Repository navigation
v0.11.0 (1/10): supervision, guard and evidence hardening - #240
Open
Mateo-GarciaL wants to merge 17 commits into
Open
Mateo-GarciaL wants to merge 17 commits into
Mateo-GarciaL wants to merge 17 commits into
Conversation
…eceipts A watchdog observes the live native event stream, computes deterministic loop signals every few completed calls, and asks System One only when a signal crosses its threshold. Each evaluation is an advisory decision receipt; the watchdog never stops, pauses or messages a run, and any failure is recorded as loop_watchdog_error.
…tamper; add virtual_device class Assignments and references to UH_TOOL_GUARD_POLICY and UH_TOOL_GUARD_LOG are resolved so a write carried through a shell variable hard-stops as guard_tamper instead of write_outside. oh-my-pi xd:// device URIs get their own virtual_device class.
…ged file review-collect keeps the reviewer's findings and per-claim verdicts in the assessment and prints contradicted claims. review-prepare captures every file the worker changed, not only declared outputs, and prints the report path relative to the review workspace.
The watchdog is fed the recorded denied-retries, healthy and repeated-shell-failure streams. The repeated-shell-failure stream does not cross a threshold; the observed signal values are asserted rather than the thresholds changed.
The 50-entry correctness assertion stays unconditional; the wall-clock bound runs only with UH_PERF_TESTS=1. uh mission show gains CLI tests for its fields, design.md readback and the unknown-mission error.
… checks are deterministic failures Verification passes failed or blocked required checks into the System One evaluation as a deterministic failure. A verdict over zero asked criteria is never pass, confidence is computed over criterion answers only, and the finding states what was judged.
Registry entries declare the files each probe asserts. Evidence records an input digest over those files plus runtime and model; classification compares digests instead of commits and names changed inputs. uh acceptance rebind revalidates old evidence without rerunning a model.
Every index mutation goes through one helper that takes an exclusive lock with a bounded backoff, breaks and records a stale lock whose owner is gone, re-reads the index inside the lock, applies one change and writes atomically. uh sandbox repair re-registers sandbox worktrees whose index entry is missing.
Team resources accept unknown_cost block or admit (default block). Under admit, a completed worker with unknown cost does not block the next wave; known costs still count against the budget and every such wave records an admission note in team state and the integration report. The command-code wave probes use admit; budget exhaustion is marked not applicable on a fleet that reports no cost.
A call the runtime refuses natively without invoking the hook is counted as a native refusal: it no longer disarms the guard or triggers the missing-hook policy stop, it consumes the denial budget with a reason naming the tool, and native_refusals is persisted. Guard-log evidence is matched per call when the log carries tool names.
…parser projectStatus uses the same nativeToolFailure parser as supervision, so a Command Code shell result carrying Exit code: N in its array-form text is projected as failed instead of successful.
The build no longer deletes dist before compiling. scripts/build.mjs compiles into dist.next and swaps it into place only when tsc succeeds; on failure dist is left untouched and the staging directory is removed. Leftover staging directories from an interrupted build are cleaned up first.
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
This was referenced Sep 23, 2026
|
Tick the box to add this pull request to the merge queue (same as
|
Collaborator
Author
|
Linux CI failed one test here: eight concurrent sandbox creations, where one |
The copy and delete target scanners dropped every token that starts with `/` so cmd.exe switches such as `/s /q` would not be read as paths. On Linux and macOS that also dropped real absolute paths: - `cp x /etc/y` and `mv x ~/.bashrc` were allowed: the destination was skipped, so a worker could write outside its roots. - `rm -rf /abs/in/root` was denied through the unresolved-delete fallback before the hive and tamper checks, as an untargeted `delete_outside`. This is why tests/hive-integrity.test.ts failed on Linux CI only. `/x` tokens are now switches only for cmd.exe verbs (rd, rmdir, del, erase, copy, move, xcopy, robocopy). POSIX regressions cover cp, mv and rm with absolute targets inside and outside the root, and cmd.exe switches keep working. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SCSUzdpgCLPbVws9ckbSV6
…rict) 0.10.0 was prepared on `dev` in June and never tagged or published, so it is skipped and its changes land here, ported from fix/changelog-roadmap-link-consistency: - UH-138: capability mismatches warn by default. `enforceCapabilities` takes a severity; `uh mission dry-run`, `run` and `run-all` accept `--strict` to turn a mismatch into an error, and `--force` prints a bypass line per runtime. `assertRuntimeCapabilities` keeps its always-throw contract. `runtime_requirements` are unchanged and still block. - UH-139: examples/missions/hello-uh and scripts/check-doc-links.mjs, wired as `bun run docs:check-links` in CI. The checker now covers only docs/ (the old apps/docs site is retired); the two broken links it found there are fixed. - spec-stale drift treats specs/ as the cross-cutting spec root. - CHANGELOG records the skipped 0.10.0; ROADMAP stops promising "planned v0.10.0" work; the Hermes plugin version moves to 0.11.0 to match the package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SCSUzdpgCLPbVws9ckbSV6
Eight concurrent createSandbox calls raced inside `git worktree add` on `.git/worktrees/<name>/commondir` and one failed with "failed to read commondir" (the Linux CI failure on #240). Adds from one process are now chained per repository root; everything else still runs concurrently, and the concurrency test is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SCSUzdpgCLPbVws9ckbSV6
LaloLalo1999
pushed a commit
that referenced
this pull request
Sep 24, 2026
Eight concurrent createSandbox calls raced inside `git worktree add` on `.git/worktrees/<name>/commondir` and one failed with "failed to read commondir" (the Linux CI failure on #240). Adds from one process are now chained per repository root; everything else still runs concurrently, and the concurrency test is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SCSUzdpgCLPbVws9ckbSV6
LaloLalo1999
pushed a commit
that referenced
this pull request
Sep 24, 2026
The three bottom-layer commits are on #240 and merged up through #249 without force-pushes; CI is green on #240, #247 and #249. The release plan now says so, marks the Phase 0 guard and flake items done, and keeps the author rewrite as the one open owner decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SCSUzdpgCLPbVws9ckbSV6
On Windows, `git worktree remove --force` recursed into a directory junction inside the worktree and deleted the junction's target instead of the link. A `node_modules` junction to the main checkout therefore emptied the main checkout's `node_modules` whenever a team or sandbox worktree was torn down. Both removal paths, sandbox teardown and team worktree removal, now remove every link and junction in the worktree, without following it, before git removes the worktree. A team worktree whose links cannot be removed is left in place. The new worktree-lock tests fail on Windows without the change (the linked directory's contents are deleted) and pass with it. Full suite on Windows: 1797 passed.
Every independent review ran in its own sandbox worktree, and nothing ever removed it: the assessment is written in the project, but the sandbox stayed behind, one worktree per review. `uh mission review-collect` now copies the reviewer's report beside the assessment as review-report.json and discards the review sandbox after a successful collection. `--keep-workspace` keeps it for inspection. `uh verify` still validates the review through the shared collection step and never discards the workspace it runs in. `uh land` reads collected reviews from the project, so it does not need the sandbox. Full suite on Windows: 1798 passed.
Mateo-GarciaL
force-pushed
the
release/v0.11.0
branch
from
September 24, 2026 23:56
ea9a36f to
a1179c6
Compare
Mateo-GarciaL
force-pushed
the
stack/v0.11.0-01-supervision-evidence
branch
from
September 24, 2026 23:56
b9ebdce to
cb75f49
Compare
This was referenced Oct 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 1 of 10 of the v0.11.0 line, stacked on the v0.11.0 draft (#239). Review this PR's own commits; its base branch carries the parts before it.
What this adds
Supervision records advisory loop receipts from live native events, the tool guard stops policy writes made through shell variables and classifies virtual devices on their own, review assessments keep every finding and claim and capture every changed file, a decision is never a pass over zero judged criteria, acceptance evidence stays valid while the files it asserts are unchanged, concurrent sandbox creation keeps every registration, teams take an explicit unknown-cost admission policy, a native refusal no longer reads as a disarmed guard, Command Code shell failures go through the shared parser, and the build swaps in only on success.
Commits (12)
Verification
At
0e6249d:bun run typecheckclean; full suite 125/125 files, 1,777 tests passed.Known issues
Open defects, gaps and unproven claims for the whole line are in
docs/known-issues.md.