Creatidy/scarcity-router
5
0
Fork 0
Code Issues 13 Pull requests Projects Releases Packages Wiki Activity Actions

M07 Stage 2: official ZCode CLI execution source — authorized workspace, evidenced edit mode, routable plan lane (D-063, #92) #161

Merged
adrian.tkacz merged 3 commits from task/92-zcode-stage2 into develop 2026-09-29 22:35:18 +00:00
Conversation 5 Commits 3 Files changed 19 +4905 -30
kilo commented 2026-09-28 22:31:45 +00:00
Member
Copy link

Closes the implementation of #92 when merged (issue stays open until human review completes; agents never merge). Decision record D-063 (amended 2026-09-29). Status: READY_FOR_OWNER_MERGE — integrated head green, real ZCode router-path acceptance passing on the exact head.

Synchronization with current develop (2026-09-29, late)

develop advanced substantially (D-062 protocol-v3 continuation machinery, reasoning-output semantics, docs — PRs #159/#160/#163), so this PR was synchronized by merging canonical develop into the branch (normal merge commit; the reviewed task commits are untouched, no rebase):

SHA
Reviewed + live-accepted implementation head b795ec63ea5319c15d62a8b15a8ab3f7f3499bf3
Merged develop 8d6d59e0a4e1d60759dd829b81474140212bcc91
Current integrated head a89975f024b0eba4e9c901b3db21b06f8c4aafa9

Treated as a semantic integration pass: one textual conflict (docs/decisions.md — resolved keeping both records, D-061 → D-062 → D-063) and one semantic fix the auto-merge could not express — develop's LocalAdapter.invoke protocol gained the optional D-062 tool_bridge channel that run_allowlisted now always passes, so ZCodeLocalAdapter.invoke accepts it and deliberately never engages it (the plan lane carries no client-tool round trip on any session version; tool-bearing requests are typed rejections before execution). The three remaining overlapping files (execution_sources.py, worker_client.py, worker_endpoint.py) were verified to coexist semantically: codex tool_calls: True (D-062) vs ZCODE tool_calls: False via the per-kind maps; the v3 continuation machinery alongside the --zcode-source/--zcode-workspace flags and the AUTH_UNPROBEABLE_KINDS exemption.

Exact-head adversarial review of a89975f: APPROVED, 0 MERGE_BLOCKER (focused on integration regressions; all eight integration questions verified with file:line evidence — v1/v2/v3 signature compatibility, every D-063 invariant intact, per-kind isolation, zcode can never enter the continuation state machine, plain-request path behaviorally identical to pre-D-062, resolution quality with an empty combined diff on the auto-merged files, scope = exactly 2 reviewed commits + 1 merge). Two DEFER-level nits confirmed pre-existing at b795ec6, recorded below for owner selection.

Live router-path acceptance re-run on the merged head: PASS — fresh disposable Git repo, complete standalone CLI (/home/adrian/workspace/zcode/apps/zcode-cli/packages/cli/dist/zcode.cjs, 0.16.9), plain model: "plan-managed" request through normal routing → HTTP 200 → real sentinel edit (sample.txt == sentinel; git status only M sample.txt); captured argv --prompt <task> --cwd <repo> --mode edit --output-format stream-json --no-browser with subprocess cwd = the repo; audit completed against zai-plan-1:plan-managed; credential scan clean. Cancellation covered by the deterministic composed acceptance at this head.

Gates on the exact head a89975f: make check — 2424 tests OK; uv run basedpyright 0 errors / 0 warnings / 0 notes; git diff --check clean; focused suites 315 OK (including the composed ZCode router-path e2e through the new v3 worker path).

Original implementation summary (b0bf858 + b795ec6, unchanged in substance)

One worker-side ZCode execution source behind the EXISTING architecture — no second runtime, no new execution channel:

M03 coordinator -> worker_bridged adapter (server) -> M05 worker
  -> zcode:<source_id> (new kind zcode_subscription, provider zai)
  -> official `zcode` CLI subprocess, ONE headless run per dispatched call
  -> --output-format stream-json NDJSON + typed final result
  • Invocation contract (D-061 constraints, enforced in code and pinned by tests): one argv vector, never a shell — zcode --prompt <text> --cwd <authorized workspace> --mode edit --output-format stream-json --no-browser. --mode edit is ALWAYS explicit and is the LEAST-AUTHORITY officially supported mode that permits the coding workflow (first-party evidence: permission/service.ts at the D-061-pinned commit 29628c9, identical in the shipped 0.16.9 bundle — edit mode explicitly allows workspace-scoped file edits, mode.edit.fileEdit; every other side-effecting or high/critical-risk tool still requires an ask a headless run cannot answer, so the vendor's default broker denies it, fail closed). The headless yolo default is never relied on. The prompt is argv data bounded at 64 KiB encoded; larger inputs are a typed rejection, never a truncation.
  • Workspace authority (D-063, remediation): --zcode-workspace <dir> is a REQUIRED worker flag with --zcode-source — ONE administrator-authorized project workspace, realpath-canonicalized at construction, re-validated fresh before every run, passed as BOTH --cwd and the subprocess cwd. Request content can never supply, alter or select a path; the per-attempt scratch machinery was removed (state/workspace separation is structural).
  • Model identity honesty: ZCode has no supported listing or steering, so NOTHING claims a physical model. The owner-reviewed zai/plan track in model-tracks.json (plan_managed: true, minimum-of-scale floor, plan-family continuity 1M in / 128K out) makes the effort-less plan-managed lane adopt as ONE variant-less resource with ONE effort-less catalog entry (variant plan, reasoning_effort null, supports_reasoning_mode false). A plain model: "plan-managed" request routes through the NORMAL selector; an effort-bearing request is a typed 400 unsupported_reasoning_effort; physical slugs (glm-5.3) classify nowhere on zai — exact-identity untouched for enforceable resources.
  • Auth honesty: probes are strictly non-inference (--version, doctor --json); a healthy CLI reports unverified — the lane's honest steady state; adoption-from-healthy-unverified and probe-health snapshots are scoped via AUTH_UNPROBEABLE_KINDS; codex semantics unchanged. zcode login zai stays the owner's only sign-in path (never wrapped).
  • Terminal contract: completion requires the documented type:"result" line AND a proven exit 0; every other ending is a typed failure or an explicit unknown observation. Exactly one invocation per call — no retry. stderr is bounded-counted and never read. Usage stays unmapped (no evidenced field names) — unknown stays unknown.
  • Reuse: process seam imported unchanged from the Codex adapter; bounded reader shared with the Codex acquisition module; D-053 inventory/report/allowlist paths; reviewed static compatibility cells (zcode_worker_evidence.py); owner-registered lane ceilings 1M/128k (the codex-272k registration-fact precedent).

Deferred items (owner selection; none merge-blocking)

  1. build_run_argv docstring wording still says "--mode build" while the code (correctly) passes edit — comment-only.
  2. _WORKSPACE_MODE_OK_MASK dead constant left by the scratch removal.
  3. Fake-CLI docstring wording ("--mode build") outdated.
  4. observe_inventory probes run with the ambient cwd (invoke-path probes run inside the workspace) — behavior differs only if the worker's cwd is deleted.
  5. --zcode-workspace worker-client glue lacks a direct build_registry unit test in tests/test_worker_client.py (covered indirectly).
  6. Pre-existing: derived_catalog_entries docstring vs continuity tokens wording.
  7. (INFO) retirement/miss-counter gating on authenticated — zcode lane registrations persist until config removal (safe; routing is health-gated).
  8. (INFO) D-063 point 6 wording could name both scoping mechanisms explicitly.
  9. Admin-UI add-source form remains codex-only (ZCode sources are config/REST-enabled) — deliberate non-goal, recorded follow-up.

Per repository governance: PR left open for human review; workers never merge.

Closes the implementation of #92 when merged (issue stays open until human review completes; agents never merge). Decision record **D-063** (amended 2026-09-29). **Status: `READY_FOR_OWNER_MERGE`** — integrated head green, real ZCode router-path acceptance passing on the exact head. # Synchronization with current `develop` (2026-09-29, late) `develop` advanced substantially (D-062 protocol-v3 continuation machinery, reasoning-output semantics, docs — PRs #159/#160/#163), so this PR was synchronized by **merging canonical `develop` into the branch** (normal merge commit; the reviewed task commits are untouched, no rebase): | | SHA | |---|---| | Reviewed + live-accepted implementation head | `b795ec63ea5319c15d62a8b15a8ab3f7f3499bf3` | | Merged `develop` | `8d6d59e0a4e1d60759dd829b81474140212bcc91` | | **Current integrated head** | **`a89975f024b0eba4e9c901b3db21b06f8c4aafa9`** | Treated as a **semantic integration pass**: one textual conflict (`docs/decisions.md` — resolved keeping both records, D-061 → D-062 → D-063) and one semantic fix the auto-merge could not express — develop's `LocalAdapter.invoke` protocol gained the optional D-062 `tool_bridge` channel that `run_allowlisted` now always passes, so `ZCodeLocalAdapter.invoke` accepts it and deliberately never engages it (the plan lane carries no client-tool round trip on any session version; tool-bearing requests are typed rejections before execution). The three remaining overlapping files (`execution_sources.py`, `worker_client.py`, `worker_endpoint.py`) were verified to coexist semantically: codex `tool_calls: True` (D-062) vs ZCODE `tool_calls: False` via the per-kind maps; the v3 continuation machinery alongside the `--zcode-source`/`--zcode-workspace` flags and the `AUTH_UNPROBEABLE_KINDS` exemption. **Exact-head adversarial review of `a89975f`: APPROVED, 0 MERGE_BLOCKER** (focused on integration regressions; all eight integration questions verified with file:line evidence — v1/v2/v3 signature compatibility, every D-063 invariant intact, per-kind isolation, zcode can never enter the continuation state machine, plain-request path behaviorally identical to pre-D-062, resolution quality with an empty combined diff on the auto-merged files, scope = exactly 2 reviewed commits + 1 merge). Two DEFER-level nits confirmed pre-existing at `b795ec6`, recorded below for owner selection. **Live router-path acceptance re-run on the merged head: PASS** — fresh disposable Git repo, complete standalone CLI (`/home/adrian/workspace/zcode/apps/zcode-cli/packages/cli/dist/zcode.cjs`, 0.16.9), plain `model: "plan-managed"` request through normal routing → HTTP 200 → real sentinel edit (`sample.txt` == sentinel; `git status` only ` M sample.txt`); captured argv `--prompt <task> --cwd <repo> --mode edit --output-format stream-json --no-browser` with subprocess cwd = the repo; audit `completed` against `zai-plan-1:plan-managed`; credential scan clean. Cancellation covered by the deterministic composed acceptance at this head. **Gates on the exact head `a89975f`:** `make check` — **2424 tests OK**; `uv run basedpyright` **0 errors / 0 warnings / 0 notes**; `git diff --check` clean; focused suites 315 OK (including the composed ZCode router-path e2e through the new v3 worker path). --- # Original implementation summary (b0bf858 + b795ec6, unchanged in substance) One worker-side ZCode execution source behind the EXISTING architecture — no second runtime, no new execution channel: ``` M03 coordinator -> worker_bridged adapter (server) -> M05 worker -> zcode:<source_id> (new kind zcode_subscription, provider zai) -> official `zcode` CLI subprocess, ONE headless run per dispatched call -> --output-format stream-json NDJSON + typed final result ``` - **Invocation contract (D-061 constraints, enforced in code and pinned by tests):** one argv vector, never a shell — `zcode --prompt <text> --cwd <authorized workspace> --mode edit --output-format stream-json --no-browser`. `--mode edit` is ALWAYS explicit and is the LEAST-AUTHORITY officially supported mode that permits the coding workflow (first-party evidence: `permission/service.ts` at the D-061-pinned commit `29628c9`, identical in the shipped 0.16.9 bundle — edit mode explicitly allows workspace-scoped file edits, `mode.edit.fileEdit`; every other side-effecting or high/critical-risk tool still requires an `ask` a headless run cannot answer, so the vendor's default broker denies it, fail closed). The headless yolo default is never relied on. The prompt is argv data bounded at 64 KiB encoded; larger inputs are a typed rejection, never a truncation. - **Workspace authority (D-063, remediation):** `--zcode-workspace <dir>` is a REQUIRED worker flag with `--zcode-source` — ONE administrator-authorized project workspace, realpath-canonicalized at construction, re-validated fresh before every run, passed as BOTH `--cwd` and the subprocess cwd. Request content can never supply, alter or select a path; the per-attempt scratch machinery was removed (state/workspace separation is structural). - **Model identity honesty:** ZCode has no supported listing or steering, so NOTHING claims a physical model. The owner-reviewed `zai/plan` track in `model-tracks.json` (`plan_managed: true`, minimum-of-scale floor, plan-family continuity 1M in / 128K out) makes the effort-less `plan-managed` lane adopt as ONE variant-less resource with ONE effort-less catalog entry (variant `plan`, `reasoning_effort` null, `supports_reasoning_mode` false). A plain `model: "plan-managed"` request routes through the NORMAL selector; an effort-bearing request is a typed 400 `unsupported_reasoning_effort`; physical slugs (`glm-5.3`) classify nowhere on `zai` — exact-identity untouched for enforceable resources. - **Auth honesty:** probes are strictly non-inference (`--version`, `doctor --json`); a healthy CLI reports `unverified` — the lane's honest steady state; adoption-from-healthy-unverified and probe-health snapshots are scoped via `AUTH_UNPROBEABLE_KINDS`; codex semantics unchanged. `zcode login zai` stays the owner's only sign-in path (never wrapped). - **Terminal contract:** completion requires the documented `type:"result"` line AND a proven exit 0; every other ending is a typed failure or an explicit `unknown` observation. Exactly one invocation per call — no retry. stderr is bounded-counted and never read. Usage stays unmapped (no evidenced field names) — unknown stays unknown. - **Reuse:** process seam imported unchanged from the Codex adapter; bounded reader shared with the Codex acquisition module; D-053 inventory/report/allowlist paths; reviewed static compatibility cells (`zcode_worker_evidence.py`); owner-registered lane ceilings 1M/128k (the codex-272k registration-fact precedent). ## Deferred items (owner selection; none merge-blocking) 1. `build_run_argv` docstring wording still says "--mode build" while the code (correctly) passes `edit` — comment-only. 2. `_WORKSPACE_MODE_OK_MASK` dead constant left by the scratch removal. 3. Fake-CLI docstring wording ("--mode build") outdated. 4. `observe_inventory` probes run with the ambient cwd (invoke-path probes run inside the workspace) — behavior differs only if the worker's cwd is deleted. 5. `--zcode-workspace` worker-client glue lacks a direct `build_registry` unit test in `tests/test_worker_client.py` (covered indirectly). 6. Pre-existing: `derived_catalog_entries` docstring vs continuity tokens wording. 7. (INFO) retirement/miss-counter gating on `authenticated` — zcode lane registrations persist until config removal (safe; routing is health-gated). 8. (INFO) D-063 point 6 wording could name both scoping mechanisms explicitly. 9. Admin-UI add-source form remains codex-only (ZCode sources are config/REST-enabled) — deliberate non-goal, recorded follow-up. Per repository governance: PR left open for human review; workers never merge.
One worker-side source adapter (zcode:<source_id>, kind zcode_subscription,
provider zai) reusing the Codex process-lifecycle seam and the existing
M05/M09/D-053 machinery: one headless official-CLI run per dispatched call,
argv-only, --mode build always explicit, adapter-owned per-attempt
workspace, stream-json consumed under bounded budgets, terminal contract
result-line-AND-exit-0, typed failures/unknown endings, no retry, no shell,
no credential access. Honest discovery: non-inference probes only
(--version, doctor --json), unverified auth never upgraded, plan-lane
descriptor (no model/variant/effort claims) visible but never routable
until owner-approved zai track evidence lands. Per-kind registry surface
facts and adapter-instance mapping; floor-entry provider now follows the
source configuration. Design record D-063; deterministic fake-CLI suite
(85 tests); docs updated. Full gate green on this head (2280 tests OK,
basedpyright 0/0/0, git diff --check clean).
kilo commented 2026-09-28 22:50:15 +00:00
Author
Member
Copy link

Independent adversarial review — exact head b0bf858 — APPROVED (no MERGE_BLOCKER)

Reviewer: independent agent instance (GLM-5.3-Flash via the Start Plan account — substitution disclosed: the task's preferred GPT-5.6 Sol High is reachable only through the new-provider pinned endpoint that D-061's evidence records as currently failing TLS validation, and per governance no unavailable preferred reviewer blocks the deterministic record). The implementation agent did not review its own work; the reviewer verified the exact head SHA and ran the focused suites itself (171 tests OK + the HTTP adapter suite).

Coverage: architecture (reuse/parallel-system/boundary/kind-consistency), security (shell injection, credential and ZCode-config access, workspace authority incl. symlink/pre-planted attacks, permission mode, multi-user surface), lifecycle (cancellation ×3 phases, timeouts, ambiguity honesty, leak probes — 40 real subprocess runs with fd/thread counting), protocol (evidenced-surface parsing, budget bounds, terminal contract), semantics (identity/auth/evidence honesty), scope (diff hygiene, minimal flags, docs-vs-code cross-check), UX (mandatory dimension: UX impact: minor, non-blocking).

Findings: 8 × DEFER, 0 × MERGE_BLOCKER (recorded verbatim in the review; headline items):

  1. stderr drainer stops at the byte cap (inherited from the proven Codex seam): a child overflowing stderr degrades the typed exit-failure note to the deadline-cancel note (bounded, honest, still one invocation).
  2. --version parse unanchored (first x.y.z wins); codex precedent anchors on an evidenced prefix.
  3. stream=True is the one dimension without a direct-call backstop (unreachable via composition — streaming: False gates selection; refuse-not-drop symmetry nit).
  4. Run finally closes neither pipe explicitly (stdout is closed by the shared reader; measured leak-free over 40 runs).
  5. No deadline re-check between probes and spawn (bounded ~20 s overshoot; exactly-once preserved).
  6. _SURFACE_CAPABILITIES_BY_KIND.get(kind, CODEX_…) defaults a future unmapped kind to codex facts instead of failing closed.
  7. (UX follow-up) admin UI add-source form still hardcodes the codex kind; ZCode sources are config/REST-enabled — deliberate non-goal for this task, noted as follow-up.
  8. (test hygiene) duplicated observe_inventory() in four setUp bodies.

No remediation round was triggered (only a MERGE_BLOCKER can trigger the single remediation per the bounded review lifecycle); the reviewed head remains the PR head b0bf858 and the DEFERs stay recorded for follow-up selection by the owner.

## Independent adversarial review — exact head `b0bf858` — **APPROVED** (no MERGE_BLOCKER) Reviewer: independent agent instance (GLM-5.3-Flash via the Start Plan account — substitution disclosed: the task's preferred GPT-5.6 Sol High is reachable only through the `new-provider` pinned endpoint that D-061's evidence records as currently failing TLS validation, and per governance no unavailable preferred reviewer blocks the deterministic record). The implementation agent did not review its own work; the reviewer verified the exact head SHA and ran the focused suites itself (171 tests OK + the HTTP adapter suite). Coverage: architecture (reuse/parallel-system/boundary/kind-consistency), security (shell injection, credential and ZCode-config access, workspace authority incl. symlink/pre-planted attacks, permission mode, multi-user surface), lifecycle (cancellation ×3 phases, timeouts, ambiguity honesty, leak probes — 40 real subprocess runs with fd/thread counting), protocol (evidenced-surface parsing, budget bounds, terminal contract), semantics (identity/auth/evidence honesty), scope (diff hygiene, minimal flags, docs-vs-code cross-check), UX (mandatory dimension: `UX impact: minor, non-blocking`). **Findings: 8 × DEFER, 0 × MERGE_BLOCKER** (recorded verbatim in the review; headline items): 1. stderr drainer stops at the byte cap (inherited from the proven Codex seam): a child overflowing stderr degrades the typed exit-failure note to the deadline-cancel note (bounded, honest, still one invocation). 2. `--version` parse unanchored (first `x.y.z` wins); codex precedent anchors on an evidenced prefix. 3. `stream=True` is the one dimension without a direct-call backstop (unreachable via composition — `streaming: False` gates selection; refuse-not-drop symmetry nit). 4. Run `finally` closes neither pipe explicitly (stdout is closed by the shared reader; measured leak-free over 40 runs). 5. No deadline re-check between probes and spawn (bounded ~20 s overshoot; exactly-once preserved). 6. `_SURFACE_CAPABILITIES_BY_KIND.get(kind, CODEX_…)` defaults a future unmapped kind to codex facts instead of failing closed. 7. (UX follow-up) admin UI add-source form still hardcodes the codex kind; ZCode sources are config/REST-enabled — deliberate non-goal for this task, noted as follow-up. 8. (test hygiene) duplicated `observe_inventory()` in four `setUp` bodies. No remediation round was triggered (only a MERGE_BLOCKER can trigger the single remediation per the bounded review lifecycle); the reviewed head remains the PR head `b0bf858` and the DEFERs stay recorded for follow-up selection by the owner.
Owner CHANGES_REQUESTED round on PR #161, three blockers resolved:

1. Workspace authority: the adapter is constructed with ONE
   administrator-authorized project workspace (--zcode-workspace,
   required): realpath-canonicalized, verified at construction,
   re-validated per run, passed as both --cwd and process cwd.
   Request content can never select a path; the per-attempt scratch
   machinery was removed (state/workspace separation is structural).
2. Permission mode: --mode edit (was build) — the least-authority
   officially supported mode that permits the coding workflow.
   First-party evidence: permission/service.ts at the D-061-pinned
   commit 29628c9 + identical shipped 0.16.9 bundle (edit mode
   explicitly allows workspace-scoped file edits, mode.edit.fileEdit;
   high/critical tools still ask and are denied headless, fail
   closed; yolo never relied on).
3. Routing: the owner-reviewed zai/plan track (plan_managed, floor
   = minimum-of-scale, plan-family continuity 1M/128K) adopts the
   effort-less plan-managed lane as one variant-less resource with
   one effort-less catalog entry; a plain model=plan-managed request
   routes through the NORMAL selector; effort-bearing requests are
   typed rejections; physical slugs classify nowhere on zai.
   Healthy-unverified adoption + probe-health lane snapshots scoped
   to the auth-unprobeable kind (AUTH_UNPROBEABLE_KINDS). Reviewed
   static compatibility cells (zcode_worker_evidence.py). Owner-
   registered lane ceilings 1M/128k (codex 272k precedent).

D-063 amended in place. Composed router-path acceptance: the fake-CLI
lane routes, edits the authorized repo, honest audit; effort rejection;
admission-deadline cancellation (408, timed_out audit, child reaped).
Live router-path acceptance: real CLI 0.16.9 discovered, lane routed,
run failed typed (502) at the recorded-broken provider endpoint —
LIVE_ACCEPTANCE_BLOCKED, owner procedure on the issue. Full gate green
on this head (2294 tests, basedpyright 0/0/0, git diff --check clean).
kilo changed title from M07 Stage 2: official ZCode CLI execution source behind the D-053 source architecture (D-063, #92) to M07 Stage 2: official ZCode CLI execution source — authorized workspace, evidenced edit mode, routable plan lane (D-063, #92) 2026-09-29 07:34:03 +00:00
kilo commented 2026-09-29 08:08:06 +00:00
Author
Member
Copy link

Independent exact-head review — b795ec6 — APPROVED (0 MERGE_BLOCKER, 6 DEFER + 2 INFO)

Reviewer: independent agent instance (GLM-5.3-Flash via the Start Plan account — substitution disclosed: the preferred GPT-5.6 Sol High remains reachable only through the new-provider pinned endpoint that currently fails the CLI's TLS validation, and per governance no unavailable preferred reviewer blocks the deterministic record). The implementation agent did not review its own work; the reviewer verified the exact SHA, ran the focused suites AND the full repo gate itself, and independently re-fetched the official permission/service.ts at the pinned commit to re-verify the mode-evidence chain.

All eight review questions answered YES with file:line evidence (authorized workspace on the real request path; edit genuinely the least-authority editing-capable headless mode with the deny broker intact; normal routing to the lane with no physical-model claim and triple rejection of effort-bearing requests; codex exact-identity untouched; no request-controlled route to filesystem authority — the dispatch protocol structurally has no path field; no credential exposure; cancellation/timeout/bounds/no-retry intact after the scratch removal through every path; the composed e2e is the real router path and non-vacuous — wait_for_lane can only pass because the snapshot-drop exemption works).

Findings (await owner selection; no remediation round triggered — only a MERGE_BLOCKER can):

  1. DEFER — build_run_argv docstring still says "--mode build" while the code passes edit (doc-vs-code wording on the mode claim).
  2. DEFER — dead constant _WORKSPACE_MODE_OK_MASK left behind by the scratch removal.
  3. DEFER — fake-CLI docstring still claims tests pin "--mode build".
  4. DEFER — observe_inventory probes run with the ambient cwd while invoke-path probes run inside the workspace (contradicts the "no ambient cwd" wording; behavior differs only if the worker's cwd is deleted).
  5. DEFER — the new required --zcode-workspace worker-client glue lacks a direct build_registry unit test in tests/test_worker_client.py.
  6. DEFER (pre-existing at b0bf858) — derived_catalog_entries docstring says hard properties "stay UNKNOWN", contradicted by both floor-entry implementations' continuity tokens.
  7. INFO — retirement/miss-counter gating on authenticated means a zcode lane registration persists until config removal (safe: routing is gated by snapshot health + the drop rule); comment or gate on healthy optionally.
  8. INFO — D-063 point 6 wording conflates the two correctly-scoped mechanisms (track.plan_managed gates adoption; AUTH_UNPROBEABLE_KINDS gates the snapshot-drop exemption); optional wording fix.

UX: no material regression — the required flag fails with an actionable, flag-naming config error; an unsigned-in lane yields a typed failure rather than a hang and its honest sign-in state stays visible.

No remediation round was triggered; the reviewed head remains the PR head b795ec6.

## Independent exact-head review — `b795ec6` — **APPROVED** (0 MERGE_BLOCKER, 6 DEFER + 2 INFO) Reviewer: independent agent instance (GLM-5.3-Flash via the Start Plan account — substitution disclosed: the preferred GPT-5.6 Sol High remains reachable only through the `new-provider` pinned endpoint that currently fails the CLI's TLS validation, and per governance no unavailable preferred reviewer blocks the deterministic record). The implementation agent did not review its own work; the reviewer verified the exact SHA, ran the focused suites AND the full repo gate itself, and independently re-fetched the official `permission/service.ts` at the pinned commit to re-verify the mode-evidence chain. All eight review questions answered YES with file:line evidence (authorized workspace on the real request path; `edit` genuinely the least-authority editing-capable headless mode with the deny broker intact; normal routing to the lane with no physical-model claim and triple rejection of effort-bearing requests; codex exact-identity untouched; no request-controlled route to filesystem authority — the dispatch protocol structurally has no path field; no credential exposure; cancellation/timeout/bounds/no-retry intact after the scratch removal through every path; the composed e2e is the real router path and non-vacuous — `wait_for_lane` can only pass because the snapshot-drop exemption works). **Findings (await owner selection; no remediation round triggered — only a MERGE_BLOCKER can):** 1. DEFER — `build_run_argv` docstring still says "--mode build" while the code passes `edit` (doc-vs-code wording on the mode claim). 2. DEFER — dead constant `_WORKSPACE_MODE_OK_MASK` left behind by the scratch removal. 3. DEFER — fake-CLI docstring still claims tests pin "--mode build". 4. DEFER — `observe_inventory` probes run with the ambient cwd while invoke-path probes run inside the workspace (contradicts the "no ambient cwd" wording; behavior differs only if the worker's cwd is deleted). 5. DEFER — the new required `--zcode-workspace` worker-client glue lacks a direct `build_registry` unit test in `tests/test_worker_client.py`. 6. DEFER (pre-existing at `b0bf858`) — `derived_catalog_entries` docstring says hard properties "stay UNKNOWN", contradicted by both floor-entry implementations' continuity tokens. 7. INFO — retirement/miss-counter gating on `authenticated` means a zcode lane registration persists until config removal (safe: routing is gated by snapshot health + the drop rule); comment or gate on `healthy` optionally. 8. INFO — D-063 point 6 wording conflates the two correctly-scoped mechanisms (`track.plan_managed` gates adoption; `AUTH_UNPROBEABLE_KINDS` gates the snapshot-drop exemption); optional wording fix. UX: no material regression — the required flag fails with an actionable, flag-naming config error; an unsigned-in lane yields a typed failure rather than a hang and its honest sign-in state stays visible. No remediation round was triggered; the reviewed head remains the PR head `b795ec6`.
kilo commented 2026-09-29 21:23:26 +00:00
Author
Member
Copy link

Final live acceptance: PASS — PR #161 is READY_FOR_OWNER_MERGE

The M07 Stage 2 final acceptance ran on the unchanged reviewed head b795ec63ea5319c15d62a8b15a8ab3f7f3499bf3 through the normal Scarcity Router path (plain model: "plan-managed" request → normal selector → the zai-plan-1:plan-managed plan-managed lane → worker execution → official ZCode CLI → authorized disposable Git repository), and produced a real, mechanically verified file edit:

  • HTTP 200; the gateway returned a well-formed completion (finish_reason: "stop"), the CLI's own answer confirming the edit;
  • sample.txt reads exactly ZCODE_ROUTER_LIVE_ACCEPTANCE_OK (was before);
  • git diff --stat: sample.txt | 2 +- only; git status --short: M sample.txt only; no new or changed paths outside the workspace (rglob before/after comparison);
  • audit: result_status: "completed", executed_target = {"resource_id": "zai-plan-1:plan-managed", "provider": "zai", "model": "plan-managed", "variant": "plan"} — the provenance IS the plan-managed lane;
  • captured invocation argv: --prompt <task> --cwd <disposable repo> --mode edit --output-format stream-json --no-browser, with the subprocess cwd equal to the authorized repo (wrapper-captured);
  • CLI: official 0.16.9, complete source build at /home/adrian/workspace/zcode/apps/zcode-cli/packages/cli/dist/zcode.cjs (the host bundle was not used); the official Z.ai Coding Plan path completed the run (the removed new-provider endpoint could not have);
  • credential-leak scan over all captured output: clean;
  • no repository code change, no new commit, no re-review — head exactly b795ec6, PR worktree clean;
  • cancellation: covered by the deterministic composed acceptance at this exact head (408 + timed_out audit + child reaped), not repeated live per the economy rule.

Full evidence table on issue #92. All acceptance criteria of the remediation task are now met, including the previously-blocked live condition.

Task conclusion: READY_FOR_OWNER_MERGE. PR #161 stays open for the manual human merge; agents never merge.

## Final live acceptance: **PASS** — PR #161 is **READY_FOR_OWNER_MERGE** The M07 Stage 2 final acceptance ran on the unchanged reviewed head **`b795ec63ea5319c15d62a8b15a8ab3f7f3499bf3`** through the **normal Scarcity Router path** (plain `model: "plan-managed"` request → normal selector → the `zai-plan-1:plan-managed` plan-managed lane → worker execution → official ZCode CLI → authorized disposable Git repository), and produced a **real, mechanically verified file edit**: - HTTP 200; the gateway returned a well-formed completion (`finish_reason: "stop"`), the CLI's own answer confirming the edit; - `sample.txt` reads **exactly** `ZCODE_ROUTER_LIVE_ACCEPTANCE_OK` (was `before`); - `git diff --stat`: `sample.txt | 2 +-` only; `git status --short`: ` M sample.txt` only; no new or changed paths outside the workspace (rglob before/after comparison); - audit: `result_status: "completed"`, `executed_target = {"resource_id": "zai-plan-1:plan-managed", "provider": "zai", "model": "plan-managed", "variant": "plan"}` — the provenance IS the plan-managed lane; - captured invocation argv: `--prompt <task> --cwd <disposable repo> --mode edit --output-format stream-json --no-browser`, with the subprocess cwd equal to the authorized repo (wrapper-captured); - CLI: official **0.16.9**, complete source build at `/home/adrian/workspace/zcode/apps/zcode-cli/packages/cli/dist/zcode.cjs` (the host bundle was not used); the official Z.ai Coding Plan path completed the run (the removed `new-provider` endpoint could not have); - credential-leak scan over all captured output: **clean**; - no repository code change, no new commit, no re-review — head exactly `b795ec6`, PR worktree clean; - cancellation: covered by the deterministic composed acceptance at this exact head (408 + `timed_out` audit + child reaped), not repeated live per the economy rule. Full evidence table on issue #92. All acceptance criteria of the remediation task are now met, including the previously-blocked live condition. **Task conclusion: `READY_FOR_OWNER_MERGE`.** PR #161 stays open for the manual human merge; agents never merge.
Semantic integration pass, not a textual one:

- docs/decisions.md: both records kept in numbering order (D-062 from
  develop, then the amended D-063).
- execution_sources.py: develop's evidenced codex tool_calls=True
  (D-062 tool bridge) coexists with the ZCODE surface facts
  (tool_calls UNSUPPORTED for the plan lane) via the per-kind maps.
- worker_client.py / worker_endpoint.py: the v3 continuation machinery
  (suspension slots, execute_tool_call/result frames) integrates with
  the zcode source flags and the AUTH_UNPROBEABLE_KINDS snapshot-drop
  exemption unchanged.
- SEMANTIC FIX the textual merge could not express: the LocalAdapter
  invoke protocol gained the optional tool_bridge channel
  (run_allowlisted now always passes it); ZCodeLocalAdapter.invoke
  accepts it and deliberately never engages it — the plan lane carries
  no client-tool round trip on any session version (ZCODE cells mark
  tool_calls UNSUPPORTED; tool-bearing requests are typed rejections
  before execution).

Focused suites green (315, incl. the composed zcode router-path e2e
through the v3 worker path); full gate green (2424 tests, basedpyright
0/0/0, git diff --check clean).
kilo commented 2026-09-29 22:30:48 +00:00
Author
Member
Copy link

Synchronized with current develop — merged head green, live acceptance re-PASSED — READY_FOR_OWNER_MERGE

PR #161 no longer points at the stale reviewed head. History is preserved exactly as directed: the two reviewed task commits (b0bf858, b795ec6) are untouched, and current canonical develop was merged in (normal merge commit, no rebase, no rewrite).

SHA
Previous PR head (reviewed + live-accepted) b795ec63ea5319c15d62a8b15a8ab3f7f3499bf3
Merged develop 8d6d59e0a4e1d60759dd829b81474140212bcc91
New integrated head a89975f024b0eba4e9c901b3db21b06f8c4aafa9

Conflicts and resolutions (one textual, one semantic):

  • docs/decisions.md (textual): both branches appended at the tail — resolved by keeping BOTH records in numbering order (D-061 → D-062 from develop → the amended D-063); no content lost on either side.
  • execution_sources.py, worker_client.py, worker_endpoint.py: auto-merged textually, then verified semantically — develop's codex tool_calls: True (D-062 evidence) coexists with the ZCODE surface facts (tool_calls UNSUPPORTED for the lane) via the per-kind maps; the v3 continuation machinery coexists with the --zcode-source/--zcode-workspace flags and the AUTH_UNPROBEABLE_KINDS snapshot-drop exemption.
  • The semantic fix the textual merge could not express: develop's LocalAdapter.invoke protocol gained the optional D-062 tool_bridge channel and run_allowlisted now always passes it — without a signature fix every zcode dispatch would have raised TypeError. ZCodeLocalAdapter.invoke (merged head) accepts the channel and deliberately never engages it: the plan lane carries no client-tool round trip on any session version (ZCODE cells mark tool_calls UNSUPPORTED; tool-bearing requests are typed rejections before execution).

Focused suites (315): ZCode adapter, execution sources, the composed ZCode router-path e2e through the new v3 worker path, worker endpoint/protocol/bridge/client, routing — all OK. Full gate: make check 2424 tests OK; uv run basedpyright 0 errors / 0 warnings / 0 notes; git diff --check clean. The #143-family flake did not fire.

Live router-path acceptance re-run on the merged head: PASS. Fresh disposable Git repo; complete standalone CLI (/home/adrian/workspace/zcode/apps/zcode-cli/packages/cli/dist/zcode.cjs, 0.16.9; the host bundle NOT used); plain model: "plan-managed" request through normal routing → HTTP 200; captured invocation argv --prompt <task> --cwd <repo> --mode edit --output-format stream-json --no-browser with the subprocess cwd = the authorized repo; sample.txt reads exactly ZCODE_MERGE_ACCEPTANCE_OK; git diff --stat = sample.txt | 2 +- only, git status --short = M sample.txt only; audit completed with executed_target = {"resource_id": "zai-plan-1:plan-managed", "provider": "zai", "model": "plan-managed", "variant": "plan"}; credential scan clean. Cancellation not repeated live (the deterministic composed acceptance at this head covers the same path).

Exact-head adversarial review of a89975f: APPROVED — 0 MERGE_BLOCKER. The reviewer verified all eight integration questions with file:line evidence (v1/v2/v3 signature compatibility; every D-063 invariant intact on the merged head; per-kind capability isolation; zcode can never enter the continuation state machine; the snapshot-drop exemption survived the endpoint restructure; the plain-request path is behaviorally the pre-D-062 path; resolution quality incl. an empty combined diff on the three auto-merged files; scope = exactly 2 reviewed commits + 1 merge). Two DEFER-level nits were confirmed PRE-EXISTING at b795ec6 (the build_run_argv docstring wording; the unreachable codex-default in the kind map) — already recorded on the PR for owner selection, not merge regressions.

Status: READY_FOR_OWNER_MERGE — integrated head green, live router-path acceptance passing. PR #161 stays open; owner merge is manual.

## Synchronized with current `develop` — merged head green, live acceptance re-PASSED — **READY_FOR_OWNER_MERGE** PR #161 no longer points at the stale reviewed head. History is preserved exactly as directed: the two reviewed task commits (`b0bf858`, `b795ec6`) are untouched, and current canonical `develop` was **merged in** (normal merge commit, no rebase, no rewrite). | | SHA | |---|---| | Previous PR head (reviewed + live-accepted) | `b795ec63ea5319c15d62a8b15a8ab3f7f3499bf3` | | Merged `develop` | `8d6d59e0a4e1d60759dd829b81474140212bcc91` | | **New integrated head** | **`a89975f024b0eba4e9c901b3db21b06f8c4aafa9`** | **Conflicts and resolutions (one textual, one semantic):** - `docs/decisions.md` (textual): both branches appended at the tail — resolved by keeping BOTH records in numbering order (D-061 → D-062 from develop → the amended D-063); no content lost on either side. - `execution_sources.py`, `worker_client.py`, `worker_endpoint.py`: auto-merged textually, then verified **semantically** — develop's codex `tool_calls: True` (D-062 evidence) coexists with the ZCODE surface facts (`tool_calls` UNSUPPORTED for the lane) via the per-kind maps; the v3 continuation machinery coexists with the `--zcode-source`/`--zcode-workspace` flags and the `AUTH_UNPROBEABLE_KINDS` snapshot-drop exemption. - **The semantic fix the textual merge could not express:** develop's `LocalAdapter.invoke` protocol gained the optional D-062 `tool_bridge` channel and `run_allowlisted` now always passes it — without a signature fix every zcode dispatch would have raised TypeError. `ZCodeLocalAdapter.invoke` (merged head) accepts the channel and deliberately never engages it: the plan lane carries no client-tool round trip on any session version (ZCODE cells mark `tool_calls` UNSUPPORTED; tool-bearing requests are typed rejections before execution). **Focused suites (315)**: ZCode adapter, execution sources, the composed ZCode router-path e2e **through the new v3 worker path**, worker endpoint/protocol/bridge/client, routing — all OK. **Full gate**: `make check` **2424 tests OK**; `uv run basedpyright` **0 errors / 0 warnings / 0 notes**; `git diff --check` clean. The #143-family flake did not fire. **Live router-path acceptance re-run on the merged head: PASS.** Fresh disposable Git repo; complete standalone CLI (`/home/adrian/workspace/zcode/apps/zcode-cli/packages/cli/dist/zcode.cjs`, 0.16.9; the host bundle NOT used); plain `model: "plan-managed"` request through normal routing → HTTP 200; captured invocation argv `--prompt <task> --cwd <repo> --mode edit --output-format stream-json --no-browser` with the subprocess cwd = the authorized repo; `sample.txt` reads exactly `ZCODE_MERGE_ACCEPTANCE_OK`; `git diff --stat` = `sample.txt | 2 +-` only, `git status --short` = ` M sample.txt` only; audit `completed` with `executed_target = {"resource_id": "zai-plan-1:plan-managed", "provider": "zai", "model": "plan-managed", "variant": "plan"}`; credential scan clean. Cancellation not repeated live (the deterministic composed acceptance at this head covers the same path). **Exact-head adversarial review of `a89975f`: APPROVED — 0 MERGE_BLOCKER.** The reviewer verified all eight integration questions with file:line evidence (v1/v2/v3 signature compatibility; every D-063 invariant intact on the merged head; per-kind capability isolation; zcode can never enter the continuation state machine; the snapshot-drop exemption survived the endpoint restructure; the plain-request path is behaviorally the pre-D-062 path; resolution quality incl. an empty combined diff on the three auto-merged files; scope = exactly 2 reviewed commits + 1 merge). Two DEFER-level nits were confirmed PRE-EXISTING at `b795ec6` (the `build_run_argv` docstring wording; the unreachable codex-default in the kind map) — already recorded on the PR for owner selection, not merge regressions. **Status: `READY_FOR_OWNER_MERGE`** — integrated head green, live router-path acceptance passing. PR #161 stays open; owner merge is manual.
adrian.tkacz deleted branch task/92-zcode-stage2 2026-09-29 22:35:18 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
adrian.tkacz
Labels
Clear labels   
accessibility
Barrier affecting people with disabilities

  
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
P1
Owner-declared highest explicit implementation priority (loop ordering rank)

  
P2
Required product and integration work

  
P3
Deferred or producer-dependent work

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
P1
P2
P3
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Creatidy/scarcity-router!161
No description provided.