[Kernel][G12] Account for and enforce whole-task budgets across calls, tools and review #56

New issue

Closed

opened 2026-10-04 22:27:40 +00:00 by kilo · 11 comments

kilo commented 2026-10-04 22:27:40 +00:00

Member

Copy link

Priority: P1

Type: implementation.

Current Scope And Supersession

Published under the owner's 2026-10-27 bounded architecture/backlog mandate #103. PR #104 is merged at ace7175e087cd70e207594f5631c8f4f70fabfd4; pending/prepared wording at that historical cut is not current integration status. This active content supersedes conflicting historical descriptive scope, priorities and dependencies, including dated comments, without changing their evidence or review counters. The complete pre-update body is preserved unchanged under ## Historical Scope And Evidence below. Prepared A is registered #105 and B is registered #106. Publication does not select implementation or establish overall alignment acceptance.

P1 means core authority/data-integrity foundation or complete everyday work capability on the critical path under the integrated P0-P3 Priority Contract; lower number is earlier, not a budget or deadline. This is the single active priority. Eligibility/evidence precede priority; ranking never bypasses prerequisites, owner decisions, STOP_REVISE or exact invalid/wontfix/duplicate exclusions. Ranked-before-unranked, explicit dependency ordering, oldest registration/tie by ID and existing /loop authority remain unchanged.

Goal

Enforce owner-configured project/work envelopes and preserve whole-result consumption across attempts/review/remediation/tools/retries.

Why

Current count policy and per-command timeout are not whole-work authority or economic bounds. Retain prior shape-spec work.

Scope

Single-core reservations, count/concurrency/time/money policies, bounded output/process work, receipt-corrected resource vector, unknown handling and recovery, independently of model inventory.

Acceptance Criteria

1. Validated configured project/task policy atomically reserves available finite work capacity; no oversubscription across pull/push or review/remediation. Reservation is not measured usage, and synthetic finite test values do not become numeric owner budgets.
2. Implement ADR 0011 original wall/verified suspend-inclusive boot-clock projection and same-boot recovery; rollback/suspend/reboot/unavailable clock refuses renewed dispatch/authority. Preserve original expiry and exact task/Attempt/Operation/revocation checks for all new Kernel admissions.
3. Bound retries, helper/review/tool/verification/auxiliary work, time and retained streaming bytes; STOP/expiry uses #90's witness pattern and unknown/no-publication/conflicting-successor gate.
4. Money/currency, tokens, quota-specific units, compute/elapsed/attention remain separate with sourced corrections, dedupe and unknowns. Missing usage/hidden/in-flight consumption is not zero or billing.
5. Unknown consumption prevents a hard cap claim: reserve conservative supported headroom or refuse that profile. Basic externally configured clients may retain unknown usage without claiming strict inference bounds; Router #184 facts/admission are optional lane-specific integration evidence.
6. Installed/reopen/crash/race/budget-exhaustion tests exercise actual enforcement, not only shape specifications; preserve old policies/bytes and no invisible reset/route or quota reconstruction.

Dependencies

Accepted #48/#49/#54; no blanket #52/#57/MI prerequisite. Receiving SR private local source_call_facts through an eventual remote transport is UNVERIFIED until that exact seam is checked; do not invent an endpoint or gate all work on it. Real budgets required only before real admissions.

Constraints

ADR 0012 and ADR 0011 apply. Preserve inward dependencies (adapters -> ports -> core) and the self-contained public core; no private repository or live-service dependency for core/offline tests. No new coding agent, tracker, catalogue, gateway or generic workflow DSL. No credential/runtime-state copying. Preserve old bytes/IDs/unknowns and #53 CLOSED / NOT IMPLEMENTED, PR #85 CLOSED / UNMERGED; its strict-expiry negative and review history are not an accepted adapter or pass. Synthetic offline tests plus the installed path and independent exact-subject review are required. Live inference/effects/releases require separate authority; this publication grants no accounts, live spending, private data access, merge, release or deployment. Preserve PR #100 as a negative receipt, not full route acceptance, and PR #101 as provenance-only, not full knowledge-content acceptance. Historical evidence and all review counters remain immutable.

Links

• Mandate #103: #103
• Integrated PR #104: #104 (merge ace7175e087cd70e207594f5631c8f4f70fabfd4).
• ADR 0012: ace7175e08/docs/adr/0012-unified-work-coordination-and-drivers.md
• ADR 0011: ace7175e08/docs/adr/0011-task-level-authority-and-trusted-development.md
• Target: ace7175e08/docs/architecture/target.md
• Migration: ace7175e08/docs/architecture/migration.md
• Exact payload, shared constraints and Priority Contract: ace7175e08/docs/architecture/backlog-alignment.md
• Accepted lifetime #48: #48
• Accepted policy/intake #49: #49
• Product review #54: #54
• Bounded STOP/settlement #90: #90
• SR call/admission facts #184: BioMedical-IT/scarcity-router#184
• Existing cost-shape specification: ace7175e08/docs/architecture/successor.md (g12-existing-cost-shape-specification-planned)
• Prior specification PR #94: #94 ; original delivery evidence: #56 (comment)

Historical Scope And Evidence

Goal

Owner: Kernel task authorization/accounting; Router owns call admission, account/quota policy and execution costs at its boundary. Preserve a multidimensional whole-task budget/consumption ledger covering implementation, review, remediation, tools/tests, retries and auxiliary calls with sourced unknowns and honest enforcement limits. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief.

Why

Cheapest-token selection and per-request rate/deadline limits do not bound the accepted-result journey. Hidden SDK/harness/gateway retries can turn one intended operation into multiple costs or effects; an unknown result cannot justify changing route and hiding the uncertainty.

Current Evidence

Kernel eb4f4a2956: BudgetPolicy in core/domain.py bounds Attempts/active count; core/outcomes.py models unitful sourced usage but task application does not collect it. run_task deadline bounds dispatch only and checks have separate timeouts; #48 repairs envelope/lifetime/freshness. TaskChecks _run_command uses subprocess capture_output before tail truncation, no complete whole-task byte/descendant bounds. Router SpendingLimit is a per-Mtoken rate ceiling, not total-task budget; native hidden retry accounting is unproved. Router #184 owns corresponding call/access-mode proof.

Scope

Link task/Attempt/session/route/call/tool/candidate and journal consumption/corrections with separate money/currency, quota units, tokens, compute/wall time and owner attention. Specify approval/enforcement boundaries before implementation, preserve unknown vs estimate/report/measurement, reconcile retries and uncertain effects, enforce whole-path deadlines/admission and bounded command output/descendants. Do not guess numerical limits or reset/credit/overflow authority.

Acceptance Criteria

1. Synthetic multi-Attempt scenario including independent review, remediation, tools, failed/retried/auxiliary calls and duplicate/corrected receipts produces traceable totals without double-counting; unknown costs/attention remain unknown, never zero.
2. Each new Kernel-controlled admission respects the approved envelope and original deadline; restart cannot reset it. Use a verified suspend-inclusive Linux CLOCK_BOOTTIME projection anchored to the original wall deadline and host boot identity. Same-boot recovery reuses the persisted projection; it must not derive a later expiry from the current wall clock. Deadline expiry stops new Kernel dispatch and initiates bounded cancellation. If the clock, its reading, or boot identity is unavailable or unverifiable, or the boot identity changes, fail closed: deny dispatch and a successor Attempt and keep the Attempt unknown pending reconciliation. Tests use controlled clocks to cover suspend/resume across expiry, wall-clock rollback after projection creation, reboot/boot-ID mismatch, unavailable/unverifiable clock identity, and same-boot recovery without projection renewal. Local native effects and provider usage during an active turn/termination interval are recorded as observed or unknown, never assumed zero or rolled back. No strict per-syscall expiry is claimed. In-flight overrun/unknown accounting is explicit with tested pause/reconciliation behavior.

Router #184's call/quota evidence and approved numeric task budget remain required.

3. Explicit native/SDK/gateway retry inventory and producer-consumer evidence shows bounded retry, preserved idempotency/identity and billed call attribution; ambiguous outcome cannot cause hidden cross-target fallback.
4. Large/streaming output, hanging/descendant process and timeout tests demonstrate byte/time/process bounds rather than truncation after unbounded buffering. Tool/test/reviewer costs and actual observation times are included.
5. Router rate/availability/admission and Kernel total authorization remain separate; no unauthorized replenishment/credit/overflow. Unsupported enforcement is clearly refused or requires explicit owner policy, not a pretend hard guarantee.
6. Persisted usage/envelopes migrate without reassigning historical costs/IDs; safe doctor/status/budget explanation, complete export conformance, docs and gates/exact-HEAD review.
7. Deadline-triggered cancellation uses the same exact owned-process settlement gate as user-requested STOP. A terminal Codex turn or successful interrupt acknowledgement is not settlement. Test a live owned-group descendant, an escaped/unobservable child, controller loss during termination or before the settlement witness is durable, and incomplete or missing termination evidence. Unless the exact profile-appropriate settlement witness is durably verified, retain the workspace, report unknown or cancel_uncertain, and block acceptance, publication, retry and any conflicting successor Attempt. Recovery must not infer settlement from a terminal turn or reacquire a numeric PID. Scope uncertainty to the affected Attempt/resources; do not block independent eligible tasks with non-conflicting authority and workspaces.

Reuse

Reuse core BudgetPolicy/OutcomeObservation/correction and receipt dedupe, Operation journal, reference bounded cancellation and existing bounded Git transport; adopt Router #184 cost/admission evidence and proved harness usage events after exact revision/license/semantics/security/negative/dependency-maintenance check. No second quota collector, policy DSL or finance service.

Dependencies And Priority

Acceptance safety prerequisite after #48 lifetime, #49 approved policy, #52 route identity and #54 product review; parallel specification of existing cost shapes is possible. Producer Router #184 must prove call/quota/access boundaries. Full outcome export consumes this ledger.

Constraints And Permissions

No invented cost/quality/time thresholds, private telemetry copied into repo, provider pricing/catalog or routing policy. Synthetic proof first; calibrated live billing/retry/attention evidence needs separately authorized inference/service/tool effects and owner numerical budget. Registration grants none; development review budget remains separate.

Links

• Parent: #46
• Lifetime repair: #48
• Product review: #54
• Router enforcement producer: BioMedical-IT/scarcity-router#184

Non-Goals

No quota replenishment, learned pricing/routing, global exactly-once promise or live spending authorization.

Priority: P1 Type: implementation. ## Current Scope And Supersession Published under the owner's 2026-10-27 bounded architecture/backlog mandate #103. PR #104 is merged at `ace7175e087cd70e207594f5631c8f4f70fabfd4`; pending/prepared wording at that historical cut is not current integration status. This active content supersedes conflicting historical descriptive scope, priorities and dependencies, including dated comments, without changing their evidence or review counters. The complete pre-update body is preserved unchanged under `## Historical Scope And Evidence` below. Prepared A is registered #105 and B is registered #106. Publication does not select implementation or establish overall alignment acceptance. P1 means core authority/data-integrity foundation or complete everyday work capability on the critical path under the integrated P0-P3 Priority Contract; lower number is earlier, not a budget or deadline. This is the single active priority. Eligibility/evidence precede priority; ranking never bypasses prerequisites, owner decisions, STOP_REVISE or exact invalid/wontfix/duplicate exclusions. Ranked-before-unranked, explicit dependency ordering, oldest registration/tie by ID and existing /loop authority remain unchanged. ## Goal Enforce owner-configured project/work envelopes and preserve whole-result consumption across attempts/review/remediation/tools/retries. ## Why Current count policy and per-command timeout are not whole-work authority or economic bounds. Retain prior shape-spec work. ## Scope Single-core reservations, count/concurrency/time/money policies, bounded output/process work, receipt-corrected resource vector, unknown handling and recovery, independently of model inventory. ## Acceptance Criteria 1. Validated configured project/task policy atomically reserves available finite work capacity; no oversubscription across pull/push or review/remediation. Reservation is not measured usage, and synthetic finite test values do not become numeric owner budgets. 2. Implement ADR 0011 original wall/verified suspend-inclusive boot-clock projection and same-boot recovery; rollback/suspend/reboot/unavailable clock refuses renewed dispatch/authority. Preserve original expiry and exact task/Attempt/Operation/revocation checks for all new Kernel admissions. 3. Bound retries, helper/review/tool/verification/auxiliary work, time and retained streaming bytes; STOP/expiry uses #90's witness pattern and unknown/no-publication/conflicting-successor gate. 4. Money/currency, tokens, quota-specific units, compute/elapsed/attention remain separate with sourced corrections, dedupe and unknowns. Missing usage/hidden/in-flight consumption is not zero or billing. 5. Unknown consumption prevents a hard cap claim: reserve conservative supported headroom or refuse that profile. Basic externally configured clients may retain unknown usage without claiming strict inference bounds; Router #184 facts/admission are optional lane-specific integration evidence. 6. Installed/reopen/crash/race/budget-exhaustion tests exercise actual enforcement, not only shape specifications; preserve old policies/bytes and no invisible reset/route or quota reconstruction. ## Dependencies Accepted #48/#49/#54; no blanket #52/#57/MI prerequisite. Receiving SR private local `source_call_facts` through an eventual remote transport is UNVERIFIED until that exact seam is checked; do not invent an endpoint or gate all work on it. Real budgets required only before real admissions. ## Constraints ADR 0012 and ADR 0011 apply. Preserve inward dependencies (`adapters -> ports -> core`) and the self-contained public core; no private repository or live-service dependency for core/offline tests. No new coding agent, tracker, catalogue, gateway or generic workflow DSL. No credential/runtime-state copying. Preserve old bytes/IDs/unknowns and #53 CLOSED / NOT IMPLEMENTED, PR #85 CLOSED / UNMERGED; its strict-expiry negative and review history are not an accepted adapter or pass. Synthetic offline tests plus the installed path and independent exact-subject review are required. Live inference/effects/releases require separate authority; this publication grants no accounts, live spending, private data access, merge, release or deployment. Preserve PR #100 as a negative receipt, not full route acceptance, and PR #101 as provenance-only, not full knowledge-content acceptance. Historical evidence and all review counters remain immutable. ## Links - Mandate #103: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/103 - Integrated PR #104: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/104 (merge `ace7175e087cd70e207594f5631c8f4f70fabfd4`). - ADR 0012: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/adr/0012-unified-work-coordination-and-drivers.md - ADR 0011: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/adr/0011-task-level-authority-and-trusted-development.md - Target: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/target.md - Migration: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/migration.md - Exact payload, shared constraints and Priority Contract: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/backlog-alignment.md - Accepted lifetime #48: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/48 - Accepted policy/intake #49: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/49 - Product review #54: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/54 - Bounded STOP/settlement #90: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/90 - SR call/admission facts #184: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/184 - Existing cost-shape specification: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/successor.md#g12-existing-cost-shape-specification-planned - Prior specification PR #94: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/94 ; original delivery evidence: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/56#issuecomment-17654 ## Historical Scope And Evidence ## Goal Owner: Kernel task authorization/accounting; Router owns call admission, account/quota policy and execution costs at its boundary. Preserve a multidimensional whole-task budget/consumption ledger covering implementation, review, remediation, tools/tests, retries and auxiliary calls with sourced unknowns and honest enforcement limits. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18 via #46 brief. ## Why Cheapest-token selection and per-request rate/deadline limits do not bound the accepted-result journey. Hidden SDK/harness/gateway retries can turn one intended operation into multiple costs or effects; an unknown result cannot justify changing route and hiding the uncertainty. ## Current Evidence Kernel eb4f4a2956712bfaf39a3271e1523e7f77a91e26: BudgetPolicy in core/domain.py bounds Attempts/active count; core/outcomes.py models unitful sourced usage but task application does not collect it. run_task deadline bounds dispatch only and checks have separate timeouts; #48 repairs envelope/lifetime/freshness. TaskChecks _run_command uses subprocess capture_output before tail truncation, no complete whole-task byte/descendant bounds. Router SpendingLimit is a per-Mtoken rate ceiling, not total-task budget; native hidden retry accounting is unproved. Router #184 owns corresponding call/access-mode proof. ## Scope Link task/Attempt/session/route/call/tool/candidate and journal consumption/corrections with separate money/currency, quota units, tokens, compute/wall time and owner attention. Specify approval/enforcement boundaries before implementation, preserve unknown vs estimate/report/measurement, reconcile retries and uncertain effects, enforce whole-path deadlines/admission and bounded command output/descendants. Do not guess numerical limits or reset/credit/overflow authority. ## Acceptance Criteria 1. Synthetic multi-Attempt scenario including independent review, remediation, tools, failed/retried/auxiliary calls and duplicate/corrected receipts produces traceable totals without double-counting; unknown costs/attention remain unknown, never zero. 2. Each new Kernel-controlled admission respects the approved envelope and original deadline; restart cannot reset it. Use a verified suspend-inclusive Linux `CLOCK_BOOTTIME` projection anchored to the original wall deadline and host boot identity. Same-boot recovery reuses the persisted projection; it must not derive a later expiry from the current wall clock. Deadline expiry stops new Kernel dispatch and initiates bounded cancellation. If the clock, its reading, or boot identity is unavailable or unverifiable, or the boot identity changes, fail closed: deny dispatch and a successor Attempt and keep the Attempt `unknown` pending reconciliation. Tests use controlled clocks to cover suspend/resume across expiry, wall-clock rollback after projection creation, reboot/boot-ID mismatch, unavailable/unverifiable clock identity, and same-boot recovery without projection renewal. Local native effects and provider usage during an active turn/termination interval are recorded as observed or `unknown`, never assumed zero or rolled back. No strict per-syscall expiry is claimed. In-flight overrun/unknown accounting is explicit with tested pause/reconciliation behavior. Router #184's call/quota evidence and approved numeric task budget remain required. 3. Explicit native/SDK/gateway retry inventory and producer-consumer evidence shows bounded retry, preserved idempotency/identity and billed call attribution; ambiguous outcome cannot cause hidden cross-target fallback. 4. Large/streaming output, hanging/descendant process and timeout tests demonstrate byte/time/process bounds rather than truncation after unbounded buffering. Tool/test/reviewer costs and actual observation times are included. 5. Router rate/availability/admission and Kernel total authorization remain separate; no unauthorized replenishment/credit/overflow. Unsupported enforcement is clearly refused or requires explicit owner policy, not a pretend hard guarantee. 6. Persisted usage/envelopes migrate without reassigning historical costs/IDs; safe doctor/status/budget explanation, complete export conformance, docs and gates/exact-HEAD review. 7. Deadline-triggered cancellation uses the same exact owned-process settlement gate as user-requested STOP. A terminal Codex turn or successful interrupt acknowledgement is not settlement. Test a live owned-group descendant, an escaped/unobservable child, controller loss during termination or before the settlement witness is durable, and incomplete or missing termination evidence. Unless the exact profile-appropriate settlement witness is durably verified, retain the workspace, report `unknown` or `cancel_uncertain`, and block acceptance, publication, retry and any conflicting successor Attempt. Recovery must not infer settlement from a terminal turn or reacquire a numeric PID. Scope uncertainty to the affected Attempt/resources; do not block independent eligible tasks with non-conflicting authority and workspaces. ## Reuse Reuse core BudgetPolicy/OutcomeObservation/correction and receipt dedupe, Operation journal, reference bounded cancellation and existing bounded Git transport; adopt Router #184 cost/admission evidence and proved harness usage events after exact revision/license/semantics/security/negative/dependency-maintenance check. No second quota collector, policy DSL or finance service. ## Dependencies And Priority Acceptance safety prerequisite after #48 lifetime, #49 approved policy, #52 route identity and #54 product review; parallel specification of existing cost shapes is possible. Producer Router #184 must prove call/quota/access boundaries. Full outcome export consumes this ledger. ## Constraints And Permissions No invented cost/quality/time thresholds, private telemetry copied into repo, provider pricing/catalog or routing policy. Synthetic proof first; calibrated live billing/retry/attention evidence needs separately authorized inference/service/tool effects and owner numerical budget. Registration grants none; development review budget remains separate. ## Links - Parent: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/46 - Lifetime repair: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/48 - Product review: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/54 - Router enforcement producer: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/184 ## Non-Goals No quota replenishment, learned pricing/routing, global exactly-once promise or live spending authorization.

kilo referenced this issue 2026-10-04 22:29:51 +00:00

[Kernel][G01-G13] Accept the installed controlled-task path end to end #60

kilo referenced this issue 2026-10-04 22:51:53 +00:00

docs: align shared harness, routing and observability architecture (#46) #63

kilo referenced this issue from Creatidy/model-intelligence 2026-10-04 22:52:28 +00:00

Prove licensed real-source A/B/C value beyond upstream coverage #12

kilo referenced this issue 2026-10-04 22:58:10 +00:00

Align Creatidy Kernel with the shared harness, routing and observability architecture #46

kilo referenced this issue from Creatidy/scarcity-router 2026-10-04 23:06:44 +00:00

G12: Prove access-mode, quota-pool and call-cost enforcement boundaries for accepted-result budgets #184

kilo referenced this issue from Creatidy/scarcity-router 2026-10-04 23:43:29 +00:00

Align Scarcity Router with Creatidy architecture and register actionable gaps (#173) #187

kilo referenced this issue 2026-10-05 15:22:53 +00:00

fix: preserve owned task lifetime and original authority (#48) #69

adrian.tkacz referenced this issue from a commit 2026-10-18 19:06:31 +00:00

docs: specify existing whole-task cost shapes (#56)

kilo referenced this issue 2026-10-18 19:06:40 +00:00

docs: specify cost-shape boundaries for whole-task budgets (#56) #94

kilo commented 2026-10-18 19:06:46 +00:00

Author

Member

Copy link

The explicitly permitted parallel cost-shape specification slice is committed as a2f910b87aadb79543f1df101eb9c16273834866 and submitted in PR #94: #94. It documents source-grounded BudgetPolicy, UsageObservation, outcome correction/Attempt lineage, QuotaSnapshot, and Router #184 billing/evidence boundaries, without implementing whole-task aggregation or inventing thresholds. make check and make package-check passed. This does not complete #56; its issue remains open pending remaining producer evidence and functional acceptance.

The explicitly permitted parallel cost-shape specification slice is committed as `a2f910b87aadb79543f1df101eb9c16273834866` and submitted in PR #94: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/94. It documents source-grounded `BudgetPolicy`, `UsageObservation`, outcome correction/Attempt lineage, `QuotaSnapshot`, and Router #184 billing/evidence boundaries, without implementing whole-task aggregation or inventing thresholds. `make check` and `make package-check` passed. This does not complete #56; its issue remains open pending remaining producer evidence and functional acceptance.

kilo referenced this issue from a commit 2026-10-18 19:10:51 +00:00

docs: specify cost-shape boundaries for whole-task budgets (#56)

kilo referenced this issue 2026-10-26 22:49:25 +00:00

Revise unified work coordination architecture and realign the canonical backlog #103

kilo referenced this issue 2026-10-27 00:29:34 +00:00

Deliver ordinary Program execution with shared pull and managed push handoffs #106

kilo added a new dependency 2026-10-27 00:30:15 +00:00

#48 [Kernel][G01 G12] Repair bounded-task lifetime, recovery and original deadline enforcement

kilo added a new dependency 2026-10-27 00:30:15 +00:00

#49 [Kernel][G02 G05] Prepare and authorize versioned specifications from ordinary issues

kilo added a new dependency 2026-10-27 00:30:15 +00:00

#54 [Kernel][G03] Implement durable candidate-bound product review and remediation

kilo added a new dependency 2026-10-27 00:30:15 +00:00

#106 Deliver ordinary Program execution with shared pull and managed push handoffs

kilo added a new dependency 2026-10-27 00:30:15 +00:00

#58 [Kernel][G07] Deliver versioned private outcome and full-cost evidence export

kilo added a new dependency 2026-10-27 00:30:15 +00:00

#60 [Kernel][G01-G13] Accept the installed controlled-task path end to end

kilo referenced this issue 2026-10-27 00:31:22 +00:00

[Kernel][G07] Deliver versioned private outcome and full-cost evidence export #58

kilo referenced this issue 2026-10-27 00:33:55 +00:00

Revise unified work coordination architecture and realign the canonical backlog #103

kilo referenced this issue 2026-10-27 00:35:52 +00:00

Revise unified work coordination architecture and realign the canonical backlog #103

kilo referenced this issue 2026-10-27 00:56:40 +00:00

Revise unified work coordination architecture and realign the canonical backlog #103

kilo commented 2026-10-27 01:05:19 +00:00

Author

Member

Copy link

Normal /loop Selection And Functional Implementation Start

Owner-authorized continuation kernel-loop-20261027T005900Z follows actual ARCHITECTURE_BACKLOG_ALIGNED acceptance in #103comment19309 and reviewed documentation integration PR107 / develop e2348656238a2ff9a3244868e2beb543d86f15a5.

Fresh postacceptance SELECT exhausted14openactualissues plus emptypage; exact wontfix15/30/37/44 exclusions, tenremainingbodies/21uniquecomments, current28nativeedges/inverses and boundedacceptedpredecessors. Currentreadyorder: #56 P1 -> #59 P1 -> #105 P1 -> #62 P2. #56 is selected by P1/eligibility/oldestregistration, not by historicalplan or existingPR. Fresh current issue/dependencies #48/#49/#54 and fetched clean base were revalidated before substantive delivery. No live #56PR exists; prior PR94 is preserved as shape-specification-only, not functional acceptance.

Ordinary branch: issue-56-work-budget-enforcement from exact base e2348656238a2ff9a3244868e2beb543d86f15a5. IMPLEMENT phase has started for the COMPLETE active AC1-6: configured atomic project/work reservations; original verified suspend-inclusive clock/recovery; bounded work/output/retry and settlement uncertainty; unitful corrected/deduplicated unknown-aware accounting; refusal of unsupported hard-cap claims; installed/reopen/crash/race/exhaustion tests on actual enforcement. Shared application seams remain inward and reusable by later #59/#105/#106 without implementing their separate whole scopes.

One bounded internal implementation task is the sole checkout writer while active; primary remains sole loop orchestrator and owns commits/PR/review/merge. No additional Agent Manager session/worktree/controller. Prior #56 native review ordinal1/10 from PR94 remains consumed; the first new whole-PR review must reserve ordinal2, never reset. No new review or functional acceptance claimed yet.

No production numeric budgets, live spending/inference, secrets/realprofiles, realkeymigration or external repository mutation is required or authorized for this offline implementation. Optional future remote SR184 facts remain UNVERIFIED lane-specific evidence, not a blanket #52/MI/Console gate. No billing/strict inference/native-syscall guarantee will be inferred from unknown facts. New independent exact-HEAD review, required makecheck/packagecheck and canonicalcurrentness remain mandatory before any allowed normal PR integration or full issue closure.

## Normal /loop Selection And Functional Implementation Start Owner-authorized continuation `kernel-loop-20261027T005900Z` follows actual ARCHITECTURE_BACKLOG_ALIGNED acceptance in #103comment19309 and reviewed documentation integration PR107 / develop `e2348656238a2ff9a3244868e2beb543d86f15a5`. Fresh postacceptance SELECT exhausted14openactualissues plus emptypage; exact wontfix15/30/37/44 exclusions, tenremainingbodies/21uniquecomments, current28nativeedges/inverses and boundedacceptedpredecessors. Currentreadyorder: **#56 P1 -> #59 P1 -> #105 P1 -> #62 P2**. #56 is selected by P1/eligibility/oldestregistration, not by historicalplan or existingPR. Fresh current issue/dependencies #48/#49/#54 and fetched clean base were revalidated before substantive delivery. No live #56PR exists; prior PR94 is preserved as shape-specification-only, not functional acceptance. Ordinary branch: `issue-56-work-budget-enforcement` from exact base `e2348656238a2ff9a3244868e2beb543d86f15a5`. IMPLEMENT phase has started for the COMPLETE active AC1-6: configured atomic project/work reservations; original verified suspend-inclusive clock/recovery; bounded work/output/retry and settlement uncertainty; unitful corrected/deduplicated unknown-aware accounting; refusal of unsupported hard-cap claims; installed/reopen/crash/race/exhaustion tests on actual enforcement. Shared application seams remain inward and reusable by later #59/#105/#106 without implementing their separate whole scopes. One bounded internal implementation task is the sole checkout writer while active; primary remains sole loop orchestrator and owns commits/PR/review/merge. No additional Agent Manager session/worktree/controller. Prior #56 native review ordinal1/10 from PR94 remains consumed; the first new whole-PR review must reserve ordinal2, never reset. No new review or functional acceptance claimed yet. No production numeric budgets, live spending/inference, secrets/realprofiles, realkeymigration or external repository mutation is required or authorized for this offline implementation. Optional future remote SR184 facts remain UNVERIFIED lane-specific evidence, not a blanket #52/MI/Console gate. No billing/strict inference/native-syscall guarantee will be inferred from unknown facts. New independent exact-HEAD review, required makecheck/packagecheck and canonicalcurrentness remain mandatory before any allowed normal PR integration or full issue closure.

adrian.tkacz referenced this issue from a commit 2026-10-27 02:11:00 +00:00

feat: enforce configured whole-work budget envelopes (#56)

kilo referenced this issue 2026-10-27 02:11:28 +00:00

feat: enforce configured whole-work budget envelopes (#56) #108

kilo commented 2026-10-27 02:27:15 +00:00

Author

Member

Copy link

Functional PR And Independent Remediation

PR #108: #108
Initial HEAD 18c693b166ad53ea54f9e02466c927e36d46c696, base/merge-base e2348656238a2ff9a3244868e2beb543d86f15a5.23files, actual budget/clock/streaming/admission/usage enforcement plus installed regressions; normal owner-authored commit/push. No merge/closure.

Fresh native independent whole-PR reviewer ses_e84decf50ffegS39x552U6Zauu, conserved ordinal 2/10 (prior PR94 ordinal1 preserved), returned REQUEST_CHANGES on those exact refs:

• P1: reserved claim must recheck exact Attempt/WorkUnit/current-spec/Operation authority after cancellation or amendment, not merely Program-level capacity/time.
• P1: command reservation without durable result/settlement must remain unknown and block workspace reset/cleanup/reuse before reconciliation, not become failed Evidence followed by definitive rejection/settlement.
• P2: source-qualified receipt/metric/unit dedupe and immutable attribution must hold across Operations/Attempts, not just within one Operation.
• P2: claim of an existing reservation must recheck corrected observed resource ceilings/unknown headroom before dispatch without counting the reservation twice.

Reviewer independently ran both required offline gates: makecheck1535passed/85explicitnative-prerequisite skips/106subtests and packagecheckPASS; these passes do not override semantic findings. Parent makeauditPASS. No native-isolation/live/productionbilling claim.

All four are ordinary in-scope engineering remediation, not new owner architecture/authority decisions. The bounded implementation task is fixing them and adding counterexample/recovery regressions as the sole checkout writer. Parent retains the same loop orchestration; no review budget reset, stale approval, self-review substitution, amend/force or external repository mutation. Next whole-PR invocation must reserve ordinal3 against the new exact HEAD after normal remediation commit and complete validation. Issue remains OPEN, PR108 UNMERGED.

## Functional PR And Independent Remediation PR #108: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/108 Initial HEAD `18c693b166ad53ea54f9e02466c927e36d46c696`, base/merge-base `e2348656238a2ff9a3244868e2beb543d86f15a5`.23files, actual budget/clock/streaming/admission/usage enforcement plus installed regressions; normal owner-authored commit/push. No merge/closure. Fresh native independent whole-PR reviewer `ses_e84decf50ffegS39x552U6Zauu`, conserved ordinal **2/10** (prior PR94 ordinal1 preserved), returned **REQUEST_CHANGES** on those exact refs: - P1: reserved claim must recheck exact Attempt/WorkUnit/current-spec/Operation authority after cancellation or amendment, not merely Program-level capacity/time. - P1: command reservation without durable result/settlement must remain unknown and block workspace reset/cleanup/reuse before reconciliation, not become failed Evidence followed by definitive rejection/settlement. - P2: source-qualified receipt/metric/unit dedupe and immutable attribution must hold across Operations/Attempts, not just within one Operation. - P2: claim of an existing reservation must recheck corrected observed resource ceilings/unknown headroom before dispatch without counting the reservation twice. Reviewer independently ran both required offline gates: makecheck1535passed/85explicitnative-prerequisite skips/106subtests and packagecheckPASS; these passes do not override semantic findings. Parent makeauditPASS. No native-isolation/live/productionbilling claim. All four are ordinary in-scope engineering remediation, not new owner architecture/authority decisions. The bounded implementation task is fixing them and adding counterexample/recovery regressions as the sole checkout writer. Parent retains the same loop orchestration; no review budget reset, stale approval, self-review substitution, amend/force or external repository mutation. Next whole-PR invocation must reserve ordinal3 against the new exact HEAD after normal remediation commit and complete validation. Issue remains OPEN, PR108 UNMERGED.

adrian.tkacz referenced this issue from a commit 2026-10-27 03:07:12 +00:00

fix: revalidate work authority and preserve uncertain commands (#56)

kilo commented 2026-10-27 03:24:10 +00:00

Author

Member

Copy link

Whole-PR Review 3/10: Further In-Scope Remediation

Normal remediation commit fd8fef101614fee7c021c32257a767e07e6e21a0 on PR108 preserves initial18c693b1, fixes the previous four findings and adds15semanticregressions. Fresh native independent whole-PR task ses_e84abffd6ffe0ezDAXjyaz6nXe reviewed COMPLETE basee2348656-to-fd8fef10 and returned REQUEST_CHANGES with three new counterexamples:

• P1: crash after a zero-exit mutating/littering verification command but before durable integrity outcome can be followed by reset/clean and cached-success replay, erasing rejection evidence.
• P1: generic new authority records under unchanged schema2 do not force the actual preceding reader to refuse downgrade; old claims can ignore new revocation/clock/budget constraints. A real persistent compatibility boundary and backup/recovery/installed old-reader refusal proof are required.
• P2: non-null estimates/partial in-flight usage cannot serve as complete reconciled consumption or release unknown resource headroom.

Both independent repository gates still passed (1552tests,85explicitnativeprerequisite skips,106subtests; packagecheckPASS). Passing checks are not acceptance of uncovered composed recovery, downgrade or provenance semantics. Prior four findings were not repeated.

These are accepted-scope engineering fixes, not owner architecture/authority decisions. Same bounded sole-writer implementation task is remediating all three with composed crash/reopen, actual old/new reader and unsettled estimate/receipt regressions. No live inference, real-state/profile migration, external repository mutation or security weakening. PR108 remains OPEN/UNMERGED and this issue remains OPEN. Reviewordinals1/2/3 preserved; next fresh whole-PR dispatch must reserve4/10 on the resulting exact HEAD, with no reset or self-review substitute.

## Whole-PR Review 3/10: Further In-Scope Remediation Normal remediation commit `fd8fef101614fee7c021c32257a767e07e6e21a0` on PR108 preserves initial18c693b1, fixes the previous four findings and adds15semanticregressions. Fresh native independent whole-PR task `ses_e84abffd6ffe0ezDAXjyaz6nXe` reviewed COMPLETE basee2348656-to-fd8fef10 and returned REQUEST_CHANGES with three new counterexamples: - P1: crash after a zero-exit mutating/littering verification command but before durable integrity outcome can be followed by reset/clean and cached-success replay, erasing rejection evidence. - P1: generic new authority records under unchanged schema2 do not force the actual preceding reader to refuse downgrade; old claims can ignore new revocation/clock/budget constraints. A real persistent compatibility boundary and backup/recovery/installed old-reader refusal proof are required. - P2: non-null estimates/partial in-flight usage cannot serve as complete reconciled consumption or release unknown resource headroom. Both independent repository gates still passed (1552tests,85explicitnativeprerequisite skips,106subtests; packagecheckPASS). Passing checks are not acceptance of uncovered composed recovery, downgrade or provenance semantics. Prior four findings were not repeated. These are accepted-scope engineering fixes, not owner architecture/authority decisions. Same bounded sole-writer implementation task is remediating all three with composed crash/reopen, actual old/new reader and unsettled estimate/receipt regressions. No live inference, real-state/profile migration, external repository mutation or security weakening. PR108 remains OPEN/UNMERGED and this issue remains OPEN. Reviewordinals1/2/3 preserved; next fresh whole-PR dispatch must reserve4/10 on the resulting exact HEAD, with no reset or self-review substitute.

adrian.tkacz referenced this issue from a commit 2026-10-27 04:11:10 +00:00

fix: preserve verification integrity and fence budget schema downgrades (#56)

adrian.tkacz referenced this issue from a commit 2026-10-27 04:33:52 +00:00

fix: validate byte reservations at every admission entrance (#56)

adrian.tkacz referenced this issue from a commit 2026-10-27 04:57:59 +00:00

fix: require durable budget authority for independent review (#56)

kilo commented 2026-10-27 04:58:28 +00:00

Author

Member

Copy link

Reviews 4–5 And Normal Remediation

The conserved whole-PR counter is now5/10 consumed, including original specification PR94ordinal1. All native reviews inspected complete current base-to-HEAD subjects with fresh contexts; no counter reset or self-approval.

• Ordinal4 ses_e8470b7d9ffeWnTd3Q9znbPKqa, HEAD20453149/basee2348656: REQUEST_CHANGES, one P2 common reservation validation gap. Negative retained_bytes could manufacture headroom via budgeted_intent. Normal commit4a305927 moves existing strict category/nonnegative-integer guard to the shared path; ten parameterized regressions cover both entrances, invalid types/bytes/category, no outbox/status mutation, replay, over-reservation and reopen.
• Ordinal5 ses_e845c5a8dffe1r5stGvR3i3rtS, HEAD4a305927/basee2348656: REQUEST_CHANGES, one P2 name-only independent_review exemption. Valid explicit check configuration with reviewer_required=False could invoke unbudgeted raw review. Normal commit 23a28e31c1 requires the actual durable budgeted review path and rejects unsupported explicit configuration at application entry before allocator/runtime/collector/producer effects. Two application regressions cover zero REVIEW capacity, with and without supplied dispatcher; retained durable-review positives pass.

Final parent closed/offline make check on current tree passed 1577tests,85explicitnative-prerequisite skips,106subtests,431.77s; all locked/static/import/secret/diff gates passed. make package-check passed including actual installed base-reader refusal of schema3 and versioned backups/artifacts. Focused review/composed suite33PASS. Same unchanged dependency/tooling audit remains PASS. No native-isolation/live/production success inferred from skips.

PR108 remains open/unmerged; issue56open. Current branchissue-56-work-budget-enforcement, basee2348656238a2ff9a3244868e2beb543d86f15a5, cleanHEAD23a28e31. Next review must reserve ordinal6/10 and freshly inspect COMPLETE PR, not merely the latest fix. These are implementation/remediation receipts, not approval. No external mutation/live spending/realprofilemigration/deploy/main/force/amend.

## Reviews 4–5 And Normal Remediation The conserved whole-PR counter is now5/10 consumed, including original specification PR94ordinal1. All native reviews inspected complete current base-to-HEAD subjects with fresh contexts; no counter reset or self-approval. - Ordinal4 `ses_e8470b7d9ffeWnTd3Q9znbPKqa`, HEAD20453149/basee2348656: REQUEST_CHANGES, one P2 common reservation validation gap. Negative retained_bytes could manufacture headroom via budgeted_intent. Normal commit4a305927 moves existing strict category/nonnegative-integer guard to the shared path; ten parameterized regressions cover both entrances, invalid types/bytes/category, no outbox/status mutation, replay, over-reservation and reopen. - Ordinal5 `ses_e845c5a8dffe1r5stGvR3i3rtS`, HEAD4a305927/basee2348656: REQUEST_CHANGES, one P2 name-only independent_review exemption. Valid explicit check configuration with reviewer_required=False could invoke unbudgeted raw review. Normal commit **23a28e31c17018acb9900efeed2da1b9b03330cf** requires the actual durable budgeted review path and rejects unsupported explicit configuration at application entry before allocator/runtime/collector/producer effects. Two application regressions cover zero REVIEW capacity, with and without supplied dispatcher; retained durable-review positives pass. Final parent closed/offline `make check` on current tree passed **1577tests,85explicitnative-prerequisite skips,106subtests,431.77s**; all locked/static/import/secret/diff gates passed. `make package-check` passed including actual installed base-reader refusal of schema3 and versioned backups/artifacts. Focused review/composed suite33PASS. Same unchanged dependency/tooling audit remains PASS. No native-isolation/live/production success inferred from skips. PR108 remains open/unmerged; issue56open. Current branchissue-56-work-budget-enforcement, basee2348656238a2ff9a3244868e2beb543d86f15a5, cleanHEAD23a28e31. Next review must reserve ordinal6/10 and freshly inspect COMPLETE PR, not merely the latest fix. These are implementation/remediation receipts, not approval. No external mutation/live spending/realprofilemigration/deploy/main/force/amend.

adrian.tkacz referenced this issue from a commit 2026-10-27 06:15:53 +00:00

fix: retain clock evidence across refusal and clean up mid-step expiry (#56)

kilo commented 2026-10-27 06:36:56 +00:00

Author

Member

Copy link

Whole-PR Reviews 6–7 And Current Recovery Work

Counter 7/10 consumed, including original PR94ordinal1; no reset. PR108 remains OPEN/UNMERGED, this issue OPEN. Current normal HEAD5b8cf8e5a23be0c1f808f6482a996243f1738924, basee2348656238a2ff9a3244868e2beb543d86f15a5.

Ordinal6 native ses_e8445dce5ffeOlm126gNX74uzV, HEAD23a28e31: REQUEST_CHANGES for clock evidence rolling back with refused capacity admission and mid-step BudgetRefused escaping the live reference STOP path. Normal commit5b8cf8e5 adds same-DB bounded clock-row pending/acquisition/committed-floor ordering, committed-only cache and lost-sample fail-closed recovery; schema4 with real installed schema2/schema3 downgrade refusal and backups. Mid-step refusal enters durable revocation and original-owned cleanup, including terminal turns.23regressions; complete gates/auditPASS.

Ordinal7 native ses_e83feb8deffeUcgipJYbzr2s3y, COMPLETE5b8cf8e5/basee2348656: REQUEST_CHANGES for two additional recovery boundaries:

• Interrupt dedupe after an already committed cancellation claim must not suppress qualified original-owned physical retirement when settlement proof is absent.
• Non-FOUND runtime.restore on a fresh wrong-group connection must remain explicit durable unknown/STOP, not become an unregistered-handle exception. No adoption of replacement ownership.

Those scoped fixes and actual retained-owner/fresh-connection crash regressions are underway in the same bounded sole-writer task. Parent retains all loop orchestration/review counters. This is ordinary engineering remediation, not a new architecture/owner-authority question and not a reason to weaken acceptance.

Latest independent gates1600passed/85explicitnative-prerequisite skips/106subtests and packagecheckPASS, including actual installed old-reader/refusal/backup/artifact tests. These passes do not override material findings or establish live/native isolation. No inference/production state/realprofilemigration/external mutation occurred. Next fresh COMPLETE PR review must reserveordinal8 against the new exact HEAD. Three review invocations remain under the unchanged finite limit; stale approvals/self-review cannot substitute.

## Whole-PR Reviews 6–7 And Current Recovery Work Counter **7/10 consumed**, including original PR94ordinal1; no reset. PR108 remains OPEN/UNMERGED, this issue OPEN. Current normal HEAD5b8cf8e5a23be0c1f808f6482a996243f1738924, basee2348656238a2ff9a3244868e2beb543d86f15a5. Ordinal6 native `ses_e8445dce5ffeOlm126gNX74uzV`, HEAD23a28e31: REQUEST_CHANGES for clock evidence rolling back with refused capacity admission and mid-step BudgetRefused escaping the live reference STOP path. Normal commit5b8cf8e5 adds same-DB bounded clock-row pending/acquisition/committed-floor ordering, committed-only cache and lost-sample fail-closed recovery; schema4 with real installed schema2/schema3 downgrade refusal and backups. Mid-step refusal enters durable revocation and original-owned cleanup, including terminal turns.23regressions; complete gates/auditPASS. Ordinal7 native `ses_e83feb8deffeUcgipJYbzr2s3y`, COMPLETE5b8cf8e5/basee2348656: REQUEST_CHANGES for two additional recovery boundaries: - Interrupt dedupe after an already committed cancellation claim must not suppress qualified original-owned physical retirement when settlement proof is absent. - Non-FOUND runtime.restore on a fresh wrong-group connection must remain explicit durable unknown/STOP, not become an unregistered-handle exception. No adoption of replacement ownership. Those scoped fixes and actual retained-owner/fresh-connection crash regressions are underway in the same bounded sole-writer task. Parent retains all loop orchestration/review counters. This is ordinary engineering remediation, not a new architecture/owner-authority question and not a reason to weaken acceptance. Latest independent gates1600passed/85explicitnative-prerequisite skips/106subtests and packagecheckPASS, including actual installed old-reader/refusal/backup/artifact tests. These passes do not override material findings or establish live/native isolation. No inference/production state/realprofilemigration/external mutation occurred. Next fresh COMPLETE PR review must reserveordinal8 against the new exact HEAD. Three review invocations remain under the unchanged finite limit; stale approvals/self-review cannot substitute.

adrian.tkacz referenced this issue from a commit 2026-10-27 07:30:49 +00:00

fix: reconcile STOP claims without adopting replacement ownership (#56)

adrian.tkacz referenced this issue from a commit 2026-10-27 09:26:36 +00:00

fix: recover original STOP targets from durable native receipts (#56)

kilo commented 2026-10-27 09:46:35 +00:00

Author

Member

Copy link

Whole-PR Reviews 8–9: Last Bounded Remediation

Conserved counter 9/10 consumed, including original specification PR94ordinal1. PR108 remains OPEN/UNMERGED; issue56OPEN. Current normal HEAD7fa95a422f459ec710452e3099065017240a1f98, basee2348656238a2ff9a3244868e2beb543d86f15a5. No reset/new delivery cycle inferred from functional scope expansion.

Ordinal8 native ses_e83baa442ffeInPz376xmh59Nc, HEAD19174b84: REQUEST_CHANGES for the natural runtime-receipt-before-accepted-observation crash. Normal commit7fa95a42 validates exact original receipt/Attempt/input/allocation/identity/current-fence bindings before STOP target selection, reconciles native-return evidence without new work/candidate acceptance, and keeps missing/stale targets explicitly uncertain.40natural/composed regressions do not manually install acceptance first. Full implementation gates1656PASS85nativeprereqskips106subtests/packagecheckPASS.

Ordinal9 native ses_e83506a7effe2OKZGJQ2oVYaXN, COMPLETE7fa95a42/basee2348656: REQUEST_CHANGES with three new P2 findings:

• run_task decision_time still samples the boot clock outside durable observation/high-water protocol, missing higher-observation/rollback and crash ordering.
• Fresh SQLite initialization precedes initial clock/projection validation, potentially stranding a zero-dispatch directory after a transient prerequisite failure.
• A corrected one-second-deadline test freezes wall time but not boot time; two cases actually failed in the independent prepared environment. Controlled clock fixtures are required, not weaker timing/assertions.

Ordinal9 makecheck:1654passed,2failed,85prerequisite skips,106subtests,577.51s. Secret scan after pytest was not reached; independent full-range diffcheck passed. Packagecheck including actual installed older-reader refusal passed. This is change-caused deterministic-coverage failure, not an external capability blocker or reason to waive checks.

Same bounded sole-writer task is fixing all three roots and rerunning COMPLETE gates. Only ordinal10 remains; it must be a fresh complete exact-HEAD independent review, not implementation self-review or a resumed reviewer. No merge/closure without exact current APPROVE, empty material findings and complete gates. If the final finite review cannot approve, existing STOP_REVISE/BLOCKED terminal rules apply to the entire invocation; no hidden reset, extra dispatch, force merge or skipping this delivery. Other backlog work is not claimed complete or QUEUE_EMPTY.

No owner architecture reconfirmation, new security boundary, external mutation, live inference, realprofile operation or deployment is involved.

## Whole-PR Reviews 8–9: Last Bounded Remediation Conserved counter **9/10 consumed**, including original specification PR94ordinal1. PR108 remains OPEN/UNMERGED; issue56OPEN. Current normal HEAD7fa95a422f459ec710452e3099065017240a1f98, basee2348656238a2ff9a3244868e2beb543d86f15a5. No reset/new delivery cycle inferred from functional scope expansion. Ordinal8 native `ses_e83baa442ffeInPz376xmh59Nc`, HEAD19174b84: REQUEST_CHANGES for the natural runtime-receipt-before-accepted-observation crash. Normal commit7fa95a42 validates exact original receipt/Attempt/input/allocation/identity/current-fence bindings before STOP target selection, reconciles native-return evidence without new work/candidate acceptance, and keeps missing/stale targets explicitly uncertain.40natural/composed regressions do not manually install acceptance first. Full implementation gates1656PASS85nativeprereqskips106subtests/packagecheckPASS. Ordinal9 native `ses_e83506a7effe2OKZGJQ2oVYaXN`, COMPLETE7fa95a42/basee2348656: REQUEST_CHANGES with three new P2 findings: - run_task decision_time still samples the boot clock outside durable observation/high-water protocol, missing higher-observation/rollback and crash ordering. - Fresh SQLite initialization precedes initial clock/projection validation, potentially stranding a zero-dispatch directory after a transient prerequisite failure. - A corrected one-second-deadline test freezes wall time but not boot time; two cases actually failed in the independent prepared environment. Controlled clock fixtures are required, not weaker timing/assertions. Ordinal9 makecheck:1654passed,2failed,85prerequisite skips,106subtests,577.51s. Secret scan after pytest was not reached; independent full-range diffcheck passed. Packagecheck including actual installed older-reader refusal passed. This is change-caused deterministic-coverage failure, not an external capability blocker or reason to waive checks. Same bounded sole-writer task is fixing all three roots and rerunning COMPLETE gates. Only ordinal10 remains; it must be a fresh complete exact-HEAD independent review, not implementation self-review or a resumed reviewer. No merge/closure without exact current APPROVE, empty material findings and complete gates. If the final finite review cannot approve, existing STOP_REVISE/BLOCKED terminal rules apply to the entire invocation; no hidden reset, extra dispatch, force merge or skipping this delivery. Other backlog work is not claimed complete or QUEUE_EMPTY. No owner architecture reconfirmation, new security boundary, external mutation, live inference, realprofile operation or deployment is involved.

adrian.tkacz referenced this issue from a commit 2026-10-27 11:00:29 +00:00

fix: journal application clock reads before task authority decisions (#56)

kilo commented 2026-10-27 11:20:07 +00:00

Author

Member

Copy link

STOP_REVISE — Finite Whole-PR Budget Exhausted

TERMINAL for the entire /loop invocation kernel-loop-20261027T005900Z. Conserved counter10/10 includes original PR94specificationordinal1 and fresh functional whole-PR reviews2–10. No counter reset, extra review, self-review approval, force/auto merge, continued product patching or queue-skipping is authorized in this invocation.

Exact Preserved Subject

PR #108 remains OPEN/UNMERGED; issue #56 remains OPEN. Clean ordinary branch issue-56-work-budget-enforcement, pushed HEAD d1d55d406923674c847b98a30756a05e87b52d2c, base/merge-base/current canonical develop e2348656238a2ff9a3244868e2beb543d86f15a5. Nine normal implementation/remediation commits retained, no amend/force/history rewrite. Final parent read-only Git/MCP currentness matches these refs. No product edits after the final review result.

Final Independent Review

Fresh native task ses_e82fa5df9ffergwywKo4CjS5Nj, ordinal10/10, COMPLETE exact subject above: REQUEST_CHANGES, one remaining P2 at src/creatidy_kernel/ports/intake.py:703–707.

approve() records/consumes the owner decision and creates or amends the Program at665–702 BEFORE validating the immutable original work-budget expiry/project/task policies. A changed decision expires_at or incompatible policy can therefore raise BudgetRefused after AmendProgramSpec has already committed. The new Program digest no longer matches the retained binding; previous approval becomes stale although the caller received no ApprovedMeaning. Rejection is not atomic with the approval state it invalidates.

Required future remediation: prevalidate original envelope compatibility and preserve original expiry, then make final decision/Program/binding admission incapable of partial invalidation. Regression tests must show refusal preserves prior Program, approval applicability and budget binding for changed expiry and incompatible policy.

New Versus Recurring Evidence

This is a new intake approval counterexample, not an identical earlier finding left unpatched. Earlier specific findings were not repeated in the final whole-PR review, but that is not full correctness or approval. Recurring semantic patterns were validation versus durable transaction boundaries; clock observation versus committed proof; runtime-return/acceptance/settlement distinctions; natural crash cuts versus manually prepared fixtures; and dedupe versus qualified cleanup. The final intake defect repeats the broad atomic-boundary risk in a new call path.

Validation And Limits

Latest implementation complete makecheck:1670passed,85explicitnative-prerequisite skips,106subtests,505.86s, through secret scanning/diffcheck; packagecheckPASS. Final independent reviewer also executed both required gates successfully, including actual installed historical schema2/schema3 readers refusing schema4 and backup/artifact recovery. Relevant unchanged-lock tooling auditPASS. Passing gates do NOT override the material finding or supply exact APPROVE. Native/OCI/realCodex/live/billing/isolation claims remain unproved where skipped; no such upgrade is made.

Disposition

No merge or functional completion receipt for #56. The backlog is NOT QUEUE_EMPTY. The invocation stops rather than silently choosing another issue or resetting counters. Existing STOP_REVISE policy requires a genuinely new explicit owner restart decision before further patches/reviews; this is not a request to reconfirm accepted architecture/backlog or diagnose routine tools.

PhaseA–C remain complete: actual #105/#106, active scopes/priorities and28verified native edges, preserved history/exclusions, independent ALIGNMENT_PASS, delegated ARCHITECTURE_BACKLOG_ALIGNED in #103comment19309, completion19327 and integrated documentation PR107/e2348656 after architecture PR104/ace7175e. /loop actually ran selected56 implementation/reviews, but now STOP_REVISE; full product delivery is not claimed. No external repo mutation/live inference/production credentials/realprofile migration/main/release/deployment.

## STOP_REVISE — Finite Whole-PR Budget Exhausted **TERMINAL for the entire `/loop` invocation `kernel-loop-20261027T005900Z`.** Conserved counter10/10 includes original PR94specificationordinal1 and fresh functional whole-PR reviews2–10. No counter reset, extra review, self-review approval, force/auto merge, continued product patching or queue-skipping is authorized in this invocation. ### Exact Preserved Subject PR #108 remains OPEN/UNMERGED; issue #56 remains OPEN. Clean ordinary branch `issue-56-work-budget-enforcement`, pushed HEAD **`d1d55d406923674c847b98a30756a05e87b52d2c`**, base/merge-base/current canonical develop **`e2348656238a2ff9a3244868e2beb543d86f15a5`**. Nine normal implementation/remediation commits retained, no amend/force/history rewrite. Final parent read-only Git/MCP currentness matches these refs. No product edits after the final review result. ### Final Independent Review Fresh native task `ses_e82fa5df9ffergwywKo4CjS5Nj`, ordinal10/10, COMPLETE exact subject above: **REQUEST_CHANGES**, one remaining P2 at `src/creatidy_kernel/ports/intake.py:703–707`. `approve()` records/consumes the owner decision and creates or amends the Program at665–702 BEFORE validating the immutable original work-budget expiry/project/task policies. A changed decision expires_at or incompatible policy can therefore raise BudgetRefused after AmendProgramSpec has already committed. The new Program digest no longer matches the retained binding; previous approval becomes stale although the caller received no ApprovedMeaning. Rejection is not atomic with the approval state it invalidates. Required future remediation: prevalidate original envelope compatibility and preserve original expiry, then make final decision/Program/binding admission incapable of partial invalidation. Regression tests must show refusal preserves prior Program, approval applicability and budget binding for changed expiry and incompatible policy. ### New Versus Recurring Evidence This is a **new intake approval counterexample**, not an identical earlier finding left unpatched. Earlier specific findings were not repeated in the final whole-PR review, but that is not full correctness or approval. Recurring semantic patterns were validation versus durable transaction boundaries; clock observation versus committed proof; runtime-return/acceptance/settlement distinctions; natural crash cuts versus manually prepared fixtures; and dedupe versus qualified cleanup. The final intake defect repeats the broad atomic-boundary risk in a new call path. ### Validation And Limits Latest implementation complete makecheck:1670passed,85explicitnative-prerequisite skips,106subtests,505.86s, through secret scanning/diffcheck; packagecheckPASS. Final independent reviewer also executed both required gates successfully, including actual installed historical schema2/schema3 readers refusing schema4 and backup/artifact recovery. Relevant unchanged-lock tooling auditPASS. Passing gates do NOT override the material finding or supply exact APPROVE. Native/OCI/realCodex/live/billing/isolation claims remain unproved where skipped; no such upgrade is made. ### Disposition No merge or functional completion receipt for #56. The backlog is NOT QUEUE_EMPTY. The invocation stops rather than silently choosing another issue or resetting counters. Existing STOP_REVISE policy requires a genuinely new explicit owner restart decision before further patches/reviews; this is not a request to reconfirm accepted architecture/backlog or diagnose routine tools. PhaseA–C remain complete: actual #105/#106, active scopes/priorities and28verified native edges, preserved history/exclusions, independent ALIGNMENT_PASS, delegated ARCHITECTURE_BACKLOG_ALIGNED in #103comment19309, completion19327 and integrated documentation PR107/e2348656 after architecture PR104/ace7175e. `/loop` actually ran selected56 implementation/reviews, but now STOP_REVISE; full product delivery is not claimed. No external repo mutation/live inference/production credentials/realprofile migration/main/release/deployment.

kilo referenced this issue 2026-10-27 11:20:07 +00:00

feat: enforce configured whole-work budget envelopes (#56) #108

kilo commented 2026-10-27 15:37:35 +00:00

Author

Member

Copy link

Explicit Owner-Authorized Persistence-Boundary Recovery

Direct owner mandate of 2026-10-27T15:34:28Z authorizes ONE materially revised bounded delivery, identity kernel56-atomic-approval-recovery-20261027T153428Z, not an extension/reset of the stopped delivery. PR #108 remains an immutable STOP_REVISE receipt at HEAD d1d55d406923674c847b98a30756a05e87b52d2c, base e2348656238a2ff9a3244868e2beb543d86f15a5, permanently 10/10 consumed (including original specification PR94 ordinal1). No original review11, unapproved-head merge, rewrite or branch deletion.

Confirmed final defect: OrdinaryIntake.approve records decision/consumption and creates/amends Program before immutable budget rejection. New delivery must prove atomic decision/consumption/Program/budget acceptance, prevalidate compatible original envelopes, enforce remaining invariants at the SQLite owner transaction, retain independently durable clock observations and fail-closed semantics, and exercise new/amended/replayed/incompatible/failing/reopened operations. Related split initialization boundaries are included in the audit, not new architecture.

Replacement branch issue-56-atomic-approval-recovery retains exact original implementation ancestry. This distinct scope has a maximum four fresh whole-PR independent reviews, starting 0/4, only after comprehensive validation. Reviews must use fresh Sol 6.1 High contexts and full exact-head subjects. Original history remains permanent and separate. Replacement PR/supersession receipt will be linked explicitly; no acceptance claimed.

Only after new exact approval, all required gates/currentness and integrated acceptance may existing owner-authorized /loop merge/completion run, followed by fresh canonical SELECT, including independently eligible #59 and #105. No ADR0012 change, external product mutation, live inference, release or deployment.

## Explicit Owner-Authorized Persistence-Boundary Recovery Direct owner mandate of 2026-10-27T15:34:28Z authorizes ONE materially revised bounded delivery, identity `kernel56-atomic-approval-recovery-20261027T153428Z`, not an extension/reset of the stopped delivery. PR #108 remains an immutable STOP_REVISE receipt at HEAD `d1d55d406923674c847b98a30756a05e87b52d2c`, base `e2348656238a2ff9a3244868e2beb543d86f15a5`, permanently **10/10** consumed (including original specification PR94 ordinal1). No original review11, unapproved-head merge, rewrite or branch deletion. Confirmed final defect: OrdinaryIntake.approve records decision/consumption and creates/amends Program before immutable budget rejection. New delivery must prove atomic decision/consumption/Program/budget acceptance, prevalidate compatible original envelopes, enforce remaining invariants at the SQLite owner transaction, retain independently durable clock observations and fail-closed semantics, and exercise new/amended/replayed/incompatible/failing/reopened operations. Related split initialization boundaries are included in the audit, not new architecture. Replacement branch `issue-56-atomic-approval-recovery` retains exact original implementation ancestry. This distinct scope has a maximum **four fresh whole-PR independent reviews**, starting 0/4, only after comprehensive validation. Reviews must use fresh Sol 6.1 High contexts and full exact-head subjects. Original history remains permanent and separate. Replacement PR/supersession receipt will be linked explicitly; no acceptance claimed. Only after new exact approval, all required gates/currentness and integrated acceptance may existing owner-authorized /loop merge/completion run, followed by fresh canonical SELECT, including independently eligible #59 and #105. No ADR0012 change, external product mutation, live inference, release or deployment.

kilo referenced this issue 2026-10-27 15:38:41 +00:00

feat: enforce configured whole-work budget envelopes (#56) #108

adrian.tkacz referenced this issue from a commit 2026-10-27 16:21:45 +00:00

fix: accept approved work and immutable budgets atomically (#56)

kilo referenced this issue 2026-10-27 16:22:17 +00:00

fix: atomically accept work approval and immutable budgets (#56) #109

kilo commented 2026-10-27 16:38:50 +00:00

Author

Member

Copy link

Replacement PR And Recovery Review 1/4

Replacement PR #109 #109 is open/unmerged, branch issue-56-atomic-approval-recovery, HEAD 76083c7a95abd8b3e801506a1e4f55b164328bab, base e2348656238a2ff9a3244868e2beb543d86f15a5. Original PR108 is CLOSED/UNMERGED as superseded; original branch/9commits/native history remain intact at permanent10/10. New delivery identity/provenance is #19377, not an original counter extension.

New atomic owner acceptance commits configured decision/consumption/Program/binding/artifact references together or none; original clock evidence commits separately, original projections persist, configured envelopes cannot be removed through legacy paths. Related task/offline/live-reference initialization shares this primitive.24newregressions and final primary makecheck1694PASS85existingnativeprerequisite skips106subtests/packagecheckPASS; budget-removal bypass reproduced failing before guard.

Fresh whole-PR requested GPT-6.1 Sol High, task ses_e81d3addaffeuriOHGR0VP3Lqb, recovery ordinal1/4, independently verified entire41-file current delta, initial/final canonical/local refs and clean checkout; independent makecheck1694PASS85same skips106subtests/packagecheckPASS. Verdict REQUEST_CHANGES, one NEW P1: unresolved verification-command recovery and WorkUncertain return before supported STOP/expiry cleanup of an independently identifiable still-owned runtime group. No-publication/refused workspace reuse is correct, but does not discharge bounded cancellation. Earlier atomic-approval defect not repeated; no general approval inferred.

In-scope #56AC3 remediation is underway with natural crash/STOP/boot-expiry regressions: preserve command unknown/no reset/reexecution, yet run existing exact receipt/fence/original-owned runtime retirement. No numericPID adoption/new cleanup architecture. Three recovery reviews remain, next must be fresh complete exact-head review after normal commit and full gates. No merge/closure/live effects/external mutation or gate weakening.

## Replacement PR And Recovery Review 1/4 Replacement **PR #109** https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/109 is open/unmerged, branch `issue-56-atomic-approval-recovery`, HEAD `76083c7a95abd8b3e801506a1e4f55b164328bab`, base `e2348656238a2ff9a3244868e2beb543d86f15a5`. Original PR108 is CLOSED/UNMERGED as superseded; original branch/9commits/native history remain intact at permanent10/10. New delivery identity/provenance is #19377, not an original counter extension. New atomic owner acceptance commits configured decision/consumption/Program/binding/artifact references together or none; original clock evidence commits separately, original projections persist, configured envelopes cannot be removed through legacy paths. Related task/offline/live-reference initialization shares this primitive.24newregressions and final primary makecheck1694PASS85existingnativeprerequisite skips106subtests/packagecheckPASS; budget-removal bypass reproduced failing before guard. Fresh whole-PR requested **GPT-6.1 Sol High**, task `ses_e81d3addaffeuriOHGR0VP3Lqb`, recovery ordinal**1/4**, independently verified entire41-file current delta, initial/final canonical/local refs and clean checkout; independent makecheck1694PASS85same skips106subtests/packagecheckPASS. Verdict **REQUEST_CHANGES**, one NEW P1: unresolved verification-command recovery and WorkUncertain return before supported STOP/expiry cleanup of an independently identifiable still-owned runtime group. No-publication/refused workspace reuse is correct, but does not discharge bounded cancellation. Earlier atomic-approval defect not repeated; no general approval inferred. In-scope #56AC3 remediation is underway with natural crash/STOP/boot-expiry regressions: preserve command unknown/no reset/reexecution, yet run existing exact receipt/fence/original-owned runtime retirement. No numericPID adoption/new cleanup architecture. Three recovery reviews remain, next must be fresh complete exact-head review after normal commit and full gates. No merge/closure/live effects/external mutation or gate weakening.

adrian.tkacz referenced this issue from a commit 2026-10-27 17:01:09 +00:00

fix: retain runtime STOP cleanup with uncertain tool commands (#56)

adrian.tkacz referenced this issue from a commit 2026-10-27 18:11:59 +00:00

fix: refresh final approval clocks and preserve uncertain resource holds (#56)

kilo referenced this issue from a commit 2026-10-27 18:41:36 +00:00

Merge pull request #109: atomic work approval and immutable budget recovery

kilo referenced this issue 2026-10-27 18:42:11 +00:00

fix: atomically accept work approval and immutable budgets (#56) #109

kilo commented 2026-10-27 18:42:40 +00:00

Author

Member

Copy link

Integrated Acceptance And Completion

Owner-authorized recovery kernel56-atomic-approval-recovery-20261027T153428Z completed through replacement PR109 #109, merged at2026-10-27T18:41:35Z as b11aae420517b14bbb4d85c84f9a0d82c14446c6. Approved HEAD ecfee7d04fae5149ba4538d706ebb303662a6458, approved base e2348656238a2ff9a3244868e2beb543d86f15a5. Canonical PR readback/fetch verifies actual merge, exact two parents, approved HEAD ancestor of develop and integrated tree identical to approved/tested tree. No direct develop push/force/auto/squash/deletion.

Active AC1-6 Verified On Integrated Content

Criterion	Actual evidence
AC1 finite atomic work capacity	SQLite-owner project/task reservations across attempts/review/remediation, race/exhaustion tests; configured ordinary decisions+consumption+Program+budget+artifact references now one acceptance commit. Incompatible/removed envelopes and real COMMIT failure leave no inconsistent business effects. Reservation remains distinct from usage.
AC2 original time and authority	Original wall/boot projection plus independent durable pending/high-water/origin evidence, same-boot reopen, rollback/reboot/unavailable refusal; fresh post-validation boot cut for new/amended/replayed approvals. Original expiry/anchors survive rejection and failed commit; inert origin grants no Program/budget authority. Exact Attempt/Operation/revocation gates retained.
AC3 bounded work and STOP	Actual retry/review/remediation/tool/output-byte admissions and bounded process work, exact original native receipt/fence/owned-group cancellation. Eight composed real-synthetic-processgroup STOP/boot-expiry tests verify unresolved TOOL ownership cannot skip runtime retirement, fabricate TOOL settlement, restore/reset workspace or publish; repeated/replacement recovery remains fail-closed.
AC4 separate consumption and corrections	Unit/currency/provenance-preserving immutable observations, same-source correction/dedupe/export; supported owner records count, effective estimates remain uncertain even for current-operation redispatch. Program/project and reopen tests prove over-cap and provenance-changing correction refuse.
AC5 honest unsupported bounds	Missing/hidden/inflight consumption remains unknown; physical settlement does not release unknown resource hold. Unsupported strict inference refuses; basic externally configured clients retain explicit unknowns rather than billing/hard-cap claims. No blanket private Router dependency.
AC6 installed/reopen/crash/race/compatibility	Whole-issue enforcement suites plus24atomic+8STOP+34finalcut+2taskretry recovery cases. Installed ordinary/source/budget smokes, crash/reopen/boot expiry and actual historical schema2/schema3 reader refusal of schema4, original bytes/backups/artifacts preserved.

Final primary closed/offline make check: 1738passed,85existingoptionalnative skips,106subtests,585.17s, all locked/static/types/inward-import/secrets/diff gatesPASS; packagecheckPASS; auditNO KNOWN VULNERABILITIES. Fresh independent whole-PR GPT-6.1 Sol High recovery3/4 (ses_e816f34d1ffe0krOQLsBWMg7bs) APPROVE/findings[] on exact approved refs, own check1738PASS/85skip/106subtests562.62s/packagePASS. ExactHEAD CI3281/UI243SUCCESS. Red-first counterexamples retained; no gate weakened.

Immutable History

Original PR108 CLOSED/UNMERGED/STOP_REVISE, permanently10/10 (including original PR94 specificationordinal1), original branch issue-56-work-budget-enforcement atd1d55d406923674c847b98a30756a05e87b52d2c and all nine implementation/remediation commits/native review results preserved. New four normal commits76083c7a,201c8f5f,81631a27,ecfee7d0 retain that full ancestry. Separate authorized recovery 3/4: REQUEST_CHANGES, REQUEST_CHANGES, APPROVE. One unused slot; no original11 or recovery4. PR109receipt19415 preserves exact review/merge provenance.

85 skipped native opt-ins are NOT live inference/provider-billing/strict syscall expiry/hostile isolation/product GO. No ADR0012/architecture replanning, SR/MI/CC mutation, production profiles/credentials, main/release/deploy. Scoped msgpack dev-lock patch repairs observed audit CVE without new product dependency. Full acceptance is the active synthetic/self-contained scope, not superseded historical live requirements.

Closing56 only after this verified integrated acceptance. Next: safely return same checkout to canonical develop and rebuild FULL fresh canonical SELECT, explicitly assessing #59 and #105 independently rather than treating former56 restrictions as repository-wide.

## Integrated Acceptance And Completion Owner-authorized recovery `kernel56-atomic-approval-recovery-20261027T153428Z` completed through replacement **PR109** https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/109, merged at2026-10-27T18:41:35Z as **`b11aae420517b14bbb4d85c84f9a0d82c14446c6`**. Approved HEAD **`ecfee7d04fae5149ba4538d706ebb303662a6458`**, approved base **`e2348656238a2ff9a3244868e2beb543d86f15a5`**. Canonical PR readback/fetch verifies actual merge, exact two parents, approved HEAD ancestor of develop and integrated tree identical to approved/tested tree. No direct develop push/force/auto/squash/deletion. ### Active AC1-6 Verified On Integrated Content | Criterion | Actual evidence | |---|---| | AC1 finite atomic work capacity | SQLite-owner project/task reservations across attempts/review/remediation, race/exhaustion tests; configured ordinary decisions+consumption+Program+budget+artifact references now one acceptance commit. Incompatible/removed envelopes and real COMMIT failure leave no inconsistent business effects. Reservation remains distinct from usage. | | AC2 original time and authority | Original wall/boot projection plus independent durable pending/high-water/origin evidence, same-boot reopen, rollback/reboot/unavailable refusal; fresh post-validation boot cut for new/amended/replayed approvals. Original expiry/anchors survive rejection and failed commit; inert origin grants no Program/budget authority. Exact Attempt/Operation/revocation gates retained. | | AC3 bounded work and STOP | Actual retry/review/remediation/tool/output-byte admissions and bounded process work, exact original native receipt/fence/owned-group cancellation. Eight composed real-synthetic-processgroup STOP/boot-expiry tests verify unresolved TOOL ownership cannot skip runtime retirement, fabricate TOOL settlement, restore/reset workspace or publish; repeated/replacement recovery remains fail-closed. | | AC4 separate consumption and corrections | Unit/currency/provenance-preserving immutable observations, same-source correction/dedupe/export; supported owner records count, effective estimates remain uncertain even for current-operation redispatch. Program/project and reopen tests prove over-cap and provenance-changing correction refuse. | | AC5 honest unsupported bounds | Missing/hidden/inflight consumption remains unknown; physical settlement does not release unknown resource hold. Unsupported strict inference refuses; basic externally configured clients retain explicit unknowns rather than billing/hard-cap claims. No blanket private Router dependency. | | AC6 installed/reopen/crash/race/compatibility | Whole-issue enforcement suites plus24atomic+8STOP+34finalcut+2taskretry recovery cases. Installed ordinary/source/budget smokes, crash/reopen/boot expiry and actual historical schema2/schema3 reader refusal of schema4, original bytes/backups/artifacts preserved. | Final primary closed/offline `make check`: **1738passed,85existingoptionalnative skips,106subtests**,585.17s, all locked/static/types/inward-import/secrets/diff gatesPASS; packagecheckPASS; auditNO KNOWN VULNERABILITIES. Fresh independent whole-PR **GPT-6.1 Sol High recovery3/4** (`ses_e816f34d1ffe0krOQLsBWMg7bs`) **APPROVE/findings[]** on exact approved refs, own check1738PASS/85skip/106subtests562.62s/packagePASS. ExactHEAD CI3281/UI243SUCCESS. Red-first counterexamples retained; no gate weakened. ### Immutable History Original **PR108 CLOSED/UNMERGED/STOP_REVISE, permanently10/10** (including original PR94 specificationordinal1), original branch `issue-56-work-budget-enforcement` atd1d55d406923674c847b98a30756a05e87b52d2c and all nine implementation/remediation commits/native review results preserved. New four normal commits76083c7a,201c8f5f,81631a27,ecfee7d0 retain that full ancestry. Separate authorized recovery **3/4**: REQUEST_CHANGES, REQUEST_CHANGES, APPROVE. One unused slot; no original11 or recovery4. PR109receipt19415 preserves exact review/merge provenance. 85 skipped native opt-ins are NOT live inference/provider-billing/strict syscall expiry/hostile isolation/product GO. No ADR0012/architecture replanning, SR/MI/CC mutation, production profiles/credentials, main/release/deploy. Scoped msgpack dev-lock patch repairs observed audit CVE without new product dependency. Full acceptance is the active synthetic/self-contained scope, not superseded historical live requirements. Closing56 only after this verified integrated acceptance. Next: safely return same checkout to canonical develop and rebuild FULL fresh canonical SELECT, explicitly assessing #59 and #105 independently rather than treating former56 restrictions as repository-wide.

kilo closed this issue 2026-10-27 18:42:45 +00:00

kilo referenced this issue 2026-10-27 18:49:54 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-27 19:56:42 +00:00

feat: own work claims and reconciled task resources (#59) #110

kilo referenced this issue 2026-10-27 19:57:10 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-27 20:16:01 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-27 22:38:15 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-27 23:55:35 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-28 01:15:46 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-28 02:27:15 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-28 04:15:15 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-28 05:49:11 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue from a commit 2026-10-28 11:22:05 +00:00

Merge pull request #110: work claims and reconciled resource ownership

kilo referenced this issue 2026-10-28 11:23:20 +00:00

feat: own work claims and reconciled task resources (#59) #110

kilo referenced this issue 2026-10-28 11:23:52 +00:00

[Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation #59

kilo referenced this issue 2026-10-28 11:38:26 +00:00

Deliver independent work, SCM, CI and knowledge drivers with a heterogeneous project path #105

kilo referenced this issue 2026-10-29 21:16:06 +00:00

Deliver ordinary Program execution with shared pull and managed push handoffs #106

kilo referenced this issue 2026-10-29 21:21:57 +00:00

Deliver ordinary Program execution with shared pull and managed push handoffs #106

kilo referenced this issue 2026-10-30 17:51:49 +00:00

feat: coordinate ordinary Forgejo programs in pull and push modes (#106) #112

kilo referenced this issue 2026-11-01 02:24:13 +00:00

Deliver ordinary Program execution with shared pull and managed push handoffs #106

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

develop

issue-62-installed-compatibility

issue-58-private-outcome-export

issue-57-recovery-preparation-alerts

issue-57-owner-served-state

issue-106-final-authority-dag

issue-106-forgejo-ordinary-execution

issue-105-independent-provider-drivers

issue-59-work-resource-ownership

issue-56-atomic-approval-recovery

issue-56-work-budget-enforcement

issue-103-publish-architecture-backlog

issue-62-platform-reception

issue-55-mi-utilized-reference

issue-52-kilo-offline-proof

docs/conversational-review-policy

issue-60-reception-fixture-plan

issue-62-compatibility-matrix-spec

issue-58-export-rights-spec

issue-57-owner-state-spec

issue-56-task-cost-shapes

issue-90-owned-cancellation

issue-54-product-review

issue-53-runtime-integration

No results found.

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks

#58 [Kernel][G07] Deliver versioned private outcome and full-cost evidence export

Creatidy/creatidy-kernel

#60 [Kernel][G01-G13] Accept the installed controlled-task path end to end

Creatidy/creatidy-kernel

#106 Deliver ordinary Program execution with shared pull and managed push handoffs

Creatidy/creatidy-kernel

Depends on

#48 [Kernel][G01 G12] Repair bounded-task lifetime, recovery and original deadline enforcement

Creatidy/creatidy-kernel

#49 [Kernel][G02 G05] Prepare and authorize versioned specifications from ordinary issues

Creatidy/creatidy-kernel

#54 [Kernel][G03] Implement durable candidate-bound product review and remediation

Creatidy/creatidy-kernel

Reference

Creatidy/creatidy-kernel#56

No description provided.