Repository navigation
Merge reviewed changes for supervision, selection, pricing and CI - #778
Merged
Merged
Conversation
…-latest GitHub ubuntu-26.04 images upgrade systemd 259.5 to 259.9 while installing the CAM build dependencies, leaving the running user manager on the old binary. Confined candidate-validation sandboxes then missed their readiness window and library shards hit the 45-minute limit, so the Linux jobs were pinned to ubuntu-24.04. Re-exec the active user manager after apt and log its version so the jobs can return to ubuntu-latest.
On ubuntu-26.04 the supervise-core library shard exceeded the 45-minute job limit and the rest shard needed 44.5 minutes. Refine supervise-core and rest by module into smaller library shards and split the integration targets into merge and other groups, keeping the job limits and requiring every shard. The partition helpers verify at runtime that the shards cover exactly the original test set.
Add a pure versioned validator for dated operator pricing metadata and explicit flat token-rate maps. - Bind rates, source attribution and exact applicability to deterministic digests; reject unsupported or mismatched input. - Apply the same validation to explicit zero rates. No catalog prices are added or invented. - This is the standalone validation slice (A) of #754; supervised admission, resume and reporting integration follow. Validation: formatting, 18 exact-name tests and all-target compilation passed; Clippy and the full suites run in this PR's CI. Refs #754, #677 and #678.
… advice Agent and orchestrator assignment creation added commit/stash/remove advice to every repository cleanliness acquisition failure, including inventory timeouts that occur before any pending change is observed. - Use neutral caller context while keeping the complete underlying failure and fail-closed behavior. - Add regression coverage for timeout details, dirty-state failures and binding failures. Validation: formatting and six exact focused tests passed; Clippy and the full suites run in this PR's CI.
- Restore the existing three-second attachment setup grace while keeping the total operation deadline. - Include verified rollback elapsed time and completion in cancellation evidence without exposing launcher output. - Add deterministic stage and missing-marker regressions that keep diagnostics after cleanup. Validation: formatting and eight focused attachment tests passed; full platform coverage runs in this PR's CI.
First slice of #713. - Add strict parent-authored Python check declarations bound to nested Worker scopes and the parent union. - Persist declarations in normalized plans and acquire opaque file, snapshot, command and semantic-risk receipts; a semantic-risk report with errors is refused. - Refuse drift during revalidation; restored metadata cannot restore acquired receipts. Scheduler pre-claim integration follows in a separate change. Validation: formatting, the focused declaration/acquisition tests and two schema-contract tests passed; Clippy and the full suites run in this PR's CI.
- When cancellation delivery fails after its submission is persisted, an identical retry resumes delivery under the journal lock. - Recovery revalidates authentication, deadline and target authority, keeps process identity checks and records no second submission. - An absent registry entry keeps the cancellation in the inbox; stale process identities stay LostChild and completed actions are not replayed. - Add restart, pre-registration, repeated failure, uncertain-stop, stale PID and refusal regressions. Validation: formatting, nine exact unit tests and five exact integration tests passed on Linux; Clippy, all-target compilation and the full platform suites run in this PR's CI.
- When a contained runtime exits before its first private-channel frame, stop waiting once its exact target exits. - Pin the authenticated target at the start gate with a pidfd and keep conservative deadline behavior when exit evidence is unavailable. - Keep bounded diagnostics, ordinary terminal results and verified process-tree cleanup; incomplete handshakes remain failures. - Add early-exit, silent-target, unknown-identity and held-incarnation regressions. Validation: formatting passed locally on Linux; the new tests, all-target compilation, Clippy and the full platform suites run in this PR's CI.
- Persist private target process-tree and side-effect confinement observations beside each command summary. - Bind receipts to the supervisor lifecycle, exact attempt, runtime and summary digest, separately from fixed-version probes and provider reports. - Keep missing legacy observations unknown and restored evidence diagnostic-only. - Cover target/probe distinctions, tampering, cross-attempt substitution and failed returned attempts without changing execution authority. Validation: formatting and the new receipt tests passed on Linux; all-target compilation, Clippy and the full platform suites run in this PR's CI.
Use a shared response validator that requires matching nonempty request IDs, the supported protocol version and exactly one result or error before either authority client consumes a response. Strict desktop decoding is preserved and validation diagnostics never include remote values. - Add core and framed-client regressions for malformed envelopes and local selection preservation. Validation: formatting and six exact core/root regressions passed on Linux; desktop client tests, Clippy and the platform suites run in this PR's CI.
Use is_multiple_of for the leap-year check (Clippy manual_is_multiple_of).
- Add an opt-in `--prior-data` input for held-out real-provider evaluation, resolved against the explicit source repository. - Validate source-relative bytes and requested-model capability evidence before any artifact or budget reservation. - Freeze and rebind the evidence per isolated profile, keeping raw bytes and policy digests through refusals. - Keep deterministic-fake and absent-input artifacts compatible. Selection priors remain separate from budget pricing. Validation: formatting, 15 exact regression tests and all-target compilation passed on Linux; Clippy and the full suites run in this PR's CI. No production qualification is claimed.
- Batch stop attempts every registered identity in the selected run and reports termination and registry-update failures separately. - Confirmed-stale rows are cleaned during stop; single-target ambiguity still refuses multiple live or uncertain rows. - Unresolved entries stay registered for retry, and the CLI prints a complete report before returning failure. - PID/start-time and pidfd safeguards are unchanged. - Regression coverage includes first and middle failures, bookkeeping errors, restarted tasks, uncertain identities and safe retry. Validation: the targeted regressions, formatting, Clippy and the platform suites run in this PR's CI.
…nd lower-effort workers Add finite qualification plans and committed input fixtures for nested token control, supplied-source review and a lower-effort writable lane. - Document the exact validation and live commands, expected contract checks, independent acceptance and retained evidence for each. - Keep account, containment, served-identity and exhaustion gates explicit without expanding runtime authority. - The seed fixtures intentionally fail until repaired; conflicting replays must be refused without changing ledger state. Validation: formatting, the Python seed-baseline, replay-mutant and binding checks, and offline CLI parses of all three plans passed. Real account-backed qualification runs remain separate. Refs #714. Refs #689. Refs #688.
First slice of #724. - Encode typed task-shape bounds in the dated priors and intersect operator declarations with the bundled limits across catalog construction. - Apply shape and long-context gates before both selection paths and keep the effective bounds in replay input. - Preserve explicit qualified ceilings in observed catalogs, and keep the generated published contracts aligned with the optional ceiling field. - Add an optional versioned assignment-shape identity to attempt evidence; legacy records stay unbound. - Cover quota pressure, ceiling widening, strict input compatibility, replay and identity decoding. Per-assignment shape validation and dispatch/history integration follow in later changes. Validation: formatting, 26 exact regression tests and all-target compilation passed on Linux; Clippy and the full suites run in this PR's CI.
Contained Researcher attempts with rejected host execution evidence could still dispatch parent review. - Mark the final Researcher gate terminal when report or evidence problems remain after corrective retries. - Keep mandatory review for complete observations, including research that reports an unresolved finding. - Add controller regressions for absent, forged, mismatched, duplicate and unfinished observations and the complete-evidence path. Validation: formatting and five exact Linux tests passed; Clippy and the full platform suites run in this PR's CI. A live managed Linux Researcher run remains a separate acceptance gate.
Stacked on #770 (authored checks in assignment metadata and plan digests); GitHub retargets this PR to main once #770 and #758 merge. First slice of #717. - Plans can declare a strict executor selection for individual assignments and nested Workers. - Omitted or explicit Local selections keep current behavior and canonical bindings. - SSH target identity is kept in normalized plans and checkpoint digests. - Supervised SSH execution is refused before launch until authenticated target bindings and the production bridge exist; plan-only loading also refuses SSH, so a selection can never silently become a Local launch. Validation: formatting and ten exact Linux tests passed; Clippy and the full suites run in CI.
The mechanical native-exec contract test pinned the whole debug libtest image as its target. As the crate grew, that image reached about 253.8 MiB, close to the 256 MiB product bound for pinned executables, and an integration build that added more code failed the test with `FileTooLarge`. - Compile a small standalone Rust fixture as the pinned target and keep libtest only as the isolated launcher. - Keep the exact argv and environment, null stdin, relay descriptor identity and closure, and request-consumption assertions. - The production executable bound and behavior are unchanged. Validation: formatting and the mechanical native, sealed-native and sealed-script exec tests passed on Linux; Clippy and the full suites run in CI.
…rades and restore ubuntu-latest
…isleading pending-change advice
…ransient failures
…pes in both clients
…der evaluation
… target failures
…control, source inputs and lower-effort workers
…cs during attachment
… before dispatch
…nd acquisition receipts
…e unconfigured SSH
RUSTSEC-2026-0418 (published 2026-10-28): the `libz-sys` 1.1.28 build script leaks environment variables into the build directory. `cargo audit --deny warnings` in the supply-chain workflow now fails on main. - Update `libz-sys` to 1.1.31, the first fixed release, with `cargo update -p libz-sys --precise 1.1.31`. It is pulled in through `git2` and `libgit2-sys`, whose `^1.1` requirement already allows it. - No other dependency changes; the desktop workspace lockfile does not contain `libz-sys`. Validation: `cargo audit --deny warnings`, `cargo deny` (advisories, bans, licenses, sources), the desktop supply-chain checks and `cargo check --locked` passed on Linux; MSRV and packaging run in CI.
The integration test `merge_apply_revalidates_clean_committed_primary_after_candidate_validation` failed intermittently on loaded ubuntu-26.04 runners (merge test binary 832-843 s instead of the usual 611-638 s) with `candidate validation sandbox for apply ... did not become ready before timeout`. The error came from the test helper, which allowed a fixed 30 s from spawning apply until the paused validation command wrote its readiness marker. That window covers preview capture, the repository lock, isolated index setup, base materialization, patch application and two integrity captures, each a separately contained Git operation, so it grows with runner load. - Replace the fixed wait with a bounded test-only budget derived from the measured preview latency, with a floor and a ceiling, and report the budget on timeout. - Fail promptly when apply has already exited, and keep the exact marker and containment proof and the kill/wait cleanup. - Add virtual-time regressions for slow readiness, a missing marker, budget bounds and late probes. Production deadlines and behavior are unchanged; only `tests/merge_cli.rs` changes. Validation: formatting, the new regressions and the affected integration tests passed on Linux.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges a batch of individually reviewed pull requests as one change, so CI runs once over the combined result. Each PR head is merged unchanged, in this order:
The same set without #777 passed the Rust CI (19 jobs), the account manager CI and the MSRV check on an integration branch; supply-chain failed there only on RUSTSEC-2026-0418, which #777 fixes.
Closes #732.
Closes #718.
Closes #709.
Closes #660.
Closes #721.
Closes #664.
Closes #719.
Closes #697.
Closes #706.
Closes #713.