release(v9.0.1): wave-parallel isolation:worktree + generator→evaluator firewall + dogfood63 hardening - #97
Merged
Merged
Conversation
…tor firewall (dogfood62 FIX-1/2/3) Fixes the three criticals the v9.0.0 first real wave-parallel dogfood surfaced. FIX-1 (wave-parallel executes): redesign the per-ticket worktree mechanism around the platform's native isolation:"worktree" Task parameter (the prior manual `git worktree add` + cwd-at-spawn path was unreachable -- Phase-0 S1: the Task tool has no cwd parameter). The scheduler spawns each ticket-executor with isolation:"worktree" + MAIN_REPO=<abs>; the executor self-creates the .simple-workflow -> main-checkout symlink as its first step. The orchestrator advances the cross-wave base by checking out the local-only ap-integration/<parent> branch IN its own main checkout and merging each completed worktree-agent-<id> branch there (no dedicated integration worktree -- a branch cannot be checked out in two worktrees; S5 validated isolation:worktree bases on the orchestrator HEAD). A worktree-capability pre-flight runs before the integration checkout; on an isolation-unsupported host it deletes the parallel_mode: line (persisting the downgrade so resume does not re-thrash) and falls back to byte-identical serial (SW_PARALLEL_WORKTREE_PREFLIGHT_MODE, default on, unknown->on). CT-WORKTREE-1/2/3/8/9 rewritten + CT-FIX1-SPAWN-ISOLATION/SYMLINK/PREFLIGHT. FIX-2 (generator->evaluator firewall, Bash + Skill): re-key the inline-git-commit authorization from the forgeable phases.ship.status proxy to a non-forgeable .ship-commit-nonce file /ship writes before its Step-3 commit (unconditional, not knob-gated); deny git add/commit/mv/push from a review agent (git worktree exempt) + namespaced pipeline-skill invocation from a review agent (new hooks/pre-skill-contract-guard.sh). The .agent_type identity gate (Phase-0 S2: native in the PreToolUse payload) + unconditional simple-workflow: strip is the sole mechanism (S3: tools: allowlists don't enforce Bash-subcommand granularity). SW_REVIEW_FIREWALL_MODE, default metric-only. FIX-3 (phase-state write-authority): pre-state-transition.sh detects every advancement (not just status:skipped) identity-free, and Detection 4 denies a review/evaluator agent (all six, bare + namespaced, incl ticket-evaluator) writing an advancement; the Bash mirror (Detection 3) gains current_phase/overall_status + bare ship. Fail-open-on-empty (orchestrator/generators always allowed). SW_STATE_ADVANCE_GUARD_MODE, default metric-only. All firewall guards are autopilot-context-gated (no regression on a normal git commit), fail-open (exit 0; a block is decision JSON), silent on missing jq. Every new default is kill-switched; parallel=off stays byte-identical to v9.0.0. Verification: test-skill-contracts 912/912 (CT-MODE-13/14 green), pre-bash 24/24, state-transition 21/21 [(a)-(f) + pending->completed canary ALLOW], pre-skill 9/9 (new), path 145/145, run-all ALL PASSED, shellcheck -S error clean (3 hooks), hooks.json valid, DECONTAM 0. Adversarial: FIX-1 read-only review GO-WITH-NOTES (5/5 claims survive, pre-flight-ordering edge fixed); FIX-2/3 4-lens panel all SURVIVE (0 blocker, 2 minor fixed: property-CT token-boundary + stale header). Phase-0 spikes S1-S5 (headless claude -p, CC 2.1.191). Owed (gates the metric-only->on knob promotion, a follow-up): re-dogfood AC-6 (firewall mechanical) + AC-8 (parallel end-to-end + SubagentStop under an isolation worktree). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mw2bH4wbEPeebXsvSG6rWe
…-remote landing + SubagentStop observability + env-isolation) The v9.0.1 re-dogfood (test_simple_workflow63, a 3-ticket wave-parallel run with the firewall knobs on) PASSED AC-8 decisively (truly-concurrent wave-0 spawn, isolation worktrees, git-proven cross-wave integration, 61 product tests, normal_completion) and AC-6 with zero firewall false-trips on legit review activity. It surfaced four low/medium findings, all self-recovered in the run, hardened here: (a) Nonce same-command false-trip (FIX-2 refinement). /ship combined the Step-2.5 `: > .../.ship-commit-nonce` write and the Step-3 `git commit` in one && chain; PreToolUse inspects the whole command before the `: >` runs, so the nonce was absent on disk -> false-block (1 of 3 ship paths). The nonce gate (pre-bash-contract-guard.sh) now also scans $COMMAND for a co-located active-tree nonce write and treats it as present; a bare `git commit` (no such write) is still blocked. ship/SKILL.md documents both forms. NOT a FIX-1xFIX-2 path mismatch (the retry from the worktree PWD succeeded -> write+check resolve the same file via the symlink). CT-FIX2-NONCE-COLOCATED. (b) No-remote main-advance (FIX-1 refinement). With no remote there are no per-ticket PRs to carry the integrated work, so the orchestrator improvised a `git checkout main && git merge --ff-only ap-integration/<parent>`. The post-loop now codifies this: no-remote -> ff-only-advance the start ref to the integrated tip (with a divergence fallback that leaves the work on ap-integration + warns, never a forced merge commit); with a remote -> restore-only (PRs are the landing surface). CT-FIX1-NOREMOTE-LANDING. (c) SubagentStop main_checkout_root resolution (AC-8 owed item). The relocated checkpoint guards resolve the phase-state via the orchestrator-written absolute main_checkout_root; subagent transcripts do not capture hook stderr, so the resolution was unverifiable from the dogfood. scout/impl-checkpoint-guard.sh now emit a behaviour-neutral `main_checkout_root resolution` marker, unit-tested end-to-end through a worktree `.simple-workflow` symlink (T-PAR-9 + non-vacuity control in test-scout/impl-checkpoint-guard.sh). (d) Build/test tooling isolation (eval-sandbox). A wave-0 executor installed pytest into the system interpreter via --break-system-packages, persisting on the host. agents/implementer.md now requires tooling installs to be isolated to the workspace (venv / project-local / container) and forbids mutating a shared/ global/system toolchain that persists outside the workspace (agnostic: the operative property is persists-outside-the-workspace; examples illustrative). CT-FIX4-ENV-ISOLATION. The metric-only->on knob promotion stays a follow-up (the clean run produced no breach, so the live review-agent deny path is still owed). Verification: test-skill-contracts 914/914 (+CT-FIX1-NOREMOTE-LANDING, CT-FIX2-NONCE-COLOCATED, CT-FIX4-ENV-ISOLATION), pre-bash 26/26, scout-checkpoint 29/29 (+T-PAR-9), impl-checkpoint 23/23 (+T-PAR-9), state-transition 21/21, pre-skill 9/9, path 145/145, run-all.sh ALL PASSED, shellcheck -S error clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mw2bH4wbEPeebXsvSG6rWe
Two assigned-but-unused variables from the FIX-3 implementation tripped CI's `shellcheck --severity=warning` (local checks had used `-S error`, which is errors-only): TRANSCRIPT_PATH in pre-state-transition.sh (the FIX-3 plan added it speculatively; Detection 4 uses only AGENT_TYPE) and STATE_ADV in test-state-transition-guard.sh (the test uses PS_ADV). Both removed; the tree-prepare side effect is preserved. shellcheck --severity=warning now clean on hooks/*.sh + tests/*.sh; test-state-transition-guard.sh 21/21. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mw2bH4wbEPeebXsvSG6rWe
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v9.0.1 — wave-parallel isolation:worktree + generator→evaluator firewall
Fixes the three criticals the v9.0.0 first real wave-parallel dogfood surfaced, plus four refinements from the v9.0.1 re-dogfood (dogfood63). Non-breaking: every new default is
metric-only/ kill-switched, andparallel=offstays byte-identical to v9.0.0.FIX-1 — wave-parallel executes (isolation:"worktree" redesign)
v9.0.0 wave-parallel fell back to serial (the executor was spawned at repo-root cwd →
EnterWorktreerejected). Phase-0 spikes settled the mechanism: the Task tool has nocwdparam, butisolation:"worktree"is native and bases the worktree on the orchestrator's HEAD. The scheduler now spawns eachticket-executorwithisolation:"worktree"+MAIN_REPO; the executor self-creates the.simple-workflowsymlink first; the orchestrator checks out the local-onlyap-integration/<parent>branch in its own main checkout and merges completedworktree-agent-<id>branches there (no dedicated integration worktree). A worktree-capability pre-flight falls back to byte-identical serial on an unsupported host.FIX-2 + FIX-3 — generator→evaluator→audit firewall
A
.agent_typePreToolUse identity gate denies a review/evaluator subagent the gitadd/commit/mv/push+ pipeline-skill + phase-advancement vectors; the inline-git commitauthorization is re-keyed from a forgeablephases.ship.statusflag to a non-forgeable/ship-issued.ship-commit-nonce. Shipsmetric-onlybehindSW_REVIEW_FIREWALL_MODE/SW_STATE_ADVANCE_GUARD_MODE. Per-agenttools:allowlists can't close the Bash vector (Phase-0 S3), so the hook is the sole mechanism.dogfood63 hardening (re-dogfood, all low/medium, self-recovered)
AC-8 PASSED decisively; AC-6 ran with zero firewall false-trips. Four refinements: (a) nonce gate tolerates a co-located
: > nonce && git commit(PreToolUse-timing false-trip fix; bare commit still blocked); (b) codified no-remote post-loop landing (--ff-onlyadvance + divergence fallback); (c) SubagentStop guards emit amain_checkout_root resolutionmarker, unit-tested through a worktree symlink (closes the AC-8 owed item); (d) implementer must isolate build/test tooling installs to the workspace (no--break-system-packagessystem mutation).Verification
test-skill-contracts914/914 (new CT-FIX1-SPAWN-ISOLATION/SYMLINK/PREFLIGHT/NOREMOTE-LANDING, CT-FIX2-, CT-FIX3-, CT-FIX4-ENV-ISOLATION; CT-WORKTREE-1/2/3/8/9 rewritten; CT-MODE-13/14, DECONTAM, EV-MODEL all green);pre-bash26/26;scout-checkpoint29/29 +impl-checkpoint23/23 (T-PAR-9 worktree-symlink resolution);state-transition21/21;pre-skill9/9 (new);path-consistency145/145;run-all.shALL PASSED;shellcheck -S errorclean.plugin.json9.0.1 == newest CHANGELOG[9.0.1].Phase-0 spikes S1–S5 + the dogfood63 forensic eval drive every mechanism. Owed (follow-up): a live review-agent deny gates the
metric-only → onknob promotion (the clean run produced no breach). SeeCHANGELOG.md[9.0.1].🤖 Generated with Claude Code
https://claude.ai/code/session_01Mw2bH4wbEPeebXsvSG6rWe