feat(agent-journal): filter phase-B provider context#128
Merged
Conversation
Record the merge commits and successful main CI runs for the ledger reconciliation and canonical-receipt infrastructure slices without advancing the pre-acceptance program gate. RED: npx vitest run packages/pi-agent-journal/__tests__/evaluation-program-ledger.test.ts Failure: ledger omitted merged PRs 126 and 127.
Freeze evaluation continuation to the Pi 0.80.6 Codex SSE payload, remove every pre-boundary message, validate the runtime capsule and provider body, and fail closed with a non-serializable abort payload. A loopback test captures and hashes the actual decompressed SSE body. RED: npx vitest run packages/pi-agent-journal/__tests__/evaluation-provider-context.test.ts Failures: module absent; loopback request blocked by invalid synthetic auth; own __proto__ carrier bypassed unknown-key detection.
Snapshot trusted filter configuration, independently convert the filtered Agent-message suffix through the frozen Codex serializer, and rebuild the full provider input from that result so same-length or appended carriers cannot preserve phase-A content. Document the remaining B3 proof boundary. RED: npx vitest run packages/pi-agent-journal/__tests__/evaluation-provider-context.test.ts -t snapshots Failures: mutated configuration was accepted and an appended phase-A provider item reached the rebuilt wire body.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an evaluation-only logical request boundary for the frozen Pi 0.80.6 OpenAI Codex SSE path. Every provider call re-identifies the current runtime Agent Journal capsule, removes the complete phase-A Agent-message prefix, snapshots trusted configuration, independently converts the remaining suffix through Pi's installed serializer, and rebuilds the full provider input from that snapshot.
The boundary rejects malformed, drifted, spoofed, oversized, proxy-backed, accessor-backed, or non-SSE inputs. Failures return a content-free non-serializable sentinel because Pi swallows provider-hook exceptions; the real serializer test proves this prevents fetch. A loopback server also captures and decompresses the actual SSE body and matches its logical byte digest.
This PR is intentionally not B3 completion. Independent suffix witnessing, extension-order attestation, physical fetch-body receipts, authenticated real-Pi proof, and real-runner wiring remain required.
The safe pre-acceptance ledger is also reconciled through merged PRs #126 and #127 without advancing the infrastructure gate.
Validation
__proto__carrier bypassed unknown-key detectionnpm run check:ciDeferred infrastructure proof