Conversation
added 3 commits
August 20, 2026 17:34
The owner gave a direction on 2026-08-20 with a standing trigger, so it gets a row rather than a mention: development material and roadmap material are stored in the PRIVATE organisation repository, `test1card/cryodaq-workspace`. Measured the same day, `test1card/cryodaq` is public and that workspace is private. THE FIRST CONDITION HAD ALREADY FAILED SILENTLY. "Stored there" is two claims, not one -- written there, and PUSHED there -- and only the first was true. The private layer stood 55 commits ahead of its remote, so the state, the traps, the coordinator brief and the evidence tools the owner asked to be kept in that repository existed on one machine only. That is the same failure shape as OB-011, and it recurred, which is why the row states the push as a check of its own instead of assuming it. WHAT THIS ROW DELIBERATELY DOES NOT DECIDE. Whether the public ROADMAP.md is removed from the public tree is left open, and the reason is measured rather than cautious: that file is referenced by 34 records in governance/agent_preventions.yaml and by three test modules, so removing it is a large governance change with no laboratory-week value -- and what a public repository publishes is an outward-facing decision that belongs to the owner. What is being done instead is narrower and already in flight: the development detail that had accumulated in that public file -- a person's travel dates, machine-specific outage history and campaign measurements -- is moved out through PR #84. Documentation only. The docs gate is green at 68 passed.
The row prohibits restating private-layer detail in the public register, and it was doing exactly that: the commit range and the push identifiers of the private layer. They live in that layer's own state file now, and the row points at it.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 574d819dc9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | OB-012 | 2026-08-10 | Owner direction, verbatim: "make it necessary, write all project documentation using this skill … this is absolutely non negotiable", then "we need to put it on the roadmap to rewrite all current docs using this skill" | All new and changed English project documentation follows ASD-STE100 via the skill at `docs/skills/asd-ste100/`. Scope: binds the client-facing English surface, agent-layer governed files, and new register rows; exempt are Russian-language text, verbatim quotes, immutable evidence/archives, and changelog history (full scope decision recorded in the out-of-tree layer ruleset). The retrofit of existing documents is the "Documentation track — ASD-STE100 conversion" entry in `ROADMAP.md`; that entry and this row reference each other. The skill ships no checker, so until a heuristic checker lands with the OB-010 guard package, conformance is writer discipline plus review — the trigger below fires on every edit to the governed surface because the writer of that edit is the enforcement point. A link from AGENTS.md to the skill is part of this row but waits for PR #20 to merge (it holds AGENTS.md). | manual:every edit to governed English documentation | IN-PROGRESS | Skill installed and ROADMAP track added in this PR; retrofit slices pending. | | ||
| | OB-013 | 2026-08-10 | Phase-1 recon (read-only lane report, retained as lane evidence in the out-of-tree layer; two findings coordinator-verified) | Reconcile Phase-1 (H3/H4) claims with measured reality in a dedicated register-truth/evidence PR: (a) the WHOLE-STACK soak driver defines 12h/72h profiles but refuses every profile except short. **CORRECTED, measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: the two refusals do NOT share an exit code.** A long profile prints an explicit reason to stderr and returns **3**. The platform refusal (`_RunnerActivationDisabled`) returns **2** and is silent. The driver therefore does not conflate the two and does not hide the stop. The residual is only that the long soak stays unreachable through the whole-stack path, which the driver states out loud — the separate engine-only soak driver accepts an arbitrary duration and IS reachable, so the finding is scoped to the whole-stack driver only, and the resource-growth bounds carried only by its long profiles; (b) measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: no current-SHA soak, full-suite, or hosted ONEDIR receipt exists in THAT tree, and the historical suite `PROJECT_STATUS.md` cites ran at commit `026bf50b158f019953e3667026bc35b7fe935330` (retrievable: contained by `origin/feat/montana-phase-a` and `origin/review/montana-cli-corrections-staging`; the hash alone is not enough in a clone that fetches only master and the PR ref), which is NOT an ancestor of that commit (coordinator-verified with `git merge-base --is-ancestor`) — the same staleness class this register exists for; (c) **STANDS. My first correction of it was WRONG and is retracted here.** I wrote that no second live reporter exists. Measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: `PERIODIC_REPORTER_FACILITIES` (`src/cryodaq/agents/assistant_bootstrap.py:59-72`) declares **TWO LIVE facilities** — `PeriodicPngSupervisor` (`png_artifact`, `cross_process_single_owner=True`) and `assistant_main._periodic_report_tick` (`llm_narrative_text`, `assistant_process_local`, **`cross_process_single_owner=False`**), which `assistant_main.py:988` starts as a task. Its guard is named `test_periodic_reporter_inventory_binds_the_two_real_facilities`. `RETIRED_PERIODIC_REPORTER_SYMBOLS` is a SEPARATE tuple naming only the legacy `notifications.periodic_report.PeriodicReporter`, dead code tracked as OC-026b. **Retiring that module does not make the LLM tick dead, and conflating the two produced the wrong correction.** So the original finding holds: scope the single-owner phrase to PNG, because the LLM facility itself declares single-owner false. **Do NOT delete the soak profile guard: it is a deliberate stop with a stated reason.** | manual:coordinator schedules the register-truth PR | IN-PROGRESS | This PR. Corrections (a) and (c) above are made in the same change, because a register that carries a wrong “(verified)” is the exact failure it exists to prevent. | | ||
| | OB-014 | 2026-08-11 | Independent review of the OB-013 pull request | **Prevention dispositions for evidence failures in this register.** The number-one operating rule applies. A confirmed agent mistake must harden the governing layer. A completion disposition must not close while its prevention stays open. Six mistakes were confirmed while correcting OB-013. Each one is a claim that its evidence does not support. **(1)** A live facility was read as retired. The correction then removed a true finding. **(2)** Measurements were bound to the moving ref `origin/master`. A later reader cannot reproduce them. **(3)** A row moved to `DONE` on an identifier that does not resolve in a fresh clone. **(4)** A row moved to `DONE` because an artifact exists, where the trigger required an authorisation or an ordering condition. **(5)** A row count was measured on the default branch. It was then briefed to a worker as the invariant for the branch under review. The branch held a different count. The worker measured the branch, contradicted the brief, and was correct. **(6)** A per-commit question was answered with a final-tip diff. A zero-deletion result between two endpoints was read as establishing that no commit in the range deleted the file, which it cannot do. The delete-then-restore sequence that demonstrates the gap was raised as a counterexample and was never observed, so the mistake is the method, not the sequence. **Proposed rules. They are reported, not applied, because a policy edit is outside this pull request:** **(a)** Bind a measurement to an immutable commit id. A branch name, `HEAD` or `origin/master` is not a binding. **(b)** For every evidence identifier, verify retrievability in a fresh clone, regardless of cell or status. Move a row to `DONE` only when every identifier in its Discharge cell resolves. Name a containing ref when the object is not on the default branch. **(c)** Quote the authorisation when the trigger needs one. An artifact that exists is not permission to create it. A later merge does not discharge an ordering condition. For `manual:` ordering triggers, record an exact human gate. The gate names its inputs, decision owner, required evidence, and fail-closed outcome. For OB-004, inputs are queue state and publication time. The coordinator is the decision owner. Required evidence is a timestamped queue-empty record before publication. If evidence is absent, retain `PENDING` and treat ordering as unverified. **(d)** Support a claim that a component is retired, dead or absent with the inventory that would list it if it were live. Show it is not in that inventory. **Bind the evidence to the facility under review: quote the identifier the reviewed claim names, and show THAT identifier against its exact inventory entry.** An absence shown for a similarly named symbol proves nothing about the facility in the claim. **This rule covers mistake (1), which rules (a) to (c) cannot catch: the inventory test was already green when the mistake happened, and the retired `PeriodicReporter` could be substituted for the live `_periodic_report_tick` while every stated condition still read as satisfied.** **(e)** Before claiming zero deletions, inspect every commit in the compared range. Record per-commit deletion results. A final-tip diff does not test intermediate deletion and restoration. **This rule covers mistake (6): answering a per-commit question with a final-tip diff.** A delete-then-restore sequence remains HYPOTHETICAL: it was raised as the counterexample that shows why the final-tip result is insufficient, and no per-commit evidence establishes that it occurred. Do not record it as observed unless retrievable per-commit evidence proves it. **(f)** Measure an invariant on the exact candidate tree under review. Record the candidate immutable tree or commit and the immutable tree or commit actually measured, and require them to be equal; naming a ref alone is not sufficient. A count taken from the default branch does not bind a branch that adds or removes rows. **This rule covers mistake (5). Rules (a) to (e) cannot catch it, because the measurement was correct about the ref it named and wrong about the ref it was used for.** The structural portions of each rule are mechanically checkable in the OB-010 guard package. Rule (c) authorization and ordering decision remains a fail-closed human gate requiring its named inputs, decision owner, required evidence, and outcome. | manual:coordinator lands the OB-010 guard package | PENDING | — | | ||
| | OB-015 | 2026-08-20 | Owner direction, verbatim: *"cryodaq-workspace это частная орг репа. она приватная, и все нужно хранить там что касается разработки, дорожной карты"* | **Development material and roadmap material are stored in the PRIVATE organisation repository `test1card/cryodaq-workspace`.** Measured 2026-08-20: `test1card/cryodaq` is PUBLIC and `test1card/cryodaq-workspace` is PRIVATE. So development state — measurements, machine paths, campaign and lane progress, worker records, schedules, and the forward development plan — belongs in the private layer, and the public repository keeps the product-facing plan and this register. Other documents may reference a private plan by its identifier; they must not restate its detail. **Two conditions hold this, and BOTH must be checked, because the first one failed silently once already:** (a) the private layer is actually PUSHED, not merely committed on one machine; (b) new development detail is written there rather than into the public tree. | manual:any turn that writes development or roadmap material | IN-PROGRESS | **Condition (a) was measured false on 2026-08-20 and repaired the same day.** `main` in the private layer stood 55 commits ahead of `origin/main`, so the material the owner asked to be stored there existed on a single machine; it was pushed as `812e613..f404c8e`. This is the same failure shape as OB-011 and it recurred, which is why condition (a) is written as a separate check rather than assumed. Condition (b) is continuous and has no end state. **Whether the public `ROADMAP.md` is REMOVED from the public tree is deliberately NOT decided here.** Measured on `origin/master` 2026-08-20, that file is referenced by 34 records in `governance/agent_preventions.yaml` and by three test modules, so removing it is a large governance change that does nothing for the laboratory week — and what a public repository publishes is an outward-facing decision that belongs to the owner, not a mechanism decision. What IS done here: the development detail that had accumulated in that file — a person's travel dates, machine-specific outage history, and campaign measurements — is being moved out through PR #84. | |
There was a problem hiding this comment.
When this row is used to scope removal of ROADMAP.md, the stated “34 records” overcounts the affected prevention records: parsing the records list gives 33 distinct entries, because MONTANA-INTEGRATION-SEQUENCE-001 contains two ROADMAP.md references and thus produces 34 textual references. Say “34 references” or “33 records” so the obligations register does not preserve a false measured count.
Useful? React with 👍 / 👎.
| | OB-012 | 2026-08-10 | Owner direction, verbatim: "make it necessary, write all project documentation using this skill … this is absolutely non negotiable", then "we need to put it on the roadmap to rewrite all current docs using this skill" | All new and changed English project documentation follows ASD-STE100 via the skill at `docs/skills/asd-ste100/`. Scope: binds the client-facing English surface, agent-layer governed files, and new register rows; exempt are Russian-language text, verbatim quotes, immutable evidence/archives, and changelog history (full scope decision recorded in the out-of-tree layer ruleset). The retrofit of existing documents is the "Documentation track — ASD-STE100 conversion" entry in `ROADMAP.md`; that entry and this row reference each other. The skill ships no checker, so until a heuristic checker lands with the OB-010 guard package, conformance is writer discipline plus review — the trigger below fires on every edit to the governed surface because the writer of that edit is the enforcement point. A link from AGENTS.md to the skill is part of this row but waits for PR #20 to merge (it holds AGENTS.md). | manual:every edit to governed English documentation | IN-PROGRESS | Skill installed and ROADMAP track added in this PR; retrofit slices pending. | | ||
| | OB-013 | 2026-08-10 | Phase-1 recon (read-only lane report, retained as lane evidence in the out-of-tree layer; two findings coordinator-verified) | Reconcile Phase-1 (H3/H4) claims with measured reality in a dedicated register-truth/evidence PR: (a) the WHOLE-STACK soak driver defines 12h/72h profiles but refuses every profile except short. **CORRECTED, measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: the two refusals do NOT share an exit code.** A long profile prints an explicit reason to stderr and returns **3**. The platform refusal (`_RunnerActivationDisabled`) returns **2** and is silent. The driver therefore does not conflate the two and does not hide the stop. The residual is only that the long soak stays unreachable through the whole-stack path, which the driver states out loud — the separate engine-only soak driver accepts an arbitrary duration and IS reachable, so the finding is scoped to the whole-stack driver only, and the resource-growth bounds carried only by its long profiles; (b) measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: no current-SHA soak, full-suite, or hosted ONEDIR receipt exists in THAT tree, and the historical suite `PROJECT_STATUS.md` cites ran at commit `026bf50b158f019953e3667026bc35b7fe935330` (retrievable: contained by `origin/feat/montana-phase-a` and `origin/review/montana-cli-corrections-staging`; the hash alone is not enough in a clone that fetches only master and the PR ref), which is NOT an ancestor of that commit (coordinator-verified with `git merge-base --is-ancestor`) — the same staleness class this register exists for; (c) **STANDS. My first correction of it was WRONG and is retracted here.** I wrote that no second live reporter exists. Measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: `PERIODIC_REPORTER_FACILITIES` (`src/cryodaq/agents/assistant_bootstrap.py:59-72`) declares **TWO LIVE facilities** — `PeriodicPngSupervisor` (`png_artifact`, `cross_process_single_owner=True`) and `assistant_main._periodic_report_tick` (`llm_narrative_text`, `assistant_process_local`, **`cross_process_single_owner=False`**), which `assistant_main.py:988` starts as a task. Its guard is named `test_periodic_reporter_inventory_binds_the_two_real_facilities`. `RETIRED_PERIODIC_REPORTER_SYMBOLS` is a SEPARATE tuple naming only the legacy `notifications.periodic_report.PeriodicReporter`, dead code tracked as OC-026b. **Retiring that module does not make the LLM tick dead, and conflating the two produced the wrong correction.** So the original finding holds: scope the single-owner phrase to PNG, because the LLM facility itself declares single-owner false. **Do NOT delete the soak profile guard: it is a deliberate stop with a stated reason.** | manual:coordinator schedules the register-truth PR | IN-PROGRESS | This PR. Corrections (a) and (c) above are made in the same change, because a register that carries a wrong “(verified)” is the exact failure it exists to prevent. | | ||
| | OB-014 | 2026-08-11 | Independent review of the OB-013 pull request | **Prevention dispositions for evidence failures in this register.** The number-one operating rule applies. A confirmed agent mistake must harden the governing layer. A completion disposition must not close while its prevention stays open. Six mistakes were confirmed while correcting OB-013. Each one is a claim that its evidence does not support. **(1)** A live facility was read as retired. The correction then removed a true finding. **(2)** Measurements were bound to the moving ref `origin/master`. A later reader cannot reproduce them. **(3)** A row moved to `DONE` on an identifier that does not resolve in a fresh clone. **(4)** A row moved to `DONE` because an artifact exists, where the trigger required an authorisation or an ordering condition. **(5)** A row count was measured on the default branch. It was then briefed to a worker as the invariant for the branch under review. The branch held a different count. The worker measured the branch, contradicted the brief, and was correct. **(6)** A per-commit question was answered with a final-tip diff. A zero-deletion result between two endpoints was read as establishing that no commit in the range deleted the file, which it cannot do. The delete-then-restore sequence that demonstrates the gap was raised as a counterexample and was never observed, so the mistake is the method, not the sequence. **Proposed rules. They are reported, not applied, because a policy edit is outside this pull request:** **(a)** Bind a measurement to an immutable commit id. A branch name, `HEAD` or `origin/master` is not a binding. **(b)** For every evidence identifier, verify retrievability in a fresh clone, regardless of cell or status. Move a row to `DONE` only when every identifier in its Discharge cell resolves. Name a containing ref when the object is not on the default branch. **(c)** Quote the authorisation when the trigger needs one. An artifact that exists is not permission to create it. A later merge does not discharge an ordering condition. For `manual:` ordering triggers, record an exact human gate. The gate names its inputs, decision owner, required evidence, and fail-closed outcome. For OB-004, inputs are queue state and publication time. The coordinator is the decision owner. Required evidence is a timestamped queue-empty record before publication. If evidence is absent, retain `PENDING` and treat ordering as unverified. **(d)** Support a claim that a component is retired, dead or absent with the inventory that would list it if it were live. Show it is not in that inventory. **Bind the evidence to the facility under review: quote the identifier the reviewed claim names, and show THAT identifier against its exact inventory entry.** An absence shown for a similarly named symbol proves nothing about the facility in the claim. **This rule covers mistake (1), which rules (a) to (c) cannot catch: the inventory test was already green when the mistake happened, and the retired `PeriodicReporter` could be substituted for the live `_periodic_report_tick` while every stated condition still read as satisfied.** **(e)** Before claiming zero deletions, inspect every commit in the compared range. Record per-commit deletion results. A final-tip diff does not test intermediate deletion and restoration. **This rule covers mistake (6): answering a per-commit question with a final-tip diff.** A delete-then-restore sequence remains HYPOTHETICAL: it was raised as the counterexample that shows why the final-tip result is insufficient, and no per-commit evidence establishes that it occurred. Do not record it as observed unless retrievable per-commit evidence proves it. **(f)** Measure an invariant on the exact candidate tree under review. Record the candidate immutable tree or commit and the immutable tree or commit actually measured, and require them to be equal; naming a ref alone is not sufficient. A count taken from the default branch does not bind a branch that adds or removes rows. **This rule covers mistake (5). Rules (a) to (e) cannot catch it, because the measurement was correct about the ref it named and wrong about the ref it was used for.** The structural portions of each rule are mechanically checkable in the OB-010 guard package. Rule (c) authorization and ordering decision remains a fail-closed human gate requiring its named inputs, decision owner, required evidence, and outcome. | manual:coordinator lands the OB-010 guard package | PENDING | — | | ||
| | OB-015 | 2026-08-20 | Owner direction, verbatim: *"cryodaq-workspace это частная орг репа. она приватная, и все нужно хранить там что касается разработки, дорожной карты"* | **Development material and roadmap material are stored in the PRIVATE organisation repository `test1card/cryodaq-workspace`.** Measured 2026-08-20: `test1card/cryodaq` is PUBLIC and `test1card/cryodaq-workspace` is PRIVATE. So development state — measurements, machine paths, campaign and lane progress, worker records, schedules, and the forward development plan — belongs in the private layer, and the public repository keeps the product-facing plan and this register. Other documents may reference a private plan by its identifier; they must not restate its detail. **Two conditions hold this, and BOTH must be checked, because the first one failed silently once already:** (a) the private layer is actually PUSHED, not merely committed on one machine; (b) new development detail is written there rather than into the public tree. | manual:any turn that writes development or roadmap material | IN-PROGRESS | **Condition (a) was measured false on 2026-08-20 and repaired the same day.** `main` in the private layer stood 55 commits ahead of `origin/main`, so the material the owner asked to be stored there existed on a single machine; it was pushed as `812e613..f404c8e`. This is the same failure shape as OB-011 and it recurred, which is why condition (a) is written as a separate check rather than assumed. Condition (b) is continuous and has no end state. **Whether the public `ROADMAP.md` is REMOVED from the public tree is deliberately NOT decided here.** Measured on `origin/master` 2026-08-20, that file is referenced by 34 records in `governance/agent_preventions.yaml` and by three test modules, so removing it is a large governance change that does nothing for the laboratory week — and what a public repository publishes is an outward-facing decision that belongs to the owner, not a mechanism decision. What IS done here: the development detail that had accumulated in that file — a person's travel dates, machine-specific outage history, and campaign measurements — is being moved out through PR #84. | |
There was a problem hiding this comment.
When origin/master advances, readers cannot reproduce which tree produced the 34-reference and three-module measurements, reintroducing the evidence-misbinding failure described by OB-014. Record the measured commit/tree and exact command, rather than only the moving ref and date; tracked count claims must bind an immutable object.
AGENTS.md reference: AGENTS.md:L445-L450
Useful? React with 👍 / 👎.
| | OB-012 | 2026-08-10 | Owner direction, verbatim: "make it necessary, write all project documentation using this skill … this is absolutely non negotiable", then "we need to put it on the roadmap to rewrite all current docs using this skill" | All new and changed English project documentation follows ASD-STE100 via the skill at `docs/skills/asd-ste100/`. Scope: binds the client-facing English surface, agent-layer governed files, and new register rows; exempt are Russian-language text, verbatim quotes, immutable evidence/archives, and changelog history (full scope decision recorded in the out-of-tree layer ruleset). The retrofit of existing documents is the "Documentation track — ASD-STE100 conversion" entry in `ROADMAP.md`; that entry and this row reference each other. The skill ships no checker, so until a heuristic checker lands with the OB-010 guard package, conformance is writer discipline plus review — the trigger below fires on every edit to the governed surface because the writer of that edit is the enforcement point. A link from AGENTS.md to the skill is part of this row but waits for PR #20 to merge (it holds AGENTS.md). | manual:every edit to governed English documentation | IN-PROGRESS | Skill installed and ROADMAP track added in this PR; retrofit slices pending. | | ||
| | OB-013 | 2026-08-10 | Phase-1 recon (read-only lane report, retained as lane evidence in the out-of-tree layer; two findings coordinator-verified) | Reconcile Phase-1 (H3/H4) claims with measured reality in a dedicated register-truth/evidence PR: (a) the WHOLE-STACK soak driver defines 12h/72h profiles but refuses every profile except short. **CORRECTED, measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: the two refusals do NOT share an exit code.** A long profile prints an explicit reason to stderr and returns **3**. The platform refusal (`_RunnerActivationDisabled`) returns **2** and is silent. The driver therefore does not conflate the two and does not hide the stop. The residual is only that the long soak stays unreachable through the whole-stack path, which the driver states out loud — the separate engine-only soak driver accepts an arbitrary duration and IS reachable, so the finding is scoped to the whole-stack driver only, and the resource-growth bounds carried only by its long profiles; (b) measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: no current-SHA soak, full-suite, or hosted ONEDIR receipt exists in THAT tree, and the historical suite `PROJECT_STATUS.md` cites ran at commit `026bf50b158f019953e3667026bc35b7fe935330` (retrievable: contained by `origin/feat/montana-phase-a` and `origin/review/montana-cli-corrections-staging`; the hash alone is not enough in a clone that fetches only master and the PR ref), which is NOT an ancestor of that commit (coordinator-verified with `git merge-base --is-ancestor`) — the same staleness class this register exists for; (c) **STANDS. My first correction of it was WRONG and is retracted here.** I wrote that no second live reporter exists. Measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: `PERIODIC_REPORTER_FACILITIES` (`src/cryodaq/agents/assistant_bootstrap.py:59-72`) declares **TWO LIVE facilities** — `PeriodicPngSupervisor` (`png_artifact`, `cross_process_single_owner=True`) and `assistant_main._periodic_report_tick` (`llm_narrative_text`, `assistant_process_local`, **`cross_process_single_owner=False`**), which `assistant_main.py:988` starts as a task. Its guard is named `test_periodic_reporter_inventory_binds_the_two_real_facilities`. `RETIRED_PERIODIC_REPORTER_SYMBOLS` is a SEPARATE tuple naming only the legacy `notifications.periodic_report.PeriodicReporter`, dead code tracked as OC-026b. **Retiring that module does not make the LLM tick dead, and conflating the two produced the wrong correction.** So the original finding holds: scope the single-owner phrase to PNG, because the LLM facility itself declares single-owner false. **Do NOT delete the soak profile guard: it is a deliberate stop with a stated reason.** | manual:coordinator schedules the register-truth PR | IN-PROGRESS | This PR. Corrections (a) and (c) above are made in the same change, because a register that carries a wrong “(verified)” is the exact failure it exists to prevent. | | ||
| | OB-014 | 2026-08-11 | Independent review of the OB-013 pull request | **Prevention dispositions for evidence failures in this register.** The number-one operating rule applies. A confirmed agent mistake must harden the governing layer. A completion disposition must not close while its prevention stays open. Six mistakes were confirmed while correcting OB-013. Each one is a claim that its evidence does not support. **(1)** A live facility was read as retired. The correction then removed a true finding. **(2)** Measurements were bound to the moving ref `origin/master`. A later reader cannot reproduce them. **(3)** A row moved to `DONE` on an identifier that does not resolve in a fresh clone. **(4)** A row moved to `DONE` because an artifact exists, where the trigger required an authorisation or an ordering condition. **(5)** A row count was measured on the default branch. It was then briefed to a worker as the invariant for the branch under review. The branch held a different count. The worker measured the branch, contradicted the brief, and was correct. **(6)** A per-commit question was answered with a final-tip diff. A zero-deletion result between two endpoints was read as establishing that no commit in the range deleted the file, which it cannot do. The delete-then-restore sequence that demonstrates the gap was raised as a counterexample and was never observed, so the mistake is the method, not the sequence. **Proposed rules. They are reported, not applied, because a policy edit is outside this pull request:** **(a)** Bind a measurement to an immutable commit id. A branch name, `HEAD` or `origin/master` is not a binding. **(b)** For every evidence identifier, verify retrievability in a fresh clone, regardless of cell or status. Move a row to `DONE` only when every identifier in its Discharge cell resolves. Name a containing ref when the object is not on the default branch. **(c)** Quote the authorisation when the trigger needs one. An artifact that exists is not permission to create it. A later merge does not discharge an ordering condition. For `manual:` ordering triggers, record an exact human gate. The gate names its inputs, decision owner, required evidence, and fail-closed outcome. For OB-004, inputs are queue state and publication time. The coordinator is the decision owner. Required evidence is a timestamped queue-empty record before publication. If evidence is absent, retain `PENDING` and treat ordering as unverified. **(d)** Support a claim that a component is retired, dead or absent with the inventory that would list it if it were live. Show it is not in that inventory. **Bind the evidence to the facility under review: quote the identifier the reviewed claim names, and show THAT identifier against its exact inventory entry.** An absence shown for a similarly named symbol proves nothing about the facility in the claim. **This rule covers mistake (1), which rules (a) to (c) cannot catch: the inventory test was already green when the mistake happened, and the retired `PeriodicReporter` could be substituted for the live `_periodic_report_tick` while every stated condition still read as satisfied.** **(e)** Before claiming zero deletions, inspect every commit in the compared range. Record per-commit deletion results. A final-tip diff does not test intermediate deletion and restoration. **This rule covers mistake (6): answering a per-commit question with a final-tip diff.** A delete-then-restore sequence remains HYPOTHETICAL: it was raised as the counterexample that shows why the final-tip result is insufficient, and no per-commit evidence establishes that it occurred. Do not record it as observed unless retrievable per-commit evidence proves it. **(f)** Measure an invariant on the exact candidate tree under review. Record the candidate immutable tree or commit and the immutable tree or commit actually measured, and require them to be equal; naming a ref alone is not sufficient. A count taken from the default branch does not bind a branch that adds or removes rows. **This rule covers mistake (5). Rules (a) to (e) cannot catch it, because the measurement was correct about the ref it named and wrong about the ref it was used for.** The structural portions of each rule are mechanically checkable in the OB-010 guard package. Rule (c) authorization and ordering decision remains a fail-closed human gate requiring its named inputs, decision owner, required evidence, and outcome. | manual:coordinator lands the OB-010 guard package | PENDING | — | | ||
| | OB-015 | 2026-08-20 | Owner direction, verbatim: *"cryodaq-workspace это частная орг репа. она приватная, и все нужно хранить там что касается разработки, дорожной карты"* | **Development material and roadmap material are stored in the PRIVATE organisation repository `test1card/cryodaq-workspace`.** Measured 2026-08-20: `test1card/cryodaq` is PUBLIC and `test1card/cryodaq-workspace` is PRIVATE. So development state — measurements, machine paths, campaign and lane progress, worker records, schedules, and the forward development plan — belongs in the private layer, and the public repository keeps the product-facing plan and this register. Other documents may reference a private plan by its identifier; they must not restate its detail. **Two conditions hold this, and BOTH must be checked, because the first one failed silently once already:** (a) the private layer is actually PUSHED, not merely committed on one machine; (b) new development detail is written there rather than into the public tree. | manual:any turn that writes development or roadmap material | IN-PROGRESS | **Condition (a) was measured false on 2026-08-20 and repaired the same day.** `main` in the private layer stood 55 commits ahead of `origin/main`, so the material the owner asked to be stored there existed on a single machine; it was pushed as `812e613..f404c8e`. This is the same failure shape as OB-011 and it recurred, which is why condition (a) is written as a separate check rather than assumed. Condition (b) is continuous and has no end state. **Whether the public `ROADMAP.md` is REMOVED from the public tree is deliberately NOT decided here.** Measured on `origin/master` 2026-08-20, that file is referenced by 34 records in `governance/agent_preventions.yaml` and by three test modules, so removing it is a large governance change that does nothing for the laboratory week — and what a public repository publishes is an outward-facing decision that belongs to the owner, not a mechanism decision. What IS done here: the development detail that had accumulated in that file — a person's travel dates, machine-specific outage history, and campaign measurements — is being moved out through PR #84. | |
There was a problem hiding this comment.
The row classifies measurements and campaign progress as private development material, but its public discharge cell publishes exactly that material: the private branch's 55-commit lag, its push range, and the PR #84 migration status. Merging therefore violates condition (b) in the same row; retain only the obligation and an opaque private evidence identifier here, and keep the operational evidence in the private workspace.
AGENTS.md reference: AGENTS.md:L544-L549
Useful? React with 👍 / 👎.
| | OB-012 | 2026-08-10 | Owner direction, verbatim: "make it necessary, write all project documentation using this skill … this is absolutely non negotiable", then "we need to put it on the roadmap to rewrite all current docs using this skill" | All new and changed English project documentation follows ASD-STE100 via the skill at `docs/skills/asd-ste100/`. Scope: binds the client-facing English surface, agent-layer governed files, and new register rows; exempt are Russian-language text, verbatim quotes, immutable evidence/archives, and changelog history (full scope decision recorded in the out-of-tree layer ruleset). The retrofit of existing documents is the "Documentation track — ASD-STE100 conversion" entry in `ROADMAP.md`; that entry and this row reference each other. The skill ships no checker, so until a heuristic checker lands with the OB-010 guard package, conformance is writer discipline plus review — the trigger below fires on every edit to the governed surface because the writer of that edit is the enforcement point. A link from AGENTS.md to the skill is part of this row but waits for PR #20 to merge (it holds AGENTS.md). | manual:every edit to governed English documentation | IN-PROGRESS | Skill installed and ROADMAP track added in this PR; retrofit slices pending. | | ||
| | OB-013 | 2026-08-10 | Phase-1 recon (read-only lane report, retained as lane evidence in the out-of-tree layer; two findings coordinator-verified) | Reconcile Phase-1 (H3/H4) claims with measured reality in a dedicated register-truth/evidence PR: (a) the WHOLE-STACK soak driver defines 12h/72h profiles but refuses every profile except short. **CORRECTED, measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: the two refusals do NOT share an exit code.** A long profile prints an explicit reason to stderr and returns **3**. The platform refusal (`_RunnerActivationDisabled`) returns **2** and is silent. The driver therefore does not conflate the two and does not hide the stop. The residual is only that the long soak stays unreachable through the whole-stack path, which the driver states out loud — the separate engine-only soak driver accepts an arbitrary duration and IS reachable, so the finding is scoped to the whole-stack driver only, and the resource-growth bounds carried only by its long profiles; (b) measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: no current-SHA soak, full-suite, or hosted ONEDIR receipt exists in THAT tree, and the historical suite `PROJECT_STATUS.md` cites ran at commit `026bf50b158f019953e3667026bc35b7fe935330` (retrievable: contained by `origin/feat/montana-phase-a` and `origin/review/montana-cli-corrections-staging`; the hash alone is not enough in a clone that fetches only master and the PR ref), which is NOT an ancestor of that commit (coordinator-verified with `git merge-base --is-ancestor`) — the same staleness class this register exists for; (c) **STANDS. My first correction of it was WRONG and is retracted here.** I wrote that no second live reporter exists. Measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: `PERIODIC_REPORTER_FACILITIES` (`src/cryodaq/agents/assistant_bootstrap.py:59-72`) declares **TWO LIVE facilities** — `PeriodicPngSupervisor` (`png_artifact`, `cross_process_single_owner=True`) and `assistant_main._periodic_report_tick` (`llm_narrative_text`, `assistant_process_local`, **`cross_process_single_owner=False`**), which `assistant_main.py:988` starts as a task. Its guard is named `test_periodic_reporter_inventory_binds_the_two_real_facilities`. `RETIRED_PERIODIC_REPORTER_SYMBOLS` is a SEPARATE tuple naming only the legacy `notifications.periodic_report.PeriodicReporter`, dead code tracked as OC-026b. **Retiring that module does not make the LLM tick dead, and conflating the two produced the wrong correction.** So the original finding holds: scope the single-owner phrase to PNG, because the LLM facility itself declares single-owner false. **Do NOT delete the soak profile guard: it is a deliberate stop with a stated reason.** | manual:coordinator schedules the register-truth PR | IN-PROGRESS | This PR. Corrections (a) and (c) above are made in the same change, because a register that carries a wrong “(verified)” is the exact failure it exists to prevent. | | ||
| | OB-014 | 2026-08-11 | Independent review of the OB-013 pull request | **Prevention dispositions for evidence failures in this register.** The number-one operating rule applies. A confirmed agent mistake must harden the governing layer. A completion disposition must not close while its prevention stays open. Six mistakes were confirmed while correcting OB-013. Each one is a claim that its evidence does not support. **(1)** A live facility was read as retired. The correction then removed a true finding. **(2)** Measurements were bound to the moving ref `origin/master`. A later reader cannot reproduce them. **(3)** A row moved to `DONE` on an identifier that does not resolve in a fresh clone. **(4)** A row moved to `DONE` because an artifact exists, where the trigger required an authorisation or an ordering condition. **(5)** A row count was measured on the default branch. It was then briefed to a worker as the invariant for the branch under review. The branch held a different count. The worker measured the branch, contradicted the brief, and was correct. **(6)** A per-commit question was answered with a final-tip diff. A zero-deletion result between two endpoints was read as establishing that no commit in the range deleted the file, which it cannot do. The delete-then-restore sequence that demonstrates the gap was raised as a counterexample and was never observed, so the mistake is the method, not the sequence. **Proposed rules. They are reported, not applied, because a policy edit is outside this pull request:** **(a)** Bind a measurement to an immutable commit id. A branch name, `HEAD` or `origin/master` is not a binding. **(b)** For every evidence identifier, verify retrievability in a fresh clone, regardless of cell or status. Move a row to `DONE` only when every identifier in its Discharge cell resolves. Name a containing ref when the object is not on the default branch. **(c)** Quote the authorisation when the trigger needs one. An artifact that exists is not permission to create it. A later merge does not discharge an ordering condition. For `manual:` ordering triggers, record an exact human gate. The gate names its inputs, decision owner, required evidence, and fail-closed outcome. For OB-004, inputs are queue state and publication time. The coordinator is the decision owner. Required evidence is a timestamped queue-empty record before publication. If evidence is absent, retain `PENDING` and treat ordering as unverified. **(d)** Support a claim that a component is retired, dead or absent with the inventory that would list it if it were live. Show it is not in that inventory. **Bind the evidence to the facility under review: quote the identifier the reviewed claim names, and show THAT identifier against its exact inventory entry.** An absence shown for a similarly named symbol proves nothing about the facility in the claim. **This rule covers mistake (1), which rules (a) to (c) cannot catch: the inventory test was already green when the mistake happened, and the retired `PeriodicReporter` could be substituted for the live `_periodic_report_tick` while every stated condition still read as satisfied.** **(e)** Before claiming zero deletions, inspect every commit in the compared range. Record per-commit deletion results. A final-tip diff does not test intermediate deletion and restoration. **This rule covers mistake (6): answering a per-commit question with a final-tip diff.** A delete-then-restore sequence remains HYPOTHETICAL: it was raised as the counterexample that shows why the final-tip result is insufficient, and no per-commit evidence establishes that it occurred. Do not record it as observed unless retrievable per-commit evidence proves it. **(f)** Measure an invariant on the exact candidate tree under review. Record the candidate immutable tree or commit and the immutable tree or commit actually measured, and require them to be equal; naming a ref alone is not sufficient. A count taken from the default branch does not bind a branch that adds or removes rows. **This rule covers mistake (5). Rules (a) to (e) cannot catch it, because the measurement was correct about the ref it named and wrong about the ref it was used for.** The structural portions of each rule are mechanically checkable in the OB-010 guard package. Rule (c) authorization and ordering decision remains a fail-closed human gate requiring its named inputs, decision owner, required evidence, and outcome. | manual:coordinator lands the OB-010 guard package | PENDING | — | | ||
| | OB-015 | 2026-08-20 | Owner direction, verbatim: *"cryodaq-workspace это частная орг репа. она приватная, и все нужно хранить там что касается разработки, дорожной карты"* | **Development material and roadmap material are stored in the PRIVATE organisation repository `test1card/cryodaq-workspace`.** Measured 2026-08-20: `test1card/cryodaq` is PUBLIC and `test1card/cryodaq-workspace` is PRIVATE. So development state — measurements, machine paths, campaign and lane progress, worker records, schedules, and the forward development plan — belongs in the private layer, and the public repository keeps the product-facing plan and this register. Other documents may reference a private plan by its identifier; they must not restate its detail. **Two conditions hold this, and BOTH must be checked, because the first one failed silently once already:** (a) the private layer is actually PUSHED, not merely committed on one machine; (b) new development detail is written there rather than into the public tree. | manual:any turn that writes development or roadmap material | IN-PROGRESS | **Condition (a) was measured false on 2026-08-20 and repaired the same day.** `main` in the private layer stood 55 commits ahead of `origin/main`, so the material the owner asked to be stored there existed on a single machine; it was pushed as `812e613..f404c8e`. This is the same failure shape as OB-011 and it recurred, which is why condition (a) is written as a separate check rather than assumed. Condition (b) is continuous and has no end state. **Whether the public `ROADMAP.md` is REMOVED from the public tree is deliberately NOT decided here.** Measured on `origin/master` 2026-08-20, that file is referenced by 34 records in `governance/agent_preventions.yaml` and by three test modules, so removing it is a large governance change that does nothing for the laboratory week — and what a public repository publishes is an outward-facing decision that belongs to the owner, not a mechanism decision. What IS done here: the development detail that had accumulated in that file — a person's travel dates, machine-specific outage history, and campaign measurements — is being moved out through PR #84. | |
There was a problem hiding this comment.
Because this row explicitly says the OB-011 unpushed-work failure recurred, adding another prose-only manual check does not satisfy the repository's required class-level prevention: no guard or exact human gate verifies the private remote state, so the same local-only condition can recur while the documentation suite remains green. Name the failure class and add an enforceable boundary check, or explicitly leave that prevention as open governance debt.
AGENTS.md reference: AGENTS.md:L391-L400
Useful? React with 👍 / 👎.
| | OB-012 | 2026-08-10 | Owner direction, verbatim: "make it necessary, write all project documentation using this skill … this is absolutely non negotiable", then "we need to put it on the roadmap to rewrite all current docs using this skill" | All new and changed English project documentation follows ASD-STE100 via the skill at `docs/skills/asd-ste100/`. Scope: binds the client-facing English surface, agent-layer governed files, and new register rows; exempt are Russian-language text, verbatim quotes, immutable evidence/archives, and changelog history (full scope decision recorded in the out-of-tree layer ruleset). The retrofit of existing documents is the "Documentation track — ASD-STE100 conversion" entry in `ROADMAP.md`; that entry and this row reference each other. The skill ships no checker, so until a heuristic checker lands with the OB-010 guard package, conformance is writer discipline plus review — the trigger below fires on every edit to the governed surface because the writer of that edit is the enforcement point. A link from AGENTS.md to the skill is part of this row but waits for PR #20 to merge (it holds AGENTS.md). | manual:every edit to governed English documentation | IN-PROGRESS | Skill installed and ROADMAP track added in this PR; retrofit slices pending. | | ||
| | OB-013 | 2026-08-10 | Phase-1 recon (read-only lane report, retained as lane evidence in the out-of-tree layer; two findings coordinator-verified) | Reconcile Phase-1 (H3/H4) claims with measured reality in a dedicated register-truth/evidence PR: (a) the WHOLE-STACK soak driver defines 12h/72h profiles but refuses every profile except short. **CORRECTED, measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: the two refusals do NOT share an exit code.** A long profile prints an explicit reason to stderr and returns **3**. The platform refusal (`_RunnerActivationDisabled`) returns **2** and is silent. The driver therefore does not conflate the two and does not hide the stop. The residual is only that the long soak stays unreachable through the whole-stack path, which the driver states out loud — the separate engine-only soak driver accepts an arbitrary duration and IS reachable, so the finding is scoped to the whole-stack driver only, and the resource-growth bounds carried only by its long profiles; (b) measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: no current-SHA soak, full-suite, or hosted ONEDIR receipt exists in THAT tree, and the historical suite `PROJECT_STATUS.md` cites ran at commit `026bf50b158f019953e3667026bc35b7fe935330` (retrievable: contained by `origin/feat/montana-phase-a` and `origin/review/montana-cli-corrections-staging`; the hash alone is not enough in a clone that fetches only master and the PR ref), which is NOT an ancestor of that commit (coordinator-verified with `git merge-base --is-ancestor`) — the same staleness class this register exists for; (c) **STANDS. My first correction of it was WRONG and is retracted here.** I wrote that no second live reporter exists. Measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: `PERIODIC_REPORTER_FACILITIES` (`src/cryodaq/agents/assistant_bootstrap.py:59-72`) declares **TWO LIVE facilities** — `PeriodicPngSupervisor` (`png_artifact`, `cross_process_single_owner=True`) and `assistant_main._periodic_report_tick` (`llm_narrative_text`, `assistant_process_local`, **`cross_process_single_owner=False`**), which `assistant_main.py:988` starts as a task. Its guard is named `test_periodic_reporter_inventory_binds_the_two_real_facilities`. `RETIRED_PERIODIC_REPORTER_SYMBOLS` is a SEPARATE tuple naming only the legacy `notifications.periodic_report.PeriodicReporter`, dead code tracked as OC-026b. **Retiring that module does not make the LLM tick dead, and conflating the two produced the wrong correction.** So the original finding holds: scope the single-owner phrase to PNG, because the LLM facility itself declares single-owner false. **Do NOT delete the soak profile guard: it is a deliberate stop with a stated reason.** | manual:coordinator schedules the register-truth PR | IN-PROGRESS | This PR. Corrections (a) and (c) above are made in the same change, because a register that carries a wrong “(verified)” is the exact failure it exists to prevent. | | ||
| | OB-014 | 2026-08-11 | Independent review of the OB-013 pull request | **Prevention dispositions for evidence failures in this register.** The number-one operating rule applies. A confirmed agent mistake must harden the governing layer. A completion disposition must not close while its prevention stays open. Six mistakes were confirmed while correcting OB-013. Each one is a claim that its evidence does not support. **(1)** A live facility was read as retired. The correction then removed a true finding. **(2)** Measurements were bound to the moving ref `origin/master`. A later reader cannot reproduce them. **(3)** A row moved to `DONE` on an identifier that does not resolve in a fresh clone. **(4)** A row moved to `DONE` because an artifact exists, where the trigger required an authorisation or an ordering condition. **(5)** A row count was measured on the default branch. It was then briefed to a worker as the invariant for the branch under review. The branch held a different count. The worker measured the branch, contradicted the brief, and was correct. **(6)** A per-commit question was answered with a final-tip diff. A zero-deletion result between two endpoints was read as establishing that no commit in the range deleted the file, which it cannot do. The delete-then-restore sequence that demonstrates the gap was raised as a counterexample and was never observed, so the mistake is the method, not the sequence. **Proposed rules. They are reported, not applied, because a policy edit is outside this pull request:** **(a)** Bind a measurement to an immutable commit id. A branch name, `HEAD` or `origin/master` is not a binding. **(b)** For every evidence identifier, verify retrievability in a fresh clone, regardless of cell or status. Move a row to `DONE` only when every identifier in its Discharge cell resolves. Name a containing ref when the object is not on the default branch. **(c)** Quote the authorisation when the trigger needs one. An artifact that exists is not permission to create it. A later merge does not discharge an ordering condition. For `manual:` ordering triggers, record an exact human gate. The gate names its inputs, decision owner, required evidence, and fail-closed outcome. For OB-004, inputs are queue state and publication time. The coordinator is the decision owner. Required evidence is a timestamped queue-empty record before publication. If evidence is absent, retain `PENDING` and treat ordering as unverified. **(d)** Support a claim that a component is retired, dead or absent with the inventory that would list it if it were live. Show it is not in that inventory. **Bind the evidence to the facility under review: quote the identifier the reviewed claim names, and show THAT identifier against its exact inventory entry.** An absence shown for a similarly named symbol proves nothing about the facility in the claim. **This rule covers mistake (1), which rules (a) to (c) cannot catch: the inventory test was already green when the mistake happened, and the retired `PeriodicReporter` could be substituted for the live `_periodic_report_tick` while every stated condition still read as satisfied.** **(e)** Before claiming zero deletions, inspect every commit in the compared range. Record per-commit deletion results. A final-tip diff does not test intermediate deletion and restoration. **This rule covers mistake (6): answering a per-commit question with a final-tip diff.** A delete-then-restore sequence remains HYPOTHETICAL: it was raised as the counterexample that shows why the final-tip result is insufficient, and no per-commit evidence establishes that it occurred. Do not record it as observed unless retrievable per-commit evidence proves it. **(f)** Measure an invariant on the exact candidate tree under review. Record the candidate immutable tree or commit and the immutable tree or commit actually measured, and require them to be equal; naming a ref alone is not sufficient. A count taken from the default branch does not bind a branch that adds or removes rows. **This rule covers mistake (5). Rules (a) to (e) cannot catch it, because the measurement was correct about the ref it named and wrong about the ref it was used for.** The structural portions of each rule are mechanically checkable in the OB-010 guard package. Rule (c) authorization and ordering decision remains a fail-closed human gate requiring its named inputs, decision owner, required evidence, and outcome. | manual:coordinator lands the OB-010 guard package | PENDING | — | | ||
| | OB-015 | 2026-08-20 | Owner direction, verbatim: *"cryodaq-workspace это частная орг репа. она приватная, и все нужно хранить там что касается разработки, дорожной карты"* | **Development material and roadmap material are stored in the PRIVATE organisation repository `test1card/cryodaq-workspace`.** Measured 2026-08-20: `test1card/cryodaq` is PUBLIC and `test1card/cryodaq-workspace` is PRIVATE. So development state — measurements, machine paths, campaign and lane progress, worker records, schedules, and the forward development plan — belongs in the private layer, and the public repository keeps the product-facing plan and this register. Other documents may reference a private plan by its identifier; they must not restate its detail. **Two conditions hold this, and BOTH must be checked, because the first one failed silently once already:** (a) the private layer is actually PUSHED, not merely committed on one machine; (b) new development detail is written there rather than into the public tree. | manual:any turn that writes development or roadmap material | IN-PROGRESS | **Condition (a) was measured false on 2026-08-20 and repaired the same day.** `main` in the private layer stood 55 commits ahead of `origin/main`, so the material the owner asked to be stored there existed on a single machine; it was pushed as `812e613..f404c8e`. This is the same failure shape as OB-011 and it recurred, which is why condition (a) is written as a separate check rather than assumed. Condition (b) is continuous and has no end state. **Whether the public `ROADMAP.md` is REMOVED from the public tree is deliberately NOT decided here.** Measured on `origin/master` 2026-08-20, that file is referenced by 34 records in `governance/agent_preventions.yaml` and by three test modules, so removing it is a large governance change that does nothing for the laboratory week — and what a public repository publishes is an outward-facing decision that belongs to the owner, not a mechanism decision. What IS done here: the development detail that had accumulated in that file — a person's travel dates, machine-specific outage history, and campaign measurements — is being moved out through PR #84. | |
There was a problem hiding this comment.
OB-012 explicitly applies ASD-STE100 to every new register row and makes review the current enforcement point, but OB-015 introduces multiple descriptive sentences over the 25-word limit, including 34-, 43-, and 53-word sentences with stacked clauses and conditions. Split these into short sentences and vertical lists so this new governed row does not violate the obligation immediately above it.
Useful? React with 👍 / 👎.
| | OB-012 | 2026-08-10 | Owner direction, verbatim: "make it necessary, write all project documentation using this skill … this is absolutely non negotiable", then "we need to put it on the roadmap to rewrite all current docs using this skill" | All new and changed English project documentation follows ASD-STE100 via the skill at `docs/skills/asd-ste100/`. Scope: binds the client-facing English surface, agent-layer governed files, and new register rows; exempt are Russian-language text, verbatim quotes, immutable evidence/archives, and changelog history (full scope decision recorded in the out-of-tree layer ruleset). The retrofit of existing documents is the "Documentation track — ASD-STE100 conversion" entry in `ROADMAP.md`; that entry and this row reference each other. The skill ships no checker, so until a heuristic checker lands with the OB-010 guard package, conformance is writer discipline plus review — the trigger below fires on every edit to the governed surface because the writer of that edit is the enforcement point. A link from AGENTS.md to the skill is part of this row but waits for PR #20 to merge (it holds AGENTS.md). | manual:every edit to governed English documentation | IN-PROGRESS | Skill installed and ROADMAP track added in this PR; retrofit slices pending. | | ||
| | OB-013 | 2026-08-10 | Phase-1 recon (read-only lane report, retained as lane evidence in the out-of-tree layer; two findings coordinator-verified) | Reconcile Phase-1 (H3/H4) claims with measured reality in a dedicated register-truth/evidence PR: (a) the WHOLE-STACK soak driver defines 12h/72h profiles but refuses every profile except short. **CORRECTED, measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: the two refusals do NOT share an exit code.** A long profile prints an explicit reason to stderr and returns **3**. The platform refusal (`_RunnerActivationDisabled`) returns **2** and is silent. The driver therefore does not conflate the two and does not hide the stop. The residual is only that the long soak stays unreachable through the whole-stack path, which the driver states out loud — the separate engine-only soak driver accepts an arbitrary duration and IS reachable, so the finding is scoped to the whole-stack driver only, and the resource-growth bounds carried only by its long profiles; (b) measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: no current-SHA soak, full-suite, or hosted ONEDIR receipt exists in THAT tree, and the historical suite `PROJECT_STATUS.md` cites ran at commit `026bf50b158f019953e3667026bc35b7fe935330` (retrievable: contained by `origin/feat/montana-phase-a` and `origin/review/montana-cli-corrections-staging`; the hash alone is not enough in a clone that fetches only master and the PR ref), which is NOT an ancestor of that commit (coordinator-verified with `git merge-base --is-ancestor`) — the same staleness class this register exists for; (c) **STANDS. My first correction of it was WRONG and is retracted here.** I wrote that no second live reporter exists. Measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: `PERIODIC_REPORTER_FACILITIES` (`src/cryodaq/agents/assistant_bootstrap.py:59-72`) declares **TWO LIVE facilities** — `PeriodicPngSupervisor` (`png_artifact`, `cross_process_single_owner=True`) and `assistant_main._periodic_report_tick` (`llm_narrative_text`, `assistant_process_local`, **`cross_process_single_owner=False`**), which `assistant_main.py:988` starts as a task. Its guard is named `test_periodic_reporter_inventory_binds_the_two_real_facilities`. `RETIRED_PERIODIC_REPORTER_SYMBOLS` is a SEPARATE tuple naming only the legacy `notifications.periodic_report.PeriodicReporter`, dead code tracked as OC-026b. **Retiring that module does not make the LLM tick dead, and conflating the two produced the wrong correction.** So the original finding holds: scope the single-owner phrase to PNG, because the LLM facility itself declares single-owner false. **Do NOT delete the soak profile guard: it is a deliberate stop with a stated reason.** | manual:coordinator schedules the register-truth PR | IN-PROGRESS | This PR. Corrections (a) and (c) above are made in the same change, because a register that carries a wrong “(verified)” is the exact failure it exists to prevent. | | ||
| | OB-014 | 2026-08-11 | Independent review of the OB-013 pull request | **Prevention dispositions for evidence failures in this register.** The number-one operating rule applies. A confirmed agent mistake must harden the governing layer. A completion disposition must not close while its prevention stays open. Six mistakes were confirmed while correcting OB-013. Each one is a claim that its evidence does not support. **(1)** A live facility was read as retired. The correction then removed a true finding. **(2)** Measurements were bound to the moving ref `origin/master`. A later reader cannot reproduce them. **(3)** A row moved to `DONE` on an identifier that does not resolve in a fresh clone. **(4)** A row moved to `DONE` because an artifact exists, where the trigger required an authorisation or an ordering condition. **(5)** A row count was measured on the default branch. It was then briefed to a worker as the invariant for the branch under review. The branch held a different count. The worker measured the branch, contradicted the brief, and was correct. **(6)** A per-commit question was answered with a final-tip diff. A zero-deletion result between two endpoints was read as establishing that no commit in the range deleted the file, which it cannot do. The delete-then-restore sequence that demonstrates the gap was raised as a counterexample and was never observed, so the mistake is the method, not the sequence. **Proposed rules. They are reported, not applied, because a policy edit is outside this pull request:** **(a)** Bind a measurement to an immutable commit id. A branch name, `HEAD` or `origin/master` is not a binding. **(b)** For every evidence identifier, verify retrievability in a fresh clone, regardless of cell or status. Move a row to `DONE` only when every identifier in its Discharge cell resolves. Name a containing ref when the object is not on the default branch. **(c)** Quote the authorisation when the trigger needs one. An artifact that exists is not permission to create it. A later merge does not discharge an ordering condition. For `manual:` ordering triggers, record an exact human gate. The gate names its inputs, decision owner, required evidence, and fail-closed outcome. For OB-004, inputs are queue state and publication time. The coordinator is the decision owner. Required evidence is a timestamped queue-empty record before publication. If evidence is absent, retain `PENDING` and treat ordering as unverified. **(d)** Support a claim that a component is retired, dead or absent with the inventory that would list it if it were live. Show it is not in that inventory. **Bind the evidence to the facility under review: quote the identifier the reviewed claim names, and show THAT identifier against its exact inventory entry.** An absence shown for a similarly named symbol proves nothing about the facility in the claim. **This rule covers mistake (1), which rules (a) to (c) cannot catch: the inventory test was already green when the mistake happened, and the retired `PeriodicReporter` could be substituted for the live `_periodic_report_tick` while every stated condition still read as satisfied.** **(e)** Before claiming zero deletions, inspect every commit in the compared range. Record per-commit deletion results. A final-tip diff does not test intermediate deletion and restoration. **This rule covers mistake (6): answering a per-commit question with a final-tip diff.** A delete-then-restore sequence remains HYPOTHETICAL: it was raised as the counterexample that shows why the final-tip result is insufficient, and no per-commit evidence establishes that it occurred. Do not record it as observed unless retrievable per-commit evidence proves it. **(f)** Measure an invariant on the exact candidate tree under review. Record the candidate immutable tree or commit and the immutable tree or commit actually measured, and require them to be equal; naming a ref alone is not sufficient. A count taken from the default branch does not bind a branch that adds or removes rows. **This rule covers mistake (5). Rules (a) to (e) cannot catch it, because the measurement was correct about the ref it named and wrong about the ref it was used for.** The structural portions of each rule are mechanically checkable in the OB-010 guard package. Rule (c) authorization and ordering decision remains a fail-closed human gate requiring its named inputs, decision owner, required evidence, and outcome. | manual:coordinator lands the OB-010 guard package | PENDING | — | | ||
| | OB-015 | 2026-08-20 | Owner direction, verbatim: *"cryodaq-workspace это частная орг репа. она приватная, и все нужно хранить там что касается разработки, дорожной карты"* | **Development material and roadmap material are stored in the PRIVATE organisation repository `test1card/cryodaq-workspace`.** Measured 2026-08-20: `test1card/cryodaq` is PUBLIC and `test1card/cryodaq-workspace` is PRIVATE. So development state — measurements, machine paths, campaign and lane progress, worker records, schedules, and the forward development plan — belongs in the private layer, and the public repository keeps the product-facing plan and this register. Other documents may reference a private plan by its identifier; they must not restate its detail. **Two conditions hold this, and BOTH must be checked, because the first one failed silently once already:** (a) the private layer is actually PUSHED, not merely committed on one machine; (b) new development detail is written there rather than into the public tree. | manual:any turn that writes development or roadmap material | IN-PROGRESS | **Condition (a) was measured false on 2026-08-20 and repaired the same day.** `main` in the private layer stood 55 commits ahead of `origin/main`, so the material the owner asked to be stored there existed on a single machine; it was pushed as `812e613..f404c8e`. This is the same failure shape as OB-011 and it recurred, which is why condition (a) is written as a separate check rather than assumed. Condition (b) is continuous and has no end state. **Whether the public `ROADMAP.md` is REMOVED from the public tree is deliberately NOT decided here.** Measured on `origin/master` 2026-08-20, that file is referenced by 34 records in `governance/agent_preventions.yaml` and by three test modules, so removing it is a large governance change that does nothing for the laboratory week — and what a public repository publishes is an outward-facing decision that belongs to the owner, not a mechanism decision. What IS done here: the development detail that had accumulated in that file — a person's travel dates, machine-specific outage history, and campaign measurements — is being moved out through PR #84. | |
There was a problem hiding this comment.
docs/OBLIGATIONS.md defines its rows as owner directions deferred until a trigger fires, but this direction applies immediately on every writing turn and condition (b) explicitly has no end state. Consequently, its IN-PROGRESS status can never resolve and the planned guard treats its manual: trigger as never auto-firing; record the durable owner decision in docs/DECISIONS.md and the workflow policy in its authoritative policy surface, leaving this register for a finite deferred action.
AGENTS.md reference: AGENTS.md:L52-L58
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2d91c2eb01
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | OB-012 | 2026-08-10 | Owner direction, verbatim: "make it necessary, write all project documentation using this skill … this is absolutely non negotiable", then "we need to put it on the roadmap to rewrite all current docs using this skill" | All new and changed English project documentation follows ASD-STE100 via the skill at `docs/skills/asd-ste100/`. Scope: binds the client-facing English surface, agent-layer governed files, and new register rows; exempt are Russian-language text, verbatim quotes, immutable evidence/archives, and changelog history (full scope decision recorded in the out-of-tree layer ruleset). The retrofit of existing documents is the "Documentation track — ASD-STE100 conversion" entry in `ROADMAP.md`; that entry and this row reference each other. The skill ships no checker, so until a heuristic checker lands with the OB-010 guard package, conformance is writer discipline plus review — the trigger below fires on every edit to the governed surface because the writer of that edit is the enforcement point. A link from AGENTS.md to the skill is part of this row but waits for PR #20 to merge (it holds AGENTS.md). | manual:every edit to governed English documentation | IN-PROGRESS | Skill installed and ROADMAP track added in this PR; retrofit slices pending. | | ||
| | OB-013 | 2026-08-10 | Phase-1 recon (read-only lane report, retained as lane evidence in the out-of-tree layer; two findings coordinator-verified) | Reconcile Phase-1 (H3/H4) claims with measured reality in a dedicated register-truth/evidence PR: (a) the WHOLE-STACK soak driver defines 12h/72h profiles but refuses every profile except short. **CORRECTED, measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: the two refusals do NOT share an exit code.** A long profile prints an explicit reason to stderr and returns **3**. The platform refusal (`_RunnerActivationDisabled`) returns **2** and is silent. The driver therefore does not conflate the two and does not hide the stop. The residual is only that the long soak stays unreachable through the whole-stack path, which the driver states out loud — the separate engine-only soak driver accepts an arbitrary duration and IS reachable, so the finding is scoped to the whole-stack driver only, and the resource-growth bounds carried only by its long profiles; (b) measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: no current-SHA soak, full-suite, or hosted ONEDIR receipt exists in THAT tree, and the historical suite `PROJECT_STATUS.md` cites ran at commit `026bf50b158f019953e3667026bc35b7fe935330` (retrievable: contained by `origin/feat/montana-phase-a` and `origin/review/montana-cli-corrections-staging`; the hash alone is not enough in a clone that fetches only master and the PR ref), which is NOT an ancestor of that commit (coordinator-verified with `git merge-base --is-ancestor`) — the same staleness class this register exists for; (c) **STANDS. My first correction of it was WRONG and is retracted here.** I wrote that no second live reporter exists. Measured at commit `d0cd9a4ac26803011b22394e6b401f840b682504`: `PERIODIC_REPORTER_FACILITIES` (`src/cryodaq/agents/assistant_bootstrap.py:59-72`) declares **TWO LIVE facilities** — `PeriodicPngSupervisor` (`png_artifact`, `cross_process_single_owner=True`) and `assistant_main._periodic_report_tick` (`llm_narrative_text`, `assistant_process_local`, **`cross_process_single_owner=False`**), which `assistant_main.py:988` starts as a task. Its guard is named `test_periodic_reporter_inventory_binds_the_two_real_facilities`. `RETIRED_PERIODIC_REPORTER_SYMBOLS` is a SEPARATE tuple naming only the legacy `notifications.periodic_report.PeriodicReporter`, dead code tracked as OC-026b. **Retiring that module does not make the LLM tick dead, and conflating the two produced the wrong correction.** So the original finding holds: scope the single-owner phrase to PNG, because the LLM facility itself declares single-owner false. **Do NOT delete the soak profile guard: it is a deliberate stop with a stated reason.** | manual:coordinator schedules the register-truth PR | IN-PROGRESS | This PR. Corrections (a) and (c) above are made in the same change, because a register that carries a wrong “(verified)” is the exact failure it exists to prevent. | | ||
| | OB-014 | 2026-08-11 | Independent review of the OB-013 pull request | **Prevention dispositions for evidence failures in this register.** The number-one operating rule applies. A confirmed agent mistake must harden the governing layer. A completion disposition must not close while its prevention stays open. Six mistakes were confirmed while correcting OB-013. Each one is a claim that its evidence does not support. **(1)** A live facility was read as retired. The correction then removed a true finding. **(2)** Measurements were bound to the moving ref `origin/master`. A later reader cannot reproduce them. **(3)** A row moved to `DONE` on an identifier that does not resolve in a fresh clone. **(4)** A row moved to `DONE` because an artifact exists, where the trigger required an authorisation or an ordering condition. **(5)** A row count was measured on the default branch. It was then briefed to a worker as the invariant for the branch under review. The branch held a different count. The worker measured the branch, contradicted the brief, and was correct. **(6)** A per-commit question was answered with a final-tip diff. A zero-deletion result between two endpoints was read as establishing that no commit in the range deleted the file, which it cannot do. The delete-then-restore sequence that demonstrates the gap was raised as a counterexample and was never observed, so the mistake is the method, not the sequence. **Proposed rules. They are reported, not applied, because a policy edit is outside this pull request:** **(a)** Bind a measurement to an immutable commit id. A branch name, `HEAD` or `origin/master` is not a binding. **(b)** For every evidence identifier, verify retrievability in a fresh clone, regardless of cell or status. Move a row to `DONE` only when every identifier in its Discharge cell resolves. Name a containing ref when the object is not on the default branch. **(c)** Quote the authorisation when the trigger needs one. An artifact that exists is not permission to create it. A later merge does not discharge an ordering condition. For `manual:` ordering triggers, record an exact human gate. The gate names its inputs, decision owner, required evidence, and fail-closed outcome. For OB-004, inputs are queue state and publication time. The coordinator is the decision owner. Required evidence is a timestamped queue-empty record before publication. If evidence is absent, retain `PENDING` and treat ordering as unverified. **(d)** Support a claim that a component is retired, dead or absent with the inventory that would list it if it were live. Show it is not in that inventory. **Bind the evidence to the facility under review: quote the identifier the reviewed claim names, and show THAT identifier against its exact inventory entry.** An absence shown for a similarly named symbol proves nothing about the facility in the claim. **This rule covers mistake (1), which rules (a) to (c) cannot catch: the inventory test was already green when the mistake happened, and the retired `PeriodicReporter` could be substituted for the live `_periodic_report_tick` while every stated condition still read as satisfied.** **(e)** Before claiming zero deletions, inspect every commit in the compared range. Record per-commit deletion results. A final-tip diff does not test intermediate deletion and restoration. **This rule covers mistake (6): answering a per-commit question with a final-tip diff.** A delete-then-restore sequence remains HYPOTHETICAL: it was raised as the counterexample that shows why the final-tip result is insufficient, and no per-commit evidence establishes that it occurred. Do not record it as observed unless retrievable per-commit evidence proves it. **(f)** Measure an invariant on the exact candidate tree under review. Record the candidate immutable tree or commit and the immutable tree or commit actually measured, and require them to be equal; naming a ref alone is not sufficient. A count taken from the default branch does not bind a branch that adds or removes rows. **This rule covers mistake (5). Rules (a) to (e) cannot catch it, because the measurement was correct about the ref it named and wrong about the ref it was used for.** The structural portions of each rule are mechanically checkable in the OB-010 guard package. Rule (c) authorization and ordering decision remains a fail-closed human gate requiring its named inputs, decision owner, required evidence, and outcome. | manual:coordinator lands the OB-010 guard package | PENDING | — | | ||
| | OB-015 | 2026-08-20 | Owner direction, verbatim: *"cryodaq-workspace это частная орг репа. она приватная, и все нужно хранить там что касается разработки, дорожной карты"* | **Development material and roadmap material are stored in the PRIVATE organisation repository `test1card/cryodaq-workspace`.** Measured 2026-08-20: `test1card/cryodaq` is PUBLIC and `test1card/cryodaq-workspace` is PRIVATE. So development state — measurements, machine paths, campaign and lane progress, worker records, schedules, and the forward development plan — belongs in the private layer, and the public repository keeps the product-facing plan and this register. Other documents may reference a private plan by its identifier; they must not restate its detail. **Two conditions hold this, and BOTH must be checked, because the first one failed silently once already:** (a) the private layer is actually PUSHED, not merely committed on one machine; (b) new development detail is written there rather than into the public tree. | manual:any turn that writes development or roadmap material | IN-PROGRESS | **Condition (a) was measured false on 2026-08-20 and repaired the same day**; the measurement, the commit range and the repair are recorded in the private layer's own state file, not restated here — which is this row's own rule applied to itself. It is the same failure shape as OB-011, and it recurred, which is why condition (a) is written as a check of its own rather than assumed. Condition (b) is continuous and has no end state. **Whether the public `ROADMAP.md` is REMOVED from the public tree is deliberately NOT decided here.** Measured on `origin/master` 2026-08-20, that file is referenced by 34 records in `governance/agent_preventions.yaml` and by three test modules, so removing it is a large governance change that does nothing for the laboratory week — and what a public repository publishes is an outward-facing decision that belongs to the owner, not a mechanism decision. What IS done here: the development detail that had accumulated in that file — a person's travel dates, machine-specific outage history, and campaign measurements — is being moved out through PR #84. | |
There was a problem hiding this comment.
This quoted direction supplies the owner approval that OB-008's manual:owner approves trigger awaits: it identifies the existing private repository and explicitly requires the workspace material to be stored there. Leaving OB-008 PENDING with the statement that “no owner approval is cited” makes the same register contradict its newly added source of authority; update OB-008 to cite this direction and record the resulting disposition.
Useful? React with 👍 / 👎.
test1card
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Withdrawn.