Creatidy/creatidy-kernel

Fork 0

D1-03 — Preflight the first live dogfood run against Scarcity Router #143 #34

New issue

Closed

opened 2026-09-28 20:17:53 +00:00 by adrian.tkacz · 3 comments

adrian.tkacz commented

2026-09-28 20:17:53 +00:00

Owner

Parent: #30
Depends on merged D1-02: #32 / PR #33

Goal

Prove that the merged Creatidy Kernel live dogfood path is actually ready to execute the first real task:

BioMedical-IT/scarcity-router#143

without spending a model inference and without modifying Scarcity Router.

This is a strict preflight gate.

No coding Runtime turn may be started during D1-03.

Why this issue exists

D1-02 established the live composition, but the independent review identified an availability gap that may block the first real run:

the live CLI accepts a runtime binding with optional reasoning effort, while the current CLI path does not supply supported_efforts to CodexRuntime.

A selected Allocation with explicit reasoning effort may therefore fail closed before useful work begins.

The first dogfood run must not discover avoidable configuration defects after consuming live model capacity.

Frozen downstream task

Target repository:

BioMedical-IT/scarcity-router

Target issue:

#143 — Flaky under load: test_scenario_11 client-disconnect cancel can assert before the cancel reaches the worker reader

D1-01 constraints remain authoritative:

one real small test-only repair;
allowed changed path:
tests/test_e2e_execution.py
production-code changes forbidden;
targeted CancellationTests;
exactly 8 repeated targeted runs;
one make check;
deterministic structural checks;
semantic residue remains subject to independent review;
no automatic merge;
no deployment.

The old D1-01 base SHA is historical evidence only.

The live run must freeze the then-current canonical Scarcity Router develop.

Preflight requirements

1. Kernel baseline

Verify canonical Creatidy Kernel develop contains merged PR #33.

Record exact Kernel SHA.

Do not modify Kernel during the initial preflight.

2. Scarcity Router current base

Fetch canonical Scarcity Router develop.

Record exact SHA.

Verify Issue #143 is still relevant at that SHA:

the race mechanism still exists;
no merged change already fixes it;
no active PR already owns the same repair.

If #143 has already been fixed or materially changed, STOP with:

DOGFOOD_TASK_STALE

Do not manufacture another task automatically.

3. Re-freeze structural tokens

Against the exact current Scarcity Router base, verify that the D1-02 frozen structural assumptions still match source reality.

At minimum confirm the exact relevant:

scenario/test names;
owning-worker cancellation assertion;
bystander/ownership assertion;
current race-producing synchronization pattern.

If the structural tokens in scarcity_router_143_task() no longer correspond to the current source, STOP before inference.

Classify whether the mismatch requires:

a data-only frozen-task update; or
a real Kernel implementation change.

Do not weaken structural checking to make it fit.

4. Verification commands

Run or otherwise validate, without changing source, that the frozen commands are still valid on current Scarcity Router:

targeted CancellationTests;
command suitable for 8 repetitions;
make check.

The purpose is command validity and baseline observation, not proving the flaky race statistically.

Do not run an excessive stress campaign.

Record approximate runtime so the later dogfood execution has a realistic wall-clock budget.

5. Codex binary and authentication preflight

Verify the configured Codex executable:

absolute path;
exact version;
app-server available;
authenticated through the intended HOME-based Codex configuration;
no Router/Forge controller secret required in Codex environment.

Do not start a coding turn.

A harmless version/schema/initialization capability probe is allowed if it performs no paid model inference.

6. Closed Codex environment

Using the merged D1-02 implementation, inspect the exact child environment that the live CLI would pass to Codex.

Confirm it contains only the intended operational allowlist and no controller credentials.

Also record the existing DEFER:

compose_dogfood_live(environ, ...) derives the child environment from os.environ.

Do not fix this unless it blocks the supported CLI path.

7. Scarcity Router selection preflight

Use the real Scarcity Router selection interface, but do NOT execute the selected model.

Run the same resource-selection request the dogfood task would use.

Record:

selected runtime;
provider;
model;
exact reasoning effort;
relevant capabilities;
provenance sufficient to diagnose the selection.

This call is allocation/recommendation only.

No provider inference.

8. Reasoning-effort compatibility gate

This is mandatory.

Determine whether the exact selected Allocation can pass the current merged CodexRuntime supported-effort check through the actual CLI composition.

Do not infer this from model names.

Trace the real values through:

ScarcityRouterAllocator
→ durable Allocation
→ CLI run_dogfood
→ CodexRuntime(supported_efforts=...)

If the current CLI would reject the selected explicit effort because supported_efforts is empty, report:

LIVE_CONFIGURATION_BLOCKED

with the smallest required correction.

Do NOT start inference.

9. Smallest correction rule

If the reasoning-effort gap is confirmed, determine the smallest sound repair.

The correction should likely expose controller-owned trusted supported-effort evidence to the live composition and pass it to the existing CodexRuntime.

It must NOT:

duplicate Router policy;
infer effort support from model names;
silently trust the Router recommendation as Runtime capability evidence;
add a new model registry;
weaken exact provider/model/effort checks;
create a generic configuration framework.

Prefer reuse of existing trusted runtime-binding/configuration semantics.

If this requires a code change, D1-03 ends with a precise bounded follow-up implementation issue.

Do not patch Kernel opportunistically inside the preflight issue unless the owner explicitly expands scope.

10. Forge preflight

Without creating a PR, verify the configured Forgejo identity and endpoints are sufficient for the existing AGit path:

target repository identity;
base branch;
API access/readback;
Git transport prerequisites;
controller-owned object source semantics.

Do not push a candidate ref or create a Scarcity Router PR.

11. Workspace preflight

Verify the supplied Scarcity Router source checkout is:

an absolute path;
clean enough to act as read-only source;
separate from Kernel control/data directories;
capable of resolving the exact current develop.

Do not alter the owner checkout.

12. Execution packet

If every gate passes, produce a final D1-04 execution packet containing:

exact Kernel SHA;
exact Scarcity Router base SHA;
exact CLI command shape;
required environment variable names, without values;
selected provider/model/effort;
supported-effort evidence;
structural tokens reverified;
exact verification plan;
expected maximum wall-clock/deadline;
control data directory recommendation;
explicit no-merge/no-deploy statement.

Do not include secrets.

Terminal outcomes

D1-03 must end in exactly one:

`READY_FOR_LIVE_DOGFOOD`

All gates pass. No model inference was performed.

`LIVE_CONFIGURATION_BLOCKED`

A bounded Kernel/configuration defect prevents a sound live run. Record the smallest correction and create no inference.

`DOGFOOD_TASK_STALE`

Scarcity Router #143 is already fixed or materially changed.

`INFRASTRUCTURE_BLOCKED`

Required Router/Codex/Forge preflight infrastructure cannot be inspected safely.

Non-goals

Do NOT:

execute the coding Runtime;
consume a model inference;
modify Scarcity Router;
create a Scarcity Router branch or PR;
merge anything;
deploy anything;
implement #143;
perform a broad architecture review;
introduce new abstractions.

Completion

Record all preflight evidence on this issue.

If status is READY_FOR_LIVE_DOGFOOD, close D1-03 and stop.

The actual model execution will be a separate child issue.

If a code correction is required, do not hide it inside the live run; create a bounded implementation issue first.

Parent: #30 Depends on merged D1-02: #32 / PR #33 ## Goal Prove that the merged Creatidy Kernel live dogfood path is actually ready to execute the first real task: `BioMedical-IT/scarcity-router#143` without spending a model inference and without modifying Scarcity Router. This is a strict preflight gate. No coding Runtime turn may be started during D1-03. ## Why this issue exists D1-02 established the live composition, but the independent review identified an availability gap that may block the first real run: the live CLI accepts a runtime binding with optional reasoning effort, while the current CLI path does not supply `supported_efforts` to `CodexRuntime`. A selected Allocation with explicit reasoning effort may therefore fail closed before useful work begins. The first dogfood run must not discover avoidable configuration defects after consuming live model capacity. ## Frozen downstream task Target repository: `BioMedical-IT/scarcity-router` Target issue: `#143 — Flaky under load: test_scenario_11 client-disconnect cancel can assert before the cancel reaches the worker reader` D1-01 constraints remain authoritative: - one real small test-only repair; - allowed changed path: `tests/test_e2e_execution.py` - production-code changes forbidden; - targeted `CancellationTests`; - exactly 8 repeated targeted runs; - one `make check`; - deterministic structural checks; - semantic residue remains subject to independent review; - no automatic merge; - no deployment. The old D1-01 base SHA is historical evidence only. The live run must freeze the then-current canonical Scarcity Router `develop`. ## Preflight requirements ### 1. Kernel baseline Verify canonical Creatidy Kernel `develop` contains merged PR #33. Record exact Kernel SHA. Do not modify Kernel during the initial preflight. ### 2. Scarcity Router current base Fetch canonical Scarcity Router `develop`. Record exact SHA. Verify Issue #143 is still relevant at that SHA: - the race mechanism still exists; - no merged change already fixes it; - no active PR already owns the same repair. If #143 has already been fixed or materially changed, STOP with: `DOGFOOD_TASK_STALE` Do not manufacture another task automatically. ### 3. Re-freeze structural tokens Against the exact current Scarcity Router base, verify that the D1-02 frozen structural assumptions still match source reality. At minimum confirm the exact relevant: - scenario/test names; - owning-worker cancellation assertion; - bystander/ownership assertion; - current race-producing synchronization pattern. If the structural tokens in `scarcity_router_143_task()` no longer correspond to the current source, STOP before inference. Classify whether the mismatch requires: - a data-only frozen-task update; or - a real Kernel implementation change. Do not weaken structural checking to make it fit. ### 4. Verification commands Run or otherwise validate, without changing source, that the frozen commands are still valid on current Scarcity Router: 1. targeted `CancellationTests`; 2. command suitable for 8 repetitions; 3. `make check`. The purpose is command validity and baseline observation, not proving the flaky race statistically. Do not run an excessive stress campaign. Record approximate runtime so the later dogfood execution has a realistic wall-clock budget. ### 5. Codex binary and authentication preflight Verify the configured Codex executable: - absolute path; - exact version; - app-server available; - authenticated through the intended HOME-based Codex configuration; - no Router/Forge controller secret required in Codex environment. Do not start a coding turn. A harmless version/schema/initialization capability probe is allowed if it performs no paid model inference. ### 6. Closed Codex environment Using the merged D1-02 implementation, inspect the exact child environment that the live CLI would pass to Codex. Confirm it contains only the intended operational allowlist and no controller credentials. Also record the existing DEFER: `compose_dogfood_live(environ, ...)` derives the child environment from `os.environ`. Do not fix this unless it blocks the supported CLI path. ### 7. Scarcity Router selection preflight Use the real Scarcity Router selection interface, but do NOT execute the selected model. Run the same resource-selection request the dogfood task would use. Record: - selected runtime; - provider; - model; - exact reasoning effort; - relevant capabilities; - provenance sufficient to diagnose the selection. This call is allocation/recommendation only. No provider inference. ### 8. Reasoning-effort compatibility gate This is mandatory. Determine whether the exact selected Allocation can pass the current merged `CodexRuntime` supported-effort check through the actual CLI composition. Do not infer this from model names. Trace the real values through: `ScarcityRouterAllocator` → durable `Allocation` → CLI `run_dogfood` → `CodexRuntime(supported_efforts=...)` If the current CLI would reject the selected explicit effort because `supported_efforts` is empty, report: `LIVE_CONFIGURATION_BLOCKED` with the smallest required correction. Do NOT start inference. ### 9. Smallest correction rule If the reasoning-effort gap is confirmed, determine the smallest sound repair. The correction should likely expose controller-owned trusted supported-effort evidence to the live composition and pass it to the existing `CodexRuntime`. It must NOT: - duplicate Router policy; - infer effort support from model names; - silently trust the Router recommendation as Runtime capability evidence; - add a new model registry; - weaken exact provider/model/effort checks; - create a generic configuration framework. Prefer reuse of existing trusted runtime-binding/configuration semantics. If this requires a code change, D1-03 ends with a precise bounded follow-up implementation issue. Do not patch Kernel opportunistically inside the preflight issue unless the owner explicitly expands scope. ### 10. Forge preflight Without creating a PR, verify the configured Forgejo identity and endpoints are sufficient for the existing AGit path: - target repository identity; - base branch; - API access/readback; - Git transport prerequisites; - controller-owned object source semantics. Do not push a candidate ref or create a Scarcity Router PR. ### 11. Workspace preflight Verify the supplied Scarcity Router source checkout is: - an absolute path; - clean enough to act as read-only source; - separate from Kernel control/data directories; - capable of resolving the exact current `develop`. Do not alter the owner checkout. ### 12. Execution packet If every gate passes, produce a final D1-04 execution packet containing: - exact Kernel SHA; - exact Scarcity Router base SHA; - exact CLI command shape; - required environment variable names, without values; - selected provider/model/effort; - supported-effort evidence; - structural tokens reverified; - exact verification plan; - expected maximum wall-clock/deadline; - control data directory recommendation; - explicit no-merge/no-deploy statement. Do not include secrets. ## Terminal outcomes D1-03 must end in exactly one: ### `READY_FOR_LIVE_DOGFOOD` All gates pass. No model inference was performed. ### `LIVE_CONFIGURATION_BLOCKED` A bounded Kernel/configuration defect prevents a sound live run. Record the smallest correction and create no inference. ### `DOGFOOD_TASK_STALE` Scarcity Router #143 is already fixed or materially changed. ### `INFRASTRUCTURE_BLOCKED` Required Router/Codex/Forge preflight infrastructure cannot be inspected safely. ## Non-goals Do NOT: - execute the coding Runtime; - consume a model inference; - modify Scarcity Router; - create a Scarcity Router branch or PR; - merge anything; - deploy anything; - implement #143; - perform a broad architecture review; - introduce new abstractions. ## Completion Record all preflight evidence on this issue. If status is `READY_FOR_LIVE_DOGFOOD`, close D1-03 and stop. The actual model execution will be a separate child issue. If a code correction is required, do not hide it inside the live run; create a bounded implementation issue first.

kilo commented

2026-09-28 20:40:40 +00:00

Member

D1-03 Preflight Evidence — Terminal outcome: `LIVE_CONFIGURATION_BLOCKED`

NO MODEL INFERENCE WAS PERFORMED DURING D1-03. Executed probes: git reads, file inspection, SR unit tests, one Router selection (recommendation-only, in-process machine-interface contract v1), and one Codex app-server initialize probe (no thread/start, no turn/start, no prompt). NO AUTOMATIC MERGE / NO DEPLOY. Kernel and Scarcity Router were not modified; no SR branch/PR was created.

Phase A — Subjects verified

A1 Kernel (PASS)

Canonical develop = 72bee742ec0b34d2bb16ace95b03794b17ccc1d3 (fetched; matches owner-side expectation).
PR #33 merged: true at 2026-09-28T20:15:30Z; merge commit 72bee742…; reviewed D1-02 head 0893ed988d4d4e210469c5503627d0a56e2b35f4 — both confirmed via Forgejo.
src/creatidy_kernel/adapters/dogfood.py + dogfood CLI subcommands present; inspection tree clean (git status --porcelain = 0), still clean at exit.

A2 Scarcity Router (PASS — task NOT stale)

Canonical develop = 59538e949d2b3488668c9649cf3728dbe87b38bb (Forgejo branch API confirms the same SHA server-side). This is the SHA to freeze for the proposed live run (--expected-base 59538e949d2b3488668c9649cf3728dbe87b38bb). D1-01 SHA 781bace… is 100+ commits behind and irrelevant as base.
Issue #143 open; both scenario-11 tests exist at 59538e9 (test_scenario_11_client_disconnect_propagates_cancel line 839; test_scenario_11_cancel_reaches_exactly_the_owning_worker line 879).
Racy mechanism intact: post-SHUT_WR drain loop with break on EOF before assertTrue(worker.cancels…) (lines 860–875 and 894–906).
git log 781bace..59538e9 -- tests/test_e2e_execution.py is empty — no merged change touches the file; no merged fix.
Open SR PRs (#159, #160) explicitly record the #143 flake as pre-existing and untouched — no competing ownership.

Phase B — Frozen task contract (FAIL → blocker 1)

scarcity_router_143_task() required tokens vs actual source at 59538e9:

assertTrue(worker.cancels — present (lines 875, 906) ✔
assertEqual(bystander.cancels, []) — ABSENT ✘. Source has the reversed form self.assertEqual([], bystander.cancels) (line 908). It was already reversed at the D1-01 base 781bace, so the token never matched source reality; the D1-02 synthetic fixture (tests/test_dogfood.py:80,93) uses the frozen order and masked the mismatch.
Enforcement: _structural_payload (dogfood.py:668-670) checks token not in content over the whole candidate file → any faithful fix that leaves the bystander assertion untouched is deterministically rejected after the model turn.
Required names ✔; allowed path tests/test_e2e_execution.py ✔; forbidden patterns/sleep ✔; verification argv + repeats=8 ✔; semantic weakening residue stays deferred to independent review (sound for a first non-adversarial run once the token is corrected). The optional review hardening (forbid added worker.cancels = … / bystander.cancels = …) remains optional and is not required for soundness.
Classification: data-only frozen-task update (one string literal), not a mechanism change. Do not weaken the gate to fit.

Phase C — Verification commands (PASS)

Disposable clone at exact 59538e9 in /tmp/kilo/sr-d1-03 (owner checkout untouched; controller-faithful env HOME=<workspace> PATH LANG=C.UTF-8):

uv run python -m unittest tests.test_e2e_execution.CancellationTests -v — cold run (venv provisioning) 19.4s wall; warm runs 11.5s / 11.4s, 2/2 tests OK each time. Suitable for exactly 8 repeats (~95s warm total; ≤900s budget each — ample).
make check — 2190 tests OK (skipped=1), basedpyright 0 errors/0 warnings/0 notes, 8m20s wall (476s tests). Baseline green at the frozen base; the auth messages in output are expected negative-path test logs, no credentials involved.
Note: tests are offline; first-run uv venv provisioning contacted PyPI (mcp + dev deps). D1-04 budget should include ~10–20s provisioning, or a pre-warmed cache.
Estimated verification total for D1-04: 1× + 8× targeted + make check ≈ 10–11 minutes; default 55-minute deadline is safe.

Phase D — Codex preflight (binary PASS; live construction FAIL → blocker 2)

Intended binary: /home/adrian/.vscode-server/extensions/openai.chatgpt-26.917.62051-linux-x64/bin/linux-x86_64/codex; codex-cli 0.155.0-alpha.16.3 (matches the version SR PR #159 evidence used).
HOME-based auth/config present (~/.codex/auth.json, config.toml); no environment-carried provider secret needed.
Probe via the merged CodexStdio (exact D1-02 class): initialize + initialized only, under the closed child env — succeeded, closed cleanly. Trusted inventory {thread/start, turn/start, thread/read, turn/interrupt} pinned. No thread/turn/inference.
Defect: connection_factory (dogfood.py:1172-1177) passes schema_methods=CODEX_METHODS without schema_version; CodexStdio.__init__ (codex_stdio.py:47) requires schema_version == expected_version whenever schema_methods is non-empty → the live factory always raises ValueError before starting app-server. Tests never invoke connection_factory() (test_dogfood.py:694-708 stops at component construction), so D1-02 could not catch it. My probe succeeded only after adding schema_version=version.

Phase E — Closed child environment (PASS)

codex_environment() (dogfood.py:1105-1111) yields exactly HOME, PATH, LANG here (LC_ALL/TMPDIR unset in controller env); probe confirmed the child env keys = ['HOME','LANG','PATH'].
CREATIDY_DOGFOOD_ROUTER_KEY, CREATIDY_DOGFOOD_FORGE_TOKEN, and unrelated secrets are structurally excluded (not in CODEX_ENVIRONMENT_KEYS); covered by test_codex_environment_is_closed_and_secret_free.
DEFER recorded: compose_dogfood_live(environ, …) derives the child env from os.environ internally (dogfood.py:1176) instead of the passed environ — behaviorally equivalent for the supported CLI (which passes os.environ); not fixed, does not block.

Phase F — Real Router SELECTION ONLY (performed; no execution)

Interface: configured Scarcity Router machine-interface contract v1 (same typed application layer and configured artifacts as REST /v1/select; the MCP adapter never starts the REST socket and never executes models). Requirement = exactly what the live CLI sends via advance_work_unit → ResourceRequest(unit, {"reference"}, 128) → {"task_level":"L0","capability_minima":{},"hard_constraints":{"requires_tool_use":true,"minimum_input_context_tokens":128}}.
Selected: provider zai, model glm-5.3, variant/reasoning effort low ("GLM-5.3 Low"); reason_codes: ["selected_balanced"], selector balanced, catalog v4 (2026-09-24), resource_policy 1, degraded=false.
Capacity/provenance: zai coding_plan weekly window 75% remaining (governing), 5h window 67%; openai codex weekly 40% (label "scarce") — openai candidates rank behind zai on capacity. Alternatives all carry explicit efforts (glm-5.3 high/max, glm-5.3-flash max, gpt-5.6-* medium/high/max); excluded gpt-6-* failed requires_tool_use (unknown). REST responses carry an always-present reasoning_effort (D-057: explicit null = unconfigured, never omitted).
Every currently eligible candidate for this requirement carries a non-null reasoning effort — there is no eligible null-effort selection in catalog v4.

Phase G — supported-effort trace (FAIL → blocker 3, the primary gate)

Trace through merged source:

compose_dogfood_live → ScarcityRouterAllocator(url, (binding,)) — binding from CREATIDY_DOGFOOD_RUNTIME_BINDING (provider/model[/effort]).
Allocation requires exact identity match incl. effort (scarcity_router.py:407-415): the observed selection forces the 3-part binding zai/glm-5.3/low; a 2-part zai/glm-5.3 binding fails at allocation ("incompatible with configured runtime bindings").
CLI _dogfood (cli.py:117-131) calls run_dogfood(...) without supported_efforts → default frozenset() (dogfood.py:880) → CodexRuntime(..., supported_efforts=frozenset()) (dogfood.py:1001-1008). The PR #33 review's report is confirmed against merged source.
resolve() passes reasoning_effort="low"; CodexRuntime._inputs (codex_runtime.py:177-181) raises UnsupportedExecution("Codex provider/model reasoning effort has no trusted support binding") before any dispatch — fail-closed, no inference wasted, but the live run is guaranteed unusable. With catalog v4 there is no effort-free selection that could sneak through, so this is structural, not incidental.

Smallest sound correction (direction, NOT implemented here): expose controller-owned trusted supported-effort evidence at the live composition boundary — e.g. one documented env var carrying a closed set of provider/model/effort triples, validated like the runtime binding, passed compose_dogfood_live → CLI → run_dogfood(supported_efforts=…) → CodexRuntime. Router recommendation stays non-evidence; no model-name inference; no registry; no weakened identity checks; null stays null.

Phase H — Forge preflight (PASS, read-only)

BioMedical-IT/scarcity-router resolves via authenticated API; server-side develop = 59538e949d2b3488668c9649cf3728dbe87b38bb (matches frozen base); default branch develop; AGit push target refs/for/<base> (forgejo_transport.py:399).
Git remote https://forgejo.creatidy.com/BioMedical-IT/scarcity-router.git — correct, credential-free URL; git 2.43.0.
Askpass contract verified (optional CREATIDY_DOGFOOD_FORGE_ASKPASS: absolute executable file, outside the object source, exported as GIT_ASKPASS); unset in the preflight environment — owner configures it (or an equivalent credential mechanism) for the D1-04 AGit push.
Controller-owned bare object source (<data-dir>/objects.git) prepared by the composition; nothing pushed, no branch/PR created.

Phase I — Workspace preflight (PASS)

/home/adrian/workspace/scarcity-router: absolute, valid Git checkout, HEAD = origin/develop = 59538e9…, git status --porcelain clean, remote URL has no embedded credentials, outside the Kernel repo and any Kernel data directory; a read-only clone from it (Phase C) worked without mutation. Untouched by D1-03.

Terminal determination: `LIVE_CONFIGURATION_BLOCKED`

Three exact defects, each with the smallest bounded correction (none implemented in #34):

#	Failing value/path	Source-level reason	Smallest correction
1	required token `assertEqual(bystander.cancels, [])` (dogfood.py:282)	SR source (all of `781bace`…`59538e9`) uses `assertEqual([], bystander.cancels)`; whole-file token check rejects every faithful candidate after the model turn	Replace the token with `assertEqual([], bystander.cancels)` (data-only frozen-task update; align the D1-02 fixture)
2	`connection_factory` (dogfood.py:1172-1177)	`schema_methods` non-empty without `schema_version` always raises in `CodexStdio.__init__` (codex_stdio.py:47); never exercised by tests	Pass `schema_version=codex_version`
3	CLI→`run_dogfood` `supported_efforts` = `frozenset()` (cli.py:117-131, dogfood.py:880,1007)	Real Router selects explicit effort (`zai/glm-5.3/low`); `CodexRuntime._inputs` (codex_runtime.py:177-181) fail-closes on any non-null effort absent trusted evidence	Controller-owned trusted effort-binding env evidence wired through the live composition (see Phase G); binding must be `zai/glm-5.3/low`

Proposed follow-up issue body (for owner decision; not created automatically)

Title: D1-03a — Unblock the first live dogfood run: live Codex construction, trusted effort evidence, and frozen bystander token

## Goal
Make the merged D1-02 live dogfood path actually executable for BioMedical-IT/scarcity-router#143 by applying the three smallest corrections identified by D1-03 preflight (#34).

## Why
The D1-03 preflight proved the live path deterministically fails before useful work: the live connection factory cannot construct CodexStdio (missing schema_version); the CLI supplies no supported_efforts so any Router selection with explicit reasoning effort (all eligible candidates in catalog v4) is rejected by CodexRuntime; and the frozen structural token `assertEqual(bystander.cancels, [])` never matched Scarcity Router source (`assertEqual([], bystander.cancels)`), so every faithful candidate would be rejected after the model turn.

## Scope
- adapters/dogfood.py + CLI: pass `schema_version=codex_version` in the live `connection_factory`; add one documented controller-owned environment variable carrying a closed set of trusted `provider/model/effort` bindings, validated like `CREATIDY_DOGFOOD_RUNTIME_BINDING`, wired `compose_dogfood_live → _dogfood → run_dogfood(supported_efforts=…) → CodexRuntime`; correct the frozen required token to `assertEqual([], bystander.cancels)` in `scarcity_router_143_task()`.
- tests: extend the live-composition test to invoke `connection_factory()` against a fake app-server transport; cover effort-evidence parsing/pass-through (incl. null-effort passthrough without substitution); align the D1-02 fixture bystander token with real source.

## Acceptance Criteria
- Constructing the live connection against the configured binary/version succeeds (no unconditional ValueError).
- With trusted evidence `zai|glm-5.3|low` configured and a Router selection of `zai/glm-5.3` effort `low`, `CodexRuntime._inputs` accepts the exact tuple; with empty evidence and explicit effort it still raises UnsupportedExecution (fail-closed preserved).
- Null/unconfigured effort passes through exactly as selected (no `"none"` coercion, either direction).
- Structural check accepts a candidate that keeps `assertEqual([], bystander.cancels)` verbatim; the weakening tests still reject removal of the bystander assertion.
- Router output is never treated as support evidence; support evidence originates only from controller configuration at the Runtime boundary.
- `make check` and `make package-check` pass.

## Constraints
- No Router policy duplication, no model registry, no model-name inference, no weakened identity checks, no generic configuration framework; D1-01 frozen-task constraints otherwise unchanged; no inference during the fix.

## Links
- #34 (D1-03 evidence), #32 / #33 (D1-02), #30 (parent), BioMedical-IT/scarcity-router#143

Issue #34 stays open (blocked outcome; only owner-side follow-up remains: decide/create D1-03a). No execution packet is issued because the terminal outcome is not READY_FOR_LIVE_DOGFOOD. For reference when D1-03a lands: SR base to pin 59538e949d2b3488668c9649cf3728dbe87b38bb, source repo /home/adrian/workspace/scarcity-router, verification 1×+8× targeted (~11.5s each warm) + make check (~8m20s), deadline default 55 min adequate.

NO AUTOMATIC MERGE / NO DEPLOY. NO MODEL INFERENCE WAS PERFORMED DURING D1-03.

# D1-03 Preflight Evidence — Terminal outcome: `LIVE_CONFIGURATION_BLOCKED` **NO MODEL INFERENCE WAS PERFORMED DURING D1-03.** Executed probes: git reads, file inspection, SR unit tests, one Router selection (recommendation-only, in-process machine-interface contract v1), and one Codex app-server `initialize` probe (no `thread/start`, no `turn/start`, no prompt). **NO AUTOMATIC MERGE / NO DEPLOY.** Kernel and Scarcity Router were not modified; no SR branch/PR was created. --- ## Phase A — Subjects verified **A1 Kernel (PASS)** - Canonical `develop` = `72bee742ec0b34d2bb16ace95b03794b17ccc1d3` (fetched; matches owner-side expectation). - PR #33 `merged: true` at 2026-09-28T20:15:30Z; merge commit `72bee742…`; reviewed D1-02 head `0893ed988d4d4e210469c5503627d0a56e2b35f4` — both confirmed via Forgejo. - `src/creatidy_kernel/adapters/dogfood.py` + `dogfood` CLI subcommands present; inspection tree clean (`git status --porcelain` = 0), still clean at exit. **A2 Scarcity Router (PASS — task NOT stale)** - Canonical `develop` = `59538e949d2b3488668c9649cf3728dbe87b38bb` (Forgejo branch API confirms the same SHA server-side). **This is the SHA to freeze for the proposed live run** (`--expected-base 59538e949d2b3488668c9649cf3728dbe87b38bb`). D1-01 SHA `781bace…` is 100+ commits behind and irrelevant as base. - Issue #143 open; both scenario-11 tests exist at `59538e9` (`test_scenario_11_client_disconnect_propagates_cancel` line 839; `test_scenario_11_cancel_reaches_exactly_the_owning_worker` line 879). - Racy mechanism intact: post-`SHUT_WR` drain loop with `break` on EOF before `assertTrue(worker.cancels…)` (lines 860–875 and 894–906). - `git log 781bace..59538e9 -- tests/test_e2e_execution.py` is **empty** — no merged change touches the file; no merged fix. - Open SR PRs (#159, #160) explicitly record the #143 flake as pre-existing and untouched — no competing ownership. ## Phase B — Frozen task contract (FAIL → blocker 1) `scarcity_router_143_task()` required tokens vs actual source at `59538e9`: - `assertTrue(worker.cancels` — present (lines 875, 906) ✔ - `assertEqual(bystander.cancels, [])` — **ABSENT** ✘. Source has the reversed form `self.assertEqual([], bystander.cancels)` (line 908). It was already reversed at the D1-01 base `781bace`, so the token never matched source reality; the D1-02 synthetic fixture (`tests/test_dogfood.py:80,93`) uses the frozen order and masked the mismatch. - Enforcement: `_structural_payload` (dogfood.py:668-670) checks `token not in content` over the whole candidate file → any faithful fix that leaves the bystander assertion untouched is **deterministically rejected after the model turn**. - Required names ✔; allowed path `tests/test_e2e_execution.py` ✔; forbidden patterns/sleep ✔; verification argv + `repeats=8` ✔; semantic weakening residue stays deferred to independent review (sound for a first non-adversarial run once the token is corrected). The optional review hardening (forbid added `worker.cancels = …` / `bystander.cancels = …`) remains optional and is not required for soundness. - Classification: **data-only frozen-task update** (one string literal), not a mechanism change. Do not weaken the gate to fit. ## Phase C — Verification commands (PASS) Disposable clone at exact `59538e9` in `/tmp/kilo/sr-d1-03` (owner checkout untouched; controller-faithful env `HOME=<workspace> PATH LANG=C.UTF-8`): - `uv run python -m unittest tests.test_e2e_execution.CancellationTests -v` — cold run (venv provisioning) 19.4s wall; warm runs 11.5s / 11.4s, 2/2 tests OK each time. Suitable for exactly 8 repeats (~95s warm total; ≤900s budget each — ample). - `make check` — **2190 tests OK (skipped=1), basedpyright 0 errors/0 warnings/0 notes, 8m20s wall** (476s tests). Baseline green at the frozen base; the auth messages in output are expected negative-path test logs, no credentials involved. - Note: tests are offline; first-run `uv` venv provisioning contacted PyPI (mcp + dev deps). D1-04 budget should include ~10–20s provisioning, or a pre-warmed cache. - Estimated verification total for D1-04: 1× + 8× targeted + make check ≈ **10–11 minutes**; default 55-minute deadline is safe. ## Phase D — Codex preflight (binary PASS; live construction FAIL → blocker 2) - Intended binary: `/home/adrian/.vscode-server/extensions/openai.chatgpt-26.917.62051-linux-x64/bin/linux-x86_64/codex`; `codex-cli 0.155.0-alpha.16.3` (matches the version SR PR #159 evidence used). - HOME-based auth/config present (`~/.codex/auth.json`, `config.toml`); no environment-carried provider secret needed. - Probe via the merged `CodexStdio` (exact D1-02 class): `initialize` + `initialized` only, under the closed child env — succeeded, closed cleanly. Trusted inventory `{thread/start, turn/start, thread/read, turn/interrupt}` pinned. **No thread/turn/inference.** - **Defect:** `connection_factory` (dogfood.py:1172-1177) passes `schema_methods=CODEX_METHODS` without `schema_version`; `CodexStdio.__init__` (codex_stdio.py:47) requires `schema_version == expected_version` whenever `schema_methods` is non-empty → **the live factory always raises `ValueError` before starting app-server.** Tests never invoke `connection_factory()` (test_dogfood.py:694-708 stops at component construction), so D1-02 could not catch it. My probe succeeded only after adding `schema_version=version`. ## Phase E — Closed child environment (PASS) - `codex_environment()` (dogfood.py:1105-1111) yields exactly `HOME, PATH, LANG` here (LC_ALL/TMPDIR unset in controller env); probe confirmed the child env keys = `['HOME','LANG','PATH']`. - `CREATIDY_DOGFOOD_ROUTER_KEY`, `CREATIDY_DOGFOOD_FORGE_TOKEN`, and unrelated secrets are structurally excluded (not in `CODEX_ENVIRONMENT_KEYS`); covered by `test_codex_environment_is_closed_and_secret_free`. - DEFER recorded: `compose_dogfood_live(environ, …)` derives the child env from `os.environ` internally (dogfood.py:1176) instead of the passed `environ` — behaviorally equivalent for the supported CLI (which passes `os.environ`); not fixed, does not block. ## Phase F — Real Router SELECTION ONLY (performed; no execution) - Interface: configured Scarcity Router machine-interface contract v1 (same typed application layer and configured artifacts as REST `/v1/select`; the MCP adapter never starts the REST socket and never executes models). Requirement = exactly what the live CLI sends via `advance_work_unit` → `ResourceRequest(unit, {"reference"}, 128)` → `{"task_level":"L0","capability_minima":{},"hard_constraints":{"requires_tool_use":true,"minimum_input_context_tokens":128}}`. - **Selected: provider `zai`, model `glm-5.3`, variant/reasoning effort `low`** ("GLM-5.3 Low"); `reason_codes: ["selected_balanced"]`, selector `balanced`, catalog v4 (2026-09-24), resource_policy 1, degraded=false. - Capacity/provenance: zai coding_plan weekly window 75% remaining (governing), 5h window 67%; openai codex weekly 40% (label "scarce") — openai candidates rank behind zai on capacity. Alternatives all carry explicit efforts (glm-5.3 high/max, glm-5.3-flash max, gpt-5.6-* medium/high/max); excluded gpt-6-* failed `requires_tool_use` (unknown). REST responses carry an always-present `reasoning_effort` (D-057: explicit null = unconfigured, never omitted). - **Every currently eligible candidate for this requirement carries a non-null reasoning effort** — there is no eligible null-effort selection in catalog v4. ## Phase G — supported-effort trace (FAIL → blocker 3, the primary gate) Trace through merged source: 1. `compose_dogfood_live` → `ScarcityRouterAllocator(url, (binding,))` — binding from `CREATIDY_DOGFOOD_RUNTIME_BINDING` (`provider/model[/effort]`). 2. Allocation requires exact identity match incl. effort (scarcity_router.py:407-415): the observed selection forces the 3-part binding `zai/glm-5.3/low`; a 2-part `zai/glm-5.3` binding fails at allocation ("incompatible with configured runtime bindings"). 3. CLI `_dogfood` (cli.py:117-131) calls `run_dogfood(...)` **without `supported_efforts`** → default `frozenset()` (dogfood.py:880) → `CodexRuntime(..., supported_efforts=frozenset())` (dogfood.py:1001-1008). **The PR #33 review's report is confirmed against merged source.** 4. `resolve()` passes `reasoning_effort="low"`; `CodexRuntime._inputs` (codex_runtime.py:177-181) raises `UnsupportedExecution("Codex provider/model reasoning effort has no trusted support binding")` **before any dispatch** — fail-closed, no inference wasted, but the live run is guaranteed unusable. With catalog v4 there is no effort-free selection that could sneak through, so this is structural, not incidental. **Smallest sound correction (direction, NOT implemented here):** expose controller-owned trusted supported-effort evidence at the live composition boundary — e.g. one documented env var carrying a closed set of `provider/model/effort` triples, validated like the runtime binding, passed `compose_dogfood_live → CLI → run_dogfood(supported_efforts=…) → CodexRuntime`. Router recommendation stays non-evidence; no model-name inference; no registry; no weakened identity checks; null stays null. ## Phase H — Forge preflight (PASS, read-only) - `BioMedical-IT/scarcity-router` resolves via authenticated API; server-side `develop` = `59538e949d2b3488668c9649cf3728dbe87b38bb` (matches frozen base); default branch develop; AGit push target `refs/for/<base>` (forgejo_transport.py:399). - Git remote `https://forgejo.creatidy.com/BioMedical-IT/scarcity-router.git` — correct, credential-free URL; git 2.43.0. - Askpass contract verified (optional `CREATIDY_DOGFOOD_FORGE_ASKPASS`: absolute executable file, outside the object source, exported as `GIT_ASKPASS`); unset in the preflight environment — owner configures it (or an equivalent credential mechanism) for the D1-04 AGit push. - Controller-owned bare object source (`<data-dir>/objects.git`) prepared by the composition; nothing pushed, no branch/PR created. ## Phase I — Workspace preflight (PASS) - `/home/adrian/workspace/scarcity-router`: absolute, valid Git checkout, HEAD = `origin/develop` = `59538e9…`, `git status --porcelain` clean, remote URL has no embedded credentials, outside the Kernel repo and any Kernel data directory; a read-only clone from it (Phase C) worked without mutation. Untouched by D1-03. --- ## Terminal determination: `LIVE_CONFIGURATION_BLOCKED` Three exact defects, each with the smallest bounded correction (none implemented in #34): | # | Failing value/path | Source-level reason | Smallest correction | |---|---|---|---| | 1 | required token `assertEqual(bystander.cancels, [])` (dogfood.py:282) | SR source (all of `781bace`…`59538e9`) uses `assertEqual([], bystander.cancels)`; whole-file token check rejects every faithful candidate after the model turn | Replace the token with `assertEqual([], bystander.cancels)` (data-only frozen-task update; align the D1-02 fixture) | | 2 | `connection_factory` (dogfood.py:1172-1177) | `schema_methods` non-empty without `schema_version` always raises in `CodexStdio.__init__` (codex_stdio.py:47); never exercised by tests | Pass `schema_version=codex_version` | | 3 | CLI→`run_dogfood` `supported_efforts` = `frozenset()` (cli.py:117-131, dogfood.py:880,1007) | Real Router selects explicit effort (`zai/glm-5.3/low`); `CodexRuntime._inputs` (codex_runtime.py:177-181) fail-closes on any non-null effort absent trusted evidence | Controller-owned trusted effort-binding env evidence wired through the live composition (see Phase G); binding must be `zai/glm-5.3/low` | ### Proposed follow-up issue body (for owner decision; not created automatically) ```markdown Title: D1-03a — Unblock the first live dogfood run: live Codex construction, trusted effort evidence, and frozen bystander token ## Goal Make the merged D1-02 live dogfood path actually executable for BioMedical-IT/scarcity-router#143 by applying the three smallest corrections identified by D1-03 preflight (#34). ## Why The D1-03 preflight proved the live path deterministically fails before useful work: the live connection factory cannot construct CodexStdio (missing schema_version); the CLI supplies no supported_efforts so any Router selection with explicit reasoning effort (all eligible candidates in catalog v4) is rejected by CodexRuntime; and the frozen structural token `assertEqual(bystander.cancels, [])` never matched Scarcity Router source (`assertEqual([], bystander.cancels)`), so every faithful candidate would be rejected after the model turn. ## Scope - adapters/dogfood.py + CLI: pass `schema_version=codex_version` in the live `connection_factory`; add one documented controller-owned environment variable carrying a closed set of trusted `provider/model/effort` bindings, validated like `CREATIDY_DOGFOOD_RUNTIME_BINDING`, wired `compose_dogfood_live → _dogfood → run_dogfood(supported_efforts=…) → CodexRuntime`; correct the frozen required token to `assertEqual([], bystander.cancels)` in `scarcity_router_143_task()`. - tests: extend the live-composition test to invoke `connection_factory()` against a fake app-server transport; cover effort-evidence parsing/pass-through (incl. null-effort passthrough without substitution); align the D1-02 fixture bystander token with real source. ## Acceptance Criteria - Constructing the live connection against the configured binary/version succeeds (no unconditional ValueError). - With trusted evidence `zai|glm-5.3|low` configured and a Router selection of `zai/glm-5.3` effort `low`, `CodexRuntime._inputs` accepts the exact tuple; with empty evidence and explicit effort it still raises UnsupportedExecution (fail-closed preserved). - Null/unconfigured effort passes through exactly as selected (no `"none"` coercion, either direction). - Structural check accepts a candidate that keeps `assertEqual([], bystander.cancels)` verbatim; the weakening tests still reject removal of the bystander assertion. - Router output is never treated as support evidence; support evidence originates only from controller configuration at the Runtime boundary. - `make check` and `make package-check` pass. ## Constraints - No Router policy duplication, no model registry, no model-name inference, no weakened identity checks, no generic configuration framework; D1-01 frozen-task constraints otherwise unchanged; no inference during the fix. ## Links - #34 (D1-03 evidence), #32 / #33 (D1-02), #30 (parent), BioMedical-IT/scarcity-router#143 ``` Issue #34 stays open (blocked outcome; only owner-side follow-up remains: decide/create D1-03a). No execution packet is issued because the terminal outcome is not `READY_FOR_LIVE_DOGFOOD`. For reference when D1-03a lands: SR base to pin `59538e949d2b3488668c9649cf3728dbe87b38bb`, source repo `/home/adrian/workspace/scarcity-router`, verification 1×+8× targeted (~11.5s each warm) + `make check` (~8m20s), deadline default 55 min adequate. **NO AUTOMATIC MERGE / NO DEPLOY. NO MODEL INFERENCE WAS PERFORMED DURING D1-03.**

adrian.tkacz referenced this issue

2026-09-28 22:26:19 +00:00

D1-03a — Repair live dogfood preflight blockers #35

kilo referenced this issue

2026-09-28 22:42:35 +00:00

D1-03a: Repair the three live dogfood preflight blockers (#35) #36

kilo referenced this issue

2026-09-28 22:57:23 +00:00

D1-03a: Repair the three live dogfood preflight blockers (#35) #36

kilo commented

2026-09-29 21:28:27 +00:00

Member

D1-03 preflight round 2 — after D1-03a/#35

Terminal outcome: INFRASTRUCTURE_BLOCKED.

Preflight performed using GLM-5.3 Max. Round-1 evidence is preserved. No new issue, implementation, branch, PR, AGit push, merge, or deployment was created. No Codex thread/start or turn/start was called. NO MODEL INFERENCE WAS PERFORMED DURING D1-03 means no execution-path/provider inference was performed; the expressly requested preflight analysis model was used.

A — Canonical subjects

Actual #34 and #35 bodies and PR #36 were fetched through Forgejo MCP; canonical develops fetched through Git.

Kernel develop: c8f105e2c03d96ee99bb9c0cca1791798cccdc4b.
PR #36 merged on 2026-09-29T20:35:46Z; reviewed head be3d7b97a5da20fec622e1b35253564826fbfcdc verified. Local inspection HEAD equals origin/develop; working tree clean before and after inspection.
Scarcity Router develop: f79f4521fddab4e6677faa9e5c260846bed5bc81.
Source checkout /home/adrian/workspace/scarcity-router is clean, HEAD equals origin/develop, and remained untouched apart from authorized fetching of Git refs.

Task #143 is not stale at the frozen SR SHA. In tests/test_e2e_execution.py, CancellationTests starts at 838; scenario tests remain at 839 and 879. Both drain loops still break on socket EOF before waiting for worker-reader cancellation recording (867–874 and corresponding second-test region). Assertions remain self.assertTrue(worker.cancels, "cancel never reached the worker") at 875, self.assertTrue(worker.cancels) at 906, and self.assertEqual([], bystander.cancels) at 908. Current source still contains the defect; no merged change fixes it.

Open SR PR files/diffs were inspected: #160 touches the same test file but adds scenario-09b/09c reasoning coverage, not CancellationTests; #161 adds separate Zcode acceptance coverage; #163 concerns MCP implementation/tests/docs. None owns or overlaps this cancellation repair. Same-file adjacency in #160 is recorded and is not itself repair ownership.

B — Fate of the three original blockers

Original blocker	Status	Evidence
Frozen structural token	PASS	`scarcity_router_143_task()` now requires `assertEqual([], bystander.cancels)` (dogfood.py:284); exact form exists at current SR base:908.
Codex schema pin	PASS, source and inference-free handshake	Factory passes `schema_methods=CODEX_METHODS`, `schema_version=codex_version`, and the same expected executable version (dogfood.py:1177–1182). CodexStdio still rejects mismatched schema versions (:47) and executable version (:87–88). Actual configured binary/version remain unavailable, as explained below.
Trusted supported-effort authority	PASS, source and labeled dry derivation	Controller runtime binding is parsed once into Allocation, supplied to allocator and used to derive DogfoodLiveComponents.supported_efforts; CLI passes it to run_dogfood; CodexRuntime retains the exact-tuple gate. Live configured values remain unavailable.

Both required scenario names and owning-worker token assertTrue(worker.cancels still match. Allowed changed paths remain exactly frozenset({"tests/test_e2e_execution.py"}). Frozen verification remains targeted once (900s timeout), targeted exactly 8 additional runs (900s each), then one make check (3600s). Anti-weakening patterns remain; semantic residue still requires later independent review. Optional assignment-pattern hardening was not added.

Authority trace, independently checked in merged source:

CREATIDY_DOGFOOD_RUNTIME_BINDING → _live_binding() controller Allocation → ScarcityRouterAllocator(runtime_bindings=(binding,)) and DogfoodLiveComponents.supported_efforts → CLI run_dogfood(..., supported_efforts=components.supported_efforts) → CodexRuntime.

Dry derivations were synthetic evidence, not live configuration:

Explicit zai/glm-5.3/low yields exactly frozenset({('zai', 'glm-5.3', 'low')}).
Binding without effort yields frozenset().
Literal effort none yields a literal none tuple, distinct from Python None.

Router-selected provider/model/effort must match the controller binding exactly (scarcity_router.py:407–430). The allocator returns that binding with provenance annotations, never adds Runtime support authority from Router output. Explicit effort missing trusted evidence still fails closed (codex_runtime.py:177–181). No identity normalization/substitution was introduced.

C — Current baseline and timing

Commands ran in a clean disposable clone at exact f79f4521, /tmp/kilo/d103r2-20260929-225538-1722006-verify/sr-src, not the owner source. Dependency bootstrap was kept separate from test execution; verification environment was inspected against the merged runner.

uv sync --only-dev: exit 0, approximately 1s, dependencies cache-served.
uv run python -m unittest tests.test_e2e_execution.CancellationTests -v, baseline run 1: exit 0, 2 tests OK, unittest 13.152s, approximately 15s wall.
Same command, baseline run 2: exit 0, 2 tests OK, unittest 11.136s, approximately 11s wall.
make check: exact captured exit 0, 2320 tests OK, unittest approximately 526.9s, basedpyright 0 errors/0 warnings/0 notes, approximately 550s wall.

Transparency: full make check ran twice, not once. The first run's tests and typing were green, but the command wrapper did not capture the exit code correctly; a second full run obtained explicit exit 0 and the timing above. There was no failing baseline gate or race reproduction requiring retry. Negative-path traceback/teardown output did not change the successful unittest verdict. No broad repetition/stress campaign was used.

Tests are synthetic/offline and require no live provider credentials. Dependency bootstrap is separate and may require a package cache/network; this preflight used cached dependencies. Future frozen verification plan is 1 + 8 targeted runs + one make check, not two targeted plus eight. At observed timings that is approximately 11–12 minutes, with 15 minutes reserved for verification as a reasonable margin. Any live Runtime turn would need its own additional budget. The CLI's default 55-minute authorization deadline is a candidate budget, not a guarantee or a hard bound on verification, and is not an execution authorization here.

D — Codex preflight limits

CREATIDY_DOGFOOD_CODEX_BIN and CREATIDY_DOGFOOD_CODEX_VERSION are absent. Therefore there is no actual configured executable/version to certify.

Supplementary candidate binary, not an owner-configured binding:
/home/adrian/.vscode-server/extensions/openai.chatgpt-26.917.62051-linux-x64/bin/linux-x86_64/codex.

--version returned codex-cli 0.155.0-alpha.16.3 with exit 0. A merged CodexStdio handshake using that candidate version, correctly pinned schema_version, and the closed environment succeeded using only version probe, initialize, initialized, close. No thread or turn was created.

The method inventory supplied by CODEX_METHODS is a trusted caller assertion, not inventory obtained from initialize (codex_stdio.py:72–74). No independent exact-binary schema inventory was established; listing conn.methods does not prove native availability. HOME-based auth/config file existence was checked by names only; credential contents were not read or printed. Existence is not proof the configured authentication is usable, and no uncertain auth probe was performed. Consequently this phase is partial, not live-ready.

E — Closed environment

Source and dry child-env derivation pass: only HOME, PATH, LANG, LC_ALL, TMPDIR are eligible. Here actual yielded keys were HOME, LANG, PATH. Router keys, Forge tokens, unrelated API keys, and arbitrary controller entries are excluded. The known library-seam DEFER is unchanged: compose_dogfood_live accepts environ but connection_factory uses codex_environment(os.environ); supported CLI passes os.environ, so those are equivalent. No repair was made.

F — Fresh Router recommendation, with exact limitations

The required configured Router URL and controller binding are absent. Therefore the actual live CLI allocator selection could not be performed safely, and there is no verified Router HTTP endpoint for this run.

A fresh supplementary in-process MCP recommendation was made using the exact CLI requirement:
{"task_level":"L0","capability_minima":{},"hard_constraints":{"requires_tool_use":true,"minimum_input_context_tokens":128}}.

It reported balanced selection, provider zai, model glm-5.3, variant low, catalog version 4, catalog date 2026-09-24; observed capacity included zai weekly 44% remaining and five-hour 93%. Critically, the response omitted reasoning_effort. Missing is neither null nor literal low nor literal none. The current canonical SR serialization always includes reasoning_effort (selector.py:1156–1163), so the observed MCP response is not compatible with the Kernel parser's required field. Its variant was not substituted for effort. Current checkout catalog data was not joined to that response to manufacture missing wire evidence. MCP is not a configured CLI URL and cannot certify this live path.

Thus fresh configured-path provider/model/effort and executable Allocation remain UNVERIFIED. No provider was executed.

G — Exact compatibility gate

SUPPORTED_EFFORT_GATE_PASS is NOT established.

There is no actual controller runtime binding, no constructed live components, and no fresh compatible live selection. Accordingly, the exact live trusted supported_efforts value is unavailable, not an assumed empty set and not the synthetic singleton above. The source chain is correct, but its real inputs have not been provisioned. Allocation-outside-binding and Runtime-without-explicit-effort-evidence still fail closed.

H — Forge, read-only

Canonical BioMedical-IT/scarcity-router identity, current develop SHA, and Forgejo MCP reads pass. Git 2.43.0 is present; canonical fetch/clone works with available Git authentication. Remote URL is credential-free:
https://forgejo.creatidy.com/BioMedical-IT/scarcity-router.git.

However CREATIDY_DOGFOOD_FORGE_API, FORGE_REMOTE, FORGE_TOKEN, and optional FORGE_ASKPASS are absent. A successful MCP read authenticates the MCP credential, not the separately configured dogfood API token. Configured askpass path and future push credentials were not verified. Current authenticated Git read is not proof of AGit write access. The code supports controller-owned <data-dir>/objects.git; no controller execution/data store or push was created to attest live delivery. Forge live readiness is partial/unverified, not PASS.

I — Workspace

Owner checkout /home/adrian/workspace/scarcity-router is an absolute valid Git source, clean, exact current develop resolvable at f79f4521fddab4e6677faa9e5c260846bed5bc81, remote credential-free, separate from Kernel/data dirs, and suitable for read-only clone source. It remained untouched. A future authorized live run must freeze its then-revalidated exact base with --expected-base, not rely on a moving branch.

J — Real dry construction and concrete blocker

Actual merged compose_dogfood_live(os.environ, scarcity_router_143_task(expected_base_sha=<frozen SHA>)) refused safely because these seven required names were absent:

CREATIDY_DOGFOOD_ROUTER_URL
CREATIDY_DOGFOOD_RUNTIME_BINDING
CREATIDY_DOGFOOD_CODEX_BIN
CREATIDY_DOGFOOD_CODEX_VERSION
CREATIDY_DOGFOOD_FORGE_API
CREATIDY_DOGFOOD_FORGE_REMOTE
CREATIDY_DOGFOOD_FORGE_TOKEN

The coordinator independently confirmed all seven are absent and Kernel HEAD/tree remain unchanged. No synthetic live config was injected, no binding was chosen from Router output, and no secrets were inspected to fill gaps. Router key and Forge askpass are additional optional configuration names when required by owner infrastructure.

Disposition

INFRASTRUCTURE_BLOCKED, not a newly proven Kernel defect. The original three source defects are fixed, but actual supported live configuration, schema/auth evidence, compatible fresh Router response, and configured Forge authority must be supplied and revalidated before readiness can be established. No opportunistic fixes, new preflight issue, follow-up issue, or execution packet were created. #34 stays open.

NO AUTOMATIC MERGE / NO DEPLOY. NO MODEL INFERENCE WAS PERFORMED DURING D1-03 execution-path probes.

## D1-03 preflight round 2 — after D1-03a/#35 Terminal outcome: **`INFRASTRUCTURE_BLOCKED`**. Preflight performed using GLM-5.3 Max. Round-1 evidence is preserved. No new issue, implementation, branch, PR, AGit push, merge, or deployment was created. No Codex `thread/start` or `turn/start` was called. **NO MODEL INFERENCE WAS PERFORMED DURING D1-03** means no execution-path/provider inference was performed; the expressly requested preflight analysis model was used. ### A — Canonical subjects Actual #34 and #35 bodies and PR #36 were fetched through Forgejo MCP; canonical develops fetched through Git. - Kernel develop: `c8f105e2c03d96ee99bb9c0cca1791798cccdc4b`. - PR #36 merged on 2026-09-29T20:35:46Z; reviewed head `be3d7b97a5da20fec622e1b35253564826fbfcdc` verified. Local inspection HEAD equals origin/develop; working tree clean before and after inspection. - Scarcity Router develop: `f79f4521fddab4e6677faa9e5c260846bed5bc81`. - Source checkout `/home/adrian/workspace/scarcity-router` is clean, HEAD equals origin/develop, and remained untouched apart from authorized fetching of Git refs. Task #143 is **not stale** at the frozen SR SHA. In `tests/test_e2e_execution.py`, CancellationTests starts at 838; scenario tests remain at 839 and 879. Both drain loops still break on socket EOF before waiting for worker-reader cancellation recording (867–874 and corresponding second-test region). Assertions remain `self.assertTrue(worker.cancels, "cancel never reached the worker")` at 875, `self.assertTrue(worker.cancels)` at 906, and `self.assertEqual([], bystander.cancels)` at 908. Current source still contains the defect; no merged change fixes it. Open SR PR files/diffs were inspected: #160 touches the same test file but adds scenario-09b/09c reasoning coverage, not CancellationTests; #161 adds separate Zcode acceptance coverage; #163 concerns MCP implementation/tests/docs. None owns or overlaps this cancellation repair. Same-file adjacency in #160 is recorded and is not itself repair ownership. ### B — Fate of the three original blockers | Original blocker | Status | Evidence | |---|---|---| | Frozen structural token | **PASS** | `scarcity_router_143_task()` now requires `assertEqual([], bystander.cancels)` (dogfood.py:284); exact form exists at current SR base:908. | | Codex schema pin | **PASS, source and inference-free handshake** | Factory passes `schema_methods=CODEX_METHODS`, `schema_version=codex_version`, and the same expected executable version (dogfood.py:1177–1182). CodexStdio still rejects mismatched schema versions (:47) and executable version (:87–88). Actual configured binary/version remain unavailable, as explained below. | | Trusted supported-effort authority | **PASS, source and labeled dry derivation** | Controller runtime binding is parsed once into Allocation, supplied to allocator and used to derive DogfoodLiveComponents.supported_efforts; CLI passes it to run_dogfood; CodexRuntime retains the exact-tuple gate. Live configured values remain unavailable. | Both required scenario names and owning-worker token `assertTrue(worker.cancels` still match. Allowed changed paths remain exactly `frozenset({"tests/test_e2e_execution.py"})`. Frozen verification remains targeted once (900s timeout), targeted exactly 8 additional runs (900s each), then one `make check` (3600s). Anti-weakening patterns remain; semantic residue still requires later independent review. Optional assignment-pattern hardening was not added. Authority trace, independently checked in merged source: `CREATIDY_DOGFOOD_RUNTIME_BINDING` → `_live_binding()` controller Allocation → `ScarcityRouterAllocator(runtime_bindings=(binding,))` and `DogfoodLiveComponents.supported_efforts` → CLI `run_dogfood(..., supported_efforts=components.supported_efforts)` → CodexRuntime. Dry derivations were synthetic evidence, not live configuration: - Explicit `zai/glm-5.3/low` yields exactly `frozenset({('zai', 'glm-5.3', 'low')})`. - Binding without effort yields `frozenset()`. - Literal effort `none` yields a literal `none` tuple, distinct from Python None. Router-selected provider/model/effort must match the controller binding exactly (scarcity_router.py:407–430). The allocator returns that binding with provenance annotations, never adds Runtime support authority from Router output. Explicit effort missing trusted evidence still fails closed (codex_runtime.py:177–181). No identity normalization/substitution was introduced. ### C — Current baseline and timing Commands ran in a clean disposable clone at exact `f79f4521`, `/tmp/kilo/d103r2-20260929-225538-1722006-verify/sr-src`, not the owner source. Dependency bootstrap was kept separate from test execution; verification environment was inspected against the merged runner. - `uv sync --only-dev`: exit 0, approximately 1s, dependencies cache-served. - `uv run python -m unittest tests.test_e2e_execution.CancellationTests -v`, baseline run 1: exit 0, 2 tests OK, unittest 13.152s, approximately 15s wall. - Same command, baseline run 2: exit 0, 2 tests OK, unittest 11.136s, approximately 11s wall. - `make check`: exact captured exit 0, **2320 tests OK**, unittest approximately 526.9s, **basedpyright 0 errors/0 warnings/0 notes**, approximately **550s wall**. Transparency: full `make check` ran twice, not once. The first run's tests and typing were green, but the command wrapper did not capture the exit code correctly; a second full run obtained explicit exit 0 and the timing above. There was no failing baseline gate or race reproduction requiring retry. Negative-path traceback/teardown output did not change the successful unittest verdict. No broad repetition/stress campaign was used. Tests are synthetic/offline and require no live provider credentials. Dependency bootstrap is separate and may require a package cache/network; this preflight used cached dependencies. Future frozen verification plan is **1 + 8 targeted runs + one make check**, not two targeted plus eight. At observed timings that is approximately 11–12 minutes, with **15 minutes reserved for verification** as a reasonable margin. Any live Runtime turn would need its own additional budget. The CLI's default 55-minute authorization deadline is a candidate budget, not a guarantee or a hard bound on verification, and is not an execution authorization here. ### D — Codex preflight limits `CREATIDY_DOGFOOD_CODEX_BIN` and `CREATIDY_DOGFOOD_CODEX_VERSION` are absent. Therefore there is no actual configured executable/version to certify. Supplementary candidate binary, not an owner-configured binding: `/home/adrian/.vscode-server/extensions/openai.chatgpt-26.917.62051-linux-x64/bin/linux-x86_64/codex`. `--version` returned `codex-cli 0.155.0-alpha.16.3` with exit 0. A merged CodexStdio handshake using that candidate version, correctly pinned schema_version, and the closed environment succeeded using **only version probe, initialize, initialized, close**. No thread or turn was created. The method inventory supplied by CODEX_METHODS is a trusted caller assertion, not inventory obtained from initialize (codex_stdio.py:72–74). No independent exact-binary schema inventory was established; listing conn.methods does not prove native availability. HOME-based auth/config file existence was checked by names only; credential contents were not read or printed. Existence is not proof the configured authentication is usable, and no uncertain auth probe was performed. Consequently this phase is partial, not live-ready. ### E — Closed environment Source and dry child-env derivation pass: only HOME, PATH, LANG, LC_ALL, TMPDIR are eligible. Here actual yielded keys were HOME, LANG, PATH. Router keys, Forge tokens, unrelated API keys, and arbitrary controller entries are excluded. The known library-seam DEFER is unchanged: compose_dogfood_live accepts environ but connection_factory uses codex_environment(os.environ); supported CLI passes os.environ, so those are equivalent. No repair was made. ### F — Fresh Router recommendation, with exact limitations The required configured Router URL and controller binding are absent. Therefore the actual live CLI allocator selection could not be performed safely, and there is **no verified Router HTTP endpoint** for this run. A fresh supplementary **in-process MCP** recommendation was made using the exact CLI requirement: `{"task_level":"L0","capability_minima":{},"hard_constraints":{"requires_tool_use":true,"minimum_input_context_tokens":128}}`. It reported balanced selection, provider `zai`, model `glm-5.3`, variant `low`, catalog version 4, catalog date 2026-09-24; observed capacity included zai weekly 44% remaining and five-hour 93%. Critically, **the response omitted reasoning_effort**. Missing is neither null nor literal `low` nor literal `none`. The current canonical SR serialization always includes reasoning_effort (selector.py:1156–1163), so the observed MCP response is not compatible with the Kernel parser's required field. Its variant was **not** substituted for effort. Current checkout catalog data was **not** joined to that response to manufacture missing wire evidence. MCP is not a configured CLI URL and cannot certify this live path. Thus fresh **configured-path provider/model/effort and executable Allocation remain UNVERIFIED**. No provider was executed. ### G — Exact compatibility gate **SUPPORTED_EFFORT_GATE_PASS is NOT established.** There is no actual controller runtime binding, no constructed live components, and no fresh compatible live selection. Accordingly, **the exact live trusted supported_efforts value is unavailable**, not an assumed empty set and not the synthetic singleton above. The source chain is correct, but its real inputs have not been provisioned. Allocation-outside-binding and Runtime-without-explicit-effort-evidence still fail closed. ### H — Forge, read-only Canonical BioMedical-IT/scarcity-router identity, current develop SHA, and Forgejo MCP reads pass. Git 2.43.0 is present; canonical fetch/clone works with available Git authentication. Remote URL is credential-free: `https://forgejo.creatidy.com/BioMedical-IT/scarcity-router.git`. However CREATIDY_DOGFOOD_FORGE_API, FORGE_REMOTE, FORGE_TOKEN, and optional FORGE_ASKPASS are absent. A successful MCP read authenticates the MCP credential, **not** the separately configured dogfood API token. Configured askpass path and future push credentials were not verified. Current authenticated Git read is not proof of AGit write access. The code supports controller-owned `<data-dir>/objects.git`; no controller execution/data store or push was created to attest live delivery. **Forge live readiness is partial/unverified, not PASS.** ### I — Workspace Owner checkout `/home/adrian/workspace/scarcity-router` is an absolute valid Git source, clean, exact current develop resolvable at `f79f4521fddab4e6677faa9e5c260846bed5bc81`, remote credential-free, separate from Kernel/data dirs, and suitable for read-only clone source. It remained untouched. A future authorized live run must freeze its then-revalidated exact base with `--expected-base`, not rely on a moving branch. ### J — Real dry construction and concrete blocker Actual merged `compose_dogfood_live(os.environ, scarcity_router_143_task(expected_base_sha=<frozen SHA>))` refused safely because these seven required names were absent: - CREATIDY_DOGFOOD_ROUTER_URL - CREATIDY_DOGFOOD_RUNTIME_BINDING - CREATIDY_DOGFOOD_CODEX_BIN - CREATIDY_DOGFOOD_CODEX_VERSION - CREATIDY_DOGFOOD_FORGE_API - CREATIDY_DOGFOOD_FORGE_REMOTE - CREATIDY_DOGFOOD_FORGE_TOKEN The coordinator independently confirmed all seven are absent and Kernel HEAD/tree remain unchanged. No synthetic live config was injected, no binding was chosen from Router output, and no secrets were inspected to fill gaps. Router key and Forge askpass are additional optional configuration names when required by owner infrastructure. ### Disposition **INFRASTRUCTURE_BLOCKED**, not a newly proven Kernel defect. The original three source defects are fixed, but actual supported live configuration, schema/auth evidence, compatible fresh Router response, and configured Forge authority must be supplied and revalidated before readiness can be established. No opportunistic fixes, new preflight issue, follow-up issue, or execution packet were created. #34 stays open. **NO AUTOMATIC MERGE / NO DEPLOY. NO MODEL INFERENCE WAS PERFORMED DURING D1-03 execution-path probes.**

kilo referenced this issue

2026-09-29 22:11:34 +00:00

D1-03b — Promote experimental dogfood path to durable task execution #37

kilo referenced this issue

2026-09-29 22:12:26 +00:00

D1-03b — Promote experimental dogfood path to durable task execution #37

kilo referenced this issue

2026-09-29 23:09:40 +00:00

D1-03b: Promote bounded task execution and quota-free preflight (#37) #38

kilo referenced this issue

2026-09-29 23:11:25 +00:00

D1-03b — Promote experimental dogfood path to durable task execution #37

kilo referenced this issue

2026-09-29 23:13:02 +00:00

D1-03b — Promote experimental dogfood path to durable task execution #37

adrian.tkacz commented

2026-09-30 18:55:18 +00:00

Author

Owner

Closing as historical INFRASTRUCTURE_BLOCKED.

The old CREATIDY_DOGFOOD_* preflight surface has been superseded by Kernel #37 / PR #38 and Infrastructure/creatidy-onprem #43 / PR #44.

Further readiness validation will continue on the durable neutral task + SOPS/Make operator surface.

Closing as historical `INFRASTRUCTURE_BLOCKED`. The old `CREATIDY_DOGFOOD_*` preflight surface has been superseded by Kernel #37 / PR #38 and Infrastructure/creatidy-onprem #43 / PR #44. Further readiness validation will continue on the durable neutral `task` + SOPS/Make operator surface.

adrian.tkacz closed this issue

2026-09-30 18:55:18 +00:00

kilo referenced this issue

2026-10-04 00:59:54 +00:00

D1-06 — Public self-contained operator path for Scarcity Router-backed task execution #44

kilo referenced this issue

2026-10-04 22:22:46 +00:00

[Kernel][G02 G05] Prepare and authorize versioned specifications from ordinary issues #49

kilo referenced this issue

2026-10-04 22:29:51 +00:00

[Kernel][G01-G13] Accept the installed controlled-task path end to end #60

No labels

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Creatidy/creatidy-kernel#34

No description provided.

Rows
Columns

D1-03 — Preflight the first live dogfood run against Scarcity Router #143 #34

Goal

Why this issue exists

Frozen downstream task

Preflight requirements

1. Kernel baseline

2. Scarcity Router current base

3. Re-freeze structural tokens

4. Verification commands

5. Codex binary and authentication preflight

6. Closed Codex environment

7. Scarcity Router selection preflight

8. Reasoning-effort compatibility gate

9. Smallest correction rule

10. Forge preflight

11. Workspace preflight

12. Execution packet

Terminal outcomes

READY_FOR_LIVE_DOGFOOD

LIVE_CONFIGURATION_BLOCKED

DOGFOOD_TASK_STALE

INFRASTRUCTURE_BLOCKED

Non-goals

Completion

D1-03 Preflight Evidence — Terminal outcome: LIVE_CONFIGURATION_BLOCKED

Phase A — Subjects verified

Phase B — Frozen task contract (FAIL → blocker 1)

Phase C — Verification commands (PASS)

Phase D — Codex preflight (binary PASS; live construction FAIL → blocker 2)

Phase E — Closed child environment (PASS)

Phase F — Real Router SELECTION ONLY (performed; no execution)

Phase G — supported-effort trace (FAIL → blocker 3, the primary gate)

Phase H — Forge preflight (PASS, read-only)

Phase I — Workspace preflight (PASS)

Terminal determination: LIVE_CONFIGURATION_BLOCKED

Proposed follow-up issue body (for owner decision; not created automatically)

D1-03 preflight round 2 — after D1-03a/#35

A — Canonical subjects

B — Fate of the three original blockers

C — Current baseline and timing

D — Codex preflight limits

E — Closed environment

F — Fresh Router recommendation, with exact limitations

G — Exact compatibility gate

H — Forge, read-only

I — Workspace

J — Real dry construction and concrete blocker

Disposition

`READY_FOR_LIVE_DOGFOOD`

`LIVE_CONFIGURATION_BLOCKED`

`DOGFOOD_TASK_STALE`

`INFRASTRUCTURE_BLOCKED`

D1-03 Preflight Evidence — Terminal outcome: `LIVE_CONFIGURATION_BLOCKED`

Terminal determination: `LIVE_CONFIGURATION_BLOCKED`