mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 14:06:50 +01:00
49b57a9be49431039bfe2e5bf786e085efc54d2d
532
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 garrytan
|
49b57a9be4 | Merge remote-tracking branch 'origin/main' into capy/fw3-b | ||
|
garrytanandcapy-ai[bot]
|
6c5ed93345 |
test(autoplan-guard-pty): the scripted actor ends its turn after a background CEO dispatch before reading the close packet
PR gate 39070276914 ( |
||
|
|
4e4f2959cd |
v1.91.126.0 fix(brain-sync): hold case-colliding artifact paths instead of reporting ok (#3220) (#3254)
* fix(brain-sync): verify requested index entries after add Refuse missing or unrelated staged paths and stale indexed content without consuming the queue or resetting the index. * fix(brain-sync): refuse new casefold path collisions Check component prefixes in requested/index and outgoing trees, including retained commits and fetch/merge retries. Preserve historical aliases, local commits, index, and queue on refusal. * fix(brain-sync): hold case-colliding paths instead of halting the sync (#3220) Builds on Kkkkkuro's staged-index and casefold checks (#3245, from #3223). A queued path whose spelling differs only by letter case from another path in the index or the batch is held before staging: it stays queued, every other file keeps syncing, and the status is "collision" rather than "ok". An established spelling keeps syncing; only the new alias waits. Skill start prints one ARTIFACTS_SYNC attention line naming the colliding names and the repair anchor (docs/troubleshooting.md#artifact-case-collision); gstack-doctor warns the same way. The outgoing check is cached by HEAD so the empty-queue drain at every skill boundary stays near main's cost. gstack-slug and skill start's slug path are unchanged. Co-authored-by: Kkkkkuro <180382840+Kkkkkuro@users.noreply.github.com> Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(brain-sync): close review gaps in the case-collision hold - Windows: write the held-path list with LF and strip CR from helper output, so CRLF cannot let a held path through or blank case_names. - --publish-removals runs the outgoing case check before it pushes. - The cached outgoing verdict is keyed by every ref, not HEAD alone, so a moved remote baseline is re-checked. - The repair snippet folds only JSONL logs and lists snapshots and other files for a manual decision. Co-authored-by: Kkkkkuro <180382840+Kkkkkuro@users.noreply.github.com> Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(brain-sync): second review pass on the case-collision hold - The repair loop also folds the dropped spelling's untracked (held) files and says to check for leftovers before removing the folder on Linux. - The cached outgoing verdict also keys on HEAD's symbolic target. - The outgoing check no longer needs a temp file, so a failed mktemp can no longer skip it. Co-authored-by: Kkkkkuro <180382840+Kkkkkuro@users.noreply.github.com> Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(brain-sync): give the retry-merge fixture a git identity The retry merge commits with the ambient identity. CI and Ubicloud runners have none under the test HOME, so the merge failed before the outgoing case check ran and the drain reported push_failed instead of error. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(changelog): unreleased entry for the #3220 case-collision hold Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.126.0 stamp Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: KuroChen <Kkkkkuro@users.noreply.github.com> Co-authored-by: Kkkkkuro <180382840+Kkkkkuro@users.noreply.github.com> Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
dc739be05a |
fix(review-army): pass the state-machines output to check as a written file, not a heredoc placeholder (W3-5)
The generated-bash lint (env-host-fence-conformance INV-3) rejects free text in a heredoc body: <its complete output> reached the shell. The agent now writes the specialist's full output to .gstack/tmp/state-machines.md and the fence runs gstack-state-matrix check on that file. Two stack-detection comments and the parenthetical are trimmed to stay inside the review/ship parity ratios; gstack-review shrinks by 33 on the five pinned hosts and their pins are lowered to match. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
b789898982 |
test(harness): bump HARNESS_VERSION to 5 for the W3-11 stripAnsi change
stripAnsi now removes cursor-visibility escapes (ESC[?25h/l). Every PTY case matches patterns against its output, so a pattern spanning one of those escapes can now match where it did not before: a verdict can change, so this is a behavioral bump, not a non-behavioral entry. The launch.ts change (last non-blank screen in failure messages) is diagnostic only. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytan
|
4e2c6d4434 | Merge remote-tracking branch 'origin/capy/fw3-b2' into capy/fw3-b | ||
|
garrytanandcapy-ai[bot]
|
c27c2e8412 |
fix(qa-evidence): count required post-repair probes only after the fixture-declared final source edit (W3-6/W3-14 confirm round)
GSTACK_QA_REQUIRED_PROBES reminders counted any complete capture, so a pre-repair duplicate or partial capture looked like post-repair coverage. The caller may now declare GSTACK_QA_REQUIRED_AFTER_EDIT with absolute paths and a clean-fixture time: only captures started after the last edit under those paths count, none count before the first edit, and a malformed declaration counts none. Without the declaration every capture counts as before. The webhook fix fixture declares its src/ directory. A free test covers pre-repair-only coverage (nudges), complete post-repair coverage (no nudge) and a second edit (nudges again). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
3debad2891 |
test(docsync-fault): diagnosable prepare snapshot failures with one fresh-id retry (W3-1)
A failed installed snapshot now returns exit 25 with a stable reason code (snapshot_exit, snapshot_timeout, snapshot_spawn_error, snapshot_invalid_record), the helper's stderr tail redacted through lib/redact-engine with the fixture root as <HOME> and bounded to 800 characters, and keeps the attempt's files: the candidate the helper left, if any, and prepare-<audit-id>-failure.json. The failure is a prepare-failed event, not a rejected interaction. One retry is allowed under a fresh audit id; reusing the failed id, dispatching it or a third prepare is rejected. Tested before and after candidate creation. The two snapshot tests get an explicit 30 s timeout: the compare/inspect agreement test runs 4.3-4.8 s alone and timed out at Bun's 5 s default under load. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
a5f6e14df3 |
fix(docs-candidate): the compare reject never sends an agent to re-snapshot after the child audit (W3-2)
A post-audit snapshot over the candidate replaces the before-audit baseline, so the ownership check would compare current files with themselves. The fix line now says the candidate must be the record the Prepare snapshot wrote, that the Prepare snapshot is rerun only before dispatching the child audit, and that the post-child snapshot uses a different --out (<audit-id>-post.json). The helper test pins the text. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
4617b4ce98 |
test(qa-functional): reserve webhook post-repair reruns first inside the unchanged 12-capture ceiling (W3-6/W3-14 confirm round)
The fix prompt now states precedence: post-repair reruns (the 7 stage-2 scenarios plus each distinct pre-repair command the verdict relies on, such as a reject probe) are reserved first, pre-repair exploration gets what remains, and reruns that cannot fit are reported as open. A free test fits a pre-repair reject plus the reproduced defect and its replay within 12 (11 captures). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
f16dce25f0 |
fix(review-army): keep the state-machine detector's output only on exit 0 (W3-5 confirm round)
A failing gstack-state-matrix detect prints SCOPE_STATE_MACHINE=false before exiting non-zero. The scope block now captures its output and sources it only when the detector succeeds; otherwise it discards the output, sets SCOPE_STATE_MACHINE=unknown (dispatching the State Machines specialist) and leaves the detector's stderr visible. Free tests cover false-output/non-zero, empty-output/non-zero and a late failure after printing true. The stack comment is shortened so gstack-review stays 4 chars under its pin; the five host pins are lowered to match. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
d9b3877636 |
test(pty): strip cursor-visibility escapes and print the last screen on autoplan-guard-pty failure (W3-11)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
c777750457 |
test(free-fixtures): declare the W3-4 captured caller transcript as a free-only fixture
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
d9b5131807 |
docs(todos): close the createQAFunctionalFixture entry and file D6 (W3-13)
The git auto-maintenance entry was fixed by
|
||
|
garrytanandcapy-ai[bot]
|
d9cfa873ec |
test(review-army): size the nested bun test budgets for windows-latest (W3-15)
windows-free-tests run 39053431430 (shard 5): the nested bun test exited 1 in 5.58 s because Bun's default 5 s hook timeout fired on the real Red Team beforeAll (8 git spawns plus skill-section copies). Both nested argvs pass --timeout 30000, which raises only the nested default; the registrations under test keep their explicit timeouts. Spawn timeouts move from 8 s to 40 s and outer test timeouts to 45 s, including the consensus test that had none. With a 6 s beforeAll injected, the lifecycle still matches; the old argv reproduces the Windows hook timeout. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
776168de04 |
test(autoplan): explicit 30 s timeout for each answer-invalidation test (W3-12)
The eng-only override test ran 4.1-4.4 s on a 4-core machine against Bun's 5 s default (7.8-9.4 s per file). Each test now names a 30 s budget. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
6fa896384a |
test(pty): keep the last non-blank viewport for failure dumps (W3-11)
autoplan-guard-pty (PR gate run 38976253774) stalled at 489 s and its screen dump, the tail of visibleText(), was only spinner redraws. Live PTY sessions now remember the last non-blank viewport a screen read returned (session.lastScreen()) and the harness wait-timeout dumps append it. Diagnostic only: visibleText(), matching and verdicts are unchanged. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
20d77403e4 |
fix(design-e2e): the shim-dom scan check resolves the command's literal _REPORT/_RUN (W3-10)
PR gate run 38980005793 went red because the agent ran the generated DOM block, scanning "$_REPORT/dom/$_RUN" with _RUN="run1" assigned in the same command, and the check looked for the literal dom/run1 anywhere in a command. domScanOfRun substitutes that command's own literal _REPORT=/_RUN= assignments and credits a scan only when one of its own arguments is the run directory. scan --changed, another directory, quoted heredoc report text and non-literal or conflicting assignments stay negative controls. All 15 captured shim-dom runs in the window pass the new check (14 passed the old). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
c16fe92106 |
fix(skills): fit the W3-5, W3-7 and W3-8 prompt repairs inside the parity budgets
The parity suite left 2-42 bytes of headroom on ship, review, plan-eng-review, plan-ceo-review and land-and-deploy, so each repair now pays for itself in the same resolver: - W3-5: the scope block runs `source <(gstack-state-matrix detect --base <base> || echo SCOPE_STATE_MACHINE=unknown)` (a failed detector's stdout is overridden by the later unknown assignment; its stderr still shows), the check block uses a short heredoc, and DIFF_LINES comes from one `git diff --numstat | awk` sum instead of two --stat greps (same count: insertions plus deletions, binary files zero). - W3-7: the absent branch reads "offer only options B), C) and D)." - W3-8: "never n/a" joins the tier 1 parenthesis, the no-linked-issue rule joins the receipt sentence, and the deep header says the same in fewer words; the redundant "(it prints the PLAN_REALITY: line)" is dropped. Size pins: land-and-deploy (12 hosts, -20), office-hours (4 hosts, -20) and plan-eng-review (12 hosts, -10) are lowered to their new sizes; gstack-review on cursor, factory, kiro, opencode and slate stays above its main pin (+355..+374) because the declared check block is a new fence that carries the env-var-host runtime prelude. Raising those five pins needs owner sign-off. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
d2f2f1010a |
test(skill-md-size): re-pin 31 over-limit skills grown by fix wave 3 prompt repairs (owner sign-off needed)
CREW rule 11: these skills were already over 100,000 characters and grow by the minimum text each repair needs; none crosses the limit for the first time. - gstack-review on cursor, factory, kiro, opencode, slate (+657..+676): W3-5 runs gstack-state-matrix detect inside the scope block with its exit status checked and declares the check step as a heredoc block; the new fence carries the env-var-host runtime prelude (about 360 characters). - gstack-plan-eng-review on 12 hosts (+104): W3-8 says tier 1 reality rows are never n/a (paid run 39004466422 looped on a rejected n/a row). - gstack-land-and-deploy on 12 hosts and gstack-office-hours on 4 hosts (+21): W3-7 letters the absent-Aside consent options B), C), D). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
26ceeb7cb4 |
fix(third-party-actions): state the absent-Aside letters in fewer characters (W3-7)
Same contract (B), C), D) when Aside is not detected; the next sentence already omits the Aside option), 67 fewer characters on the pinned land-and-deploy and office-hours skills. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
31f4fd455e |
test(golden): refresh the ship goldens for the W3-5 scope block and W3-7 consent letters
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
fcfba0ec91 |
test(docsync): keep the two docsync model misses as negative controls (W3-3)
The Bash grep of ship-docsync-missing-asset (PR gate run 38983306684,
bash#13) and the composed cat; cat of ship-docsync-failure (38984977679,
bash#12) were correct rejections. They join the stored known_bad commands
(with a {home} placeholder for the fixture home); no detector change.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
|
||
|
garrytanandcapy-ai[bot]
|
469fcf04b0 |
docs(todos): file the qa-quick capture headroom follow-up (fix wave 3, T)
qa-quick timed out once at 300 s (paid run 38980005793) against passing runs of 164-272 s. Trimming what the Quick tier loads is a product call, so it is filed, not repaired; no budget change. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
2b125f1bcf |
fix(docsync-fault): prepare writes the production candidate through the installed snapshot (W3-1)
The fault actor prepare wrote its own {base_sha, content_hashes, ...} record,
which the installed gstack-docs-candidate compare rejects, while
ship/sections/documentation.md requires running compare; 79 of 198 docsync
captures (and the red in PR gate run 38990111230) were pushed off the
documented path by it.
prepare now runs the installed snapshot under a 30 s timeout for the same
selection, returns its exact command as snapshot_command so the post-child
rerun is literal, publishes prompt and event only after a valid record
exists, and removes a record its own failed snapshot left. dispatch observes
the candidate with the same installed snapshot; inspect returns base, index
and per-file git blob ids in the record representation; the legacy re-audit
check reads selected/hashes. The fault prompt names snapshot_command and the
new field names.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
|
||
|
garrytanandcapy-ai[bot]
|
a3662c47b5 |
fix(docs-candidate): per-subcommand --help and a compare reject that names the fix (W3-2)
snapshot --help and compare --help print the usage and exit 0 before any side effect; the docsync observer admits exactly those two forms. compare names the record path, each missing or wrong field (schema_version, base, hashes) and the snapshot command that writes a valid record, keeping exit 1. The captured ship-docsync-stale-after commands from PR gate run 38990111230 replay inside the interface; help with any other argument stays rejected. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
91d0c43090 |
test(qa-functional): keep the captured webhook-report cat attempts as denied negative controls (Q3)
Paid run 39006896632 (qa-functional-webhook-report) attempted `cat package.json probe.ts .gitignore` and `cat src/*.ts test/*.ts`; the PreToolUse hook denied both. This is a model miss, not a detector defect, so both commands are pinned as denied by the registered hook and outside qaCommandAllowed. No detector change. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
f0447e61ae |
fix(qa): tie the exploratory stop rule to per-rule input probes; fix runs close superseded captures (W3-9, W3-14)
W3-9: two qa-functional-cli-report sessions stopped at 5-7 of 12 probes without probing a non-digit amount (paid runs 38983306684, 39001107574), though system-functional.md requires one probe per documented input rule. The single stop rule shared by both exploratory templates now says each documented input rule needs its own probe breaking only that rule, and rules left uncovered at a probe or time cap go in limits. W3-14: for fix runs (not qa-only), every capture taken before a fix is superseded even when its client prints no snapshot; before completion the agent reruns each one its verdict relies on or reports it as an open remainder. Production superseded/open semantics are unchanged. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
3392d3f5d5 |
test(qa-functional): webhook fix runs re-verify the repaired invariant and rerun superseded captures (W3-6, W3-14)
W3-6: stage 2 of the fix-run prompt asked only for the original, happy, cancel and dependency probes while verifyQANativeRegression reruns all eight, so a status-only repair that left partial broken reached the verifier (paid run 38986120559). The webhook fix prompt now states the capture budget up front (at most 5 pre-repair captures, then the 7 post-repair scenarios: duplicate, partial, concurrent-ab, concurrent-ba, happy, cancel, dependency; 12 in total; report incomplete if 5 cannot establish the defect). That list feeds the capture nudge (GSTACK_QA_REQUIRED_PROBES); QA_WEBHOOK_REQUIRED_SCENARIOS and the verdict are unchanged. W3-14: the fix prompt now says to rerun every pre-repair capture the verdict relies on after the final repair, and that a superseded row stays open until its command reran on the repaired source (paid run 39053431488 labelled a pre-repair duplicate superseded and never reran it). The detector and its negative test are unchanged; the captured shape joins them as a negative control. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
37216ca844 |
fix(plan-reality): say tier 1 rows are never n/a (W3-8)
The plan-review reality block offered pass|finding|n/a without saying tier 1 rows may never be n/a, so a plan-mode-no-op session wrote `REALITY: deferred-asks n/a ...`, check returned repair, and the repair loop ran past the 300 s capture (paid run 39004466422). The block now says tier 1 rows are never n/a and that with no linked issue deferred-asks is pass with a receipt showing none. The captured line is pinned through check as missing=deferred-asks verdict=repair. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
8de6f27397 |
fix(third-party-actions): letter the absent-Aside consent options B/C/D (W3-7)
The contract fixed letters only when Aside is detected, so a tpa-absent-linux agent numbered its consent question 1/2/3 (paid run 39011101113), which the lettered-offer inspection cannot read. The absent branch now offers B) gstack's own visible browser, C) manual instructions, D) defer and omits A). The paid test's assertion is unchanged; the captured numbered answer is a documented fail example in the unit test. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
7bbb730da5 |
fix(review-army): run the state-machine detector in the scope block and check its exit status (W3-5)
Specialist 9 named gstack-state-matrix detect only in selection prose, and small diffs keep only State Machines, so agents ran an undeclared command (paid gate run 39002269281). The generated scope block now runs the detector with its exit status checked: on failure it keeps the detector's diagnostics and sets SCOPE_STATE_MACHINE=unknown, and selection dispatches State Machines when the signal is true or unknown. The check step becomes a declared heredoc block. The clarity test requires every non-diff-scope signal to come from a detect helper the scope block runs; a free test runs the block against a failing detector stub; the captured standalone call stays outside the caller interface. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
garrytanandcapy-ai[bot]
|
939ace2231 |
test(qa-callers): bind QA section names in the caller prompt instead of teaching helper forms (W3-4)
The caller session prompt taught full capture/checkpoint syntax but only mentioned materialize, so two ship-exploratory-small-cli sessions (paid gate runs 38973329985, 38993076767) skipped qa/sections/exploratory.md and system-functional.md and guessed a bare materialize. The prompt now declares only fixture bindings (DEADLINE_TOOL, EVIDENCE_TOOL, PROBE_DIR, DEADLINE_FILE, --public approval, --timeout-ms 10000 for plan probes) and points to the section for every form. The read requirement is unchanged; both captured transcripts are kept as negative controls. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
Garry Tan
|
c10c139ed6 |
v1.91.125.0 feat(cso-eval): daily precision counts confirmed incidental issues and leaves out declared fixture instrumentation (#3251)
* fix(cso): comprehensive verify can patch read-only snapshots and accepts runtime-plan's profile * feat(cso): helper replies carry remainingSeconds; producer receipts record a content-free tool timeline * fix(cso): count remainingSeconds to the investigation deadline; bound and validate the tool timeline remainingSeconds now measures to deadline - 60s, the point where scan, verify and record-review refuse with DEADLINE, and inspect carries it. The post-command clock lookup can only omit the field, never fail a command whose state change is already saved. The stream timeline records end times from tool_result, indexes only recorded calls so it stays at the 4096 cap, and receipts reject malformed timeline entries. * feat(cso-eval): daily precision counts confirmed incidental issues and leaves out declared fixture instrumentation * docs(changelog): unreleased entry for the cso-eval precision definition * v1.91.125.0 stamp |
||
|
Garry Tan
|
501ff8310a |
v1.91.124.0 feat(cso): helper run clock (remainingSeconds), /cso time discipline, content-free producer tool timeline (#3242)
* fix(cso): comprehensive verify can patch read-only snapshots and accepts runtime-plan's profile * feat(cso): helper replies carry remainingSeconds; producer receipts record a content-free tool timeline * fix(cso): count remainingSeconds to the investigation deadline; bound and validate the tool timeline remainingSeconds now measures to deadline - 60s, the point where scan, verify and record-review refuse with DEADLINE, and inspect carries it. The post-command clock lookup can only omit the field, never fail a command whose state change is already saved. The stream timeline records end times from tool_result, indexes only recorded calls so it stays at the 4096 cap, and receipts reject malformed timeline entries. * docs(changelog): unreleased entry for the /cso run clock * v1.91.124.0 stamp |
||
|
Garry Tan
|
56f25ef82b |
v1.91.123.0 fix(cso): comprehensive verify can patch read-only snapshots and accepts runtime-plan's profile (#3240)
* fix(cso): comprehensive verify can patch read-only snapshots and accepts runtime-plan's profile * docs(changelog): unreleased entry for the /cso verify repair path * v1.91.123.0 stamp |
||
|
dependabot[bot]
|
521fd42489 |
build(deps): bump the github-actions group across 1 directory with 2 updates (#3229)
Bumps the github-actions group with 2 updates in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v7.0.1...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v8.0.1...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Garry Tanandcapy-ai[bot]
|
9dea818e34 |
v1.91.122.0 fix(deps): clear the 2026-11-30 OSV suppressions, replace #3228, exempt dependabot from Version Gate rule 1 (#3239)
* fix(deps): clear the OSV suppressions that expire on 2026-11-30 Delete the hono, @anthropic-ai/sdk (#2754) and sprintf-js ignores, which the lockfiles no longer match. Override image-size to 2.0.4 (#2753) and chokidar to 4.0.3 in lib/diagram-render (drops braces), and delete those ignores. Re-date katex to 2027-01-31: its fix is outside mermaid 11's range (mermaid-js/mermaid#8388). html-to-docx 1.8.0 bundles its own image-size 1.x, which the override cannot reach and whose ICNS parser loops forever. make-pdf --to docx now hands it only PNG, JPEG, GIF, WebP or SVG bytes. A golden docx test proves the Word output is unchanged. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * build(deps-dev): @types/bun 1.4.3, prettier 3.9.10; hold the Anthropic SDKs to patches Replaces dependabot #3228 without its agent-sdk 0.3 and sdk 0.133 bumps, which break typecheck:test and overlay-sdk-cancel-eof. Their 0.x breaking releases are semver-minor to dependabot, so the ignore covers minor and major. @types/bun 1.4.3 retires 18 test type diagnostics; the baseline locks that in. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(ci): exempt dependabot dependency-manifest PRs from Version Gate rule 1 Dependabot never edits VERSION, so hard rule 1 failed every package.json PR it opened. The workflow now passes the PR author and changed-file list; the gate skips rule 1 only for dependabot[bot] when every file is a package.json, bun.lock(b) or .github/dependabot.yml. A failed file lookup keeps the rule. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(make-pdf): guard every html-to-docx sizing path, keep non-ICNS formats Review found three spellings that got past the regex guard and still hung --to docx: a data-src decoy, a percent-encoded separator, and an unquoted encoded colon. html-to-docx sizes images on three paths, and buildImage URI-decodes the whole src first. The guard now mirrors all three, drops ICNS (the only input its bundled image-size routes to the looping parser) instead of allowlisting formats, so BMP and TIFF embed as before, and re-parses the result with html-to-docx's own html-to-vdom to fail closed on anything the regex misreads. The golden test tolerates CRLF checkouts on Windows. Version Gate treats a failed file lookup as an empty list, so a partial paginated result cannot decide the exemption. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore(release): stamp v1.91.121.0 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore(release): restamp v1.91.122.0 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
Garry Tanandcapy-ai[bot]
|
d258bcffb0 |
v1.91.121.0 test(windows-seed): refresh the Windows duration seed from real windows-latest timings (#3243)
* fix(windows-seed): record slow Windows files in full instead of at the 6-minute deadline The first Windows recording on |
||
|
Garry Tanandcapy-ai[bot]
|
eca247e99a |
v1.91.120.0 test: split the doctor windows bash test so each case fits the Windows per-test timeout (#3241)
* test: split the doctor windows bash test so each case fits the Windows per-test timeout Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(changelog): doctor windows bash test split entry Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore(release): stamp v1.91.120.0 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
Garry Tanandcapy-ai[bot]
|
f47321e615 |
v1.91.119.0 test(seed): refresh the free-suite duration seed (#3224) (#3238)
* test(seed): refresh the free-suite duration seed from a Ubicloud recording (#3224)
54 free test files had landed since the 2026-10-15 recording, so CEO-10
failed again (limit 5). Recorded with `bun run test:ubicloud --record-durations`
(standard-16, recorder exit 0, no failed files) on origin/main
|
||
|
Garry Tanandcapy-ai[bot]
|
a6eb647328 |
v1.91.118.0 test: held-install recovery fixture no longer assumes the checkout has no local main (#3237)
* test: held-install recovery fixture no longer assumes the checkout has no local main actions/checkout leaves push runs on a local main branch, so the fixture's clone already had main and 'checkout --orphan main' failed. Build the root commit on an orphan held-fixture branch and push HEAD:refs/heads/main; add a regression covering a source on main and a detached source with no branch. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.118.0 test: held-install recovery fixture no longer assumes the checkout has no local main Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
|
82530ac143 |
v1.91.117.0 fix: pregate bats lanes, WTREE_UNAVAILABLE, doctor rows, SKILL.md size guard, planMode hosts (fix wave PR 5) (#3236)
* fix(pregate): recognise bats test files so lanes does not fail in bats repos (#3161) gstack-pregate never treated a .bats file as a test, so in a repository whose tests are bats files the lanes check failed every run with PREGATE_NO_LANE: a .gstack/pregate.json dependency pointing at tests/foo.bats selected nothing, a selection manifest printing .bats paths yielded 0 files, and a bats run that executed no tests could not trip the zero-run rule. Recognise .bats in the test-file pattern and in the manifest-output parser, and read the bats TAP plan and pretty summary (as a last resort, after every existing runner's summary) so a run that reports zero tests is a failure. Fixes #3161. Cherry-picked from #3177 ( |
||
|
|
cadbd0af15 |
v1.91.116.0 feat: field list 2 wave B: gstack-ship-queue, approval classes, state-machine review, pregate timing check, update-check main moves (#3235)
* fix(capy): the install trailer says behind=<n> and its fix, so a stale install shows in every relayed trailer (field list 2 item 13, #2378) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(capy): a lease records its holder's start identity, so a pid reused after a wake is reclaimed; a skipped session-start upgrade ends fail behind, never ok (GBRA-105, GBRA-106) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): stale needs proof (unreadable or malformed identities keep the lease), ps identity is timezone-independent, and reclaim never deletes a concurrent renewal Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * feat(autoplan): enforced round cap and spend budget, deferred close, public export without machine paths, opt-in durable checkpoints (field list 2 W5-W7) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): one directory lock for publish, prune and reclaim; reclaim rereads the record judged stale, so a renewal is never deleted or hidden Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): the directory lock names its holder; broken only when the holder is dead or its pid reused, unlock removes only its own lock, touch exits 3 under a live holder Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): breakers serialize on .lock.break and reread the lock before removing it; gstack-skill-start reports a lease the held lock kept out Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(lease): name the double-crash limit of breaking a dead lock Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * feat(capy): --for review-voice install profile, no-Drive bootstrap command, reviewer prompt trailer (field list 2 W11) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> (cherry picked from commit |
||
|
Garry Tanandcapy-ai[bot]
|
c71d764ba4 |
v1.91.115.0 feat: field list 2 wave A: autoplan round cap and public export, eval-plan diagnostics and model rules, --for review-voice (#3234)
* fix(capy): the install trailer says behind=<n> and its fix, so a stale install shows in every relayed trailer (field list 2 item 13, #2378) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(capy): a lease records its holder's start identity, so a pid reused after a wake is reclaimed; a skipped session-start upgrade ends fail behind, never ok (GBRA-105, GBRA-106) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): stale needs proof (unreadable or malformed identities keep the lease), ps identity is timezone-independent, and reclaim never deletes a concurrent renewal Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * feat(autoplan): enforced round cap and spend budget, deferred close, public export without machine paths, opt-in durable checkpoints (field list 2 W5-W7) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): one directory lock for publish, prune and reclaim; reclaim rereads the record judged stale, so a renewal is never deleted or hidden Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): the directory lock names its holder; broken only when the holder is dead or its pid reused, unlock removes only its own lock, touch exits 3 under a live holder Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): breakers serialize on .lock.break and reread the lock before removing it; gstack-skill-start reports a lease the held lock kept out Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(lease): name the double-crash limit of breaking a dead lock Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * feat(capy): --for review-voice install profile, no-Drive bootstrap command, reviewer prompt trailer (field list 2 W11) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> (cherry picked from commit |
||
|
Garry Tanandcapy-ai[bot]
|
bc2ed0cee7 |
v1.91.114.0 feat(dx): score every error for an AI agent reader (agent-ready error contract + gstack-error-capture) (#3226)
* feat(dx): agent-ready error contract for the DevEx review skills Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * feat(dx): gstack-error-capture runs a CLI with no terminal and prints a redacted record Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(dx): CI-clean fences, runtime-root-safe contract location, path-agnostic launch-check test Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(dx): preregistered behavior case for the agent-ready error contract; README skill rows Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(dx): grader items come from the contract; paid-file count includes the new case Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * feat(dx): outside DX voice uses the agent-ready contract; DX_CAPTURE_* codes join RESULT_CODES with troubleshooting anchors Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(dx): review fixes for gstack-error-capture and the paid grader - every helper diagnostic passes the record's redaction, fail-closed - forwarded values are masked before and after sanitizing, plus JSON-escaped forms - the final secret check reads the record's string fields with byte-based scan limits - mise/asdf config, trust and env-loading variables need --pass-env; only data locations pass by default - launch reports whether the target started; --launch-check's probe result is exit_code - Step 3 captures --help first; help states the containment lifetime limit - the paid grader validates the bound result with parseReviewResult Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(dx): mask forwarded values before argument validation; protocol strings never match literals; Step 3 captures stay read-only Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.114.0 feat(dx): score every error for an AI agent reader (agent-ready error contract + gstack-error-capture) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
Garry Tanandcapy-ai[bot]
|
73f1394b0a |
v1.91.113.0 fix(capy): trailers say behind=<n> with a fix, a skipped upgrade is never ok, and a reused pid no longer holds the upgrade lease (#3232)
* fix(capy): the install trailer says behind=<n> and its fix, so a stale install shows in every relayed trailer (field list 2 item 13, #2378) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(capy): a lease records its holder's start identity, so a pid reused after a wake is reclaimed; a skipped session-start upgrade ends fail behind, never ok (GBRA-105, GBRA-106) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): stale needs proof (unreadable or malformed identities keep the lease), ps identity is timezone-independent, and reclaim never deletes a concurrent renewal Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): one directory lock for publish, prune and reclaim; reclaim rereads the record judged stale, so a renewal is never deleted or hidden Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): the directory lock names its holder; broken only when the holder is dead or its pid reused, unlock removes only its own lock, touch exits 3 under a live holder Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(lease): breakers serialize on .lock.break and reread the lock before removing it; gstack-skill-start reports a lease the held lock kept out Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(lease): name the double-crash limit of breaking a dead lock Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(third-party-actions): the Aside drive-offer detector matches the product name, not the English idiom (paid run 38988927989 tpa-absent-linux false positive) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(changelog): field list 2 F1 entry; capy/support.env GSTACK_MIN_REVISION to this release Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore: stamp v1.91.113.0 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
Garry Tanandcapy-ai[bot]
|
299e051010 |
v1.91.112.0 fix(cso): --paths scopes an audit and reports every skipped path (no more hand-trimmed copies) (#3230)
* fix(cso): --paths scopes an audit and reports every skipped path A repo over the 64 MiB cap was audited on hand-trimmed copies, so the verdict read assessed over partial input. --paths records out-of-scope files unread as snapshot-inputs gaps (coverage partial), keeps --diff fail-closed, and carries the scope through submit, recheck and replay. Field list 2 item 12; related #2993. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(cso): close /review findings on --paths scoping - Comparison mode hashes out-of-scope files in bounded 1 MiB chunks and re-hashes them in both stability passes instead of reading whole files. - --diff --paths refuses every changed path outside the scope except host dependency trees, including credential and agent configuration. - --paths prefixes that report persistence would rewrite are refused. - In-scope gaps sort first; out-of-scope files and deletions share the skipped tier and are dropped from transformations. - History is limited to --paths, reported as partial, and history queries on out-of-scope paths are refused. - A --diff recheck refused for out-of-scope changes says to start a new audit. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(cso): troubleshooting names --paths for the source cap Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(changelog): /cso --paths entry Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.112.0 fix(cso): --paths scopes an audit and reports every skipped path (#3230) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
Garry Tanandcapy-ai[bot]
|
f592d67826 |
v1.91.111.0 fix(evals): four PR-gate background reds were a detector, an interface, a helper and a workflow-block defect (#3231)
* fix(evals): three PR-gate background reds were a detector, an interface and a helper defect - docsync-fault-eval: a conditional mention (until/unless/once/when/before/if) of 'Documentation is current' is not a false current claim; replay corpus for ship-docsync-launch-failure from PR run 38336400566 with derived refusals. - gstack-skill-start/gstack-skill-end: --help prints usage and exits before any side effect (it used to start a session); the docsync interface admits the lifecycle helpers' own --help; captured run 38969924945 replays clean. - qa deadline policy: listing the owned qa-reports/screenshots directory is bookkeeping (qa-only-no-fix, run 38969924945). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(evals): the launch-failure corpus is a row in the docsync corpus test that owns docsync-fault-eval Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(evals): register the launch-failure corpus and docsync-store capture in their contracts The B1 corpus contract wants its own detector-corpus-<case> replay test, so the launch-failure corpus keeps one, listed in the test-of-test baseline beside its sibling corpora; FREE_FIXTURES names both new fixtures' free consumers. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(review-army): the scope block prints the SCOPE_* signals specialist selection reads The Detect stack and scope block sourced gstack-diff-scope silently, so an agent that needed SCOPE_FRONTEND to pick specialists appended its own echo and left the declared caller interface (ship-exploratory-plan-checks red in run 38981523623). The block now lists the sourced signals itself. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * v1.91.111.0 fix(evals): four PR-gate background reds were a detector, an interface, a helper and a workflow-block defect Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |
||
|
Garry Tanandcapy-ai[bot]
|
83f15043ac |
v1.91.110.0 fix(capy): install the project's pinned Node; launch Bun through a bun-only directory (#3233)
* fix(capy): install and launch the project's pinned Node; launch Bun through a bun-only directory gbrain pins node 24.18.0 in CI while the Capy image ships 24.21.0 in /usr/local/bin, so a full install still ended with fail pins (GBRA-117). The installer now resolves the project's exact Node pins the way it resolves Bun's (required non-CI pins, CI pins in different jobs as alternatives): the node first on PATH, then gstack's store copy and nvm's copy of each wanted version, then any other node on PATH. With no match, install mode downloads the pinned release into <state root>/runtimes/node and checks it against SHASUMS256.txt. The resolution is recorded in the install verdict (node_path, node_version, node_rule), and --check reuses it. The launch PATH no longer prepends a shared bin directory. When the resolved Bun was /usr/local/bin/bun, the image's node there shadowed every other node (GBRA-122). A store Bun still launches from its own version directory; any other Bun, and a Node the launch needs, launch through a gstack-owned directory of symlinks beside the verdict. The pregate's lanes use the recorded launch directory. The doctor's pins row names the node it read and, for a Node mismatch, the installer command that installs the pinned Node (or nvm install <v> off Capy). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore: v1.91.109.0 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(egress): exempt the Node installer's two release downloads with their reason Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore: restamp v1.91.110.0 (1.91.109.0 is #3225's slot) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(doctor): make the Node pin case platform-neutral (an any-lane CI pin, bash's spelling of the stub path) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> |