Creatidy/creatidy-kernel
5
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

[K3] Synthetic execution, workspace, and authority enforcement #6

New issue
Closed
opened 2026-09-22 16:49:35 +00:00 by kilo · 3 comments
kilo commented 2026-09-22 16:49:35 +00:00
Member
Copy link

Goal

Prove the execution boundary with fake Runtime and Workspace implementations plus synthetic authority enforcement, including start/observe/cancel/reconcile and stale-worker rejection.

Why

Workers are replaceable and untrusted; core semantics must be exercised before live providers.

Scope

In scope

Core Runtime/Workspace/authority ports; producer-shaped fakes; synthetic isolation/enforcement; immutable Attempt start via Operation; freshness, candidate retrieval, cancellation, known-key reconciliation, runtime identity, and unknown/unavailable outcomes; tests for capability/path/network/expiry/revocation, cancel races, missing sessions, delayed healthy work, stale publication, invalid candidate, and lost start reply.

Out of scope

Codex, Forgejo, hostile-code OS sandbox, custom container/secrets manager, verification verdicts, CLI, and paid/cloud inference.

Acceptance Criteria

  • Fake Runtime executes an immutable Attempt through candidate publication while control-plane mutations remain authority-checked.
  • Unsupported recovery/identity is unknown/unavailable; duplicate starts and terminal replays are safe.
  • Quiet healthy activity remains healthy/waiting and recovery targets the exact execution, not global age (A: false child stall).
  • Worker grants/acceptance/gate changes, control-state/credential access, workspace escape, and stale-fence publication are rejected.
  • Deterministic synthetic tests preserve replaceable ports and no vendor imports.
  • Custom sandbox is explicitly excluded and supported trust mode is honest.

Constraints

  • Direct prerequisite: issue #13 (K2B). Direct dependent: issue #7.
  • Use existing OS/container/credential mechanisms for actual isolation; preserve ADR 0004, ADR 0005, and threat model.

Links

  • Parent: issue #3 #3
  • Direct prerequisite: issue #13 #13
  • Direct dependent: issue #7 #7
  • Architecture: docs/architecture/contracts.md, docs/architecture/threat-model.md, docs/adr/0004-ports-and-resources.md, docs/adr/0005-authority-and-acceptance.md
## Goal Prove the execution boundary with fake Runtime and Workspace implementations plus synthetic authority enforcement, including start/observe/cancel/reconcile and stale-worker rejection. ## Why Workers are replaceable and untrusted; core semantics must be exercised before live providers. ## Scope ### In scope Core Runtime/Workspace/authority ports; producer-shaped fakes; synthetic isolation/enforcement; immutable Attempt start via Operation; freshness, candidate retrieval, cancellation, known-key reconciliation, runtime identity, and unknown/unavailable outcomes; tests for capability/path/network/expiry/revocation, cancel races, missing sessions, delayed healthy work, stale publication, invalid candidate, and lost start reply. ### Out of scope Codex, Forgejo, hostile-code OS sandbox, custom container/secrets manager, verification verdicts, CLI, and paid/cloud inference. ## Acceptance Criteria - [ ] Fake Runtime executes an immutable Attempt through candidate publication while control-plane mutations remain authority-checked. - [ ] Unsupported recovery/identity is unknown/unavailable; duplicate starts and terminal replays are safe. - [ ] Quiet healthy activity remains healthy/waiting and recovery targets the exact execution, not global age (A: false child stall). - [ ] Worker grants/acceptance/gate changes, control-state/credential access, workspace escape, and stale-fence publication are rejected. - [ ] Deterministic synthetic tests preserve replaceable ports and no vendor imports. - [ ] Custom sandbox is explicitly excluded and supported trust mode is honest. ## Constraints - Direct prerequisite: issue #13 (K2B). Direct dependent: issue #7. - Use existing OS/container/credential mechanisms for actual isolation; preserve ADR 0004, ADR 0005, and threat model. ## Links - Parent: issue #3 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/3 - Direct prerequisite: issue #13 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/13 - Direct dependent: issue #7 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/7 - Architecture: `docs/architecture/contracts.md`, `docs/architecture/threat-model.md`, `docs/adr/0004-ports-and-resources.md`, `docs/adr/0005-authority-and-acceptance.md`
kilo commented 2026-09-25 22:31:41 +00:00
Author
Member
Copy link

Delivery ledger (issue #6)

PR: #18; branch: issue-6-synthetic-execution -> develop; current HEAD: 97ac9661709310d701adb790e0afcafc9d33b21d.
max_remediation_cycles = 10; remediation_used = 1.

  1. Full review, frozen HEAD 3cf0b229a10b8254892a0d36d24013ab7d372458, base 059482d045bd8e772005c9fbc1a9b89ce64ce26f: profile repository_review, L4 with reasoning/coding/tool_use >= 5/5/5 and required tool use/reasoning mode, numeric author floor unknown. Router selected zai/glm-5.3/max; dispatched zai-coding-plan/GLM-5.3/max (documented provider adapter; no fallback), catalog v4, profile policy v8, degraded=false. Fresh session ses_f254b6570ffep4ToYj85AesLDv, request am-1790375664161-6650lt, Agent Manager DISPATCH_VERIFIED; review #602 #18 (comment). Forgejo verdict COMMENT (body recommended APPROVE; same-account APPROVED rejected), not approval. A01 review atomicity claim required correction assessment; Q01 workspace lifetime, Q02 partial launch/credential. Remediation status done, resulting HEAD 97ac9661709310d701adb790e0afcafc9d33b21d, 1 / 10.

  2. Separate architecture/model-correction assessment at old frozen HEAD/base: same repository_review L4 5/5/5 hard requirements, unknown author numeric floor. Router selected zai/glm-5.3/max; dispatched zai-coding-plan/GLM-5.3/max (adapter, no fallback), catalog v4, policy v8, degraded=false. Fresh session ses_f24f9b93affeJaysViyowHjrSd, request am-1790381016656-qc6990, Agent Manager DISPATCH_VERIFIED; #18 (comment): BOUNDED_CORRECTION. A01 clarified: broker in-memory intent admission is atomic within its lock, not with SQLite; real durable adapter is separate, not issue #6 scope. Path/symlink allowed-root safety, uncertain partial launch, and lifetime/durable-broker deferral were changed on the same PR at 97ac9661709310d701adb790e0afcafc9d33b21d. Checks: focused tests 12 passed; make check 164 passed; make package-check passed; make audit passed before code-only remediation with dependency/tooling files unchanged. Remediation status done, 1 / 10.

  3. Fresh full review of whole PR at HEAD 97ac9661709310d701adb790e0afcafc9d33b21d, base 059482d045bd8e772005c9fbc1a9b89ce64ce26f: profile repository_review, L4 5/5/5, required tool use/reasoning mode, numeric author floor unknown. Router selected zai/glm-5.3/max; dispatched zai-coding-plan/GLM-5.3/max (adapter, no fallback), catalog v4, policy v8, degraded=false. Fresh session ses_f24f2c388ffeho2w4MT9EUaFaq, request am-1790381472800-iatsoy, Agent Manager DISPATCH_VERIFIED; review #603 #18 (comment). Forgejo verdict COMMENT (body recommends APPROVE, no blocking findings), not APPROVE; same-account author-review restriction remains. Q02 remaining provider-credential conformance is deferred to a real adapter because the fake has no credential. Remediation status none; resulting HEAD unchanged; 1 / 10.

Final exact-HEAD evidence: clean local branch; focused 12 passed; make check 164 passed, make package-check passed; Forgejo ci pull_request run #1948 (https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/33) succeeded on exact SHA; issue acceptance reviewed without unresolved blocking finding. REVIEW_INFRASTRUCTURE_BLOCKED: the only configured Forgejo review identity is the PR author's kilo account. Forgejo rejects its APPROVED review, and both valid fresh reviews are formally COMMENT; the contract says COMMENT is not approval. Repeating the same-account request is not a corrected attempt, and no alternate authorized reviewer identity is available through the configured MCP. No approval or merge readiness claimed; issue open, PR unmerged.

Initial invalid diagnostics (not cycles): malformed Router tightening corrected against published TaskRequirement; first Agent Manager launch had extra prompt text, stopped and corrected to literal /review-pr <URL>. No quota snapshots or transcripts retained.

## Delivery ledger (issue #6) PR: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/18; branch: `issue-6-synthetic-execution` -> `develop`; current HEAD: `97ac9661709310d701adb790e0afcafc9d33b21d`. `max_remediation_cycles = 10`; `remediation_used = 1`. 1. Full review, frozen HEAD `3cf0b229a10b8254892a0d36d24013ab7d372458`, base `059482d045bd8e772005c9fbc1a9b89ce64ce26f`: profile `repository_review`, L4 with reasoning/coding/tool_use >= 5/5/5 and required tool use/reasoning mode, numeric author floor unknown. Router selected `zai/glm-5.3/max`; dispatched `zai-coding-plan/GLM-5.3/max` (documented provider adapter; no fallback), catalog v4, profile policy v8, degraded=false. Fresh session `ses_f254b6570ffep4ToYj85AesLDv`, request `am-1790375664161-6650lt`, Agent Manager `DISPATCH_VERIFIED`; review #602 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/18#issuecomment-11697. Forgejo verdict `COMMENT` (body recommended APPROVE; same-account APPROVED rejected), not approval. A01 review atomicity claim required correction assessment; Q01 workspace lifetime, Q02 partial launch/credential. Remediation status done, resulting HEAD `97ac9661709310d701adb790e0afcafc9d33b21d`, `1 / 10`. 2. Separate architecture/model-correction assessment at old frozen HEAD/base: same `repository_review` L4 5/5/5 hard requirements, unknown author numeric floor. Router selected `zai/glm-5.3/max`; dispatched `zai-coding-plan/GLM-5.3/max` (adapter, no fallback), catalog v4, policy v8, degraded=false. Fresh session `ses_f24f9b93affeJaysViyowHjrSd`, request `am-1790381016656-qc6990`, Agent Manager `DISPATCH_VERIFIED`; https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/18#issuecomment-11699: `BOUNDED_CORRECTION`. A01 clarified: broker in-memory intent admission is atomic within its lock, not with SQLite; real durable adapter is separate, not issue #6 scope. Path/symlink allowed-root safety, uncertain partial launch, and lifetime/durable-broker deferral were changed on the same PR at `97ac9661709310d701adb790e0afcafc9d33b21d`. Checks: focused tests 12 passed; `make check` 164 passed; `make package-check` passed; `make audit` passed before code-only remediation with dependency/tooling files unchanged. Remediation status done, `1 / 10`. 3. Fresh full review of whole PR at HEAD `97ac9661709310d701adb790e0afcafc9d33b21d`, base `059482d045bd8e772005c9fbc1a9b89ce64ce26f`: profile `repository_review`, L4 5/5/5, required tool use/reasoning mode, numeric author floor unknown. Router selected `zai/glm-5.3/max`; dispatched `zai-coding-plan/GLM-5.3/max` (adapter, no fallback), catalog v4, policy v8, degraded=false. Fresh session `ses_f24f2c388ffeho2w4MT9EUaFaq`, request `am-1790381472800-iatsoy`, Agent Manager `DISPATCH_VERIFIED`; review #603 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/18#issuecomment-11702. Forgejo verdict `COMMENT` (body recommends APPROVE, no blocking findings), not APPROVE; same-account author-review restriction remains. Q02 remaining provider-credential conformance is deferred to a real adapter because the fake has no credential. Remediation status none; resulting HEAD unchanged; `1 / 10`. Final exact-HEAD evidence: clean local branch; focused 12 passed; `make check` 164 passed, `make package-check` passed; Forgejo `ci` pull_request run #1948 (https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/33) succeeded on exact SHA; issue acceptance reviewed without unresolved blocking finding. `REVIEW_INFRASTRUCTURE_BLOCKED`: the only configured Forgejo review identity is the PR author's `kilo` account. Forgejo rejects its `APPROVED` review, and both valid fresh reviews are formally `COMMENT`; the contract says COMMENT is not approval. Repeating the same-account request is not a corrected attempt, and no alternate authorized reviewer identity is available through the configured MCP. No approval or merge readiness claimed; issue open, PR unmerged. Initial invalid diagnostics (not cycles): malformed Router tightening corrected against published TaskRequirement; first Agent Manager launch had extra prompt text, stopped and corrected to literal `/review-pr <URL>`. No quota snapshots or transcripts retained.
kilo commented 2026-09-26 09:58:55 +00:00
Author
Member
Copy link

Delivery ledger continuation

Linked to the original ledger: #6 (comment). Do not reinterpret or rewrite its historical reviews.

PR #18 current HEAD is 73be4bd608a6b391d6a334c4eaa327f491aea1f4, base develop at 0fb435bf3653f2c3b7d986a0f872334dd278ce59. Reconciled previously unrecorded head change: merge commit 73be4bd has parents 97ac9661709310d701adb790e0afcafc9d33b21d (last reviewed issue #6 implementation) and 0fb435b (develop's governance PR #20 merge). The merge introduces only .kilo/command/deliver-issue.md and .kilo/command/review-pr.md relative to the prior issue #6 HEAD; the PR diff relative to its new base remains the same 11 issue #6 files. This is a base sync, not issue #6 implementation remediation: max_remediation_cycles = 10, remediation_used = 1 unchanged. Old substantive APPROVE review #603 applies only to 97ac966, not this changed HEAD. Fresh full review and exact-HEAD local gates pending; CI run #1952 on 73be4bd succeeded. Issue open; PR unmerged.

## Delivery ledger continuation Linked to the original ledger: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/6#issuecomment-11695. Do not reinterpret or rewrite its historical reviews. PR #18 current HEAD is `73be4bd608a6b391d6a334c4eaa327f491aea1f4`, base `develop` at `0fb435bf3653f2c3b7d986a0f872334dd278ce59`. Reconciled previously unrecorded head change: merge commit `73be4bd` has parents `97ac9661709310d701adb790e0afcafc9d33b21d` (last reviewed issue #6 implementation) and `0fb435b` (develop's governance PR #20 merge). The merge introduces only `.kilo/command/deliver-issue.md` and `.kilo/command/review-pr.md` relative to the prior issue #6 HEAD; the PR diff relative to its new base remains the same 11 issue #6 files. This is a base sync, not issue #6 implementation remediation: `max_remediation_cycles = 10`, `remediation_used = 1` unchanged. Old substantive APPROVE review #603 applies only to `97ac966`, not this changed HEAD. Fresh full review and exact-HEAD local gates pending; CI run #1952 on `73be4bd` succeeded. Issue open; PR unmerged.
kilo commented 2026-09-26 10:07:17 +00:00
Author
Member
Copy link

Delivery ledger continuation: review cycle 3 and terminal condition

Continues the original ledger #6 (comment) and HEAD reconciliation #6 (comment); historical entries remain unchanged. The old REVIEW_INFRASTRUCTURE_BLOCKED conclusion is superseded by the merged Kernel governance correction PR #20 and this new exact-HEAD review, not retroactively altered.

  1. Fresh full independent review of PR #18 at frozen HEAD 73be4bd608a6b391d6a334c4eaa327f491aea1f4, base develop 0fb435bf3653f2c3b7d986a0f872334dd278ce59. Profile repository_review; monotone floor L4 and reasoning/coding/tool_use >= 5/5/5, tool use and reasoning mode required; numeric author floor unknown. Router selected zai/glm-5.3/max, dispatched zai-coding-plan/GLM-5.3/max via the documented provider adapter (no fallback); catalog v4, profile policy v8, degraded=false. Agent Manager request am-1790416823345-gqg6dq, fresh reviewer session ses_f22d75b03ffeFFICg6IUkY5swA, DISPATCH_VERIFIED by explicit Resolved models: GLM-5.3 (zai-coding-plan) · max. Review #606 #18 (comment), completed at the frozen HEAD: substantive_verdict = APPROVE from ### Overall Recommendation; forgejo_review_state = COMMENT; platform_approval_recorded = false; blocking findings = 0; remediation status none; resulting HEAD unchanged; remediation_used = 1 / 10. platform_identity_limitation: configured kilo review identity is PR author kilo, with prior Forgejo rejection approve your own pull is not allowed in review #602. The review body mistakenly names Agent Manager sender ses_f2558af87ffe7rsTI143sc8bTq as reviewer; Agent Manager list and completed reviewer session transcript show ses_f22d75b03ffeFFICg6IUkY5swA submitted review #606. This is a provenance correction, not a new review or model-resolution substitute.

Final exact-HEAD evidence: focused synthetic tests 12 passed; make check 164 passed (format/lint/basedpyright/import boundaries/secrets/diff); make package-check passed. Required Forgejo pull_request CI run #1952 at exact SHA succeeded: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/36. Issue #6's six acceptance criteria are evidenced by the full independent review; no unresolved blocking finding. Reviewer questions: HEAD-trail is reconciled in linked ledger; overbroad provider credentials are intentionally deferred to a real adapter because this fake has no provider credential and issue #6 excludes a custom secrets manager. No dependency/tooling change required another audit. No observed formal-platform-approval merge requirement is claimed (branch-protection details were not accessible); owner retains merge authority.

READY_FOR_OWNER_MERGE for exact HEAD 73be4bd608a6b391d6a334c4eaa327f491aea1f4 under the corrected Kernel /deliver-issue substantive-verdict rule. Do not merge automatically; issue remains open and PR #18 unmerged until owner integration into develop.

## Delivery ledger continuation: review cycle 3 and terminal condition Continues the original ledger https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/6#issuecomment-11695 and HEAD reconciliation https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/6#issuecomment-11751; historical entries remain unchanged. The old `REVIEW_INFRASTRUCTURE_BLOCKED` conclusion is superseded by the merged Kernel governance correction PR #20 and this new exact-HEAD review, not retroactively altered. 3. Fresh full independent review of PR #18 at frozen HEAD `73be4bd608a6b391d6a334c4eaa327f491aea1f4`, base `develop` `0fb435bf3653f2c3b7d986a0f872334dd278ce59`. Profile `repository_review`; monotone floor L4 and reasoning/coding/tool_use >= 5/5/5, tool use and reasoning mode required; numeric author floor unknown. Router selected `zai/glm-5.3/max`, dispatched `zai-coding-plan/GLM-5.3/max` via the documented provider adapter (no fallback); catalog v4, profile policy v8, degraded=false. Agent Manager request `am-1790416823345-gqg6dq`, fresh reviewer session `ses_f22d75b03ffeFFICg6IUkY5swA`, `DISPATCH_VERIFIED` by explicit `Resolved models: GLM-5.3 (zai-coding-plan) · max`. Review #606 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/18#issuecomment-11759, completed at the frozen HEAD: `substantive_verdict = APPROVE` from `### Overall Recommendation`; `forgejo_review_state = COMMENT`; `platform_approval_recorded = false`; blocking findings = 0; remediation status none; resulting HEAD unchanged; `remediation_used = 1 / 10`. `platform_identity_limitation`: configured `kilo` review identity is PR author `kilo`, with prior Forgejo rejection `approve your own pull is not allowed` in review #602. The review body mistakenly names Agent Manager sender `ses_f2558af87ffe7rsTI143sc8bTq` as reviewer; Agent Manager list and completed reviewer session transcript show `ses_f22d75b03ffeFFICg6IUkY5swA` submitted review #606. This is a provenance correction, not a new review or model-resolution substitute. Final exact-HEAD evidence: focused synthetic tests 12 passed; `make check` 164 passed (format/lint/basedpyright/import boundaries/secrets/diff); `make package-check` passed. Required Forgejo pull_request CI run #1952 at exact SHA succeeded: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/36. Issue #6's six acceptance criteria are evidenced by the full independent review; no unresolved blocking finding. Reviewer questions: HEAD-trail is reconciled in linked ledger; overbroad provider credentials are intentionally deferred to a real adapter because this fake has no provider credential and issue #6 excludes a custom secrets manager. No dependency/tooling change required another audit. No observed formal-platform-approval merge requirement is claimed (branch-protection details were not accessible); owner retains merge authority. `READY_FOR_OWNER_MERGE` for exact HEAD `73be4bd608a6b391d6a334c4eaa327f491aea1f4` under the corrected Kernel `/deliver-issue` substantive-verdict rule. Do not merge automatically; issue remains open and PR #18 unmerged until owner integration into `develop`.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
issue-62-installed-compatibility
issue-58-private-outcome-export
issue-57-recovery-preparation-alerts
issue-57-owner-served-state
issue-106-final-authority-dag
issue-106-forgejo-ordinary-execution
issue-105-independent-provider-drivers
issue-59-work-resource-ownership
issue-56-atomic-approval-recovery
issue-56-work-budget-enforcement
issue-103-publish-architecture-backlog
issue-62-platform-reception
issue-55-mi-utilized-reference
issue-52-kilo-offline-proof
docs/conversational-review-policy
issue-60-reception-fixture-plan
issue-62-compatibility-matrix-spec
issue-58-export-rights-spec
issue-57-owner-state-spec
issue-56-task-cost-shapes
issue-90-owned-cancellation
issue-54-product-review
issue-53-runtime-integration
No results found.
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Creatidy/creatidy-kernel#6
No description provided.