Repository navigation
feat(pilot): installable workspace pilot (spec 006 T001–T009) - #91
Merged
Merged
Conversation
5 tasks done
Owner
Author
|
Review CLEAR on |
wstein
force-pushed
the
pilot/installable-pilot-pr
branch
from
October 16, 2026 10:42
75526bb to
7656115
Compare
Owner
Author
wstein
marked this pull request as ready for review
October 16, 2026 10:55
Owner
Author
|
Ready per owner: review CLEAR on this head; local |
2 tasks
wstein
force-pushed
the
pilot/installable-pilot-pr
branch
from
October 16, 2026 11:19
7656115 to
866e46c
Compare
Owner
Author
|
Pilot nits fixed per owner (H65:b→H66:b): go-csvvalue direct, direct isGitTransport parity test, two commit scopes reworded. Review CLEAR on |
Avoid duplicate input after an uncertain agent-send response while retaining durable workspace operation recovery. Refs: #72
Move baseline text escaping and stream filtering into the first WIs that expose untrusted output so later exhaustive acceptance cannot leave earlier work items unsafe. Record the owner's delegated intermediate review route, pending independent Sol re-review, and corrected design baseline while retaining the frozen migration oracle. Refs: #72
Establish reproducible application boundaries before lifecycle behavior, retaining the official Phoenix HTML/LiveView asset scaffold and a shared exported Go API-client package. Keep CLI and host-agent entrypoints truthful while refusing unimplemented product commands. Record actual scaffold verification and upstream limitations without claiming pilot acceptance or activating a runtime. Refs: #67, #72
Avoid requiring a signed release on main before the PR that introduces the implementation. Keep local packaging and release-policy tests in the pilot, retain real-host/browser/load gates, and leave SC-006 plus full Feature 006 completion open for a separately authorized signed-release follow-up. Refs: #72
Honor ADR 0013 from the scaffold onward so unsupported commands cannot establish an incompatible CLI exit contract. Require exact usage exit 64 and the whr stderr prefix in the refusal regression test, retaining the host-agent contract and historical scaffold measurements. Refs: #72
Add fixed application gates and required outcome inventories so clean local and CI checks reject missing tools, missing/skipped tests and failed builds. Bootstrap locked dependencies in isolated state without changing inherited Python policy or check deadlines. Refs: #67, #72 Co-authored-by: Codex <noreply@openai.com>
Pin independent source behavior before the Go port so malformed inputs, canonical bytes and deliberately restricted product domains cannot drift silently. Keep the offline oracle and its negative controls in development tooling, with portable runtime provenance and explicit candidate review. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Preserve the independently frozen integer-only JSON identities and lexical path predicates in dependency-free Go packages before any callers switch. Validate native types and malformed Unicode in production, and require operation-specific negative/golden vectors plus adversarial and bounded fuzz evidence. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Persist the independently reviewed native identity and atomic durability rules before implementation, and record exact T004 acceptance without claiming later runtime evidence. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Commit normalized lifecycle identity, scoped storage/runtime reservations and audit before any future provider effect. Keep intent versions separate from runtime generations, guard terminal results and retain immutable replay history with SQLite constraints and real failure/restart evidence. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Bind owner authentication to separate owner, dashboard and preauth stores before behavior. Preserve read-only mutation denial, strict raw decoding and transport boundaries without automatic credential revocation. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Establish revocable owner credentials and explicit browser contexts so read-only viewers cannot inherit management authority. Validate transport and raw request boundaries before socket dispatch, map construction or secret-bearing handlers. Retain all inherited acceptance IDs and add failure-first scope, expiry, revocation, parser, cookie, ingress and redaction coverage. No listener activation or later host/lifecycle implementation is included. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Fresh database validation loads the migration before test fixtures run. Reuse that module, matching the foundation fixture, to avoid a duplicate-load warning. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Freeze the independently reviewed closed protocol and actual foundation/auth interfaces before failure-first behavior. Record exact T006 acceptance without claiming transport or lifecycle capability. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Reject malformed, foreign, stale and conflicting host messages before future effects. Keep owner request identity distinct from immutable command replay, preserve strict observation types and bound both raw and normalized canonical envelopes. Add independent shared fixtures and failure-first native regressions in Go and Elixir. Pure dispositions confer no provider permission; transport, trust stores and durable execution remain later work. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Record accepted T007 scope and the independently reviewed S001 blocker before T008. Reproduce actual TLS HTTP2 exposure and unsafe configuration acceptance before mitigation while preserving real HTTP1 authentication and WSS gates. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Mitigate GHSA-69m6-wcv4-rwcf without an unreleased dependency pin. Reject ambiguous activation and unsafe protocol or low-level overrides before active listener startup; keep inert defaults and real HTTPS browser, bearer and WSS behavior. Record failure-first activation review fix and full native application checks. Locked Bandit remains advisory-affected; a released fix and separate review are required before HTTP2 re-enable. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Consolidate accepted T008 identity, renewal, crash recovery and scoped liveness rules before failure-first tests. Preserve the final empty enrollment CSR correction and narrowly extend the reviewed HTTP1-only transport profile for optional verified agent certificates. Record exact S001 acceptance without claiming dependency security or pilot runtime completion. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Bind host enrollment, renewal and revocation to durable scoped identities, and fence stale or expired outbound connections without rewriting lifecycle history. Preserve HTTP/1-only ingress and fixed secret-safe diagnostics. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Exercise native and Go identity transitions under deterministic syscall failures and fresh reloads. Propagate native close failures so uncertain durability never reports success, and record predecessor real-host evidence without accepting a changed candidate. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Complete the same two Linux acceptance roots with exact trust, revision, source and runtime collision refusals. Require zero additional mutating Docker forwards alongside actual inventory and data checks, with separate fixture-owned setup and positive transport controls. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
The immutable resolver deliberately reports filesystem source containment errors as invalid_configuration. Reproduce the relative symlink chain and correct the acceptance expectation without weakening exact diagnostics or changing provider behavior. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Pinned npm rejects loading /dev/null twice for user and global configuration. Preserve hermetic locked companion installation with distinct exclusive empty0600 files and verify their state during invocation; retain the original canonical failure. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Prevent an unrelated early resource refusal from satisfying retention evidence. The same real acceptance roots must observe a new forwarded build during the intentionally failing build attempt before checking preserved hashes. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Preserve the exact canonical pass and every pre-create refusal so source readiness cannot be mistaken for actual Docker acceptance. Record the scoped diagnostic evidence and missing authoritative backing mapping without weakening resource or ownership gates. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Preserve the reviewed monitored-disk strategy, corrected fixture evidence and two actual incomplete attempts so canonical source readiness cannot be mistaken for Linux/Docker acceptance. Record verified owned cleanup, the unknown baseline cause and the current bounded outer-readiness failure without changing runtime gates or task completion. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
Attribute the accepted 2.75GiB entry amendment to the later byte-bound fixture pressure policy and mechanism clarification artifacts. Preserve the earlier strategy's historical 3GiB text and all actual evidence without changing numeric policy, source behavior or task status. Refs: #72 Co-authored-by: Codex <noreply@openai.com>
The lexical and final-target checks accepted a chain that climbs above ProjectsPath through an intermediate link and comes back in by name. It resolves inside the source but to a sibling of data once copied. Resolve each link component by component inside the source root. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Registry admission decoded tool-pins.json into string-only maps, but the crane pin carries the numeric metadata_input_limit_bytes. The decode always failed, so every registry image refused as tool_unavailable before any tool check. Read string fields per pin and test the embedded pins directly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A failed renewal skipped the session even while the active certificate was valid, so an unreachable or conflicting renewal disconnected a healthy host. A failed reload after a successful renewal dereferenced a nil state and crashed the agent. Keep the active credential, which the session still checks, and return ErrTransport on a failed reload. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Dockerfile gate pinned FROM bases but ignored COPY/ADD --from and RUN --mount from=, so an approved Dockerfile could pull a mutable external image past the digest and metadata gate. Admit only earlier stage aliases or indexes there, and refuse remote ADD sources and dynamic flag values. External tools enter through a pinned FROM stage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The harness guide and ADR 0007 still described the T002 scaffold: no required API client tests and five ExUnit tests. The manifest now requires wirejson and many more ExUnit identities. Point to the manifest inventory instead of fixed counts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The docker_integration acceptance files were never vetted or compiled by make check or CI, so a provider refactor could break them unseen until a scarce guest run. Vet the tagged package without running it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The split from PR #83 rebased every pilot commit, so evidence IDs cited in the plan no longer resolve on the branch. Map them by subject, mark them historical, and record the independent review's fixed and deferred findings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
After a failed renewal Run opened a session on the old credential whose deadline was the real expiry once under 6h remained, so renewal was not retried until the certificate expired and the host was lost. Bound the session to the next retry time (renewRetry) when renewal is due and failed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Mount options are CSV in BuildKit, so quoted from= fields bypassed the comma split; any user@host:path is git, not only git@. Reuse csvvalue and gitutil.IsGitTransport from the pinned module and trim/lowercase keys. Apply the "$" refusal only to --from and mount from=, so --chown=$U:$U and cache targets using ARG are accepted again. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
State which review fixes have failing-without-fix tests, record the renewal-retry defect and the second review round, and document the docker_integration go vet step. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
check_repo.py admits only the BuildKit parser, instructions and linter imports in trusted.go, so importing util/gitutil failed the boundary check. Mirror BuildKit v0.34.0 gitutil.IsGitTransport and sshutil IsImplicitSSHTransport locally and extend the refusal test with each accepted transport form. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
go-csvvalue is imported directly by trusted.go, so list it in the direct require block. Add a unit test of isGitTransport covering every upstream transport form and register it in the CI acceptance manifest. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
wstein
force-pushed
the
pilot/installable-pilot-pr
branch
from
October 16, 2026 11:31
866e46c to
2235c20
Compare
This was referenced Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Installable workspace pilot, spec 006 T001–T009, split from #83 so it can be reviewed and merged on its own.
Stack (H51:b, draft, each PR based on its parent): this PR → #83 shell policy, #89 contract record, #86 / #87 follow-ups.
mainwith no merge commits. The out-of-scope orchestrator adapter proposal moved to its own PR.docs/exec-plans/active/installable-pilot.md.Not yet: independent re-review of this exact head is running, and
make checkon this head has not run. Draft until both are green.🤖 Generated with Claude Code