From 7eaca20a0e6552f57d55d92c68fd9d2a825e6ee4 Mon Sep 17 00:00:00 2001 From: veil-chow-fyaic <247294299+veil-chow-fyaic@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:16:17 +0800 Subject: [PATCH] docs: record real Codex autonomous event-pump chain --- README.md | 37 +++--- ROADMAP.md | 31 +++--- docs/06-guides/m5-2-live-agent-scenario.md | 35 +++--- ...5-2-real-codex-event-pump-attempt-audit.md | 63 +++++++---- ...-01-m5-2-real-codex-event-pump-behavior.md | 105 ++++++++++++++++++ docs/09-reviews/README.md | 5 +- docs/10-planning/mainline-plan.md | 45 ++++---- .../product-mainline-2026-08-28.md | 48 ++++---- docs/10-planning/project-status.md | 47 ++++---- 9 files changed, 266 insertions(+), 150 deletions(-) create mode 100644 docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-behavior.md diff --git a/README.md b/README.md index 04621d0..d4a7a29 100644 --- a/README.md +++ b/README.md @@ -102,22 +102,21 @@ publication recovery are durable per dispatch, with leased and fenced publication. There is still no global cross-dispatch selection chain: `selectionChainValid=null`. -Three real Codex event-pump attempts have not yet produced a completed chain. -The first stopped at product-probe validation; the second stopped at timestamp -evidence validation; the third was operator-paused after five role sessions -bootstrapped, while coordinator task, turn-intent, and pump-dispatch counts all -remained zero. The five owned sessions were then deleted and absence-confirmed, -and their exact temporary resources were removed through a one-off operator -cleanup because the signal path did not run normal cleanup. This is preflight, -adapter-boundary, and cleanup evidence—not real session initiative. - -The project now freezes non-mainline expansion. The next checkpoint is one -fresh real Codex event-pump chain on the existing implementation. OS-kill and -heartbeat matrices, a global chain, external verifier and real Git closure, -Kimi parity, and further product polish follow only after that behavioral -checkpoint, unless the live run proves one of them is the direct blocker. +The sixth real Codex event-pump attempt completed that same autonomous chain. +After one kickoff, nine real bound native turns carried the work through R, +the original A session, V, and the dependent. The runner supplied zero later +phase prompts or direct activations; the irrelevant session ran zero turns; +five of five temporary sessions and all coordinator artifacts were removed. + +The completed result is deliberately classified `state=blocked` and +`liveProductEvidence=false`: verifier custody and Git effects are still +fixture-owned or simulated. This proves bounded real session initiative, not +M5.2 or production closure. The next checkpoint reuses the existing Git and +verifier foundations in this correlated path, then measures against a manual +relay/polling baseline. Non-mainline expansion remains frozen. [Read the exact fixture evidence](docs/09-reviews/2026-09-01-m5-2-autonomous-fixture.md) · +[Read the real Codex behavior](docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-behavior.md) · [Read the M5.2 scenario guide](docs/06-guides/m5-2-live-agent-scenario.md) ## Quickstart @@ -304,14 +303,14 @@ peer content or as a production security boundary. install Ajv and native `better-sqlite3`. - **Reference runtime:** authenticated JSON-RPC + SQLite coordinator for local, trusted-process experiments. -- **Validation:** 378 tests, plus 55 schema cases and 7 transition cases; +- **Validation:** 379 tests, plus 55 schema cases and 7 transition cases; documentation lint passes. These are separate counts, not one combined total. - **Default:** proactive coordination remains off unless a maintainer explicitly opts into the bounded experimental profile. -- **Next mainline:** complete and retain one fresh real Codex event-pump chain - with one kickoff, zero runner phase prompts or direct activations, an - irrelevant zero-turn control, and exact cleanup. Only then resume the - remaining M5.2 closure and Kimi parity gates. +- **Next mainline:** reuse the existing bounded Git-worktree and verifier + foundations inside the now-proven real Codex event-pump chain; add a manual + relay/polling baseline and minimum critical negative/restart evidence. Kimi + parity and broader hardening follow after M5.2 closure. [Current status](docs/10-planning/project-status.md) · [roadmap](ROADMAP.md) · diff --git a/ROADMAP.md b/ROADMAP.md index 740d9f3..c02dc26 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -140,26 +140,23 @@ The retained foundation includes: [#125](https://github.com/fyaic/threadmesh/pull/125)– [#127](https://github.com/fyaic/threadmesh/pull/127). -The completed chain remains fixture evidence: `liveProductEvidence=false`, +The deterministic chain remains fixture evidence: `liveProductEvidence=false`, `deterministicPolicyOracle=true`, `externalIndependentVerifier=false`, the signer is a fixture-owned ephemeral key, and there is no global cross-dispatch -selection chain. Three real Codex event-pump attempts then stopped at product -probe validation, timestamp evidence validation, and an operator pause after -five-session bootstrap respectively. The paused attempt recorded zero -coordinator tasks, turn intents, and pump dispatches before all five owned -sessions and exact temporary resources were cleaned. No attempt completed the -real proactive chain. +selection chain. Five real Codex event-pump attempts then failed closed at +successively narrower product boundaries. A sixth attempt completed the full +real proactive `A -> R -> same-A -> V -> dependent` chain with one kickoff, +nine bound native turns, zero later runner prompts or direct activations, an +irrelevant zero-turn control, and exact cleanup. This exposed an execution-order imbalance rather than a change in product -direction. The immediate checkpoint is now one fresh real Codex event-pump -chain on the existing surface. New substrate, generalized recovery, verifier, -Git, cross-harness, or presentation work is frozen unless that live run proves -it is the direct blocker. A completed run remains `blocked` and -`liveProductEvidence=false` while verifier custody and Git effects are -simulated; it demonstrates behavior, not M5.2 closure. - -The paused attempt also exposed one bounded SIGINT/SIGTERM cleanup gap. Closing -that exact gap before the rerun is in scope; general process supervision is not. +direction. The behavioral checkpoint is now passed. The immediate checkpoint +is to reuse the existing bounded Git-worktree and verifier foundations inside +that correlated live path, then add the manual baseline and minimum critical +negative/restart evidence. New substrate, generalized recovery, cross-harness, +or presentation work remains frozen. The completed run correctly remains +`blocked` and `liveProductEvidence=false` while verifier custody and Git effects +are simulated; it demonstrates behavior, not M5.2 closure. - [x] Ship a one-command local demo with generated identities, grants, example sessions, and an inspector @@ -179,7 +176,7 @@ that exact gap before the rerun is in scope; general process supervision is not. chain with trusted pre-turn finalization, zero irrelevant turns, and exact cleanup; persist each dispatch through selection, turn settlement, and publication recovery. This does not satisfy the real-product M5.2 gate. - - [ ] Real-chain checkpoint: retain one fresh Codex event-pump + - [x] Real-chain checkpoint: retain one fresh Codex event-pump A/R/same-A/V/dependent run with one kickoff, zero runner phase/business prompts or direct activations, exact real session/turn/dispatch bindings, dependent ordering, an irrelevant zero-turn control, and exact cleanup. diff --git a/docs/06-guides/m5-2-live-agent-scenario.md b/docs/06-guides/m5-2-live-agent-scenario.md index 8a42a4a..ba84d4b 100644 --- a/docs/06-guides/m5-2-live-agent-scenario.md +++ b/docs/06-guides/m5-2-live-agent-scenario.md @@ -184,32 +184,33 @@ export THREADMESH_CODEX_COMMAND=/absolute/path/to/codex node scripts/run-m5-2-event-pump-gate.mjs --mode live --artifacts-dir /fresh/owned/directory ``` -The first three attempts did not complete the event-pump chain: +Six bounded attempts are retained: | Attempt | Stop | Chain evidence | Cleanup evidence | |---|---|---|---| | 1 | Product probe invalid | Preflight rejection only | Not asserted by this record | | 2 | Timestamp evidence invalid | Adapter-boundary defect only | Not asserted by this record | | 3 | Operator paused after five session bootstraps | Coordinator task/turn-intent/dispatch counts were `0/0/0`; chain not started | Normal signal cleanup did not run; one-off exact operator cleanup deleted and absence-confirmed five of five sessions and removed temporary resources | +| 4 | Exact lifecycle publication action mismatch after kickoff | Five tasks and one kickoff intent; no pump dispatch | Normal five-of-five session and temporary-resource cleanup | +| 5 | Ambiguous reconciliation during the admitted same-A fix turn | Real chain through reviewer review and same-A acceptance | Normal five-of-five session and temporary-resource cleanup | +| 6 | Completed with expected `threadmesh_m52_independent_verifier_service_pending` product-gate classification | Full real `A -> R -> same-A -> V -> dependent`; one kickoff, nine bound turns, zero later runner prompts/direct activations, irrelevant zero turns | Normal five-of-five session cleanup, coordinator removal, zero journals, and removal of the exact empty artifacts directory | [#126](https://github.com/fyaic/threadmesh/pull/126) and [#127](https://github.com/fyaic/threadmesh/pull/127) fixed the first two observed -boundaries, but do not retroactively upgrade those attempts. None is a -completed `state=blocked` gate result. Attempt 3 must be rerun fresh because its -owned sessions and temporary state no longer exist. - -The missing bounded SIGINT/SIGTERM cleanup path is an observed rerun blocker. -Fixing that exact path is in scope; building a general process supervisor is -not. - -The next checkpoint is one uninterrupted real chain with one kickoff, zero -runner phase/business prompts or direct activation dispatches, eight protected -receiver turns, nine total bound native turns, exact dependent ordering, an -irrelevant zero-turn control, and exact cleanup. If the real turn chain -completes while verifier custody and Git effects remain simulated, the correct -public result is still `state=blocked` and `liveProductEvidence=false`. - -See the [bounded attempt audit](../09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md). +boundaries, but do not retroactively upgrade those attempts. #129 added bounded +signal cleanup, #130 exposed exact coordinator-bound tool contracts, and #131 +extended only protected admitted business turns to 300 seconds. Attempt 6 is a +completed `state=blocked` gate result and the first real autonomous behavioral +chain. + +The next checkpoint is no longer another behavioral rerun. Reuse the existing +bounded Git-worktree and verifier foundations inside this correlated event-pump +path, then add the manual relay/polling baseline and minimum critical +negative/restart evidence. Until those gates pass, the correct public result +remains `state=blocked` and `liveProductEvidence=false`. + +See the [bounded attempt audit](../09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md) +and [real behavior record](../09-reviews/2026-09-01-m5-2-real-codex-event-pump-behavior.md). ## Historical real product gate diff --git a/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md b/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md index d0eda5e..2dc45c5 100644 --- a/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md +++ b/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md @@ -2,9 +2,10 @@ Date: 2026-09-01 -Latest attempted `main`: `cbdccfb548074890d9c8fca712cade4cdbdfd3fe` +Latest attempted `main`: `f98c56b83057b43f8b9618d6f69e1b2f481f77bd` -Classification: five non-completing live attempts; no real autonomous pass +Classification: six live attempts; attempt 6 completed the real autonomous +behavioral chain, while the integrated M5.2 product gate remains blocked ## Why this record exists @@ -23,13 +24,16 @@ paused run into product evidence. | 3 | Operator paused the run after the five role sessions had bootstrapped | Five session bootstraps; coordinator counts remained task `0`, turn intent `0`, pump dispatch `0`, and audit event `0` | Not started | The signal path did not run normal cleanup; a one-off exact operator cleanup deleted and absence-confirmed five of five owned sessions and removed the temporary SQLite, WAL, journal, and run-root resources | | 4 | The first user-kickoff turn reached lifecycle publication, then failed `threadmesh_lifecycle_publication_action_mismatch` | Five registered tasks; one durable kickoff turn intent; no event-pump dispatch; the live model's selected tool arguments did not reproduce the coordinator-bound lifecycle material | Not started | Normal scenario cleanup deleted and absence-confirmed five of five sessions and removed the coordinator database, journals, and run root | | 5 | The chain reached the same-A admitted fix turn, then failed `threadmesh_codex_live_context_reconciliation_ambiguous` | Real kickoff publication; reviewer offer, acceptance, admission, and two-tool review; durable `review-failed`; irrelevant skip; same-A offer and acceptance; the admitted fix turn started but had no safely confirmable terminal result inside the existing product-operation window | Partial through `A -> R -> same-A acceptance`; verifier and dependent did not start | Normal scenario cleanup again deleted and absence-confirmed five of five sessions and removed the coordinator database, journals, and run root | +| 6 | Completed the bounded event-pump scenario and returned the expected `state=blocked`, `code=threadmesh_m52_independent_verifier_service_pending` result | One kickoff; nine bound real Codex native turns; eight protected receiver turns; eight business tool calls; four published event-pump dispatches; one durable irrelevant skip; same-A identity/worktree reuse; verifier-finalization-before-dependent ordering | Complete `A -> R -> same-A -> V -> dependent`; zero runner phase prompts, direct activation dispatches, manual relay, polling, or irrelevant native turns | Normal scenario cleanup deleted and absence-confirmed five of five sessions, removed the coordinator, and left zero journals; the exact empty operator artifacts directory was then removed | The fixes in #126 and #127 do not retroactively change the evidence class of attempts 1 or 2. Attempt 3 is bootstrap and cleanup evidence only. Attempt 4 is the first retained real kickoff/action-binding failure after all five tasks registered. Attempt 5 is the first retained real autonomous partial chain and stopped conservatively at an ambiguous same-A admitted turn. None of the five -attempts produced a completed `state=blocked` event-pump gate result. +attempts produced a completed `state=blocked` event-pump gate result. Attempt 6 +did. It is the first retained real behavioral pass of the autonomous chain, not +an M5.2 completion claim. ## What the combined work established @@ -52,17 +56,27 @@ attempts produced a completed `state=blocked` event-pump gate result. - attempt 5 proved a real receiver-owned accept/admit boundary, a two-tool review publication, an irrelevant durable skip, and a same-A acceptance without runner phase prompts or user relay. - -These are valuable fail-closed and cleanup results. They are not evidence that -real Codex sessions completed the proactive lifecycle chain. +- merged [#131](https://github.com/fyaic/threadmesh/pull/131) extended only the + protected admitted business-turn operation window from 180 to 300 seconds; + ambiguous outcomes remain reconcile-only and are never resent; +- attempt 6 completed all nine model/tool-bound native turns after one kickoff: + R reviewed, the original A session accepted and fixed the finding, V verified + the exact chain, and the dependent session activated only after finalization; +- the runner supplied zero later phase or business prompts and made zero direct + activation dispatches; the irrelevant session ran zero native turns; +- the completed public result retained exact native-turn, durable-dispatch, + runner-trace, and five-session manifests and passed exact cleanup. + +The sixth result is real Codex session-initiative evidence. It is still bounded +experimental evidence, not proof of an independently verified Git workflow or +production reliability. ## What is not established -- no real `A -> R -> same-A -> V -> dependent` event-pump chain completed; -- no reduction in user relay or polling was measured in these attempts; -- no complete model-selected lifecycle chain or dependent activation occurred; - verifier custody and Git implementation/fix effects were not independently real in an event-pump run; +- the completed run demonstrates zero relay and polling by construction, but it + does not yet include a timed manual-workflow baseline; - OS-kill recovery, long-turn lease heartbeat, a global cross-dispatch chain, Kimi parity, and repetition remain untested on this live path. @@ -74,13 +88,12 @@ cleanup behavior. The execution order was imbalanced: generalized durability, verification, Git evidence, and recovery work advanced before one uninterrupted real proactive chain was retained. -Non-mainline expansion is now frozen. The bounded signal cleanup fix is merged, -and attempt 4 proved the normal post-bootstrap cleanup path. The next checkpoint -is one fresh run after the exact tool-contract correction, with one user -kickoff, zero runner phase or business prompts, zero runner direct activation -dispatches, exact real session/turn/dispatch bindings, an irrelevant zero-turn -control, and exact cleanup. Only a blocker observed by that run may interrupt -this checkpoint. +Non-mainline expansion remains frozen. The bounded signal cleanup, exact +phase-tool contracts, and admitted-turn window corrections are merged. Attempt +6 has now passed the previously missing behavioral checkpoint with one kickoff, +zero runner phase/business prompts or direct activations, exact real +session/turn/dispatch bindings, an irrelevant zero-turn control, and exact +cleanup. Attempt 4 then exposed the next direct blocker: the live model was asked to select `threadmesh_publish_artifact`, but the registered dynamic-tool schema @@ -91,11 +104,13 @@ the exact binding, add a new protocol field, or let final prose authorize an effect. Attempt 5 closed this blocker and exposed a narrower operational boundary: the same-A admitted tool turn reached the existing timeout/reconciliation path without a safely confirmable terminal observation. -The next bounded change is only to extend the admitted business-turn operation -window from 180 to 300 seconds; ambiguous outcomes remain reconcile-only and -are never resent. - -A completed chain would still report `state=blocked` and -`liveProductEvidence=false` while verifier custody and Git effects remain -fixture-owned or simulated. That bounded result would demonstrate real session -initiative, not M5.2 closure. +The bounded window correction in #131 closed that blocker without changing the +reconciliation policy. + +The next mainline checkpoint is to reuse—not redesign—the existing bounded Git +worktree and verifier foundations in this same correlated event-pump path, then +add the manual relay/polling baseline and the minimum critical negative/restart +case. Attempt 6 correctly reports `state=blocked` and +`liveProductEvidence=false` because verifier custody and Git effects remain +fixture-owned or simulated. It demonstrates real session initiative and clears +the behavioral checkpoint; issue #91 and M5.2 remain open. diff --git a/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-behavior.md b/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-behavior.md new file mode 100644 index 0000000..a0d45a7 --- /dev/null +++ b/docs/09-reviews/2026-09-01-m5-2-real-codex-event-pump-behavior.md @@ -0,0 +1,105 @@ +# Real Codex autonomous event-pump behavior + +Date: 2026-09-01 + +Tested `main`: `f98c56b83057b43f8b9618d6f69e1b2f481f77bd` + +Result: behavioral checkpoint passed; integrated M5.2 gate remains blocked + +## What happened + +One explicit user kickoff started a real Codex session. After that kickoff, +ThreadMesh's durable event pump—not the user and not a sequence of runner phase +prompts—continued the workflow across four receiving roles: + +```text +user kickoff + -> A publishes an artifact + -> R accepts, reads it, and publishes a review finding + -> the same A session accepts, applies the fix, and publishes a dependency + -> V accepts, reads the verification chain, and verifies it + -> only after finalization, the dependent accepts and activates +``` + +An authorized irrelevant session existed in the same run. Its route was +durably skipped and it executed no native model turn. + +This is the concrete behavior ThreadMesh is trying to make portable across +agent harnesses: a session can notice a related durable event and choose to act +without the user copying context, asking for status, or manually waking the +next session. Receiver admission and exact tool bindings keep that initiative +bounded. + +## Machine-observed result + +| Measure | Observed | +|---|---:| +| Explicit user kickoffs | 1 | +| Runner phase/business prompts after kickoff | 0 | +| Runner direct activation dispatches | 0 | +| Bound real Codex native turns | 9 | +| Protected receiver turns | 8 | +| Model-selected business tool calls | 8 | +| Published event-pump dispatches | 4 | +| Durable irrelevant-route skips | 1 | +| Irrelevant native turns | 0 | +| Temporary role sessions deleted and absence-confirmed | 5/5 | +| Remaining journals | 0 | + +The native-turn manifest contained the kickoff plus a decision and admitted +business turn for R, same-A, V, and dependent. The session manifest confirmed +that the implementation and fix used the same A adapter reference and +workspace. Durable evidence confirmed that the dependent started after trusted +finalization. + +The sanitized result bound the evidence with these digests: + +- native-turn manifest: + `sha256:58f0beb48d3c5c388fca72db68274afa32c53b4ac67b9afe3867eb380229f546`; +- durable-dispatch manifest: + `sha256:c82739562ea57376aded812915d326a1fed6e082a2c731e20fd7264804c52b67`; +- runner trace: + `sha256:510dca5c9741726e300717ad32c1f698e84b5cf1fc43ae5914644d7f4284d0f1`; +- five-session manifest: + `sha256:da6db06bf98996d2b906b71c943d414de4a5f1aa3f2170f472b58a6073847b2c`. + +## Why the process exited with `state=blocked` + +The result code was +`threadmesh_m52_independent_verifier_service_pending`, with +`liveProductEvidence=false`. This is an evidence classification, not a failed +behavioral chain. Three stronger product claims remain deliberately unmade: + +- the verifier signer was fixture-owned rather than held by an independent + verifier service; +- implementation and fix effects used the bounded simulated scenario rather + than real Git worktrees and commits; +- the executable was operator supplied, so trusted Codex binary provenance was + not independently established. + +Consequently this run proves real model/session initiative and exact cleanup. +It does not close M5.2, establish production safety, or prove cross-harness +parity. + +## Reproduce + +The live command is intentionally acknowledgement-gated and creates real Codex +tasks. Run it only from a clean checkout and a fresh, owned artifacts directory: + +```sh +export THREADMESH_M52_EVENT_PUMP_LIVE_ACK=maintainer-approved-threadmesh-m52-event-pump-live +export THREADMESH_CODEX_COMMAND=/absolute/path/to/codex +node scripts/run-m5-2-event-pump-gate.mjs \ + --mode live \ + --model gpt-5.6-sol \ + --artifacts-dir /fresh/owned/directory +``` + +Expected behavioral fields are the counts above plus +`sameAPersistentRefAndWorkspace=true`, +`dependentStartedAfterFinalization=true`, and `cleanup.complete=true`. Until +the remaining product gates are integrated, the honest top-level result is +still `state=blocked`. + +The complete attempt history, including five earlier fail-closed runs, is in +the [attempt audit](2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md). diff --git a/docs/09-reviews/README.md b/docs/09-reviews/README.md index de6db6a..9f96fe1 100644 --- a/docs/09-reviews/README.md +++ b/docs/09-reviews/README.md @@ -31,9 +31,12 @@ not count as live-product or independent external-verifier evidence. ## Live attempt audits - [M5.2 real Codex event-pump attempt audit](2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md) +- [Real Codex autonomous event-pump behavior](2026-09-01-m5-2-real-codex-event-pump-behavior.md) Attempt audits preserve preflight, failure, interruption, and cleanup facts. -They do not count as a real-product pass or a completed blocked gate result. +The sixth event-pump attempt completed the real autonomous behavioral chain and +returned the expected blocked product-gate classification; it does not close +M5.2 while Git effects and verifier custody remain simulated. ## Real product evidence diff --git a/docs/10-planning/mainline-plan.md b/docs/10-planning/mainline-plan.md index b28418a..73c8617 100644 --- a/docs/10-planning/mainline-plan.md +++ b/docs/10-planning/mainline-plan.md @@ -25,9 +25,9 @@ kickoff while the runner supplies no later phase prompt or direct activation? The older product canary proved real multi-tool turns, same-A reuse, a bounded Git chain, controls, and cleanup, but its four prompts were runner-submitted. -The newer event-pump gate has not completed a live chain. Its first three -attempts stopped at product-probe validation, timestamp evidence validation, -and an operator pause after five-session bootstrap. A fourth fresh attempt on +The newer event-pump gate has now completed a live behavioral chain. Its first +three attempts stopped at product-probe validation, timestamp evidence +validation, and an operator pause after five-session bootstrap. A fourth on `e052299` registered all five tasks and started the sole kickoff, then failed the exact lifecycle-action binding before any event-pump dispatch because the dynamic-tool schema did not expose the coordinator-bound arguments. A fifth @@ -35,28 +35,26 @@ attempt on `cbdccfb` validated that correction and autonomously reached reviewer acceptance, admitted two-tool review, `review-failed`, irrelevant skip, and same-A acceptance. Its admitted fix turn ended in conservative ambiguous reconciliation. Both runs used normal five-of-five deletion, absence checks, -and exact temporary-resource cleanup. +and exact temporary-resource cleanup. A sixth attempt on `f98c56b` completed +the full real `A -> R -> same-A -> V -> dependent` chain with one kickoff, nine +bound native turns, zero later runner prompts/direct activations, an irrelevant +zero-turn control, and exact cleanup. Execute in this order: -1. The bounded signal cleanup and exact phase-tool contract gaps are closed by - #129 and #130. Extend only the admitted business-turn operation window from - 180 to 300 seconds, preserving reconcile-only ambiguous outcomes, then run - the event-pump surface fresh. Do not add another prerequisite that was not - exposed by a live run. -2. Retain exact real session, native-turn, model-action, durable-dispatch, - dependent-ordering, irrelevant-control, and cleanup evidence. The required - behavioral counts are one kickoff, zero runner phase/business prompts or - direct activation dispatches, eight protected receiver turns, and nine total - bound native turns. -3. Publish the bounded attempt as `blocked`, `failed`, or `not-run`. A completed - chain remains `blocked` and `liveProductEvidence=false` while verifier - custody and Git effects are simulated. -4. Only after that chain is retained, reuse the existing bounded Git worktree - and verifier foundations in the same correlated run, add the manual - relay/polling baseline and minimum critical negative/restart case, and close - #91 when its original product outcome is satisfied. -5. Then resume repetition, Kimi parity, and production-hardening evidence. +1. Treat the real behavioral chain as passed and retain its exact evidence; do + not rerun it merely to polish counts or prose. +2. Reuse the existing bounded Git worktree foundation so A's implementation + and same-A fix become observable commits in the same correlated event-pump + run. Do not design a new Git subsystem. +3. Move verifier signing custody to the existing child-verifier boundary and + bind finalization to the real commits, finding, and test result. Keep the + dependent locked until that attestation is accepted. +4. Add the manual relay/polling baseline and the minimum critical + negative/restart case required by #91; publish the result without upgrading + simulated or operator-supplied evidence. +5. Close #91 only when its original outcome is satisfied, then resume + repetition, Kimi parity, and production-hardening evidence. Mainline guardrail: do not add a new substrate or generalize an existing one unless the current live chain demonstrates that it is the blocking condition. @@ -67,7 +65,8 @@ paused. Small PRs remain acceptable; scope, not PR size, is the constraint. The detailed historical gates remain in the [real Codex scenario plan](m5-2-real-codex-scenario.md). The [event-pump attempt audit](../09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md) -is the canonical live-attempt status until a fresh run supersedes it. +and the [behavior record](../09-reviews/2026-09-01-m5-2-real-codex-event-pump-behavior.md) +are the canonical live status. ## Product sequence — 2026-08-28 diff --git a/docs/10-planning/product-mainline-2026-08-28.md b/docs/10-planning/product-mainline-2026-08-28.md index 6f54128..03a3a65 100644 --- a/docs/10-planning/product-mainline-2026-08-28.md +++ b/docs/10-planning/product-mainline-2026-08-28.md @@ -140,28 +140,25 @@ submitted all four phase prompts and ThreadMesh performed no lifecycle handoff. The event-pump surface subsequently gained protected multi-tool turns, strict public evidence, an operator-run live entry point, observed Codex probe support, -and timestamp normalization. Three live attempts still did not complete the -proactive chain: product-probe rejection, timestamp-evidence rejection, and an -operator pause after five-session bootstrap. The paused attempt recorded zero -coordinator tasks, turn intents, and pump dispatches, then deleted and -absence-confirmed all five sessions and removed exact temporary resources. - -The project has enough deterministic substrate to test the user-facing -behavior. The next evidence must be real session initiative, not another -substrate milestone. Execute in this order: - -1. close the observed bounded SIGINT/SIGTERM cleanup gap, then run one fresh - event-pump chain on the `c17c837` surface with no other new prerequisite - unless a live run exposes it; -2. retain one kickoff, zero runner phase/business prompts and direct - activations, exact native turns and durable dispatches, same-A reuse, - dependent ordering, irrelevant zero turns, and exact cleanup; -3. publish the honest bounded result—even a completed chain remains `blocked` - and `liveProductEvidence=false` while verifier and Git effects are simulated; -4. only then reuse the existing bounded Git and verifier foundations in the - same correlated run and add the manual baseline plus minimum critical - negative/restart evidence; -5. after #91 closes, resume repetition and Kimi parity. +timestamp normalization, cooperative signal cleanup, exact phase-tool +contracts, and a bounded admitted-turn window. Five attempts failed closed at +successively narrower boundaries. A sixth completed the full real proactive +chain with one kickoff, nine bound native turns, zero later runner prompts or +direct activations, an irrelevant zero-turn control, and exact cleanup. + +Real session initiative is now retained. The next evidence must close the +original workflow effect without replacing the proven path. Execute in this +order: + +1. preserve the sixth run as the behavioral baseline; do not repeat it for + presentation polish; +2. reuse the existing bounded Git-worktree foundation so A's implementation and + same-A fix are observable commits in the same correlated run; +3. reuse the child-verifier boundary so independently held signing custody binds + finalization to those commits, the finding, and the test result; +4. add the manual baseline plus minimum critical negative/restart evidence and + close #91 only when its original product outcome passes; +5. then resume repetition and Kimi parity. The acceptance run requires A to publish an implementation, R to discover and publish a reproducible finding, the original A session/worktree to fix it, and @@ -171,10 +168,9 @@ admission, native turn, publication, or dependency effect after its precreation/bootstrap baseline. OS-kill and heartbeat matrices, a global cross-dispatch chain, Kimi parity, new -harnesses, external verifier service design, Git-evidence generalization, and -presentation-only polish are paused unless the real chain proves one directly -blocks it. Small PRs remain acceptable; every change must serve the live chain -or an observed blocker. +harnesses, verifier/Git generalization, and presentation-only polish remain +paused. Small PRs remain acceptable; every change must serve the integrated +Git/verifier closure or an observed blocker. ## Roadmap: Now / Next / Later diff --git a/docs/10-planning/project-status.md b/docs/10-planning/project-status.md index ca186ec..d537efd 100644 --- a/docs/10-planning/project-status.md +++ b/docs/10-planning/project-status.md @@ -1,10 +1,11 @@ # Project status > Snapshot: 2026-09-01 at `main` commit -> `c17c83755c32647eae1a4ed70a075ff56bfc84a5`. Technical evidence includes the +> `f98c56b83057b43f8b9618d6f69e1b2f481f77bd`. Technical evidence includes the > deterministic no-plan autonomous fixture, the earlier runner-sequenced real -> Codex canary, and three non-completing event-pump attempts. None is a real -> autonomous M5.2 product pass. +> Codex canary, five fail-closed event-pump attempts, and one completed real +> autonomous behavioral chain. M5.2 remains blocked on real Git effects, +> independent verifier custody, a manual baseline, and critical closure cases. ## Executive summary @@ -41,8 +42,8 @@ until this outcome is demonstrated. |---|---|---| | Research and problem framing | Codex deep dive, community signals, ecosystem comparison, ADRs | Established | | Community adoption | No external stars, forks, watchers, issue comments, or independent setup result as of 2026-08-28 | Unvalidated | -| Active product outcome | One-command lifecycle-event and dependency-handoff loop with an inspector | Deterministic autonomous A/R/same-A/V/dependent fixture merged; real Codex M5.1 seam passed; real autonomous M5.2 product loop pending | -| Protocol draft | 14 JSON Schemas; 55 schema cases; 7 transition cases; 378 tests | Executable draft; counts are reported separately | +| Active product outcome | One-command lifecycle-event and dependency-handoff loop with an inspector | Real Codex A/R/same-A/V/dependent behavioral chain completed after one kickoff; independent Git/verifier closure pending | +| Protocol draft | 14 JSON Schemas; 55 schema cases; 7 transition cases; 379 tests | Executable draft; counts are reported separately | | Minimal adapter SDK | `@fyaic/threadmesh` `0.1.0-alpha.0`; six bounded client methods, per-turn proactive bridge, about 20 kB tarball, packed-consumer execution | Real Pi clean-consumer pass; not published to npm | | Local binding | Schema-validated JSON-RPC, transport-derived principals, typed errors | Executable local reference | | Local persistence | SQLite v10 registry, lifecycle state, append-only Git evidence, and durable per-dispatch event-pump selection/publication checkpoints | Experimental; global cross-dispatch pump chain absent | @@ -62,7 +63,7 @@ until this outcome is demonstrated. | M5.2 Git evidence foundation | Independent temporary bare repo and role worktrees, same-worktree implementer fix, SQLite v5 evidence chains, SQLite v6 turn/cursor recovery, SQLite v7 bound verifier-only atomic unlock, private signed-result recovery journal, five controlled coordinator-reopen checkpoints, and a preconfigured-key child verifier bound to exact commits/finding/test | Deterministic safety, persistence, model-action receipt, authority, and coordinator-reopen recovery seams passed; integrated process-crash recovery and coordinator-driven real loop pending | | M5.2 real Codex model/tool canary | Five persistent roles; four real A/R/same-A/V turns; seven model-selected tool calls; exact two-commit chain; same-A identity/worktree; dependent and irrelevant zero-turn controls; five-of-five cleanup on base `1155fc8` | Canary completed; intentionally `blocked` with `liveProductEvidence=false` because the runner submitted four phase prompts and ThreadMesh performed no lifecycle handoff | | M5.2 autonomous no-plan fixture | One user kickoff; durable SQLite attention drives A→R→same-A→V→dependent; zero fixture-runner activation dispatches or phase/business prompts; zero manual relay and polling; pump starts protected receiver turns; trusted finalization precedes dependent turn; exact cleanup | Deterministic in-process fixture at `711da66`; per-dispatch recovery durable, global chain absent; OS kill/heartbeat/live products/external verifier pending | -| M5.2 real event-pump attempts | Five attempts: three pre-chain stops; exact lifecycle-action mismatch after kickoff; then a real autonomous partial chain through reviewer review and same-A acceptance before ambiguous admitted-fix reconciliation | First real event-pump initiative evidence, but no complete chain; attempts 4–5 used normal five-of-five deletion, absence verification, and exact temporary-resource cleanup; M5.2 remains open | +| M5.2 real event-pump attempts | Six attempts: five bounded fail-closed stops, then one complete real Codex A/R/same-A/V/dependent chain with one kickoff, nine bound turns, eight business tool calls, zero later runner prompts/direct activations, an irrelevant zero-turn control, and exact cleanup | Behavioral checkpoint passed; result remains honestly `blocked`/`liveProductEvidence=false` because Git effects and verifier custody are simulated; M5.2 remains open | | Gemini CLI headless | Official package 0.56.0 integrity, required flags, isolated-home cleanup | Real no-model preflight passed | | Gemini live model behavior | Exact marker script requires explicit provider key | Not authorized, not run | | Multi-product admission | One mailbox/acceptance/claim/evidence path across ACP, Codex, and Gemini fakes | Merged experimental implementation | @@ -283,23 +284,23 @@ durable, but a global cross-dispatch chain is absent and reports See the [autonomous fixture evidence](../09-reviews/2026-09-01-m5-2-autonomous-fixture.md) and [durable recovery record](../09-reviews/2026-09-01-m5-2-durable-pump-recovery.md). -Three event-pump live attempts did not complete the chain. The first rejected -the observed product-probe shape; the second rejected numeric Codex completion -time evidence; the third was operator-paused after all five role sessions -bootstrapped but before any coordinator task, turn intent, pump dispatch, or -audit event existed. The third attempt then deleted and absence-confirmed all -five owned sessions and removed its exact temporary resources through a -one-off operator cleanup; normal signal cleanup did not run. These attempts -establish preflight, adapter-boundary, and cleanup facts only. See the -[attempt audit](../09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md). - -The sequencing decision is now explicit: retain the existing substrate and run -one fresh real Codex proactive chain before extending it. OS-kill and heartbeat -matrices, a global cross-dispatch chain, external verifier and real Git closure, -Kimi parity, and further presentation work stay frozen unless the live run -shows one is its direct blocker. A completed chain with simulated verifier or -Git effects is still `blocked` and `liveProductEvidence=false`; it is the next -behavioral checkpoint, not M5.2 completion. +Six event-pump live attempts are retained. The first five failed closed at +successively narrower probe, adapter, lifecycle-binding, and turn-operation +boundaries. The sixth completed the real `A -> R -> same-A -> V -> dependent` +chain with one kickoff, nine bound native turns, zero later runner prompts or +direct activations, an irrelevant zero-turn control, and exact five-session and +temporary-resource cleanup. See the +[attempt audit](../09-reviews/2026-09-01-m5-2-real-codex-event-pump-attempt-audit.md) +and [behavior record](../09-reviews/2026-09-01-m5-2-real-codex-event-pump-behavior.md). + +The sequencing decision is now explicit: retain the proven path and reuse the +existing bounded Git-worktree and verifier foundations inside it. Add the +manual baseline and minimum critical negative/restart evidence; do not build a +new substrate. OS-kill and heartbeat matrices, a global cross-dispatch chain, +Kimi parity, new harnesses, and further presentation work remain frozen. The +completed chain is still `blocked` and `liveProductEvidence=false` because its +Git effects and verifier custody are simulated; it clears the behavioral +checkpoint, not M5.2. The Codex context-admission turn now uses the same private pre-turn baseline, fsynced journal, exact client key, and read-first restart boundary. The journal