[K4] Evidence-based verification, acceptance, remediation, and outcomes

kilo commented

2026-09-22 16:49:35 +00:00

Member

Goal

Implement CandidateResult, exact-subject Evidence and Finding records, independent verification, AcceptedResult, bounded remediation, HumanGate distinction, minimal ContextPackage manifests, and local outcome observations.

Why

Worker output is not an engineering result; fresh trusted evidence is required while ordinary defects remain autonomous within finite budgets.

Scope

In scope

Untrusted candidate validation and bindings; evidence producer/version/subject binding; deterministic checks and independent reviewer seam; policy pinning; finding progress/oscillation; remediation Attempts; acceptance decisions; pause versus HumanGate; finite budgets; bounded context manifests; local outcome export with requested/resolved/observed identities and unknown consumption; synthetic two-node lifecycle tests.

Out of scope

M5-B, full Context Compiler, vector database, analytics/telemetry, learned routing, automatic merge/deployment, live Forgejo/Codex, custom policy DSL, and universal correctness claims.

Acceptance Criteria

Schema-valid candidates cannot be accepted without exact subjects and required fresh evidence.
Rejected candidates create bounded remediation when authorized; progress is recognized, oscillation diagnosed, and only genuine authority need creates HumanGate.
C malformed/extra/duplicate data, D transport/domain rejection, E unaccepted wait, and F ordinary new blockers have explicit tests.
Two-node synthetic flow accepts node one and exposes its verified output as node two input; stale subjects are rejected and old findings preserved.
Context/outcome manifests pin revisions/digests and preserve unknown resource/usage values.
Verification remains outside worker authority and no M5-B/workflow language is introduced.

Constraints

Direct prerequisite: issue #6. Direct dependents: issues #8 and #9.
Preserve ADR 0005/0006 and docs/architecture/contracts.md; tests run without private/live/cloud services.

Links

Parent: issue #3 #3
Direct prerequisite: issue #6 #6
Direct dependents: issue #8 #8; issue #9 #9
Architecture: docs/adr/0005-authority-and-acceptance.md, docs/adr/0006-context-and-outcomes.md, docs/architecture/successor.md

## Goal Implement CandidateResult, exact-subject Evidence and Finding records, independent verification, AcceptedResult, bounded remediation, HumanGate distinction, minimal ContextPackage manifests, and local outcome observations. ## Why Worker output is not an engineering result; fresh trusted evidence is required while ordinary defects remain autonomous within finite budgets. ## Scope ### In scope Untrusted candidate validation and bindings; evidence producer/version/subject binding; deterministic checks and independent reviewer seam; policy pinning; finding progress/oscillation; remediation Attempts; acceptance decisions; pause versus HumanGate; finite budgets; bounded context manifests; local outcome export with requested/resolved/observed identities and unknown consumption; synthetic two-node lifecycle tests. ### Out of scope M5-B, full Context Compiler, vector database, analytics/telemetry, learned routing, automatic merge/deployment, live Forgejo/Codex, custom policy DSL, and universal correctness claims. ## Acceptance Criteria - [ ] Schema-valid candidates cannot be accepted without exact subjects and required fresh evidence. - [ ] Rejected candidates create bounded remediation when authorized; progress is recognized, oscillation diagnosed, and only genuine authority need creates HumanGate. - [ ] C malformed/extra/duplicate data, D transport/domain rejection, E unaccepted wait, and F ordinary new blockers have explicit tests. - [ ] Two-node synthetic flow accepts node one and exposes its verified output as node two input; stale subjects are rejected and old findings preserved. - [ ] Context/outcome manifests pin revisions/digests and preserve unknown resource/usage values. - [ ] Verification remains outside worker authority and no M5-B/workflow language is introduced. ## Constraints - Direct prerequisite: issue #6. Direct dependents: issues #8 and #9. - Preserve ADR 0005/0006 and `docs/architecture/contracts.md`; tests run without private/live/cloud services. ## Links - Parent: issue #3 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/3 - Direct prerequisite: issue #6 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/6 - Direct dependents: issue #8 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/8; issue #9 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/9 - Architecture: `docs/adr/0005-authority-and-acceptance.md`, `docs/adr/0006-context-and-outcomes.md`, `docs/architecture/successor.md`

kilo referenced this issue

2026-09-22 16:52:40 +00:00

[Kernel v0] First useful vertical slice #3

kilo referenced this issue

2026-09-22 16:53:17 +00:00

[K3] Synthetic execution, workspace, and authority enforcement #6

kilo referenced this issue

2026-09-22 16:53:35 +00:00

[K6] Runtime port and Codex app-server adapter #8

kilo referenced this issue

2026-09-22 16:53:51 +00:00

[K5] Forge port and Forgejo adapter #9

kilo referenced this issue

2026-09-22 16:54:10 +00:00

[K7] CLI reference slice and restart/recovery proof #10

kilo referenced this issue

2026-09-26 10:29:04 +00:00

[K4] Bind candidate acceptance to exact verification evidence #21

kilo commented

2026-09-26 10:29:26 +00:00

Author

Member

Delivery ledger for #7 / PR #21

Issue: #7
PR: #21 (base develop, branch issue-7-evidence-verification)
Current HEAD: 06f14f217d0975ff0a5bfc3d5d8c14ae84f331d1
max_remediation_cycles = 10; remediation_used = 0 / 10
Initial validation at HEAD: uv run --locked pytest -q tests/test_verification.py 10 passed; make check 179 passed, make package-check passed. Changed files: core/verification.py, core/context.py, core/outcomes.py, and their two focused test modules. Strict candidate/evidence binding, two-node acceptance, finite remediation, and unknown outcome consumption tested with synthetic fixtures. No live service checks claimed.
Independent review: pending. Ledger entries for this delivery will remain in this issue thread. Issue remains open and PR unmerged.

## Delivery ledger for #7 / PR #21 - Issue: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/7 - PR: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/21 (base `develop`, branch `issue-7-evidence-verification`) - Current HEAD: `06f14f217d0975ff0a5bfc3d5d8c14ae84f331d1` - `max_remediation_cycles = 10`; `remediation_used = 0 / 10` - Initial validation at HEAD: `uv run --locked pytest -q tests/test_verification.py` 10 passed; `make check` 179 passed, `make package-check` passed. Changed files: `core/verification.py`, `core/context.py`, `core/outcomes.py`, and their two focused test modules. Strict candidate/evidence binding, two-node acceptance, finite remediation, and unknown outcome consumption tested with synthetic fixtures. No live service checks claimed. - Independent review: pending. Ledger entries for this delivery will remain in this issue thread. Issue remains open and PR unmerged.

kilo commented

2026-09-26 10:38:54 +00:00

Author

Member

Delivery ledger continuation: review cycle 1, PR #21

Reviewed HEAD/base: 06f14f217d0975ff0a5bfc3d5d8c14ae84f331d1 -> develop at e41f6928ba77975b1b663250dd91b0b9f819ec53; current PR HEAD reconfirmed unchanged.
Review profile: repository_review; monotone capability floor: task L4, minima reasoning=5,coding=5,tool_use=5, requires_tool_use=true, requires_reasoning_mode=true; author capability floor unknown (not guessed). Authority/security, lifecycle, exact-subject verification and remediation justify L4.
router_selected = zai/glm-5.3/max; dispatched = zai-coding-plan/glm-5.3/max (documented provider-ID adapter zai -> zai-coding-plan); routing_result = SELECTED, no harness fallback. Router catalog v4 (updated 2026-09-24), profile policy v8, resource policy v1, degraded=false.
Reviewer Agent Manager local session ses_f22bb41d3ffeb9dFMiy01xINQ1, request am-1790418664863-j1ntgr; dispatch REQUESTED and DISPATCH_VERIFIED: explicit resolution GLM-5.3 (zai-coding-plan) · max matched routed eligible identity. Reviewer completed a fresh full read-only review of this HEAD.
Independent review: #21 (comment) (review ID 608). substantive_verdict = APPROVE under ### Overall Recommendation; forgejo_review_state = COMMENT; platform_approval_recorded = false. Blocking finding count: 0; blocker IDs: none.
platform_identity_limitation: PR author and review account are both kilo; reviewer records the platform rejection approve your own pull is not allowed for formal APPROVED submission. The persisted COMMENT is not represented as formal approval.
Remediation status: none; resulting HEAD unchanged; remediation_used = 0 / 10.
Final evidence at same HEAD: local make check (179 passed) and make package-check passed; reviewer independently reran both and focused 15 tests; Forgejo pull_request workflow run #1954 succeeded for exact commit: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/38. Issue criteria covered in review evidence table. Branch-protection rules were inaccessible to this token (admin-write required), so no unobserved formal-approval policy is asserted. PR remains open and unmerged; issue remains open. READY_FOR_OWNER_MERGE under delivery contract, subject to any owner-visible branch policy.

## Delivery ledger continuation: review cycle 1, PR #21 - Reviewed HEAD/base: `06f14f217d0975ff0a5bfc3d5d8c14ae84f331d1` -> `develop` at `e41f6928ba77975b1b663250dd91b0b9f819ec53`; current PR HEAD reconfirmed unchanged. - Review profile: `repository_review`; monotone capability floor: task `L4`, minima `reasoning=5,coding=5,tool_use=5`, `requires_tool_use=true`, `requires_reasoning_mode=true`; author capability floor unknown (not guessed). Authority/security, lifecycle, exact-subject verification and remediation justify L4. - `router_selected = zai/glm-5.3/max`; `dispatched = zai-coding-plan/glm-5.3/max` (documented provider-ID adapter `zai` -> `zai-coding-plan`); `routing_result = SELECTED`, no harness fallback. Router catalog v4 (updated 2026-09-24), profile policy v8, resource policy v1, degraded=false. - Reviewer Agent Manager local session `ses_f22bb41d3ffeb9dFMiy01xINQ1`, request `am-1790418664863-j1ntgr`; dispatch `REQUESTED` and `DISPATCH_VERIFIED`: explicit resolution `GLM-5.3 (zai-coding-plan) · max` matched routed eligible identity. Reviewer completed a fresh full read-only review of this HEAD. - Independent review: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/21#issuecomment-11779 (review ID 608). `substantive_verdict = APPROVE` under `### Overall Recommendation`; `forgejo_review_state = COMMENT`; `platform_approval_recorded = false`. Blocking finding count: 0; blocker IDs: none. - `platform_identity_limitation`: PR author and review account are both `kilo`; reviewer records the platform rejection `approve your own pull is not allowed` for formal APPROVED submission. The persisted COMMENT is not represented as formal approval. - Remediation status: none; resulting HEAD unchanged; `remediation_used = 0 / 10`. - Final evidence at same HEAD: local `make check` (179 passed) and `make package-check` passed; reviewer independently reran both and focused 15 tests; Forgejo pull_request workflow run #1954 succeeded for exact commit: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/38. Issue criteria covered in review evidence table. Branch-protection rules were inaccessible to this token (admin-write required), so no unobserved formal-approval policy is asserted. PR remains open and unmerged; issue remains open. `READY_FOR_OWNER_MERGE` under delivery contract, subject to any owner-visible branch policy.