cubs-halogen-probe-1: cubs-iteration executable and kit entries (FRONT-12 bootstrap)

[mecattaf]

The dotfiles half of the 7-day Halogen capability probe on the CUBS tree: one store executable and 120 generated kit entries. Nothing else in this repository moves; no switch, no unit, no arm. Doc: docs/local-ai/cubs-campaign.md. DECISIONS.md 2026-09-16 entry; DEFERRED.md DF-CUBS-1..5.

What is in it

• pkgs/cubs-iteration/ — a writeShellApplication (runtimeInputs bash, coreutils, curl, findutils, git, gnugrep, gnused, jq, python3, util-linux, pkgs.llm-agents.pi) plus cubs-helpers.py (event-stream summariser, built-in diff guard). Reads one task JSON (or the kit's {worklist, id} pointer) on stdin; flock; receipt as the idempotent done marker; polls worker:8731/health until status ok, busy false (10 s, 20 min, then exit 69 and an outage receipt that never feeds the fuse); records /v1/models and /health.version; git worktree add of ~/agency/<repo> at its current HEAD on campaign/cubs-halogen-probe-1/<id>; optional setup_cmd; ONE fresh pi -p --mode json … --provider halogen --model halogen-qwen3.8-flash-next --thinking <task> --no-extensions --no-skills --no-prompt-templates --no-context-files --no-approve --tools read,bash,edit,grep,find,ls[,write] under a campaign-private PI_CODING_AGENT_DIR; the campaign's tools/spec-diff-guard.sh as the gate (built-in fallback, same rules); validation_cmd under a 10 min timeout; exactly one repair process fed bundle + diff + transcript; commit on pass (only allowed files, never a push); receipt.json in the campaign's schema + execution_id/exit_code, attempts.json beside it; one usage line at $TALLY_USAGE_SOURCE_PATH; SIGTERM → WIP commit + cancelled receipt inside the kernel's 30 s grace; 3-consecutive-fail fuse (exit 2). --dry and --help. Exit codes 0/1/2/64/65/69/75/78/143, documented.
• home/tally-uplink.nix — build:CUBS-1..40 (+ scope/eval noops) generated beside the untouched LOCAL-SMOKE trio: argv = the store executable, cwd ~/mecattaf/cubs-campaign, env_allowlist [], usage_source halogen-usage/1 under <rewrite state>/uplink/usage/cubs-*.jsonl, stdin = a static pointer {"worklist": ".../worklists/current.jsonl", "id": "CUBS-<n>"} (a store kit's stdin is static bytes — kit.mjs, uplink.mjs:623, exec.rs:747 — so the day's task cannot live there without a switch per day).
• tests/tally-uplink/probe-cubs-iteration.sh — hermetic oracle (stub Pi + stub Halogen + throwaway repos), C1–C11.
• docs/local-ai/cubs-campaign.md — the executable, receipt fields, exit codes, the two operator acts, DEFERRED table.

MEASURED

• rendered kit: 123 entries; nix build .#checks.x86_64-linux.tally-uplink-topology → rc 0 (the check does not enumerate kit refs; no edit).
• bash tests/tally-uplink/probe-cubs-iteration.sh → PROBE cubs-iteration: PASS (SIGTERM → rc 143 in 137 ms with Pi mid-run).
• bash tests/tally-uplink/probe-FT-3-kit.sh → K1–K6 green; K7 red only because nix flake check --offline --no-build is red on the untouched main checkout today with the same source.drv error (pre-existing, not this change).
• one real run of the built executable under env -i on a scratch repo against live Halogen with a campaign-private models.json (thinkingFormat qwen, supportsReasoningEffort true), --thinking low: pass first try, 17 s, 4 tool calls, prompt 12337 / completion 405 / reasoning 74 tokens, commit on the task branch, receipt + usage line written. First Pi-with-tools run against Halogen recorded on this box; a smoke, not a capability claim.

The three orchestrator defaults (Tom may flip any)

1. cards say executor: review so the deployed floor lands the items on gpu-worker without a redeploy;
2. envelope-pass semantics: with no evaluator lock the lake closes every finished item pass; the proof is the commit + receipt.json + usage line;
3. --level 1 (cap 1, strictly serial).

The two operator acts left to Tom

1. the coordinator switch, so the kit is live before the first proposal (an unresolvable argv_ref is a KitError);
2. the non-dry tally-plan-arm … --level 1 with LAKE_TOKEN from ~/.local/state/tally-rewrite/lake-token in the shell. services.tally-uplink.plan stays null.

Deviations from the brief: the receipt follows the campaign repo's tools/receipt.schema.json (is_error_count, worktree_branch, sha256: digests, observed_failure_mode reserved for the review, the executable's mechanical reading in notes) plus execution_id and exit_code; the kit carries pkgs.llm-agents.pi rather than pi.nix's wrapper (empty roster, --no-extensions; DF-CUBS-5); a worklist line's setup_cmd and relative bundle_path are honoured because day-01.jsonl uses them.

🤖 Generated with Claude Code