From 0504ac9671114ed558786e29731027a0954d6cdc Mon Sep 17 00:00:00 2001 From: Moon-Young Date: Sun, 26 Jul 2026 11:47:57 +0000 Subject: [PATCH] docs: design the run identity view (ORRO #135, #105) Co-Authored-By: Claude Fable 5 --- .../2026-07-26-run-identity-view-design.md | 95 +++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 docs/superpowers/specs/2026-07-26-run-identity-view-design.md diff --git a/docs/superpowers/specs/2026-07-26-run-identity-view-design.md b/docs/superpowers/specs/2026-07-26-run-identity-view-design.md new file mode 100644 index 0000000..edd9a3a --- /dev/null +++ b/docs/superpowers/specs/2026-07-26-run-identity-view-design.md @@ -0,0 +1,95 @@ +# One view that answers what actually ran — design + +Date: 2026-07-26 +Status: Design agreed, phase 1 ready to build. +Closes the design question behind ORRO #135 and the #105 comment. + +## The question this must answer + +The operator's words: *"Which project/plan/workspace did this task actually run against, what lane/model +was observed, and where is its durable evidence?"* + +Today the answer requires opening several directories and reading a session transcript. The data mostly +exists; it is scattered, and — more seriously — requested values are rendered under headings that read +as observation. + +## What we are allowed to say + +An inventory of every identity fact (where it is recorded, whether it is bound to the signed bundle, +and whether the verifier re-derives it) produced a three-way split. That split, not layout taste, is +what shapes this view. + +**Sayable today, already bound and re-derived.** Requested model from the runner receipt's invocation +argv; the lane's base git HEAD and working-tree status from the signed run-intent; budget and timeout; +worktree and task id; lane start/end commits, which Depone already cross-checks against the worktree +receipt; the evidence directory with per-artifact content hashes. + +**Sayable today with a label.** Roadmap item and step, which are recorded but transcribed rather than +bound. Requested adapter, model source and tier, which are plan-side values. The reference-adapter and +placeholder-fallback flags, which already exist in JSON and are simply missing from the text. + +**Needs new capture.** The observed model as a field — the Claude adapter already extracts it from the +stream and discards it. Model and tier on the ledger lane, whose absence is why the distinct-model +count is entirely request-derived. Repository identity: no artifact records the repo path, name, or +remote anywhere. A durable external workspace identifier, which does not exist and whose addition +changes what the task boundary claims. + +**Not sayable, ever, in the current architecture.** The observed model for Antigravity lanes: the +provider silently falls back, the exit code does not change, and the transcript carries no model name. +Since every reviewer lane routes to Antigravity by policy, the most honest statement about a review is +"gemini-3.5-flash was requested; the provider returned no identity signal". Equally, the Codex +`verified` status means only that no rejection string appeared — it is not confirmation that the model +ran, and rendering it as "model confirmed" would be an overclaim. + +## Shape + +Six blocks, in this order, because it mirrors how the question is asked. + +**Identity** — repository, base commit, branch or worktree, task id. +**Intent** — goal, profile, roadmap item and step. +**Execution** — lane count stated plainly (`1 execution lane, 0 reviewer lanes`), then per lane the +adapter and model as *two columns*: requested, and observed. When observation is impossible, the +observed column says so in words rather than repeating the request. +**Verification** — the Depone verdict. This is the only line in the view that is verifier truth. +**Producer declarations (not verified)** — the four signed-but-not-re-derived declarations, if shown at +all, live here and nowhere else. +**Evidence** — run directory and the artifact hashes that matter. + +## The rules that make it honest + +Requested and observed never share a cell. A missing observation is rendered as its own state, never +by falling back to the requested value. Where only a planned value exists, the block says requested. + +Verifier truth and producer self-report never appear under the same heading. The verification block +carries the Depone verdict; declarations the verifier does not re-derive are quarantined in their own +block with an explicit marker. witnessd #212 establishes that marker; this view consumes it. + +Lane counts come from observation, not from the plan. This is the defect #212 fixes at the source: the +run summary currently spreads the plan over the ledger, so counts labelled as evidence are +request-derived. + +"Team" and "multi-model" language never describes a single runner lane. A single-lane run says so. + +## Phasing + +**Phase 1** ships the whole layout using only facts already available, with the label rules above. It +requires no new capture, and it is blocked only on witnessd #212, since building on top of a summary +where the plan overwrites the observation would bake the conflation into the view. + +**Phase 2** adds the capture that phase 1 exposes as missing: repository identity, the observed model +as a field, ledger lane model and tier. Each is a producer change and each should land with a test that +a run whose plan and observation disagree reports the observation. + +**Deferred.** The durable external workspace identifier from the #105 comment. The current task +boundary explicitly places external workspaces outside the evidence scope; adding an identifier means +re-deciding that boundary, which deserves its own design rather than being smuggled in as a field. + +Also deferred, and worth naming so it is not mistaken for oversight: wiring Depone re-derivation for the +four declaration artifacts. That is a verifier contract change, lands in Depone first, and is the only +thing that would let those declarations graduate out of the quarantine block. + +## How we will know it worked + +An operator who has just finished a run can answer the original question from one command, and can tell +— without asking us — which lines are verifier truth, which are producer self-report, and which are +things the system cannot know.