From 0b5bc9ea9055f65ca8c94c8394149df141cad719 Mon Sep 17 00:00:00 2001 From: Victor Solano Date: Tue, 8 Sep 2026 15:27:27 +0200 Subject: [PATCH 1/3] fix(brain): attach the default safety audit log --- crates/sysknife-brain/src/planner.rs | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/crates/sysknife-brain/src/planner.rs b/crates/sysknife-brain/src/planner.rs index 65a96e9d..bc51f0e5 100644 --- a/crates/sysknife-brain/src/planner.rs +++ b/crates/sysknife-brain/src/planner.rs @@ -754,6 +754,10 @@ impl LlmPlanner { /// HTTP client cannot be initialised (rare; only fails if the TLS /// subsystem is unavailable). /// + /// Safety-fence rejection logging is enabled by default and writes to + /// [`SafetyAuditLog::default_path`]. Use [`Self::new`] for a planner + /// without runtime defaults. + /// /// Rate limiting is **enabled by default** at [`DEFAULT_MAX_RPM`] requests /// per minute. Override with the `SYSKNIFE_MAX_RPM` environment variable. /// Call `with_rate_limiter` after this to replace the default limiter, or @@ -859,9 +863,14 @@ impl LlmPlanner { None => provider, }; - let mut planner = Self::new(provider, state_client, config.max_turns); + let mut planner = + Self::new(provider, state_client, config.max_turns) + .with_audit_log(SafetyAuditLog::new(SafetyAuditLog::default_path())); + // `from_config` is the production construction path used by the CLI, + // MCP server, and shell. Attach the default safety log here so every + // runtime planner records fence rejections; direct `new` remains + // opt-in for callers such as tests and embedded consumers. planner.prefs_path = Some(sysknife_core::config::prefs_path()); - if replaying { // No rate limiter under replay. It exists to bound spend and load on a // provider, and a replay reaches neither: every answer comes off disk. @@ -1516,6 +1525,19 @@ mod tests { .expect("ollama defaults need no credentials") } + /// The integration test exercises the rejection path and reads the JSONL; + /// this test pins that the production constructor actually attaches the + /// log without mutating process-global path configuration. + #[test] + fn configured_planner_attaches_audit_log() { + let planner = ollama_planner(); + assert!( + planner.audit_log.is_some(), + "from_config must attach the safety audit log" + ); + } + + #[test] fn into_authorized_replaces_every_step_risk() { let step = |name: &str, risk| { From a80b1b3bc9d72a9b299da3e312ef7308b3452718 Mon Sep 17 00:00:00 2001 From: Victor Solano Date: Wed, 9 Sep 2026 14:29:49 +0200 Subject: [PATCH 2/3] style(brain): rustfmt the safety-audit from_config wiring cargo fmt --all --check is the first rust CI step and failed on the from_config statement wrap plus a double blank line before the next test. --- crates/sysknife-brain/src/planner.rs | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/crates/sysknife-brain/src/planner.rs b/crates/sysknife-brain/src/planner.rs index bc51f0e5..e7d90f7a 100644 --- a/crates/sysknife-brain/src/planner.rs +++ b/crates/sysknife-brain/src/planner.rs @@ -863,9 +863,8 @@ impl LlmPlanner { None => provider, }; - let mut planner = - Self::new(provider, state_client, config.max_turns) - .with_audit_log(SafetyAuditLog::new(SafetyAuditLog::default_path())); + let mut planner = Self::new(provider, state_client, config.max_turns) + .with_audit_log(SafetyAuditLog::new(SafetyAuditLog::default_path())); // `from_config` is the production construction path used by the CLI, // MCP server, and shell. Attach the default safety log here so every // runtime planner records fence rejections; direct `new` remains @@ -1537,7 +1536,6 @@ mod tests { ); } - #[test] fn into_authorized_replaces_every_step_risk() { let step = |name: &str, risk| { From 8e9a4ccb6e8fe74168f7e989ad49aa0ab0900dac Mon Sep 17 00:00:00 2001 From: Victor Solano Date: Wed, 9 Sep 2026 14:40:08 +0200 Subject: [PATCH 3/3] chore(evidence): record 1846 workspace tests CI ran cargo nextest --workspace --locked on this branch: 1846 passed. scripts/test_baseline.sh then failed because the published figure was still 1845. Move the artifact and the three prose claims together. --- README.md | 2 +- docs/distro-support.md | 2 +- docs/introduction.md | 2 +- tests/evidence/workspace-tests.json | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index e6ab4db2..c798a3ba 100644 --- a/README.md +++ b/README.md @@ -314,7 +314,7 @@ milestone. | **Every Ubuntu LTS validated** — 22.04, 24.04 and 26.04 all at 79/79, each with a replay twin that reproduces it | ✅ | | Telegram approval interface | 📋 roadmap | -**1,845 Rust tests and 72 frontend tests** form the current deterministic +**1,846 Rust tests and 72 frontend tests** form the current deterministic release baseline. ## Configure your LLM diff --git a/docs/distro-support.md b/docs/distro-support.md index 415d35bf..223e4f21 100644 --- a/docs/distro-support.md +++ b/docs/distro-support.md @@ -82,7 +82,7 @@ family and the atomic story family are implemented and covered by the workspace suite. What is missing is a way to put the helpers somewhere the daemon's own grants already point. -The deterministic workspace baseline is 1,845 Rust tests plus 72 frontend +The deterministic workspace baseline is 1,846 Rust tests plus 72 frontend tests. Those tests verify action construction, policy, approval, storage, and UI behavior, but they do not replace a real distribution VM run. diff --git a/docs/introduction.md b/docs/introduction.md index f26a54d7..337f584a 100644 --- a/docs/introduction.md +++ b/docs/introduction.md @@ -141,7 +141,7 @@ flow. ## Status -190 typed actions · 1,845 Rust tests + 72 frontend tests · MIT +190 typed actions · 1,846 Rust tests + 72 frontend tests · MIT SysKnife is the reference implementation of the [LACS specification](https://github.com/lacs-project/specification) — a diff --git a/tests/evidence/workspace-tests.json b/tests/evidence/workspace-tests.json index 5f66b8d5..cc092b4f 100644 --- a/tests/evidence/workspace-tests.json +++ b/tests/evidence/workspace-tests.json @@ -4,6 +4,6 @@ "tests": "cargo nextest run --workspace --locked" }, "frontend_tests": 72, - "tests": 1845, + "tests": 1846, "version": 2 }