feat: add evidence-bound failure curation

[divo12]

Context

Rebased onto fresh after #30. The base now provides deterministic exact pattern mining; this PR adds the separate evidence-bound curation step before harness hypotheses.

Summary

• add a typed cross-failure curation service that partitions a complete bounded diagnosis set into repeated actionable groups or explicit deferred entries
• require supported evidence, one failure type, and recurrence across distinct tasks before a curated group can be recorded
• bind deterministic group and curation identities to exact diagnosis artifact SHA-256 digests
• reuse the hardened bounded, no-follow failure workspace and atomically publish curations under .workspace/failure-curations/
• expose record_failure_curation after mine_failure_patterns and route the ITSM program through a $failure-curator cross-task debugger pass
• bump the combined plugin to 0.7.0 and pin its portable runtime

Reference behavior

• Agentic Harness Engineering: per-task debugger detail followed by a cross-task root-cause overview: https://github.com/china-qijizhifeng/agentic-harness-engineering
• auto-harness: durable repeated patterns with later candidate gates kept separate: https://github.com/neosigmaai/auto-harness

Non-goals

• no harness hypothesis or automatic file edit
• no benchmark, candidate gate, promotion, or scheduler
• no Langfuse trace writes or local trace payload copies
• no semantic-similarity claim and no complete curation above the explicit 50-artifact bound

Rebase resolution

• preserved [codex] add exact failure pattern mining #30 exact normalized pattern mining as the first aggregation step
• retained curation as a later explicit debugger judgment step
• preserved regular-file, non-blocking, no-follow reads and shared atomic artifact publication
• accepted all three Ponytail simplifications; follow-up remained net negative in lines
• artifact IDs are anchored consistently at both seams; only current-run receipts may be curated; overflow blocks hypothesis formation

Local verification

• uv run ruff check src tests plugins/openflywheel/scripts/mcp_server.py: clean
• uv run mypy src tests plugins/openflywheel/scripts/mcp_server.py: clean across 46 source files
• uv run pytest --cov=ofw --cov-report=term-missing --cov-fail-under=90 -q: 217 passed, 2 skipped, 95.24% total coverage
• failure curation: 97%; exact pattern mining: 99%
• changed production functions: complexity A, maximum 5; repository average A
• all five plugin skills validate
• plugin validation passes

All verification above is local evidence, not CI evidence.

Risk / follow-up

Pattern semantics remain agent-authored. Deterministic checks enforce evidence lineage, complete partitioning, failure-type consistency, and distinct-task recurrence without pretending to verify semantic similarity.

[cubic-dev-ai]

All reported issues were addressed across 17 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[divo12]

Follow-up pushed in 7a9a528 (runtime pin 5fa1c54).

Addressed all three simplification findings:

• routed both writers directly through _store_artifact and removed _store_prepared_artifact plus _workspace_paths
• removed the unused _failure_directory_handle
• replaced three repeated integration setups with _record_failures

Also addressed the completed review findings:

• anchored artifact IDs before filename use and added a traversal-shaped rejection test
• restricted curation to current-run record_failure receipts; explicitly forbade globbing retained artifacts
• made the >50-artifact branch stop before hypothesis formation

Net follow-up diff: 78 additions, 142 deletions (-64 lines). Local verification: Ruff clean; strict mypy clean; 200 passed, 2 skipped; 95.28% total coverage; failure curation 97%; changed functions complexity A with maximum 5; skill and plugin validation passed. GitHub Actions quality check is green.

[cubic-dev-ai]

1 issue found across 10 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/ofw/evaluation/failure_curation.py">

<violation number="1" location="src/ofw/evaluation/failure_curation.py:18">
P3: This hardening anchors the artifact-ID regex only in failure_curation.py; failure_workspace.py:43 keeps the identical _ARTIFACT_ID_PATTERN unanchored, used to validate artifact_id at lines 149 and 157. The two modules now enforce different rules on the same artifact IDs (the workspace accepts IDs with surrounding junk that curation rejects). Extract the pattern to one shared constant (e.g. in ofw.contracts) and use it in both modules, or apply the same anchors to both copies, so the pipeline validates consistently.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: This hardening anchors the artifact-ID regex only in failure_curation.py; failure_workspace.py:43 keeps the identical _ARTIFACT_ID_PATTERN unanchored, used to validate artifact_id at lines 149 and 157. The two modules now enforce different rules on the same artifact IDs (the workspace accepts IDs with surrounding junk that curation rejects). Extract the pattern to one shared constant (e.g. in ofw.contracts) and use it in both modules, or apply the same anchors to both copies, so the pipeline validates consistently.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/ofw/evaluation/failure_curation.py, line 18:

<comment>This hardening anchors the artifact-ID regex only in failure_curation.py; failure_workspace.py:43 keeps the identical _ARTIFACT_ID_PATTERN unanchored, used to validate artifact_id at lines 149 and 157. The two modules now enforce different rules on the same artifact IDs (the workspace accepts IDs with surrounding junk that curation rejects). Extract the pattern to one shared constant (e.g. in ofw.contracts) and use it in both modules, or apply the same anchors to both copies, so the pipeline validates consistently.</comment>

<file context>
@@ -15,7 +15,7 @@
 from ofw.observability.langfuse.domain import ObservationId, ScoreId, TraceId
 
-_ARTIFACT_ID_PATTERN = r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+_ARTIFACT_ID_PATTERN = r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
 _PATTERN_KEY_PATTERN = r"[a-z0-9]+(?:-[a-z0-9]+)*"
 _TEXT_PATTERN = r"[^\x00]+"
</file context>