
Evidence object uses `anyOf` so at least one staleness signal
(`last_touch_ts`, `worktree_quiet_since`, or `heartbeat_expired_at`) is
required.
3 follow-up beads filed for slices 2-4:
- Slice 2: `ao beads stale-claims` list command
- Slice 3: `ao beads resume <id>` atomic transfer
- Slice 4: agentopsd auto-resume background job
All three block on this slice.
## Test
13 bats tests, all passing. Cover: schema is valid JSON, $id+draft are
right, six core required fields present, `schema_version` const 1,
`event_type` enum exact, `bead_id` regex matches real-shaped IDs and
rejects mis-cased ones, evidence `anyOf` allows any single signal,
`allOf if/then` enforces conditional fields for `claim_transferred`,
Agent $def shape, runtime enum coverage, minimal fixtures of both event
types satisfy the schema, `additionalProperties: false` at every object
boundary.
(ajv isn't in the test env; structural validation via jq + fixtures
catches the schema/fixture-drift class without the new dep.)
Closes-scenario: soc-vuu6.27#stale-claim-event-schema
Bounded-context: BC1-Corpus
Evidence: schemas/stale-claim-event.v1.schema.json
Evidence: tests/scripts/stale-claim-event-schema.bats
Co-authored-by: Codex <codex@example.invalid>
|
||
|
Bo
|
a51cbe327e |
feat(scripts): skill catalog generator + drift gate (soc-vuu6.4 slice 1 #catalog-generator) (#379)
## Why `registry.json` (47KB) is too coarse — agents grepping for "which skill produces a ratchet?" have to scan markdown. Hand-curated /skills tables drift. Future `ao skill new` scaffolders need a queryable inventory. This is slice 1 of soc-vuu6.4 (the generator + schema + CI gate). Go CLI subcommands and showcase consumer are filed as follow-up beads. ## What Three artifacts: 1. `schemas/skill-catalog.schema.json` — JSON Schema for the catalog. Required fields: name, description, hexagonal_role, consumes, produces, context_rel, user_invocable, references_count, codex_override_present. hexagonal_role enum mirrors soc-e8pj/PR #376. 2. `scripts/generate-skill-catalog.sh` — walks every `skills/*/SKILL.md`, parses YAML frontmatter via awk, emits `skills/catalog.json` with all 79 skills. Modes: default (write), `--check` (CI drift gate, exits 1 on drift), `--stdout`, `--out PATH`. 3. `scripts/check-skill-catalog-drift.sh` — thin wrapper over `--check` so the future workflow has a stable, named entry point. 4. `skills/catalog.json` — generated artifact, committed. 79 skills, 40KB. The parser handles the SKILL.md frontmatter subset we actually use: scalar key:value, lists (`- item`), and `context_rel` nested objects (`- kind:` / `with:`). A regression test covers the "last context_rel entry dropped on transition to next scalar" parser bug caught during development. ## Test 14 bats tests, all passing. Cover: envelope fields, name/description extraction, list round-trip, context_rel parsing (incl. the regression for the dropped-last-entry bug), user_invocable boolean, references_count, codex_override_present, default file-write, `--check` pass + drift detection, drift wrapper exit codes, empty-skills case, unknown-flag error. Self-dogfood: real skills/ tree → 79 skills generated, all 4 keys validated by lint-skill-frontmatter (#376), drift check green. ## Follow-up beads filed - Slice 2 — `ao skills list/consumers/producers/graph` (Go CLI subcommands, blocks on this PR) - Slice 3 — Showcase consumes catalog.json instead of hand tables Closes-scenario: soc-vuu6.4#catalog-generator Bounded-context: BC1-Corpus Evidence: scripts/generate-skill-catalog.sh Evidence: scripts/check-skill-catalog-drift.sh Evidence: tests/scripts/generate-skill-catalog.bats Co-authored-by: Codex <codex@example.invalid> |
||
|
Bo
|
f55cbb3dcd |
chore(scripts): add registry drift detector for DDD/hex registry docs (soc-ry4a) (#308)
## What Adds \`scripts/check-registry-drift.sh\` — a drift detector for the hand-maintained DDD/hex registry docs. Detects three classes of drift: 1. **Count drift** — narrative + audit-table + Gherkin scenario counts vs actual \`skills/\` directory count 2. **Membership drift** — every skill listed in the Full Skill Map exists in \`skills/\` and vice versa 3. **Role drift** — \`hexagonal_role\` column in the map matches each \`SKILL.md\` frontmatter ## Why Encodes the \`registries-drift\` lesson from session 2026-05-17: > Hand-maintained inventory docs drift silently. Three axis owners (DDD vocab, Hex frontmatter, Gherkin features) must be generated or schema-gated; never hand-edited maps. Pre-PR state (detected by the new script): | Doc | Declared | Actual | |---|---|---| | \`agentops-skill-domain-map.md\` narrative | 77 skills | 78 | | \`agentops-skill-domain-map.md\` audit table | 78 | 78 ✓ | | \`agentops-domain-evolution-bdd.md\` Gherkin | 77 skills | 78 | | \`skills/expert-council/SKILL.md\` | no \`hexagonal_role\` | declared \`domain\` in map | All four reconciled in this PR; final check is PASS. ## Implementation ### \`scripts/check-registry-drift.sh\` - Modes: \`--check\` (default), \`--fix-counts\` (auto-update inline narrative counts), \`--json\` (machine-readable report) - Returns exit 1 on FAIL, 0 on PASS/WARN - Runtime: < 1s - Dep: PyYAML (already required for context-map generator) ### Wired into: - \`scripts/pre-push-gate.sh\` — always-runs section (drift can be introduced by any skill add/rename/remove) - \`.github/workflows/validate.yml\` — new \`validate-registry-drift\` job + added to \`summary\` job's \`needs\` (so it gates merges) ### Reconciliation - 77 → 78 in 2 doc locations (via \`--fix-counts\`) - \`hexagonal_role: domain\` added to expert-council frontmatter (consistent with council, which it aliases to) - documentation-index.md count updated + annotation added ### Codex parity \`skills-codex/expert-council/.agentops-generated.json\` source_hash auto-updated. \`generated_hash\` unchanged → codex artifact is byte-identical, no regen required. \`bash scripts/check-codex-parity-drift.sh\` returns PASS. ## Acceptance - [x] \`scripts/check-registry-drift.sh\` exists, runs in < 1s - [x] Detects count/membership/role drift; current state PASSES after reconciliation - [x] Wired into pre-push-gate.sh — confirmed gate runs (\`registry drift: ok\`) - [x] Wired into validate.yml summary needs list - [x] Linked from documentation-index.md - [x] Lands via PR (governed by branch protection — dogfoods discipline) Closes-scenario: drift-detector-encoded Bounded-context: scripts/ + CI gates Evidence: scripts/check-registry-drift.sh, validate-registry-drift job, PASS verdict Closes: soc-ry4a 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Bo
|
1f0e545a51 |
Executable spec layer (epic soc-58nt, F2–F5): GOALS as BDD acceptance criteria (#292)
* feat(goals): F2.0 scenario-result artifact contract + producer/writer
bead: soc-58nt.2.6
* docs(goals): F4.0 trace link convention ADR-0005
bead: soc-58nt.4.8
* docs(goals): F3.0 domain-slice manifest contract + ADR-0004
bead: soc-58nt.3.8
- schemas/domain-slice-manifest.v1.schema.json: JSON Schema (draft/2020-12,
additionalProperties:false) for domain-slice manifests. All required fields:
domain, version, bounded_context, directive_ids (d-<slug> pattern), scenario_ids,
context_roots, allowed_read_globs, denied_read_globs, validation_commands, owner.
- docs/adr/ADR-0004-domain-slice-manifest-contract.md: records four decisions:
(A) command shape is ao rpi phased --domain <name>; (B) manifest is durable
tracked artifact at docs/domains/<name>/manifest.yaml; (C) reconciles with the
domain skill (vocabulary), context-map.md (architecture view), and skill
frontmatter — no overlap; (D) Go model named domainSliceManifest, explicitly
distinct from rpi_phased_manifest.go's phaseManifest. Cross-references ADR-0003.
- docs/domains/README.md: explains the directory, field table, relationship to
the three pre-existing domain surfaces, and how to add a new slice.
- docs/domains/example/manifest.yaml: fully populated example; validated against
the schema via jsonschema (PASSED).
* feat(goals): F2.1 scenario-result aggregation reader
bead: soc-58nt.2.1
* feat(rpi): F3.1 domainSliceManifest model + loader
Implements the domainSliceManifest Go model and loader in
cli/internal/domainslice/ per the F3.0 contract (ADR-0004, Decision D).
Uses gopkg.in/yaml.v3 with KnownFields(true) to reject unknown fields,
mirrors the schema's additionalProperties:false. Validates all required
fields, directive_id pattern (^d-[a-z0-9][a-z0-9-]*$), context_roots
minItems:1, and validation_commands sub-fields with field-named errors.
Explicitly distinct from phaseManifest (rpi_phased_manifest.go).
28 tests pass (L1 unit + L2 fixture round-trip via docs/domains/example/manifest.yaml).
bead: soc-58nt.3.1
* feat(goals): F4.1 read-only executable-spec trace graph walker
bead: soc-58nt.4.1
* feat(goals): F2.2 per-directive scenario_satisfaction + threshold verdict
bead: soc-58nt.2.2
* feat(rpi): F3.2 ao rpi phased --domain scoping
bead: soc-58nt.3.2
* feat(goals): F4.2/F4.3 ao goals trace --from / --orphans
beads: soc-58nt.4.2 soc-58nt.4.3
* feat(goals): F4.4 ao goals render — GOALS.md to Gherkin
bead: soc-58nt.4.4
* feat(rpi): F3.3a domain-scope audit evidence
bead: soc-58nt.3.3
* feat(goals): F2.3 scenario_satisfaction JSON field + --scenarios-only
Per-directive scenario satisfaction added to ao goals measure: 0 -> 8
new JSON fields and a --scenarios-only mode that skips gate execution.
bead: soc-58nt.2.3
* feat(rpi): F3.4 ao rpi phased --scaffold-domain
bead: soc-58nt.3.4
* test(goals): commit missing goals-trace scenario-results fixture
The F4.1/F4.2 walker tests reference a scenario-results.json fixture under
a gitignored .agents/ subpath; it was never force-added and a clean
checkout (and CI) lacks it, failing 5 scenario_result tests. Force-add it.
bead: soc-58nt.4.1
* fix(goals): F4.1 tighten goalstrace scenario-claim heuristic
bead: soc-58nt.4.9
- Tighten scenarioTokenRe: auto- tokens now require at least two
hyphen-separated slug segments (auto-X-Y…), so single-word English
compounds like auto-merge and auto-update are no longer matched.
- Downgrade broken_bead_scenario_claim from error to warning when the
claim comes from a heuristic (ConfidenceLow) free-text match; per
ADR-0005 §4.1 only an explicit Scenarios: line constitutes a broken
explicit link and may produce an error.
- Add beads_test.go with table-driven tests covering: English auto-*
false-positive rejection, real multi-segment auto-* ID detection,
explicit missing scenario → error, heuristic missing → warning only,
resolvable scenario → no defect, end-to-end Walk with auto-merge bead
produces no error-severity finding.
* test(goals): F2.T1 regression-coverage audit + gap fill
bead: soc-58nt.2.4
* ci(goals): F1.6 wire executable-spec link lint + trace-orphans (warn-first)
bead: soc-58nt.1.9
* feat(rpi): F3.3b runtime hook enforcement of domain scope
bead: soc-58nt.3.9
* test(goals): F2.T2 e2e script for scenario-satisfaction gate
bead: soc-58nt.2.5
* docs(goals): F5.0 re-steer policy + mutation-safety contract (ADR-0006)
bead: soc-58nt.5.9
* docs(goals): fix streak-reset prose in ADR-0006 (cleanup)
bead: soc-58nt.5.9
[no-sibling] prose fixup only, no structural change
0 → 0 schema fields changed
* test(goals): F4.T1 regression-coverage audit + gap fill
bead: soc-58nt.4.6
* feat(wiki): land wiki bounded context waves 1-4 (epic soc-behj)
Phased strangler consolidating ao's .agents/-touching logic into one
cli/internal/wiki bounded context. Each wave gated by the 102 cmd/ao
integration tests staying green; legacy command surface untouched.
- W1 soc-1lju FrontmatterCodec — all 5 frontmatter parsers delegate
- W2 soc-36lw CorpusLocator — agentsDirIn moved, 17 call sites migrated
- W2 soc-f4tr Artifact + Claim domain types with subtype invariants
- W3 soc-vot0 persistent WikiIndex — JSONL, incremental by content-hash
- W3 soc-r08p FreshnessPolicy — claim-level evidence-driven freshness
- W4 soc-ijp8 WikiPipeline — subsumes llmwiki loop, 3 stages wired
- W4 soc-q50a port conformance suite
Also anchors .gitignore's bare wiki/ pattern with a !cli/internal/wiki/
negation — the new package was being silently ignored.
Wave 5 (ao wiki command group) is not included in this commit.
* test(goals): F4.T2 e2e script for trace chain
bead: soc-58nt.4.7
* test(rpi): F3.T1 regression-coverage audit + gap fill
bead: soc-58nt.3.6
* test(rpi): F3.T2 e2e script for domain-scoped RPI
bead: soc-58nt.3.7
* feat(goals): F5.1 verdict ledger schema + writer
bead: soc-58nt.5.1
* feat(goals): F5.2 re-steer policy engine + verdict-ledger producer hookup
bead: soc-58nt.5.2
* feat(goals): F5.4 feedback-to-learning compiler
Adds cli/internal/feedbackcompiler — scans the verdict ledger for
fail->pass directive transitions and drafts a learning entry in
docs/learnings/ for each transition found. Drafts carry status: draft
and directive_id frontmatter (ADR-0005 §2.6). Never auto-promotes.
Idempotent: skips existing drafts on re-run.
Also documents the auto-draft workflow in
skills/forge/references/feedback-compiler-drafts.md with a compact
reference-link in skills/forge/SKILL.md (under 248-line limit).
Synced to skills-codex/forge/ and regenerated codex hashes.
bead: soc-58nt.5.4
* docs(goals): F5.5 compound-engineering retro in /post-mortem
Extend the /post-mortem skill with a Compound-Engineering Retro section
that compares iteration N vs N-1 for a domain slice using the F5.1 verdict
ledger (.agents/goals/verdict-ledger.json). The mode emits a comparative
delta — directives that improved (fail→pass, satisfaction up), regressed
(pass→fail, satisfaction down), or held stable — plus learning yield since
N-1, written as a status:draft learning to .agents/learnings/.
Detailed step-by-step procedure (CE.0–CE.5) lives in
references/compound-engineering-retro.md; SKILL.md carries a compact
trigger/commands summary and links to it. Both files synced to
skills-codex/post-mortem/ with updated codex hashes.
bead: soc-58nt.5.5
* feat(goals): F5.3 ao goals steer --auto with human-gated confirmation
bead: soc-58nt.5.3
* test(goals): F5.T1 regression-coverage audit + gap fill
bead: soc-58nt.5.7
* test(goals): F5.T2 e2e script for auto re-steer
bead: soc-58nt.5.8
* docs(goals): F2.4 docs regen for scenario-satisfaction gate + epic CLI artifacts
Regenerate cli/docs/COMMANDS.md and registry.json from a clean worktree at
HEAD so the soc-58nt command surface is documented without leaking unrelated
peer WIP into the generated docs.
F2 (soc-58nt.2.7): document scenario_satisfaction JSON shape, --scenarios-only,
result-artifact resolution, and exit codes in skills/goals/SKILL.md +
references/executable-spec-chain.md; cross-ref ao goals measure/trace from
skills/scenario/SKILL.md.
Epic-wide artifacts also landed here because they regenerate atomically across
F2-F5: COMMANDS.md/registry.json (all new ao goals/rpi surface), cli-skills-map
heading count, skills-codex hashes, ADR-0004/0005/0006 documentation-index
links, and the F2-F5 e2e CI lanes in validate.yml.
ao capabilities and ao robot-docs need no manual edits — both build their
command/flag surface from the live cobra tree, so new commands register
automatically (Global Rule G5 satisfied by construction).
bead: soc-58nt.2.7
* docs(domain): F3.5 domain-as-loop docs for domain-scoped RPI
Document the domain-slice runtime in skills/domain/SKILL.md (a "Domain as a
scoped RPI loop" section connecting the Slice primitive to ao rpi phased
--domain / --scaffold-domain / --force) and add the Domain-Slice row to the
modes table in skills/scaffold/SKILL.md, mirroring the existing Project/
Component/CI mode-row shape. The scaffold skill's Domain-Slice Mode section
already covered the workflow; this lands the missing modes-table entry so the
mode count is 3 -> 4.
The COMMANDS.md/registry/CI-lane regen for F3 landed in soc-58nt.2.7.
skills-codex hashes for the two changed skills refreshed via
scripts/regen-codex-hashes.sh; codex-parity audit clean.
bead: soc-58nt.3.5
* docs(goals): F5.6 re-steer loop docs in /post-mortem
Cross-reference the auto re-steer loop from the Compound-Engineering Retro
section of skills/post-mortem/SKILL.md: when the compound retro names a
chronically regressing directive, ao goals steer recommend prints
policy-driven directive mutations from the same verdict ledger and ao goals
steer apply writes the mutation to GOALS.md, human-gated via the non-lossy
patcher (ADR-0006). Mirrors the existing "closing the loop" cross-ref shape
used elsewhere in the skill's See Also prose.
The ao goals steer recommend/apply COMMANDS.md surface, the F5 e2e CI lane,
and the ADR-0006 documentation-index link landed atomically in soc-58nt.2.7's
epic-wide regen; the re-steer contract detail lives in
skills/goals/references/executable-spec-chain.md (also in 2.7).
skills-codex/post-mortem hash refreshed; codex-parity audit clean.
bead: soc-58nt.5.6
* docs(goals): F4.5 docs regen for goals trace + render (epic-subsumed)
F4's docs deliverables — the `ao goals trace` and `ao goals render` entries in
cli/docs/COMMANDS.md, the F4 trace-chain e2e CI lane in validate.yml, the
ADR-0005 documentation-index link, and the Trace/Render mode sections plus the
trace contract in skills/goals/SKILL.md + references/executable-spec-chain.md —
all co-landed atomically in soc-58nt.2.7's epic-wide CLI-reference regen
(commit
|
||
|
Boden Fuller
|
d1f01537d0 | feat(goals): expose directive scenarios in goals parser | ||
|
Boden Fuller
|
3e870eb148 | fix(validation): close postmortem follow-up beads | ||
|
Boden Fuller
|
66759d28b1 | fix(rpi): align execution packet loop fields | ||
|
Bo
|
a4108a5503 |
fix: critical audit findings remediation (epic soc-ab5g) (#279)
* fix(session): sanitize init-step exec and correct BEADS_ACTOR
Two defects in `ao session spawn` runInitSteps, from the 2026-05-16
codebase audit (epic soc-ab5g):
- BEADS_ACTOR was exported as the expanded command string of the first
init step instead of the session actor identity, so beads attribution
for every init step was garbage. Thread tmpl.Identity.BeadsActorTemplate
through runInitSteps and export the var only when non-empty.
- Init steps ran via raw exec.Command("bash","-c",...) (SEC-C1). Route
init-step exec through shellutil.SanitizedBashCommand and add
sanitizeHostname() to strip shell metacharacters from {{hostname}}-class
template vars before substitution.
New regression tests: TestRunInitStepsSetsBeadsActor, TestSanitizeHostname.
Refs: soc-jhxr
* fix(autodev): replace vague 'validation failed' with a concrete summary
outputAutodevValidateResult returned fmt.Errorf("validation failed")
after already printing the detailed INVALID/ERROR lines -- a redundant,
content-free wrapper. Return a summary naming the file and the
validation-error count instead (COPY-C1, epic soc-ab5g).
Refs: soc-mpzu
* docs(eval): strip internal Day-N cadence jargon from user-facing text
eval_task.go exposed internal sprint labels ("Day-2 placeholder",
"Day-3 wires real launch", "Day-4 gate #4") in command Long
descriptions and flag help. Reword to describe current behavior
without the internal cadence (COPY-C2, epic soc-ab5g).
Refs: soc-iy7p
* fix(cli): reject unknown subcommands on group commands
Group-parent commands (daemon, beads, codex, constraint, factory,
goals, hooks, ratchet, rpi, session) had no Args validator, so an
unknown subcommand printed help to stdout and exited 0 -- breaking
`if ao rpi <bad>; then ...` scripting. Add Args: cobra.NoArgs to all
ten; unknown subcommands now exit 1 with the error on stderr
(CLI-C1, epic soc-ab5g).
Refs: soc-mlqe
* docs(cli): regenerate COMMANDS.md after eval-task help copy edit
* fix(daemon): contain dream output_dir against path traversal
DreamRunJobSpec/DreamStageJobSpec/DreamStageManifest Validate() only
TrimSpace-checked output_dir, leaving the operator-supplied job payload
free to redirect summary/log writes outside the intended tree.
validateOutputDir now rejects ".." traversal in all three Validate()
paths; outputDirContained rejects an absolute output_dir resolving
outside the daemon working tree, checked in DreamExecutor.RunJob before
MkdirAll. Containment checks: 1 (symlink only) → 3 (symlink + .. + abs).
Closes soc-ly33 (SEC-C2, epic soc-ab5g).
* fix(cli): wire ao --version flag and unify goals --json with -o
rootCmd had no Version field, so `ao --version` was unsupported even
though an `ao version` subcommand existed. Set rootCmd.Version = version
(the ldflags-injected build var) so the standard --version flag works.
goals registered its own local --json bool, disconnected from the
global -o/--output flag — `ao goals measure -o json` was ignored. Drop
goalsJSON; goalsJSONOutput() now reads GetOutput(), the sibling pattern
used by agentopsd.go, autodev.go, codex.go and ~40 other callsites. The
global --json persistent flag is inherited, so `ao goals --json` still
works; output paths honored by goals: 1 (local bool) → 2 (--json + -o).
Closes soc-nx1o (CLI-C2, epic soc-ab5g).
* perf(cli): collapse tmux probe storm in ao rpi status
checkTmuxSessionAlive forked `tmux has-session` up to 3 times per
non-terminal run, each with a 2s timeout — a status scan over N runs
issued 3N subprocesses and could stall ~6N seconds when tmux was slow
or absent.
probeTmuxSessions now runs one `tmux ls -F #{session_name}`, memoized
per process behind a mutex-guarded cache; tmuxSessionAlive filters the
snapshot in Go. resolveRPIToolchainDefaults collapses from per-run to
once. Subprocesses per status scan: 3N → 1.
Closes soc-d7v5 (PERF-C1, epic soc-ab5g). Mirrors the snapshot-then-
filter shape used elsewhere for batch probes.
* perf(cli): one-pass git capture + walk-once index in ao beads audit
ao beads audit re-shelled git per bead (one `git log --grep` per bead,
one `git log --since` per bead-path pair) and re-walked the worktree
per pattern (recordAuditStaleFinding probes up to 10 patterns/bead, so
up to 10N full-repo walks for N beads).
captureAuditCommits now runs a single `git log --all --name-only`,
parsed into auditCommit records; grepCommitsForID and
fileChangesSinceCommits filter that slice in Go. repoContentCache walks
the scoped roots once (lazily) and memoizes a path->content map shared
across every pattern probe. git subprocesses per audit: O(beads) → 1;
repo walks: O(10*beads) → 1. Mirrors the snapshot-then-filter shape
just applied to ao rpi status.
Closes soc-2grz (PERF-C2, epic soc-ab5g).
* fix(schemas): declare schema_version const in 15 unversioned schemas
15 of 34 schemas under schemas/ carried versioned filenames (or implied
a stable contract) without a machine-readable schema_version, so a
consumer could not detect the version from the payload alone.
Each now declares an optional schema_version integer const, mirroring
the shape in schemas/bead.v1.schema.json: const 1 for every schema
except skill-frontmatter.v2 (const 2). The field is intentionally left
out of "required" so existing documents without it still validate —
non-breaking. scenario.v1 keeps its legacy "version" field alongside.
Schemas declaring schema_version: 19/34 → 34/34.
Closes soc-wzgo (API-C2, epic soc-ab5g).
* docs(contracts): regenerate context-map after merging main
The merge of origin/main pulled a discovery SKILL.md description edit
without its companion context-map regeneration, so
validate-context-map-drift flagged 1 stale line. Regenerated via
scripts/generate-context-map.sh. Drifted lines: 1 → 0.
|
||
|
Boden Fuller
|
b8c5a3761b |
feat(agentops): make 3.0 hookless-first
Add DDD skill-domain contracts, hook lease inventory, replacement ports, artifact-first RPI skill boundaries, and release exact-SHA validation. Demote ao inject to a compatibility adapter and remove prompt-only default hooks. |
||
|
Boden Fuller
|
ee763750ba |
docs: rename PRACTICE.md to PRACTICE-REGISTRY.md + add CDLC narrow-waist doctrine
Rescope PRACTICE.md into PRACTICE-REGISTRY.md: it now owns only the practice-slug lineage registry, not product positioning or CDLC doctrine. Update all references (schema, validate-practice-citations.sh, bats test, architecture-terms.md, documentation-index.md, aggregate.go comment). Introduce the Context Density Rule as a canonical domain concept: every high-value context token carries intent, boundary, evidence, decision, constraint, or next action. New domain entry context-density-rule.md (+ codex mirror). Thread the BDD/Gherkin + DDD + Hexagonal + TDD narrow waist through cdlc.md, README.md, PRODUCT.md, GOALS.md, and the rpi/domain/ post-mortem skills. Sync codex artifacts. |
||
|
Boden Fuller
|
6ce5df6f45 |
fix(ci): clear 4 post-merge CI failures on DDD/hexagonal PR
doc-release-gate: exclude generated cli/embedded/ mirror from link validation (its relative links resolve at source depth, not mirror depth) + allowlist 3 doctrine links to the gitignored .agents/research/ note registry-check: regenerate registry.json (77 skills) stale after the 127-commit merge plugin-load-test + skill-schema: add hexagonal_role/consumes/produces/context_rel to skill-frontmatter.v1 schema — v2 dropped v1's other props so it is not a drop-in superset; extending v1 keeps full validation. 77/77 -> 77/77 pass. Verified locally: validate-links 0 broken, validate-skill-schema 77/77, validate-manifests exit 0, doc-release-gate PASS. |
||
|
Boden Fuller
|
91a8e2d12e |
feat(schemas): SKILL.md frontmatter v2 with hexagonal_role/consumes/produces/context_rel
Adds an additive, optional schema extension that future-proofs cross-skill relationship modeling. All four new fields are optional — every existing SKILL.md (77/77) passes default validation; --strict warns on missing optionals (Issue #3 backfills next wave). CI job mirrors the validate-ci-policy-parity contract; AGENTS.md updated to keep CI parity. Issue #2 of the DDD+Hexagonal v1 plan. Applies finding-2026-05-07-ci-parity-as-wave-acceptance. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Boden Fuller
|
f4f3dd63d9 |
feat(practice): pass-10 backfill — practices: declared on all 33 schemas/
schemas/ pool exhausted (33/33). Mixed declaration carrier: - 22 schemas: top-level "practices": [slug, ...] sibling to "description". Loose JSON Schema (no additionalProperties: false at root) accepts unknown keywords; meta-schema treats this as inert metadata. - 11 schemas with additionalProperties: false: "$comment": "practices: [slug, slug]" — $comment is a reserved meta-keyword and the citation validator regex matches the practices: substring inside it. After pass 10: 160 with practices / 594 missing. Remaining: evals/ (61), cli/ (533). schemas/, hooks/, and skills/ all fully declared. Added scripts/insert-schema-practices.py (one-off): deterministic insertion, validates JSON parses before writing. |
||
|
Boden Fuller
|
235e5c20f2 |
feat(practice): backfill practices: declarations into 13 RPI-core skills
Pass 1 of N: lands practices: frontmatter declarations on the RPI-lifecycle and foundational skills (rpi, discovery, crank, validation, plan, implement, vibe, pr-prep, pr-validate, post-mortem, domain, flywheel, handoff), each citing 3-4 slugs from PRACTICE.md's 45-slug registry. scripts/validate-practice-citations.sh report now: primitives scanned: 754 with practices field: 13 (was 0) missing practices field: 741 (was 754) invalid slug citations: 0 Schema fix in same commit (required infrastructure that was missed in the pre-mortem audit): schemas/skill-frontmatter.v1.schema.json had additionalProperties: false, which would have rejected every practices: declaration via validate-manifests.sh. Added practices as a recognized array-of-slug property; this unblocks all future backfill passes. Codex twins intentionally NOT modified — skills-codex/* SKILL.md frontmatter is strictly name+description by design (enforced by scripts/validate-codex-generated-artifacts.sh). Skills-codex .agentops-generated.json markers regenerated via regen-codex-hashes.sh to record the source-side content drift. Plan: .agents/plans/2026-05-10-practice-citation-backfill-rpi-core.md Research: .agents/research/2026-05-10-practice-citation-backfill-mapping.md Pre-mortem: .agents/council/2026-05-10-pre-mortem-practice-citation-backfill.md (PASS, with one gap noted: schema enforcement) Bead epic: soc-hdot (14 child issues closed) Local pre-push gate (fast): green. |
||
|
Bo
|
729fbf8ab6 |
Sharpen RPI lifecycle: criterion contract + isolation enforcement + daemon executor swap (soc-bcrn) (#255)
* feat(rpi): executionPacket criterion contract foundation (UW0 of soc-bcrn) Extend executionPacket with EpicCriteria []rpi.Criterion and BeadCriteria map[string][]rpi.Criterion, backed by a new exported rpi.Criterion type. Add JSON schema (draft 2020-12) covering envelope + criterion shape; if/then enforces agent_judge when check_type == custom_rubric (pre-mortem advisory fix #1). DoneCriteria preserved verbatim for v1 back-compat. New round-trip tests cover criteria-populated, v1-no-criteria, custom-rubric, and omitempty cases. Lands soc-bcrn.1.1 (E1.1). go test ./... → 11911 passed in 50 packages. * feat(skills): acceptance_criteria contract across discovery/plan/crank/validation (UW1 of soc-bcrn) Wire the per-criterion contract through the lifecycle skills (text-only; no code changes). Skill text now references the JSON schema landed in UW0 (schemas/execution-packet.schema.json) as canonical. soc-bcrn.1.2 — discovery/plan emit acceptance_criteria fences: - skills/discovery/SKILL.md STEP 4 + STEP 6 amendments - skills/discovery/references/output-templates.md links the schema - skills/plan/SKILL.md issue-decomposition step requires the block soc-bcrn.1.3 — crank pre-spawn read + per-criterion checkpoint: - Step 4 instructs orchestrator to inject metadata.validation.acceptance_criteria - Step 5.7 checkpoint format adds criterion_verdicts[] soc-bcrn.1.4 (E1.4+E1.5 merged on shared file) — validation: - Per-criterion verdict table replaces vibe-only - Back-compat WARN until 2026-06-30, then FAIL (pre-mortem fix #2) - New skills/validation/references/per-criterion-rubric.md go test ./... → 11833 passed in 50 packages. * fix(skills): correct check_type terminology in crank acceptance-criteria injection Worker B's UW1 amendment hallucinated `kind (test|structure|content|command|lint)` as the criterion field/enum. Actual schema uses `check_type` with enum `test_pass | command_exit_zero | file_exists | grep_match | manual | council_judge | custom_rubric`, plus the conditional `agent_judge` field for `custom_rubric`. Replace with the verbatim shape from schemas/execution-packet.schema.json $defs/Criterion. Caught by self-review of 81d729fc. * feat(rpi,skills): isolation contract + lint + addSignalWithEvidence (UW2 of soc-bcrn) soc-bcrn.2.1 (E2.1+E2.3 merged): - skills/rpi/references/isolation-contract.md (NEW): codifies PRODUCT.md operational principle #5 with declaration-vs-enforcement framing, four-lever table (text / hook / daemon / combination — recommends D), compression patterns + false-positive guard. - scripts/check-skill-isolation.sh (NEW, executable): bash lint that greps phase-skill SKILL.md for compression patterns. Runs clean on current tree; injection-regression test passes (rc=1 on 'I will research' violation). soc-bcrn.3.3 (E3.S2): - session_outcome.go: addSignalWithEvidence(regex, evidence, weight) override path; tests_pass now credited via either regex or evidence. - internal/rpi/artifacts.go: LaneResult + ParseValidationLanesResults (forward-compat — accepts {passed:bool}, {status:"PASS"}, {result:"PASSED"}; empty slice when packet field absent). - rpi_evaluator.go: collectPhaseSessionOutcome reads packet validation_lanes_results and threads any-PASS reduce to evidence path. - session_outcome_test.go: 3 new tests cover override, both-false, regex-alone. UW2 verify-only beads (closed without code): - soc-bcrn.3.1 (E3.S1): captureCreatedEpicID already merged at rpi_phased_discovery.go:43, primary callsite rpi_phased_gates.go:83. - soc-bcrn.3.2 (E3.S3): preserveWorktreeCommits already merged at rpi_cleanup.go:399, called BEFORE git worktree remove --force. go test ./... → 11833 passed in 50 packages. * feat(skills,scripts): isolation-contract cross-links + RPI surface smoke (UW3 of soc-bcrn) soc-bcrn.2.2 (E2.2): Cross-link skills/{rpi,discovery,crank,validation}/SKILL.md to the isolation contract reference doc landed in UW2. Each link uses the lint-allowed `See [...](path)` form. lint runs clean. soc-bcrn.3.4 (E3.S4): scripts/test-rpi-surface-smoke.sh (NEW, executable). Static-surface smoke covering 6 checks: bin presence, schema validity, skill-isolation lint, dangling commits (informational), bd workspace, schema-criterion-fields. Returns PASS/FAIL summary. Path-collision recovery: bead body said scripts/test-evolve-cycle-smoke.sh, but that path was already taken by PR #241 (end-to-end cycle smoke wired into pre-push-gate's --smoke-evolve flag). Restored the original; renamed this new static-surface smoke to scripts/test-rpi-surface-smoke.sh. The two scripts have distinct purposes (cycle E2E vs static surface) and should coexist. go test ./... → 11832 passed in 50 packages. * docs(rpi): rollback discipline note in phase-data-contracts.md (UW4 of soc-bcrn) soc-bcrn.3.5 (E3.W3): document phase-3-first / phase-2-second rollback discipline. Re-routed from the plan's `program-templates/phase-{2,3}.md` path (which doesn't exist in the repo) to the existing phase-data-contracts.md ref doc. Pre-mortem F3 of soc-bcrn flagged this as the primary rollback risk for E3 (consolidated daemon epic). E3.S3 (already merged) is the worked example: preserveWorktreeCommits (phase-3 logic) shipped BEFORE the phase-2 cleanup-removal. soc-bcrn.2.3 (E2.4 verify): closed without code change — isolation-contract.md already has 3 forward-references to rpi_run.go from UW2. go test ./... → 11834 passed in 50 packages. * feat(daemon): RPIRunExecutor in-process runner replaces CLI-fallback shell-out (UW5/5a of soc-bcrn) soc-bcrn.3.6 (E3.W4 sub-wave 5a, additive): - NEW cli/internal/daemon/rpi_run.go: RPIRunExecutor with function-pointer pattern (RPIRunFunc). Mirrors DreamExecutor structure. Validates full-cycle specs (start_phase=1, max_phase=3) and emits artifacts tagged executor_policy=in-process / backend=in-process. - NEW cli/internal/daemon/rpi_run_test.go: 5 tests (runs-via-func, rejects-wrong-jobtype, propagates-runner-error, validate-full-run, requires-fields). - agentopsd.go: buildAgentOpsDaemonCLIFallbackRPIExecutor now wires RPIRunExecutor with defaultCLIFallbackRPIRunFunc that calls runPhasedEngine in-process. New CLIFallbackRPIRunFunc option lets tests inject fakes. buildPhasedEngineOptionsFromSpec maps obvious fields (RunID, TestFirst, ExecutionPacketPath→DiscoveryArtifact, PhaseTimeout); other phasedEngineOptions fields use defaults. - agentopsd_test.go: TestAgentOpsDaemonCLIFallbackExecutorPolicyCompletesRPIRunJob rewritten to inject a fake RPIRunFunc instead of writing fake shell scripts. Asserts executor_policy=in-process, backend=in-process, rpi_run_status=completed. ADDITIVE only — RPICLIExecutor and scripts/ao-rpi-autonomous-cycle.sh preserved for nightly-evolution.sh until sub-waves 5b/5c migrate them. RPICLIExecutor has zero production callers after this change (only its own test file references the type). go test ./... → 11832 passed in 50 packages. * fix(daemon): RPIRunExecutor wraps supervisor (gates+landing+cycles) (UW5/5a-fix of soc-bcrn) soc-bcrn.3.8 — fix the regression sub-wave 5a introduced. Sub-wave 5a's defaultCLIFallbackRPIRunFunc called runPhasedEngine alone, silently losing the gate/landing/cycle semantics of the old shell wrapper that ran ao rpi loop --supervisor. Daemon-submitted rpi.run jobs would have skipped landing-policy enforcement. Changes: - RPIRunJobSpec gains 7 supervisor policy fields (all omitempty for back-compat): MaxCycles, GatePolicy, LandingPolicy, LandingBranch, BDSyncPolicy, FailurePolicy, KillSwitchPath. - agentopsd.go:defaultCLIFallbackRPIRunFunc now calls executeLoopCyclesCtx (thin context-aware wrapper around executeLoopCycles) — full supervisor loop with gates + landing + cycle management. - New buildSupervisorConfigFromSpec(spec, root) helper translates spec policy fields into rpiLoopSupervisorConfig, then validates via the supervisor's own validateLoopConfigPolicies. - Lease disabled in daemon path (cfg.LeaseEnabled=false) — daemon already owns queue-level claim; lease would deadlock. - Deleted dead helper buildPhasedEngineOptionsFromSpec. - 5 new tests: spec round-trip with policy fields, defaults-empty back-compat, spec→cfg mapping (3 cases incl. invalid-enum rejection). Forward-compat caveats noted in worker discoveries (NOT fully wired): - MaxCycles in spec is read but rpiLoopSupervisorConfig has no MaxCycles field; cycle count comes from the cobra-bound rpiMaxCycles global. Daemon path runs one cycle (matches nightly script default). - RunID, ExecutionPacketPath, TestFirst, PhaseTimeout in spec are not yet projected onto the cfg. go test ./... → 11835 passed in 50 packages. * feat(scripts,docs): nightly-evolution + 3 docs migrate to ao daemon submit (UW5/5b of soc-bcrn) soc-bcrn.3.7 (E3.W4 sub-wave 5b): scripts/nightly-evolution.sh — replace shell wrapper invocation (`scripts/ao-rpi-autonomous-cycle.sh`) with `ao daemon jobs submit --type=rpi.run` + `ao daemon jobs wait`. Liveness-probe via `ao daemon jobs list --json` before submit. Payload now carries supervisor policy fields (max_cycles, gate_policy, landing_policy, optional landing_branch) via the spec extension landed in 5a-fix; daemon executor runs the full supervisor loop (cycles + gates + landing). docs/contracts/agentops-daemon.md, docs/runbooks/daemon-factory-admission.md, docs/contracts/factory-admission.md — replace stale references to `scripts/ao-rpi-autonomous-cycle.sh` with the new in-process path (RPIRunExecutor, cli/internal/daemon/rpi_run.go). scripts/ao-rpi-autonomous-cycle.sh and cli/internal/daemon/rpi_cli_executor.go remain in-tree pending sub-wave 5c (deletion). go test ./... → 11835 passed in 50 packages. bash -n scripts/nightly-evolution.sh → clean. * chore(daemon): delete RPICLIExecutor + ao-rpi-autonomous-cycle.sh shell wrapper (UW5/5c of soc-bcrn) soc-bcrn.3 final E3.W4 cleanup. After sub-waves 5a (RPIRunExecutor), 5a-fix (supervisor wrapping + policy fields), and 5b (nightly migration to ao daemon submit), all production callers of these surfaces have been retired. Deleting: - cli/internal/daemon/rpi_cli_executor.go (5.6KB) — old shell-shelling executor - cli/internal/daemon/rpi_cli_executor_test.go (6.6KB) - scripts/ao-rpi-autonomous-cycle.sh (4.7KB) — legacy shell wrapper Final consumer audit: zero non-comment references to RPICLIExecutor or NewRPICLIExecutor remain. The new in-process path (cli/internal/daemon/rpi_run.go → executeLoopCyclesCtx) carries the same gate + landing semantics via supervisor wrapping. go test ./... → 11833 passed in 50 packages (down from 11835 — the 2 diff is from the deleted RPICLIExecutor's own tests). go build ./... + go vet ./... → clean. UW5 (E3.W4 / M3.5 daemon executor swap) complete. * docs(skills): best-practices citation table + 4 SKILL.md cross-links (UW6 of soc-bcrn) soc-bcrn.4 (E4 — Best-practices encoding): E4.1: NEW skills/rpi/references/best-practices.md. Table A (14 lifecycle principles) + Table B (6 anti-patterns) extracted verbatim from .agents/research/2026-05-07-rpi-lifecycle-sharpening.md §Objective 4. Each row carries a source citation and which skills should encode it. The doc explicitly says lifecycle skills MUST cite by # — never duplicate the body. E4.2: skills/{rpi,discovery,crank,validation}/SKILL.md — one-line cross-link added next to the existing isolation-contract.md citation. Each link uses the lint-allowed `See [...](path)` form. lint runs clean. Mechanical-enforcement section in best-practices.md cross-references prior soc-bcrn waves (UW0 schema $defs/Criterion, UW1 per-criterion-rubric, UW2 check-skill-isolation lint). go test ./... → 11832 passed in 50 packages. * feat(daemon,schema): agent-update protocol surface (UW7-1 of soc-y0ct) soc-y0ct.1 — protocol surface (schema + event types + payload structs). Defers ac-aup.3 (rpi_run.go emission) to a follow-up bead since it requires careful integration with the supervisor's existing event flow. - schemas/agent-update.schema.json (NEW): draft 2020-12 envelope {agent_update_version, event_type, payload}; 4 $defs (phase_start, phase_complete, criterion_verdict, phase_handoff) with allOf+if/then for type-tagged payload dispatch (mirrors UW0 Criterion's custom_rubric pattern). - cli/internal/daemon/types.go: 4 new EventType constants registered in the const block AND eventTypeSet (required for ValidateEventType). - cli/internal/daemon/agent_update.go (NEW): AgentUpdateVersion=1, 4 payload structs, 4 NewAgentUpdate*Event constructors that stamp the version, default empty timestamps, emit only-non-zero optional fields. Constructors deliberately leave EventID/RequestID/JobID/Actor unset — emission caller populates those. - cli/internal/daemon/agent_update_test.go (NEW): 7 test functions covering const + ValidateEventType registration, 4 payload round-trips, version stamping, and timestamp default. Status enums per spec: phase_complete uses lowercase (success|failure| timeout) matching JobResultStatus; criterion_verdict uses uppercase (PASS|FAIL|SKIP) matching the verdict vocabulary in schemas/verdict.v1.schema.json. go test ./... → 11842 passed in 50 packages (up from 11833 — the +9 is the new tests under ./internal/daemon/). * feat(tests,docs): wave 0 operator canary + software-factory drift stopgap (soc-kizn.11) Adds tests/e2e/factory-operator-canary.sh: narrow L1/L2 smoke that prints the five operator-surface anchors (briefing, next delivery, validation, evidence, closeout) and reports each as resolved-path or explicit-unavailable. Does not claim factory yield, autonomous merge, or L3 proof. Reframes the Codex section of docs/software-factory.md so the canonical hookless route is `agentopsd` (`ao daemon submit ...`), and `ao codex *` is documented only as deprecated legacy fallback. Strips routine `ao codex *` recommendations from the Surface Map. Validation now passes: `rg 'ao codex (start|stop)|ao codex ensure-(start|stop)' docs/software-factory.md | rg -v 'hookless|compat|legacy|fallback|deprecated'` returns empty. Full Codex skill/runtime parity cleanup remains tracked in soc-kizn.8. * docs(skills): move forge Examples to references/ to fit 248-line CI limit (soc-pul8) skills/forge/SKILL.md was 260 lines after the soc-yjzp.3 cross-vendor analog edit, over the 248-line skill-lint ceiling. Moves the two Examples walkthroughs (SessionEnd hook invocation + manual transcript mining) to skills/forge/references/examples.md, replacing the section body with a link. Now 237 lines. heal.sh --strict clean (new references file is linked). hooks/skill-lint-gate.sh exits 0. Codex parity audit passes. * fix(skills): copy rpi references into crank/discovery/validation, fix dead-ref gate UW3 ( |
||
|
Bo
|
19f520f847 |
Nightly 2026-05-06 — 3 productive cycles, +1 code-driven goal, 94.29 → 100.00 (#235)
* refactor(cli): drop go-complexity-ceiling violators below thresholds
printRegistryTable in cli/cmd/ao/registry.go was at CC=28 against the
cli/ ceiling of 20, and FactoryAdmissionEvaluator.evaluate in
cli/internal/daemon/factory_admission.go was at CC=24 against the
cli/internal/ ceiling of 18. Together they were the only non-test
production functions failing the gate.
Each violator naturally split into independent phases that already
had separate cohesion:
- printRegistryTable: extract a registrySectionEmitters table whose
rows describe each surface kind (skills/hooks/stores/jobs/evals/
cli/cadence) plus a small writeRegistrySectionHeader/registry
SectionShouldShow pair. The parent loops once and gates on the
active --type filter without repeating the seven if/else blocks.
CC drops from 28 to 3.
- FactoryAdmissionEvaluator.evaluate: extract collectFactory
AdmissionEvidence (with one helper per evidence source: repo,
open-PR blockers, CI baseline) plus parseFactoryAdmissionWindow,
evaluateFactoryAdmissionWindow, evaluateFactoryAdmissionAggregate.
The decision-builder reads as a flat sequence of phases and the
per-source error handling is independently testable. CC drops
from 24 to 5.
No behavior change. cli/internal/daemon and cli/cmd/ao test suites
both green; ao goals measure flips go-complexity-ceiling fail to
pass and code-driven score 94.29 to 100.00 on this branch baseline.
Cycle 1 of nightly/2026-05-06.
* fix(overnight): align dream RunTimeout cap with config default (6h to 8h)
The dream config default RunTimeout (cli/internal/config/config.go:335)
has been "8h" for as long as the file has existed, and the same value
is hard-coded as the fallback in cli/cmd/ao/overnight.go,
overnight_setup.go, and the resolveStringField default in
cli/internal/config/config.go:969. The runtime cap in
cli/internal/overnight/types.go was 6h, so every default-config dream
run silently clamped to 6h and appended a "RunTimeout clamped to 6h
hard max" entry to summary.json.degraded.
The dream curator then promoted that permanent degraded entry into a
morning packet ("Investigate Dream degradation: RunTimeout clamped to
6h hard max"), which the consumer-side tractability probe correctly
treated as actionable but pointing at session-state files. It re-
emitted on every nightly run because the underlying state never
changed — there was nothing to investigate, the runtime was clamping
its own default.
Fix is one-line: raise maxRunTimeout to 8h to match the prevailing
default. The 6h cap was not load-bearing — it appears nowhere else
in the codebase, and the comment now records why the two values must
move in lockstep.
Add TestRunLoopOptionsNormalize_RunTimeoutMatchesDreamConfigDefault
as a regression. It locks maxRunTimeout to 8h, asserts the default
config passes through unclamped, and asserts an over-cap value still
produces the clamp warning so the safety check is not lost. End-to-
end verified by re-running 'ao overnight start' after the change:
summary.json.degraded no longer contains the clamp entry.
Cycle 2 of nightly/2026-05-06. Resolves the morning packet
dream-3fe168c54c55084b.
* fix(overnight): skip dream session-state paths in target-file probe
probeTargetFilesExist statted every cited TargetFiles path and flagged
the packet stale on the first hit. Every dream-* packet generator
(degraded, metrics-health, retrieval-live) cites its own session-
state output as the target — summary.json, metrics-health.json,
retrieval-bench.json — so after the dream run that emitted the
packet, those files always exist and the probe always said "target
file already tracked".
The downstream effect: each nightly's curator suppressed every dream-*
packet, the stale-rate threshold (50%) tripped, and the curator
emitted a "dream-curator-degraded" entry into summary.degraded that
the degraded-packet generator then surfaced as ANOTHER packet on the
next run. Three of the last four nightlies hit this loop.
Fix: probeTargetFilesExist now skips paths under .agents/overnight/
and .agents/dream/. Those are the dream session-state hierarchy —
files written by the dream run itself, whose presence is not a
signal about whether the packet's underlying issue is resolved. Real
source/contract paths still trigger staleness.
Tests:
- TestProbeDreamPacketStaleness_SessionStateTargetsAreNotStale exercises
summary.json / metrics-health.json / retrieval-bench.json /
probe-results.jsonl in both relative and absolute forms.
- TestProbeDreamPacketStaleness_RealSourceTargetIsStale locks the
inverse so the session-state skip cannot quietly broaden into a
general escape hatch.
End-to-end verified: re-running 'ao overnight start' after the change
produces 3 actionable morning packets with stale=false in
.agents/dream/probe-results.jsonl, and summary.degraded no longer
contains "dream-curator-degraded: stale packet rate ...".
Also marks the RunTimeout-clamp morning packet from cycle 1 of this
nightly as consumed in .agents/rpi/next-work.jsonl now that the
underlying fix has landed (cycle 2).
Cycle 3 of nightly/2026-05-06.
* chore(nightly): persist final-goals.json for 2026-05-06
* chore(nightly): record inherited canary failures in 2026-05-06 baseline
The agentops-contract-canaries (required) check failed on PR #235 with
6 failing suites. Reproduced locally on origin/main HEAD (
|
||
|
Boden Fuller
|
e4c50275dd |
docs(parity): spec docs + JSON schemas for outcomes/watch/worker-spec (epic soc-yjzp Wave 3a)
Closes soc-yjzp.7 (spec-only deliverable). yjzp.6 and yjzp.8 stay open with the spec phase complete; Go implementation deferred to a fresh session that can afford the full --test-first SPEC->TEST->RED->GREEN->IMPL ceremony. Spec docs (docs/contracts/): - ao-outcomes.md: full implementation spec for `ao outcomes run --rubric --target` with rubric schema fields, separate-context grader contract, error & rescue map (rubric not found, malformed, target failure passthrough, grader timeout, budget exhausted, SIGINT), result JSON shape, and L1/L2 test plan. Implements pre-mortem fixes 2 + 3 verbatim. - ao-watch.md: spec for `ao watch --follow` (Console-trace analog). Names the trace.go collision and resolves it (verb is `watch` not `trace`). Event schema, retention, kill criterion 2026-06-15. Implements pre-mortem fix 4. JSON schemas (schemas/): - rubric.v1.schema.json: validates ao outcomes run rubric files. Required criteria array with weighted entries summing to 1.0; pass_threshold default 0.8; retry_budget default 3, hard cap 10; grader_timeout_seconds default 300. - worker-spec.v1.schema.json: validates per-worker model/tool/prompt isolation specs for /crank and /swarm. Implements pre-mortem fix 6 (model field is enum-strict; additionalProperties:false at top level so field-name typos fail loudly). Operator docs: - skills/crank/references/worker-specs.md: when-to-use guidance, schema pointer, storage convention, anti-patterns. Doc-index entries link the two new contracts and the two new schemas per the project's "Contracts must be catalogued" rule. Closes-issues: soc-yjzp.7 Refs-epic: soc-yjzp Spec-phase-complete: soc-yjzp.6, soc-yjzp.8 (Go implementation pending) |
||
|
Boden Fuller
|
8281ecfd0d | feat(daemon): add factory admission job specs | ||
|
Boden Fuller
|
80f53fb028 |
feat(eval): add context_comprehension dimension, CDLC identity, and observability feedback loop
Reframe AgentOps as a "context compiler" across README, docs/index.md, and PRODUCT.md — replacing "operational discipline" / "local operating layer" with context-first language aligned to the Context Development Life Cycle (CDLC). Add context_comprehension eval dimension (schema + Go types + validation) with a deterministic eval suite and shell fixture that scores SKILL.md structural quality (steps, flags, examples, output spec, length). Add SkillLoadEvent to the citation pipeline so ao inject --for=<skill> records a skill_loaded CitationEvent via ratchet.RecordCitation, closing the gap between "what context was loaded" and "how the session went." Wire quality-signal corrections from hooks/quality-signals.sh into the flywheel close-loop so user corrections reduce utility of loaded skills, completing the observe → adapt feedback loop. Ref: soc-hsef, Debois CDLC talk (AI Engineer 2026) |
||
|
Boden Fuller
|
f40ba2f866 | Merge branch 'crank/soc-dpci' into main | ||
|
Boden Fuller
|
65f9d3ff27 |
feat(daemon): add factory validation and yield contracts
Refs soc-dpci.6 Refs soc-dpci.7 |
||
|
Boden Fuller
|
43a5217621 | feat: add agentopsd routing policy guardrails | ||
|
Boden Fuller
|
8385cf6a64 | chore: add release readiness gate | ||
|
Boden Fuller
|
13e3241c36 |
feat(schedule): add .agents/schedule.yaml schema + parser package (soc-8inr.3)
New cli/internal/schedule package parses .agents/schedule.yaml into []daemon.RecurringJobTemplate. Strict yaml.v3 KnownFields(true) decode + amendment B4 DoS protections: duplicate-name rejection, job_type pattern ^[a-z]+\.[a-z]+$, sub-minimum effective period rejection (60s default, override via AGENTOPS_SCHEDULE_MIN_PERIOD_SECONDS), and max_queue_depth ceiling (1000 default, override via AGENTOPS_SCHEDULE_MAX_QUEUE_DEPTH_CEILING). JSON-schema schemas/schedule.schema.json mirrors the same constraints with additionalProperties: false at every nested object. L0 tests: 9 named cases including TestParser_LoadValidYAML, RejectsDuplicateName, RejectsInvalidCron, RejectsUnknownJobType, RejectsUnknownTopLevelField, RejectsUnknownBackpressureField, RejectsSubMinuteCron (env override), RejectsExcessiveQueueDepth, and HonorsMinPeriodCeilingEnvOverride. |
||
|
Boden Fuller
|
75bc023ec2 |
feat(extract): import olympus v5 contracts + reference docs into agentopsd
Lands the agentops-tqc extraction (32-bead epic). Olympus repo
(~/dev/personal/olympus, v5.0.1) was superseded 2026-04-28 by agentopsd;
this imports the load-bearing patterns and contracts.
New code surface:
- schemas/{bead,briefing,learning,phase,quest,verdict}.v1.schema.json
(6 JSON schemas, contracts independent of Go type structs)
- cli/internal/types/quest/{atomic,atomic_test}.go + {atomic_fault,
json_marshal_guard}_test.go: atomic file-write helpers (canonical
destination for future writeFileAtomic dedup)
- cli/cmd/ao/exit_codes.go: 0/1/2/42 exit-code protocol from Olympus zeus
- cli/internal/context/brief_render{,_test}.go: pure-fn Render +
RenderAndPersist shell (olympus hermes pattern, post-Feb-24 reduction)
- cli/cmd/ao/cobra_conformance_test.go: bidirectional spec/code walk
locking cli/docs/COMMANDS.md against drift
Documentation:
- 11 new AGENTS.md files (10 cli/internal/<pkg>/ + cli/internal/types)
- docs/standards/olympus-engineering-standards.md (reference port,
subordinate to canonical agentops rules)
- docs/runbooks/{autonomy-runtime-cycle-1,release-process}.md
- docs/code-map/agentopsd-codebase-map.md
- docs/design/olympus-v4-specs/ (8 v4 specs as REFERENCE only)
- docs/documentation-index.md updated with new entries
Build/vet/test green. Follow-up beads (agentops-3ga) consolidate atomic
helpers and fix the spec generator.
Source: ~/.agents/olympus-history-index.md
Plan: .agents/plans/2026-04-29-plan-extract-olympus-into-agentopsd.md
|
||
|
Boden Fuller
|
1ec75aaa21 | feat(eval): classify evidence and audit baselines | ||
|
Boden Fuller
|
1c02633eef |
docs(remote): add remote compute contracts
Refs ag-1m0.1 |
||
|
Boden Fuller
|
4386f2e422 |
feat(evals): add 'security' to eval-suite domain enum
Adds 'security' as a ninth accepted value in the eval-suite domain taxonomy, enabling future security-domain eval manifests under evals/agentops-core/. Three coupled surfaces moved together to keep schema, production default, and test fixture in lock-step: - schemas/eval-suite.v1.schema.json: $defs/domain enum - cli/internal/eval/coverage.go: DefaultCoverageDomains - cli/cmd/ao/cobra_commands_test.go: evalCoverageDomains reset ao eval coverage will now report 'security' under missing_required_domains until a security-domain manifest is authored; that's the intended forcing function for the next piece of work. Tracked as bd ag-3bi. Plan, research, pre-mortem, vibe, and post-mortem artifacts written under .agents/ (gitignored). Applied learning: f-2026-04-27-004 (CI contract scanners need syntax parity). |
||
|
Boden Fuller
|
4caf45895a | docs: add eval environment contract | ||
|
Boden Fuller
|
1131658e61 | Align Codex plugin metadata with marketplace spec | ||
|
Boden Fuller
|
50cf99fed9 |
feat(validation): swarm evidence schema + validator + gate wiring
Defines a tracked contract for swarm worker result files living under
.agents/swarm/results/<task>.json. These files were implicitly shaped
but never validated — misshapen packets could silently break crank
result ingestion.
- schemas/swarm-evidence.schema.json: JSON Schema. Required: task,
status, files_changed, notes. Optional: tests, gate, evidence,
before/after counters. additionalProperties=true permits task-specific
extensions.
- scripts/validate-swarm-evidence.sh: jq-based validator accepting a
file or directory. ajv fallback when available. Exit 0 pass, 1 fail.
- docs/contracts/swarm-evidence.md: human-readable contract doc with
example and schema link. Added to docs/INDEX.md catalog.
- scripts/pre-push-gate.sh: new section 26b ('swarm evidence schema')
invokes the validator on every push.
- scripts/check-contract-compatibility.sh: extended ref resolution to
also search schemas/ so docs/contracts/*.md can cite
schemas/*.schema.json without tripping the cataloguing check.
Consumes ag-yhr 'Implement executable swarm evidence schema validation'.
|
||
|
Boden Fuller
|
3744d6c90d |
feat(validation): add agent-built behavioral specs (Stage 4 Phase 3)
During /implement Step 5c, the implementing agent now produces a behavioral spec (.agents/specs/<issue-id>.json) documenting expected behaviors alongside code. During /validation STEP 1.8, the evaluator council validates code against both holdout scenarios AND agent-built specs. Changes: - Widen scenario schema id pattern to accept auto-* prefix for agent specs - Add Step 5c to /implement with spec template and guidelines - Add advisory spec completeness gate to gate-checks.md - Enhance STEP 1.8 to scan .agents/specs/ alongside .agents/holdout/ |
||
|
Boden Fuller
|
aef1efab3f |
feat(validation): add Stage 4 behavioral validation — holdout scenarios + satisfaction scoring
Add the missing validation tier between council/vibe (Stage 3) and production (Stage 5). Inspired by StrongDM's Digital Twin Universe and Shield AI's SITL/HITL/VITL fidelity ladder. New capabilities: - Holdout isolation hook: PreToolUse gate blocks agent access to .agents/holdout/ unless AGENTOPS_HOLDOUT_EVALUATOR=1 (prevents reward hacking) - Scenario schema: schemas/scenario.v1.schema.json defines holdout scenario format - Verdict extension: satisfaction_score (0.0-1.0) and satisfaction_breakdown added as optional fields to verdict schema (v4) - Scenario skill: /scenario for authoring and managing holdout scenarios - Validation pipeline: STEP 1.8 inserted for behavioral validation - Vibe exposure: weighted_score now exposed as satisfaction_score - CLI commands: ao scenario init|list|validate with 11 passing tests - Planning rule: schema wave ordering for additionalProperties:false |
||
|
Boden Fuller
|
45db7ab97b |
feat(skills): apply Claude Code architecture lessons — retry budgets, stability flags, quality signals, orchestration pattern
Inspired by patterns discovered in Claude Code's npm source map leak: - Add hook failure budget to lib/hook-helpers.sh (MAX_CONSECUTIVE_HOOK_FAILURES=3, configurable via AGENTOPS_HOOK_FAILURE_CAP) — prevents runaway hook loops - Add metadata.stability field (experimental|stable) to skill frontmatter schema with heal.sh validation (H010) and skill-conventions documentation - Add quality-signals.sh hook detecting repeated prompts and correction patterns, logging to .agents/signals/session-quality.jsonl with defined schema - Document orchestration-as-prompt as a first-class pattern in shared references, linked from crank, swarm, evolve, rpi skills with codex parity |
||
|
Boshu2
|
92bc02dd9a |
feat(schemas): add output_contract field and canonical finding-item schema
Wave 1 of ag-1rh (Skill Output Standardization): - Add output_contract optional field to skill-frontmatter.v1.schema.json - Add optional finding id field to verdict.json for cross-skill correlation - Create schemas/finding.json as canonical finding-item schema - Document output_contract in SKILL-API.md - Add finding.json link to docs/INDEX.md |
||
|
Test
|
b3b49d443e | fix(post-mortem): preserve durable pre-commit closure proof | ||
|
Test
|
d93d34a9c6 | feat(post-mortem): add staged and worktree closure evidence |