From 92fa4e22addd8a19df8f8a0b8fc42aa8e8303e78 Mon Sep 17 00:00:00 2001 From: sanjey99 Date: Mon, 31 Aug 2026 11:31:08 +0800 Subject: [PATCH] docs: record issue 48 integration evidence ## Summary Record the exact protected-main merge and post-integration stability evidence for issue #48. ## Evidence boundary The candidate ledger still described PR #93 as pending even after merge b05a4aa and its local and hosted repository gates passed. ## Change - docs/BUILD_LOG.md: add exact-main local and hosted run evidence. - docs/FIXES.md: mark TST-27 through TST-30 resolved and integrated without claiming an independent audit. - docs/TASKS.md: record C and I as passed for STABILITY. ## Testing - Literal npm run check on exact protected-main b05a4aa: launcher/deploy 12/12, Server 846 passed and 3 skipped, Web 20/20, all typechecks and builds. - Hosted protected-main run 33353622211 passed. - git diff --check passed. --- docs/BUILD_LOG.md | 23 +++++++++++++++++++++++ docs/FIXES.md | 26 ++++++++++++++++++-------- docs/TASKS.md | 2 +- 3 files changed, 42 insertions(+), 9 deletions(-) diff --git a/docs/BUILD_LOG.md b/docs/BUILD_LOG.md index a0a47f3..7380122 100644 --- a/docs/BUILD_LOG.md +++ b/docs/BUILD_LOG.md @@ -7,6 +7,29 @@ Branch and phase statements remain true only for the commit named in their entry Use [`TASKS.md`](TASKS.md) for the current repository snapshot, defects, pending checks, and workflow. +## 2026-08-31 — STABILITY protected-main integration closeout + +Issue [#48](https://github.com/kyashp/shepherd/issues/48) implementation and +evidence [PR #93](https://github.com/kyashp/shepherd/pull/93) merged to protected +`main` as `b05a4aad10d0c4c0e9f7d54fed2cdd5c779c16b0`. Its parents are the +frozen integrated base `a2a464d6be697ab949b254944b81c355a9be5403` and final +evidence head `ec015b6414b56df297a83489004edae441243483`; `git diff` between +the merge tree and that second parent is empty. + +A fresh detached worktree whose HEAD and `origin/main` were both exact `b05a4aa` +ran one literal `npm run check` with no environment, worker, timeout, or retry +override. It exited 0: all four production/test-source typechecks passed; +launcher/deploy passed 12/12; Server passed 846 with three unchanged documented +opt-in skips in 140.70s; Web passed 20/20; and both production builds passed. No +warning, live/model request, product/UI mutation, or tracked-file change occurred. + +The merge-triggered protected-main workflow run +[`33353622211`](https://github.com/kyashp/shepherd/actions/runs/33353622211) +also completed successfully on exact `b05a4aa`; its `Node 22 / npm run check` +job ran for 3m40s. Together with the immutable five-run candidate campaign at +`10c95da`, this establishes both issue gates `C` and `I`. This is an integration +verification record, not a claim of a separate independent audit. + ## 2026-08-31 — STABILITY candidate passed five consecutive literal gates Issue [#48](https://github.com/kyashp/shepherd/issues/48), draft diff --git a/docs/FIXES.md b/docs/FIXES.md index f4f26d9..50efd26 100644 --- a/docs/FIXES.md +++ b/docs/FIXES.md @@ -40,12 +40,14 @@ that limitation is explicit. recovery path. Concurrent first-use candidates can therefore race private-root sentinel adoption and fail before `runner.run` registers their private homes as cleanup-fault targets. The row then measures setup adoption instead of cleanup. -- **Correction/status:** **RESOLVED CANDIDATE** at `69d82b4` on PR #93. Call the +- **Correction/status:** **RESOLVED + INTEGRATED** at protected-main merge `b05a4aa` + via PR #93; causal correction `69d82b4`. Call the public executor preflight once and assert it occurred before candidate scheduling; cleanup injection, timeout, and failure/no-promotion assertions are unchanged. The exact row passed 10/10, executor file 72/72, full Server 845/3 skipped before rebase, and the formal current-main campaign passed five literal gates at - `10c95da`. Integration audit remains pending. + `10c95da`. Exact-main local check passed Server 846/3 skipped plus all adjacent + gates, and protected-main workflow `33353622211` passed. Not independently audited. ### `TST-29` — PERF-01 overlap proof spends its budget on full Mission setup @@ -56,13 +58,15 @@ that limitation is explicit. five-second row builds a complete Git-backed Mission before reaching that boundary. Under suite pressure the setup consumes the timing budget even when candidate scheduling is correct. -- **Correction/status:** **RESOLVED CANDIDATE** at `f3a9dc0` on PR #93. Move the +- **Correction/status:** **RESOLVED + INTEGRATED** at protected-main merge `b05a4aa` + via PR #93; causal correction `f3a9dc0`. Move the existing byte-equivalent `allSettledBounded` primitive to the canonical scheduler module and prove two-start-before-release, completion-after-release, limit-one, rejection, and input-order behavior directly. Adjacent 30-second real-Plane tests retain completed-Mission, selection, promotion, and `promotion_completed` coverage. No product timeout/concurrency/retry changed. Formal campaign 5/5 at - `10c95da`; integration audit remains pending. + `10c95da`; exact-main local check passed Server 846/3 skipped plus all adjacent + gates, and protected-main workflow `33353622211` passed. Not independently audited. ### `TST-28` — F-03 snapshot cleanup is observed through OS file watchers @@ -72,13 +76,16 @@ that limitation is explicit. service-owned lifecycle boundary. Under full-suite contention it can miss the removal or contribute descriptor pressure even though the snapshot owner's `finally` is correct. -- **Correction/status:** **RESOLVED CANDIDATE** at `682d7d9` on PR #93. The existing +- **Correction/status:** **RESOLVED + INTEGRATED** at protected-main merge `b05a4aa` + via PR #93; causal correction `682d7d9`. The existing optional fault-checkpoint seam emits one exact `contract_verification_snapshot_removed` checkpoint only after owned cleanup settles; both F-03 variants await the matching Mission/Contract checkpoint and still require `lstat -> ENOENT`. A failing observer cannot mask the primary verifier error. Both rows passed five consecutive focused repetitions and the - formal campaign passed 5/5 at `10c95da`; integration audit remains pending. + formal campaign passed 5/5 at `10c95da`. Exact-main local check passed Server + 846/3 skipped plus all adjacent gates, and protected-main workflow `33353622211` + passed. Not independently audited. ### `TST-27` — Fixture Git inherits outer repository selector variables @@ -88,12 +95,15 @@ that limitation is explicit. - **Failure contract:** `git -C` does not override explicit repository selectors. Raw `execFile("git", ...)` inherited the enclosing hook/session environment, so a nested test could mutate the wrong index before asserting its repository. -- **Correction/status:** **RESOLVED CANDIDATE** at `682d7d9` on PR #93. Fixture Git +- **Correction/status:** **RESOLVED + INTEGRATED** at protected-main merge `b05a4aa` + via PR #93; causal correction `682d7d9`. Fixture Git receives only PATH plus fixed locale/noninteractive/no-config values, never ambient selector variables, and destructive fixture setup first proves the selected repository's real top level. The hostile-selector/decoy regression passed, the normal pre-push gate no longer redirected staging, and the formal campaign passed - 5/5 at `10c95da`. Integration audit remains pending. + 5/5 at `10c95da`. Exact-main local check passed Server 846/3 skipped plus all + adjacent gates, and protected-main workflow `33353622211` passed. Not independently + audited. ### `CRUD-01` — Clarification drafts permanently block Agent deletion diff --git a/docs/TASKS.md b/docs/TASKS.md index cda7dbc..35958dc 100644 --- a/docs/TASKS.md +++ b/docs/TASKS.md @@ -270,7 +270,7 @@ without an open issue/PR are not active ownership claims. | `TEST-TS` | 16 Phase 9B | **AUDITED** at integrated implementation `8995605` | Separate strict no-emit server test-source config is enforced by root `typecheck`/`check`; production emit config is unchanged. RED evidence covers 14 errors across 4 test files (4 implicit callback types, 5 invalid Vitest matcher generics, 4 stale promotion fixtures, 1 stale verifier fixture), then 2 nullable fixture values exposed after matcher typing was restored. Auditor confirmed no suppression, broad exclusion, compiler weakening, blanket `any`, assertion weakening, product/UI change, or dependency churn. Candidate and integrated strict test-source checks passed; both production typechecks/builds passed; affected suites passed 73/73; literal candidate and integrated gates passed with launcher 3/3, server 563/563 and one unchanged opt-in live skip, plus both production builds. | **100% scoped**; `T,C,I` passed (3/3); audited | | `CI-01` | 0.1, 16, 17 | **AUDITED** at workflow `cda2446`; hosted run `33259565232` succeeded | `required-checks.yml` uses supported official checkout/setup-node actions, Node 22, lockfile-backed npm cache, `npm ci`, Docker availability, and literal `npm run check`; it triggers every PR, pushes to protected `main`, and merge-queue `checks_requested`. Token permission is only `contents: read`; checkout credentials are not persisted; no `.env`, secrets, artifacts, privileged actions, or live/model path is configured. Independent local validation passed Docker 29.7.2 and launcher 3/3 plus server 555/555 with one opt-in skip. Hosted Node 22.23.2/npm 10.9.8 and Docker client/server 28.0.4 passed locked install, launcher 3/3, server 551 passed/5 environment-gated skips, typechecks, 40-module web build and server build. Stable job check: `Node 22 / npm run check`. Administrator must require that check on protected `main`; this external rule change is not performed by agents. `C,I`. | **100% scoped**; `C,I` passed (2/2); audited | | `SEC-REVIEW` | 0.3, 13, 17 | `PARTIAL`; parts 4-5 tracked in [issue #89](https://github.com/kyashp/shepherd/issues/89), successor to [#49](https://github.com/kyashp/shepherd/issues/49) | Parts 1-3 are evidenced at `bd9b093`. **Canary scan:** exactly two credentials exist, both threaded as `sensitiveValues`; no path found by which either reaches `state.json`, a model prompt, a 4xx/5xx body, the DOM, browser storage, a URL, the logger or a tracked file. The Ark key is never in argv and never in the generated Codex config. Two low observations: `/api/system` has no redaction pass, and `ARK_API_KEY` has no minimum length against a 4-character redaction floor. **Five invariant mutations, each caught by an existing test:** bearer auth rejection (2 tests), promotion refusal on failed final re-verification (`failure-matrix`), fast-forward-only protected-ref CAS, contract-cannot-broaden-authority intersection, and verifier Plane containment. **Boundary audit: FAIL.** Route inventory, traversal, identity, authority and promotion boundaries hold, but the bearer hook was bypassable by percent-encoding the `/api/` prefix — filed and fixed as `SEC-01`. **Parts 4 and 5 are tracked in [#89](https://github.com/kyashp/shepherd/issues/89), successor to `#49` after that issue was closed three times with its scope unsatisfied:** the independent read-only review must not be done by the author of `config.ts`'s token floor, `check-deploy-auth-token.mjs`, the deploy guard, the `A`-gate tests or the `SEC-01` fix. This row also owns the carried `OPS-06` High finding: `docker-compose.yml` binds `0.0.0.0` with an unprefixed port while `README` documents two entry points a deploy-script guard cannot reach. `C,S,I`. | **85%**; parts 1-3 evidenced; a seven-lens adversarial review ran for part 4 and returned 19 confirmed findings with 0 refuted, of which five Highs are fixed; part 5 incomplete and four findings remain open; whether that review satisfies "by someone other than the author" is the maintainer's call; not audited | -| `STABILITY` | 16 Phase 9B | **REVIEWED CANDIDATE** at `10c95da` on draft [PR #93](https://github.com/kyashp/shepherd/pull/93), [issue #48](https://github.com/kyashp/shepherd/issues/48); integrated feature-freeze base `a2a464d` | The first `bd77952` sequence was truthfully reset after run 4 exposed PERF-01's full-Mission timing harness. Four causal corrections now isolate inherited Git selectors, post-cleanup F-03 observation, scheduler overlap, and candidate-cleanup preflight without sleeps, timeout/retry increases, hidden workers, suppression, skips, or weakened assertions. On immutable candidate `10c95da`, five separate literal `npm run check` gates passed: launcher/deploy 12/12, Server 846 passed / 3 documented skips, Web 20/20, all typechecks and both builds on every run; Server durations were 149.16, 145.77, 144.00, 145.19, and 137.87 seconds. Required hosted runs `33351880563` and `33351880571` also passed. `C,I`. | **90% scoped**; candidate `C` passed (1/2); integrator review/merge and protected-main `I` rerun pending; not audited | +| `STABILITY` | 16 Phase 9B | **INTEGRATED** at protected-main merge `b05a4aa` via [PR #93](https://github.com/kyashp/shepherd/pull/93), [issue #48](https://github.com/kyashp/shepherd/issues/48); immutable campaign candidate `10c95da` | The first `bd77952` sequence was truthfully reset after run 4 exposed PERF-01's full-Mission timing harness. Four causal corrections isolate inherited Git selectors, post-cleanup F-03 observation, scheduler overlap, and candidate-cleanup preflight without sleeps, timeout/retry increases, hidden workers, suppression, skips, or weakened assertions. Candidate `10c95da` passed five separate literal `npm run check` gates: launcher/deploy 12/12, Server 846 passed / 3 documented skips, Web 20/20, all typechecks and both builds on every run; Server durations were 149.16, 145.77, 144.00, 145.19, and 137.87 seconds. A fresh literal exact-main check at `b05a4aa` passed the same counts with Server duration 140.70s; protected-main workflow `33353622211` also passed. `C,I`. | **100% scoped**; `C,I` passed (2/2); integration verified, not independently audited | | `LIVE-01` | 16 Phase 3/7/8 | `BLOCKED` by host capability, not by code; [issue #65](https://github.com/kyashp/shepherd/issues/65), split out of #47 | Reviewer sub-gate is satisfied: command attempt two made exactly one external request and completed with two bounded findings while deterministic outcome/security/cleanup stayed green. Current live Shepherd Mission and legacy continuity remain required. Reproduced on the affected host at `b80af11`: a plain write to a host-share bind mount inside the Runtime succeeds while the identical write under `codex sandbox linux --full-auto` is denied, so `test:shepherd:live` — which pins `CONTAINER_STATE_ROOT`/`CONTAINER_STATE_VOLUME` to `undefined` and bind-mounts `.tmp/shepherd-live-gate` — would fail at `stage=container_start reason=sandbox_probe_failed` and consume the no-retry allowance for no evidence. The gate needs a Linux host, or a code change making it volume-aware, which is outside an `L` run. `L,S,I`. | **55%**; 1/3; not audited | | `DEMO-REHEARSAL` | 14–15, 16 Phase 8 | `BLOCKED` by all demo-critical rows; [issue #50](https://github.com/kyashp/shepherd/issues/50) | Three clean reset-to-completion judge flows under three minutes, including clean no-op reset and initialized reset; second machine/state if genuinely available. `B,S,I`. | **0%**; 0/3; not audited |