From f0649bd1d0d8a9f9399e5b82d24819e02b9be35f Mon Sep 17 00:00:00 2001 From: Magnus Hedemark Date: Wed, 7 Oct 2026 15:20:17 -0400 Subject: [PATCH] Expose fixed v17 review contract with atomic qualified runtime pin --- .github/workflows/slopsearx-pilot.yml | 5 ++- docs/V17-HOSTED-SELECTOR.md | 29 +++++++++++++ scripts/central_pilot_admission.py | 2 +- scripts/resolve_review_contract.py | 28 ++++++++++-- tests/test_central_pilot_admission.py | 4 +- tests/test_pilot_workflow.py | 4 +- tests/test_review_contract_selection.py | 58 +++++++++++++++++++++++-- 7 files changed, 116 insertions(+), 14 deletions(-) create mode 100644 docs/V17-HOSTED-SELECTOR.md diff --git a/.github/workflows/slopsearx-pilot.yml b/.github/workflows/slopsearx-pilot.yml index 9ad1619..8b880d1 100644 --- a/.github/workflows/slopsearx-pilot.yml +++ b/.github/workflows/slopsearx-pilot.yml @@ -15,6 +15,7 @@ on: options: - legacy-v14 - bounded-production-v16 + - bounded-production-v17 permissions: contents: read @@ -121,10 +122,10 @@ jobs: checks: read pull-requests: read actions: read - uses: groktopus/codereview/.github/workflows/pr-analysis.yml@9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea + uses: groktopus/codereview/.github/workflows/pr-analysis.yml@dd01a24976631c957a34f3ecc80dcb097948e450 with: harness_repository: groktopus/codereview - harness_sha: 9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea + harness_sha: dd01a24976631c957a34f3ecc80dcb097948e450 target_repository: magnus919/SlopSearX pull_request_number: ${{ fromJSON(inputs.pull_request_number) }} base_ref: ${{ needs.resolve-target.outputs.base_ref }} diff --git a/docs/V17-HOSTED-SELECTOR.md b/docs/V17-HOSTED-SELECTOR.md new file mode 100644 index 0000000..a2caa31 --- /dev/null +++ b/docs/V17-HOSTED-SELECTOR.md @@ -0,0 +1,29 @@ +# Hosted v17 selector preparation + +`bounded-production-v17` is a closed opt-in choice for the SlopSearX caller. +The default remains `legacy-v14`. The new name resolves only to the exact +`slopsearx-v17-context-target-manifest-candidate.json` bytes and the existing +`ordinary-review-limits-v3.json`; the profile adds the finite +`context-target-manifest.v1` input while retaining the v16 review and capacity +policy. The resolver checks both pinned file hashes, the manifest version and +caps, context-selection version and cap, retrieval revisions, required +security risk rule, and claim limit before writing a profile binding. Unknown +or cross-target names fail before profile or limit files are read. + +The local provider-free request measurement in +`tests/test_context_target_manifest.py` serialized a 10,204-byte request with +the manifest and an 8,050-byte request for the same task without it. Its +canonical manifest metadata was 1,555 bytes. A separate offline reconstruction +from the PR 305 snapshot produced 11 available choices in 5,535 bytes of +manifest metadata. Those are bounded serialization measurements, not a live +provider quote or proof that a future task fits its budget; normal quote and +ledger checks still govern dispatch. The v4 default request fixture remains +byte-identical (8,087 bytes, SHA-256 +`004df69e267e61f3457099ef2febcadee7bf2378e6f1cc0507f19881adc4e129`). + +The selected reusable workflow is pinned to the qualified v17-capable runtime +at `dd01a24976631c957a34f3ecc80dcb097948e450`. This makes the v17 input +available to the caller; it does not validate the profile's review quality or +establish production behavior. The provider wire quote uses adapter 0.2 and +continues to use the same quote/ledger checks before dispatch. Publication +remains outside this read-only selection path. diff --git a/scripts/central_pilot_admission.py b/scripts/central_pilot_admission.py index 5d08aed..12ed338 100644 --- a/scripts/central_pilot_admission.py +++ b/scripts/central_pilot_admission.py @@ -37,7 +37,7 @@ TARGET = "magnus919/SlopSearX" BASE_REF = "main" REUSABLE_PATH = ".github/workflows/pr-analysis.yml" -REUSABLE_SHA = "9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea" +REUSABLE_SHA = "dd01a24976631c957a34f3ecc80dcb097948e450" MAX_EVENT_BYTES = 64 * 1024 SHA1 = re.compile(r"^[0-9a-f]{40}$") RUN_ID = re.compile(r"^[1-9][0-9]{0,19}$") diff --git a/scripts/resolve_review_contract.py b/scripts/resolve_review_contract.py index 97a6106..fd0a062 100644 --- a/scripts/resolve_review_contract.py +++ b/scripts/resolve_review_contract.py @@ -36,6 +36,14 @@ "limits_sha256": "ec191dcde1672b4f86aac24ee6412752cd9a08871d1aba1b332d11341b6fd2a6", "max_claim_assessments": 4, }, + "bounded-production-v17": { + "profile_path": "profiles/slopsearx-v17-context-target-manifest-candidate.json", + "limits_path": "profiles/ordinary-review-limits-v3.json", + "profile_version": "slopsearx-production-v17-context-target-manifest-candidate", + "profile_sha256": "28725e806a87812386ff67f5c6e63320cc9f3f2b9c1a79c6942c7cf1be004dac", + "limits_sha256": "ec191dcde1672b4f86aac24ee6412752cd9a08871d1aba1b332d11341b6fd2a6", + "max_claim_assessments": 4, + }, } # Keep this Slop-only mapping stable for the separate central pilot admission # consumer. New target contracts are resolved through the target-scoped map. @@ -51,7 +59,7 @@ } ALL_CONTRACTS = {**CONTRACTS, **CODE_REVIEW_CONTRACTS} TARGET_CONTRACTS = { - "magnus919/SlopSearX": frozenset({"legacy-v14", "bounded-production-v16"}), + "magnus919/SlopSearX": frozenset({"legacy-v14", "bounded-production-v16", "bounded-production-v17"}), "groktopus/codereview": frozenset({"codereview-native-v1"}), } CODE_REVIEW_TARGET = "groktopus/codereview" @@ -154,19 +162,31 @@ def resolve_review_contract( "max_input_bytes_per_task": 96_000, }: raise ProfileBindingError("review_contract_limits_mismatch") - elif review_contract == "bounded-production-v16": + elif review_contract in {"bounded-production-v16", "bounded-production-v17"}: selector = profile.get("context_selection") retrieval = profile.get("retrieval_revisions") + expected_status = ( + "bounded_production_capacity_candidate_not_quality_validated" + if review_contract == "bounded-production-v16" + else "bounded_production_capacity_and_context_target_candidate_not_quality_validated" + ) + expected_manifest = ( + None + if review_contract == "bounded-production-v16" + else {"version": "context-target-manifest.v1", "max_entries": 256, "max_bytes": 16384} + ) if ( - profile.get("profile_status") != "bounded_production_capacity_candidate_not_quality_validated" + profile.get("profile_status") != expected_status or not isinstance(selector, dict) or selector.get("version") != "context-selection.v3" or selector.get("max_total_context_bytes") != 128_000 or retrieval != {"implementation": "head", "test": "head"} or V16_RISK_RULE not in profile.get("risk_rules", []) + or profile.get("context_target_manifest") != expected_manifest or limits != V16_LIMITS ): - raise ProfileBindingError("review_contract_v16_contract_mismatch") + mismatch = "v16" if review_contract == "bounded-production-v16" else "v17" + raise ProfileBindingError(f"review_contract_{mismatch}_contract_mismatch") else: selector = profile.get("context_selection") required_checks = profile.get("required_checks") diff --git a/tests/test_central_pilot_admission.py b/tests/test_central_pilot_admission.py index 5495534..5097730 100644 --- a/tests/test_central_pilot_admission.py +++ b/tests/test_central_pilot_admission.py @@ -104,7 +104,7 @@ def _candidate(tmp_path, contract_name="legacy-v14"): return json.dumps(event).encode(), FakeTransport(responses) -@pytest.mark.parametrize("contract_name", ["legacy-v14", "bounded-production-v16"]) +@pytest.mark.parametrize("contract_name", ["legacy-v14", "bounded-production-v16", "bounded-production-v17"]) def test_central_dispatch_candidate_yields_hash_only_receipt_without_writes(tmp_path, contract_name): event, transport = _candidate(tmp_path, contract_name) receipt = admission.verify_candidate(event_bytes=event, pull_request_number=7, token="fake-read-token", transport=transport) @@ -123,7 +123,7 @@ def test_central_dispatch_candidate_yields_hash_only_receipt_without_writes(tmp_ assert len(transport.calls) == 5 -@pytest.mark.parametrize("contract_name", ["legacy-v14", "bounded-production-v16"]) +@pytest.mark.parametrize("contract_name", ["legacy-v14", "bounded-production-v16", "bounded-production-v17"]) @pytest.mark.parametrize( ("field", "value"), [ diff --git a/tests/test_pilot_workflow.py b/tests/test_pilot_workflow.py index 89c6a92..b617797 100644 --- a/tests/test_pilot_workflow.py +++ b/tests/test_pilot_workflow.py @@ -9,7 +9,7 @@ import pytest WORKFLOW = Path(__file__).parents[1] / ".github/workflows/slopsearx-pilot.yml" -PIN = "9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea" +PIN = "dd01a24976631c957a34f3ecc80dcb097948e450" SECRETS = ( "LLM_BASE_URL", "LLM_MODEL", @@ -84,7 +84,7 @@ def test_pilot_dispatch_has_closed_contract_choice_and_runs_dispatcher_on_defaul assert "review_contract:" in dispatch assert "type: choice" in dispatch assert "default: legacy-v14" in dispatch - assert " - legacy-v14\n - bounded-production-v16" in dispatch + assert " - legacy-v14\n - bounded-production-v16\n - bounded-production-v17" in dispatch assert "target_repository:" not in dispatch assert "harness_sha:" not in dispatch assert "LLM_BASE_URL:" not in dispatch diff --git a/tests/test_review_contract_selection.py b/tests/test_review_contract_selection.py index 34299bb..b5af00f 100644 --- a/tests/test_review_contract_selection.py +++ b/tests/test_review_contract_selection.py @@ -21,6 +21,7 @@ V14_LIMITS = "profiles/ordinary-review-limits-v2.json" V16_PROFILE = "profiles/slopsearx-v16-bounded-production-candidate.json" V16_LIMITS = "profiles/ordinary-review-limits-v3.json" +V17_PROFILE = "profiles/slopsearx-v17-context-target-manifest-candidate.json" def _root(tmp_path: Path) -> Path: @@ -169,6 +170,31 @@ def test_v16_contract_rejects_changed_native_output_cap(tmp_path: Path, monkeypa resolve_review_contract(TARGET, "bounded-production-v16", root=root) +def test_v17_contract_rejects_manifest_change_even_if_registry_digest_is_rebound( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +): + root = _root(tmp_path) + profile_path = root / V17_PROFILE + profile_path.parent.mkdir(parents=True, exist_ok=True) + profile = json.loads((Path(__file__).parents[1] / V17_PROFILE).read_text(encoding="utf-8")) + profile["context_target_manifest"]["max_entries"] = 257 + profile_path.write_text(json.dumps(profile), encoding="utf-8") + limits_path = root / V16_LIMITS + limits_path.parent.mkdir(parents=True, exist_ok=True) + limits_path.write_bytes((Path(__file__).parents[1] / V16_LIMITS).read_bytes()) + monkeypatch.setitem( + CONTRACTS, + "bounded-production-v17", + { + **CONTRACTS["bounded-production-v17"], + "profile_sha256": hashlib.sha256(profile_path.read_bytes()).hexdigest(), + }, + ) + + with pytest.raises(ProfileBindingError, match="review_contract_v17_contract_mismatch"): + resolve_review_contract(TARGET, "bounded-production-v17", root=root) + + def test_v16_contract_rejects_untrusted_target_repository_before_file_reads(tmp_path: Path): root = tmp_path / "does-not-exist" with pytest.raises(ProfileBindingError, match="target_repository_unsupported"): @@ -211,11 +237,29 @@ def test_codereview_contract_resolves_its_exact_profile_and_shared_finite_limits assert profile["review_criteria"]["project_specific"].startswith("Use AGENTS.md from the base revision") +def test_v17_hosted_contract_resolves_only_its_exact_profile_and_manifest(): + binding = resolve_review_contract(TARGET, "bounded-production-v17") + profile = json.loads((Path(__file__).parents[1] / V17_PROFILE).read_text(encoding="utf-8")) + + assert binding["review_contract"] == "bounded-production-v17" + assert binding["profile_path"] == V17_PROFILE + assert binding["profile_version"] == "slopsearx-production-v17-context-target-manifest-candidate" + assert binding["profile_sha256"] == "28725e806a87812386ff67f5c6e63320cc9f3f2b9c1a79c6942c7cf1be004dac" + assert binding["limits_path"] == V16_LIMITS + assert binding["limits_sha256"] == "ec191dcde1672b4f86aac24ee6412752cd9a08871d1aba1b332d11341b6fd2a6" + assert binding["max_claim_assessments"] == "4" + assert profile["context_target_manifest"] == { + "version": "context-target-manifest.v1", + "max_entries": 256, + "max_bytes": 16_384, + } + + def test_target_contract_allowlist_keeps_slop_contracts_closed(): - assert TARGET_CONTRACTS[TARGET] == frozenset({"legacy-v14", "bounded-production-v16"}) + assert TARGET_CONTRACTS[TARGET] == frozenset({"legacy-v14", "bounded-production-v16", "bounded-production-v17"}) assert TARGET_CONTRACTS[CODEREVIEW_TARGET] == frozenset({"codereview-native-v1"}) - assert set(CONTRACTS) == {"legacy-v14", "bounded-production-v16"} - assert set(ALL_CONTRACTS) == {"legacy-v14", "bounded-production-v16", "codereview-native-v1"} + assert set(CONTRACTS) == {"legacy-v14", "bounded-production-v16", "bounded-production-v17"} + assert set(ALL_CONTRACTS) == {"legacy-v14", "bounded-production-v16", "bounded-production-v17", "codereview-native-v1"} assert CONTRACTS == { "legacy-v14": { "profile_path": V14_PROFILE, @@ -233,6 +277,14 @@ def test_target_contract_allowlist_keeps_slop_contracts_closed(): "limits_sha256": "ec191dcde1672b4f86aac24ee6412752cd9a08871d1aba1b332d11341b6fd2a6", "max_claim_assessments": 4, }, + "bounded-production-v17": { + "profile_path": V17_PROFILE, + "limits_path": V16_LIMITS, + "profile_version": "slopsearx-production-v17-context-target-manifest-candidate", + "profile_sha256": "28725e806a87812386ff67f5c6e63320cc9f3f2b9c1a79c6942c7cf1be004dac", + "limits_sha256": "ec191dcde1672b4f86aac24ee6412752cd9a08871d1aba1b332d11341b6fd2a6", + "max_claim_assessments": 4, + }, }