chore: adopt NovaForge compute contract - #24
Conversation
Verification: remote-compute-audit; compute guard heavy/light refusal checks; bash -n; git diff --check
There was a problem hiding this comment.
Pull request overview
This PR introduces the NovaForge compute-distribution contract to bind development workflows to a Mac Mini (control surface) / Hetzner AX102 (heavy compute) split, including documentation, a local heavy-workload guard, and VS Code tasks to support remote proof workflows.
Changes:
- Adds versioned contract documentation describing the compute boundary, remote workspace proof rules, and operator tooling requirements.
- Introduces a local guard script to fail-closed on known heavy workloads when run locally.
- Adds VS Code tasks + README/AGENTS references to make the contract actionable for contributors.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/check-compute-distribution.sh | Adds a local guard that blocks known heavy workloads from being run on the Mac Mini. |
| README.md | Links contributors to the compute-distribution documentation. |
| docs/remote-workspace.md | Documents remote workspace identity and proof rules for heavy commands. |
| docs/operator-tooling.md | Defines required operator tools and their fail-closed behavior contract. |
| docs/novaforge-ax102-stack.md | Documents the AX102 “NovaForge” role/topology and forbidden topologies. |
| docs/compute-distribution.md | Establishes the compute boundary rules and lists versioned contract surfaces. |
| AGENTS.md | Adds agent-facing summary of the compute-distribution contract surfaces and rules. |
| .vscode/tasks.json | Adds tasks for guard checks and remote compute workflows. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| { | ||
| "label": "Compute Guard: Check command", | ||
| "type": "shell", | ||
| "command": "${workspaceFolder}/scripts/check-compute-distribution.sh \"${input:guardCommand}\"", | ||
| "problemMatcher": [] | ||
| }, |
| ```text | ||
| Remote host: hetzner-server | ||
| Remote workspace: /home/krille/workspaces/selectpilot | ||
| ``` |
| ```text | ||
| Host: hetzner-server | ||
| Workspace: /home/krille/workspaces/selectpilot | ||
| ``` |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6664113f88
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| { | ||
| "label": "Remote Compute: Run command on Hetzner", | ||
| "type": "shell", | ||
| "command": "${env:HOME}/.codex/bin/remote-compute-run -- ${input:remoteCommand}", |
There was a problem hiding this comment.
In the new VS Code shell task, ${input:remoteCommand} is interpolated unquoted, so shell operators are handled by the local task shell rather than sent to Hetzner. For example, entering pnpm install && pnpm test passes only pnpm install to remote-compute-run, then executes pnpm test locally after the wrapper succeeds, defeating the task's compute boundary. Pass the input through structured arguments or safely quote it as a single remote command.
AGENTS.md reference: AGENTS.md:L19-L25
Useful? React with 👍 / 👎.
| for pattern in "${heavy_patterns[@]}"; do | ||
| if [[ "$normalized" == *"$pattern"* ]]; then |
There was a problem hiding this comment.
The substring-only classifier allows pnpm setup:local, even though package.json:13 expands that command into pnpm install, pnpm build, and the macOS bootstrap that installs and pulls models; the README also presents this command in Quick Start. An operator checking that command receives mac_allowed_bounded_smoke and may run precisely the dependency installation, build, and background workload this contract requires on Hetzner. Resolve package scripts or explicitly classify these repository entry points before returning the safe result.
AGENTS.md reference: AGENTS.md:L19-L32
Useful? React with 👍 / 👎.
| "meilisearch" | ||
| "tantivy" | ||
| "release" | ||
| "package" |
There was a problem hiding this comment.
Because every pattern is matched as an arbitrary substring, the generic package entry makes a permitted command such as git diff package.json exit with blocked_local_heavy_compute. This incorrectly prevents a routine local Git inspection explicitly allowed by the contract; classify command tokens or concrete heavy operations instead of generic words that commonly occur in paths.
AGENTS.md reference: AGENTS.md:L10-L17
Useful? React with 👍 / 👎.
Summary
Stack boundary
This PR targets
codex/ci-foundation-repairso its diff contains only SOD-795. It does not modify PR #22 or represent delivery tomain. After #22 merges, this PR can be retargeted tomainwithout scope pollution.Verification
Exact branch SHA:
6664113f88fb59db607d439ec5c86af9628a404eLocal bounded checks:
remote-compute-auditbash -n scripts/check-compute-distribution.shgit diff --checkHetzner:
pnpm install --frozen-lockfilepnpm lintpnpm lint:manifestpnpm typecheckpnpm test: 5 panel + 25 server testspnpm buildpnpm test:e2e: 6 passed, 1 Chrome-extension test skipped because no Chrome executable was declared on the Linux hostRisk
Documentation/operator-contract change only. No SelectPilot runtime or product artifact includes NovaForge tooling.