Repository navigation
[docs] - Resync README, setup guide and install docs after the agentic removal and extras drop - #1731
Merged
Merged
Conversation
…c removal and extras drop Doc pass against main @ cdcef76 with the two open PRs (#1726, #1727) treated as merged; the deterministic checkers (doc-sync, dep-guard, env drift, lock contract, invariant-guard) were already green, so every change is prose. - README: the agentic loop no longer appears in the ship-off list, the security-model row or "Current development"; the docs map stops crediting setup-guide.md with Docker/conda and gains locks/README.md. - setup-guide.md: the self-install line is `pip install -e . -c constraints.txt` on Linux/Windows and `pip install -e . --no-deps` on macOS (the old `/tmp/constraints-macos.txt` no longer exists, and the install goes through the hashed locks, not requirements.txt); the lock contract covers 19 locks, not 25; "step 4b" is step 4; the stranded lock-freshness section sits above the footer; reconciled date 2026-10-20. - locks/README.md: records that constraints.txt and requirements*.txt are hashed byte-for-byte into the lock records, and what a Dependabot pip PR is under the #1726 config. - docs/DOCKER.md, macos/README.md, powershell/README.md, AGENTS.md, CLAUDE.md section 8: stale agentic-registry/agentic-writes wording, the verify-deps name, and the macOS note on the editable install. - docs/audits/2026-10-20-dependency-currency-sweep.md: PyPI currency and advisory sweep over all 42 pins. No pin changed: the hashed locks regenerate only on arm64 macOS and the contract hashes the manifests, so bump candidates are listed for the owner. 0 new advisories. Checks run directly: doc_sync.py, check_deps.py, check_env_drift.py, check_lock_contract.py, check_invariants.py (all 0 failures); `pip install --dry-run --no-deps -e .` in a 3.12 venv. CI only: everything else. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0196C68GFwq9cXGmpqDMDGJe
4 of 18 tasks
cgfixit
marked this pull request as ready for review
October 20, 2026 14:33
cgfixit
enabled auto-merge
October 20, 2026 14:34
cgfixit
added a commit
that referenced
this pull request
Oct 20, 2026
## Proposed changes Make the completed 60-second CyClaw demo available from the repository README. Add the unchanged MP4 under `docs/screenshots/demo/` and a descriptive relative link near the top of `README.md`. ```text README.md → docs/screenshots/demo/cyclaw-60-second-demo.mp4 ``` The silent demo shows local status, a document question, its grounded answer, supporting sources, and protected operator controls. It uses real local retrieval/inference with synthetic documents and leaves quiet holds for later narration. **Invariant / Governance Impact:** Documentation and media only. No application, configuration, workflow, hook, or invariant changes. ## Types of changes - [ ] Bugfix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Security (auth, privacy, injection, egress, redaction, or secrets) - [ ] Invariant / Governance refinement (use this for changes that strengthen or evolve the 6 invariants, I6 isolation, or harness phases) - [ ] Dependencies (added, removed, or bumped) - [ ] CI / infrastructure (workflows, hooks, templates, or checkers) - [ ] Refactor or tests (behavior-preserving, no new capability) - [x] Documentation update - [ ] Other (none of the boxes above fit) ## Benefits / why Visitors can watch the working local-document flow directly from the README. The description identifies the silent format and synthetic data so the footage is not mistaken for a production corpus or a cloud-provider demonstration. ## Risks to monitor **Door:** two-way. **Blast radius:** documentation. Removing the link and media reverses the change; the 1,778,140-byte video remains in Git history. The recording can become dated as the UI evolves. Browser handling of a repository MP4 may open a preview or download it. ## Checklist - [ ] I have read `docs/THREAT_MODEL.md`, `INVARIANTS.md` and `SECURITY.md` (and any relevant Phase docs) - [x] This change preserves all 6 security invariants and I6 module isolation (explicit evidence or invariant matrix included for core changes) - [ ] Full sandbox validation has been run (`GROK_API_KEY=dummy pytest tests/ -q --tb=short`, and `bash .claude/skills/CyClaw-Sandbox/verify.sh` for core RAG/agentic paths) and passes with no regressions - [x] No new external network dependencies or mandatory online LLM assumptions were introduced without explicit justification + offline fallback path - [ ] For any agentic/fsconnect change: two-phase audit, quota enforcement, governed delete/trash, and write guards have been verified - [ ] Relevant architecture docs or threat model notes have been updated if core behavior or topology changed - [x] Commit messages follow the title prefix convention above - [ ] For large or complex changes: before/after invariant matrix + sandbox evidence is included in "Further comments" or linked Unchecked runtime/security-path rows are not applicable to this two-file documentation/media change. Full local suites and Actionlint were not rerun: no executable code or workflows changed. ## Further comments **Evidence — before:** the completed 60-second export was a local artifact with no README link. **After:** it is tracked at the requested repository path and the relative README link resolves. - Base: `b0683515d5791eb5caaa958013d7780ccfb8027e`; candidate: `069a8c175165e0693fb4433fad873cc2cd2163ba`. - Maintained doc-sync checker: **0 drift items**; README paths and links pass. `git diff --check` passes. - Copied video is byte-for-byte identical to the verified export: SHA-256 `f3424b34d093484d51d3bc33316587116c56e163739769db6fbb4129002dedad`. - ffprobe: **60.000000 seconds**, 1920×1080, H.264, 30 fps, 1,800 frames, no audio stream. Fresh full-file FFmpeg decode passes. - The identical export previously completed real browser playback to 60 seconds with `ended: true` and no playback error. Its contents were visually reviewed; footage is a paced capture edit of synthetic demo documents. - No private corpus, credentials, runtime directories, or raw capture frames are included. The earlier screenshot/gallery and existing 15-second advertisement remain intact. ## Suggested merge order of open PRs Trial merges verified with `git merge --no-commit --no-ff` and abort against main `b0683515d5791eb5caaa958013d7780ccfb8027e` on 2026-10-20 ET. The combined demo + #1731 trial also merged cleanly; its README retains both changes. There is no ordering dependency. **#1731 · Blocked (draft)** Impact: Documentation refresh; shared README, distinct hunks; combined trial clean. Action: Complete hosted checks and human review; recheck current heads before merge. **This PR · Blocked (draft)** Impact: Adds the demo and README link only; combined trial clean. Action: Human review and merge decision; may merge independently of #1731. ## ELI5 The demo was saved locally but visitors could not find it in the repository. This adds that exact silent, one-minute video to `docs/screenshots/demo/` and links it near the top of the README. No application behavior changes. The file was decoded, its duration and format checked, and the README link passed the repository checker. The same video also completed browser playback. Full application suites were not run for this media-only addition; future UI changes may make the recording look dated. Last updated: 2026-10-20 10:29 ET
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Documentation and dependency resync against
main@b0683515(after #1726 and #1727 merged). The five deterministic checkers (doc-sync D1-D13, dep-guard D1-D11, env drift E1-E7,check_lock_contract.py, invariant-guard) were already green, so every change here is prose plus one dated audit. No pin, lock, manifest, or code line changes.README.md: the removed agentic coding loop no longer appears in the ship-off list, the security-model "Optional surfaces" row, or "Current development"; the docs map stops creditingsetup-guide.mdwith Docker/conda and gains alocks/README.mdrow.setup-guide.md: the editable self-install ispip install -e . -c constraints.txton Linux/Windows andpip install -e . --no-depson macOS. The old text pointed at/tmp/constraints-macos.txt(exists nowhere in the repo) and said the install went throughrequirements.txt(it goes through the hashed locks). Lock count 25 -> 19 (six locks left with [infra] - Drop the orphaned deepagents and mssql extras #1700). "step 4b" -> step 4 (no 4b exists). The lock-freshness section was stranded after the footer and now sits above it. Reconciled date 2026-10-20. Option C step 5 notesGH_TOKENis optional and unread by the runtime.locks/README.md: records thatconstraints.txt,requirements*.txtandscripts/ci-lock-inputs/are hashed byte-for-byte into the lock records (a comment edit alone fails the contract), and a Dependabot section matching [infra] - Keep Dependabot out of locks/ and split pip majors into their own PR #1726.docs/DOCKER.md,macos/README.md,powershell/README.md: "agentic registry" / "agentic writes" / "Agentic / registry" wording replaced with what exists (model caches, fsconnect writes, connectors).AGENTS.md:verify-dep->verify-deps.CLAUDE.md§8: one trailing comment on the macOS editable install. Both files steer agent sessions; the diff is those two lines, nothing copied from any external source.docs/audits/2026-10-20-dependency-currency-sweep.md(new) and adocs/changelog.txtrow: PyPI currency + per-release advisory sweep over all 42 pins. 0 new advisories (chromadb and nltk remain the two accepted inSECURITY.md). Bump candidates are grouped for the owner; the staleconstraints.txtpydantic comment is flagged but left alone because fixing it would re-hash the file.Invariant / Governance Impact: none. No core file, graph edge, config value, sanitizer pattern, auth path, or manifest changed.
check_invariants.py: 46 passed, 0 failed on the pushed head.Types of changes
Scope note: Docs + audits.
Benefits / why
setup-guide.mdon macOS was told to pass a constraints file that does not exist; the new line (--no-deps) was run and resolves./ops/agentic.locks/README.mdnow states the one rule that bites a would-be contributor: the manifests are hashed, so a pin or comment edit needs the Mac re-lock. Dependabot's role ([infra] - Keep Dependabot out of locks/ and split pip majors into their own PR #1726) is documented where the locks live.Risks to monitor
pip install -e . --no-depsline. Signal if wrong:cyclaw-*shims missing after that command on a Mac. Verified on Linux 3.12 only (dry-run, "Would install cyclaw-1.9.0"); not run on macOS.doc_sync.pyD9/D10 would catch a broken link or anchor from the moved section; it reports 0 drift on the head.Checklist
docs/THREAT_MODEL.md,INVARIANTS.mdandSECURITY.md(and any relevant Phase docs)Further comments
Checks run directly on the pushed head:
doc_sync.py(0 drift),check_deps.py(0/0),check_env_drift.py(0/0),check_lock_contract.py(passed),check_invariants.py(46/0), a lock-vs-constraints agreement pass over 148 shared entries, andpip install --dry-run --no-deps -e .in a Python 3.12 venv. CI only: ruff, the four test legs, coverage, pr-template-check.Suggested merge order of open PRs
Trial merges verified against main @ b068351 on 2026-10-20: this branch is rebased directly onto that SHA (fast-forward, nothing to merge).
#1728 · Blocked
Impact: Dependabot Docker base 3.12 -> 3.15;
requires-python <3.13, so this cannot merge as proposed.Action: Close or re-pin; independent of this PR.
#1729 · Blocked
Impact: Dependabot pip minor+patch, 16 packages; red on the lock contract until the Mac re-lock (see
locks/README.mdDependabot section in this PR).Action: Owner re-locks on arm64 macOS, then merge; does not touch this PR's files.
this PR · Safe
Impact: Docs and one audit only; no shared file with #1728/#1729.
Action: Merge any time; squash.
ELI5
The code moved on (the agentic coding loop and its extras were deleted last week, the lock set shrank, Dependabot got new rules) and the instruction manuals did not. This PR is the manual catching up; it changes no behavior.
README.md,docs/DOCKER.mdand the macOS/PowerShell READMEs still named the agentic loop, its registry and its writes.setup-guide.mdtold Mac users to pass-c /tmp/constraints-macos.txt(a file nothing creates), said the install went throughrequirements.txt(it goes throughlocks/), counted 25 locks (there are 19), referenced a "step 4b" that does not exist, and had its lock-freshness section sitting after the signature line.pip install -e . --no-deps, becauseconstraints.txtpinstorch==2.13.0+cpuand no such wheel exists for macOS.locks/README.mdgains two facts: the manifests are hashed into the lock records byte-for-byte, and a Dependabot pip PR is a shopping list until someone re-locks on the Mac. A new dated audit lists every pin against PyPI today with advisories checked per pinned release; two advisories exist (chromadb, nltk) and both were already accepted inSECURITY.md. Deliberately not done: no pin bumped, noconstraints.txtcomment fixed, because either one turnscheck_lock_contract.pyred until the arm64 re-lock.--no-depsline. It was dry-run on Linux 3.12 and resolved; it was not run on a Mac. If it is wrong,cyclaw-userand friends stay "command not found" after it. Everything else is words;doc_sync.pyD9/D10 guard the links and anchors and report 0 drift.Last updated: 2026-10-20 10:12 ET
Generated by Claude Code