feat(dispatcher): FRS S1 — §2.7 advance derives the stage from the frontier (consumer binding, never a fork) - #1488
Merged
Conversation
added 4 commits
August 18, 2026 19:46
…m the dependency frontier (consumer of frontier.sh, never a fork) Pure consumer of the /pipeline-owned emitter: tees its full recorded output, then emits ONE verdict line (ADVANCE / ADVANCE-INCOMPLETE / ADVANCE-DEGRADE / HALT-VERIFY / HALT-BLOCKED / COMPLETE) + FRONTIER-SET / ATTN-UNRESOLVED satellites. HALT-VERIFY encodes T-FRS1-B: basis=marker-unverified done never advances a consumer — §2.6 is:merged stays the authority, verdict fed back via MO_FRONTIER_DONE/OPEN. 14-arm paired-negative test (marker-lies triple, delegation anti-fork arm, SKILL-wiring arms red-by-design until the binding commits). Prior-art: REUSE — consumer binding over .claude/skills/pipeline/helpers/frontier.sh (ratified emitter, skill-harmonization spec §5.4 / D-H13); helper+test pattern follows probe-inflight.sh §2.0. No new capability (umbrella kickoff §0).
…to the frontier read §2.7 «Advance» rewritten from two narration lines to the executed helper call with the full verdict table (§2.0 probe-inflight pattern): branch on the verdict, never pick the next stage by eye, never re-derive the frontier by hand. §2.6 is:merged check retained as the merge authority inside HALT-VERIFY's re-entry recipe. §6 gains the stage note. night-mode's substrate-choice clause now routes advance through §2.7 — one clause, no second stage-picker. SKILL-wiring test arms go green with this commit. Prior-art: REUSE — consumer binding over .claude/skills/pipeline/helpers/frontier.sh (ratified emitter, skill-harmonization spec §5.4 / D-H13); helper+test pattern follows probe-inflight.sh §2.0. No new capability (umbrella kickoff §0).
…edits SNAPSHOT_MODE=capture fallout of the night-mode/SKILL.md clause extension (the one edited file on the consumer install surface — hash updated in all 8 lanes). Dispatcher skill files carry 0 fingerprint rows: repo-internal orchestration, not shipped. Diff reviewed before commit; SNAPSHOT_MODE=compare passes 15/15. Prior-art: skipped — snapshot regen after shipped-skill edit, no new capability
…ner unverified-done clause - §2.7: §2.6 CLEARs feed forward — invoke the helper with MO_FRONTIER_DONE accumulating confirmed-merged ids, so a just-merged stage cannot re-enter the frontier because its row still reads done=no - ADVANCE-DEGRADE verdict + SKILL bullet: rows reading done= in degraded output carry no basis= — unverified row text, §2.6 clears them before any stage is skipped Both from the /harvest §4 cold code review (Important #1/#2); T-FRS1-B does not stop at the verdict path.
artyhoo
enabled auto-merge (squash)
August 19, 2026 20:39
artyhoo
added a commit
that referenced
this pull request
Aug 19, 2026
…reset lane runners (seven lanes) + F5 narrowing (#1492) * feat(audit-self): pre-merge-carrier-build B2 — python/go/cargo + UI-preset lane runners Six lane runners added to the shipped opt-in carrier (ts-server landed in B1; seven shipped lanes total, re-derived via template census): python + go + cargo install lanes and the react-next/react-spa/react-native UI-preset extension of the npm lane. Per-lane gate sets are derived from the merge tree's wired workflow files (both `- run:` and `- name:`+bare `run:` shapes tolerated); tool pins are checked and a mismatch exits 3 naming the pin (F2 semantics, three-sha contract unchanged — verified sha is always the merge sha). - python: ast-grep scan + ruff check gates incl. the ruff-bans config gate; both ruff invocations run --no-cache (§b.1). - go: golangci-lint forbidigo gate; GOLANGCI_LINT_CACHE pointed at a throwaway dir under `git rev-parse --git-path` (§b.1). Cache-staleness experiment outcome: INCONCLUSIVE — no golangci-lint/go binary reachable in the build container to probe with; the conservative isolation ships anyway. - cargo: clippy gate with -D flags derived from the wired run line; CARGO_TARGET_DIR/RUSTC_WRAPPER unset-then-restored around the run (§b.1). - UI presets: ci-success.needs-driven extension; browser legs (test-storybook, test-e2e) are named NOT COVERED per the F3 report-only policy — never CANNOT-RUN; build leg runs locally. - severity aggregation 3 > 90 > 1 > 0; multi-lane runs report lane-qualified gates and an aggregated NOT-COVERED list. - self-test arms 11-20 appended to the existing pre-merge-local.test.sh (no new test files — principle 41 population untouched): honest shims logging invocations + reporting pinned versions; arms cover green/pin-mismatch/ seeded-red/vacuity/absent-tool/multi-lane per lane, all asserting the carrier's OUTPUT and exit code on fixture repos (T-PMC-D). 84 pass / 0 fail. Prior-art: prior-art-evaluations.md#259-#263 (S0 BFR consult, SPENT — lane runners extend the carrier scoped by that consult; reference implementation timeliner PR 229 read, never vendored, SSOT #263). * docs(pre-merge-carrier-build): B2 F5 claim-narrowing + snapshot regen F5 (operator, 2026-08-18, chip task_a1cd3b11): python/go/cargo installs ship no scripts/ by construction (measured greenfield fingerprints 38/3/5 lines, zero scripts/ entries vs 184-196 for npm lanes), so the "at every profile" install-coverage claim was false on those lanes. Narrowed in both shipped docs to name npm-lane installs (ts-server + UI presets): - INSTALL-FOR-AI.md:520-525 — "ship to scripts/ on npm-lane installs" + "runs every detected lane's gates on the merge result"; net-zero line delta (594/600, hard markdown gate respected). - packages/core/templates/shared/AI-USAGE-GUIDE.md §3.5 — same narrowing, header untouched. Snapshot baselines regenerated deliberately (shipped-file edit): the delta is exactly scripts/pre-merge-local.sh fingerprints on the seven npm-lane baselines + the AI-USAGE-GUIDE.md delivery fingerprint on all eleven; thin lanes' scripts/ rows unchanged (they ship none). SNAPSHOT_MODE=compare green 15/0. Tripwires green: principle 41 8/8, refresh-covers-full-delivery 21/0, meta-all-wired 2/0, pre-merge-local-delivery 12/0, carrier self-test 84/0. Known deviation: the kickoff §5 append (B2 lane arms below the B1 block) is prepared but permission-blocked in the autonomous session (sensitive path, no approver) — recorded in the plan for operator application at merge. Prior-art: prior-art-evaluations.md#259-#263 (F5 narrowing is the docs half of the same ratified build the S0 consult scoped; no new capability — claim edit + fingerprint regen only). * fix(audit-self): pre-merge-carrier-build B2 rework r1 — vacuity guards + anchored parses + SC1007 Harvest-audit rework round 1 (task 62462592), on the two audit-self files only: - BLOCKER 1: SC1007 at the cargo lane local decl — `_ctd_val= _rw_val=` → `_ctd_val='' _rw_val=''` (unquoted space-after-= reddens the CI shellcheck gate; exclude set does not cover SC1007). - MAJOR 2: zero-gate vacuity guards for the stack lanes — a DETECTED lane whose workflow parses to zero gate lines (python), an unparsable golangci-lint invocation (go), or unparsable clippy denial flags (cargo) now adds a lane-qualified CANNOT-RUN entry naming lane + workflow file (aggregate exit 3) instead of contributing a silent nothing to a PASS; unparsed pins likewise fail named ("never a silent unpinned run") instead of silently skipping the pin check. - Parse blockers from the round-1 review (rework comment asserted all seven shapes parsed; measurement against the live templates showed three broken): python pin greps picked up header-comment prose (pins with trailing ',' / ')'), go args derived '(getff bans)' from the step-NAME line, the go-version pin grep matched a comment first and silently died. All pin/args/flags parses re-anchored to run:/input/command lines; the PYWF/GOWF self-test fixtures replaced with the measured template shapes so the traps stay armored (T-PMC-A: fixtures mirror measured shapes, not idealized ones). - MINOR 3: (a) arm 21 covers the UI BLOCK needs: shape (production form of all three real UI templates) + asserts the new unmapped-job WARN; (b) go seeded-red (arm 28) + go absent-tool (arm 29) arms close the per-lane claim gap; (c) the ci-success.needs case gains a *) default arm that WARNs on unmapped job names instead of silently treating them as covered. Self-test: 122 pass / 0 fail (84 pre-existing assertions + 38 new across arms 21-29). shellcheck is ABSENT in this build container — the SC1007 fix is verified by token-shape scan + bash -n only; the host CI shellcheck gate (audit-self.yml:878-880) is the authoritative check at harvest. Prior-art: skipped — bug-fix/guard round on an existing shipped capability, no new capability. * chore(snapshot): regen install baselines for the B2 rework carrier edits Operator-side harvest regen (task 62462592), post-rebase onto staging #1488-#1490. One row folded: scripts/pre-merge-local.sh on the 8 npm-family baselines — rework r1 (f9534d3c85) changed the carrier after the worker's regen in b7510d05b7, and the #1490 line-level auto-merge left these 8 compare-RED on the merged tree. Captured on the rebased tree; SNAPSHOT_MODE=compare is 15/0. * docs(kickoff): pre-merge-carrier-build §5 — B2 lane arms appended below the B1 block Operator-applied at harvest (task 62462592) per the recorded Task-10 deviation: the autonomous worker's Edit to this file was permission-blocked (sensitive path, HANDOFF_MODE=1), and the kickoff's own §5 contract requires the B2 lane commands to land in the same PR that adds them. B1 lines untouched (append-only history). Six B2 lines: seven-lane template census, the three stack-lane runners, the zero-gate guard arms (rework r1), the pin-unparsed named-failure guard, and the F5-narrowed install-coverage claim in both shipped docs. * test(audit-self): arm15 cache-path expectation — canonicalize like the carrier Host-run finding (operator harvest, 2026-08-20): arm15 red on macOS while the carrier behavior is correct. The carrier cd's to $(git rev-parse --show-toplevel), which canonicalizes symlinked roots (mktemp /var/folders/... -> /private/var/...), and logs the git-dir path in that canonical form; the arm grepped for the UN-canonicalized mktemp $T literal — match impossible on macOS, always true on the linux container (/tmp carries no symlink). Fix: derive the expectation with cd $T && pwd -P (same canonicalization). Verified on host: self-test 122/0 (was 121/1); container semantics unchanged. * test(audit-self): ci-tool-pin escape hatch on arm-25 fixture install lines The pre-push ci-tool-pinning scanner is line-based over repo shell scripts, so the deliberately-UNPINNED consumer-workflow fixture inside the PYWF_NP heredoc (arm 25 — the unparsed-pins guard) pattern-matched Rule A exactly like a real bare install. Annotate the two fixture run: lines with the rule's own escape hatch; the fixture keeps feeding the carrier an unpinned workflow either way (no version token added). Self-test re-run on host after the edit: 122 pass / 0 fail. --------- Co-authored-by: Test <test@example.com>
This was referenced Aug 20, 2026
Owner
Author
|
Tracking issues for the Parked questions (operator decision 2026-08-20: merge green only — auto-merge stays armed and will fire once CI is green after the fixes land):
|
6 tasks
artyhoo
added a commit
that referenced
this pull request
Sep 5, 2026
…#1609) ## Summary Records an explicit PARK of frontier-residue-sweep stages S4 (registry gate) and S5 (evals) until after the beta release. S1-S3 are merged (#1488, #1491, #1490); S4/S5 are factory-internal judgment calls that sit on no release-frame phase-1 exit criterion (`docs/superpowers/specs/2026-07-23-beta-program-design.md` §7), so leaving them undispatched-but-silent would let `/pipeline` keep ranking a stage nobody intends to run before the release. One Status block in the umbrella kickoff header; no other file. ## Changes - `.claude/orchestrator-prompts/frontier-residue-sweep/kickoff.md:10-15` — Status block: merged PRs per stage, the park with its reason, and the re-open instruction (delete the block, dispatch per §4). The umbrella stays open — no `done.md` is written, because a park is not a close (CLAUDE.md umbrella-closure convention). ## Prior-art consult - [x] Not a capability commit (kickoff prose). - [x] No new capability area. - [x] No SSOT entry matched. - [x] context7 not applicable. ## Test plan - [x] `npx prettier --check` + markdownlint on the kickoff (pre-commit). - [x] `bash .claude/hooks/check-kickoff-traps.sh` unaffected — the kickoff keeps its §3 T-enumeration; only the header block grew. ## Provenance n/a ## Review findings n/a ## Fidelity verdict FIDELITY: skipped — kickoff status annotation only; no worker output, no stage audited. ## Parked questions n/a ## §1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files) ### §1.7 Skipped: one kickoff status block under .claude/orchestrator-prompts/ — a dispatch input, not a discipline artefact; no rule, principle or convention is introduced or extended
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
S1 of the
frontier-residue-sweepumbrella:/dispatcher§2.7 «Advance» now derives the next stage from the dependency-frontier emitter —advance-frontier.shis a pure CONSUMER of/pipeline'sfrontier.sh(never a fork),night-modedelegates its advance step through §2.7, and a 14-arm vitest suite makes the no-fork / no-marker-trust constraints executable. Install-sh baselines regenerated for the shipped night-mode edit (one hash row ×8 lanes; dispatcher files are not on the consumer install surface — 0 fingerprint rows, verified not an omission).Commits:
dd75881dc0(helper + suite, Prior-art: REUSE) ·c3555e45d1(dispatcher §2.7 + night-mode bindings) ·2e3357b98d(snapshot regen) ·c250bffc90(cold-review riders: §2.6→§2.7MO_FRONTIER_DONEfeed-forward clause + ADVANCE-DEGRADE unverified-done clause).Live proof (T-FRS1-A)
Recorded dispatcher-path run on the PR head (
c250bffc90), host checkout, real umbrella — stage choice traceable to aFRONTIER:line, per the kickoff's live-proof requirement:Independently reproduced by the aif review pass in-container (same
FRONTIER: S1 S2 S3 S4→ADVANCE: S1).§1.7: forward-check: packages/core/skills/dispatcher/advance-frontier.test.ts:162 marker-lies HALT arm (T-FRS1-B) — a
basis=marker-unverifiedadvance never passes, paired DONE/OPEN confirmation arms at :178/:196; advance-frontier.test.ts:281 delegation arm trips on any own done-marker parser or gh call in the helper body; advance-frontier.test.ts:299 and :312 wiring arms verified RED at base 845cb9c (0 verdict-token / §2.7 / frontier-read occurrences there); backward: 12-file diff is fully inside the kickoff §2 allowlist (git diff --name-only origin/staging...HEAD), 0 new .md files, baseline deltas touch only the night-mode hash row ×8 lanes with dispatcher rows verified absent from baselinesProvenance
eb31049b(frontier-residue-sweep-s1): autonomous implement,/aif-review(verdict: no blockers, 4 advisories),/aif-security-checklist(0 blocking, 2 advisories)./harvest§1 Channel A — bundle out of the container, host fetch, sha verified2e3357b98d, host-side riderc250bffc90, host push through.husky/pre-push(no Git-Data-API land, no--no-verify).845cb9cb83— no rebase, clobber check vacuous by construction.SNAPSHOT_MODE=compare15/15;check-skill-drift.shPASS. Red gates attributed against pristine base845cb9cb83— see Parked questions.Review findings
aif review (no blockers): advisories carried in the task record include the regex-fragile
field()grep atadvance-frontier.sh:78, the HALT-VERIFY<ids>trust assumption atadvance-frontier.sh:111(maintainer-authored repo text — borderline noise, recorded to make the trust explicit), and an output-contract call (task contract's three-section format followed over the skill's default JSON block — the machine-parsed contract wins).aif security audit (0 blocking): shell safety verified at
advance-frontier.sh:55-144(set -euo pipefail, quoted expansions, no eval/secrets/network/writes); test harness verified (spawnSyncarray args,mkdtempSyncsandboxes, ambientMO_FRONTIER_*deleted).Harvest cold code review (superpowers:requesting-code-review, verdict «with fixes»): both Important findings fixed in
c250bffc90—MO_FRONTIER_DONEaccumulation (.claude/skills/dispatcher/SKILL.md:318-321).basis=field, sodone=reads were unverified yet skip-able. Fix: verdict line + SKILL bullet route them through §2.6 before any skip (advance-frontier.sh:100,.claude/skills/dispatcher/SKILL.md:331-333).Minor (recorded, not fixed): ATTN-UNRESOLVED satellite arm untested (
advance-frontier.sh:141-144); emitter-crash empty-output branch and multi-id HALT-VERIFY sed untested; §5 host-acceptance list omits the new suite path (it runs via the default skills glob and the diff-aware sweep); delegation body-filter strips only full-line comments (inline trailing comments could evade tripwires — contrived).Implementer deviation, review-concurred:
MO_FRONTIER_OPEN=S1yieldsADVANCE: S1rather than the plan-sketched HALT-BLOCKED —frontier.sh:319demotes OPEN stages to not-done, so forcing HALT-BLOCKED would require the consumer to re-derive blocked-ness (the forbidden fork). Reasoning guarded in the test arm + plan annotations.Watch-list
FRONTIER:lineFRONTIER:/ADVANCE:output block.claude/skills/dispatcher/helpers/advance-frontier.sh:59, guarded byadvance-frontier.test.ts:281gh prcall in the helper's executable body; any hunk onpipeline/helpers/frontier.shoutside a /pipeline-owned stageis:mergedstays merge authority; HALT-VERIFY +MO_FRONTIER_DONE/MO_FRONTIER_OPENfeedback intactbasis=marker-unverifiedrow text alone is the false-green class this stage exists to close.claude/skills/dispatcher/SKILL.md:334-339+helpers/advance-frontier.sh:114, guarded by test:162MO_FRONTIER_*mentions gone from §2.7; MARKER-LIES-HALT going green on a marker-unverified advancepipeline/SKILL.mduntouched (599/600-line ceiling)done=rows in degraded tables on the §2.6 path; the pipeline ceiling is a hard pre-commit gate.claude/skills/dispatcher/SKILL.md:331-333+helpers/advance-frontier.sh:100; pipeline/SKILL.md — none, preventive.claude/skills/pipeline/SKILL.mdRound 1: W-1 N/A (no stage PR exists at audit time — check lands with the egress body) · W-2 CLEAN · W-3 CLEAN · W-4 CLEAN
Fidelity verdict
FIDELITY: GO
Basis: stage kickoff «frontier-residue-sweep S1» (inlined verbatim in dispatch; §1 scope verbatim from ../frontier-residue-sweep/kickoff.md row S1)
Round: 1
Audited-SHA: c250bff
Evidence: .claude/skills/dispatcher/SKILL.md:308-352 (§2.7 rewrite: helper invocation :311, "consumer, never a fork" :320, HALT-VERIFY + gh authority + MO_FRONTIER_DONE/OPEN feedback :334-339, feed-forward rider :318) · .claude/skills/dispatcher/helpers/advance-frontier.sh:59 (EMITTER binding to pipeline/helpers/frontier.sh), :114 (HALT-VERIFY recipe), :100 (degrade-not-permission + unverified-done rider), :141/:145 (FRONTIER-SET / ATTN-UNRESOLVED satellites) · .claude/skills/night-mode/SKILL.md:35 ("advance (§2.7 frontier read)" added to the delegation chain) · packages/core/skills/dispatcher/advance-frontier.test.ts:162-176 (MARKER-LIES-HALT, T-FRS1-B), :178-195 (OPEN/DONE seam arms), :281-297 (DELEGATION no-fork arm), :299-310 (SKILL-WIRING), :312-317 (NIGHT-WIRING) · 8 × tests/install-sh/baselines/** (night-mode/SKILL.md hash only — verified consistent: baselines carry no dispatcher/ entries)
Findings:
Failure-scenario: the stage PR merges with prose claiming the wiring («§2.7 now derives the stage from the frontier») and no verbatim FRONTIER:/ADVANCE: output block — exactly the T-FRS1-A trap (done-by-paragraph), leaving «the executor never reads the frontier» unfixed and undetected.
Parked questions
python-rules-lock.test.shred (identical at base845cb9cb83, exit 1): line 188 references a variable whose name carries a stray carriage-return byte (fpA\r: unbound variable) — the test aborts after check (9). Verified failing on pristine staging in a clean worktree, so mechanically not attributable to this diff. Propose a separate small fix task (one-byte edit + rationale), per the atomic-umbrella discipline.hooks/end-of-turn-reminder.test.tsreds (7 failed / 62 passed, identical at base): all F10-autonomy-arm tests in that one file fail on pristine staging on this host. Same attribution logic — separate task / owner decision, not this PR./pipelineowner):frontier.sh:288-293(no-column fallback) emitsdone=yesrows without abasis=field and without theATTN: marker-unverifiedline, so marker-lies protection cannot reach the degrade path at the emitter level. This PR mitigates in-scope (the ADVANCE-DEGRADE rider routesdone=rows through §2.6); the emitter fix is outside S1's owner boundary (kickoff §3 c1 forbids editingfrontier.shhere).