(cherry picked from commit 4411186681584bf55e065c654fe909a3320d4a22)
Reconcile-conflict: test_skill_transplant_prep artifact count — kept HEAD's finalized 0 refs (2026-11-02 user sign-off deleting §4's 6 references, already in target) with incoming's l→line rename; incoming's 6-ref assertion is pre-finalization and must not overwrite.
(cherry picked from commit 908df30d1a3cf328ea05344f0660af9b77bf24a1)
Reconcile-port: handler_support.py kept at HEAD (189 lines; A13 domain comments describe source's 1616-line handler_support layout, which does not exist here — functions live in server.py). test_longfunc_inventory.py kept as-is for now; it pins source architecture and will be re-pinned for the unified line in a final commit (recorded).
- peer_messages.row_get gains default=None (was None-only); the
three old variants agree on all real row types (None / dict /
sqlite3.Row): auto_memory's old default was already None, and
lifecycle's old None special-case and dict .get give identical
results on those types, so no call-site behavior changes and no
call site passes a non-None default.
- auto_memory and lifecycle delete their private _row_get copies
and import peer_messages.row_get as _row_get (precedent: server,
worker, handler_project, handler_support already do this);
peer_messages imports no cloud modules, so no import cycle.
lifecycle's old broad-Exception catch differs only for pathological
__getitem__ inputs, which are not DB rows and are out of contract;
this is documented on row_get, not left as a second story.
- Scope note: other modules' own row_get copies (approvals,
automations, marker_tools, todos, wait_ops) are out of this item's
stated scope and are untouched.
- Also drops auto_memory's unused 'import os' (pre-existing F401),
so touched files are ruff E,F clean.
- Tests: cloud/tests/test_row_get_unified.py locks the identity
(both aliases ARE row_get), the real-row-type matrix, the
None-default fallback, and snapshot_to_dict via the unified path.
(cherry picked from commit 1644a0b837bfefb13cdc3c93d87fc1b246026607)
- New production caller cloud/worker_sweep.py (python -m
cloud.worker_sweep): AuthStore.authenticate + CODEX_GLOBAL_ADMINS
global-admin check (same fail-closed semantics as
handler_admin._is_global_admin) before any reap call; denied
authenticated non-admins get an admin_worker_sweep_denied audit
row; authorized runs reuse reap_stale_workers (classify, re-verify,
pre-kill audit fail-closed, per-pid SIGKILL only, post-kill
verification) plus an admin_worker_sweep summary audit; --dry-run
lists classifications only.
- No new HTTP route, no container enumeration, no name/prefix
matching, no workers-row deletion; workers.py docstring only notes
the new caller.
- Tests: cloud/tests/test_worker_sweep_admin.py, 6 cases (bad key,
non-admin, unconfigured admin list fail-closed, authorized full
chain, dry-run, CLI main authorized/refused).
(cherry picked from commit c7d217549c5ccedf61dcc924b8998fffeddc76c6)
process_audit_verdict now calls validate_signer_separation
before any state save or ledger write (previously the function
had no production caller on this path: it only ran inside
collect_failed_checks via decide_pushback, which itself has no
production caller). Signer is bound to the authenticated
caller -- a body signer differing from the caller is rejected
-- and executor/coordinator_approver/qa_tester must be
declared and distinct from the caller; missing field,
self-audit, or forged signer raises ValueError, mapped by
_loop_run to HTTP 400 with no side effects. No new route.
Honest limits are in the helper docstring: declared-identity
enforcement only (task rows store no authoritative executor /
coordinator / QA identity; task executor is a backend, not a
person), and audit-fix reaudit verdicts are out of scope
(the fix poster is not necessarily the re-auditor, so binding
signer to the fix poster would be a mis-binding).
(cherry picked from commit 56dce5165f4d08f38fe1730b9eea3b78f90cb97d)
Reconcile-port: handler_lifecycle.py docstring hunk redirected into cloud/server.py audit-verdict handler (target keeps 6-mixin split; enforcement itself is in audit_loop_wiring.py and applied cleanly).
Pre-fix any first-attempt audit failure raised NameError at
auth.py:424 (sqlite3 never imported), aborting the 5-attempt
retry loop on attempt 1 and masking the original error. The
424-line coverage mystery is also explained: the only full-suite
hit is test_child_model.test_coordinator_inherits_child_defaults
via worker best-effort _audit swallowing an OperationalError
(database is locked); 422-423/426-427 stay uncovered because
rollback succeeds and NameError aborts before either raise.
Bubble audit (see report): no merge/release gate swallows the
NameError and proceeds, so this stays a downgrade, not a
production blocker.
(cherry picked from commit 039c6adbac3b120b5b9a1dcbafeff6a91407ce70)
Postgres audit_ledger append-only guard gains exactly one
execution entry: cloud/ledger_pg_guard.apply_pg_guard, runnable
as 'python3 -m cloud.ledger_pg_guard' (explicit ops command,
not a migration script). It executes PG_GUARD_SQL verbatim from
the constant -- no second copy of the SQL anywhere -- refuses
non-PgConnection targets, does not commit itself (caller/CLI
commits), and refuses with exit 2 on a non-postgres backend so
a no-PG environment can never claim hardening. ensure_schema
still skips PG triggers; POSTGRES_SCHEMA still builds only the
table. Tests lock all of this with a recording fake connection
(no PG execution is faked), a source scan asserting only
ledger.py and ledger_pg_guard.py reference the constant, and
CLI dry-run/refusal cases. Real-PG syntax and UPDATE/DELETE
blocking verification is explicitly left to B5, not claimed here.
(cherry picked from commit b1f6c9158d628186965a9e57576ff8c9500e3f73)
Server POST /tasks/{id}/merge no longer has record/enforce/off:
hard_mode_from_env and HARD_MODES deleted (not re-defaulted),
handler always evaluates the hard gate, env CLOUD_MERGE_GATE_MODE
and body merge_gate_mode are ignored server-side. The record
'no-evidence passes' and 'unprotected+confirm passes with
merge_gate_risk' server paths are gone with the dead risk audit;
no production caller justified keeping them (only production
caller of the non-hard evaluator was the merge handler itself;
audit_loop_wiring already used the hard gate). cloud/merge_gate
pure functions keep their #209 semantics but are documented as
non-server: they are no longer wired to any endpoint.
Server-level record/enforce/off tests rewritten to the new
behavior (renamed, not deleted silently); pure-function tests
unchanged.
(cherry picked from commit 08e75edbd6d04701965c5db951fa054cfbb75bb0)
Reconcile-port: handler_lifecycle.py hunks redirected into cloud/server.py _merge_task (target keeps 6-mixin split; mixin file does not exist here); handler_support.py kept at HEAD (its A1 hunk is a docstring of _validate_hard_gate_body, ported to server.py copy); test mock paths cloud.handler_lifecycle.* rewritten to cloud.server.*.
- restore _audit_row in cloud/automations.py as a thin wrapper over
cloud.auth.audit_on_conn (legacy row + ledger entry pair,
user_id system, best-effort self-commit preserved). The stack's
gap-4 option A deleted the direct writer; main #275 resident.py
imports _audit_row, so the bare rebase broke server import.
No direct audit_log INSERT is reintroduced, so the #250
no-bypass scan stays green.
- conformance accounting 238/144 -> 243/149: main #275 added 5
resident methods that legitimately stay in server.py; moved
count stays 94, no duplicates.
- directional: resident x3, audit chain, conformance, automations
x3 suites, 51 tests OK
- whitelist expansion (tr + exit builtin) confirmed, comment only
- B4 viewport wording: temp banner removed, wording untouched,
change-list table stays in draft, not merged into body
- B3-tail (a)/(b): no content change (bullet still absent), recorded
as decided; v2 record showed it unselected, no side picked here
- section 4: 6 templates/artifacts/ refs deleted per signed verdict;
tripwire test updated 6 -> 0 to pin the new inventory
- CHANGELOG pointer line kept, no marker present
- workers audit landing migration confirmed, comment only
- verify-script gate evidence confirmed, gate hard untouched
- 2 temp stances NOT touched: actual-only quota, evidence binding
not enforced / no anti-restamp
- behavior code unchanged; directional skill tests 39/39 OK
- cloud/evidence_binding.py: bind/validate/nonce single-use store;
release endpoint consumes nonce on first validated submission,
replay -> 409 evidence_replayed, stale/future -> 409
evidence_stale, partial -> 400, absent -> old path + label.
Binding blocks exact replay and stale evidence, NOT restamping
(unsigned evidence cannot prove content freshness).
- cloud/quota.py docstring: actual-only is the v2 integration
position (already converged in v1 base via fef09ae, NOT in
main); original PR semantics (#86 all-rows vs #90 actual-only)
still pending coordinator confirmation at merge time.
- cloud/ledger_onboarding.py: DDL checklist referencing
PG_DDL/PG_MARKER_DDL constants, read-only verify_ledger_ready
and ledger_setup_report; default stays OFF, PG DDL stays an
operator action (never claimed as executed).
- cloud/ledger_outbox.py + worker hook: ledger write failures
go to a JSONL outbox in addition to the log and can be
replayed; task outcome still unaffected (rule 7 kept),
audit fail-closed untouched -- asymmetry documented, not
silently changed.
- cloud/gate_verification.py: read-only verifier over an
injected reader (match/mismatch/skipped); live wiring in
merge/release is NOT possible on the current contract (no
repo/ref in body or task row, no guaranteed trusted token),
proven in the module header; no fake verification claimed.
- cloud/tests/test_v2_evidence.py: 18 new tests, all passing.
(cherry picked from commit bd85e33cd5e846fa6ee5d7e2440182dbd9c758b0)
- db: translate INSERT OR IGNORE ... SELECT to ON CONFLICT DO NOTHING;
register task_audit_loop_state (task_id) in _OR_REPLACE_PK (direct port).
- server: _backfill_default_quotas uses SAVEPOINT containment, no longer
commits the caller's transaction (direct port; callers are init_db only).
- worker: NOT ported — integration _coord_child_rows has no column-fallback
retry loop, so the InFailedSqlTransaction cascade site does not exist here.
- tests: rewritten for the integration base (no cloud.audit_loop /
_coord_audit_loop_merge here); real-PG cases skip without DSN/driver.
(cherry picked from commit 79e6843610fcd275af874e7b4afc57af7ffa579e)
Preparation only: no v0.3/v0.4/v0.5 text is changed, nothing is
claimed transplanted or deployed. Stacked on feat-audit-pushback
(#244, 39966bd).
- Appendix provenance 00..09: templates/roles/00-08 sources
(byte-identical to #217) plus 09-auditor extracted from #244's
appendix; check_appendix.py extended 00..08 -> 00..09.
SKILL.md sole change (1 line, format-only): 09 chapter heading
normalised to the strict source form, otherwise the #217
checker cannot recognise the chapter. check_appendix.py passes
on the real pack: 10 chapters match; --emit outputs 10 chapters.
- TRANSPLANT-PREP-244.md: per-paragraph transplant diffs for
#244's +459 lines into v0.3/v0.4/v0.5 with anchors, grades
(merge / merge+note / partial stop / full stop), chapter-number
mapping (v0.5: 11-auditor, colliding 09-ops noted), the
templates/artifacts delete-references decision with 6 sites and
replacements, and the draft-sync checklist (sync itself is
post-deployment only, not done here).
- tools/check_transplant.py: anchors / draft-apply /
check-transplanted modes; draft-apply on the real v0.3/v0.4/v0.5
texts passes check-transplanted (drafts in /tmp only, not
committed). Stopped paragraphs are listed, never silently
rewritten: v0.3 G7/full-auto sentences, v0.4 G7 sentences and
the tighten-3 pre-rebuild confirmation, v0.5 whole QA section
plus its checklist item and the confirmation paragraph.
- Tests: test_skill_appendix_provenance.py (00..09) and
test_skill_transplant_prep.py; 13 new tests pass.
Suites on this tree: cloud 1523 OK (skipped=4), top-level 105
OK, deploy 39 OK.
- cloud/attempt_hook.py (new): canonical policy -- one counted
dispatch = one row, is_defect always False from the worker;
human/first rounds and human breakpoint resumes count;
platform auto-resume reruns, coordinator fan-out, and
pre-execution gate failures do not; transient retries inside
one dispatch are not new attempts. Platform origin survives
via the task_attempt_origin_markers table (same-transaction
write on requeue, queued_at generation guard on consume).
Defects are explicit-recorder only; corrections are
append-only (record_correction, last-wins).
- cloud/worker.py: Worker(attempt_ledger_hook=False) + CLI
--attempt-ledger-hook (default OFF = gap-3 behaviour exactly);
marker write in auto_resume_interrupted, marker consume +
classify in run_one, one ledger write at each terminal point
(cancel branch, normal terminal block); all hook writes
best-effort, never fail the task or block a requeue.
- cloud/attempt_ledger.py: corrects_attempt_no column (new DDL
supersedes gap 3's pre-merge DDL) + record_correction +
correction-aware aggregation; read path uses SELECT * so
gap-3-era tables still read; cost code untouched.
- cloud/tests/test_attempt_hook.py: 32 tests (policy, markers,
corrections, worker integration, mixed endpoint).
- docs/arch-conformance-metrics.md: policy, switch, PG manual
steps (new PG_DDL + PG_MARKER_DDL), remaining user decisions.
- cloud/audit_scorecard.py: pure stdlib scorer, structured evidence in,
7 dimension scores (0-10, 1 decimal), basis, missing/untested items,
overall pass only when all 7 >= 9; unknown -> None, never 0/10/estimated;
fixture/viewport/code-review evidence -> untested, never pass;
thresholds all test_default_unapproved, user_approved only on explicit input.
- server.py: GET /audit-scorecard read-only, same auth/member scope as
/metrics, no DB writes, no ledger writes, no pushback/reaudit triggers;
on main base it honestly reports unknown/not-enforced, overall not_pass.
- docs/audit-scorecard.md: spec, formulas, threshold table, unknown
handling, overall rule, 10-to-7 merge mapping, relations to
#238 metrics-report, #244 sampling, #260/#261 loop, and a system-computed
example (current state, overall not_pass) clearly separated from the
previous judgement estimates.
- tests: 12 new items pin all-pass, one-below-nine fails, average 9.1
with one 4 still fails, unknown None, fixture untested, conditional
not a pass, thresholds unapproved, endpoint 401/200 read-only.
- suites: cloud 1442 OK (skipped 4), top-level 105 OK, deploy 39 OK.
Server-side execution for the track-1 pure driver (#260), no driver
semantics changed: audit verdict / fix completion / correction /
rebuild confirmation endpoints persist LoopState in audit_loop_state,
write every step through the #241/#247 ledger path (ledger first,
state second, fail-closed), derive fix/rebuild subtasks, and block
merge/release via the existing #247 chain reader. POST
/tasks/{id}/release follows the #259 contract (global-admin write,
fresh hard-gate evidence, merged status, multi-source 409 with no
audit write on block); deploy.py stays outside task gates.
LoopState + decide_audit + after_fix + apply_correction +
confirm_rebuild + emit, all pure: the driver returns Action
objects, the caller executes (subtask creation, merge/release
blocking, ledger persistence). Counts per (module, contract
version); pushbacks 1-3, 4th failure (> 3) rebuilds, 1 rebuild
and 1 targeted round per version, third-failure triage
(structural -> early rebuild, contract/design -> refreeze,
near-complete -> targeted), rebuild-only-implementation with
the old-test first gate, acceptance rebuilds pending user
confirmation, quota blocks consume nothing, cost threshold
escalates rebuilds to the user with full history, corrections
to pass do not unblock, ledger events match the #241 table
with CONDITIONAL mapped to fail at the boundary.
No server wiring, no release endpoint, no task creation, no
DB access in this track; wiring is the next track's job
against this interface.
Single sampling rule; track 3 (#244) is authoritative for WHO is
mandatory, track 5 (#238) for HOW the rest are drawn:
- Mandatory (1.0): golden-task records + rebuild / refreeze /
escalation records + third-failure near-complete still-failed
cases (mandatory_triggers, full list per case). Track 3's old
deterministic every-10th ordinary rule is removed (it drew zero
from batches under 10 ordinary records and was predictable);
track 5's old narrow mandatory list is expanded with golden /
refreeze / escalate. blocked_quota stays non-mandatory.
- Random tiers: normal 0.10, critical-path 0.50, seed required
and recorded, ceil so a non-empty group is never rounded to
zero. 0.10/0.50 are TEST DEFAULTS, not approved production
values; production rates remain a user decision.
- One pass, no double counting: mandatory records leave the
random pools before drawing; a multi-trigger record (e.g.
golden + rebuild) is sampled once with all triggers listed,
and its correction follows the (original, corrected) verdict
pair, never the trigger list.
- cloud/audit_pushback.py::select_audit_sample is now only a
record-shaped adapter over cloud/audit_sampling.py::select_sample
(seed required, retired reason names critical_path-for-kinds
and periodic_sample removed); AUDIT_SAMPLE_EVERY_NTH deleted.
- Correction: original never mutated, correction appended,
corrector != signer enforced in audit_sampling when both names
are supplied; gate effect pinned (correction to pass never
unblocks by itself -- schedule/cancel-and-rerun, blocked until
a new passing re-audit; correction to fail re-blocks at once).
Track 3 / track 5 retrigger vocabularies documented as synonyms.
- Skill text (tightening 3 item 2 + correction paragraph)
rewritten to the unified rule; new test file pins the
boundaries (mandatory union, dedup, ceil incl. the 9-record
case, seed reproducibility, golden-set construction under both
sample vocabularies, adapter order/non-mutation, correction
preservation on both tracks).
Bypass closed: automations._audit_row (direct audit_log INSERT,
best-effort swallow) is deleted. run_due_automation now writes via
cloud.auth.audit_on_conn, the same audit_log + audit_ledger pair
AuthStore.audit() writes, sharing created_at. The audit pair runs
before record_automation_run's commit, so task row, run row and
audit pair commit or roll back together; chain-head IntegrityError
retries the whole block up to 5 times, other errors roll back and
raise (fail-closed). The claim stays committed, so a failed run is
retried next interval, never recorded as a failed run.
AuthStore.audit() now delegates to audit_on_conn; its pair, retry
count and fail-closed semantics are unchanged.
- cloud/attempt_ledger.py: separate task_attempts table (not tasks
columns) with per-attempt rows, MAX+1 attempt_no, append-only
intent; interrupted rows kept but never counted; is_defect is
explicit, never inferred from failure; first defect category
wins; no-ledger tasks stay unknown (None), never backfilled.
SQLite DDL is CREATE TABLE IF NOT EXISTS (idempotent); PG_DDL
is the verbatim manual step for production Postgres, kept out
of POSTGRES_SCHEMA on purpose (migrations coverage untouched).
- cloud/server.py GET /metrics-report: aggregates the ledger
into compute_metrics records; missing ledger table degrades to
unknown rates, not an error. Cost dual-column code untouched.
- cloud/metrics.py: docstring only (ledger is now the source);
compute_metrics logic and all #238 semantics unchanged.
- Tests: 16 ledger tests (store/aggregate/metrics/PG adapter
evidence) + 3 endpoint tests (real rates, old task beside
ledger task, interrupted status non-terminal).
- cloud/audit_sampling.py (pure, stdlib): mandatory sampling (1.0)
for rebuild cases and for third-failure near-complete cases whose
continuation round still failed; random sampling for the rest
(normal 0.10, critical-path 0.50, ceil so small groups are never
rounded to zero, seed required and recorded for reproducibility).
- Wrong-verdict handling: correct the original conclusion and
retrigger the corresponding flow (wrong pushback ->
cancel_pushback_and_rerun_audit; wrong rebuild ->
halt_rebuild_and_restore; wrong pass -> reopen_audit_and_pushback;
unknown original -> escalate_to_human); every result, correct or
corrected, is appended to the audit-of-audit record.
- Golden-set approval checklist: list reviewed, criteria defined,
sample exclusion, approver+timestamp -- all human-confirmed before
approval; sample entries (sample=True or sample- ids) are dropped
and counted, never counted as golden.
- metrics.build_report gains an optional sampling_plan section;
without a plan it states sampling is pending, never implying the
audit was re-examined.
- cloud/arch_conformance.py: contract-version (+1 only, approved
change record), forbidden-directory (own dir only, .. and symlink
escapes resolved), forbidden-import layer bans audited against the
baseline (foundation/execution/driver, server sqlite3 Row adapters
deliberately allowed), G2 frozen-stack swap guard; skill-project
one-call check.
- cloud/metrics.py: first-pass/defect/rework rates over terminal
tasks, unknown rates as None (never 0), #212 dual-column per-task
cost (total None when incomplete), pure feedback rules
(tighten/route-with-extra-audit/recalibrate, auto_apply False),
golden-set gate: unapproved sample set is never decision-ready.
- GET /metrics-report (authenticated, member-scoped, same as
/metrics): attempts/defects are None until an attempt ledger
exists, so rates stay unknown rather than fabricated.
- Tests: 29 arch + 15 metrics + 3 endpoint, each check with
positive and negative cases; repo-level scan pins zero layer
violations on the baseline so a future violation fails CI via the
existing host-verify discover run (no workflow change).
Track 3 decisions (audit_pushback) now really block the server merge
endpoint and really land on the track 4 hash chain, via the new
cloud/audit_wiring.py translation layer:
- POST /tasks/{id}/merge ANDs the chain pushback block
(merge_blocked/release_blocked/blocked_by=audit_pushback/round/
failed_checks, replayed per module+contract version) with the
hard gate's five checks in every gate mode; either side blocks
-> 409, status unchanged, audit_pushback_blocked appended to
merge_gate.blocks. Ledger reads that fail (other than a missing
audit_ledger table) fail closed to 409.
- Every pushback/fix/re-audit/rebuild/escalation step is written
to the ledger with track 3 fields authoritative and track 4
storage authoritative; CONDITIONAL maps to fail at the boundary
with the original preserved, history never rewritten.
- Hard-gate 409 blocks codes feed pushback packages machine-first
(branch protection survives as its own extra check).
- Re-audit QA guard: a claimed pass with un-rerun or failed QA
links never reaches the chain.
- Track 4 compat: one audit_wiring_event action for escalation /
blocked-quota / audit-sample kinds, counted in the timeline.
- Resolved tension (documented in audit_wiring.py): a meta-review
correction to fail re-blocks at once, but a correction to pass
does NOT unblock by itself -- track 3 schedules a re-audit,
it does not release the gate; track 4 failure counts still use
effective verdicts, so the two views may disagree while a
re-audit is pending.
Tests: cloud/tests/test_audit_wiring.py (18 items), incl. a real
HTTP end-to-end chain (fail -> 409 -> fix -> re-audit pass ->
200) and a separate QA-link chain test.
Independent audit (no code, independent re-run, separate signature;
CONDITIONAL never passes; deviation needs due todo) and automatic
pushback (fail -> derived fix subtask, merge/release blocked,
package with per-item evidence, full re-audit, 3-round limit with
a separate CI auto-fix counter, ledger hash-chain interface for
track 4, gate-block interface for track 1). Over 3 failures per
module per contract version: rebuild only that module from the
frozen contract (old implementation archived, avoidance list),
contract/design root cause -> G2 re-freeze escalation instead.
Tightenings: 3rd-failure triage (structural early rebuild /
early refreeze, near-complete one targeted round), rebuild keeps
tests and passed assets with an old-test first gate, audit-of-
audit sampling/correction and G6 user-only acceptance plus
acceptance-rebuild user confirmation. QA full chain: self-test
three parts, PRD coverage, agent six, cross-client matrix with
honest uncompiled verdicts, G5 gates, impact-scoped regression,
dual QA/audit signatures, failed-link re-runs in re-audit.
Skill text is purely additive (+459/-0) against main v0.2 text;
port this section into v0.3/v0.4/v0.5 texts on merge, never
overwrite them with this file.
Integration arbitration, not a PR commit: v0.3/v0.4/v0.5 synced body
changes into appendix chapters 00/02/04/06/07 while templates/roles/
sources stayed at v0.2, so check_appendix failed 6 chapters; and
09-ops/10-iteration chapters (v0.5) were invisible to the strict
chapter regex because of the ', v0.5 new' title suffix, breaking
the #214 matrix-vs-appendix test. Direction is sources follow the
appendix (appendix is the tenant-visible authoritative version;
never overwrite v0.5 text with v0.2). 09/10 headers normalized to
strict form (suffix only); 09/10 sources split mechanically from
the appendix; EXPECTED_IDS extended to 11 chapters in the checker
and both appendix tests.
- test_skill_appendix_sync: all 9 appendix chapters 00..08 in order,
body role-matrix set == appendix role-title set, authority
statement on both sides, GitHub guarantee in body + named
appendix chapters 00/04/07, seeded copy byte-identical with
full appendix. Previously only 00/08 existence was asserted.
- test_skill_seed_pinning: only SKILL.md copied (pack extras never
land, never resurrected), tenant extras left alone, tenant-modified
SKILL.md never overwritten across repeats, identical = noop,
deleted SKILL.md re-seeded (documented boundary, not deletion
preservation).
- skill_seed.py: evaluation note only (why whole-dir copy is not
done); no code change.
- CostStore: per-model breakdown, report_by_creator (JOIN tasks.created_by),
dual-column reports with priced_usd_micros, unpriced_models listed
separately and a billing note (proxy price, not the relay bill);
_report itself untouched, old exact-key tests keep passing.
- Hard cutoff: cost.quota_cutoff_reason is the single USD/unpriced-cap
decision; worker._quota_exceeded now delegates to it (identical
messages); claim gate, turn boundary and poll kill stop spend and
record interrupted + quota reason + audit; auto-resume re-checks
live quota before requeueing.
- Approval timeout (G7 ops metric): cloud/approval_timeout.py —
default stays 600s, >20% timeout rate recommends 1800s, <5% keeps,
mid-range keeps; stats + recommendation + info log; wired into
/metrics (member projects, no log spam) and a global-admin
/admin/ops/approval-timeout endpoint (sweeps overdue first).
- Server: task/project cost endpoints return dual-column reports;
new GET /users/me/cost and GET /admin/cost-by-creator.
- Tests: cloud/tests/test_cost_quota.py, 10 tests.
Core artifacts travel as an explicit manifest; coordinator triple-checks
(core report vs manifest vs recomputed hash) before cleanup, regression
rewrites files verbatim, recomputes sha256, stops on ARTIFACT-HASH-MISMATCH
and only then runs the same core code plus import-only regression tests.
GET /full-auto/status, GET /full-auto/config-plan, POST
/full-auto/validate-action|merge-gate|ci-fix|release-plan|
rollback-plan, POST /full-auto/execute (global admin only,
FULL_AUTO_ENABLED + verified installation + branch protection
verified via GitHub API, else 403 + audit), GET /full-auto/audit.
Guards reused from cloud/full_auto.py; token only in Authorization
header; audit via audit_record redaction into AuthStore audit_log.
host