[Kernel][G03] Implement durable candidate-bound product review and remediation

kilo commented

2026-10-04 22:24:52 +00:00

Member

Goal

Owner: Kernel. Implement the product loop implementation -> verification -> independent review -> remediation -> fresh candidate acceptance with durable operations and finite approved budgets, without manual result copying. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief.

Why

Current deterministic task acceptance is not independent semantic review. Repository /deliver-issue is a development workflow and its ten-cycle budget must not be presented as product implementation or copied as user policy.

Current Evidence

At eb4f4a2956, core/verification.py provides exact EvidenceSubject, optional independent-review evidence and remediation_action. task_execution.py POLICY:91-95 has reviewer_required=False; ports/application.py records rejection and returns rejected, no reviewer/remediation dispatch. #7 proved the domain seam; #32 excluded automatic review dispatch; #15/#19 are development-only. This is source/test inspection, not product loop execution.

Scope

Compose existing immutable Attempt/Operation/evidence/finding mechanisms and the proved harness's native cold review/delegation where useful. Persist review intent/claim/semantic receipt, independent input/session identity, verdict/candidate/policy/spec/base/head, findings and remediation lineage. New candidate receives entirely fresh required checks/review. Reconcile platform review separately from substantive verdict; correlate all resources to the task budget.

Acceptance Criteria

Deterministic scenario produces candidate, rejects concrete findings, performs authorized bounded remediation as a new Attempt/candidate, then accepts only fresh exact-subject verification and independent review.
Changed candidate/head/base/spec/policy, stale/missing evidence, author-conversation contamination, self-review and fabricated form-valid approval cannot satisfy acceptance.
Lost reviewer dispatch/reply, malformed/domain-rejected response, duplicate callback and controller restart preserve known receipts/uncertainty without waiting for unaccepted review or duplicate execution.
Findings retain identities/subjects; healthy distinct repairs, repeated/oscillating failure, budget pause and genuine owner authority decisions are distinct. No unbounded loop or fixed magic HumanGate threshold.
Substantive verdict and formal platform review state are separate; COMMENT cannot masquerade as APPROVED. Platform failure does not erase exact-SHA verdict, and policy requirements remain explicit.
Existing acceptance history/IDs remain immutable through migration; safe status/diagnostics expose candidate/review/remediation state and no secrets/transcripts; consumer/export tests plus gates and exact-HEAD review.

Reuse

Retain core verification/remediation/effect journal and bounded local reference scenarios. Evaluate selected harness native review/delegation and Symphony/standard patterns against cold-context, authority, lost-response and persistence guarantees. Exact source/revision/license/service terms, security, dependency maintenance and adversarial tests before adoption. Do not wrap Markdown development commands into product controller.

Dependencies And Priority

Product acceptance prerequisite after approved spec #49, proved harness/control evidence #47, verification/test-child profile #50 and lifecycle #48. Synthetic fixture-first review/remediation remains independently eligible after these existing synthetic prerequisites; it does not wait for #90, #53 or #60. Only a live trusted-development review/remediation path that may create native effects must use an explicit trusted-development profile and consume #90 STOP/uncertainty/settlement facts, with separately authorized Router route and effect scope. An independent verdict is not proof that native effects stopped at expiry or that the reviewer was hostile-worker isolated. Router owns the separately authorized review route; whole-task budget/cost and exports must consume review/remediation facts. No manual owner handoff as integration plan.

Constraints And Permissions

Product attempt/time/cost thresholds require approved user policy, not this session's budget. Synthetic acceptance first; live implementation/review/remediation requires separately authorized inference/service/workspace/effect scopes. Preserve adapters -> ports -> core, no private M5-B dependency, unknown effects before retry and no auto merge/deploy.

Links

Parent: #46
Domain seam: #7
Intake: #49
Harness proof: #47
Isolation: #50

Non-Goals

No new review framework, automatic merge, repository-workflow model pin as product architecture or live inference granted by registration.

## Goal Owner: Kernel. Implement the product loop implementation -> verification -> independent review -> remediation -> fresh candidate acceptance with durable operations and finite approved budgets, without manual result copying. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief. ## Why Current deterministic task acceptance is not independent semantic review. Repository /deliver-issue is a development workflow and its ten-cycle budget must not be presented as product implementation or copied as user policy. ## Current Evidence At eb4f4a2956712bfaf39a3271e1523e7f77a91e26, core/verification.py provides exact EvidenceSubject, optional independent-review evidence and remediation_action. task_execution.py POLICY:91-95 has reviewer_required=False; ports/application.py records rejection and returns rejected, no reviewer/remediation dispatch. #7 proved the domain seam; #32 excluded automatic review dispatch; #15/#19 are development-only. This is source/test inspection, not product loop execution. ## Scope Compose existing immutable Attempt/Operation/evidence/finding mechanisms and the proved harness's native cold review/delegation where useful. Persist review intent/claim/semantic receipt, independent input/session identity, verdict/candidate/policy/spec/base/head, findings and remediation lineage. New candidate receives entirely fresh required checks/review. Reconcile platform review separately from substantive verdict; correlate all resources to the task budget. ## Acceptance Criteria 1. Deterministic scenario produces candidate, rejects concrete findings, performs authorized bounded remediation as a new Attempt/candidate, then accepts only fresh exact-subject verification and independent review. 2. Changed candidate/head/base/spec/policy, stale/missing evidence, author-conversation contamination, self-review and fabricated form-valid approval cannot satisfy acceptance. 3. Lost reviewer dispatch/reply, malformed/domain-rejected response, duplicate callback and controller restart preserve known receipts/uncertainty without waiting for unaccepted review or duplicate execution. 4. Findings retain identities/subjects; healthy distinct repairs, repeated/oscillating failure, budget pause and genuine owner authority decisions are distinct. No unbounded loop or fixed magic HumanGate threshold. 5. Substantive verdict and formal platform review state are separate; COMMENT cannot masquerade as APPROVED. Platform failure does not erase exact-SHA verdict, and policy requirements remain explicit. 6. Existing acceptance history/IDs remain immutable through migration; safe status/diagnostics expose candidate/review/remediation state and no secrets/transcripts; consumer/export tests plus gates and exact-HEAD review. ## Reuse Retain core verification/remediation/effect journal and bounded local reference scenarios. Evaluate selected harness native review/delegation and Symphony/standard patterns against cold-context, authority, lost-response and persistence guarantees. Exact source/revision/license/service terms, security, dependency maintenance and adversarial tests before adoption. Do not wrap Markdown development commands into product controller. ## Dependencies And Priority Product acceptance prerequisite after approved spec #49, proved harness/control evidence #47, verification/test-child profile #50 and lifecycle #48. Synthetic fixture-first review/remediation remains independently eligible after these existing synthetic prerequisites; it does not wait for #90, #53 or #60. Only a live trusted-development review/remediation path that may create native effects must use an explicit trusted-development profile and consume #90 STOP/uncertainty/settlement facts, with separately authorized Router route and effect scope. An independent verdict is not proof that native effects stopped at expiry or that the reviewer was hostile-worker isolated. Router owns the separately authorized review route; whole-task budget/cost and exports must consume review/remediation facts. No manual owner handoff as integration plan. ## Constraints And Permissions Product attempt/time/cost thresholds require approved user policy, not this session's budget. Synthetic acceptance first; live implementation/review/remediation requires separately authorized inference/service/workspace/effect scopes. Preserve adapters -> ports -> core, no private M5-B dependency, unknown effects before retry and no auto merge/deploy. ## Links - Parent: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/46 - Domain seam: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/7 - Intake: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/49 - Harness proof: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/47 - Isolation: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/50 ## Non-Goals No new review framework, automatic merge, repository-workflow model pin as product architecture or live inference granted by registration.

kilo referenced this issue

2026-10-04 22:27:40 +00:00

[Kernel][G12] Account for and enforce whole-task budgets across calls, tools and review #56

kilo referenced this issue

2026-10-04 22:27:40 +00:00

[Kernel][G07] Deliver versioned private outcome and full-cost evidence export #58

kilo referenced this issue

2026-10-04 22:29:51 +00:00

[Kernel][G01-G13] Accept the installed controlled-task path end to end #60

kilo referenced this issue

2026-10-04 22:51:53 +00:00

docs: align shared harness, routing and observability architecture (#46) #63

kilo referenced this issue

2026-10-04 22:58:10 +00:00

Align Creatidy Kernel with the shared harness, routing and observability architecture #46

kilo referenced this issue

2026-10-18 03:05:11 +00:00

docs: accept task-level AC4 baseline #91

kilo referenced this issue

2026-10-18 13:49:33 +00:00

feat: add durable candidate-bound product review #92

kilo commented

2026-10-18 13:49:45 +00:00

Author

Member

Implemented the synthetic-first candidate-bound product review/remediation loop in PR #92: #92. It persists independent review receipts and uncertainty, binds fresh evidence to exact candidate subjects, links bounded remediation Attempts, and keeps owner decisions separate from code findings. make check (1,452 passed, 85 skipped, 106 subtests) and make package-check pass. No live inference or external effects were used. Refs #54

Implemented the synthetic-first candidate-bound product review/remediation loop in PR #92: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/92. It persists independent review receipts and uncertainty, binds fresh evidence to exact candidate subjects, links bounded remediation Attempts, and keeps owner decisions separate from code findings. `make check` (1,452 passed, 85 skipped, 106 subtests) and `make package-check` pass. No live inference or external effects were used. Refs #54

kilo commented

2026-10-18 14:03:10 +00:00

Author

Member

Completion Evidence

PR #92 merged to develop: #92
Reviewed head: b561b106a1bdf2115ef7c836d597aa3e9b2f3176; approved base: 66e4ed206fc94d1917bf8e860bc22546e767c8fc; merge commit: 40eea02cee517f7b31da01173739b23c510779b0.
Canonical develop is now 40eea02cee517f7b31da01173739b23c510779b0; the merge commit is present and the approved head is an ancestor.
Synthetic acceptance covers candidate-bound cold review, exact-subject receipt, lost-response recovery, owner-decision separation, bounded remediation as a new linked Attempt, fresh review/verification, repeated-finding pause, codec migration and outcome export.
make check: 1,452 passed, 85 skipped, 106 subtests passed. make package-check: reproducible sdist/wheel, isolated installation and smoke checks passed. PR Actions run #2908 succeeded.
No live inference or external effects were used. Refs #54

## Completion Evidence - PR #92 merged to `develop`: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/92 - Reviewed head: `b561b106a1bdf2115ef7c836d597aa3e9b2f3176`; approved base: `66e4ed206fc94d1917bf8e860bc22546e767c8fc`; merge commit: `40eea02cee517f7b31da01173739b23c510779b0`. - Canonical `develop` is now `40eea02cee517f7b31da01173739b23c510779b0`; the merge commit is present and the approved head is an ancestor. - Synthetic acceptance covers candidate-bound cold review, exact-subject receipt, lost-response recovery, owner-decision separation, bounded remediation as a new linked Attempt, fresh review/verification, repeated-finding pause, codec migration and outcome export. - `make check`: 1,452 passed, 85 skipped, 106 subtests passed. `make package-check`: reproducible sdist/wheel, isolated installation and smoke checks passed. PR Actions run #2908 succeeded. - No live inference or external effects were used. Refs #54

kilo closed this issue

2026-10-18 14:03:16 +00:00

kilo referenced this issue

2026-10-27 00:29:34 +00:00

Deliver ordinary Program execution with shared pull and managed push handoffs #106

kilo added a new dependency

2026-10-27 00:30:15 +00:00

#56 [Kernel][G12] Account for and enforce whole-task budgets across calls, tools and review

kilo added a new dependency

2026-10-27 00:30:15 +00:00

#106 Deliver ordinary Program execution with shared pull and managed push handoffs

kilo added a new dependency