From aec80b10a9a3d579a85578a55113d3b5208d803a Mon Sep 17 00:00:00 2001 From: garrytan Date: Sun, 1 Nov 2026 18:31:33 +0000 Subject: [PATCH] gstack-autoplan: shadow every published gate, the shadow export, config and docs Every driver command that prints a gate records the shadow first and checkpoints after it; answer waits for a live lease and records a dead one retrospectively; gstack-autoplan shadow exports answered revisions for taste-replay R2 (SHADOW_BEFORE_ANSWER otherwise); gstack-config autoplan_shadow / autoplan_shadow_model; gstack-artifact validate checks the record's hash (GST-537 PR 3). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- bin/gstack-artifact | 5 +- bin/gstack-autoplan | 171 +++++++---- bin/gstack-config | 23 +- bin/gstack-doctor-components.sh | 1 + docs/troubleshooting.md | 13 + docs/unattended.md | 86 +++++- lib/autoplan-shadow-reader.ts | 122 ++++++++ lib/result-codes-autoplan.ts | 8 +- test/autoplan-shadow-driver.test.ts | 402 +++++++++++++++++++++++++ test/autoplan-shadow.test.ts | 1 + test/fixtures/module-size-ratchet.json | 1 + 11 files changed, 769 insertions(+), 64 deletions(-) create mode 100644 lib/autoplan-shadow-reader.ts create mode 100644 test/autoplan-shadow-driver.test.ts diff --git a/bin/gstack-artifact b/bin/gstack-artifact index 9cef77cfb..2a8f77af5 100755 --- a/bin/gstack-artifact +++ b/bin/gstack-artifact @@ -22,6 +22,7 @@ import { import { resultLine } from '../lib/result-codes'; import { resolveStateRoot } from '../lib/state-root'; import { validatePublic } from '../lib/autoplan-public'; +import { validateShadow } from '../lib/autoplan-shadow-reader'; const HELP = `gstack-artifact — the unattended artifact contract (docs/unattended.md) @@ -86,7 +87,9 @@ function main(argv: string[]): number { else { printErrors(errors); process.stdout.write(errors.length ? `ARTIFACT_INVALID: ${errors.length} error(s)\n` : `ARTIFACT_VALID: ${as} ${path.basename(file)}\n`); } return errors.length ? EXIT.fail : EXIT.ok; } - const result = validateRun(file); + const run = validateRun(file); + const shadow = validateShadow(run.runDir); + const result = { ...run, valid: run.valid && shadow.length === 0, errors: [...run.errors, ...shadow] }; if (json) { process.stdout.write(JSON.stringify({ valid: result.valid, run: result.manifest?.run ?? null, status: result.manifest?.status ?? null, run_dir: result.runDir, attested: result.attested ?? 0, errors: result.errors }) + '\n'); } else { diff --git a/bin/gstack-autoplan b/bin/gstack-autoplan index a4e43b520..0cf6428ca 100755 --- a/bin/gstack-autoplan +++ b/bin/gstack-autoplan @@ -21,6 +21,7 @@ * gstack-autoplan budget --out [--spend-cap ] [--max-rounds ] --by > the owner's journaled cap change * gstack-autoplan check --out --attempt --result --model | --unavailable the delta check before a carry * gstack-autoplan checkpoints --from list checkpoint generations, newest first, with hash ok|bad + * gstack-autoplan shadow --out | --runs [--json] export answered gates beside their shadow predictions (read-only) * gstack-autoplan contract print the coordinator contract every lane prompt inherits (plan E2) * * Logic: lib/autoplan-run.ts (next/submit/resume), lib/autoplan-gate.ts (close, gate, answer), @@ -52,6 +53,8 @@ import { createRunner, familyConflict, type RunnerId } from '../lib/outside-voic import { resultLine } from '../lib/result-codes'; import { release } from '../lib/spend-ledger'; import { COORDINATOR_CONTRACT } from '../lib/coordinator-contract'; +import { claimShadow, runShadow, shadowBeforeAnswer, shadowSwitch, type ShadowClaim, type ShadowOutcome } from '../lib/autoplan-shadow'; +import { exportShadow, renderShadowExport } from '../lib/autoplan-shadow-reader'; const HELP = `gstack-autoplan — unattended /autoplan: next/submit loop, answer, resume (docs/unattended.md) DRIVER: ${driverFile()} @@ -95,6 +98,14 @@ DRIVER: ${driverFile()} bind the one-reviewer delta check a CARRY_CHECK: line asked for: nothing at High or above carries the owner's last answer (CARRIED:); otherwise, or when unavailable, the gate goes to the owner as before checkpoints --from list checkpoint generations, newest first: run, gate_rev, time, hash ok|bad, current + shadow --out | --runs [--json] + read-only export for taste-replay R2: one row per item of each answered gate revision, its shadow prediction + (recorded before the answer; status recorded, malformed, failed, missing, retrospective or off) beside the + owner's answer and how he gave it; counts by status, item class, owner_mode and ceo_eligible. An unanswered or + interrogated revision refuses SHADOW_BEFORE_ANSWER, a CEO-only run CEO_ONLY_NO_GATE. --runs: one run dir per line. + Shadow mode itself is off by default: gstack-config set autoplan_shadow on (or GSTACK_AUTOPLAN_SHADOW=1) at the + first next; each gate then gets one hidden model call (autoplan_shadow_model, default claude-opus-5-5) counted + against --spend-cap, and every command that prints a gate prints SHADOW: first close --out --phase

--deferred "" --by > close the phase accepted-with-findings: open voices skipped (dispatched attempts settle unknown at their reservation), open findings into tasks.jsonl; Critical, urgent and user-challenge findings become gate items @@ -138,7 +149,7 @@ function nextLine(state: RunState, out: string): string { * Admission, then under the run lock: bring an existing run forward (GSTACK_VERSION_CHANGED, legacy decision ids) * and record an admission override as a deviation. Notices go to stdout before the command's own lines (stderr with --json). */ -function mutating(out: string, json: boolean, fn: () => number): number { +function mutating(out: string, json: boolean, fn: () => number | Report): number | Report { const admission = admit(process.env); touchInstallLease(process.env); return withRunLock(out, () => { @@ -155,13 +166,48 @@ function mutating(out: string, json: boolean, fn: () => number): number { notices.push(...migrated.lines); } if (notices.length) (json ? process.stderr : process.stdout).write(notices.join('\n') + '\n'); - const code = fn(); + const result = fn(); if (admission.deviation && fs.existsSync(path.join(out, FILES.run))) { const state = readState(out); if (record(state)) writeState(state); } - if (code === EXIT.ok) checkpointQuietly(out); - return code; + if (typeof result !== 'number') return claimed(out, result); + if (result === EXIT.ok) checkpointQuietly(out); + return result; }); } +/** + * What a command that can leave a gate reports: the lines before the gate, the lines after it, and its JSON payload. + * `publish` puts the SHADOW line and the gate lines between them once the shadow has run (lib/autoplan-shadow.ts). + */ +interface Report { head: string[]; tail: string[]; payload: Record; gate: boolean; claim?: ShadowClaim; claimLine?: string } + +/** Still under the command's run lock: a report at a gate claims its shadow (the checkpoint waits for publish); any other checkpoints now. */ +function claimed(out: string, r: Report): Report { + if (!r.gate) { checkpointQuietly(out); return r; } + try { const c = claimShadow(out); return { ...r, claim: c.claim, claimLine: c.line }; } + catch (e: any) { return { ...r, claimLine: `SHADOW: failed internal (${e?.message ?? e}); the gate stands` }; } +} + +const shadowField = (o: ShadowOutcome | undefined, line: string | undefined) => (o ? { shadow: { status: o.status, ...(o.code ? { code: o.code } : {}), ...(o.model ? { model: o.model } : {}), ...(o.usd !== undefined ? { usd: o.usd } : {}) } } : line ? { shadow: { line } } : {}); + +/** + * The one gate-publication step every command that prints a gate shares (next, submit, close, resume, revise, run, check): + * after the locked step, run the claimed shadow with no lock held, then print SHADOW, the gate and its cost, then + * checkpoint, so a checkpoint taken at a gate holds its shadow record. A shadow failure never fails the command. + */ +async function publish(out: string, json: boolean, r: number | Report): Promise { + if (typeof r === 'number') return r; + const outcome = r.claim ? await runShadow(out, r.claim) : undefined; + const line = outcome?.line ?? r.claimLine; + const state = r.gate ? readState(out) : undefined; + emit(json, [...r.head, ...(line ? [line] : []), ...(state ? gateLines(state, out) : []), ...r.tail], { ...r.payload, ...(state ? gateCostField(state, out) : {}), ...shadowField(outcome, line) }); + if (r.gate) gateCheckpoint(out); + return EXIT.ok; +} +function gateCheckpoint(out: string): void { + try { withRunLock(out, () => checkpointQuietly(out), { waitMs: 30_000 }); } + catch (e: any) { process.stderr.write(`CHECKPOINT: skipped for ${out}: ${e instanceof RunError ? `${e.detail} (${e.code})` : e?.message ?? e}; the command's result stands\n`); } +} + /** Set by a command whose success is a checkpoint moment beyond rest: a bound voice, a phase transition, the first next. */ let moment: CheckpointMoment | undefined; @@ -180,7 +226,7 @@ function emit(json: boolean, lines: string[], payload: Record): else process.stdout.write(lines.join('\n') + '\n'); } -function doNext(out: string, rest: string[], json: boolean): number { +function doNext(out: string, rest: string[]): Report { const cwd = process.cwd(); const initLines: string[] = []; const fresh = !fs.existsSync(path.join(out, FILES.run)); @@ -194,20 +240,18 @@ function doNext(out: string, rest: string[], json: boolean): number { if (maxRounds !== undefined && (!Number.isInteger(maxRounds) || maxRounds < 1)) throw new RunError('ARTIFACT_SCHEMA', '--max-rounds needs an integer >= 1', 1); const carryCheckCapUsd = num(rest, '--carry-check-cap'); if (carryCheckCapUsd !== undefined && !(carryCheckCapUsd >= 0)) throw new RunError('ARTIFACT_SCHEMA', '--carry-check-cap needs a number >= 0', 1); + const shadow = shadowSwitch({ outsideEnabled: !rest.includes('--no-outside'), ceoOnly }, process.env); + if (shadow.line) initLines.push(shadow.line); initRun({ plan, out, cwd, planHeading: flag(rest, '--plan-heading'), outsideEnabled: !rest.includes('--no-outside'), spendCap: num(rest, '--spend-cap') ?? null, maxRounds, - carryForward: !rest.includes('--no-carry-forward'), carryCheckCapUsd, ceoOnly, + carryForward: !rest.includes('--no-carry-forward'), carryCheckCapUsd, ceoOnly, shadow: shadow.shadow, deadlineMin: num(rest, '--deadline'), light: rest.includes('--light'), scaffold: rest.includes('--scaffold'), scope: { ui, developerTool: rest.includes('--developer-tool'), agentPrimary: rest.includes('--agent-primary'), dx: rest.includes('--no-dx') ? false : undefined, ...(rest.includes('--docs-only') ? { docsOnly: true } : {}) } }, initLines); } const redispatch = rest.flatMap((a, i) => (a === '--redispatch' && rest[i + 1] ? [rest[i + 1]!] : [])); const r = nextStep({ out, cwd, estimateUsd: num(rest, '--estimate-usd'), redispatch }); moment = fresh ? 'init' : r.attempts.some(a => a.new) || r.lines.some(l => l.startsWith('PHASE_DEFERRED: ')) ? 'transition' : undefined; const status = r.state.status; - const lines = [...initLines, ...r.lines]; - if (status === 'gate_pending') lines.push(...gateLines(r.state, out)); - if (status === 'running') lines.push(`NEXT: gstack-autoplan next --out ${out}`); - lines.push(resultLineFor(status, out)); - emit(json, lines, { run: r.state.run, status, phase: r.phase ?? null, attempts: r.attempts, gate_rev: r.state.gate_rev ?? null, ...gateCostField(r.state, out), out }); - return EXIT.ok; + return { head: [...initLines, ...r.lines], tail: [...(status === 'running' ? [`NEXT: gstack-autoplan next --out ${out}`] : []), resultLineFor(status, out)], gate: status === 'gate_pending', + payload: { run: r.state.run, status, phase: r.phase ?? null, attempts: r.attempts, gate_rev: r.state.gate_rev ?? null, out } }; } /** The gate pointer, its cost so far and the price of `rec` (lib/autoplan-gate-cost.ts), plus the owner-facing render to relay under Capy (lib/captain-brief.ts). */ @@ -228,7 +272,7 @@ function gateCostField(state: RunState, out: string): Record { return cost ? { gate_cost: gateCostPayload(cost) } : {}; } -function doSubmit(out: string, rest: string[], json: boolean): number { +function doSubmit(out: string, rest: string[]): number | Report { const phase = flag(rest, '--phase'); const voice = flag(rest, '--voice'); const result = flag(rest, '--result'); const record = flag(rest, '--record'); const model = flag(rest, '--model'); const attempt = flag(rest, '--attempt'); const unavailable = flag(rest, '--unavailable'); const failed = flag(rest, '--failed'); if (!phase || !voice) return usage('submit needs --phase and --voice'); @@ -240,28 +284,22 @@ function doSubmit(out: string, rest: string[], json: boolean): number { const r = submitResult({ out, phase, voice, result: result ? path.resolve(result) : undefined, record: record ? path.resolve(record) : undefined, model, attempt, attest: flag(rest, '--attest'), unavailable, failed, runner: flag(rest, '--runner'), usageUsd: num(rest, '--usage-usd'), reconcile: flag(rest, '--reconcile'), cwd: process.cwd() }); const status = r.state.status; - const lines = [...r.lines]; - if (status === 'gate_pending') lines.push(...gateLines(r.state, out)); - if (status === 'running') lines.push(`NEXT: gstack-autoplan next --out ${out}`); - lines.push(resultLineFor(status, out)); - emit(json, lines, { run: r.state.run, status, phase, voice, attempt: r.state.phases[phase]?.[voice]?.attempt ?? attempt ?? null, closed: r.closed, findings: r.findings, gate_rev: r.state.gate_rev ?? null, ...gateCostField(r.state, out), out }); - return EXIT.ok; + return { head: [...r.lines], tail: [...(status === 'running' ? [`NEXT: gstack-autoplan next --out ${out}`] : []), resultLineFor(status, out)], gate: status === 'gate_pending', + payload: { run: r.state.run, status, phase, voice, attempt: r.state.phases[phase]?.[voice]?.attempt ?? attempt ?? null, closed: r.closed, findings: r.findings, gate_rev: r.state.gate_rev ?? null, out } }; } -function doRevise(out: string, rest: string[], json: boolean): number { +function doRevise(out: string, rest: string[]): number | Report { const plan = flag(rest, '--plan'); const incorporates = listFlag(rest, '--incorporates'); const withdraw = listFlag(rest, '--withdraw'); const settle = listFlag(rest, '--settle'); if (!plan && !withdraw.length && !settle.length) return usage('revise needs --plan (and optionally --incorporates ), --withdraw or --settle '); if (!plan && incorporates.length) return usage('--incorporates binds accepted changes to a revised plan: pass --plan '); refuseCeoOnly(readState(out), 'revise'); const r = reviseRun({ out, plan: plan ? path.resolve(plan) : undefined, incorporates, withdraw, settle, cwd: process.cwd() }); - const lines = [...r.lines]; - if (r.state.status === 'running' || r.state.status === 'amend_pending') lines.push(nextLine(r.state, out)); - lines.push(resultLineFor(r.state.status, out)); - emit(json, lines, { run: r.state.run, status: r.state.status, reopened: r.reopened, amendments: pendingAmendments(r.state).map(a => a.decision), gate_rev: r.state.gate_rev ?? null, out }); - return EXIT.ok; + const tail = [...(r.state.status === 'running' || r.state.status === 'amend_pending' ? [nextLine(r.state, out)] : []), resultLineFor(r.state.status, out)]; + return { head: [...r.lines], tail, gate: r.state.status === 'gate_pending', + payload: { run: r.state.run, status: r.state.status, reopened: r.reopened, amendments: pendingAmendments(r.state).map(a => a.decision), gate_rev: r.state.gate_rev ?? null, out } }; } -function doClose(out: string, rest: string[], json: boolean): number { +function doClose(out: string, rest: string[]): number | Report { const phase = flag(rest, '--phase'); const reason = flag(rest, '--deferred'); const by = flag(rest, '--by'); if (!phase || !reason?.trim()) return usage('close needs --phase

--deferred "" --by >'); if (by === undefined || !ANSWERED_BY_RE.test(by)) throw new RunError('ANSWER_BY_REQUIRED', `close records who deferred the phase: pass --by human or --by agent: (got ${JSON.stringify(by ?? null)})`, 3); @@ -273,25 +311,22 @@ function doClose(out: string, rest: string[], json: boolean): number { const r = closeDeferred(state, phase as Phase, { reason: reason.trim(), by, cause: 'owner' }); moment = 'transition'; const lines = [...r.lines, ...(stopped ? liftStop(state, `${phase} closed deferred by ${by}`) : [])]; - if (!currentPhase(state)) lines.push(...finishRun(state), ...(state.status === 'gate_pending' ? gateLines(state, out) : [])); + if (!currentPhase(state)) lines.push(...finishRun(state)); else { state.status = 'running'; lines.push(`NEXT: gstack-autoplan next --out ${out}`); } writeState(state); - lines.push(resultLineFor(state.status, out)); - emit(json, lines, { run: state.run, status: state.status, phase, blockers: r.blockers, gate_rev: state.gate_rev ?? null, ...gateCostField(state, out), out }); - return EXIT.ok; + return { head: lines, tail: [resultLineFor(state.status, out)], gate: state.status === 'gate_pending', payload: { run: state.run, status: state.status, phase, blockers: r.blockers, gate_rev: state.gate_rev ?? null, out } }; } /** `check`: the delta reviewer's verdict before a carry (lib/autoplan-carry.ts). */ -function doCheck(out: string, rest: string[], json: boolean): number { +function doCheck(out: string, rest: string[]): number | Report { const unavailable = flag(rest, '--unavailable'); const result = flag(rest, '--result'); if (unavailable === undefined && (!result || !flag(rest, '--model'))) return usage('check needs --attempt and --result --model , or --unavailable ""'); const r = submitCarryCheck({ out, attempt: flag(rest, '--attempt'), result: result ? path.resolve(result) : undefined, model: flag(rest, '--model'), unavailable, sameFamily: flag(rest, '--same-family') }); moment = 'transition'; const status = r.state.status; - const lines = [...r.lines, ...(status === 'gate_pending' ? gateLines(r.state, out) : []), ...(status === 'amend_pending' || status === 'running' ? [nextLine(r.state, out)] : []), resultLineFor(status, out)]; - emit(json, lines, { run: r.state.run, status, gate_rev: r.state.gate_rev ?? null, carry: r.state.carry ?? null, out }); - return EXIT.ok; + return { head: [...r.lines], tail: [...(status === 'amend_pending' || status === 'running' ? [nextLine(r.state, out)] : []), resultLineFor(status, out)], gate: status === 'gate_pending', + payload: { run: r.state.run, status, gate_rev: r.state.gate_rev ?? null, carry: r.state.carry ?? null, out } }; } function doBudget(out: string, rest: string[], json: boolean): number { @@ -313,13 +348,18 @@ async function doRun(out: string, rest: string[], json: boolean): Promise doNext(out, rest, true)); - if (code !== EXIT.ok) return code; + const step = withRunLock(out, () => { const r = doNext(out, rest); return r.gate ? claimed(out, r) : r; }); const state = readState(out); if (state.status !== 'awaiting_result') { - if (!json) process.stdout.write([...statusLines(state), ...(state.status === 'gate_pending' ? gateLines(state, out) : [])].join('\n') + '\n'); - process.stdout.write(resultLineFor(state.status, out) + '\n'); return EXIT.ok; + const outcome = step.claim ? await runShadow(out, step.claim) : undefined; + const line = outcome?.line ?? step.claimLine; + const at = readState(out); + emit(true, [], { ...step.payload, ...gateCostField(at, out), ...shadowField(outcome, line) }); + if (!json) process.stdout.write([...statusLines(at), ...(line ? [line] : []), ...(at.status === 'gate_pending' ? gateLines(at, out) : [])].join('\n') + '\n'); + if (step.gate) gateCheckpoint(out); + process.stdout.write(resultLineFor(at.status, out) + '\n'); return EXIT.ok; } + emit(true, [], step.payload); const phase = state.phase_order.find(p => state.phases[p]?.snapshot && !state.phases[p]?.closed_at)!; for (const voice of ['native', 'outside'] as const) { const v = state.phases[phase]![voice]!; @@ -341,12 +381,24 @@ async function doRun(out: string, rest: string[], json: boolean): Promise doSubmit(out, ['--phase', phase, '--voice', voice, '--result', `${open.result}.raw`, '--model', res.model ?? (voice === 'native' ? nativeModel : outsideModel), '--attempt', open.attempt, '--runner', res.runner], true)); + const bound = withRunLock(out, () => doSubmit(out, ['--phase', phase, '--voice', voice, '--result', `${open.result}.raw`, '--model', res.model ?? (voice === 'native' ? nativeModel : outsideModel), '--attempt', open.attempt, '--runner', res.runner])); + if (typeof bound !== 'number') emit(true, [], bound.payload); } } return EXIT.fail; } +/** `shadow`: the read-only export for taste-replay R2 (lib/autoplan-shadow-reader.ts). */ +function doShadow(rest: string[], json: boolean): number { + const runs = flag(rest, '--runs'); const one = flag(rest, '--out'); + if (!runs === !one) return usage('shadow needs --out or --runs (one run directory per line)'); + const dirs = runs ? fs.readFileSync(runs, 'utf8').split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#')).map(d => path.resolve(d)) : [path.resolve(one!)]; + const r = exportShadow(dirs); + for (const x of r.refused) process.stderr.write(resultLine('gstack-autoplan shadow', x.code, x.detail) + '\n'); + if (json) process.stdout.write(JSON.stringify(r) + '\n'); else process.stdout.write(renderShadowExport(r).join('\n') + '\n'); + return r.rows.length === 0 && r.refused.length ? EXIT.refused : EXIT.ok; +} + async function main(argv: string[]): Promise { const [cmd, ...rest] = argv; const json = rest.includes('--json'); @@ -359,15 +411,16 @@ async function main(argv: string[]): Promise { catch (e: any) { if (!(e instanceof RunError)) throw e; process.stderr.write(resultLine('gstack-autoplan checkpoints', e.code, e.detail) + '\n'); return EXIT.refused; } } const outFlag = flag(rest, '--out'); - if (!outFlag) return usage(`${cmd} needs --out

`); - const out = path.resolve(outFlag); + if (!outFlag && cmd !== 'shadow') return usage(`${cmd} needs --out `); + const out = path.resolve(outFlag ?? '.'); try { - if (cmd === 'next') return mutating(out, json, () => doNext(out, rest, json)); - if (cmd === 'submit') return mutating(out, json, () => doSubmit(out, rest, json)); - if (cmd === 'revise') return mutating(out, json, () => doRevise(out, rest, json)); - if (cmd === 'close') return mutating(out, json, () => doClose(out, rest, json)); - if (cmd === 'budget') return mutating(out, json, () => doBudget(out, rest, json)); - if (cmd === 'check') return mutating(out, json, () => doCheck(out, rest, json)); + if (cmd === 'shadow') return doShadow(rest, json); + if (cmd === 'next') return await publish(out, json, mutating(out, json, () => doNext(out, rest))); + if (cmd === 'submit') return await publish(out, json, mutating(out, json, () => doSubmit(out, rest))); + if (cmd === 'revise') return await publish(out, json, mutating(out, json, () => doRevise(out, rest))); + if (cmd === 'close') return await publish(out, json, mutating(out, json, () => doClose(out, rest))); + if (cmd === 'budget') return await publish(out, json, mutating(out, json, () => doBudget(out, rest, json))); + if (cmd === 'check') return await publish(out, json, mutating(out, json, () => doCheck(out, rest))); if (cmd === 'run') { const admission = admit(process.env); if (admission.lines.length) process.stdout.write(admission.lines.join('\n') + '\n'); return await doRun(out, rest, json); } if (cmd === 'status') { const state = readState(out); @@ -377,13 +430,11 @@ async function main(argv: string[]): Promise { if (cmd === 'resume') { const from = flag(rest, '--from'); const restored = from !== undefined ? restoreCheckpoint(from, out) : []; - return withRunLock(out, () => { + return await publish(out, json, withRunLock(out, () => { const r = resumeRun(out); - checkpointQuietly(out); - const lines = [...restored, ...r.lines, resultLineFor(r.state.status, out)]; - emit(json, lines, { run: r.state.run, status: r.state.status, execution_unknown: r.unknown, rebound: r.rebound, out }); - return EXIT.ok; - }, { steal: true }); + return claimed(out, { head: [...restored, ...r.lines], tail: [resultLineFor(r.state.status, out)], gate: r.state.status === 'gate_pending', + payload: { run: r.state.run, status: r.state.status, execution_unknown: r.unknown, rebound: r.rebound, out } }); + }, { steal: true })); } if (cmd === 'answer') { const rev = flag(rest, '--gate-rev'); const reply = flag(rest, '--reply'); const by = flag(rest, '--by'); @@ -392,7 +443,9 @@ async function main(argv: string[]): Promise { const replyFile = flag(rest, '--owner-reply-file'); const ownerFlag = flag(rest, '--owner-reply'); if (replyFile !== undefined && ownerFlag !== undefined) return usage('--owner-reply and --owner-reply-file are exclusive'); const ownerReply = replyFile !== undefined ? fs.readFileSync(replyFile, 'utf8') : ownerFlag === '-' ? fs.readFileSync(0, 'utf8') : ownerFlag; - return mutating(out, json, () => { + const shadowLines = await shadowBeforeAnswer(out); + if (shadowLines.length) (json ? process.stderr : process.stdout).write(shadowLines.join('\n') + '\n'); + return await publish(out, json, mutating(out, json, () => { const state = readState(out); refuseCeoOnly(state, 'answer'); const r = answerGate(state, Number(rev), reply, by, { recHash: flag(rest, '--rec-hash'), ownerReply }); @@ -402,19 +455,19 @@ async function main(argv: string[]): Promise { lines.push(resultLineFor(state.status, out)); emit(json, lines, { run: state.run, status: state.status, outcome: r.outcome, pending: r.pending, reopened: r.reopened, amendments: pendingAmendments(state).map(a => a.decision), gate_rev: state.gate_rev, out }); return EXIT.ok; - }); + })); } if (cmd === 'recommend') { const rev = flag(rest, '--gate-rev'); const item = flag(rest, '--item'); const option = flag(rest, '--option'); const basis = flag(rest, '--basis'); if (rev === undefined || !item || !option || !basis?.trim()) return usage('recommend needs --gate-rev --item --option --basis ""'); - return mutating(out, json, () => { + return await publish(out, json, mutating(out, json, () => { const state = readState(out); refuseCeoOnly(state, 'recommend'); const lines = recommendGate(state, Number(rev), item.toLowerCase(), option.toLowerCase(), basis.trim(), flag(rest, '--by') ?? 'parent'); writeState(state); emit(json, [...lines, resultLineFor(state.status, out)], { run: state.run, status: state.status, gate_rev: state.gate_rev, out }); return EXIT.ok; - }); + })); } if (cmd === 'export' && flag(rest, '--public') !== undefined) { return withRunLock(out, () => { @@ -425,7 +478,7 @@ async function main(argv: string[]): Promise { }); } if (cmd === 'export') { - return mutating(out, json, () => { + return await publish(out, json, mutating(out, json, () => { const state = readState(out); const pending = pendingAmendments(state).map(a => a.decision); if (state.status === 'complete' && pending.length) throw new RunError('PLAN_AMEND_PENDING', `run says complete with accepted changes not in the plan: ${pending.join(', ')}`, 3); @@ -434,7 +487,7 @@ async function main(argv: string[]): Promise { for (const w of r.warnings) process.stderr.write(`gstack-autoplan export: ${w}\n`); emit(json, [...r.files.map(f => `EXPORTED: ${f}`), dispatchLine(state)], { run: state.run, files: r.files, warnings: r.warnings, dispatches: state.dispatches, est_input_tokens: state.est_input_tokens }); return EXIT.ok; - }); + })); } if (cmd === 'release') { const attempt = flag(rest, '--attempt'); diff --git a/bin/gstack-config b/bin/gstack-config index 8992806e2..afd908913 100755 --- a/bin/gstack-config +++ b/bin/gstack-config @@ -221,6 +221,17 @@ CONFIG_HEADER='# gstack configuration — edit freely, changes take effect on ne # # /codex and /claude-code still run when you ask by name. # # An unreadable config counts as disabled. # # Invalid values preserve the old value. +# autoplan_shadow: off # Shadow mode for the CEO-only decider (gstack-autoplan +# # driver runs): on gives every gate one hidden model +# # prediction, recorded before the owner answers, for +# # taste-replay R2. Sends the reviewed plan and the gate +# # to that model on your own API key, about $0.07 per +# # gate, counted against --spend-cap. Read at the first +# # next of each run only. GSTACK_AUTOPLAN_SHADOW=1|0 +# # overrides. +# # Invalid values are rejected, the old value kept. +# autoplan_shadow_model: claude-opus-5-5 # The model the shadow decider runs on. +# # Docs: docs/unattended.md#shadow-mode # browse_extension_id: # Forks and self-built extensions: the 32-letter (a-p) # # Chrome extension ID the browse sidebar terminal accepts. # # Empty = the gstack extension. "" clears it. @@ -309,6 +320,8 @@ lookup_default() { explain_level) echo "default" ;; plan_mode_preamble) echo "on" ;; # on | off — off drops the plan-mode preamble on the next ./setup (#3168) codex_reviews) echo "enabled" ;; + autoplan_shadow) echo "off" ;; # on | off — autoplan shadow mode, fixed at each run's first next (lib/autoplan-shadow.ts) + autoplan_shadow_model) echo "claude-opus-5-5" ;; # the shadow decider's model; needs a lib/pricing.ts row and its family's API key design_detector) echo "auto" ;; # auto | off — impeccable engine pre-pass in the design skills design_detector_install_prompted) echo "false" ;; # true once the user answered the one-time engine install offer with "never ask again" gstack_contributor) echo "false" ;; @@ -961,6 +974,12 @@ $_gstack_legacy_root" echo "Error: memorable_recall '$VALUE' not recognized. Valid values: on, off. Existing value left unchanged." >&2 exit 1 fi + # autoplan_shadow is a CONSENT key: `on` sends each gate's plan to a model + # API. Reject like memorable_recall -- a typo must never flip it. + if [ "$KEY" = "autoplan_shadow" ] && [ "$VALUE" != "on" ] && [ "$VALUE" != "off" ]; then + echo "Error: autoplan_shadow '$VALUE' not recognized. Valid values: on, off. Existing value left unchanged." >&2 + exit 1 + fi # browse_extension_id (D1) decides which Chrome extension may reach the # browse daemon's token route and terminal socket. Reject anything that is # not a Chrome extension ID; "" clears the override. @@ -1093,7 +1112,7 @@ $_gstack_legacy_root" report_root_disagreement for KEY in proactive routing_declined telemetry auto_upgrade update_check update_channel \ skill_prefix explain_level plan_mode_preamble \ - codex_reviews gstack_contributor skip_eng_review workspace_root \ + codex_reviews autoplan_shadow autoplan_shadow_model gstack_contributor skip_eng_review workspace_root \ artifacts_sync_mode artifacts_sync_mode_prompted artifacts_sync_removals plan_tune_hooks \ timeline_stop_hook design_detector design_detector_install_prompted memorable_recall \ browse_extension_id ship_measure_rule_trials ship_measure_behavior_panels \ @@ -1118,7 +1137,7 @@ $_gstack_legacy_root" echo "# gstack-config defaults" for KEY in proactive routing_declined telemetry auto_upgrade update_check update_channel \ skill_prefix explain_level plan_mode_preamble \ - codex_reviews gstack_contributor skip_eng_review workspace_root \ + codex_reviews autoplan_shadow autoplan_shadow_model gstack_contributor skip_eng_review workspace_root \ artifacts_sync_mode artifacts_sync_mode_prompted artifacts_sync_removals plan_tune_hooks \ timeline_stop_hook design_detector design_detector_install_prompted memorable_recall \ browse_extension_id ship_measure_rule_trials ship_measure_behavior_panels \ diff --git a/bin/gstack-doctor-components.sh b/bin/gstack-doctor-components.sh index 09a4bd780..1e462a625 100644 --- a/bin/gstack-doctor-components.sh +++ b/bin/gstack-doctor-components.sh @@ -376,6 +376,7 @@ gstack_result_anchor() { CEO_ONLY_CONFLICT) printf '%s' 'ceo-only-conflict' ;; CEO_ONLY_AFTER_INIT) printf '%s' 'ceo-only-after-init' ;; CEO_ONLY_NO_GATE) printf '%s' 'ceo-only-no-gate' ;; + SHADOW_BEFORE_ANSWER) printf '%s' 'shadow-before-answer' ;; *) return 1 ;; esac } diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 276543d9e..cbee76ee2 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -3216,6 +3216,19 @@ work: they are how a budget-stopped CEO-only run recovers.) full review in a new directory: `gstack-autoplan next --out --plan ` without `--ceo-only`. + +### `SHADOW_BEFORE_ANSWER` + +**Meaning.** `gstack-autoplan shadow` skipped a gate revision whose plan +approval (`p1`) is unanswered or was answered `c` (interrogate). The export +pairs each hidden prediction with the owner's answer, so a revision he has not +answered has nothing to pair it with. Answered revisions of the same run still +export; the command exits 3 only when nothing was exported. + +**Fix.** Answer the gate (`gstack-autoplan answer --out --gate-rev +...`), then run `gstack-autoplan shadow` again. See +[Shadow mode](unattended.md#shadow-mode). + ### `ATTEMPT_MISMATCH` diff --git a/docs/unattended.md b/docs/unattended.md index fd70bf033..c27663a41 100644 --- a/docs/unattended.md +++ b/docs/unattended.md @@ -258,7 +258,8 @@ tree no review saw, so /ship runs again; | File | Schema | Contents | |------|--------|----------| | `run.json` | `run` v1 | The manifest: `run` id, `status`, `required_phases`, each phase's `native` and `outside` outcome (`status`, `model`, `provider`), input `snapshot` hashes, `counts`, every artifact's `path` (relative to the run directory) and `sha256`, `session_kind`, `gate_rev`, `deviations`, `consumed_by`. | -| `decisions.jsonl` | `decisions` v1 | One row per decision: `id` (`-