diff --git a/docs/TEST_INTEGRITY.md b/docs/TEST_INTEGRITY.md index 7a04bea..e37eaaa 100644 --- a/docs/TEST_INTEGRITY.md +++ b/docs/TEST_INTEGRITY.md @@ -1,5 +1,102 @@ # Test Integrity Notes +## 2026-10-03 — Current unread inbox startup mitigation + +```yaml +test_integrity_note: + change_type: new_tests + scenarios: + - id: SCN-fleet-startup-inbox + given: "Manager and specialist each have 102 unread handoffs, exceeding the legacy default history page" + when: "Fresh and resumed provider launch messages specify the current unread-inbox request and it is invoked through the registered identity-bound tool" + then: "Both launches name the correct identity and retrieve newer messages absent from default history, without acknowledging them or weakening authority; overflow coverage is explicitly uncertain" + observable_outcomes: + - "Actual provider launch arguments, registered MCP response, newest message identity and unchanged unread count" + determinism_controls: + - "Hermetic project/worktrees, increasing fixed clock and real local tool; no provider launches" + anti_cheat_rationale: + prevents: + - "Prompt-only proof that never exercises the actual inbox tool" + - "Claiming truncated history is complete or reading acknowledges a handoff" + relaxation: + did_relax_any_assertion: false + if_true_explain_spec_basis: "" +``` + +## 2026-10-03 — Audited one-day additional allowance + +```yaml +test_integrity_note: + change_type: new_tests + scenarios: + - id: SCN-runtime-continuation-day-override + given: "An exhausted owner-approved daily allowance and retained charged attempts" + when: "The owner approves a bounded current-UTC-day total and later pauses or the day rolls over" + then: "Extra work starts without resetting attempts; non-owner/invalid overrides refuse; pause persists; the following day uses the original daily cap" + observable_outcomes: + - "Actual launched count, charged attempts, remaining allowance, owner audit and next-day limit" + determinism_controls: + - "Hermetic project, fixed clock and controlled launch callback; no live provider or host scheduling" + anti_cheat_rationale: + prevents: + - "Erasing usage or permanently removing daily caps on an owner override" + - "Allowing a specialist to authorize extra budget or bypass pause" + relaxation: + did_relax_any_assertion: false + if_true_explain_spec_basis: "" +``` + +## 2026-10-03 — Owner-configured concurrency + +```yaml +test_integrity_note: + change_type: new_tests + scenarios: + - id: SCN-runtime-continuation-concurrency + given: "Seven eligible identities and an approved 48-turn daily cap" + when: "The owner raises concurrency to seven, starts a bounded controller, then pauses" + then: "Seven pending starts occur before completion; a tighter limit restricts candidates; invalid settings refuse; pause preserves cap, concurrency and charged attempts" + observable_outcomes: + - "Pending launch count, policy capacity, ledger attempts and refusal codes" + determinism_controls: + - "Hermetic Git repository, fixed clock, controlled promises and no provider calls" + anti_cheat_rationale: + prevents: + - "Treating sequential starts as concurrency or resetting usage on configuration" + - "Tick limits exceeding owner-approved policy" + relaxation: + did_relax_any_assertion: false + if_true_explain_spec_basis: "" +``` + +## 2026-10-03 — Visible automatic-work stops + +```yaml +test_integrity_note: + change_type: new_tests + scenarios: + - id: SCN-runtime-continuation-health + given: "An enabled pilot exhausts its daily attempt allowance" + when: "Observation reads the ledger, next UTC day, pause or malformed state" + then: "The exact stop and remaining allowance are visible without resetting or modifying state, and no timer/token qualification is fabricated" + - id: SCN-console-continuation-stop + given: "A daily cap stop and a specialist no-progress hold" + when: "Attention items are projected" + then: "The budget decision belongs to the owner, coordination belongs to the manager, and no fake approval action or automatic budget increase is offered" + observable_outcomes: + - "Live snapshot health, byte-identical ledger and owner/manager attention routing" + determinism_controls: + - "Hermetic repository, fixed UTC clock, injected executor and plain snapshot fixtures" + anti_cheat_rationale: + prevents: + - "Silent budget exhaustion disguised as healthy idle" + - "Resetting a ledger to make work appear available" + - "Treating declared policy as a verified running timer or measured usage" + relaxation: + did_relax_any_assertion: false + if_true_explain_spec_basis: "" +``` + ## 2026-10-03 — Rolling continuation and bounded no-progress escalation ```yaml diff --git a/docs/TODO.md b/docs/TODO.md index 371be8c..e7a205d 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -2,6 +2,17 @@ ## Current owner priority: reliability first (2026-10-03 UTC) +End-to-end repair qualification is still open. Runtime reported exact converged +candidate `d2d9845` with four fresh native check PASS receipts; QA independent +acceptance is not yet recorded. Owner source fixes cover guarded presence, +rolling/fair dispatch, no-progress escalation and visible daily-cap stops. The +first automatic allowance of 12 turns was exhausted; any increase needs an +explicit owner choice, not a manual-start bypass. Next dispatch should prioritize +QA's exact verdict/support decisions, Release's declared-inventory consumer +decision, safe Kernel/Work composition and actual Console implementation. +Require evidence of specialist work, independent review/checks, serialized +integration and next-work continuation before calling the autonomous loop ready. + Live all-fleet resume exposed a new urgent proposal: `TASK-d95e72d0-816d-4fc2-acaf-b73642fd4881` — refill continuation capacity when individual turns exit instead of waiting for the longest batch member. diff --git a/docs/spec_changes/2026-10-03-continuation-concurrency.md b/docs/spec_changes/2026-10-03-continuation-concurrency.md new file mode 100644 index 0000000..606b0ee --- /dev/null +++ b/docs/spec_changes/2026-10-03-continuation-concurrency.md @@ -0,0 +1,16 @@ +# Owner-configured continuation concurrency + +The owner can configure `torch continuation enable --concurrency 7 --yes`. +The default remains three; valid settings are integers from one through seven. +An explicit tick `--limit` may tighten but never exceed the approved policy. +Each refill reads current policy; lowering capacity does not cancel active turns. +Omitted configuration fields preserve the approved daily cap and concurrency. +Configuration never resets the attempt ledger or bypasses physical identity guards. + +An already-running older controller cannot hot-load this change. Replace its +timer, not its active service, and allow its native turns and controller lock to +finish before the new controller takes over. No concurrent controllers may +dispatch through the same project lock. + +Scenario SCN-runtime-continuation-concurrency proves seven simultaneous pending +starts, tighter tick limits, invalid-policy refusal and preserved usage on pause. diff --git a/docs/spec_changes/2026-10-03-daily-continuation-override.md b/docs/spec_changes/2026-10-03-daily-continuation-override.md new file mode 100644 index 0000000..2807910 --- /dev/null +++ b/docs/spec_changes/2026-10-03-daily-continuation-override.md @@ -0,0 +1,14 @@ +# One-day continuation allowance override + +An explicit owner decision can grant a higher bounded total for the current UTC +day using `torch continuation enable --today-max-turns 96 --yes`. +The override total includes turns already charged; it never erases usage. +The ordinary daily cap (1–48) remains unchanged. The override ceiling is 96. +At UTC midnight the override ceases to apply without a scheduled reset write. +Owner-only audited configuration, seven-slot concurrency, identity guards, +pause, unknown-outcome protection and all verification boundaries remain intact. +Omitting the override argument preserves its existing same-day decision. +This is a turn allowance, not a measured token, subscription-credit or cost limit. + +SCN-runtime-continuation-day-override checks actual extra dispatch, preserved +charges, authorization/range refusals, pause and automatic next-day expiry. diff --git a/docs/spec_changes/2026-10-03-rolling-continuation.md b/docs/spec_changes/2026-10-03-rolling-continuation.md index 3f48e19..e495d46 100644 --- a/docs/spec_changes/2026-10-03-rolling-continuation.md +++ b/docs/spec_changes/2026-10-03-rolling-continuation.md @@ -14,4 +14,10 @@ Status exposes occupied guard identities and no-progress holds. Installed releas Eligible identities are ordered least-recently-dispatched within the current UTC day, with the Manager first only on ties. A repeatedly revised specialist task must not consume every freed slot while an eligible peer has never started. +## Visible operating stops + +The read-only project observation includes the automatic-turn budget, remaining attempts, exact pause/cap stop, retained capacity guards and current no-progress holds. It never resets the ledger, changes authority or treats declared policy as verified timer installation. No-progress holds are displayed only while the same active task IDs/revisions remain; resolved or revised tasks do not retain stale alerts. + +An exhausted automatic allowance appears as an owner policy decision in Overview and as an explicit Fleet status line. Manager-owned no-progress waits remain with the Manager, rather than being falsely routed to the owner. There is no fabricated approval button or silent allowance increase. Manual owner turns are not included in this ledger; token/cost governance remains unknown. + Deterministic acceptance scenarios and anti-cheat notes are in docs/TEST_INTEGRITY.md. Independent live qualification remains necessary; do not close broader event-driven or persistent-operations umbrellas based on this source fix alone. diff --git a/docs/spec_changes/2026-10-03-startup-unread-mitigation.md b/docs/spec_changes/2026-10-03-startup-unread-mitigation.md new file mode 100644 index 0000000..103b76c --- /dev/null +++ b/docs/spec_changes/2026-10-03-startup-unread-mitigation.md @@ -0,0 +1,15 @@ +# Explicit unread inbox on startup and resume + +Legacy `torch_read_messages` defaults to the oldest 100 historical messages. +Observed native inboxes exceeded 100 unread messages during fleet supervision. +Launch/resume now explicitly requests the bound identity's unread inbox with a +limit of 1000 and explains chronological order, potential overflow and deliberate +acknowledgements. This uses the existing tool without changing its API contract. + +This mitigation does not implement pagination, newest-first history, coherent +cross-query observation, or complete overflow detection. Those remain in the +existing unread-first inbox task. A result of 1000 is explicitly uncertain, +not a complete-inbox claim. No permissions follow from reading a message. + +SCN-fleet-startup-inbox exercises the actual fresh/resume launch arguments and +registered identity-bound inbox tool against messages beyond the default page. diff --git a/reports/audit/fleet-arbiter-checkpoint-2026-10-03.md b/reports/audit/fleet-arbiter-checkpoint-2026-10-03.md new file mode 100644 index 0000000..d9e6f29 --- /dev/null +++ b/reports/audit/fleet-arbiter-checkpoint-2026-10-03.md @@ -0,0 +1,70 @@ +# Fleet arbiter checkpoint — 2026-10-03, 05:58 UTC + +## Outcome + +The owner-approved blocker-clearing directive produced concrete component +commits and exact QA contributor consent. No new verified fleet landing has +been established in this checkpoint. Automatic usage reached the approved +48-turn cap; no additional provider turns were started or budget increased. + +## Decisions and evidence + +- Work committed its read-only convergence component at + `7e0734ae90314b6182046b1d813efd40b453743f`. +- Release committed read-only CLI routing at + `dd77b7015e5d34851725237d6f424babccf7f7d4`. +- QA message `c3f7ac15-5d40-4f85-a27b-6d5837b141a9` approved the exact + compact-card source/test contribution. Actual browser capability remains + unavailable in those native sessions; this is not visual acceptance. +- Arbiter directive `8865db38-a077-4935-a154-7b566d65aa44` authorized + source-only isolated composition without managed-branch convergence or + integration. Corresponding directives were persisted for all implementers. + +## Concrete compatibility failure + +A detached checkout at canonical +`7e3d333c5467c15d72be950f1fac9c3cd5439aee` was created at +`/tmp/torch-readonly-composition-EirOji/candidate`. Applying exactly Kernel +`18ccb0890d93c8a01e2c2d96db775b1ec14fe973` with `cherry-pick -x` produced +content conflicts in `src/control-plane/service.mjs`. Composition stopped; +Work and Release components were not applied, and no composed test PASS is +claimed. The conflicted detached checkout is retained as diagnostic evidence. +Canonical and managed agent checkouts were not altered by this operation. + +The conflicts expose future schema-v3/reservation prerequisites absent from +canonical, which initializes schema version 2. The reader requires +`runtime_launch_reservations`, and its branch-local refusal scenario treats +version 2 as incompatible. Pulling the entire future branch would therefore +broaden this narrow current-branch unblock into an architecture upgrade. + +The existing Kernel reader tests passed 2/2 on the Kernel branch under hermetic +fixtures (`/tmp/torch-reader-component-review-20261003.log`). This is source +review evidence only: it does not establish canonical compatibility, composed +CLI behavior, operational receipts, independent QA, or installed qualification. + +## Next bounded action + +Kernel should supply a current-canonical-compatible reader slice without +future reservation APIs, schema migration or live writer initialization. QA +must approve strict version-relative refusal scenarios, not weaken assertions. +Immutable SQLite observation also needs a demonstrated consistent snapshot or +fail-closed behavior under concurrent writers, not only a sidecar precheck. +Correction request `34a90b11-a64d-4ed7-a7ae-cf2ba8ef46f2` and corresponding +manager/peer requests preserve the exact evidence and composition boundary. + +## Controller handoff + +The old three-slot controller drained without termination. At 05:57:52 UTC, +the replacement seven-slot worker ran, obtained the released controller lock, +and returned `daily-turn-cap` with `launched: []`. This verifies a cap-preserving +handoff, not seven concurrent native workers or reboot persistence. The +replacement timer remains configured; the ledger was not reset. + +## Remaining gates + +Current-base compatible composition, strict composed CLI scenarios, exact +source gates, independent QA, guarded serialized integration and next-work +continuation remain open. Native execution cannot continue today without an +explicit new budget decision; the existing policy resets its daily allowance +at UTC midnight. No deployment, installed-runtime upgrade, live DDL, authority +expansion or completion assertion follows from this checkpoint. diff --git a/site/attention-projection.js b/site/attention-projection.js index 1808af1..5d32ad2 100644 --- a/site/attention-projection.js +++ b/site/attention-projection.js @@ -16,6 +16,18 @@ function attentionGroups(snapshot) { const agentName = (id) => agents.get(id)?.title ?? id ?? 'Owner not recorded'; const add = (group, item) => groups[group].push(item); const approvals = (snapshot.approvalRequests?.items ?? []).filter((approval) => approval.status === 'pending'); + const continuation = snapshot.continuation; + if (continuation?.available && continuation.stopReason === 'daily-turn-cap') add('owner', { + tone: 'decision', title: 'Automatic fleet work stopped at its daily limit', owner: 'Project owner', + detail: 'No additional automatic agent turns can start today unless you explicitly change the limit. Existing turns may finish; idle does not mean all work is done.', + evidence: `${continuation.attempts}/${continuation.maxTurnsPerDay} automatic attempts · UTC day ${continuation.day} · not measured token/cost usage`, + href: '#fleet', action: 'Review continuation policy', decisionApprovalId: null, + }); + for (const hold of continuation?.held ?? []) add('fleet', { + tone: 'review', title: `${agentName(hold.areaId)} needs a concrete coordination decision`, owner: agentName('session-manager'), + detail: 'Two completed turns left the assigned task state unchanged. Unchanged-work retries are held; inspect evidence and resolve the actual blocker rather than restarting blindly.', + evidence: hold.areaId, href: '#communications', action: 'Open coordination messages', requestOwner: 'session-manager', + }); const advisory = []; const recheckCodes = new Set(['BACKLOG_OBSERVED_COMMIT_STALE', 'BACKLOG_OBSERVED_COMMIT_MISSING']); diff --git a/site/console.html b/site/console.html index 4af0f6e..23cd5b8 100644 --- a/site/console.html +++ b/site/console.html @@ -183,6 +183,7 @@

Persistent identities

Fleet and ownership

Session state from latest observation
+

Reading automatic continuation policy…

Sessions

One context per identity
diff --git a/site/console.js b/site/console.js index c82d85d..bf85713 100644 --- a/site/console.js +++ b/site/console.js @@ -1039,6 +1039,12 @@ function renderAttention(groups) { } function render(snapshot) { + const continuation = snapshot.continuation; + setText('#continuation-status', continuation?.available + ? `Automatic turns: ${continuation.attempts}/${continuation.maxTurnsPerDay} used today (UTC); ${continuation.remainingTurns} left. ${continuation.dailyOverride?.day === continuation.day ? `Owner-approved extra allowance expires at UTC midnight; normal daily cap ${continuation.configuredMaxTurnsPerDay}. ` : ''}Concurrency policy: up to ${continuation.maxConcurrency ?? 3}. ${continuation.stopReason === 'daily-turn-cap' + ? 'No further automatic starts: the owner-controlled daily cap is reached. Running turns may finish.' + : continuation.stopReason === 'paused' ? 'Owner policy is paused; no new automatic starts.' : 'Policy permits new eligible turns; this does not verify timer installation.'} ${continuation.held?.length ?? 0} unchanged-work hold(s) need Manager coordination. This is not measured token or cost usage.` + : 'Automatic continuation policy is unavailable; do not assume the fleet can start more work.'); const project = snapshot.project ?? snapshot.repository; const agents = snapshot.agents ?? []; const tasks = snapshot.backlog ?? []; diff --git a/src/cli.mjs b/src/cli.mjs index 6a169fc..98cc0a0 100644 --- a/src/cli.mjs +++ b/src/cli.mjs @@ -98,7 +98,7 @@ Usage: torch setup [--parent ] [--dry-run] [--yes] [--json] torch up [--fresh] [--only ] [--dry-run] [--yes] [--json] torch recover-runtime --area --unit --invocation [--expected-session --expected-updated-at