Creatidy/creatidy-kernel

Fork 0

[K5 correction] Open exact-head PRs through Forgejo AGit #24

New issue

Closed

opened 2026-09-26 19:34:00 +00:00 by kilo · 5 comments

kilo commented

2026-09-26 19:34:00 +00:00

Member

Goal

Replace K5's live write-once snapshot-branch PR creation with Forgejo 15.0.8 AGit creation from the exact authorized candidate commit. Preserve the reviewed K5 foundation in PR #22 as historical evidence; this issue is a separate, narrowly bounded correction with its own branch, PR, independent review, and remediation budget.

Why

The owner superseded the snapshot-isolation mechanism after a single authorized deployment probe demonstrated AGit PR creation from a pushed full SHA without resolving an ordinary mutable source branch. The existing snapshot-gated live pr capability remains unsupported without external infrastructure, while AGit offers an exact-head creation path without weakening accepted-candidate authority.

Scope

Adapter-edge AGit create effect: push exactly the authorized full commit SHA to refs/for/<authorized-base> in the bound target repository. Use a fresh collision-resistant Operation topic never intentionally reused for another logical creation. Do not push from mutable HEAD or create an ordinary feature/snapshot head branch for this effect.
Treat the base authority as target repository + base branch identity; record observed base SHA as provenance only. Validate the AGit domain receipt, resulting PR identity, repository, base ref, and current full head SHA == authorized candidate before acknowledgement. A Git exit code or uploaded object alone is not domain acceptance.
Preserve durable Operation intent, bounded output/timeout, uncertainty reconciliation and no blind retry after ambiguous/lost responses. Distinguish a new PR from a same-topic update/collision; do not re-use a topic for another operation. A later head movement invalidates prior exact-head evidence and requires fresh subject checks before any later authoritative action.
Update the shared fake/reference conformance suite and issue-specific contract/documentation for the new live mechanism. Keep Forgejo payloads and AGit details at the adapter edge (adapters -> ports -> core). Remove obsolete live snapshot-isolation requirements only as part of this correction.

Acceptance Criteria

The fake and Forgejo adapter pass one shared synthetic conformance suite for exact-SHA AGit PR creation, target repository/base identity, immutable accepted SHA verification, observed base SHA evidence, collision-resistant never-reused topic, topic collision/update refusal, and no ordinary mutable source branch on the creation path.
Success is a validated domain receipt plus authoritative read-back of PR identity, expected repository and base ref, and full current head SHA equal to the authorized candidate. A mismatched head never acknowledges the operation; base-tip movement alone does not change creation authority.
Lost/failed/ambiguous push responses never trigger blind repeat. Recovery uses a durably known remote reference or otherwise remains UNKNOWN; existing PR updates, same-topic collisions, permission failures and unsupported capability are distinct and fail closed.
A later PR head change makes previously recorded exact-head evidence stale; K5 still has no merge/deploy effect. Core remains independent of live Forgejo and does not acquire AGit-specific payload semantics.
make check and make package-check pass, required Forgejo CI succeeds, and a fresh independently routed reviewer reviews the entire correction PR at its exact HEAD. The existing PR #22 delivery ledger and its 10/10 remediation budget are not rewritten or extended.

Constraints

Branch from origin/develop after the owner-approved safe K5 foundation PR #22 is integrated. One correction issue, one feature branch/PR to develop, independent whole-PR review; no replacement PR for #22 and no auto-merge of this correction.
No K6/K7, merge automation, generic Git abstraction, new server-side hooks, snapshot authority, cross-repository head store, or change to main.
The disposable AGit probe PR #23 is evidence only and must never be merged; no second probe push or topic-update experiment is authorized by this issue.
The owner decision to adopt AGit supersedes the earlier snapshot mechanism, not exact accepted-head authority or review history.

Links

Parent K5 issue #9: #9
Already-reviewed safe foundation PR #22: #22
Successful disposable AGit deployment probe PR #23: #23 (creation push of 9a3cbc928aca8c5dc2a3b5414f0799b9cee93df6 to refs/for/develop, read back exactly, DO NOT MERGE)
Accepted architecture: docs/adr/0003-durability-and-effects.md, docs/adr/0004-ports-and-resources.md, docs/adr/0005-authority-and-acceptance.md, docs/architecture/contracts.md

## Goal Replace K5's live write-once snapshot-branch PR creation with Forgejo 15.0.8 AGit creation from the exact authorized candidate commit. Preserve the reviewed K5 foundation in PR #22 as historical evidence; this issue is a separate, narrowly bounded correction with its own branch, PR, independent review, and remediation budget. ## Why The owner superseded the snapshot-isolation mechanism after a single authorized deployment probe demonstrated AGit PR creation from a pushed full SHA without resolving an ordinary mutable source branch. The existing snapshot-gated live `pr` capability remains unsupported without external infrastructure, while AGit offers an exact-head creation path without weakening accepted-candidate authority. ## Scope - Adapter-edge AGit create effect: push exactly the authorized full commit SHA to `refs/for/<authorized-base>` in the bound target repository. Use a fresh collision-resistant Operation topic never intentionally reused for another logical creation. Do not push from mutable `HEAD` or create an ordinary feature/snapshot head branch for this effect. - Treat the base authority as target repository + base branch identity; record observed base SHA as provenance only. Validate the AGit domain receipt, resulting PR identity, repository, base ref, and current full head SHA == authorized candidate before acknowledgement. A Git exit code or uploaded object alone is not domain acceptance. - Preserve durable Operation intent, bounded output/timeout, uncertainty reconciliation and no blind retry after ambiguous/lost responses. Distinguish a new PR from a same-topic update/collision; do not re-use a topic for another operation. A later head movement invalidates prior exact-head evidence and requires fresh subject checks before any later authoritative action. - Update the shared fake/reference conformance suite and issue-specific contract/documentation for the new live mechanism. Keep Forgejo payloads and AGit details at the adapter edge (`adapters -> ports -> core`). Remove obsolete live snapshot-isolation requirements only as part of this correction. ## Acceptance Criteria - [ ] The fake and Forgejo adapter pass one shared synthetic conformance suite for exact-SHA AGit PR creation, target repository/base identity, immutable accepted SHA verification, observed base SHA evidence, collision-resistant never-reused topic, topic collision/update refusal, and no ordinary mutable source branch on the creation path. - [ ] Success is a validated domain receipt plus authoritative read-back of PR identity, expected repository and base ref, and full current head SHA equal to the authorized candidate. A mismatched head never acknowledges the operation; base-tip movement alone does not change creation authority. - [ ] Lost/failed/ambiguous push responses never trigger blind repeat. Recovery uses a durably known remote reference or otherwise remains UNKNOWN; existing PR updates, same-topic collisions, permission failures and unsupported capability are distinct and fail closed. - [ ] A later PR head change makes previously recorded exact-head evidence stale; K5 still has no merge/deploy effect. Core remains independent of live Forgejo and does not acquire AGit-specific payload semantics. - [ ] `make check` and `make package-check` pass, required Forgejo CI succeeds, and a fresh independently routed reviewer reviews the entire correction PR at its exact HEAD. The existing PR #22 delivery ledger and its 10/10 remediation budget are not rewritten or extended. ## Constraints - Branch from `origin/develop` **after** the owner-approved safe K5 foundation PR #22 is integrated. One correction issue, one feature branch/PR to `develop`, independent whole-PR review; no replacement PR for #22 and no auto-merge of this correction. - No K6/K7, merge automation, generic Git abstraction, new server-side hooks, snapshot authority, cross-repository head store, or change to `main`. - The disposable AGit probe PR #23 is evidence only and must never be merged; no second probe push or topic-update experiment is authorized by this issue. - The owner decision to adopt AGit supersedes the earlier snapshot *mechanism*, not exact accepted-head authority or review history. ## Links - Parent K5 issue #9: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/9 - Already-reviewed safe foundation PR #22: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/22 - Successful disposable AGit deployment probe PR #23: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/23 (creation push of `9a3cbc928aca8c5dc2a3b5414f0799b9cee93df6` to `refs/for/develop`, read back exactly, DO NOT MERGE) - Accepted architecture: `docs/adr/0003-durability-and-effects.md`, `docs/adr/0004-ports-and-resources.md`, `docs/adr/0005-authority-and-acceptance.md`, `docs/architecture/contracts.md`

kilo referenced this issue

2026-09-26 19:34:32 +00:00

[K5] Forge port and Forgejo adapter #9

kilo commented

2026-09-26 19:34:56 +00:00

Author

Member

Delivery prerequisite status (read-only/normal-platform attempt, 2026-09-26): foundation PR #22 remains open at reviewed/CI-green HEAD 4f412d8022e4f1f39a1bcebf3f6afb17a89a31fa; normal non-forced Forgejo MCP merge returned HTTP 405 for current kilo identity (push=false). No direct Git bypass, force merge or replacement PR was attempted. Wait for an authorized normal integration into develop before branching or implementing this issue, preserving #9 open. Parent decision link: #9 (comment). Probe PR #23 is DO NOT MERGE.

Delivery prerequisite status (read-only/normal-platform attempt, 2026-09-26): foundation PR #22 remains open at reviewed/CI-green HEAD `4f412d8022e4f1f39a1bcebf3f6afb17a89a31fa`; normal non-forced Forgejo MCP merge returned HTTP 405 for current `kilo` identity (`push=false`). No direct Git bypass, force merge or replacement PR was attempted. Wait for an authorized normal integration into `develop` before branching or implementing this issue, preserving #9 open. Parent decision link: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/9#issuecomment-12019. Probe PR #23 is DO NOT MERGE.

kilo referenced this issue

2026-09-26 19:36:04 +00:00

[K5] Forge port and Forgejo adapter #9

~~kilo referenced this issue 2026-09-26 22:09:57 +00:00~~

[K5 correction] Create exact-head PRs through Forgejo AGit #25

kilo commented

2026-09-26 22:10:08 +00:00

Author

Member

Delivery ledger (issue #24, correction PR #25): branch issue-24-agit-pr -> develop; initial HEAD 9663fe754b9cc2ae1f602c9b1e8535a7be23abef; max_remediation_cycles = 10; remediation_used = 0. PR: #25 . Scope: exact-SHA Forgejo AGit creation and shared fake/reference conformance; no live second probe. Local evidence at this HEAD: make check passed (486 tests; lock, formatting, lint, basedpyright, imports, secrets, diff); make package-check passed. Independent full-PR review and required CI pending. Keep #24 open and PR #25 unmerged; historical #22 ledger/budget unchanged. Subsequent numbered review and remediation entries will remain in this issue thread.

Delivery ledger (issue #24, correction PR #25): branch `issue-24-agit-pr` -> `develop`; initial HEAD `9663fe754b9cc2ae1f602c9b1e8535a7be23abef`; `max_remediation_cycles = 10`; `remediation_used = 0`. PR: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/25 . Scope: exact-SHA Forgejo AGit creation and shared fake/reference conformance; no live second probe. Local evidence at this HEAD: `make check` passed (486 tests; lock, formatting, lint, basedpyright, imports, secrets, diff); `make package-check` passed. Independent full-PR review and required CI pending. Keep #24 open and PR #25 unmerged; historical #22 ledger/budget unchanged. Subsequent numbered review and remediation entries will remain in this issue thread.

kilo commented

2026-09-26 22:20:36 +00:00

Author

Member

Delivery ledger review cycle 1 (linked to initial ledger #issuecomment-12086): reviewed HEAD 9663fe754b9cc2ae1f602c9b1e8535a7be23abef, base develop @ 8a4a31cf1647f693ce8b7cc27cc265ea27b9f863. Profile repository_review; monotone task/review floor L4, capability minima reasoning/coding/tool_use 5/5/5, requires_tool_use=true, requires_reasoning_mode=true; author floor unknown. Router selected = dispatched openai/gpt-5.6-sol/medium (provider adapter identity openai -> openai, no fallback); catalog v4, profile policy v8, resource policy v1, degraded=false. Agent Manager reviewer session ses_f2039b17effejEYYcGkAFUY3My, DISPATCH_VERIFIED from explicit resolved model GPT-5.6 Sol (openai) · medium; session completed direct whole-PR review (unverified child analysis not used as verdict). Independent review #25 (comment) ; substantive_verdict=REQUEST_CHANGES, forgejo_review_state=COMMENT, platform_approval_recorded=false, platform_identity_limitation=kilo PR author cannot submit formal REQUEST_CHANGES (Forgejo rejected 'reject your own pull is not allowed'). Blocking findings 2: R1-1 nonzero AGit porcelain rejection classification; R1-2 moved PR head stale evidence. Remediation pending; resulting HEAD unchanged; remediation_used=0/10 pending validated change. Additional review observation about durable topic test coverage and temporary read-back recovery handle is being checked in scope. CI run #2002 passed at reviewed HEAD; issue remains open and PR unmerged.

Delivery ledger review cycle 1 (linked to initial ledger #issuecomment-12086): reviewed HEAD `9663fe754b9cc2ae1f602c9b1e8535a7be23abef`, base `develop` @ `8a4a31cf1647f693ce8b7cc27cc265ea27b9f863`. Profile `repository_review`; monotone task/review floor L4, capability minima reasoning/coding/tool_use 5/5/5, requires_tool_use=true, requires_reasoning_mode=true; author floor unknown. Router selected = dispatched `openai/gpt-5.6-sol/medium` (provider adapter identity `openai` -> `openai`, no fallback); catalog v4, profile policy v8, resource policy v1, degraded=false. Agent Manager reviewer session `ses_f2039b17effejEYYcGkAFUY3My`, `DISPATCH_VERIFIED` from explicit resolved model `GPT-5.6 Sol (openai) · medium`; session completed direct whole-PR review (unverified child analysis not used as verdict). Independent review https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/25#issuecomment-12089 ; `substantive_verdict=REQUEST_CHANGES`, `forgejo_review_state=COMMENT`, `platform_approval_recorded=false`, `platform_identity_limitation=kilo PR author cannot submit formal REQUEST_CHANGES (Forgejo rejected 'reject your own pull is not allowed')`. Blocking findings 2: R1-1 nonzero AGit porcelain rejection classification; R1-2 moved PR head stale evidence. Remediation pending; resulting HEAD unchanged; `remediation_used=0/10` pending validated change. Additional review observation about durable topic test coverage and temporary read-back recovery handle is being checked in scope. CI run #2002 passed at reviewed HEAD; issue remains open and PR unmerged.

kilo commented

2026-09-26 22:25:10 +00:00

Author

Member

Delivery ledger remediation 1, linked to review cycle 1 (#issuecomment-12090): valid in-scope blockers R1-1 (nonzero AGit porcelain rejection evidence) and R1-2 (moved PR head stale evidence) fixed together on the same branch/PR, plus the review's in-scope recovery-handle and topic coverage gaps. Resulting HEAD 723fcfa9f5748c5629a486960ee17ea2c116daf8 confirmed from PR #25 metadata; remediation_used=1/10, review cycle 1 remediation status done. make check passed (490 tests, format/lint/basedpyright/import/secrets/diff) and make package-check passed before push. New HEAD has no inherited approval; required fresh independent whole-PR review and exact-HEAD CI pending. #24 remains open, PR #25 unmerged.

Delivery ledger remediation 1, linked to review cycle 1 (#issuecomment-12090): valid in-scope blockers R1-1 (nonzero AGit porcelain rejection evidence) and R1-2 (moved PR head stale evidence) fixed together on the **same** branch/PR, plus the review's in-scope recovery-handle and topic coverage gaps. Resulting HEAD `723fcfa9f5748c5629a486960ee17ea2c116daf8` confirmed from PR #25 metadata; `remediation_used=1/10`, review cycle 1 remediation status `done`. `make check` passed (490 tests, format/lint/basedpyright/import/secrets/diff) and `make package-check` passed before push. New HEAD has no inherited approval; required fresh independent whole-PR review and exact-HEAD CI pending. #24 remains open, PR #25 unmerged.

kilo commented

2026-09-26 22:29:36 +00:00

Author

Member

Delivery ledger review cycle 2 / final readiness (initial ledger #issuecomment-12086; cycle 1 #issuecomment-12090; remediation 1 #issuecomment-12093): exact reviewed HEAD 723fcfa9f5748c5629a486960ee17ea2c116daf8, PR #25 base develop @ 8a4a31cf1647f693ce8b7cc27cc265ea27b9f863, branch issue-24-agit-pr. Profile repository_review; monotone L4 floor reasoning/coding/tool_use 5/5/5, requires_tool_use=true, requires_reasoning_mode=true, author floor unknown. Router selected = dispatched openai/gpt-5.6-sol/medium; provider adapter openai -> openai, routing_result=SELECTED (no fallback); catalog v4, profile policy v8, resource policy v1, degraded=false. Reviewer Agent Manager session ses_f202cb7fcffeuPJFCPY1AMOPxH, DISPATCH_VERIFIED from explicit GPT-5.6 Sol (openai) · medium; fresh, read-only whole-PR review completed. Independent review #25 (comment) (review #633): substantive_verdict=APPROVE, blocking findings=0, forgejo_review_state=COMMENT, platform_approval_recorded=false. platform_identity_limitation: configured kilo identity authored PR, Forgejo rejected formal APPROVED with approve your own pull is not allowed; persisted COMMENT explicitly contains the substantive APPROVE. Remediation status=none after cycle 2, resulting HEAD unchanged, remediation_used=1/10. R1-1 and R1-2 from the historical first HEAD are remediated. Local validation at exact HEAD: make check passed (490 tests, lock/format/lint/basedpyright/imports/secrets/diff); make package-check passed; no dependency/tooling change requiring audit. Forgejo pull_request CI run #2003 succeeded at this full SHA: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/54 . Issue #24 acceptance criteria satisfied by synthetic fake/reference conformance and authoritative exact-head path; no second live probe was run. Final condition READY_FOR_OWNER_MERGE; issue remains open, PR #25 remains unmerged, main untouched. Branch-protection rules are not observable to this account (admin-read endpoint denied), so no formal platform-approval requirement is asserted or bypassed.

Delivery ledger review cycle 2 / final readiness (initial ledger #issuecomment-12086; cycle 1 #issuecomment-12090; remediation 1 #issuecomment-12093): exact reviewed HEAD `723fcfa9f5748c5629a486960ee17ea2c116daf8`, PR #25 base `develop` @ `8a4a31cf1647f693ce8b7cc27cc265ea27b9f863`, branch `issue-24-agit-pr`. Profile `repository_review`; monotone L4 floor reasoning/coding/tool_use 5/5/5, requires_tool_use=true, requires_reasoning_mode=true, author floor unknown. Router selected = dispatched `openai/gpt-5.6-sol/medium`; provider adapter `openai` -> `openai`, routing_result=SELECTED (no fallback); catalog v4, profile policy v8, resource policy v1, degraded=false. Reviewer Agent Manager session `ses_f202cb7fcffeuPJFCPY1AMOPxH`, `DISPATCH_VERIFIED` from explicit `GPT-5.6 Sol (openai) · medium`; fresh, read-only whole-PR review completed. Independent review https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/25#issuecomment-12095 (review #633): `substantive_verdict=APPROVE`, blocking findings=0, `forgejo_review_state=COMMENT`, `platform_approval_recorded=false`. `platform_identity_limitation`: configured `kilo` identity authored PR, Forgejo rejected formal APPROVED with `approve your own pull is not allowed`; persisted COMMENT explicitly contains the substantive APPROVE. Remediation status=none after cycle 2, resulting HEAD unchanged, `remediation_used=1/10`. R1-1 and R1-2 from the historical first HEAD are remediated. Local validation at exact HEAD: `make check` passed (490 tests, lock/format/lint/basedpyright/imports/secrets/diff); `make package-check` passed; no dependency/tooling change requiring audit. Forgejo pull_request CI run #2003 succeeded at this full SHA: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/54 . Issue #24 acceptance criteria satisfied by synthetic fake/reference conformance and authoritative exact-head path; no second live probe was run. Final condition `READY_FOR_OWNER_MERGE`; issue remains open, PR #25 remains unmerged, `main` untouched. Branch-protection rules are not observable to this account (admin-read endpoint denied), so no formal platform-approval requirement is asserted or bypassed.

kilo referenced this issue from a pull request that will close it,

2026-09-26 22:29:52 +00:00

[K5 correction] Create exact-head PRs through Forgejo AGit #25