diff --git a/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md b/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md index 2f90342..d0eda5e 100644 --- a/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md +++ b/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md @@ -2,15 +2,15 @@ Date: 2026-09-01 -Latest attempted `main`: `e052299c3c0ff4f07f9a27dd23da421fbd95170a` +Latest attempted `main`: `cbdccfb548074890d9c8fca712cade4cdbdfd3fe` -Classification: four non-completing live attempts; no real autonomous pass +Classification: five non-completing live attempts; no real autonomous pass ## Why this record exists The deterministic event-pump fixture and the earlier runner-sequenced Codex canary are useful but separate evidence classes. This record preserves what -the first three operator-supplied Codex-shaped event-pump attempts actually +the operator-supplied Codex-shaped event-pump attempts actually established without combining those evidence classes or upgrading a failed or paused run into product evidence. @@ -22,12 +22,14 @@ paused run into product evidence. | 2 | `threadmesh_durable_turn_intent_evidence_invalid` rejected a numeric Codex `completedAt` value | A real adapter boundary mismatch; Unix-second normalization was later addressed by [#127](https://github.com/fyaic/threadmesh/pull/127) | Not established | Not asserted by this record | | 3 | Operator paused the run after the five role sessions had bootstrapped | Five session bootstraps; coordinator counts remained task `0`, turn intent `0`, pump dispatch `0`, and audit event `0` | Not started | The signal path did not run normal cleanup; a one-off exact operator cleanup deleted and absence-confirmed five of five owned sessions and removed the temporary SQLite, WAL, journal, and run-root resources | | 4 | The first user-kickoff turn reached lifecycle publication, then failed `threadmesh_lifecycle_publication_action_mismatch` | Five registered tasks; one durable kickoff turn intent; no event-pump dispatch; the live model's selected tool arguments did not reproduce the coordinator-bound lifecycle material | Not started | Normal scenario cleanup deleted and absence-confirmed five of five sessions and removed the coordinator database, journals, and run root | +| 5 | The chain reached the same-A admitted fix turn, then failed `threadmesh_codex_live_context_reconciliation_ambiguous` | Real kickoff publication; reviewer offer, acceptance, admission, and two-tool review; durable `review-failed`; irrelevant skip; same-A offer and acceptance; the admitted fix turn started but had no safely confirmable terminal result inside the existing product-operation window | Partial through `A -> R -> same-A acceptance`; verifier and dependent did not start | Normal scenario cleanup again deleted and absence-confirmed five of five sessions and removed the coordinator database, journals, and run root | The fixes in #126 and #127 do not retroactively change the evidence class of attempts 1 or 2. Attempt 3 is bootstrap and cleanup evidence only. Attempt 4 is the first retained real kickoff/action-binding failure after all five tasks -registered. None of the four attempts produced a completed `state=blocked` -event-pump gate result. +registered. Attempt 5 is the first retained real autonomous partial chain and +stopped conservatively at an ambiguous same-A admitted turn. None of the five +attempts produced a completed `state=blocked` event-pump gate result. ## What the combined work established @@ -44,7 +46,12 @@ event-pump gate result. `SIGINT`/`SIGTERM` into a cooperative shutdown checked after each role bootstrap, after kickoff, and between event-pump dispatches; - attempt 4 exercised the normal five-role cleanup path successfully after a - post-bootstrap live failure, without one-off operator cleanup. + post-bootstrap live failure, without one-off operator cleanup; +- the phase-specific exact-argument correction from #130 was validated by + attempt 5: the kickoff publication and first reviewer dispatch succeeded; +- attempt 5 proved a real receiver-owned accept/admit boundary, a two-tool + review publication, an irrelevant durable skip, and a same-A acceptance + without runner phase prompts or user relay. These are valuable fail-closed and cleanup results. They are not evidence that real Codex sessions completed the proactive lifecycle chain. @@ -53,7 +60,7 @@ real Codex sessions completed the proactive lifecycle chain. - no real `A -> R -> same-A -> V -> dependent` event-pump chain completed; - no reduction in user relay or polling was measured in these attempts; -- no model-selected real lifecycle handoff or dependent activation occurred; +- no complete model-selected lifecycle chain or dependent activation occurred; - verifier custody and Git implementation/fix effects were not independently real in an event-pump run; - OS-kill recovery, long-turn lease heartbeat, a global cross-dispatch chain, @@ -81,8 +88,12 @@ did not tell it the exact coordinator-owned event and material required by the durable lifecycle binding. The bounded correction is to expose those already authorized arguments through phase-specific JSON Schemas. It does not relax the exact binding, add a new protocol field, or let final prose authorize an -effect. A fresh run, not deterministic fixtures, must show whether this closes -the blocker. +effect. Attempt 5 closed this blocker and exposed a narrower operational +boundary: the same-A admitted tool turn reached the existing +timeout/reconciliation path without a safely confirmable terminal observation. +The next bounded change is only to extend the admitted business-turn operation +window from 180 to 300 seconds; ambiguous outcomes remain reconcile-only and +are never resent. A completed chain would still report `state=blocked` and `liveProductEvidence=false` while verifier custody and Git effects remain diff --git a/docs/10-planning/mainline-plan.md b/docs/10-planning/mainline-plan.md index 51a109a..b28418a 100644 --- a/docs/10-planning/mainline-plan.md +++ b/docs/10-planning/mainline-plan.md @@ -30,16 +30,20 @@ attempts stopped at product-probe validation, timestamp evidence validation, and an operator pause after five-session bootstrap. A fourth fresh attempt on `e052299` registered all five tasks and started the sole kickoff, then failed the exact lifecycle-action binding before any event-pump dispatch because the -dynamic-tool schema did not expose the coordinator-bound arguments. Normal -cleanup deleted and absence-confirmed all five sessions and removed the exact -temporary resources. +dynamic-tool schema did not expose the coordinator-bound arguments. A fifth +attempt on `cbdccfb` validated that correction and autonomously reached reviewer +acceptance, admitted two-tool review, `review-failed`, irrelevant skip, and +same-A acceptance. Its admitted fix turn ended in conservative ambiguous +reconciliation. Both runs used normal five-of-five deletion, absence checks, +and exact temporary-resource cleanup. Execute in this order: -1. The bounded SIGINT/SIGTERM cleanup gap is closed by #129. Expose the exact - already-authorized lifecycle arguments through phase-specific tool schemas, - then run the event-pump surface fresh. Do not add another prerequisite that - was not exposed by a live run. +1. The bounded signal cleanup and exact phase-tool contract gaps are closed by + #129 and #130. Extend only the admitted business-turn operation window from + 180 to 300 seconds, preserving reconcile-only ambiguous outcomes, then run + the event-pump surface fresh. Do not add another prerequisite that was not + exposed by a live run. 2. Retain exact real session, native-turn, model-action, durable-dispatch, dependent-ordering, irrelevant-control, and cleanup evidence. The required behavioral counts are one kickoff, zero runner phase/business prompts or diff --git a/docs/10-planning/project-status.md b/docs/10-planning/project-status.md index b6161f5..ca186ec 100644 --- a/docs/10-planning/project-status.md +++ b/docs/10-planning/project-status.md @@ -62,7 +62,7 @@ until this outcome is demonstrated. | M5.2 Git evidence foundation | Independent temporary bare repo and role worktrees, same-worktree implementer fix, SQLite v5 evidence chains, SQLite v6 turn/cursor recovery, SQLite v7 bound verifier-only atomic unlock, private signed-result recovery journal, five controlled coordinator-reopen checkpoints, and a preconfigured-key child verifier bound to exact commits/finding/test | Deterministic safety, persistence, model-action receipt, authority, and coordinator-reopen recovery seams passed; integrated process-crash recovery and coordinator-driven real loop pending | | M5.2 real Codex model/tool canary | Five persistent roles; four real A/R/same-A/V turns; seven model-selected tool calls; exact two-commit chain; same-A identity/worktree; dependent and irrelevant zero-turn controls; five-of-five cleanup on base `1155fc8` | Canary completed; intentionally `blocked` with `liveProductEvidence=false` because the runner submitted four phase prompts and ThreadMesh performed no lifecycle handoff | | M5.2 autonomous no-plan fixture | One user kickoff; durable SQLite attention drives A→R→same-A→V→dependent; zero fixture-runner activation dispatches or phase/business prompts; zero manual relay and polling; pump starts protected receiver turns; trusted finalization precedes dependent turn; exact cleanup | Deterministic in-process fixture at `711da66`; per-dispatch recovery durable, global chain absent; OS kill/heartbeat/live products/external verifier pending | -| M5.2 real event-pump attempts | Four attempts: product-probe rejection; timestamp-evidence rejection; operator pause after five-session bootstrap; exact lifecycle-action mismatch after five tasks and the sole kickoff registered | No event-pump dispatch or proactive-chain evidence; attempt 4 used normal five-of-five deletion, absence verification, and exact temporary-resource cleanup; M5.2 remains open | +| M5.2 real event-pump attempts | Five attempts: three pre-chain stops; exact lifecycle-action mismatch after kickoff; then a real autonomous partial chain through reviewer review and same-A acceptance before ambiguous admitted-fix reconciliation | First real event-pump initiative evidence, but no complete chain; attempts 4–5 used normal five-of-five deletion, absence verification, and exact temporary-resource cleanup; M5.2 remains open | | Gemini CLI headless | Official package 0.56.0 integrity, required flags, isolated-home cleanup | Real no-model preflight passed | | Gemini live model behavior | Exact marker script requires explicit provider key | Not authorized, not run | | Multi-product admission | One mailbox/acceptance/claim/evidence path across ACP, Codex, and Gemini fakes | Merged experimental implementation | diff --git a/src/validation/live-agent-scenario.mjs b/src/validation/live-agent-scenario.mjs index 11c9a19..749e6df 100644 --- a/src/validation/live-agent-scenario.mjs +++ b/src/validation/live-agent-scenario.mjs @@ -1688,7 +1688,7 @@ export class CodexLiveAgentRuntime { )); await afterToolCall(metadata); }, - timeoutMs: 180_000, + timeoutMs: 300_000, }); assertExactCompletedToolTurn(turn, ref, started); assertExactToolCallCorrelation(turn, selectedCalls, completedCalls);