Dynamic Execution Sources, Model Discovery, Multi-Account & Security

kilo commented

2026-09-24 15:22:19 +00:00

Member

New development program on develop (NOT a hotfix, NOT release remediation; no v0.1.0 pressure). Base SHA: 98dd25ad7858dad3162e30391140b2d7ffe15459 (canonical Forgejo develop, 2026-09-24; supersedes the pre-merge expectation ab59c42e… — the owner merged develop→main as PR #115 immediately before program start and develop now points at that merge commit).

Mission

Scarcity Router currently requires too much knowledge of physical model names and execution details. A Codex resource needs manual configuration equivalent to gpt-5.6-sol, which ages badly: a provider can add gpt-6-luna/sol/astra and the user should not edit Scarcity Router configuration merely because a new generation appeared.

Desired product model: the user configures access to an execution SOURCE once; Scarcity Router discovers what that source can execute, safely classifies the discovered inventory, selects the least-scarce sufficiently capable exact model, and records the exact physical model actually used.

Program architecture direction (child A owns the amendment):

ExecutionSource → runtime/provider discovery → ModelInventory
  → classification/adoption policy → exact derived executable resources
  → existing Routing Core → exact pinned execution target

Absolute model rule

ALL program work (implementation, orchestration, architecture analysis, independent review, remediation) uses ONLY GLM-5.3-Flash (thinking = MAX). No workflow or subagent on non-Flash GLM-5.3. A separate Daybreak security review is an ADDITIONAL gate, not a replacement.

Confirmed live evidence (2026-09-24)

Real controlled Codex session, codex-cli 0.155.0-alpha.16.3: official login OK; account/read {} returns account.type=chatgpt; model/list {} advertises gpt-6-luna, gpt-6-sol, gpt-6-astra (efforts low→ultra) plus gpt-5.5, gpt-5.6-luna/sol/terra, gpt-daybreak-blue-latest. The current implementation omits params for account/read and the first model/list page → JSON-RPC -32600 on 0.155 — the evidenced explanation for "Codex snapshot health = unknown" despite a logged-in controlled home. Confirmed protocol drift; child B remediates first.

Strategic requirements — improve ALL four

reliability; 2. UX; 3. security; 4. ability to evolve as providers add models. No smallest-diff optimization; no abstraction for its own sake; smallest architecture that removes recurring manual model configuration without weakening invariants.

Absolute invariants preserved

D-042 exact-target semantics: discovery happens BEFORE selection; execution stays exact (source/resource/provider/physical model/effort/entitlement/pool/worker/surface all known at dispatch). gpt-6-sol/high never silently becomes gpt-6.1-sol, gpt-6-astra or gpt-5.6-sol.
All D-040…D-052 security architecture (D-044 identity classes, verified TLS, worker outbound+pairing, local allowlist authority, no credential in any output), provider-edge discipline, quota-never-changes-capability, frozen v1 surfaces.
Two independent accounts = two quota pools / unknown sharing until explicit evidence; same physical model via two accounts = two targets, never one resource.
No "latest model always wins": conservative adoption (DISCOVERED → CLASSIFIED → ROUTABLE) with approved track floors only; unknown models stay discovered/not-routable; model disappearance keeps audit interpretability with an explicit deterministic state rule.

Children

A. Architecture + source/inventory contracts
B. Codex 0.155 protocol repair + runtime inventory
C. Dynamic derived resources + track adoption
D. Multi-account / multiple source instances on one worker
E. UX + diagnostics + durable UX review gate
F. Daybreak security-review contract
G. Integration + live acceptance

Branching / output

One program branch program/dynamic-execution-sources from canonical develop; final output is ONE reviewed PR into develop, left open for owner merge. No merge to main, no release/tag, no PyPI.

Required final artifacts

GLM-5.3-Flash/MAX independent review (APPROVE/CHANGES_REQUESTED, UX mandatory); Daybreak security review or honest SECURITY_REVIEW_UNAVAILABLE; live acceptance through the product path (discovery + one real end-to-end turn); top-10 slowest tests with explanations; explicit release-posture statement ending in DYNAMIC_EXECUTION_SOURCES_READY_FOR_OWNER_MERGE or DYNAMIC_EXECUTION_SOURCES_PAUSED.

New development program on `develop` (NOT a hotfix, NOT release remediation; no v0.1.0 pressure). Base SHA: `98dd25ad7858dad3162e30391140b2d7ffe15459` (canonical Forgejo `develop`, 2026-09-24; supersedes the pre-merge expectation `ab59c42e…` — the owner merged develop→main as PR #115 immediately before program start and `develop` now points at that merge commit). ## Mission Scarcity Router currently requires too much knowledge of physical model names and execution details. A Codex resource needs manual configuration equivalent to `gpt-5.6-sol`, which ages badly: a provider can add `gpt-6-luna/sol/astra` and the user should not edit Scarcity Router configuration merely because a new generation appeared. Desired product model: **the user configures access to an execution SOURCE once; Scarcity Router discovers what that source can execute, safely classifies the discovered inventory, selects the least-scarce sufficiently capable exact model, and records the exact physical model actually used.** Program architecture direction (child A owns the amendment): ```text ExecutionSource → runtime/provider discovery → ModelInventory → classification/adoption policy → exact derived executable resources → existing Routing Core → exact pinned execution target ``` ## Absolute model rule ALL program work (implementation, orchestration, architecture analysis, independent review, remediation) uses ONLY `GLM-5.3-Flash` (thinking = MAX). No workflow or subagent on non-Flash GLM-5.3. A separate Daybreak security review is an ADDITIONAL gate, not a replacement. ## Confirmed live evidence (2026-09-24) Real controlled Codex session, `codex-cli 0.155.0-alpha.16.3`: official login OK; `account/read {}` returns `account.type=chatgpt`; `model/list {}` advertises `gpt-6-luna`, `gpt-6-sol`, `gpt-6-astra` (efforts low→ultra) plus `gpt-5.5`, `gpt-5.6-luna/sol/terra`, `gpt-daybreak-blue-latest`. The current implementation omits `params` for `account/read` and the first `model/list` page → `JSON-RPC -32600` on 0.155 — the evidenced explanation for "Codex snapshot health = unknown" despite a logged-in controlled home. Confirmed protocol drift; child B remediates first. ## Strategic requirements — improve ALL four 1. reliability; 2. UX; 3. security; 4. ability to evolve as providers add models. No smallest-diff optimization; no abstraction for its own sake; smallest architecture that removes recurring manual model configuration without weakening invariants. ## Absolute invariants preserved - D-042 exact-target semantics: discovery happens BEFORE selection; execution stays exact (source/resource/provider/physical model/effort/entitlement/pool/worker/surface all known at dispatch). `gpt-6-sol/high` never silently becomes `gpt-6.1-sol`, `gpt-6-astra` or `gpt-5.6-sol`. - All D-040…D-052 security architecture (D-044 identity classes, verified TLS, worker outbound+pairing, local allowlist authority, no credential in any output), provider-edge discipline, quota-never-changes-capability, frozen v1 surfaces. - Two independent accounts = two quota pools / unknown sharing until explicit evidence; same physical model via two accounts = two targets, never one resource. - No "latest model always wins": conservative adoption (DISCOVERED → CLASSIFIED → ROUTABLE) with approved track floors only; unknown models stay discovered/not-routable; model disappearance keeps audit interpretability with an explicit deterministic state rule. ## Children - A. Architecture + source/inventory contracts - B. Codex 0.155 protocol repair + runtime inventory - C. Dynamic derived resources + track adoption - D. Multi-account / multiple source instances on one worker - E. UX + diagnostics + durable UX review gate - F. Daybreak security-review contract - G. Integration + live acceptance ## Branching / output One program branch `program/dynamic-execution-sources` from canonical `develop`; final output is ONE reviewed PR into `develop`, left open for owner merge. No merge to `main`, no release/tag, no PyPI. ## Required final artifacts GLM-5.3-Flash/MAX independent review (APPROVE/CHANGES_REQUESTED, UX mandatory); Daybreak security review or honest `SECURITY_REVIEW_UNAVAILABLE`; live acceptance through the product path (discovery + one real end-to-end turn); top-10 slowest tests with explanations; explicit release-posture statement ending in `DYNAMIC_EXECUTION_SOURCES_READY_FOR_OWNER_MERGE` or `DYNAMIC_EXECUTION_SOURCES_PAUSED`.

kilo referenced this issue

2026-09-24 15:23:09 +00:00

A. Architecture: ExecutionSource + ModelInventory contracts #117

kilo referenced this issue

2026-09-24 15:23:10 +00:00

B. Codex 0.155 protocol repair + runtime inventory #118

kilo referenced this issue

2026-09-24 15:23:10 +00:00

C. Dynamic derived resources + track adoption #119

kilo referenced this issue

2026-09-24 15:23:10 +00:00

D. Multi-account: multiple source instances on one worker #120

kilo referenced this issue

2026-09-24 15:23:50 +00:00

E. UX + diagnostics + durable UX review gate #121

kilo referenced this issue

2026-09-24 15:23:51 +00:00

F. Daybreak restricted capability + security-review contract #122

kilo referenced this issue

2026-09-24 15:23:51 +00:00

G. Integration + live acceptance + timing report #123

kilo commented

2026-09-24 19:14:20 +00:00

Author

Member

Program status — implementation complete, in verification:

A (#117) ✅ ModelInventory contract (typed, bounded, credential-free) + reviewed model-tracks.json (luna/sol/astra floors, restricted daybreak) + structural classifier.
B (#118) ✅ Codex 0.155 explicit-{} params repair with discriminating -32600 coverage (the fake runtime now mirrors the real strictness).
C (#119) ✅ Server sources config domain (schema v2), SourceRegistry adoption (DISCOVERED→CLASSIFIED→ROUTABLE, retirement after 3 authenticated misses), derived exact resources, track-floor catalog entries, GPT-6 Luna/Sol/Astra catalog reconciliation (D-033 gate exercised), ultra effort.
D (#120) ✅ Adapter kind/instance split (codex:<source_id>), per-source controlled homes, worker protocol v2 (inventories in state reports; v1 peers unaffected), --codex-source + official codex-login.
E (#121) ✅ Sources page, label-first workers, worker-vs-provider auth terminology, durable UX review gate (AGENTS.md + llm-operating-policy).
F (#122) ✅ Daybreak restricted track (never materialized, never substituted) + security_critical → Daybreak-review governance contract with SECURITY_REVIEW_UNAVAILABLE.
G (#123) 🔄 E2E acceptance suite green (upgrade T0→T1 with zero config change, unknown/restricted exclusion, two-sources-one-worker isolation, exact-binding audit); full make check + package-check + guardrails in progress; SR_TEST_TIMING top-10 being collected.

D-053 records the full architecture, alternatives and the two explicit contract reconciliations (D-049 ownership at source granularity; M01 observation identity excluding registration-owned quota pools).

Program status — implementation complete, in verification: - **A (#117)** ✅ ModelInventory contract (typed, bounded, credential-free) + reviewed `model-tracks.json` (luna/sol/astra floors, restricted daybreak) + structural classifier. - **B (#118)** ✅ Codex 0.155 explicit-`{}` params repair with discriminating -32600 coverage (the fake runtime now mirrors the real strictness). - **C (#119)** ✅ Server `sources` config domain (schema v2), SourceRegistry adoption (DISCOVERED→CLASSIFIED→ROUTABLE, retirement after 3 authenticated misses), derived exact resources, track-floor catalog entries, GPT-6 Luna/Sol/Astra catalog reconciliation (D-033 gate exercised), `ultra` effort. - **D (#120)** ✅ Adapter kind/instance split (`codex:<source_id>`), per-source controlled homes, worker protocol v2 (inventories in state reports; v1 peers unaffected), `--codex-source` + official `codex-login`. - **E (#121)** ✅ Sources page, label-first workers, worker-vs-provider auth terminology, durable UX review gate (AGENTS.md + llm-operating-policy). - **F (#122)** ✅ Daybreak restricted track (never materialized, never substituted) + `security_critical` → Daybreak-review governance contract with `SECURITY_REVIEW_UNAVAILABLE`. - **G (#123)** 🔄 E2E acceptance suite green (upgrade T0→T1 with zero config change, unknown/restricted exclusion, two-sources-one-worker isolation, exact-binding audit); full `make check` + `package-check` + guardrails in progress; SR_TEST_TIMING top-10 being collected. D-053 records the full architecture, alternatives and the two explicit contract reconciliations (D-049 ownership at source granularity; M01 observation identity excluding registration-owned quota pools).