Skip to content

fix(external-grants): suspend fleet-wide mixed-profile grant conflicts (hosted #5993, #5019 PR3-C) - #6195

Closed
schickling wants to merge 57 commits into
mainfrom
schickling-assistant/2026-11-08-867-profile-conflict-hosted1
Closed

fix(external-grants): suspend fleet-wide mixed-profile grant conflicts (hosted #5993, #5019 PR3-C)#6195
schickling wants to merge 57 commits into
mainfrom
schickling-assistant/2026-11-08-867-profile-conflict-hosted1

Conversation

@schickling

@schickling schickling commented Nov 10, 2026

Copy link
Copy Markdown
Contributor

Hosted copy of #5993 at 635e3baa658cba3848d329bab184f92f96de60f5 (fleet-compat run incl. 11 new rollback cases; NOT for landing yet: FPL GO waits for q39 and a real-store measurement; replaces stale #5994). Hosted by Compounding Manager for pull_request CI; review and GO stay on the original.

Friction and bottlenecks

An existing original PR requires a distinct hosted ref, never an owner-branch update.

@schickling-assistant
fix(external-grants): own atomic profile admission and append
98e550c 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
perf(external-grants): index and prefilter principal admission history
5ec504c 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
test(external-grants): prove prefilter admission equivalence
c1365c4 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix(external-grants): suspend fleet-wide mixed-profile conflicts
0f1f0eb 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
test(external-grants): measure q39 with verified foreign grants
0c5875e 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix(delivery): retain request-history seek after admission index
7a9009d 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix(external-grants): authenticate lifecycle overlays and opt in witn…
d374cbe 
…esses

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
perf(external-grants): bound expiry and revocation conflict probes
1a20821 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Seek active external grants through principal expiry ranges
13da938 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Accept covering expiry index for principal-only migration probe
b259952 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Merge final admission index safeguards into profile conflicts
f429449
@schickling-assistant
Merge current main into fleet profile conflict enforcement
0ed611e
@schickling-assistant
Bound authoritative grant transitions and fence owner changes on the …
e62704f 
…subject head

Owner revoke, policy and read-trust changes keep the validated policy as
authority but fence on the real subject head, so an ignored overlay cannot
block revocation. Authentication, read trust and message send share one
indexed SQL transition lookup instead of walking overlay history. The policy
candidate arm only considers same-origin unexpired policies. Local grants get
the same well-formedness check as foreign ones. Bearer and pairing conflict
errors no longer carry witnesses.

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
Register the transition index and query as large-value sites; use exp…
d862c27 
…ect_err

The shared transition query and its subject/kind/origin/actor index are new
SQL sites. Replace an err().expect() in the conflict tests that clippy flags.

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
Merge remote-tracking branch 'origin/main' into schickling-assistant/…
9d47c73 
…2026-11-08-867-profile-conflict
@schickling-assistant
Expect profile-conflict suspension of the compat counterexample pair
7249e85 
With the counterexample, the candidate holds active, well-formed assistant
(grant 4) and service (grant 7) grants for one principal, so it suspends both
with 409. The old-binary phase is unchanged. A candidate-only daemon test and
a unit test reproduce the fixture without the baseline binary.

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
State the conflict-before-service refusal order in the compat test
1dd5ec3 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
Keep the store migration reference query identical to admission
a80dc5e 
The schema-install test copies the admission query; give it the expiry-bounded
policy arm and the transition index, and check that reopening installs it.

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
Revoke service-grant fixtures the way the owner route does
5a6ff90 
Only an authoritative revocation (owner issuer, matching grant id) clears a
grant; the bare {} fixture body is an ignored overlay, so grant 6 stayed active.

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
Regenerate the TypeScript client for the owner-only witness descriptions
3a66dfb 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
Replicate admission-bench overlays until every claim has verified pro…
1b7a91d 
…venance

Replication exchanges are cut to a body budget; one round left part of the
1000-overlay history without a member signature.

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
Record the pre-index admission plan as unplannable in the cost probe
0828483 
The admission query names its index with INDEXED BY, so SQLite cannot plan it
while the probe has the index dropped.

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: anthropic/claude-opus-5-5
@schickling-assistant
Retain authenticated grant history and batch conflict admission reads
3abdd9a 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Validate optional benchmark build identity only when measurement is r…
dc75b63 
…equested

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Merge origin/main and regenerate the client schema descriptions
2975777
@schickling-assistant
Project authenticated external-grant authority incrementally and perm…
5f0ada3 
…it owner service revocation

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Exercise authority projection rollback compatibility and bounded admi…
b679e88 
…ssion queries

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Merge current main while retaining authority projection and pairing r…
c3bdfaa 
…egressions
@schickling-assistant
Preserve complete reserved fixture identity in SQLite inventory excerpt
e638ad4 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Bound authority maintenance memory and avoid completed-history rescans
3c82349 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Use structurally valid expired grant IDs in q39 comparisons
03b2f4e 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Adapt admission harness to current Unix socket readiness API
7dd7b75 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Remove unused seccomp opcode without relaxing the clippy ratchet
36ecca3 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Scope x32 comparison opcode to x86 and seccomp interpreter tests
405eda4 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Correct raw-history repair oracle and late-signature admission fixture
b456376 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Maintain authority in legacy test import and distinguish evidence fro…
1273a35 
…m credentials

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
Record synthetic authority backfill timing and qualified 50GB extrapo…
c774424 
…lation

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: keep assistant authority maintenance reactive after backfill
c12b224 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: reconcile late assistant grant envelope signatures
0cc74fa 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: persist local grant append provenance and reject ambiguous history
2631056 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: yield authority pages and fence maintenance lifecycle races
32cfa40 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: keep grant provenance diagnostics local and document restore rei…
160f60c 
…ssue

agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: bound grant authentication and skip duplicate signature refreshes
05ab7c9 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: isolate grant membership maintenance and subject readiness
dc771be 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: distinguish private subject fences from initial backfill readiness
e102b69 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: reuse authoritative fleet generation for grant maintenance
47658c3 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: isolate pending grant subjects in writes and inspection
0592e8f 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
docs: scope fleet invalidation contract to projected windows
594cfab 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
test: materialize unsigned keyed history before projection checks
198dc27 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: match assistant authority error codes directly
e127da3 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
fix: name assistant grant membership window bounds
92d5338 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
test: align grant fixtures with authenticated authority fencing
2c905f2 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
test: prepare sealed membership before authority benchmark backfill
cb1be0a 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling-assistant
test: persist benchmark membership snapshot before seeding
635e3ba 
agent-identity: agent/dotfiles/st-delegation-2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.12.5
agent-runtime: OMP 18.12.5
agent-model: openai-codex/gpt-6.1-sol
@schickling
schickling marked this pull request as ready for review November 10, 2026 07:12
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 10, 2026

Copy link
Copy Markdown
Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ❌ Failed 2026-11-10T07:12:24.450790Z
We couldn’t complete this review. Comment @codex review to try again.		 635e3ba Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 10, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@schickling-assistant schickling-assistant mentioned this pull request Nov 10, 2026
Draft
@schickling-assistant

schickling-assistant commented Nov 10, 2026

Copy link
Copy Markdown
Contributor

Compounding Manager: closed with the author's consent (st-delegation-2). #5993 now runs hosted CI at its own head c402346 (after #6228). #5993 stays open.

Posted on behalf of @schickling
field value
agent_identity agent/compoundingtech/compounding-manager
session 01a1d992
agent_persona generalist
agent_supervisor unavailable
agent_tool OMP
agent_tool_version 18.12.5
agent_runtime OMP 18.12.5
agent_model anthropic/claude-opus-5-5
worktree unknown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@schickling @schickling-assistant