G10: Remove gateway effort-from-variant inference and prove honest execution identity guarantees

kilo commented

2026-10-04 22:23:07 +00:00

Member

Goal

Product owner: Scarcity Router; G10/G04/G12. Source: Creatidy architecture v1.0 (2026-10-04), sections 1-5, 7-13, 14-18 via #173. Correct gateway discovery/resolution effort semantics and document/test the exact identity guarantees each actual channel can make.

Why and Current Evidence

Integrated develop 8d9d4b04bcb23fe19ff702b6209fbcb1537cdf1b: recommendation selector.CandidateEvaluation.to_dict correctly uses catalog reasoning_effort (D-057/#148). Gateway _resolve_logical_effort matches request effort against available_variants; discovery advertises identity.variant as reasoning_efforts. D-063 lane catalog has variant plan with effort null; opaque catalog variants may differ from effort. gateway_coordinator assigns executed_target=selected_target at dispatch; AuditRecord is dispatch provenance, not observed physical-model proof. Existing non-effort-qualified HTTP pin tests explicitly allow omitted wire effort. Exact external-harness identity retention remains To prove.

Scope

Use catalog effort independently from opaque identity in discovery/resolution/dispatch and prove backward-compatible mapping for shipped variants; handle multiple configurations without inventing effort. Bound/document deterministic requested/resolved/dispatched/observed semantics using existing metadata/audit before proposing additions. Distinguish provider/model/resource/source/account-pool/access mode/effort/harness/adapter version and plan-managed identity. No universal physical-model guarantee, ontology or silent behavior change for unrelated clients.

Acceptance Criteria

A catalog entry with opaque variant and independent known effort advertises/resolves/dispatches the effort correctly; null is unconfigured, literal none real, unknown and unsupported distinct. A plan-managed lane exposes no fictitious effort, rejects physical-model/effort requirements it cannot prove, and only promises an exact lane pin.
Regression tests exercise /v1/models plus logical/pinned ingress using actual projection/resolution, including plan lane, opaque variants, missing/multiple effort configurations, conflicting dialects and max-only families. Shipped logical models and exact-pin round trips remain compatible.
For each supported channel/version, deterministic evidence separates requested, resolved, dispatched and independently observed facts. A dispatch echo or configured subscription entitlement never becomes RUNTIME_VERIFIED/free-subscription proof. UNKNOWN/unattested physical identity and unsupported observation are explicit; a task demanding physical identity cannot use an unverifiable lane. Synthetic fixtures test these distinctions but do not establish actual observed execution.
Output control/continuation/helper-call limitations are reported honestly. Effort-less HTTP pins are not silently redefined as guaranteed provider effort; any necessary migration requires explicit compatibility decision, config fixtures and actionable diagnostics.
Docs/admission/metadata/audit assertions agree, no model self-report as identity proof; unknown never zero/none. The deterministic Router identity/effort correction may be delivered and this issue closed after full repository validation, producer-consumer identity fixtures and normal independent exact-HEAD technical/security/UX review. No live inference is needed or authorized for this delivery.

Separate Integration Gate

REAL_HARNESS_IDENTITY_ACCEPTANCE remains OPEN under existing #174/#181: separately owner-authorized, version-pinned real-harness acceptance must establish the actual requested/resolved/dispatched/observed evidence the supported source can provide. No configuration/dispatch echo/synthetic pass fabricates physical observation or cross-product readiness. #180 retains authority/migration control over affected workspace-editing lanes; this deterministic correction neither enables those lanes nor resolves that disposition.

Dependencies, Priority and Reuse

First-priority correctness/UX blocker for #174/#175 and no-PAYG/cost evidence. G09/#180 disposition governs workspace-editing lane integration, not the unrelated small opaque-variant/effort correction (comment14353). Reuse D-057 catalog output, current logical metadata, routing core, native Codex exact-effort checks, plan-lane adoption and existing dialect/continuation tests; no parallel identity stores. External adoption requires exact revision/files/license/attribution/semantic/negative/security/dependency/maintenance evidence. Guarantees are scoped to actual harness/protocol/adapter/source versions.
Refs #173, #174, #175, #148/#149, D-054/D-057/D-063/D-064. Future live observation/provider/harness access and inference remain separately authorized; registration and /loop grant none. No credentials or prompt/response contents in evidence.

Owner Decision

2026-10-05T16:41:45Z, continuation of /loop invocation 2026-10-05T12:38:32Z: owner selected Deterministic Scope, explicitly permitting this deterministic correction's delivery/closure after validation and independent review. Retain the named real-harness gate linked to #174/#181 and #180's affected-lane authority. This revises acceptance only, not live-effect authority or identity evidence requirements.

## Goal **Product owner: Scarcity Router**; G10/G04/G12. Source: Creatidy architecture v1.0 (2026-10-04), sections 1-5, 7-13, 14-18 via #173. Correct gateway discovery/resolution effort semantics and document/test the exact identity guarantees each actual channel can make. ## Why and Current Evidence Integrated develop `8d9d4b04bcb23fe19ff702b6209fbcb1537cdf1b`: recommendation `selector.CandidateEvaluation.to_dict` correctly uses catalog reasoning_effort (D-057/#148). Gateway `_resolve_logical_effort` matches request effort against available_variants; discovery advertises identity.variant as reasoning_efforts. D-063 lane catalog has variant `plan` with effort null; opaque catalog variants may differ from effort. `gateway_coordinator` assigns executed_target=selected_target at dispatch; AuditRecord is dispatch provenance, not observed physical-model proof. Existing non-effort-qualified HTTP pin tests explicitly allow omitted wire effort. Exact external-harness identity retention remains To prove. ## Scope Use catalog effort independently from opaque identity in discovery/resolution/dispatch and prove backward-compatible mapping for shipped variants; handle multiple configurations without inventing effort. Bound/document deterministic requested/resolved/dispatched/observed semantics using existing metadata/audit before proposing additions. Distinguish provider/model/resource/source/account-pool/access mode/effort/harness/adapter version and plan-managed identity. No universal physical-model guarantee, ontology or silent behavior change for unrelated clients. ## Acceptance Criteria 1. A catalog entry with opaque variant and independent known effort advertises/resolves/dispatches the effort correctly; null is unconfigured, literal `none` real, unknown and unsupported distinct. A plan-managed lane exposes no fictitious effort, rejects physical-model/effort requirements it cannot prove, and only promises an exact lane pin. 2. Regression tests exercise `/v1/models` plus logical/pinned ingress using actual projection/resolution, including plan lane, opaque variants, missing/multiple effort configurations, conflicting dialects and max-only families. Shipped logical models and exact-pin round trips remain compatible. 3. For each supported channel/version, deterministic evidence separates requested, resolved, dispatched and independently observed facts. A dispatch echo or configured subscription entitlement never becomes RUNTIME_VERIFIED/free-subscription proof. UNKNOWN/unattested physical identity and unsupported observation are explicit; a task demanding physical identity cannot use an unverifiable lane. Synthetic fixtures test these distinctions but do not establish actual observed execution. 4. Output control/continuation/helper-call limitations are reported honestly. Effort-less HTTP pins are not silently redefined as guaranteed provider effort; any necessary migration requires explicit compatibility decision, config fixtures and actionable diagnostics. 5. Docs/admission/metadata/audit assertions agree, no model self-report as identity proof; unknown never zero/none. The deterministic Router identity/effort correction may be delivered and this issue closed after full repository validation, producer-consumer identity fixtures and normal independent exact-HEAD technical/security/UX review. No live inference is needed or authorized for this delivery. ## Separate Integration Gate **REAL_HARNESS_IDENTITY_ACCEPTANCE** remains OPEN under existing #174/#181: separately owner-authorized, version-pinned real-harness acceptance must establish the actual requested/resolved/dispatched/observed evidence the supported source can provide. No configuration/dispatch echo/synthetic pass fabricates physical observation or cross-product readiness. #180 retains authority/migration control over affected workspace-editing lanes; this deterministic correction neither enables those lanes nor resolves that disposition. ## Dependencies, Priority and Reuse First-priority correctness/UX blocker for #174/#175 and no-PAYG/cost evidence. G09/#180 disposition governs workspace-editing lane integration, not the unrelated small opaque-variant/effort correction (comment14353). Reuse D-057 catalog output, current logical metadata, routing core, native Codex exact-effort checks, plan-lane adoption and existing dialect/continuation tests; no parallel identity stores. External adoption requires exact revision/files/license/attribution/semantic/negative/security/dependency/maintenance evidence. Guarantees are scoped to actual harness/protocol/adapter/source versions. Refs #173, #174, #175, #148/#149, D-054/D-057/D-063/D-064. Future live observation/provider/harness access and inference remain separately authorized; registration and /loop grant none. No credentials or prompt/response contents in evidence. ## Owner Decision 2026-10-05T16:41:45Z, continuation of /loop invocation `2026-10-05T12:38:32Z`: owner selected **Deterministic Scope**, explicitly permitting this deterministic correction's delivery/closure after validation and independent review. Retain the named real-harness gate linked to #174/#181 and #180's affected-lane authority. This revises acceptance only, not live-effect authority or identity evidence requirements.

kilo referenced this issue

2026-10-04 22:25:02 +00:00

G12: Prove access-mode, quota-pool and call-cost enforcement boundaries for accepted-result budgets #184

kilo added a new dependency

2026-10-04 22:27:54 +00:00

#174 G04: Prove the executable recommendation, admission and exact-pin contract with Kernel

kilo added a new dependency

2026-10-04 22:27:54 +00:00

#181 G10: Prove versioned harness-protocol compatibility and deliver the evidenced Responses subset

kilo added a new dependency

2026-10-04 22:27:55 +00:00

#183 G08: Define authorized Router state and reconnectable events for Console and CLI consumers

kilo referenced this issue from Creatidy/model-intelligence

2026-10-04 22:30:36 +00:00

Agree capability identity and calibration ownership with Router and Kernel #14

kilo referenced this issue from Creatidy/creatidy-kernel

2026-10-04 22:40:26 +00:00

[Kernel][G04 G10] Consume Router execution decisions and preserve Attempt-bound route identity #52

kilo commented

2026-10-04 23:06:44 +00:00

Author

Member

Identity/evidence counterparts from the single closeout reread: Creatidy/model-intelligence#14 owns public identity/raw-evidence/calibration agreement; Creatidy/creatidy-kernel#52 consumes Attempt-bound actual route and requested/resolved/observed facts after #47 compatibility proof. Router alone fixes this existing gateway effort projection; counterparts are not substitutes for the defect. #180 gates enabling affected workspace-editing lanes, not the small opaque-variant/effort correction for unrelated clients. Registered OPEN obligations do not prove runtime identity.

Identity/evidence counterparts from the single closeout reread: https://forgejo.creatidy.com/Creatidy/model-intelligence/issues/14 owns public identity/raw-evidence/calibration agreement; https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/52 consumes Attempt-bound actual route and requested/resolved/observed facts after #47 compatibility proof. Router alone fixes this existing gateway effort projection; counterparts are not substitutes for the defect. #180 gates enabling affected workspace-editing lanes, not the small opaque-variant/effort correction for unrelated clients. Registered OPEN obligations do not prove runtime identity.

kilo referenced this issue

2026-10-04 23:11:08 +00:00

Align Scarcity Router with the Creatidy system architecture and register actionable gaps #173

kilo referenced this issue

2026-10-04 23:43:29 +00:00

Align Scarcity Router with Creatidy architecture and register actionable gaps (#173) #187

kilo referenced this issue

2026-10-04 23:56:05 +00:00

G08: Define authorized Router state and reconnectable events for Console and CLI consumers #183

kilo referenced this issue

2026-10-05 00:10:49 +00:00

Align Scarcity Router with Creatidy architecture and register actionable gaps (#173) #187

kilo referenced this issue

2026-10-05 15:32:13 +00:00

G04: Fix exact model-variant narrowing in route_request without changing gateway pin admission #178

kilo referenced this issue

2026-10-05 16:47:56 +00:00

G04: Prove the executable recommendation, admission and exact-pin contract with Kernel #174

kilo referenced this issue

2026-10-05 16:47:56 +00:00

G10: Prove versioned harness-protocol compatibility and deliver the evidenced Responses subset #181

adrian.tkacz referenced this issue from a commit

2026-10-05 17:45:39 +00:00

Use configured catalog effort in gateway routing (#179)

kilo referenced this issue

2026-10-05 17:58:10 +00:00

Use configured catalog effort in gateway routing (#179) #193

kilo commented

2026-10-05 17:58:28 +00:00

Author

Member

Deterministic correction implemented in PR #193 under owner-revised acceptance. Base46cb9ab6958b63003d0b4e275590c04616fa405d; HEADd39597d98bf563878c3b3358c650066b8cd2e12c. Exact committed gate2702 PASS/17 skips, basedpyright0 diagnostics, locked sync and whitespace PASS; original focused source export169 tests PASS. Catalog effort, opaque/null/none/unknown/plan semantics, pin omission compatibility and exact output checks covered with actual core/HTTP/derived-source fixtures. No live or physical observation claims. REAL_HARNESS_IDENTITY_ACCEPTANCE stays OPEN under #174/#181; #180 unaffected. Fresh independent whole-PR review pending; same invocation2026-10-05T12:38:32Z, issue179 count0/10.

kilo commented

2026-10-05 20:27:34 +00:00

Author

Member

SAME invocation2026-10-05T12:38:32Z stopped STOP_AND_ASK for concurrent-writer handoff, not an engineering/test blocker. Review ordinal1/10 REQUEST_CHANGES on d39597d/base46cb9ab identified actual HTTP/native consumer gaps. Remediation is preserved uncommitted; latest safe worktree make check2705 PASS/17 skips, basedpyright0 diagnostics, real HTTP/native fake/worker-loopback regressions pass. No ordinal2 dispatched yet.

Precommit inspection found another writer's workflowPR194 integration and sync of this active branch. Fresh canonical/local PR193 HEAD e26d41efbf; base/merge-base d0df133ba1. PR open/unmerged. No history cleanup, commit/push/merge after detection; own seven-file remediation preserved. Need owner confirmation of intentional sync and sole-mutator handoff before refreezing/continuing same invocation and ordinal2. Deterministic179 scope remains accepted; REAL_HARNESS_IDENTITY_ACCEPTANCE stays OPEN174/181,180 unchanged. No live inference or observed physical identity claim.

SAME invocation2026-10-05T12:38:32Z stopped STOP_AND_ASK for concurrent-writer handoff, not an engineering/test blocker. Review ordinal1/10 REQUEST_CHANGES on d39597d/base46cb9ab identified actual HTTP/native consumer gaps. Remediation is preserved uncommitted; latest safe worktree make check2705 PASS/17 skips, basedpyright0 diagnostics, real HTTP/native fake/worker-loopback regressions pass. No ordinal2 dispatched yet. Precommit inspection found another writer's workflowPR194 integration and sync of this active branch. Fresh canonical/local PR193 HEAD e26d41efbf9a9af1a2984a6754e5f3fa0fe396c9; base/merge-base d0df133ba17ae2b645d8d24ea87ec46d1a5600a8. PR open/unmerged. No history cleanup, commit/push/merge after detection; own seven-file remediation preserved. Need owner confirmation of intentional sync and sole-mutator handoff before refreezing/continuing same invocation and ordinal2. Deterministic179 scope remains accepted; REAL_HARNESS_IDENTITY_ACCEPTANCE stays OPEN174/181,180 unchanged. No live inference or observed physical identity claim.

adrian.tkacz referenced this issue from a commit

2026-10-05 20:49:24 +00:00

Preserve HTTP defaults and decouple native catalog effort (#179)

adrian.tkacz referenced this issue from a commit

2026-10-05 21:36:22 +00:00

Reject native alias effort conflicts before dispatch (#179)

kilo referenced this issue from a commit

2026-10-05 21:56:47 +00:00

Merge PR #193: deterministic catalog effort and identity (#179)

kilo commented

2026-10-05 21:57:47 +00:00

Author

Member

Completed deterministic #179 acceptance in SAME /loop invocation2026-10-05T12:38:32Z. PR193 merged through Forgejo stylemerge as662facdc75fea06c500a538face0d0477e230959. Canonical develop fetched at that exact merge; approved base d0df133ba1 and HEAD e9a829e06d are its parents/ancestors, integrated tree equals approved tree.

Acceptance verified from actual core/projection/HTTP/native consumer fixtures and complete source review: configured catalog effort separated from opaque identity; null/none/unknown, plan lanes and physical-model refusal, exact pins, multiple configs, dialect conflict, max-only HTTP omission, native exact controls/source binding and high-profile alias refusal beforeturn. Existing HTTP carried/omitted behavior, worker loopback, native auth/isolation/workspace rights and quota truth preserved. Requested/resolved/dispatched are not observed physical identity or billing/free proof; audit schema unchanged and D071 records bounds.

Review179 history preserved:1 REQUEST_CHANGES atd39597d/base46cb9ab; remediation3c1b181;2 REQUEST_CHANGES at3c1b181/currentbase; remediatione9a829e;3 APPROVE/findings[] at exact currentHEAD/base, technical/security/UX/reuse covered. Exact clean-HEAD gate2707 PASS/17 skips, basedpyright0 diagnostics, locked sync and whitespace PASS; reviewer independently170 synthetic tests and typecheck, assessed system-recorded sanitized full gate. Owner-confirmed194/e26d sync preserved with exclusive handoff.

Closing only owner-approved deterministic correction. REAL_HARNESS_IDENTITY_ACCEPTANCE remains OPEN174/181;180 affected workspace-lane authority unresolved and untouched. No live inference, actual-model observation, paid/free attestation, cross-product readiness, release or deployment claim.

Completed deterministic #179 acceptance in SAME /loop invocation2026-10-05T12:38:32Z. PR193 merged through Forgejo stylemerge as662facdc75fea06c500a538face0d0477e230959. Canonical develop fetched at that exact merge; approved base d0df133ba17ae2b645d8d24ea87ec46d1a5600a8 and HEAD e9a829e06d1d1c4c7166516080760c66bbc59ba4 are its parents/ancestors, integrated tree equals approved tree. Acceptance verified from actual core/projection/HTTP/native consumer fixtures and complete source review: configured catalog effort separated from opaque identity; null/none/unknown, plan lanes and physical-model refusal, exact pins, multiple configs, dialect conflict, max-only HTTP omission, native exact controls/source binding and high-profile alias refusal beforeturn. Existing HTTP carried/omitted behavior, worker loopback, native auth/isolation/workspace rights and quota truth preserved. Requested/resolved/dispatched are not observed physical identity or billing/free proof; audit schema unchanged and D071 records bounds. Review179 history preserved:1 REQUEST_CHANGES atd39597d/base46cb9ab; remediation3c1b181;2 REQUEST_CHANGES at3c1b181/currentbase; remediatione9a829e;3 APPROVE/findings[] at exact currentHEAD/base, technical/security/UX/reuse covered. Exact clean-HEAD gate2707 PASS/17 skips, basedpyright0 diagnostics, locked sync and whitespace PASS; reviewer independently170 synthetic tests and typecheck, assessed system-recorded sanitized full gate. Owner-confirmed194/e26d sync preserved with exclusive handoff. Closing only owner-approved deterministic correction. REAL_HARNESS_IDENTITY_ACCEPTANCE remains OPEN174/181;180 affected workspace-lane authority unresolved and untouched. No live inference, actual-model observation, paid/free attestation, cross-product readiness, release or deployment claim.

kilo closed this issue

2026-10-05 21:57:57 +00:00

kilo referenced this issue from Creatidy/creatidy-kernel

2026-10-27 00:30:58 +00:00

[Kernel][G04 G10] Consume Router execution decisions and preserve Attempt-bound route identity #52

kilo referenced this issue

2026-10-27 21:41:30 +00:00

Record D-083 backlog disposition: re-home excluded wontfix requirements (#228) #229

kilo referenced this issue

2026-10-28 11:07:10 +00:00

Record D-083 backlog disposition: re-home excluded wontfix requirements (#228) #229