Fix TechVault participant study agent affiliations for current RAES

[Brad-Edwards]

Problem

The merged techvault-participant-study pack from #394 declares entity on each of its three agents (study-controller, red-team-operator, and blue-team-operator). The merged RAES participant model requires affiliations. The pack therefore cannot be used unchanged for APTL issue OpenRAE/lilrae#601 against the current RAES contract. Its existing validation test calls validate_pack and does not exercise the full current RAES participant parse/compile/admission path.

Required outcome

• Migrate those agent declarations to the current RAES SDL semantics while preserving the authored four-inject red/blue sequence and its authority/observation boundaries.
• Regenerate every affected binding, scheme, content manifest, and pack digest through the repository's canonical generation path.
• Add a regression that parses, compiles, and admits the study pack with the compatible published RAES contract, including participant delivery bindings.
• Publish a compatible env-packs release so APTL can pin the released package and resulting study pack digest for a clean qualification.

Related: OpenRAE/lilrae#601; OpenRAE/rae#1389.

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 401-fix-study-agent-affiliations, 2026-09-30T04:18:59.518Z.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #401). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #401). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Implementation plan

Issue #401 is a shipped pack compatibility defect (Path B for the SDL and regression). The public RAES 5.0.0 release pinned here still defines Agent.entity; RAES dev has Agent.affiliations, and OpenRAE/rae#1389 remains open. A compatible published RAES release that fixes participant delivery time-model admission is therefore an external prerequisite for a green delivery PR.

1. Write a regression in tests/test_techvault_study_pack.py against the final published RAES pin. It must parse, instantiate, admit, and compile the study SDL; project the compiled time model through RAES's portable declaration/admission boundary; assert all four participant delivery addresses, order, participants, inject targets, and separate controller authority, observation, and interactive-access boundaries. Observe the reported failure before changing the pack. (Path B.)
2. Replace the study pack's three legacy entity fields with single-item affiliations, preserving the existing authority, scope, observation, access, inject, and evidence declarations. Update the existing study/base comparison test for the new shape. If the new RAES pin rejects the base TechVault pack's two legacy agent fields, migrate them in the same change to keep both published packs valid. (Path B.)
3. Refresh affected SDL bindings and associated-artifact manifests with tools/refresh_pack_sdl_binding.py. Keep the concept scheme snapshot unchanged if its source and concepts are unchanged. Read each final pack digest from the validated pack tree; do not hand-edit hashes. (Path B.)
4. Update the exact RAES dependency pin in pyproject.toml to that compatible published release, install it in the repository venv, and run focused study, base pack, artifact, and distribution tests. The host's pack-validation and release checks, packaged-content checks, and CI will verify the complete release candidate. (Path B.)
5. Use a fix: Conventional Commit PR title. Release Please owns the package version and changelog; after the reviewed PR reaches main, its release PR and publish workflow produce the env-packs release for APTL. No version, changelog, backend-specific path, or live qualification claim will be authored here.

Security and whole-repo checks: RAES parsing and semantic admission, pack manifest/digest validation, contained pack reads, participant-view and leak checks, and published distribution contents all see the changed SDL. Preserve their existing bounded diagnostics and secret-free fixtures. Reuse RAES public contracts and the canonical rebinding script; add no local SDL schema, migration alias, or backend admission logic. The RAES pin and regression remain the seam for later participant-profile changes. The architecture guardrails are in docs/development/techvault-participant-affiliations-preflight.md.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #401). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Plan amendment for RAES 6.0.1

The compatible package is published as raes==6.0.1. Its parser revealed three legacy required evidence media types in each TechVault pack that have no registered RAES content-proof contract. The existing study parse/admission regression and hosted-pack gate failed on those declarations before the edit (Path B). Keep their source, scope, channel, redaction, integrity, retention, and loss-disclosure requirements; omit only the unsupported encoding demands rather than claiming a different payload format. Regenerate both SDL bindings and manifests through tools/refresh_pack_sdl_binding.py, and test both hosted packs plus the base TechVault contract tests against the published wheel. The package pin is updated to 6.0.1; the project version and changelog remain Release Please owned.

[Brad-Edwards]

gc_codex_review — sanitized deferred publication for issue #401, cycle 1 of 1
Reviewed revision: 762b80504368e2ed96774990ed32b99111440dca0ddc6438fe69b8dbc5d01794

Architectural read

The RAES pin, affiliations, evidence declarations, byte bindings, and admission regression follow the repository's RAES-subordinate pack boundary. Both changed packs must advance their own release versions to keep published identities immutable.

Verdict: ship-with-fixes

Findings

core-F1 — Advance both pack versions with changed content identities

• Classification: class
• Decision: fix
• Location: packs/techvault/associated-artifacts.json:736
• Rationale: Both pack content digests changed while the pack-owned version remained 0.1.0. Advance both pack versions and align compatibility and associated-artifact manifests before publishing.

[Brad-Edwards]

gc_codex_review pre-push cycle 1 of 1 complete for issue #401 on branch '401-fix-study-agent-affiliations'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.

[Brad-Edwards]

Review decision record — codex cycle 1 (issue #401)

Reviewer: codex
Cycle: 1
Verdict: ship-with-fixes

Architectural read:

The RAES pin, affiliations, evidence declarations, byte bindings, and admission regression follow the repository's RAES-subordinate pack boundary. Both changed packs must advance their own release versions to keep published identities immutable.

Blocking findings: 1

Finding 1 — class (2 instances)

• ID: core-F1
• Title: Advance both pack versions with changed content identities
• Location: packs/techvault/associated-artifacts.json:736
• Decision: fix
• Rationale: Both pack content digests changed while the pack-owned version remained 0.1.0. Advance both pack versions and align compatibility and associated-artifact manifests before publishing.
• Instances:
  • packs/techvault/associated-artifacts.json:736
  • packs/techvault-participant-study/associated-artifacts.json:736

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at d1ad0e5552e69252ad3cbd7cfe7d30d4bbe2353b
• Outcome: already_current
• Published feature head: 379404189b57f77c48eb697b0ee5ec8d2cb9b544
• Synchronized tree: 2d616322cf538b64bd430441876051109ef06150

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at d1ad0e5552e69252ad3cbd7cfe7d30d4bbe2353b
• Outcome: already_current
• Published feature head: 23996a7bd94beb8afa89a43db610e62be0580c2f
• Synchronized tree: ee9ff15bca35b7fae7f03b73421758642aa1e05b

[Brad-Edwards]

Execution obligation ISSUE-401-SONAR-AUTH-403 — Opened

Category: failing_check
Observed state: The Sonar scanner failed twice before analysis when GET https://api.sonarcloud.io/analysis/jres returned HTTP 403 Forbidden. All other PR checks, including the required verify check, passed.
Impact: The Sonar analysis and Ground Control readiness gate cannot be evaluated for PR #402.
Current obligation: Restore valid SonarCloud authorization for the repository's GitHub Actions SONAR_TOKEN, rerun the Sonar job, then resume the monitor and readiness gates.

Evidence

• https://github.com/OpenRAE/env-packs/actions/runs/37090684869/job/111114082570
• https://github.com/OpenRAE/env-packs/actions/runs/37090684869/job/111114212852
• fix: update TechVault study for RAES 6.0.1 #402

[Brad-Edwards]

Execution obligation ISSUE-401-SONAR-AUTH-403 — Escalated

Category: failing_check
Observed state: SonarCloud rejected the scanner's request with HTTP 403 in the original run and one failed-job retry; no analysis was produced.
Impact: PR #402 cannot satisfy the Sonar quality gate or the Ground Control readiness assertion.
Current obligation: Restore valid SonarCloud authorization for the GitHub Actions SONAR_TOKEN, rerun the Sonar job, and resume monitoring.

Evidence

• https://github.com/OpenRAE/env-packs/actions/runs/37090684869/job/111114082570
• https://github.com/OpenRAE/env-packs/actions/runs/37090684869/job/111114212852

Pause class: hard_external_dependency
Decision request: A repository maintainer with access to GitHub Actions and SonarCloud credentials should repair or rotate the SONAR_TOKEN secret and confirm when the scan can be rerun. No token value should be shared.

This obligation remains open while the decision is pending.

[Brad-Edwards]

Execution obligation ISSUE-401-SONAR-AUTH-403 — Resolved

Category: failing_check
Observed state: The current Sonar job passes on PR #402 after restoring the GitHub Actions credential.
Impact: Sonar analysis is available again and the hosted check is green.
Current obligation: Restore SonarCloud authorization and rerun the Sonar job.

Evidence

• https://github.com/OpenRAE/env-packs/actions/runs/37090684869/job/111119377699
• fix: update TechVault study for RAES 6.0.1 #402

Disposition: fix
Corrective action: Updated the repository's GitHub Actions SONAR_TOKEN from the local environment without exposing its value, then reran failed jobs.

Verification

• Sonar job 111119377699 concluded success.
• All current PR checks, including sonar and verify, pass.