From 48ceef427de61b19ab3d0f6a030d8851677eafa9 Mon Sep 17 00:00:00 2001 From: Monsky Date: Sat, 1 Aug 2026 23:23:48 -0400 Subject: [PATCH 1/2] docs: freeze lifecycle run invocation authority --- docs/INDEX.md | 17 +- .../lifecycle-run-invocation-authority.json | 266 +++++++++++++++++ ...cycle-run-invocation-authority.schema.json | 241 ++++++++++++++++ docs/roadmap/REMAINING_EXECUTION_PLAN.md | 13 +- docs/roadmap/TASK_PACKETS.md | 8 +- ...7r1-correct-lifecycle-preparation-scale.md | 10 +- ...-07r1a0-freeze-lifecycle-path-authority.md | 17 +- scripts/check_kernel_scope.py | 9 + tests/kernel/test_documentation_authority.py | 24 +- tests/kernel/test_kernel_scope.py | 2 + ...test_lifecycle_run_invocation_authority.py | 272 ++++++++++++++++++ 11 files changed, 835 insertions(+), 44 deletions(-) create mode 100644 docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json create mode 100644 docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json create mode 100644 tests/kernel/test_lifecycle_run_invocation_authority.py diff --git a/docs/INDEX.md b/docs/INDEX.md index d16034d9..28a9a9d5 100644 --- a/docs/INDEX.md +++ b/docs/INDEX.md @@ -28,13 +28,16 @@ CK-07R1A0 is accepted at exact main `519b503aa3b23019033b6481687c08b23fc6c31e`. Its transition authority makes the planner-valid receipt a CK-07R1 successor acceptance output rather than a pre-dispatch dependency. PR #394 remains a stale failed read-only witness; it is not updated, rerun, or merged. CK-07R1 -is held behind the linked [source-digest authority](decisions/evidence/ck07r1a0/lifecycle-source-digest-authority.json), -which freezes predecessor `408d18e4…` to the permitted successor -`d192c858…` and requires exact-main worker revalidation before any one-run -gate can be considered. CK-07R1 is Conditional Ready only after that -source-digest authority merges and exact-main verifies; no other successor is -advanced and the one-run gate remains unspent. Reclassification and -maintainability remain open. The central authority is +is held behind the linked [source-digest authority](decisions/evidence/ck07r1a0/lifecycle-source-digest-authority.json) +and [run-invocation authority](decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json) +(`docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json`). +The source authority freezes predecessor `408d18e4…` to the permitted +successor `d192c858…`; the run authority freezes the exact launch, fixture, +evidence, token, and no-retry contract. The retained candidate is explicitly +blocked because it cannot support that launch contract without behavioral +implementation. CK-07R1 remains blocked, no run token is consumed, no other +successor is advanced, and the one-run gate remains unspent. Reclassification +and maintainability remain open. The central authority is [REMAINING_EXECUTION_PLAN.md](roadmap/REMAINING_EXECUTION_PLAN.md). ## Authority set diff --git a/docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json b/docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json new file mode 100644 index 00000000..91aed705 --- /dev/null +++ b/docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json @@ -0,0 +1,266 @@ +{ + "schema": "codex-usage-tracker.lifecycle-run-invocation-authority.v1", + "authority_version": 1, + "owner": "CK-07R1A0", + "authority_base_sha": "e0ee9f2cf442399633d93e402d17f527da604f0f", + "status": "authority_only_harness_blocked", + "preserved_authorities": { + "lifecycle_path": { + "path": "docs/decisions/evidence/ck07r1a0/lifecycle-path-authority.json", + "sha256": "315f143661efa89f572484a7fc1e17754be5537c143fa2be1d97a041ad7b44b1", + "schema_path": "docs/decisions/evidence/ck07r1a0/lifecycle-path-authority.schema.json", + "schema_sha256": "181fa2290457e1149764b5f5952559838e70d4f81a512bc920aeb52592fc7856" + }, + "lifecycle_source_digest": { + "path": "docs/decisions/evidence/ck07r1a0/lifecycle-source-digest-authority.json", + "sha256": "9c9898a05d618c9f14cd0bcc5403987a5029c684ae53dfadaf28ddea77170c58", + "schema_path": "docs/decisions/evidence/ck07r1a0/lifecycle-source-digest-authority.schema.json", + "schema_sha256": "d524b987f76ff534ee3430e26299a574802f19a8cb8ef27322fb7fc3aed1a87f" + } + }, + "launch_contract": { + "repository_relative_command": [ + ".venv/bin/python", + "scripts/benchmark_ck07r1_lifecycle_scale.py", + "--profile", + "all", + "--samples", + "5", + "--output", + "output/ck07r1/lifecycle-requalification-v1.json" + ], + "required_cwd": "repository_root", + "cwd_rule": "pwd -P is the fresh retained worker worktree root containing pyproject.toml; do not run from scripts, a canonical dirty checkout, or a witness worktree", + "interpreter": { + "executable": ".venv/bin/python", + "version_min_inclusive": "3.10", + "version_max_exclusive": "3.15", + "resolution": "sys.executable resolves to the repository .venv/bin/python", + "system_fallback": false + }, + "environment": { + "required": { + "LC_ALL": "C.UTF-8", + "PYTHONHASHSEED": "0", + "PYTHONUNBUFFERED": "1", + "TZ": "UTC" + }, + "forbidden": [ + "PYTHONPATH", + "CODEX_HOME", + "real Codex log or database paths" + ], + "data_policy": "synthetic fixtures only; no private or production inputs" + }, + "output": { + "relative_path": "output/ck07r1/lifecycle-requalification-v1.json", + "format": "one canonical UTF-8 JSON document followed by LF", + "parent_rule": "the output parent must exist before launch", + "prelaunch_rule": "the exact output path must not exist before launch", + "overwrite_rule": "if the path exists, fail closed before launch; never truncate, append, replace, or reuse it", + "write_rule": "the child creates the output only for this launch and the authority records its final file SHA-256" + }, + "fixture_identity": { + "vocabulary": { + "fixture_manifest_digest": "the manifest's declared manifest_digest value; it is not a file SHA and is not a workload digest", + "fixture_file_sha256": "SHA-256 of exact fixture file bytes at the required relative path; it is not the manifest digest and is not a dynamic digest", + "workload_transition_digest": "SHA-256 computed during this run from the canonical generated workload and emitted transition vector; it is not supplied as a static fixture identity" + }, + "manifest": { + "path": "tests/agent_kernel/fixtures/tiny-v1/manifest.json", + "schema": "codex-usage-tracker.synthetic-fixture-manifest.v1", + "fixture_manifest_digest": "91e0658f913c917bd8ce69fac9a1d75e881f41630eccc0f30f68bd9b6a972a35", + "fixture_file_sha256": "e8c79373697ebe2af5385dbb2899ae49cec6104637c4a3b0909f91225128e0bc", + "seed": 20260728 + }, + "fixture_files": [ + {"path": "tests/agent_kernel/fixtures/profiles/standard-v1.json", "fixture_file_sha256": "ef0da880255a0b13ea6055e0f8d748870c075635aa6f199c9521462c681250f3"}, + {"path": "tests/agent_kernel/fixtures/profiles/production-v1.json", "fixture_file_sha256": "2de0b4dc198603da6c1b0905b8d934e2cd5604e4036ef009d0cd07f1cc81f51b"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0000.jsonl", "fixture_file_sha256": "bad29500048dcff994d4211ff6de446c48d51184ab00caa134a7d668a6e57191"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0001.jsonl", "fixture_file_sha256": "d3ddb9592d67f058b7b7b354c7e01ff159d195c3963e0780be7a4cf35ec9a5eb"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0002.jsonl", "fixture_file_sha256": "114dadd49888fe77bfa1690b0fb810820950dea80d04ff11b233cd14bab54605"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0003.jsonl", "fixture_file_sha256": "12ccb3114f5f4583e98e6e0d8a485b2c1479762b93cd8e6008c9be14edfd2a5d"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0004.jsonl", "fixture_file_sha256": "0729952c7d2c250608ac0913a9d4a879c09b3bf252d86ee84b6b333000b66514"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0005.jsonl", "fixture_file_sha256": "cbfdfbb7f0f463c087c058b0f49cfdb6ec0ff72da5afa14d293b06a3f2ee817f"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0006.jsonl", "fixture_file_sha256": "f7693618223a2de73d5dcfc0c645f13455c480a721641b4d790c278744283729"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/archived/exact-copy.jsonl", "fixture_file_sha256": "34709a9e5b6c52438f7c5710c9480db9a2641fbd33e25d8e6c767c383502a65f"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/malformed/malformed.jsonl", "fixture_file_sha256": "cdfbf46b0d9524c5c9b16b6672eb98cd9f1b413703cd75f8ca9b833e96e5ac4d"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/replaced/revision-1.jsonl", "fixture_file_sha256": "de66394d849cab6e4936af84b4991e36c1cdf6746f0ab90c7c39dd1ca10761e1"}, + {"path": "tests/agent_kernel/fixtures/tiny-v1/sources/truncated/truncated.jsonl", "fixture_file_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"} + ], + "dynamic_digest": { + "field": "workload_transition_digest", + "algorithm": "sha256", + "canonicalization": "sort_keys=true; separators=(',', ':'); ensure_ascii=true; UTF-8", + "source": "generated workload descriptor plus ordered lifecycle transition vector, excluding receipt metadata and expected-answer/grading fields", + "supplied_before_launch": false, + "recorded_after": "successful process launch and workload/transition production", + "verified_at": "acceptance after receipt schema validation", + "mismatch": "fail_closed" + } + }, + "profiles": { + "sample_count": 5, + "warmup_count": 0, + "profiled": false, + "seed": 20260728, + "workloads": [ + {"name": "standard_30_day", "source_profile": "standard", "history_preset": "30_days", "model_calls": 2740, "entities": 685, "observations": 1369, "seed": 20260728, "profile_file_sha256": "ef0da880255a0b13ea6055e0f8d748870c075635aa6f199c9521462c681250f3"}, + {"name": "production_all_time", "source_profile": "production", "history_preset": "all_time", "model_calls": 1316864, "entities": 329216, "observations": 658431, "seed": 20260728, "profile_file_sha256": "2de0b4dc198603da6c1b0905b8d934e2cd5604e4036ef009d0cd07f1cc81f51b"}, + {"name": "no_change", "source_profile": "synthetic_tail", "history_preset": "all_time", "model_calls": 0, "entities": 0, "observations": 0, "seed": 20260728, "profile_file_sha256": null}, + {"name": "one_call_tail", "source_profile": "synthetic_tail", "history_preset": "all_time", "model_calls": 0, "entities": 1, "observations": 1, "seed": 20260728, "profile_file_sha256": null}, + {"name": "one_tool_tail", "source_profile": "synthetic_tail", "history_preset": "all_time", "model_calls": 0, "entities": 1, "observations": 1, "seed": 20260728, "profile_file_sha256": null} + ] + }, + "tail_limits": { + "source_symbol": "codex_usage_tracker.agent_kernel.publication.planner.TailLimits", + "construction": "TailLimits() with no overrides", + "values": { + "selected_bytes": 8388608, + "selected_records": 32, + "observations": 12000, + "occurrences": 12000, + "affected_sessions": 2000, + "affected_turns": 4000, + "affected_resources": 4000, + "affected_allowance_cycles": 512, + "dirty_keys": 16000, + "projection_rows": 16000, + "expected_wal_bytes": 16777216, + "planning_staleness_us": 5000000, + "model_call_tail_rows": 32000 + }, + "verification": "receipt planner_tail_limits equals these values and plan_refresh receives the same values" + }, + "reachable_path": { + "ordered_steps": [ + "select_readable_artifact(pointer_path, validate_open=...)", + "recover_startup(pointer_path, selection=..., store=..., ...)", + "plan_refresh(changes, intent, limits=TailLimits(), dirty_keys=0, projection_rows=0, expected_wal_bytes=None)", + "selected_plan_unchanged", + "PublicationWriter.publish_with_pointer(plan, request, write_set, pointer_path=..., operational_store=..., pointer_request=..., validate_open=...)", + "publish_small_with_pointer(..., commit_analytical=...)", + "PublicationWriter.publish(plan, request, write_set)" + ], + "selection": "plan_refresh alone selects append_safe_small; no manually constructed PublicationPlan or operation-class override", + "unchanged_plan": { + "identity": "the exact object returned by plan_refresh is passed to the writer", + "record": ["planner_operation_class", "planner_reason", "planner_tail_limits", "planner_change_estimate", "plan_digest_before_writer", "plan_digest_at_writer"], + "verify": "plan_digest_before_writer equals plan_digest_at_writer and all serialized plan fields remain unchanged" + }, + "identity_binding": [ + "ReadSelection.head.publication_id == RefreshIntent.parent_publication_id", + "RefreshIntent.parent_publication_id == PublicationPlan.parent_publication_id", + "PublicationPlan.parent_publication_id == SmallPublicationRequest.expected_active_publication_id", + "SmallPublicationRequest.expected_active_publication_id == pre_commit_pointer.active.publication_id", + "committed_AnalyticalHead.parent_publication_id == SmallPublicationRequest.expected_active_publication_id", + "post_commit_pointer.active.publication_id == committed_AnalyticalHead.publication_id" + ], + "failure": "any path, ordering, plan identity, or publication identity mismatch is fail_closed with no stitched artifacts" + } + }, + "launch_gates": { + "prelaunch": { + "required": [ + "exact command, cwd, interpreter, environment, output path, fixture manifest digest, and fixture file SHA values supplied", + "exact output path is absent", + "no matching process exists for exact argv, exact cwd, and current owner", + "disk available bytes are captured", + "maximum_new_end_to_end_runs remains 1 and run token is unspent_unavailable" + ], + "token": "not consumed" + }, + "successful_process_launch": { + "definition": "child creation returns a PID and the child is observed with the exact command and required cwd", + "record": ["pid", "parent_pid", "launched_at_utc", "launched_monotonic_ns", "argv", "cwd", "interpreter", "run_token_id"], + "token": "consume exactly one run token at this stage and only at this stage" + }, + "runtime_and_completion": { + "record": [ + "start and completion UTC timestamps", + "monotonic elapsed time", + "peak RSS bytes", + "disk available bytes before launch, after launch, and after completion", + "stdout and stderr evidence paths and SHA-256 values", + "output path and output file SHA-256", + "exit code or terminating signal", + "receipt schema and workload_transition_digest", + "planner path, selected-plan identity, publication/recovery identity bindings, budgets, counts, and postconditions", + "process state transitions and no-retry outcome" + ], + "verification": "all required receipt fields, exact static identities, dynamic digest, planner path, budgets, counts, and postconditions are independently checked before acceptance" + } + }, + "run_token": { + "maximum_new_end_to_end_runs": 1, + "status": "unspent_unavailable", + "consumption": "successful_process_launch_only", + "refund": false, + "prior_identities_reused": false, + "concurrent_processes_allowed": false + }, + "failure_matrix": { + "after_launch": { + "no_retry": true, + "no_restart": true, + "no_replacement": true, + "retain_first_result": true, + "token_remains_consumed": true, + "failures": [ + "process launch failure after token consumption", + "interruption", + "timeout", + "nonzero exit or signal", + "incomplete receipt", + "invalid receipt", + "budget miss", + "planner or publication identity-binding miss", + "postcondition failure" + ] + }, + "before_successful_launch": { + "token_consumed": false, + "automatic_retry_or_replacement": false, + "action": "retain the exact blocker and keep the one-run gate unavailable" + } + }, + "preserved_history": { + "writer_only_receipt_digest": "935e4427b93e67c5ca649b773b0b3895dafac87f49bc76d7ed8917dff2f0250d", + "source_predecessor_sha256": "408d18e44c87da234d220c29298ebac1780e9426e2dce767b0bfc3ae65e8a872", + "source_successor_sha256": "d192c858b48e44b5aa7a7e39ef524e5ec2f08085655fe485639f5e875a727aa1", + "runtime_budgets_ms": {"first_publication_30_day": 5000, "production_all_time": 120000, "no_change": 100, "one_call_tail": 500, "one_tool_tail": 500}, + "package_ceilings_bytes": {"sdist": 2000000, "wheel": 1000000}, + "pr_394": {"number": 394, "head_sha": "98a9b5b82951d136644a5fe5f8a70d320131ba08", "workflow_run_id": "30685780055", "failed_job_id": "91331138768", "failure": "ordinary.2000_call_tail", "status": "stale_failed_superseded_read_only", "policy": "do_not_update_rerun_merge_or_reinterpret"}, + "prior_attempt_ids": ["all-profile-initial-serializer", "all-profile-corrected-serializer-tail-oracle", "all-profile-pid-60367-recovery", "production-only-valid-profile"], + "preservation": "all prior run identities, attempts, timestamps, failures, receipts, and digests remain visible and read-only; no old receipt is upgraded" + }, + "feasibility": { + "candidate_script": "scripts/benchmark_ck07r1_lifecycle_scale.py", + "candidate_status": "cannot_support_one_explicit_launch_without_behavioral_implementation", + "exact_blocker": "the retained candidate exposes an optional output argument and an in-process run path, but does not implement the required prelaunch process exclusion, exclusive non-overwrite output preflight, launch-token ledger, child PID/parent PID/timestamp/RSS/disk/evidence capture, or post-launch no-retry/restart/replacement state machine", + "authority_action": "freeze contract only; do not implement runtime or harness behavior in this authority", + "run_action": "do not execute production or end-to-end qualification; do not consume the run token; keep CK-07R1 blocked", + "fixture_identity_status": "proven_for_static_manifest_and_file_values; workload_transition_digest remains a required runtime-produced value" + }, + "scope": { + "authority_only_files": [ + "docs/INDEX.md", + "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json", + "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json", + "docs/roadmap/REMAINING_EXECUTION_PLAN.md", + "docs/roadmap/TASK_PACKETS.md", + "docs/roadmap/tasks/ck-07r1a0-freeze-lifecycle-path-authority.md", + "docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md", + "scripts/check_kernel_scope.py", + "tests/kernel/test_lifecycle_run_invocation_authority.py" + ], + "forbidden": [ + "src/codex_usage_tracker/agent_kernel/", + "scripts/benchmark_ck07r1_lifecycle_scale.py", + "tests/agent_kernel/publication/test_lifecycle_scale.py", + "the two retained witness worktrees", + "PR #394", + "downstream packets" + ] + } +} diff --git a/docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json b/docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json new file mode 100644 index 00000000..4f18af88 --- /dev/null +++ b/docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json @@ -0,0 +1,241 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://codex-usage-tracker.invalid/schemas/lifecycle-run-invocation-authority-v1.schema.json", + "title": "CK-07R1A0 lifecycle run-invocation authority", + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "authority_version", + "owner", + "authority_base_sha", + "status", + "preserved_authorities", + "launch_contract", + "launch_gates", + "run_token", + "failure_matrix", + "preserved_history", + "feasibility", + "scope" + ], + "properties": { + "schema": {"const": "codex-usage-tracker.lifecycle-run-invocation-authority.v1"}, + "authority_version": {"const": 1}, + "owner": {"const": "CK-07R1A0"}, + "authority_base_sha": {"const": "e0ee9f2cf442399633d93e402d17f527da604f0f"}, + "status": {"const": "authority_only_harness_blocked"}, + "preserved_authorities": { + "type": "object", + "additionalProperties": false, + "required": ["lifecycle_path", "lifecycle_source_digest"], + "properties": { + "lifecycle_path": { + "type": "object", + "additionalProperties": false, + "required": ["path", "sha256", "schema_path", "schema_sha256"], + "properties": { + "path": {"const": "docs/decisions/evidence/ck07r1a0/lifecycle-path-authority.json"}, + "sha256": {"const": "315f143661efa89f572484a7fc1e17754be5537c143fa2be1d97a041ad7b44b1"}, + "schema_path": {"const": "docs/decisions/evidence/ck07r1a0/lifecycle-path-authority.schema.json"}, + "schema_sha256": {"const": "181fa2290457e1149764b5f5952559838e70d4f81a512bc920aeb52592fc7856"} + } + }, + "lifecycle_source_digest": { + "type": "object", + "additionalProperties": false, + "required": ["path", "sha256", "schema_path", "schema_sha256"], + "properties": { + "path": {"const": "docs/decisions/evidence/ck07r1a0/lifecycle-source-digest-authority.json"}, + "sha256": {"const": "9c9898a05d618c9f14cd0bcc5403987a5029c684ae53dfadaf28ddea77170c58"}, + "schema_path": {"const": "docs/decisions/evidence/ck07r1a0/lifecycle-source-digest-authority.schema.json"}, + "schema_sha256": {"const": "d524b987f76ff534ee3430e26299a574802f19a8cb8ef27322fb7fc3aed1a87f"} + } + } + } + }, + "launch_contract": { + "type": "object", "additionalProperties": false, + "required": ["repository_relative_command", "required_cwd", "cwd_rule", "interpreter", "environment", "output", "fixture_identity", "profiles", "tail_limits", "reachable_path"], + "properties": { + "repository_relative_command": { + "const": [".venv/bin/python", "scripts/benchmark_ck07r1_lifecycle_scale.py", "--profile", "all", "--samples", "5", "--output", "output/ck07r1/lifecycle-requalification-v1.json"] + }, + "required_cwd": {"const": "repository_root"}, + "cwd_rule": {"const": "pwd -P is the fresh retained worker worktree root containing pyproject.toml; do not run from scripts, a canonical dirty checkout, or a witness worktree"}, + "interpreter": { + "type": "object", "additionalProperties": false, + "required": ["executable", "version_min_inclusive", "version_max_exclusive", "resolution", "system_fallback"], + "properties": { + "executable": {"const": ".venv/bin/python"}, + "version_min_inclusive": {"const": "3.10"}, + "version_max_exclusive": {"const": "3.15"}, + "resolution": {"const": "sys.executable resolves to the repository .venv/bin/python"}, + "system_fallback": {"const": false} + } + }, + "environment": { + "type": "object", "additionalProperties": false, + "required": ["required", "forbidden", "data_policy"], + "properties": { + "required": {"const": {"LC_ALL": "C.UTF-8", "PYTHONHASHSEED": "0", "PYTHONUNBUFFERED": "1", "TZ": "UTC"}}, + "forbidden": {"const": ["PYTHONPATH", "CODEX_HOME", "real Codex log or database paths"]}, + "data_policy": {"const": "synthetic fixtures only; no private or production inputs"} + } + }, + "output": { + "type": "object", "additionalProperties": false, + "required": ["relative_path", "format", "parent_rule", "prelaunch_rule", "overwrite_rule", "write_rule"], + "properties": { + "relative_path": {"const": "output/ck07r1/lifecycle-requalification-v1.json"}, + "format": {"const": "one canonical UTF-8 JSON document followed by LF"}, + "parent_rule": {"const": "the output parent must exist before launch"}, + "prelaunch_rule": {"const": "the exact output path must not exist before launch"}, + "overwrite_rule": {"const": "if the path exists, fail closed before launch; never truncate, append, replace, or reuse it"}, + "write_rule": {"const": "the child creates the output only for this launch and the authority records its final file SHA-256"} + } + }, + "fixture_identity": { + "type": "object", "additionalProperties": false, + "required": ["vocabulary", "manifest", "fixture_files", "dynamic_digest"], + "properties": { + "vocabulary": { + "const": { + "fixture_manifest_digest": "the manifest's declared manifest_digest value; it is not a file SHA and is not a workload digest", + "fixture_file_sha256": "SHA-256 of exact fixture file bytes at the required relative path; it is not the manifest digest and is not a dynamic digest", + "workload_transition_digest": "SHA-256 computed during this run from the canonical generated workload and emitted transition vector; it is not supplied as a static fixture identity" + } + }, + "manifest": { + "type": "object", "additionalProperties": false, + "required": ["path", "schema", "fixture_manifest_digest", "fixture_file_sha256", "seed"], + "properties": { + "path": {"const": "tests/agent_kernel/fixtures/tiny-v1/manifest.json"}, + "schema": {"const": "codex-usage-tracker.synthetic-fixture-manifest.v1"}, + "fixture_manifest_digest": {"const": "91e0658f913c917bd8ce69fac9a1d75e881f41630eccc0f30f68bd9b6a972a35"}, + "fixture_file_sha256": {"const": "e8c79373697ebe2af5385dbb2899ae49cec6104637c4a3b0909f91225128e0bc"}, + "seed": {"const": 20260728} + } + }, + "fixture_files": { + "type": "array", "minItems": 13, "maxItems": 13, + "items": { + "type": "object", "additionalProperties": false, + "required": ["path", "fixture_file_sha256"], + "properties": { + "path": {"type": "string"}, + "fixture_file_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"} + } + } + }, + "dynamic_digest": { + "type": "object", "additionalProperties": false, + "required": ["field", "algorithm", "canonicalization", "source", "supplied_before_launch", "recorded_after", "verified_at", "mismatch"], + "properties": { + "field": {"const": "workload_transition_digest"}, + "algorithm": {"const": "sha256"}, + "canonicalization": {"const": "sort_keys=true; separators=(',', ':'); ensure_ascii=true; UTF-8"}, + "source": {"const": "generated workload descriptor plus ordered lifecycle transition vector, excluding receipt metadata and expected-answer/grading fields"}, + "supplied_before_launch": {"const": false}, + "recorded_after": {"const": "successful process launch and workload/transition production"}, + "verified_at": {"const": "acceptance after receipt schema validation"}, + "mismatch": {"const": "fail_closed"} + } + } + } + }, + "profiles": { + "type": "object", "additionalProperties": false, + "required": ["sample_count", "warmup_count", "profiled", "seed", "workloads"], + "properties": { + "sample_count": {"const": 5}, + "warmup_count": {"const": 0}, + "profiled": {"const": false}, + "seed": {"const": 20260728}, + "workloads": { + "const": [ + {"name": "standard_30_day", "source_profile": "standard", "history_preset": "30_days", "model_calls": 2740, "entities": 685, "observations": 1369, "seed": 20260728, "profile_file_sha256": "ef0da880255a0b13ea6055e0f8d748870c075635aa6f199c9521462c681250f3"}, + {"name": "production_all_time", "source_profile": "production", "history_preset": "all_time", "model_calls": 1316864, "entities": 329216, "observations": 658431, "seed": 20260728, "profile_file_sha256": "2de0b4dc198603da6c1b0905b8d934e2cd5604e4036ef009d0cd07f1cc81f51b"}, + {"name": "no_change", "source_profile": "synthetic_tail", "history_preset": "all_time", "model_calls": 0, "entities": 0, "observations": 0, "seed": 20260728, "profile_file_sha256": null}, + {"name": "one_call_tail", "source_profile": "synthetic_tail", "history_preset": "all_time", "model_calls": 0, "entities": 1, "observations": 1, "seed": 20260728, "profile_file_sha256": null}, + {"name": "one_tool_tail", "source_profile": "synthetic_tail", "history_preset": "all_time", "model_calls": 0, "entities": 1, "observations": 1, "seed": 20260728, "profile_file_sha256": null} + ] + } + } + }, + "tail_limits": { + "type": "object", "additionalProperties": false, + "required": ["source_symbol", "construction", "values", "verification"], + "properties": { + "source_symbol": {"const": "codex_usage_tracker.agent_kernel.publication.planner.TailLimits"}, + "construction": {"const": "TailLimits() with no overrides"}, + "values": {"const": {"selected_bytes": 8388608, "selected_records": 32, "observations": 12000, "occurrences": 12000, "affected_sessions": 2000, "affected_turns": 4000, "affected_resources": 4000, "affected_allowance_cycles": 512, "dirty_keys": 16000, "projection_rows": 16000, "expected_wal_bytes": 16777216, "planning_staleness_us": 5000000, "model_call_tail_rows": 32000}}, + "verification": {"const": "receipt planner_tail_limits equals these values and plan_refresh receives the same values"} + } + }, + "reachable_path": { + "type": "object", "additionalProperties": false, + "required": ["ordered_steps", "selection", "unchanged_plan", "identity_binding", "failure"], + "properties": { + "ordered_steps": {"const": ["select_readable_artifact(pointer_path, validate_open=...)", "recover_startup(pointer_path, selection=..., store=..., ...)", "plan_refresh(changes, intent, limits=TailLimits(), dirty_keys=0, projection_rows=0, expected_wal_bytes=None)", "selected_plan_unchanged", "PublicationWriter.publish_with_pointer(plan, request, write_set, pointer_path=..., operational_store=..., pointer_request=..., validate_open=...)", "publish_small_with_pointer(..., commit_analytical=...)", "PublicationWriter.publish(plan, request, write_set)"]}, + "selection": {"const": "plan_refresh alone selects append_safe_small; no manually constructed PublicationPlan or operation-class override"}, + "unchanged_plan": { + "type": "object", "additionalProperties": false, + "required": ["identity", "record", "verify"], + "properties": { + "identity": {"const": "the exact object returned by plan_refresh is passed to the writer"}, + "record": {"const": ["planner_operation_class", "planner_reason", "planner_tail_limits", "planner_change_estimate", "plan_digest_before_writer", "plan_digest_at_writer"]}, + "verify": {"const": "plan_digest_before_writer equals plan_digest_at_writer and all serialized plan fields remain unchanged"} + } + }, + "identity_binding": {"const": ["ReadSelection.head.publication_id == RefreshIntent.parent_publication_id", "RefreshIntent.parent_publication_id == PublicationPlan.parent_publication_id", "PublicationPlan.parent_publication_id == SmallPublicationRequest.expected_active_publication_id", "SmallPublicationRequest.expected_active_publication_id == pre_commit_pointer.active.publication_id", "committed_AnalyticalHead.parent_publication_id == SmallPublicationRequest.expected_active_publication_id", "post_commit_pointer.active.publication_id == committed_AnalyticalHead.publication_id"]}, + "failure": {"const": "any path, ordering, plan identity, or publication identity mismatch is fail_closed with no stitched artifacts"} + } + } + } + }, + "launch_gates": { + "type": "object", "additionalProperties": false, + "required": ["prelaunch", "successful_process_launch", "runtime_and_completion"], + "properties": { + "prelaunch": {"type": "object", "additionalProperties": false, "required": ["required", "token"], "properties": {"required": {"const": ["exact command, cwd, interpreter, environment, output path, fixture manifest digest, and fixture file SHA values supplied", "exact output path is absent", "no matching process exists for exact argv, exact cwd, and current owner", "disk available bytes are captured", "maximum_new_end_to_end_runs remains 1 and run token is unspent_unavailable"]}, "token": {"const": "not consumed"}}}, + "successful_process_launch": {"type": "object", "additionalProperties": false, "required": ["definition", "record", "token"], "properties": {"definition": {"const": "child creation returns a PID and the child is observed with the exact command and required cwd"}, "record": {"const": ["pid", "parent_pid", "launched_at_utc", "launched_monotonic_ns", "argv", "cwd", "interpreter", "run_token_id"]}, "token": {"const": "consume exactly one run token at this stage and only at this stage"}}}, + "runtime_and_completion": {"type": "object", "additionalProperties": false, "required": ["record", "verification"], "properties": {"record": {"const": ["start and completion UTC timestamps", "monotonic elapsed time", "peak RSS bytes", "disk available bytes before launch, after launch, and after completion", "stdout and stderr evidence paths and SHA-256 values", "output path and output file SHA-256", "exit code or terminating signal", "receipt schema and workload_transition_digest", "planner path, selected-plan identity, publication/recovery identity bindings, budgets, counts, and postconditions", "process state transitions and no-retry outcome"]}, "verification": {"const": "all required receipt fields, exact static identities, dynamic digest, planner path, budgets, counts, and postconditions are independently checked before acceptance"}}} + } + }, + "run_token": {"type": "object", "additionalProperties": false, "required": ["maximum_new_end_to_end_runs", "status", "consumption", "refund", "prior_identities_reused", "concurrent_processes_allowed"], "properties": {"maximum_new_end_to_end_runs": {"const": 1}, "status": {"const": "unspent_unavailable"}, "consumption": {"const": "successful_process_launch_only"}, "refund": {"const": false}, "prior_identities_reused": {"const": false}, "concurrent_processes_allowed": {"const": false}}}, + "failure_matrix": { + "type": "object", + "additionalProperties": false, + "required": ["after_launch", "before_successful_launch"], + "properties": { + "after_launch": { + "type": "object", + "additionalProperties": false, + "required": ["no_retry", "no_restart", "no_replacement", "retain_first_result", "token_remains_consumed", "failures"], + "properties": { + "no_retry": {"const": true}, + "no_restart": {"const": true}, + "no_replacement": {"const": true}, + "retain_first_result": {"const": true}, + "token_remains_consumed": {"const": true}, + "failures": {"const": ["process launch failure after token consumption", "interruption", "timeout", "nonzero exit or signal", "incomplete receipt", "invalid receipt", "budget miss", "planner or publication identity-binding miss", "postcondition failure"]} + } + }, + "before_successful_launch": { + "type": "object", + "additionalProperties": false, + "required": ["token_consumed", "automatic_retry_or_replacement", "action"], + "properties": { + "token_consumed": {"const": false}, + "automatic_retry_or_replacement": {"const": false}, + "action": {"const": "retain the exact blocker and keep the one-run gate unavailable"} + } + } + } + }, + "preserved_history": {"type": "object", "additionalProperties": false, "required": ["writer_only_receipt_digest", "source_predecessor_sha256", "source_successor_sha256", "runtime_budgets_ms", "package_ceilings_bytes", "pr_394", "prior_attempt_ids", "preservation"], "properties": {"writer_only_receipt_digest": {"const": "935e4427b93e67c5ca649b773b0b3895dafac87f49bc76d7ed8917dff2f0250d"}, "source_predecessor_sha256": {"const": "408d18e44c87da234d220c29298ebac1780e9426e2dce767b0bfc3ae65e8a872"}, "source_successor_sha256": {"const": "d192c858b48e44b5aa7a7e39ef524e5ec2f08085655fe485639f5e875a727aa1"}, "runtime_budgets_ms": {"const": {"first_publication_30_day": 5000, "production_all_time": 120000, "no_change": 100, "one_call_tail": 500, "one_tool_tail": 500}}, "package_ceilings_bytes": {"const": {"sdist": 2000000, "wheel": 1000000}}, "pr_394": {"const": {"number": 394, "head_sha": "98a9b5b82951d136644a5fe5f8a70d320131ba08", "workflow_run_id": "30685780055", "failed_job_id": "91331138768", "failure": "ordinary.2000_call_tail", "status": "stale_failed_superseded_read_only", "policy": "do_not_update_rerun_merge_or_reinterpret"}}, "prior_attempt_ids": {"const": ["all-profile-initial-serializer", "all-profile-corrected-serializer-tail-oracle", "all-profile-pid-60367-recovery", "production-only-valid-profile"]}, "preservation": {"const": "all prior run identities, attempts, timestamps, failures, receipts, and digests remain visible and read-only; no old receipt is upgraded"}}}, + "feasibility": {"type": "object", "additionalProperties": false, "required": ["candidate_script", "candidate_status", "exact_blocker", "authority_action", "run_action", "fixture_identity_status"], "properties": {"candidate_script": {"const": "scripts/benchmark_ck07r1_lifecycle_scale.py"}, "candidate_status": {"const": "cannot_support_one_explicit_launch_without_behavioral_implementation"}, "exact_blocker": {"const": "the retained candidate exposes an optional output argument and an in-process run path, but does not implement the required prelaunch process exclusion, exclusive non-overwrite output preflight, launch-token ledger, child PID/parent PID/timestamp/RSS/disk/evidence capture, or post-launch no-retry/restart/replacement state machine"}, "authority_action": {"const": "freeze contract only; do not implement runtime or harness behavior in this authority"}, "run_action": {"const": "do not execute production or end-to-end qualification; do not consume the run token; keep CK-07R1 blocked"}, "fixture_identity_status": {"const": "proven_for_static_manifest_and_file_values; workload_transition_digest remains a required runtime-produced value"}}}, + "scope": {"type": "object", "additionalProperties": false, "required": ["authority_only_files", "forbidden"], "properties": {"authority_only_files": {"const": ["docs/INDEX.md", "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json", "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json", "docs/roadmap/REMAINING_EXECUTION_PLAN.md", "docs/roadmap/TASK_PACKETS.md", "docs/roadmap/tasks/ck-07r1a0-freeze-lifecycle-path-authority.md", "docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md", "scripts/check_kernel_scope.py", "tests/kernel/test_lifecycle_run_invocation_authority.py"]}, "forbidden": {"const": ["src/codex_usage_tracker/agent_kernel/", "scripts/benchmark_ck07r1_lifecycle_scale.py", "tests/agent_kernel/publication/test_lifecycle_scale.py", "the two retained witness worktrees", "PR #394", "downstream packets"]}}} + } +} diff --git a/docs/roadmap/REMAINING_EXECUTION_PLAN.md b/docs/roadmap/REMAINING_EXECUTION_PLAN.md index 1feecd87..c7dddf1e 100644 --- a/docs/roadmap/REMAINING_EXECUTION_PLAN.md +++ b/docs/roadmap/REMAINING_EXECUTION_PLAN.md @@ -31,10 +31,11 @@ worker implementation. PR #394 is a stale failed witness: head `ordinary.2000_call_tail` gate and is superseded read-only. It must not be updated, rerun, or merged. The planner-valid lifecycle receipt is an acceptance output of the existing CK-07R1 worker only after it revalidates the -retained candidate on this authority's exact merged main; it is not a -pre-dispatch dependency. The first sample, all five budgets, one-run ceiling, -and every fail-closed rule remain binding. CK-07R1 is Conditional Ready only -after the source-digest authority is accepted, merged, and exact-main +retained candidate on the source-digest and run-invocation authorities' exact +merged main; the run-invocation authority is not a pre-dispatch dependency. +The first sample, all five +budgets, one-run ceiling, and every fail-closed rule remain binding. CK-07R1 +is blocked until both authorities are accepted, merged, and exact-main verified. Earlier wording that says to resume, refresh, or rerun PR #394 is historical provenance and does not authorize action. This source-digest authority supersedes earlier CK-07R1 wording that says to resume, refresh, or @@ -114,10 +115,8 @@ conditions in the table and child files; they are not unconditional DAG edges. }, { "condition": "CK-QG1A0 merged and exact-main verified", "tasks": ["CK-QG1A"] - }, { - "condition": "CK-07R1/CK-07R1A0 source-digest authority accepted, merged, and exact-main verified; worker pre-run gates remain required", - "tasks": ["CK-07R1"] }], + "blocked": ["CK-07R1"], "tasks": [ {"id": "CK-08R0", "file": "tasks/ck-08r0-freeze-corrective-contracts.md", "dependencies": []}, {"id": "CK-08R1A", "file": "tasks/ck-08r1a-freeze-answer-semantics.md", "dependencies": ["CK-08R0"]}, diff --git a/docs/roadmap/TASK_PACKETS.md b/docs/roadmap/TASK_PACKETS.md index b99ec160..c943ea01 100644 --- a/docs/roadmap/TASK_PACKETS.md +++ b/docs/roadmap/TASK_PACKETS.md @@ -15,8 +15,8 @@ parents are accounting umbrellas. - Completed corrective child tasks: **5 — CK-08R0, CK-08R2, CK-QG1A0, CK-07R1A, CK-07R1A0** - Remaining delegable child tasks: **45** - Ready child tasks: **0** -- Conditional-ready child tasks: **4 — CK-08R1A, CK-08R3A; CK-QG1A after CK-QG1A0 exact-main; CK-07R1 after this authority exact-main** -- Blocked child tasks: **41** +- Conditional-ready child tasks: **3 — CK-08R1A, CK-08R3A; CK-QG1A after CK-QG1A0 exact-main** +- Blocked child tasks: **42 — CK-07R1 pending the source-digest and the run-invocation authority** ## Parent packets @@ -61,8 +61,8 @@ other corrective locks are unchanged. - [ ] **CK-08R3A — Implement bounded EvidenceService physical queries** · Conditional Ready after corrective authority exact-main verification; CK-08R0 remains accepted · [packet](tasks/ck-08r3a-implement-evidence-physical-query.md) - [ ] **CK-08R3 — Qualify evidence service scale** · Blocked on CK-08R3A accepted merge and exact-main verification · [packet](tasks/ck-08r3-qualify-evidence-scale.md) - [x] **CK-07R1A — Correct hosted lifecycle tail** · Accepted/merged at `4d807495`; exact-main verified · [packet](tasks/ck-07r1a-correct-hosted-lifecycle-tail.md) -- [x] **CK-07R1A0 — Freeze lifecycle planner/recovery path authority** · Completed on merge; exact-main verified at `519b503a`; linked source-digest correction pending its own merge/exact-main verification · [packet](tasks/ck-07r1a0-freeze-lifecycle-path-authority.md) -- [ ] **CK-07R1 — Correct lifecycle preparation scale** · Conditional Ready only after the source-digest authority merge/exact-main; revalidate the retained candidate on exact merged main; planner-valid receipt is a successor acceptance output and PR #394 is stale read-only · [packet](tasks/ck-07r1-correct-lifecycle-preparation-scale.md) +- [x] **CK-07R1A0 — Freeze lifecycle planner/recovery path authority** · Completed on merge; exact-main verified at `519b503a`; linked source-digest and run-invocation authorities require their own merge/exact-main verification · [packet](tasks/ck-07r1a0-freeze-lifecycle-path-authority.md) +- [ ] **CK-07R1 — Correct lifecycle preparation scale** · Blocked pending source-digest and run-invocation authority merges/exact-main verification; revalidate the retained candidate only on exact merged main; planner-valid receipt is a successor acceptance output and PR #394 is stale read-only · [packet](tasks/ck-07r1-correct-lifecycle-preparation-scale.md) - [ ] **CK-QG1A — Correct page-executor complexity** · Conditional Ready after CK-QG1A0 exact-main · [packet](tasks/ck-qg1a-correct-page-executor-complexity.md) - [ ] **CK-QG1 — Enforce replacement-kernel maintainability** · Blocked on CK-QG1A and refresh of existing PR #392 on corrected main · [packet](tasks/ck-qg1-enforce-agent-kernel-maintainability.md) - [ ] **CK-08R4 — Reclassify physical named plans** · Blocked on CK-08R1/R2/R3 and CK-07R1 · [packet](tasks/ck-08r4-reclassify-physical-plans.md) diff --git a/docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md b/docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md index b687c97f..161a53e4 100644 --- a/docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md +++ b/docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md @@ -1,6 +1,6 @@ # CK-07R1 — Correct lifecycle preparation scale -**Status:** Conditional Ready after the source-digest authority merges and exact-main verifies; worker pre-run gates remain required +**Status:** Blocked pending the source-digest and run-invocation authorities merging and exact-main verification; worker pre-run gates remain required **Parent:** Corrective prerequisite for CK-09 @@ -24,7 +24,8 @@ contracts. **Dependencies:** CK-07R1A accepted, merged, and exact-main verified at `4d8074952f679877f2b4fbb3e89c51015e96a197`; CK-07R1A0 path authority accepted at exact main `519b503aa3b23019033b6481687c08b23fc6c31e`; and the linked -source-digest authority accepted, merged, and exact-main verified. The worker +source-digest and the run-invocation authority accepted, merged, and exact-main +verified. The worker must then start from that exact merged main and reapply the retained candidate, revalidating predecessor and successor digests before any end-to-end run. PR #394 head `98a9b5b82951d136644a5fe5f8a70d320131ba08` is a stale failed read-only @@ -59,8 +60,9 @@ standard/production fixtures, five unprofiled samples, 30-day/all-time gates, `just v/vc`. **Acceptance:** Work is linear in observations plus prior transitions and all -publication-valid scale gates pass through the CK-07R1A0 reachable path. The -existing worker must revalidate the exact predecessor-to-successor digest +publication-valid scale gates pass through the CK-07R1A0 reachable path and +the frozen CK-07R1A0 run-invocation contract. The existing worker must +revalidate the exact predecessor-to-successor digest transition, bind every frozen path and prior identity, produce the planner-valid receipt, and consume at most one new end-to-end run. Receipt absence before dispatch is not a blocker; receipt absence or invalidity at diff --git a/docs/roadmap/tasks/ck-07r1a0-freeze-lifecycle-path-authority.md b/docs/roadmap/tasks/ck-07r1a0-freeze-lifecycle-path-authority.md index 6d7181f3..3bc398d4 100644 --- a/docs/roadmap/tasks/ck-07r1a0-freeze-lifecycle-path-authority.md +++ b/docs/roadmap/tasks/ck-07r1a0-freeze-lifecycle-path-authority.md @@ -1,6 +1,6 @@ # CK-07R1A0 — Freeze lifecycle planner/recovery path authority -**Status:** Completed on merge; exact-main verified at `519b503aa3b23019033b6481687c08b23fc6c31e`; linked source-digest correction is pending merge and exact-main verification, so the existing CK-07R1 worker remains held +**Status:** Completed on merge; exact-main verified at `519b503aa3b23019033b6481687c08b23fc6c31e`; linked source-digest and run-invocation authorities are pending merge and exact-main verification, so the existing CK-07R1 worker remains held **Release-candidate package ceilings:** sdist remains at most 2,000,000 bytes and wheel remains at most 1,000,000 bytes. The historical 828000/383000 @@ -35,6 +35,9 @@ contract is with its schema. The linked [source-digest authority](../../decisions/evidence/ck07r1a0/lifecycle-source-digest-authority.json) and its schema freeze the exact predecessor/successor transition. The retained CK-07R1 implementation/profile/evidence diff is read-only evidence. +The linked run-invocation authority is +`docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json`; +it adds no runtime implementation and keeps the retained candidate blocked. **Produces:** A frozen entry-path contract, APPEND_SAFE_SMALL selection rule, independent lifecycle oracle/postconditions, exact source/diff identity, @@ -69,9 +72,9 @@ predecessor digest is `408d18e44c87da234d220c29298ebac1780e9426e2dce767b0bfc3ae65e8a872` and the permitted-not-accepted retained successor digest is `d192c858b48e44b5aa7a7e39ef524e5ec2f08085655fe485639f5e875a727aa1`; generic -or different digest drift fails closed; CK-07R1 becomes Conditional Ready only -after this source-digest authority is accepted, merged, and exact-main -verified; the five budgets remain `5000/120000/100/500/500` ms; every prior +or different digest drift fails closed; CK-07R1 remains blocked until the +source-digest and run-invocation authorities are accepted, merged, and +exact-main verified; the five budgets remain `5000/120000/100/500/500` ms; every prior attempt and its identity/timestamp/failure remains visible; receipt `935e4427b93e67c5ca649b773b0b3895dafac87f49bc76d7ed8917dff2f0250d` remains writer-only evidence and is never reused or upgraded. @@ -83,9 +86,9 @@ rules; one final read-only review; hosted CI; squash merge; attached exact-main verification. **Acceptance:** The authority artifact validates, exact identities and run -accounting are preserved, only the two retained CK-07R1 scope additions are +accounting are preserved, only the retained CK-07R1 authority additions are bound, the stale failed PR #394 is explicitly superseded read-only, and CK-07R1 -becomes Conditional Ready only after this authority's merge and exact-main +remains blocked until the linked authorities merge and exact-main verification. The planner-valid receipt is a future successor acceptance output, not a pre-dispatch dependency. This packet does not run or authorize a production qualification run by itself. @@ -100,7 +103,7 @@ from a manually forced plan. **Handoff:** Coordinator `019fbeb3-00d5-7f22-ba65-ae4672838140` and parent `019fbea6-66b5-71e0-b85a-b6654fd414c5` receive the merged SHA, source-digest -authority path, exact candidate source/diff identity, preserved +and run-invocation authority paths, exact candidate source/diff identity, preserved attempts/digests, validation/reviewer/CI/exact-main results, and unchanged downstream gates. diff --git a/scripts/check_kernel_scope.py b/scripts/check_kernel_scope.py index 09d28490..acf9041d 100644 --- a/scripts/check_kernel_scope.py +++ b/scripts/check_kernel_scope.py @@ -760,6 +760,14 @@ } ) +CK07R1_RUN_INVOCATION_AUTHORITY_ADDITIONS = frozenset( + { + "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json", + "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json", + "tests/kernel/test_lifecycle_run_invocation_authority.py", + } +) + CK08_PREREQUISITE_BLOCKER_ADDITIONS = frozenset( { "docs/decisions/evidence/ck08/fact-backed-oracle-prerequisite-gap.json", @@ -820,6 +828,7 @@ | PACKAGE_BUDGET_POLICY_ADDITIONS | CK07R1A0_AUTHORITY_ADDITIONS | CK07R1_LIFECYCLE_SCOPE_ADDITIONS + | CK07R1_RUN_INVOCATION_AUTHORITY_ADDITIONS | CK08_PREREQUISITE_BLOCKER_ADDITIONS | CI_PERFORMANCE_QUALIFICATION_ADDITIONS ) diff --git a/tests/kernel/test_documentation_authority.py b/tests/kernel/test_documentation_authority.py index 1f932912..44111019 100644 --- a/tests/kernel/test_documentation_authority.py +++ b/tests/kernel/test_documentation_authority.py @@ -176,7 +176,8 @@ def test_remaining_execution_plan_is_complete_acyclic_and_fail_closed() -> None: manifest = json.loads(manifest_match.group(1)) assert manifest["schema"] == "codex-usage-tracker.remaining-delegation-dag.v1" assert manifest["orchestration"]["spawn"] == "all_newly_ready_successors" - conditional_ready = {"CK-08R1A", "CK-08R3A", "CK-QG1A", "CK-07R1"} + conditional_ready = {"CK-08R1A", "CK-08R3A", "CK-QG1A"} + blocked = {"CK-07R1"} assert manifest["completed"] == [ "CK-08R0", "CK-08R2", @@ -197,18 +198,12 @@ def test_remaining_execution_plan_is_complete_acyclic_and_fail_closed() -> None: "condition": "CK-QG1A0 merged and exact-main verified", "tasks": ["CK-QG1A"], }, - { - "condition": ( - "CK-07R1/CK-07R1A0 source-digest authority accepted, merged, and " - "exact-main verified; worker pre-run gates remain required" - ), - "tasks": ["CK-07R1"], - }, ] + assert manifest["blocked"] == ["CK-07R1"] assert "Completed packets: **14 / 22**" in ledger assert "Not started: **8**" in ledger assert "Critical-path completion: **14 / 21**" in ledger - assert "Blocked child tasks: **41**" in ledger + assert "Blocked child tasks: **42" in ledger assert f"Ready child tasks: **{len(manifest['ready'])}" in ledger assert ( f"Conditional-ready child tasks: **{sum(len(item['tasks']) for item in manifest['conditional_ready'])}" @@ -301,6 +296,8 @@ def test_remaining_execution_plan_is_complete_acyclic_and_fail_closed() -> None: assert "**Status:** Conditional Ready after" in body elif packet_id in ready: assert "**Status:** Ready" in body + elif packet_id in blocked: + assert "**Status:** Blocked" in body elif packet_id in {"CK-08R0", "CK-08R2", "CK-QG1A0", "CK-07R1A", "CK-07R1A0"}: assert "**Status:** Completed on merge" in body else: @@ -522,8 +519,8 @@ def test_corrective_seam_packet_is_critical_path_authority() -> None: "fold_lifecycle", "935e4427b93e67c5ca649b773b0b3895dafac87f49bc76d7ed8917dff2f0250d", "one-run authorization condition", - "CK-07R1 becomes", - "Conditional Ready", + "CK-07R1 remains blocked", + "run-invocation authority", "The planner-valid receipt is a future successor acceptance", "stale failed PR #394 is explicitly superseded read-only", ), @@ -534,10 +531,7 @@ def test_corrective_seam_packet_is_critical_path_authority() -> None: assert "strict Authority v2" in ck07r1a0 assert "supersedes earlier CK-07R1 wording" in central assert "Blocked on CK-QG1A" in ckqg1 - assert ( - "Conditional Ready after the source-digest authority merges and exact-main verifies" - in ck07r1 - ) + assert "Blocked pending the source-digest and run-invocation authorities" in ck07r1 def test_ck07r1a0_authority_is_strict_and_preserves_attempt_identity() -> None: diff --git a/tests/kernel/test_kernel_scope.py b/tests/kernel/test_kernel_scope.py index 76d9bc55..51caf213 100644 --- a/tests/kernel/test_kernel_scope.py +++ b/tests/kernel/test_kernel_scope.py @@ -19,6 +19,7 @@ CK07D_EFFECTIVE_DATED_VALUATION_ADDITIONS, CK07E_INDEPENDENT_FACT_ADAPTER_ADDITIONS, CK07R1_LIFECYCLE_SCOPE_ADDITIONS, + CK07R1_RUN_INVOCATION_AUTHORITY_ADDITIONS, CK07R1A0_AUTHORITY_ADDITIONS, CK08_PREREQUISITE_BLOCKER_ADDITIONS, CK08_QUERY_EVIDENCE_ADDITIONS, @@ -675,6 +676,7 @@ def test_k6_additions_are_explicit_and_bounded() -> None: | PACKAGE_BUDGET_POLICY_ADDITIONS | CK07R1A0_AUTHORITY_ADDITIONS | CK07R1_LIFECYCLE_SCOPE_ADDITIONS + | CK07R1_RUN_INVOCATION_AUTHORITY_ADDITIONS | CK08_PREREQUISITE_BLOCKER_ADDITIONS | CI_PERFORMANCE_QUALIFICATION_ADDITIONS ) diff --git a/tests/kernel/test_lifecycle_run_invocation_authority.py b/tests/kernel/test_lifecycle_run_invocation_authority.py new file mode 100644 index 00000000..e0beff35 --- /dev/null +++ b/tests/kernel/test_lifecycle_run_invocation_authority.py @@ -0,0 +1,272 @@ +from __future__ import annotations + +import copy +import hashlib +import json +from pathlib import Path +from typing import Any + +import pytest +from jsonschema import Draft202012Validator + +from scripts.check_kernel_scope import CK07R1_RUN_INVOCATION_AUTHORITY_ADDITIONS + + +_ROOT = Path(__file__).resolve().parents[2] +_AUTHORITY_PATH = _ROOT / "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json" +_SCHEMA_PATH = _ROOT / "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json" + + +def _authority() -> dict[str, Any]: + return json.loads(_AUTHORITY_PATH.read_text(encoding="utf-8")) + + +def _schema() -> dict[str, Any]: + return json.loads(_SCHEMA_PATH.read_text(encoding="utf-8")) + + +def _errors(value: dict[str, Any]) -> list[Any]: + return list(Draft202012Validator(_schema()).iter_errors(value)) + + +def _set_path(value: dict[str, Any], path: tuple[str | int, ...], replacement: Any) -> None: + target: Any = value + for component in path[:-1]: + target = target[component] + target[path[-1]] = replacement + + +def test_run_invocation_authority_validates_and_is_strict() -> None: + schema = _schema() + Draft202012Validator.check_schema(schema) + Draft202012Validator(schema).validate(_authority()) + assert schema["additionalProperties"] is False + + +def test_command_cwd_interpreter_environment_and_output_are_exact() -> None: + launch = _authority()["launch_contract"] + assert launch["repository_relative_command"] == [ + ".venv/bin/python", + "scripts/benchmark_ck07r1_lifecycle_scale.py", + "--profile", + "all", + "--samples", + "5", + "--output", + "output/ck07r1/lifecycle-requalification-v1.json", + ] + assert launch["required_cwd"] == "repository_root" + assert launch["interpreter"]["executable"] == ".venv/bin/python" + assert launch["interpreter"]["system_fallback"] is False + assert launch["environment"]["required"] == { + "LC_ALL": "C.UTF-8", + "PYTHONHASHSEED": "0", + "PYTHONUNBUFFERED": "1", + "TZ": "UTC", + } + assert launch["output"]["relative_path"] == "output/ck07r1/lifecycle-requalification-v1.json" + assert "must not exist" in launch["output"]["prelaunch_rule"] + assert "fail closed" in launch["output"]["overwrite_rule"] + + +def test_fixture_identity_vocabulary_and_static_file_shas_are_distinct_and_proven() -> None: + identity = _authority()["launch_contract"]["fixture_identity"] + assert set(identity["vocabulary"]) == { + "fixture_manifest_digest", + "fixture_file_sha256", + "workload_transition_digest", + } + assert identity["manifest"]["fixture_manifest_digest"] != identity["manifest"]["fixture_file_sha256"] + for item in identity["fixture_files"]: + path = _ROOT / item["path"] + assert path.is_file() + assert hashlib.sha256(path.read_bytes()).hexdigest() == item["fixture_file_sha256"] + dynamic = identity["dynamic_digest"] + assert dynamic["supplied_before_launch"] is False + assert dynamic["field"] == "workload_transition_digest" + assert dynamic["mismatch"] == "fail_closed" + + +def test_profiles_samples_counts_seed_and_tail_limits_are_frozen() -> None: + contract = _authority()["launch_contract"] + assert contract["profiles"]["sample_count"] == 5 + assert contract["profiles"]["warmup_count"] == 0 + assert contract["profiles"]["profiled"] is False + assert contract["profiles"]["seed"] == 20260728 + assert contract["profiles"]["workloads"] == [ + { + "name": "standard_30_day", + "source_profile": "standard", + "history_preset": "30_days", + "model_calls": 2740, + "entities": 685, + "observations": 1369, + "seed": 20260728, + "profile_file_sha256": "ef0da880255a0b13ea6055e0f8d748870c075635aa6f199c9521462c681250f3", + }, + { + "name": "production_all_time", + "source_profile": "production", + "history_preset": "all_time", + "model_calls": 1316864, + "entities": 329216, + "observations": 658431, + "seed": 20260728, + "profile_file_sha256": "2de0b4dc198603da6c1b0905b8d934e2cd5604e4036ef009d0cd07f1cc81f51b", + }, + { + "name": "no_change", + "source_profile": "synthetic_tail", + "history_preset": "all_time", + "model_calls": 0, + "entities": 0, + "observations": 0, + "seed": 20260728, + "profile_file_sha256": None, + }, + { + "name": "one_call_tail", + "source_profile": "synthetic_tail", + "history_preset": "all_time", + "model_calls": 0, + "entities": 1, + "observations": 1, + "seed": 20260728, + "profile_file_sha256": None, + }, + { + "name": "one_tool_tail", + "source_profile": "synthetic_tail", + "history_preset": "all_time", + "model_calls": 0, + "entities": 1, + "observations": 1, + "seed": 20260728, + "profile_file_sha256": None, + }, + ] + assert contract["tail_limits"]["values"] == { + "selected_bytes": 8388608, + "selected_records": 32, + "observations": 12000, + "occurrences": 12000, + "affected_sessions": 2000, + "affected_turns": 4000, + "affected_resources": 4000, + "affected_allowance_cycles": 512, + "dirty_keys": 16000, + "projection_rows": 16000, + "expected_wal_bytes": 16777216, + "planning_staleness_us": 5000000, + "model_call_tail_rows": 32000, + } + +def test_reachable_path_and_plan_identity_are_explicit() -> None: + path = _authority()["launch_contract"]["reachable_path"] + assert path["ordered_steps"] == [ + "select_readable_artifact(pointer_path, validate_open=...)", + "recover_startup(pointer_path, selection=..., store=..., ...)", + "plan_refresh(changes, intent, limits=TailLimits(), dirty_keys=0, projection_rows=0, expected_wal_bytes=None)", + "selected_plan_unchanged", + "PublicationWriter.publish_with_pointer(plan, request, write_set, pointer_path=..., operational_store=..., pointer_request=..., validate_open=...)", + "publish_small_with_pointer(..., commit_analytical=...)", + "PublicationWriter.publish(plan, request, write_set)", + ] + assert path["unchanged_plan"]["identity"].startswith("the exact object") + assert len(path["identity_binding"]) == 6 + assert path["failure"].startswith("any path") + + +def test_process_exclusion_launch_token_and_evidence_capture_are_required() -> None: + authority = _authority() + prelaunch = authority["launch_gates"]["prelaunch"] + assert any("no matching process" in item for item in prelaunch["required"]) + assert prelaunch["token"] == "not consumed" + launch = authority["launch_gates"]["successful_process_launch"] + assert launch["record"] == [ + "pid", + "parent_pid", + "launched_at_utc", + "launched_monotonic_ns", + "argv", + "cwd", + "interpreter", + "run_token_id", + ] + runtime = authority["launch_gates"]["runtime_and_completion"]["record"] + assert any("RSS" in item for item in runtime) + assert any("disk" in item for item in runtime) + assert any("evidence" in item or "SHA-256" in item for item in runtime) + assert authority["run_token"] == { + "maximum_new_end_to_end_runs": 1, + "status": "unspent_unavailable", + "consumption": "successful_process_launch_only", + "refund": False, + "prior_identities_reused": False, + "concurrent_processes_allowed": False, + } + + +def test_no_retry_semantics_and_candidate_blocker_are_explicit() -> None: + authority = _authority() + after_launch = authority["failure_matrix"]["after_launch"] + assert after_launch["no_retry"] is True + assert after_launch["no_restart"] is True + assert after_launch["no_replacement"] is True + assert after_launch["token_remains_consumed"] is True + assert {"interruption", "timeout", "incomplete receipt", "budget miss", "postcondition failure"} <= set( + after_launch["failures"] + ) + feasibility = authority["feasibility"] + assert feasibility["candidate_status"] == "cannot_support_one_explicit_launch_without_behavioral_implementation" + assert "prelaunch process exclusion" in feasibility["exact_blocker"] + assert feasibility["run_action"].startswith("do not execute") + + +@pytest.mark.parametrize( + ("label", "path", "replacement"), + [ + ("command", ("launch_contract", "repository_relative_command", 1), "wrong.py"), + ("cwd", ("launch_contract", "required_cwd"), "scripts"), + ("fixture-vocabulary", ("launch_contract", "fixture_identity", "vocabulary", "fixture_file_sha256"), "manifest"), + ("fixture-digest-binding", ("launch_contract", "fixture_identity", "manifest", "fixture_file_sha256"), "0" * 64), + ("output-overwrite", ("launch_contract", "output", "overwrite_rule"), "overwrite"), + ("process-exclusion", ("launch_gates", "prelaunch", "required", 2), "process check omitted"), + ("run-token-timing", ("run_token", "consumption"), "before launch"), + ("no-retry", ("failure_matrix", "after_launch", "no_retry"), False), + ("tail-limit", ("launch_contract", "tail_limits", "values", "observations"), 12001), + ("count", ("launch_contract", "profiles", "workloads", 0, "observations"), 1370), + ("seed", ("launch_contract", "profiles", "seed"), 42), + ("reachable-path", ("launch_contract", "reachable_path", "ordered_steps", 2), "direct writer"), + ("generic-drift", ("preserved_history", "source_predecessor_sha256"), "0" * 64), + ], +) +def test_negative_contract_mutations_fail_closed( + label: str, path: tuple[str | int, ...], replacement: Any +) -> None: + mutated = copy.deepcopy(_authority()) + _set_path(mutated, path, replacement) + assert _errors(mutated), label + + +def test_dag_ledger_index_and_scope_bind_the_authority_without_new_task() -> None: + authority = _authority() + index = (_ROOT / "docs/INDEX.md").read_text(encoding="utf-8") + central = (_ROOT / "docs/roadmap/REMAINING_EXECUTION_PLAN.md").read_text(encoding="utf-8") + ledger = (_ROOT / "docs/roadmap/TASK_PACKETS.md").read_text(encoding="utf-8") + packet = (_ROOT / "docs/roadmap/tasks/ck-07r1a0-freeze-lifecycle-path-authority.md").read_text(encoding="utf-8") + ck07r1 = (_ROOT / "docs/roadmap/tasks/ck-07r1-correct-lifecycle-preparation-scale.md").read_text(encoding="utf-8") + artifact = "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json" + assert artifact in index + assert artifact in packet + assert "run-invocation authority" in ck07r1 + assert "run-invocation authority" in central + assert "run-invocation authority" in ledger + assert "CK-07R1" in central and "CK-07R1" in ledger + assert authority["scope"]["authority_only_files"] + assert "scripts/benchmark_ck07r1_lifecycle_scale.py" in authority["scope"]["forbidden"] + assert CK07R1_RUN_INVOCATION_AUTHORITY_ADDITIONS == { + "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json", + "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json", + "tests/kernel/test_lifecycle_run_invocation_authority.py", + } From 78b378f307e70f28165f60867ee5ef64b27c8631 Mon Sep 17 00:00:00 2001 From: Monsky Date: Sat, 1 Aug 2026 23:32:01 -0400 Subject: [PATCH 2/2] style: order lifecycle authority test imports --- tests/kernel/test_lifecycle_run_invocation_authority.py | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/kernel/test_lifecycle_run_invocation_authority.py b/tests/kernel/test_lifecycle_run_invocation_authority.py index e0beff35..92869d9e 100644 --- a/tests/kernel/test_lifecycle_run_invocation_authority.py +++ b/tests/kernel/test_lifecycle_run_invocation_authority.py @@ -11,7 +11,6 @@ from scripts.check_kernel_scope import CK07R1_RUN_INVOCATION_AUTHORITY_ADDITIONS - _ROOT = Path(__file__).resolve().parents[2] _AUTHORITY_PATH = _ROOT / "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.json" _SCHEMA_PATH = _ROOT / "docs/decisions/evidence/ck07r1a0/lifecycle-run-invocation-authority.schema.json"