Conversation
Add reusable agent-managed workstreams
Harden CI for Experiment development
Run CI for workstream slice PRs
Complete Experiment onboarding
This was referenced Aug 2, 2026
Fix residual-output CI race
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
accept one authored Experiment from a directory, an exact one-member ZIP, or a public GitHub HTTPS URL pinned to a lowercase 40-hex commit
copy source data into one private snapshot, validate the exported experiment value with CUE, resolve image selectors to immutable subjects, authorize installation freshly with Cedar, and publish atomically into the local store
provide the independently installed local CLI, strict home/config initialization, stable locks and tool cache, plus the shared operator-managed image catalog
keep onboarding data-only: source content is never executed, and this work creates no container or Docker network
Motivation / Context
The CI prerequisite landed in #26. The feature work then landed as independently checked slices on one reusable workstream so the complete change can receive one final integration decision. The completed workstream is rebased directly on the current origin/dev tip.
Changes
#28 — directory format and intake
#30 — local CLI foundation
#31 — local image catalog
#32 — authorized install store
#33 — bounded ZIP intake
#34 — pinned public Git intake
#35 — post-rebase evidence preservation
The supported v0 host is Linux. The image catalog registers digest-pinned names only; it does not pull, build, import, attest, admit, or run images. Git acquisition is bounded to the fixed TLS-authenticated public GitHub API, which is the trust binding from the requested commit ID to its returned root tree; Agent Lab independently recomputes the returned tree and blob object IDs. External-service availability is not treated as CI truth. Experiment runtime containment and execution remain separate future work.
This is the final draft integration PR into dev; merge remains a human action.
Testing
replayed the three post-rebase RED points documented in #35 and retained named assertion-failure evidence for the hardened catalog, ZIP watchdog, and Git worker lifecycle paths
catalog state: 34/34 assertions
ZIP mutation suite: 13/13 mutations
Git intake: 32/32 assertions
source-adapter aggregate: 83/83 assertions in exact order
end-to-end aggregate harness: 23/23 assertions
./scripts/dev/check default quick: 32 passed, 0 failed, 0 skipped, 0 infrastructure failures
lint, strict validation, containment lint, attribution, diff-scope, and whitespace checks passed
every hosted check on the exact final tip passed before this final integration PR was opened
Adversarial mutations still detect substituted source objects, weakened private-copy behavior, missing or duplicate aggregate assertions, ZIP watchdog failure, and Git worker lifecycle failure.