* security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml
Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a
cwd bunfig.toml preload before the program starts. gstack runs inside the repo
it audits, so a committed .env could steer state roots, the claude binary or
spend caps, and a bunfig preload ran arbitrary code in every bin and hook.
Every bun shebang, shell and skill caller, TypeScript spawn and compiled build
now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(),
--no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture
regressions.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test: name the directly executed scripts in the isolation ratchet
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test: follow the isolation flags in touchfiles, copy lists, recipe assertions and the harness pin
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix: keep browse/src/bun-child-config.ts unchanged so the native cookie qualification still binds
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(windows): the empty bunfig outlives its process so the timeline hook's detached repair child can read it
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test: plan-mode render pattern accepts the isolation flags
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* chore(scripts): retire hollow and legacy paid package scripts behind one-release stubs (W8a, DX-4, CEO-31)
test:codex*, test:evals*, test:e2e*, test:gate, test:periodic, eval:bg,
eval:bg:all, eval:flake-rank, eval:watch and test:audit now print their
replacement and exit 1 via scripts/retired-command.ts. CONTRIBUTING.md
carries the same table; test/retired-commands.test.ts pins both. Eval CLI
empty-state hints point at eval:bg:pr.
* chore: delete dead update-readme-throughput, eval-watch, orphan fixtures and QA_FUNCTIONAL_INPUTS (W8b, CEO-24)
Retired with named behavior:
- update-readme-throughput.ts + readme-throughput test: replaced a README
anchor that no longer exists from a JSON file that was never produced;
the script was a no-op. Guarantee withdrawn (nothing to protect).
- eval-watch.ts + its dashboard tests: rendered ~/.gstack-dev/e2e-live.json
and _partial-e2e.json, written only by unsharded runs, so it showed
nothing for every supported (sharded) entry point. Guarantee withdrawn;
live progress is the gstack-detach log or gh run watch. Manual-review
rendering stays covered by eval-list and eval-summary tests.
- Orphan fixtures (autoplan-pending-artifact-ae.json, autoplan-existing-app/,
autoplan-sign-in-ui/, parity baselines v1.47.0.0/v1.57.7.0/v1.69.1.0):
no test, touchfile or script reads them; superseded baselines stay in
git history.
- QA_FUNCTIONAL_INPUTS: exported, never imported.
* refactor(test-free): delete dead WORKER_HOSTILE list and buildShardArgs parallel mode
Neither had a production caller: full-suite mode runs shard processes, so the
worker quarantine was inert and --parallel was never passed (W8b).
* docs(test-value): narrow prompt-byte contract to machine-read tokens (D2)
Define prompt-byte contract as machine-read tokens (markers, field names,
command lines, enum values, file paths, security-boundary strings) and add a
sentence-pin glossary entry: convert to structural checks or delete when a
behavioral eval covers the behavior.
* test(ratchet): count free tests that slice a paid test's source
A free test that binds readFileSync(<paid test file>) and cuts it with
.slice() tests the paid harness's code out of context even when it imports a
lib/ symbol. Record the 15 existing files with reasons; new ones fail with fix
text. Self-test covers positive and negative shapes.
* test(browse): un-quarantine compare-board; all 16 board tests pass headless (W8d, CEO-24)
The GSTACK_COMPARE_BOARD_TESTS opt-in hid a headless mismatch that no
longer reproduces: all 16 tests pass on Bun 1.4.0 with the bundled
headless Chromium, solo, repeated, and beside other in-process browser
files. Protected behavior (the comparison-board DOM contract the
plan-design-review/office-hours/design-consultation feedback loop polls)
is checked on every free run again.
* test: replace silent existsSync early returns with explicit skips or assertions (W8d)
- browse/test/build.test.ts: server-node.mjs checks skip only when the
bundle is absent and GSTACK_EXPECT_BINARIES is unset; the free CI lane
and test:ubicloud build it and set the flag, so a dropped build step
fails with the build command instead of passing with no assertions.
- gstack-update-check: VERSION is tracked; the guard could only hide a bug.
- gen-skill-docs host leakage/frontmatter checks assert the host tree
exists (the module-level render always produces it).
- cso-docker staged-runtime test uses test.skipIf so reports show it as
skipped, not passed.
* test(ship): convert ship-workflow-clarity sentence pins to structural checks
Add test/helpers/prompt-structure.ts (between, expectTokens, expectAbsent,
expectOrdered, expectMentions) with fix text on failure. ship-workflow-clarity
now pins headings, step order and machine-read tokens (commands, fields, enum
and status strings); safety rules are meaning-level keyword checks. Wording is
judged by the 'ship/SKILL.md workflow' judge in skill-llm-eval.
Sentence pins: 90 -> 0.
* ci: add platform-qualification lane for opt-in ML, gitleaks and Swift tests (W8d, CEO-24)
security-bench + security-live-playwright L4 (SECURITY_BENCH), the real
gitleaks 8.30.1 memory-ingest cases (GSTACK_TEST_GITLEAKS) and the
DebugBridge Swift build invariants (GSTACK_TEST_SWIFT) self-skip in every
lane today. No scheduled lane has their prerequisites, so per CEO-24 they
move to an owned dispatch + quarterly workflow instead of being deleted.
Each job was run locally (ML 10 pass, gitleaks 130 pass; Swift needs
macOS). test/platform-qualification-workflow.test.ts pins gate variable,
job and file together.
* fix(scripts): capture-baseline and preflight-agent-sdk no longer act on --help or typos (W8e)
capture-baseline parses its flags strictly: --help prints usage, an unknown
or valueless flag exits 2, and only a valid invocation writes a fixture
(--help used to write test/fixtures/parity-baseline-current.json).
preflight-agent-sdk gains --help, rejects unknown flags, and runs the live
SDK query (API spend) only with --live.
* test(evals): register the three keyless periodic paid files with case ids (W1b)
skill-e2e-auq-consistency, skill-e2e-auq-verbose-vs-carved-ab and
codex-e2e-recommendation-substance now carry touchfiles, a periodic tier and
kind rule (one trial, unchanged), so editing one selects its own case instead
of restoring the full PR gate. The verbose A/B case also registers the vendored
pre-cut fixture it reads, and review-army-migration-safety registers the SQL
fixture it reads.
* feat(evals): narrow PR fallback for free-only inputs (W1a, CEO-13/20, ENG-13)
The PR profile now exempts the duration seeds, every free-lane workflow
(explicit list; inventory test fails on an unclassified workflow, .yaml
and workflow_call included), scripts/ubicloud/** and fixtures declared in
the explicit FREE_FIXTURES map. Each remaining unknown file carries a label
and fix (needs touchfile entry / add to FREE_ONLY_PR_FILES / real unknown
dependency). evals.yml itself still restores the full gate.
* ci: delete ci-image.yml; the eval workflows already build and push the same content-hash tag (W8f)
evals.yml, evals-periodic.yml and evals-marathon.yml each compute the
identical hashFiles() tag and build/push it (with :buildcache and :latest)
when missing, so ci-image's push trigger and weekly cron were no-ops
(30-day median 0.5 min, 36/36 success). ci-image-tag-binding now pins the
three eval workflows.
* ci(evals): key periodic/marathon concurrency on ref+event; branch periodic dispatch skips the gate census (W2a, ENG-9, CEO-04)
* refactor(paid): drop ~160 unused imports; leaf paid-types/paid-select modules break the paid-* import cycle (W8c)
* ci(quality-gate): per-PR concurrency, free runner, drop unscoped bun audit (W2a, W8f)
- Concurrency keys on pull_request.number || run_id, so back-to-back main
pushes no longer cancel each other's credential scan.
- ubuntu-24.04 instead of a billed 8-vCPU Ubicloud runner for a ~1 min job.
- bun audit --audit-level=critical ran on every PR regardless of diff, so a
newly published advisory turned unrelated PRs red, with its own ignore
policy. dependency-review (lockfile PRs, fail >= high) and the weekly OSV
sweep remain the dependency gates.
* chore(test-free): refresh the free duration seed from the audit's Ubicloud recording
Adds the 19 files merged after the last refresh, including the 115 s
claude-overlay-setup that packed as ~1 s and doubled a shard (W6a). The seed
is re-recorded on the final tree at the end of this wave.
* ci: move tiny ubicloud-standard-2 jobs to free ubuntu-24.04 runners (W8f)
actionlint, skill-docs, dependency-review, version-gate and pr-title-sync
are sub-minute jobs; GitHub-hosted runners are free for this public repo.
* feat(test-free): pessimistic unseeded packing, seed growth ratchet and CI health summary
- Unseeded files pack at the seed's p99 instead of p75 (W6a).
- --ci-plan warns in the job summary past 5 unseeded files; --ci-verify
lists shards that outran their prediction by 1.5x (and 30 s) plus every
flaky pass absorbed by the serial retry (W6a, W7a job summary).
- test/free-seed-ratchet.test.ts fails when a seeded file over 60 s is not
on scripts/free-test-seed-allowlist.json, when an entry is stale, and when
the allowlist grows versus its merge-base copy unless the new entry is an
annotated exception with a todo (CEO-10, DX-7). free-plan runs it with
full history so the shrink check is real in the required lane.
- Every message names the fix command and docs anchor (DX-6).
* feat(evals): state PR coverage mode, counts, reuse and fallback files in the summary and comment (CEO-13)
* test: make the tracked-tree skill-doc freshness check local-only; tidy skill-docs header (W8f)
Every free CI shard regenerates the tracked SKILL.md files before running
tests, so the --dry-run freshness assertion compared the regenerated tree
with itself and could not fail there. It now skips under GitHub Actions;
skill-docs.yml's git diff --exit-code is CI's freshness gate. Removes a
stale concurrency comment in skill-docs.yml.
* ci(free-tests): install zsh so the bash+zsh portability arms run (W6f)
~42 zsh-arm tests (aside-probe-shell, qa-browser-preservation,
generated-docs-fences) skipped in CI because zsh is not in the runner image.
All 141 tests in those files pass with zsh present.
* feat(evals): executors write negative receipts at the execution boundary (CEO-25, ENG-6)
A completed single-trial rule/judge shard that did not pass now writes its
negative receipt beside the pass receipts in the slice artifact, so a
cancelled run's FAIL still blocks an older PASS when its report never runs.
Receipts merge negatives first and order by (run attempt, completedAt); a
same-second FAIL/PASS tie resolves to FAIL. The runner call site is a
one-line hunk in scripts/test-paid-shards.ts.
* docs(cso): state that contained runtime/scanner execution is unavailable today
The scanner catalog is empty while its build inputs await review and the
runtime catalog holds no qualified profile until the private evaluator
exists, so /cso runs static assessment only. AGENTS.md, README and
docs/cso-release-qualification.md now say so; docs/cso-scanners.md
already did.
* test(helpers): expectMentions splits on sentence ends only
Clauses joined by ';' or ':' are one rule; splitting there made a reworded
rule fail for punctuation.
* test(plan-ceo): convert skill-ceo-section-ordering sentence pins
Safety and authority rules (never/do not/stop/only/without/wait/approval) are
meaning-level expectMentions checks; other sentence pins are dropped. Headings,
labels, option rows, placeholders and machine-read lines (auto-decide
annotation, Mode:/approved decisions format, STATUS/SOURCE fields,
CROSS-MODEL marker, gstack-ceo-mode-handoff) stay as tokens; ordering checks
unchanged. Behavior is covered by the periodic PTY case in
skill-e2e-plan-ceo-review-section-loading.test.ts.
Sentence pins: 210 -> 23.
* test(helpers): expectMentions treats wrapped lines as one sentence
Templates hard-wrap prose; only sentence ends and blank lines separate rules.
* test(gen-skill-docs): convert sentence pins to meaning checks or drop them
Safety/authority sentences become expectMentions keyword checks; other English
sentences are dropped (wording is judged by the per-skill workflow judges in
skill-llm-eval and the E2E cases in touchfiles-data). Commands, config keys,
markers (PLAN MODE EXCEPTION, NO UNRESOLVED DECISIONS, Gate outcome), field
names and alternation-based meaning regexes stay. Removed the now-empty
'contains opt-in AskUserQuestion text' test (only pinned a sentence; the
resolver's AskUserQuestion wiring is covered by the codex second-opinion
tests in the same describe). Lane E's existsSync hunks are untouched.
Sentence pins: 216 -> 65 (remaining lines carry machine tokens).
* ci(windows): shard the Windows lane via --ci-plan/--ci-run/--ci-verify; move native campaigns to native-qualification.yml
- windows-free-tests.yml: a Linux plan job curates and packs the Windows-safe
files into 6 shards, one strict serial shard per windows-latest job, and a
Linux aggregate verifies exact coverage and every result (8.1 min on one
runner today). --windows-only now combines with the CI modes; the plan binds
the curated file set (W6e).
- Every Windows plan and --list run prints the curated count with its top
exclusion reasons in the job summary; a free ratchet fails when the curated
subset drops below its floor, with the fix (W6e).
- The four Dia/cookie diagnostic dispatch campaigns move to the dispatch-only
native-qualification.yml with one exclusive `mode` choice input, so their
red dispatch runs no longer read as a red PR lane (W8f). Their workflow pins
move to test/windows-native-workflows.test.ts; the boolean-exclusivity
guard is replaced by the choice input.
* feat(paid): per-slice CI job ceilings and an in-process slice deadline with not_run/hung outcomes and checkpoints (W2c, ENG-2)
* fix(pass-rates): segment trial history strictly by EVAL_POLICY version
Reader-compatibility floor for EVAL_POLICY v2 (ENG-14/CEO-35/DX-12). Only
trials under the reader's own policy version feed labels and alarms; older
policy trials stay visible but are never scored or used as a drift baseline;
trials from a newer policy are ignored with a printed count and fix text.
Reverting the later v2 writer commits leaves a reader that cannot pool v2
records into v1 series (the pre-PR reader at 2db0b3a does: it reports a
mixed fixture as FAILING with drift alarms).
* docs: one contributor command table; retired commands, seed sources and current workflows (W8g, DX-5, DX-13, CEO-12)
- CONTRIBUTING.md gains 'Which command do I run?' (task -> command ->
cost/time -> needs, including branch validation via gh workflow run);
CLAUDE.md, AGENTS.md and TESTING_INTERNALS.md link to it instead of
repeating command lists. Tier tables drop retired commands and stale
per-run dollar estimates.
- Retired names (test:evals, test:e2e, eval:bg, eval:flake-rank, eval:watch,
...) are gone from CLAUDE.md, CONTRIBUTING.md, TESTING_INTERNALS.md,
ARCHITECTURE.md and USING_GBRAIN_WITH_GSTACK.md.
- The flake-ledger claim now says what happens: CI uploads flake-ledger-*
artifacts; eval:pass-rates reads only the local ledger.
- TESTING_INTERNALS states that only test:ubicloud --record-durations
produces an acceptable duration seed (DX-13).
- CI section: quality gate no longer runs bun audit; dependency-review's
real trigger; the platform-qualification lane.
- docs/test-audit-2026-09.md gets a corrections section for its stale claims.
- TODOS.md: audit follow-ups (post-merge metrics, stub removal, name reclaim,
diff-aware planner); eval-watch shard-awareness and the image freshness
tripwire closed as won't-do.
* feat(evals): recover receipts of cancelled PR runs (W1c, CEO-14/34, ENG-4/5/7)
A new recover-receipts job runs base-ref code with actions: read, restores
the PR's store, merges the receipts of completed cancelled evals.yml runs
for this PR (provenance-checked, at most 5, oldest first, negatives first),
reconstructs completed panel negatives with panelVerdict() (partial panels
get no credit) and keeps a recovery.json checkpoint that never advances past
an unresolved run. plan-slices keeps contents: read, takes the store as an
artifact, turns reuse off when recovery degraded or a run is unresolved, and
carries the whole store to slices-report so nothing is lost. Any gh problem
degrades to no recovered receipts with a named reason.
* feat(evals): classify this wave's free-only tools and workflows for PR selection
platform-qualification.yml, retired-command.ts, test-health-report.ts,
bump-harness-version.ts and eval-bg.ts never run inside a paid case.
* feat(evals): debounce PR push bursts before planning paid slices (W1d, CEO-15, ENG-11, DX-7)
A tiny ubuntu-24.04 job waits 90 s only on synchronize when another run for
the PR started in the last 15 minutes; cancel-in-progress supersedes, and a
run that outlives the wait reports "superseded by <sha>" and plans nothing.
Labels: evals-no-debounce skips the wait, evals-fresh disables receipt reuse.
* perf(test): move the real-process browser settlement cases out of test-free-shards.test.ts (W6b)
The 19 owned-browser settlement modes were 85 s of the file's 95 s and could
not be packed apart from the fast runner unit cases. They move to a shared
fixture with two files (lifecycle 47 s, ownership 39 s); the unit file drops
to 10 s. Same modes, same assertions.
* chore(evals): delete the finished validation_phase dispatch and its inline planner (W8f)
Retirement (CEO-24): the protected behavior was a one-off cookie-repair
validation subset (eight dependent cases) and a quality/behavior split of
the census; that validation is complete, so the guarantee is withdrawn.
Branch validation dispatches evals.yml with evals_all.
* perf(test): inject the office-hours record grace in non-cooperative deadline tests
* perf(test): shrink aside-render process slack via GSTACK_RENDER_SLACK_MS in timeout tests
* perf(test): make the memorable lock give-up configurable for lock-contention tests
* perf(test): check install-timeout knob normalization through its own setup lines
* perf(test): inject a 2 s storage-reset deadline in the late isolated dispatch test
* perf(test): shorten the slow gbrain fake to 1 s, still past the 300 ms probe timeout
* ci(free-tests): run only cso-docker-integration in the free CSO Docker job (F16)
cso-node-lifecycle-integration and cso-stack-cold-integration need
GSTACK_CSO_TEST_STACK images and always skipped there; they stay in the CSO
runtime workflows through test:cso:docker.
* test(gen-skill-docs,plan-ceo): split mixed sentence pins into tokens and rules
Sentences that wrap a backticked or bold token keep the token (expectTokens)
and, when they state a safety rule, a keyword check; short safety sentences
(25-39 chars) get the same treatment.
* test(plan-ceo): convert ceo-workflow-clarity.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: periodic PTY case skill-e2e-plan-ceo-review-section-loading and the plan-ceo workflow judges.
Sentence pins: 13 -> 1.
* test(plan-eng): convert eng-review-routing.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: plan-eng E2E cases (skill-e2e-plan-eng-*) and the plan-eng workflow judge.
Sentence pins: 28 -> 6.
* test(plan-eng): convert eng-scope-entry-ap.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: plan-eng E2E cases (skill-e2e-plan-eng-*) and the plan-eng workflow judge.
Sentence pins: 16 -> 5.
* test(plan): convert plan-scope-selection.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: plan-review E2E cases and workflow judges in skill-llm-eval.
Sentence pins: 19 -> 2.
* test(qa): convert qa-lazy-sections.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: qa/qa-only E2E cases (skill-e2e-qa-*) and the qa workflow judge.
Sentence pins: 71 -> 11.
* test(qa): convert qa-browser-preservation.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: qa/qa-only E2E cases (skill-e2e-qa-*) and the qa workflow judge.
Sentence pins: 25 -> 11.
* test(qa): convert qa-probe-gates.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: qa/qa-only E2E cases (skill-e2e-qa-*) and the qa workflow judge.
Sentence pins: 20 -> 5.
* test(qa): convert qa-checkpoint-evidence.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: qa/qa-only E2E cases (skill-e2e-qa-*) and the qa workflow judge.
Sentence pins: 7 -> 5.
* test(qa): convert qa-evidence.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: qa/qa-only E2E cases (skill-e2e-qa-*) and the qa workflow judge.
Sentence pins: 4 -> 3.
* test(design): convert design-consultation-contract.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: design-consultation E2E/judge cases in touchfiles-data.
Sentence pins: 44 -> 11.
* test(outside-voice): convert run-in-background-guidance.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: outside-voice E2E cases and plan-review workflow judges.
Sentence pins: 35 -> 5.
* test(spec): convert spec-template-invariants.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: spec E2E/judge cases in touchfiles-data.
Sentence pins: 36 -> 21.
* perf(evals): 420 s census slice budget; case-shard skill-e2e-qa-workflow; seed its case walls (W5c)
* feat(evals): evals.yml dispatch contract for eval:bg (CEO-17/29, DX-1, ENG-8/12)
workflow_dispatch gains base_ref, base_sha, expected_sha, nonce and
pr_receipts. The nonce appears in run-name so the dispatcher resolves its
own run; evals_all=false runs the PR profile against base_sha/base_ref; a
checkout that differs from expected_sha fails before any paid work with a
named fix; pr_receipts reads that PR's receipts read-only through the
recover-receipts artifact path (never the cache) and never saves.
* ci(windows): pack the Windows lane with Windows-measured durations (W6e)
The first sharded run (37221451711) finished in 6.0 min: the Linux seed has
browse/test/cookie-import-native-job.test.ts at ~0 s (its cases skip on
Linux) but it takes 122 s on Windows, so one shard ran 242 s against an 84 s
prediction. The plan now reads scripts/free-test-durations-windows.json; a
record_durations dispatch times every Windows-safe file alone and uploads it.
* test(free): settlement case files import the runner rule they exercise
Keeps the split files out of the test-of-test ratchet: the retry-eligibility
rule is a direct runner import passed to the shared fixture.
* fix(marathon): no hollow plan-decision-classification shard; office-hours marathon scenario scoped to the pilot (W2f)
* test(free): satisfy the typecheck:test ratchet in the seed ratchet test
* refactor(ci-history): one shared GitHub history reader with the CI flake-ledger reader
Extract pass-rates' gh fetch layer into scripts/lib/ci-history.ts (CEO-09) and
add the W7a reader: paged run listings that fail whole on any page error,
per-run artifact downloads (cached, size-capped, data only), flake-ledger
parsing, the pre-registered flaky-file rule (> 5% of main free-tests runs over
a window of at least 20 runs, widened to the newest 20 runs when the window is
thinner), a job-summary table, and named unavailable reasons with next steps.
* feat(test-health): test:health report of the audit success metrics
scripts/test-health-report.ts (CEO-09/06/22/32, DX-8/9/12/13) prints every
success metric with its counting rule from CI history: PR full-fallback rate,
reused PR trial records, PR-lane spend per merged PR and per validated
revision, cancelled slice-minutes per week, push-to-verdict p50/p95, census
expected failed trials per run with raw failure rate per kind/class and
P(lane red) under the recorded panels vs single-trial aggregation, INFRA
re-dispatches, quarantine evidence (insufficient evidence distinct from
healthy), free flaky-pass rate, free/Windows wall, free serial time and the
net-complexity line. An unreadable input prints 'unavailable: <reason>; next:
<step>', never 0. --enforce fails on a flaky file (W7a) or > 5 unseeded free
files (CEO-10); unavailable checks never fail and keep the issue open.
* test(review): convert review-workflow-clarity.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: review E2E cases (skill-e2e-review*) and the review workflow judge in skill-llm-eval.
Sentence pins: 85 -> 17.
* test(review): convert review-entry-and-design-clarity-au.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: review E2E cases (skill-e2e-review*) and the review workflow judge in skill-llm-eval.
Sentence pins: 15 -> 4.
* test(review): convert review-enum-lifecycle.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: review E2E cases (skill-e2e-review*) and the review workflow judge in skill-llm-eval.
Sentence pins: 8 -> 0.
* test(ship): convert ship-control-flow.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 74 -> 9.
* test(ship): convert ship-skip-requeue.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 28 -> 3.
* test(ship): convert ship-plan-completion-invariants.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 28 -> 12.
* test(ship): convert ship-reentry-gates.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 16 -> 4.
* test(ship): convert ship-document-release-dispatch.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 11 -> 4.
* test(ship): convert ship-apple-gate.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 7 -> 0.
* test(ship): convert ship-skip-actor.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 6 -> 1.
* test(ship): convert ship-template-redaction.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 5 -> 4.
* test(ship): convert ship-publication-gates.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 5 -> 2.
* test(ship): convert ship-review-loop.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 3 -> 1.
* test(ship): convert ship-version-sync.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 5 -> 2.
* test(ship): convert ship-pr-liveness-policy.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: ship E2E cases (skill-e2e-ship*, skill-e2e-workflow) and the 'ship/SKILL.md workflow' judge.
Sentence pins: 4 -> 0.
* test(plan-review): convert plan-review-cases.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: plan-review E2E cases and workflow judges in skill-llm-eval.
Sentence pins: 58 -> 15.
* test(autoplan): convert autoplan-phase-order.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: autoplan E2E cases (skill-e2e-autoplan-*) and the autoplan workflow judge.
Sentence pins: 42 -> 11.
* test(autoplan): convert autoplan-phase-handoff.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: autoplan E2E cases (skill-e2e-autoplan-*) and the autoplan workflow judge.
Sentence pins: 20 -> 4.
* test(autoplan): convert autoplan-snapshot.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: autoplan E2E cases (skill-e2e-autoplan-*) and the autoplan workflow judge.
Sentence pins: 21 -> 5.
* test(outside-voice): convert outside-voice-preflight.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: outside-voice E2E cases and plan-review workflow judges.
Sentence pins: 26 -> 9.
* test(ask-format): convert resolver-ask-user-format.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: AUQ E2E cases (skill-e2e-auq-*); prompt-injection rule kept as a meaning check.
Sentence pins: 32 -> 15.
* test(skills): convert binding-template-drift.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: workflow judges in skill-llm-eval.
Sentence pins: 19 -> 13.
* test(skills): convert carve-plan-fixture.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: workflow judges in skill-llm-eval.
Sentence pins: 20 -> 6.
* test(land-and-deploy): convert land-and-deploy-postfail.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: land-and-deploy E2E cases and its workflow judge.
Sentence pins: 21 -> 14.
* test(land-and-deploy): convert land-and-deploy-ci-gate.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: land-and-deploy E2E cases and its workflow judge.
Sentence pins: 5 -> 4.
* test(land-and-deploy): convert land-and-deploy-flow.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: land-and-deploy E2E cases and its workflow judge.
Sentence pins: 5 -> 3.
* test(office-hours): convert office-hours-completion.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: office-hours E2E cases (skill-e2e-office-hours*).
Sentence pins: 16 -> 1.
* test(plan-ceo): restore the stale closing-route guard
The negative check for 'Closing hooks' / 'return to section' guards a retired
route token, not a sentence; the first conversion pass dropped it.
* ci(test-health): weekly test-health workflow with an honest tracking issue
New test-health.yml (CEO-18/DX-9): Monday 10:00 UTC after the periodic census
plus dispatch, free ubuntu-24.04 runner, permissions contents:read +
actions:read + issues:write only. Runs bun run test:health --since-days 7
--enforce; an enforced failure upserts one tracking issue, a run with
unavailable inputs keeps it open and lists them, and it closes only when every
enforced check has evidence and passes. Only main runs touch the issue.
* feat(evals): an edited paid test file runs its own gate cases in the PR lane (DX-11)
A gate case outside the audited fast profile is selected when its single
owning paid test file changed and the runner can select it by name (its
Bun test is named by the case id). The manifest records directCases and
validation accepts only recorded, name-addressable ones; the runner and
planner read the file->cases map from test-pr-profile. Cases the runner
cannot address stay deferred with the fix. An inventory test covers every
owned gate case. Touches one hunk each in test-paid-shards.ts and
lib/paid-plan.ts, and pr-shared-input-selection.test.ts's ship-skip pin.
* ci(osv): tracking issue for scheduled reds and a 14-day suppression expiry test
F11/W8f: a failed main OSV scan now upserts one tracking issue and a clean
scan closes it (scheduled reds notified no one during the August backlog).
A free test fails 14 days before any .osv-scanner.toml ignoreUntil (all four
expire 2026-11-30), with the fix: upgrade and delete, or re-justify and move
the date.
* test(ship,review): keep guards against retired fail-open instructions
'skip silently' on reviewer failure and 'do not block /ship on subagent
failure' were harmful instructions, not prose style; keep them absent with the
shortest distinctive phrase.
* feat(eval-select): default to the pr profile
DX-10: eval:select previews the PR lane's selection by default, matching
test:pr and eval:bg:pr; --profile full (or EVALS_PROFILE=full) keeps the plain
touchfile selection.
* test(evals): type-clean the recovery gh fake (typecheck:test ratchet)
* chore(windows): record the Windows duration seed (run 37221963236)
573 Windows-safe files timed alone on windows-latest; cookie-import-native-job
is 102 s there. Six shards now predict 154 s each.
* feat(evals): eval:bg dispatches the pushed ref to CI or runs locally under a 1.5x-planned cap (W5d, CEO-17/29, DX-1/2/3/7, ENG-12/19)
* feat(runners): --help on both shard runners via the shared flag loop; paid runner header describes today's planner/executor/report (W8e)
* test(windows): drop the stale Playwright exclusion and force-include probe-proven files (W6e)
A temporary windows-latest probe (run 37221995077) ran each of the 97 files
excluded for 'launches Playwright browser' or 'raw /tmp/ path' alone: all 17
Playwright files pass (Chromium is installed and Bun drives it there), and 41
of the /tmp files pass with executed cases. The Playwright pattern is removed
and the 41 files are force-included with the probe as their reason; the 36
real failures stay excluded. The curated subset grows from 573 to 631 files
and the ratchet floor follows. Windows curation moves to
scripts/lib/windows-curation.ts (the runner drops to 2000 lines).
* test(free): one install fixture cloned from a read-only seed (W6c, ENG-1)
Merge test/helpers/setup-codex-scope-fixture.ts into install-fixture.ts.
The checkout is built once per test file into a read-only seed and cloned
per fixture with copy-on-write where the filesystem has it (full copy
otherwise), restoring each file's own mode; clones never hard-link the
seed because put() and tests write in place. Callers register
afterAll(cleanupSeed); Bun's runner fires no exit event, so seeds of
killed runs are swept by pid. test/install-fixture.test.ts is the ENG-1
tripwire: put/setVersion/chmod in one clone leave the seed and a sibling
unchanged, and clones share no inodes with the read-only seed.
* test(free): split claude-overlay-setup by describe (W6b)
The 115 s serial file becomes default/lifecycle/installs files (5/4/3
tests, unchanged bodies) sharing test/helpers/claude-overlay-fixture.ts,
so the shard packer can balance them.
* test(cso): convert cso-contracts.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: cso E2E/judge cases (skill-e2e-cso*, cso-eval).
Sentence pins: 16 -> 8.
* test(cso): convert cso-preserved.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: cso E2E/judge cases (skill-e2e-cso*, cso-eval).
Sentence pins: 10 -> 3.
* test(cso): convert cso-eval.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: cso E2E/judge cases (skill-e2e-cso*, cso-eval).
Sentence pins: 7 -> 4.
* test(browser): convert aside-driver.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: Aside/browse E2E cases; the installer ban stays a meaning check.
Sentence pins: 27 -> 9.
* test(browser): convert third-party-actions.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: Aside/browse E2E cases; the installer ban stays a meaning check.
Sentence pins: 17 -> 2.
* test(skills): convert skill-validation.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: workflow judges in skill-llm-eval.
Sentence pins: 19 -> 6.
* test(skills): convert workflow-excerpt.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: workflow judges in skill-llm-eval.
Sentence pins: 37 -> 10.
* test(skills): convert question-tuning-registry-path.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: workflow judges in skill-llm-eval.
Sentence pins: 4 -> 0.
* test(skills): convert host-conformance.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: workflow judges in skill-llm-eval.
Sentence pins: 4 -> 4.
* test(memory): convert memory-ingest-landing.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: memory-ingest free tests that run the binary.
Sentence pins: 11 -> 9.
* test(windows): exclude the skip-only claude-overlay setup files from the Windows subset
Their real-setup cases are describe.skipIf(win32); after the split their bin/
spawns live in the shared helper, so the source scan stopped seeing them.
* test(skills): convert agents-digest.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 1 -> 0.
* test(skills): convert brain-preflight.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 2 -> 1.
* test(skills): convert codex-skill-isolation.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 1 -> 0.
* test(skills): convert office-hours-review.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 2 -> 1.
* test(skills): convert onboarding-moved-literals.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 2 -> 2.
* test(skills): convert open-gstack-browser-liveness.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 3 -> 2.
* test(skills): convert plan-floor-review.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 3 -> 2.
* test(skills): convert plan-review-report-recording.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 4 -> 2.
* test(skills): convert regression-1539-review-self-verify.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 4 -> 0.
* test(skills): convert skill-fixture.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 6 -> 3.
* test(skills): convert template-context-parity.test.ts sentence pins
Safety and authority sentences become expectMentions keyword checks (reword
freely, keep the rule); other English sentence pins are dropped. Headings,
labels, placeholders, commands, field names, enum/status tokens and ordering
checks stay. Behavior and wording: the owning skills' E2E cases and workflow judges; CLI/hook output and fixture-data pins in the tail were left alone.
Sentence pins: 1 -> 0.
* test: restore pins on renderer output and paid-fixture inputs
cso-contracts (the report renderer's required empty phrase), memory-ingest
(binary output), carve-plan-fixture, ship-skip-actor and cso-eval (inputs the
paid harness builds) assert product or fixture output, not skill prose, so the
value-bar narrowing does not apply to them.
* feat(eval-policy): v2 series identity, HARNESS_VERSION guard and identity backtest
W4a (CEO-27/ENG-3/DX-6), not yet wired to the writer: caseSeriesIdentitiesV2
keys a case by the bytes it owns (paid test file, fixtures, its skills' prompt
files including the generated SKILL.md) plus HARNESS_VERSION, and records the
full consumed-input fingerprint as provenance. scripts/harness-version.json
pins the blob of every shared-harness file (GLOBAL_TOUCHFILES plus the session
runners, PTY harness, e2e gate and LLM judge), one line per file;
test/harness-version.test.ts fails on drift with both fixes, and
scripts/bump-harness-version.ts records the decision: --bump (new series for
every case) or --non-behavioral (compatibility entry, no reset).
eval-trial-series --backtest replays identities over weekly main revisions
and recorded trials (ENG-3/DX-12).
* feat(pass-rates): weekly history is main's scheduled runs plus main dispatches
W4b: pass-rates reads evals-periodic history from main only, keeping scheduled
runs and main dispatches and never a branch dispatch, so back-to-back branch
validation runs neither feed pass rates nor count as weeks for quarantine
expiry or drift. --branch <name> still reads one branch's runs for inspection.
* docs(test-audit): EVAL_POLICY v2 decision memo with the identity backtest
D1 memo (CEO-33, ENG-3, DX-12, CEO-27): P(green) arithmetic, false-blocking
targets, the v2 identity rule and harness guard, weekly history, W4c evidence
(the named 'stochastic' cases pass 26/27 to 34/34, so they stay rule), the
backtest over 29 weekly main revisions and 14,898 recorded trials, what it
means for quarantine reachability, alternatives (gating vs trended, adaptive
panels not adopted, buy vs build), and the rollback proof on the pre-PR reader.
* feat(eval-policy): EVAL_POLICY v2 writer: case-owned series identity
The v2 writer, last commit of the W4 block (DX-12/ENG-14/ENG-21): the report
job's stamp now writes caseSeriesIdentitiesV2 (case-owned bytes plus
HARNESS_VERSION) as series_identity, the full consumed-input fingerprint as
series_fingerprint and harness_version as provenance, and EVAL_POLICY.version
is 2 (approved 2026-10-04, D1). The v1 touchfile identity is removed.
Rollback = revert this commit (and the W4 commits above the reader-compat
floor); readers then ignore the v2 records with a printed count.
* test: restore pins on paid-harness prompt inputs
review-enum-lifecycle and plan-review-report-recording assert the prompt a
paid case's harness builds (opts.prompt / call.prompt), a fixture contract,
not skill prose.
* test(security): check injected safety lines on meaning, not capitals
content-security, the canary instruction and the arm judge prompt still must
carry their never-follow / never-output / exact-"none" rules; the checks are
case-insensitive keyword checks so emphasis can change. The UNTRUSTED envelope
markers and "none" value stay exact tokens. (Hidden element stripping fails
locally only because Playwright Chromium is not installed; same at base.)
* test(plan-ceo): keep the outside-voice scope-summary rule as a meaning check
The first codemod pass left an empty if body (TS1313).
* chore(windows): re-record the Windows duration seed for the 631-file subset (run 37222668939)
* ci(free-tests): summarize every shard's flake ledger in the aggregate job (W7a)
The aggregate downloads flake-ledger-* (one subdirectory per shard) and
appends lane C's `scripts/test-health-report.ts flake-summary` output to the
job summary before strict verification. The runner's own flaky table is
dropped so the ledger reader stays the single source; --ci-verify keeps the
shard-overrun warning.
* feat(evals): free test files anywhere and the stored-zip helper never restore the full PR gate (W1a)
The CEO-23 replay found design/test free tests forcing fallback (36485436963).
* feat(evals): replay recorded PR pushes through today's selector (CEO-23, ENG-18)
scripts/replay-pr-selection.ts reports per push the recorded vs replayed
mode and case count, dropped gate cases, retired failed cases and every
miss (a failed case that depends on the diff but is no longer selected).
* refactor(evals): one case-sharded carve-section-loading file with a case id and touchfiles per skill (W5a)
* test(free): hold qa-deadline's full-pipe case on a FIFO, not a paused Bun stream
Bun gives a child 'pipe' stdio a unix socketpair, so whether the 2 MB fill
actually blocks depends on the parent's reader and the host's socket buffer
sizes. CI (run 36761671811, both attempts) saw exit 0 after ~130 ms; with
net.core.{w,r}mem_default=4 MiB locally the old case fails 3/3 the same way.
A FIFO the test never reads is bounded by the kernel pipe buffer, so the
receipt write genuinely blocks and the 5 s settlement deadline must fire.
The 7 s bound now starts once the preload has queued the write.
* test(free): event-driven waits in pty-output-wake
close-releases-observers: the 500 ms wall race becomes an ordering check
(the waiter is released while only SIGINT has been sent, before close's
escalation finishes), and the Bun.spawn spy fakes only the PTY launch so a
shard neighbor's in-process spawn cannot add a stray SIGTERM (CI runs
36015568981, 36036582721, 36074636848).
continuous-redraws: the fixture spinner stops once the observer has made
five coalesced reads, so the run reaches its work deadline with no redraw
in flight. Streaming right up to the deadline raced the helper's screen
drain and failed as 'PTY screen parse failed; viewport is incomplete'
(5 CI runs 09-30..10-03; 4/40 locally under 8 busy loops, 0/40 after).
* test(free): session-runner long-capture handshake waits for the collected Read event
The fake CLI's init line arms the runner's work-phase timer, so the worker's
handshake (work-ready + a >200 s timer) could pass before the runner's read
loop had collected the Read event printed just before work-ready. Advancing
the clock then killed the run with the Read lost: readSection false (CI run
37194511124). The worker now also waits for the runner's own progress line
for that Read. Forcing the observed ordering (work-ready 200 ms before the
Read line) fails the old test deterministically and passes the new one.
* test(free): budget-override restores the CI variables it rewrites
Its provenance cases set and then deleted CI, GITHUB_ACTIONS, GITHUB_REF_NAME,
GITHUB_SHA and the GitLab CI_* names without restoring them, so in a CI shard
every later file ran with CI unset. qa-only-cleanup's real browse daemons
then launched Chromium without --no-sandbox, the sandbox failed on the
runner, and both real-Chromium cases timed out with 'QA cleanup fixture did
not become ready' (shard 12 attempt 1 of six runs on 10-04, retry alone
green). Retained startup log: 'Chromium sandboxing failed!', child env with
no CI. Reproduced 3/3 with CI=true, userns denied and budget-override ahead
of qa-only-cleanup in one process; 0/3 after.
* test(free): pr-shared-input-selection names its base and package history
Every selection now passes EVALS_BASE and packageVersionOnly explicitly, so
no case reads the checkout's git state. Before, 12 calls ran
detectBaseBranch and the cumulative case diffed package.json against
merge-base(origin/main, HEAD) — the ambient input that turned main red in
runs 36572856858 and 36594314027. A PATH git spy counts 14 git calls in the
old file and 0 now.
* feat(evals): derive PR-lane dependents for unmapped files instead of restoring the full gate
scripts/pr-dependencies.ts derives, from the checked-out tree, which paid
cases consume each repository file: test import closures, repo paths and
path.join segments in code/shell/skill text (whole-line comments and
selection data excluded), bin script names, compiled binaries by outfile
path (scripts/build.sh), package scripts, template placeholders through
RESOLVERS, and host configs by host id. The global touchfiles' import
closure is global.
PR selection: an unmapped file with derived consumers puts the run in the
new 'dependents' mode (every dependent gate case and judge, no profile cut);
a tracked file under a derivable directory that nothing reaches is exempt;
periodic/marathon workflows, .gitignore and tsconfig.test.json never run
the PR gate. PR_FULL_GATE_FILES is the fail-closed list (deps, CI image,
setup, build, evals.yml and its actions, test preload, tsconfig.json,
.gitattributes, the skill generator and preamble resolvers, the eval
policy). Untracked or underivable files restore the full gate with fix
text. The summary and PR comment list derived dependents.
* feat(evals): replay misses count derived dependents; report wave vs ordinary pushes (CEO-23)
* test: drop FREE_FIXTURES entries for fixtures deleted in W8b
* test: re-shape the census attribution fixture to qa-workflow and carve case shards
* test: census fixture case order
* ci: 420 s PR-lane slices with per-slice ceilings; periodic tracking issue only on main
evals.yml joins the census lanes at the 420 s slice budget (W5c/CEO-15) and
indexes each eval slice's job timeout from .plan.sliceCiTimeoutMinutes with
the slice-deadline clock as its first step (W2c/ENG-2). evals-periodic.yml's
tracking-issue upsert and close run only on refs/heads/main, so a branch
dispatch whose gate census is skipped (CEO-04) never opens or closes#2755.
* docs: integrate lane docs for the audit wave (eval-bg backends, PR fallback, policy v2, ceilings, evidence)
- CLAUDE.md: 'Running evals as an agent' describes scripts/eval-bg.ts's
dispatch and local backends, forcing flags, the sentinel and status;
eval:select's PR-profile default; prompt-structure helper and value-bar
terms. instruction-facts now requires scripts/eval-bg.ts in that section.
- CONTRIBUTING.md: decision table gains test:health, eval:select default,
eval:bg backends and the include_gate_census / evals_all dispatch lines;
420 s runners and per-runner ceilings; flake ledger, OSV tracking issue
and expiry test, weekly test health; prompt-structure guidance.
- AGENTS.md: build commands name the eval:bg backend choice and test:health.
- docs/TESTING_INTERNALS.md: anchors the fix texts point to
(#pr-paid-lane-fallback, #pass-rate-policy-versions, #harness-version,
#flake-ledger, #duration-seed), receipts/recovery/debounce, per-slice
ceilings, the slice deadline with not_run/hung and checkpoints, the eval-bg
cap formula in place of the detach floors, EVAL_POLICY v2 history, carve
case shards via --case.
- docs/test-audit-2026-10.md: CEO-23 replay (165/168 -> 164/168
full-fallback, 0 misses), ENG-17 slice table (re-measured on this tree),
D2 prose-pin metric.
- TODOS.md: progress note on 'Let pass-rate history decide the rest'.
- test/testing-internals-anchors.test.ts: every TESTING_INTERNALS.md#anchor
named in code must match a heading.
* test(free): hold qa-deadline's blocked-output-pipe receipts on a FIFO
The five 'guard %s receipts survive a blocked output pipe' cases filled a
paused Bun child pipe with 2 MiB. That pipe is a unix socketpair, so the
fill only blocks while the host's socket buffers are smaller than the write:
with net.core.{w,r}mem_default=4 MiB the old cases fail 13 of 15 case runs
(the guard finishes before the test resumes the stream). The held stream is
now a FIFO the test drains only after resume(), bounded by the kernel pipe
buffer; Windows keeps the paused pipe. Bounds and assertions are unchanged.
* test(free): qa-deadline waits for a written pid, not just the pid file
DRIVER and LEAF write their pid with writeFileSync, so under load ready()
can see the file before its digits and fail 'expected > 0, received 0'
(seen once in 150 loaded runs). After any early failure the finally
SIGKILLs the CLI, which orphans the detached command group; a leaf whose pid
file is not yet readable then keeps the output stream open and the case
hangs to its 15 s timeout (2/80 old-file runs and 3/310 FIFO-only runs
under 8 busy loops; the instrumented hang showed the CLI already SIGKILLed
by the finally). ready() now polls within the same 3 s bound until the file
holds a positive pid.
* fix(evals): a deleted file selects the dependents of the live files that still reference it
PR selection treated every path absent from the head tree as an unknown
dependency, so any PR that deleted a file forced the full gate. A deleted
path is now placed like a live one, against the head tree: a matching
touchfile selects its cases; live code, skill text or a full-gate input that
still references it (path, extensionless import target, relative import,
bin name, ancestor directory, compiled-binary outfile; whole-line comments
and data files excluded) contributes its dependents, a full-gate referencer
restores the full gate with a 'deleted but still referenced' fix, and an
unreferenced deleted path has no dependents. Deleted PR_FULL_GATE_FILES
entries still force the full gate. Tests that used absent paths as stand-ins
for new unmapped files now use tracked root files (or an explicit tracked
set); the CEO-23 replay counts misses through those references too.
* docs: integrate free-suite lane docs (seed anchor, Windows lane, native qualification, install fixture, flake rules)
- docs/TESTING_INTERNALS.md: '### Free suite duration seed' (the anchor the
seed messages link) with DX-13, the 99th-percentile packing, --ci-plan
warning, --ci-verify overruns and the CEO-10 seed ratchet; the Windows
6-job lane, its Windows-measured seed and refresh dispatch, curation and
WINDOWS_CURATED_FLOOR; native-qualification.yml modes; the merged
install fixture; test-only timing knobs; the flake-ledger job summary,
Windows ledger names and three free-suite flake rules; zsh in the
Ubicloud mirror.
- scripts/test-health-report.ts links #free-suite-duration-seed, so the
two seed messages share one heading (the anchor test caught the split).
- CONTRIBUTING.md: Windows seed refresh and native qualification rows;
seed-source pointer. AGENTS.md: Windows six-job lane.
- docs/cso-release-qualification.md: the free CSO Docker job runs only
cso-docker-integration.test.ts.
- docs/test-audit-2026-10.md: free-suite evidence lines.
- TODOS.md: CEO-11b progress note on the pre-push hook hang.
* test: final duration seeds on the integrated tree; retire the emptied cookie-validation-phases file
Linux seed re-recorded on Ubicloud standard-16 and the Windows seed from
dispatch run 37227140871, both at c903310. The seed allowlist drops the three
entries that are no longer over the ceiling. cookie-validation-phases lost its
validation-phase pins with W8f and its Windows/Dia pins moved to
windows-native-workflows with native-qualification.yml, so the file is
deleted and the curated Windows floor rises to 638. The Windows recorder writes
the seed at its default path so GSTACK_FREE_TEST_DURATIONS never leaks into
timed tests.
* test: re-express stale PR-lane pins against the new evals.yml contract
- ci-eval-cache: the profile/fresh expressions now include evals_all=false
dispatches and pr_receipts/evals-fresh; the PR store is restored only by
recover-receipts (still scoped to repository_id + PR, PR events only),
plan-slices takes it as an artifact and never touches the cache, saves
stay PR-only, EVALS_CACHE_PR binds pr_receipts dispatches, and the report
verdict artifact carries report receipts.
- ci-paid-coordination: plan-slices needs only the two ubuntu coordination
jobs (never the image); the fork/Dependabot clause is unchanged on
plan-slices and also gates debounce and recover-receipts; only recovery
holds actions: read.
- qa-supervision-selection: auq-consistency and auq-verbose-vs-carved-ab
(W1b) reach claude-pty-runner and pty-screen through auq-sdk-capture,
exactly as auq-format-gate does.
- paid-retry-supervision: the full-validation plan uses a tracked full-gate
input (setup); an absent path is now a deletion placed by its references.
* ci(windows): record the Windows seed at the default path
* chore: HARNESS_VERSION non-behavioral decision for the audit-wave integration
* v1.91.20.0 release metadata: test, eval and CI audit wave
* test(compare-board): wait for the post-submit state the feedback POST settles
The two post-submit assertions read the board once, but the board disables
the submit button and shows the message only after its feedback POST
resolves. On a loaded Ubicloud shard the read beat the round trip (FLAKY-PASS
in the final free-suite run). Delaying the POST by 400 ms reproduces both
failures at HEAD; polling for the settled state passes.
* test(plan-eng plan-mode): run the seeded STOP-gate smoke in its own fixture project
The seeded plan proposes a custom test runner, so the review's Step 0 reads
the working tree's test setup. In the gstack checkout that is gstack's own
sharded runner, and the case timed out at 300 s in census 37228573062 after
this wave reshaped the runner. It now runs in a four-file Bun project with
git history, with the product-notice suppression auto-decide-preserved's
standalone fixture already uses. Local pass on Bun 1.4.0 + Claude Code
2.1.284: asked in 121 s, seed tokens observed.
* test(plan-mode evidence): pin the seeded eng smoke's isolated fixture cwd and env
* ci(image): Git >= 2.44 so paid shared-libs cases run the supported safe-git path
bin/gstack-safe-git prefixes every /deslop-shared-libs Git read with
--no-lazy-fetch, which noble's git 2.43 rejects (exit 129). The eval image
therefore ran every paid shared-libs case on the unsupported-Git fallback:
local history unavailable, branch HEAD unknown. shared-libs-read-only failed
on exactly that in PR run 37230639146 ("Current branch HEAD: unknown. The
safe-git probe failed (unknown option: --no-lazy-fetch, git 2.43.0)") and in
2 of 74 earlier PR runs. The image installs current Git from the Ubuntu Git
Maintainers PPA and fails its build if --no-lazy-fetch is missing; the
deliberate unsupported-Git case keeps its fake Git.
* eval: pool matching branch census trials into main's pass-rate series (D1 option b)
Approved 2026-10-05. eval:pass-rates also reads completed branch census runs
in the weekly window. A branch trial counts only toward a series a main run
also has (same case-owned bytes, HARNESS_VERSION, model and CLI), so a branch
extends main's history but never starts or becomes a case's current series;
weeks for quarantine expiry still count main runs only. The D1 backtest put
this at 67 of 210 cases with enough trials for the entry rule, against 0 of
195 on main alone.
* C2: /qa defines its outcome filename fields; QA report templates name the measured timing fields
Low judge samples in failing panels named both: qa workflow (37186854666)
'an undefined {user} in the outcome filename', and qa-only workflow
(37198445662) 'template asks for Duration / durationMs totals while
reporting.md mandates Probe budget and Guarded command time'. The qa
union stays under its 1.11 size ratio (93292 of 93294 bytes).
(cherry picked from commit e14c0c1de1)
* C2: Browser Quick gets a feasible budget; QA loop names its directory and stop path
Judge rationales on the qa-only panels (2 of the last 3) cited the 30 s
Browser Quick budget: homepage + 5 targets, each a checkpoint write and a
guarded command, left ~5 s per probe. Quick is now 180 s (method text: 3
minutes); the qa-only-no-fix paid check expects the same native deadline.
PROBE_DIR points at its source line, a stopped loop goes to the final
report steps (annotations, materialize, Markdown), and /review and /ship
say that after smoke expiry only plan checks rerun in revalidation.
(cherry picked from commit 78d4a2a343)
* qa: fit the C2 judge fixes under the qa and review size caps
Brings GSTA-21's qa.ts trims (3bd625d, ce73af0) for the cherry-picked C2
wording: PROBE_DIR keeps 'owned', the stop line points at §4, and the
post-expiry rule is one sentence, so /review fits its cap. qa measures
93,303 / 84,049 = 1.11010 against the same 1.1102 cap GSTA-21 set. The
qa-only workflow judge passed 10 of 10 local trials on this wording (7 of 10
before the C2 fixes).
* test: qa-only fixture keeps its caller-set 30 s deadline
The qa-only-no-fix fixture tells the model to start the guard with 30 s
(a caller limit), so its deadline assertion's default stays 30 000 ms; the
product's Browser Quick default (180 s) does not apply to it. Reverts the
helper and its test to their base.
(cherry picked from commit e36e622add)
* test: qa-quick sets a caller probe limit and drains past its session budget
C2 raised Browser Quick's native budget to 180 s. qa-quick is the only gate case
on the native budget, and its wall went 194 s (main periodic, pre-C2) -> 254 s and
274 s (this PR's runs) -> 300 s session timeout (run 37242691913): the agent now
probes every navigation target with a checkpoint, then needs ~80 s to report.
Like qa-only-no-fix, the eval now sets a caller probe limit (30 s), scopes the
fixture, and gives bun's outer timeout the session drain margin instead of racing
the 300 s session. The product's 180 s budget and the session budget are unchanged.
Diagnostic rerun passed in 195 s.
(cherry picked from commit f8dc64031e)
* chore: restore the audit wave's package scripts after the main merge (version 1.91.23)
* qa: keep main's one-sentence post-expiry rule for /review and /ship
The C2 variants ("step 4c reruns plan checks only" and "even in 4c") read
to the review workflow judge as conflicting with Step 5.8's repeat-pass
reruns: 6 of 10 local trials passed with the longer sentence and PR run
37248650879 failed on the shorter one. Main's "Post-expiry smoke rechecks are
not-run." passed 10 of 10. qa (9/10), qa-only (10/10) and
ship-managed-hook-refresh (10/10) were measured on the same tree.
* v1.91.24.0: move off the slot #3036 claims
* fix: acknowledge seeded plans before invoking review skills
* fix: distinguish current plan input from conversation history
* fix: keep hermetic plan reviews on manual permissions
* fix: distinguish tool discovery from file permission ownership
* fix: preserve initial plan mode in observation tests
* fix: wait for scope decisions before writing review findings
* fix: carry autoplan decisions consistently into review artifacts
* test: retain native failure context in periodic assertions
* fix: advance active file permissions before queued questions
* fix: finish red-team attempts before retry and cleanup
* fix: finalize plan format captures and judges before retry
* fix: cancel setup-gbrain SDK attempts before fixture cleanup
* test: select periodic consumers of the bounded attempt helper
* fix native Bash permission cards and queued questions
* fix: preserve independent decisions and review scope
Keep CEO approach, engineering scope and outside-review choices from approving independent remedies together. Carry declared contracts through DX polish and resolve new gaps before editing the plan. Regenerate every host and retain existing stop boundaries.
Validation: 654 focused tests passed across nine files; all-host generation passed. Full free and periodic validation pending.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* fix: require approval before design plan amendments
Align the Design review philosophy and rating recipe with its section protocol: resolve one proposed fix, then apply only that approved decision and retain honest scores for declined fixes.
Validation: 469 focused tests passed across four files; all-host generation passed.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* fix: observe native question completion before transcript persistence
Match owned completion hooks to submitted choices, reject conflicting or late answers, and retain bounded failure evidence.
* test: recognize review posture in acknowledged native questions
Require the selected mode acknowledgement, a completed follow-up question, and its current decoded display while preserving existing posture assertions.
* fix: preserve settled CEO choices and isolate pending remedies
Resolve established approach gates with cited authority and keep independent fixes out of unrelated option commitments and plan amendments.
* fix: carry approved DX choices through later review steps
Choose documentation approaches within the accepted scope and map resolved confusion points without reopening them through a bulk menu.
* test: handle native settings-file edit prompts
Keep one-time owned-file approvals and retain the actual sampled Autoplan permission frame with its matching barrier state.
* test: accept standard CEO reply directives with tuning footers
Recognize the exact trailing preference footer and letter-list directive while preserving current-display and exact acknowledgement checks.
* test: scope split reviewers to their generated plan artifacts
* test: observe native Bash permissions and invocation results
* test: handle owned Bash prompts during mode preference checks
* test: preserve synchronous subprocess rejection in Codex fixture
* Fix periodic review handoff navigation
Recognize review-first and explicit manual-next-step labels while preserving exact action families, manual preference, and ambiguous-menu rejection.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Bind pending file permissions to distinct current targets
Allow one captured file request to own the complete current dialog while unrelated file work is pending. Preserve same-path ambiguity, exact input ownership, and one-time grant checks.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Make paired CEO verification choices genuinely unresolved
Start the positive control with proposed manual checks so its unchanged oracle measures two new coverage decisions. Preserve runtime contracts, targets, count bounds, and all assertions.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Keep CEO review options and verification within approved scope
Audit every offered option for independent add-ons and keep new verification depth pending until accepted. Preserve already requested coverage and trace plan changes to the actual decision.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Assemble DX review artifacts before appending the final report
Keep early DX evidence above decisions, update artifact sections in place, and append the report using the actual current file suffix. Re-read after deleting an existing report before choosing the append anchor.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Keep outside plan reviews exclusive and invocation-owned
Follow one preflight-selected backend, terminate failed Codex work before fallback, and allocate extra prompt/output files uniquely. Consume only the current invocation’s completed output.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Select periodic completion evaluations for report writer changes
Register the shared review resolver for eight missing consumers and regress selection for all nine completion cases without changing their IDs or tiers.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Keep permission ambiguity fixtures on the same normalized target
Use distinct raw spellings of one target in the four negative fixtures so they exercise the normalized duplicate-owner guard after exact current-file disambiguation. Preserve the existing exception, no-input, diagnostic and cleanup assertions.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Clarify preserved contracts in engineering review fixture
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Recognize the offered DX follow-up handoff
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Check independent commitments before presenting review options
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Keep Codex review output and status in one shell invocation
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Distinguish seeded plans from reports written by a test attempt
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Recover clipped Autoplan file approvals with bounded viewport resizing
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Recover clipped Bash approvals before binding the complete command
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Isolate setup message tests from the shared checkout
Run the real installer in a temporary payload with private config, require successful completion, and guard source and binary contents and mtimes.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Fix periodic native permission and report completion handling
Match the pinned CLI's soft wraps and clipped headings without granting from incomplete frames. Retire completed file requests, retain mode annotations, and ask section captures for a short final acknowledgement after their full report is saved.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Preserve review approvals and validate DX comparison artifacts
Keep independent remedies and approved amendments explicit. Give the synthetic DX review its existing documentation and validate peer comparison as required analysis alongside four native decisions. Add positive and negative semantic calibrations while preserving review counts, model budgets and prompt size limits.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Make the five-finding CEO fixture's application boundary explicit
Materialize the request adapter and service composition used by the synthetic payment application. Explicitly declare the revised unregistered-event and mail-telemetry assumptions while preserving uncaught handler errors, the original invoice path and all five unresolved findings.
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Keep CEO state-path checks scoped to directory preparation
Co-authored-by: OpenAI Codex <noreply@openai.com>
* Use checked ports and bounded cleanup in pair-agent tests
Discover the daemon port from its owned state file, retain startup diagnostics, and await failed-start cleanup. Add occupied-port, early-exit, deadline, and foreign-state regressions while preserving the existing HTTP assertions and hook budgets.
Co-authored-by: Codex <noreply@openai.com>
* Preserve queued edit identity and recover clipped Bash permissions
Distinguish separately queued unfinished edits from mutation of one native tool ID. Keep grants bound to an exact owned request and reject reused IDs, ambiguous inputs, and competing owners.
Support the pinned renderer's literal em dash and request a repaint when only the Bash card's top rule is clipped. Grants still require the complete fresh card and an exact native acknowledgment.
Validation: 413 integrated parser/event tests passed; private repaint controls and joint source review passed. Full canonical suite and native periodic rerun remain pending.
Co-authored-by: Codex <noreply@openai.com>
* Keep periodic reviews within their approved contracts and deliverables
Carry exact approvals through engineering review, preserve declared contracts when amending CEO plans, and keep prioritization at the requested decision level. Materialize the revised synthetic SDK reference contract while retaining the five original documentation gaps.
Accept the observed semicolon in the finite DX handoff menu and register the direct source dependencies used by the engineering cases. Regenerate canonical review documents without changing model budgets, retries, count bands, or native completion assertions.
Validation: all-host generation and 275 review, fixture, selection and parity tests passed. Full free-suite and native periodic validation remain pending.
Co-authored-by: Codex <noreply@openai.com>
* Keep Eng approval cadence and independence guards explicit
* Accept ordinary punctuation in manual review handoffs
* Recover file permissions alongside queued Bash calls
* Carry approved DX work through later review findings
* Clarify the synthetic auth internal failure decision
* Bound the periodic DX fixture to onboarding changes
* Recognize native Design review handoff labels
* Hold scope in the integration-choice review fixture
* Carry approved Design decisions through review evidence
* Capture listener state when feedback reload fails
* Exclude workspace caches before checking deprecated flags
* Verify Design UI scope against a seeded review plan
* Clarify plan review decisions and outside-voice approval flow
* Reject setup menus in the Design UI gate
* docs: require focused repair validation before final acceptance
* fix: separate review commitments within existing prompt budgets
* docs: align generation and contributor validation guidance
* fix: advance native review prompts and count acknowledged findings
* chore: bump version and changelog (v1.87.1.0)
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* chore: enforce cheap checks and side-effect-free validation previews
* fix: handle owned Fetch permissions and oversized native cards
* test: ground review fixtures in independent executable contracts
* fix: preserve review decisions and verify reports before completion
* test: construct the synthetic credential URL without a scanner false positive
* test: materialize DX examples and verify their actual local behavior
* fix: clarify CEO review decisions and execution order
* fix: clarify review workflow ordering and select Design quality checks
* Fix review decision gates and incomplete evaluation fixtures
Persist CEO and engineering commitment ledgers before menus, preserve exact
approvals, and distinguish implementation structure from feature scope.
Route Autoplan through the canonical CEO Step 0 ordering. Classify DX findings
before requesting approval and ground runtime claims in actual evidence.
Complete neutral non-target fixture contracts and accept the captured Design
handoff purpose without relaxing its ownership or acknowledgment checks.
Record runtime-capability verification in AGENTS.md validation discipline.
Validation: 1,335 focused tests passed across 21 files; build, all-host freshness,
skill validation (647 artifacts / 107 tracked), and credential checks passed.
Prior paid failures are preserved; behavioral acceptance remains pending.
* Fix review decision boundaries and owned Read prompts
Preserve exact approvals across review options, compare consistent DX milestones,
and keep proposed implementation separate from review evidence. Bind modern
Read prompts to one immutable native request and wait for its result.
Retain captured regression verdicts, correct fixture error names, improve import
probe diagnostics, and record focused-first validation discipline in AGENTS.md.
* Clarify CEO and engineering review decisions
Use explicit decision steps, one engineering ledger, and clear scope/write transitions. Preserve exact approvals and distinguish pending test requirements. Keep unrelated generated content unchanged.
* Fix review decision ordering and native evaluation interactions
* Clarify engineering decisions and test artifact order
* Clarify pending choices and approvals in CEO reviews
* Make CEO review phases sequential and clarify completion
* Fix Design board submission intent matching
* Seed an existing browser test baseline for Autoplan
* Document decision-log payloads before state initialization
* Preserve exact review scope and decide one change before drafting options
* Require input identity before repeating passing model judges
* Honor permitted storage throughout CEO review completion
* Match complete native permission text within the pinned renderer contract
* Align review approvals, independent choices, and bounded validation
* fix: preserve reopened approvals and declare fixture interfaces
* fix: isolate review artifacts and audit complete questions
* fix: match detector artifact permissions to configured storage
* fix: complete native permissions and review fixture workflows
* fix: order CEO review work and separate engineering guarantees
* fix: preserve native validation and separate review choices
* fix: clarify review decisions and judge complete report context
* fix: constrain review judgments and retain parse failures
* fix: compare each affected value before review decisions
* fix: make engineering review decisions and completion order explicit
* fix: give the complete Autoplan evaluation a bounded chain budget
* fix(cso): diagnose forbidden Docker endpoints before tool lookup
* fix(reviews): reconcile workflow contracts and generated artifacts after main integration
* fix(evals): migrate retained regressions to the native review harness
* fix(tests): close native harness and workflow integration regressions
* fix(evals): preserve complete permission context and native menu contracts
* fix(tests): capture synchronous command output without pipe drain stalls
* fix(reviews): clarify decision and completion ordering
* fix(reviews): separate decision readiness from final completion checks
* refactor(reviews): consolidate decision rules and completion branches
* fix(plan-eng-review): order preparation and clarify decision routing
* fix(plan-eng-review): restore size and question-format guard parity
* fix(plan-eng-review): clarify scope phases and blocked completion
* fix(plan-eng-review): unify review flow and report destination
* fix(plan-eng-review): define bootstrap and question stage ownership
* fix(plan-eng-review): clarify review structure and design lookup
* fix(plan-eng-review): render report examples and show saved decisions
* fix: consolidate Eng review decisions and select their evaluations
* test: cover overlapping terminal attachments and clean merged runner type
* fix: preserve Office Hours relationship closings during review updates
* fix: retain pasted review targets across slash invocations
* docs: preserve validation traces and correct release scope
* test: cover pasted targets in both review skills
* fix: validate report artifacts before recording success
* fix: redact source roots at CSO report boundaries
* fix: bind native Design questions before answering
* test: select report privacy and native recovery regressions
* test: bind rejection predicate in extracted observers
* fix: bind complete boxed native questions
* test: keep the Design UI fixture on native review
* fix: preserve review decisions and evaluation completion outcomes
* fix: clarify CEO approval and report completion order
* fix: align native review evaluation ownership and completion
* fix: bind review evaluators to native decisions and owned artifacts
* fix: validate review decisions against native outcomes
* fix: preserve review evidence and Autoplan phase handoffs
* test: bind review evidence to owned decisions and completion
* fix: retain owned native history across compaction
* fix(evals): validate current review decisions and setup choices
* fix: bind Autoplan reviews and phase completion to current amended input
* fix: reconcile native review evidence and close Autoplan phases
* test: recognize owned whole-candidate complexity decisions
* test: preserve report freshness for approved investigation handoffs
* fix: recognize scoped review findings and isolate dual voice fixtures
* fix: make review handoffs and question dispatch self-contained
* test: recognize complete CEO decisions and procedural pauses
* fix: bind current CEO comparison options and risk intervals
* test: bind engineering decisions and completion to owned evidence
* fix: publish Autoplan phase reports before continuing tools
* test: verify actual Autoplan dual-review dispatch evidence
* test: select dual review when shared evidence fixtures change
* fix: clarify plan review decisions and completion gates
* fix: make CEO review decisions and return paths explicit
* test: keep Autoplan prompt files inside attempt state
* test: preserve source whitespace across permission dialog wraps
* fix: publish Autoplan phase reports before continuing
* test: recognize current CEO comparisons and reject inactive records
* fix: reconcile engineering decision states before completion
* test: recognize complete Design decisions and reports
* test: verify current engineering decisions before navigation
* Recognize source-owned component reduction choices
* fix: recognize current CEO ledger and commitment grids
* test: supply RequestPolicy context to Eng count fixture
* fix: save complete engineering decisions before asking
* fix: bind Autoplan publication to the complete phase readback
* chore: prepare 1.87.5.0 reliability release
* fix: clarify engineering review completion and preserve log failures
* fix: bind CEO saved choices and current section ancestry
* fix(evals): bind review execution and completion evidence
* fix(plan-ceo-review): verify complete decisions before asking
* fix(evals): preserve complete engineering choice records
* fix(evals): preserve complete review outcomes and bounded fixtures
* fix(autoplan): publish phase reports before advancing
* fix(plan-ceo-review): validate option fields before asking
* fix(plan-eng-review): verify current decisions after answers
* fix(evals): bind review decisions and bound fixture scope
* fix(plan-ceo-review): verify decision rows and edit saved checkpoints
* fix(evals): bind review evidence and scope document lookup
* fix(plan-eng-review): update resolution state with its answer
* fix(reviews): preserve complete questions through dispatch
* fix(evals): recognize completed mode declarations
* fix(evals): define cache consistency at wrapper completion
* fix(evals): validate owned initial scope and completed review handoffs
* fix: assemble complete CEO decision fields before saving
* fix: authenticate automatic mode decisions without guessing selectors
* fix: bind engineering coverage to approved regression contracts
* fix(evals): supply review helpers to native Eng capture
* fix(plan-eng-review): preserve the full selected option scope
* fix(evals): recognize owned engineering seed and regression evidence
* fix(evals): bind engineering retry reports to native approvals
* docs: clarify release guarantees (v1.87.5.0)
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* fix(evals): recognize owned engineering decisions and handoffs
* fix(evals): bind engineering decisions and completion evidence
* fix(tests): align review contracts and selection fixtures
* fix(skills): restore review prompt size limits
* fix(plan-eng-review): clarify review execution and completion
* fix(evals): preserve configured retries through all supervision layers
* Clarify Engineering decisions and report completion
* Keep native decision assertions within their source boundary
* fix: recognize owned engineering decisions and completed navigation
* fix: bind completed auto decisions to their current review
* fix: recognize explicit CEO source attribution
* fix: dispatch verified CEO decisions without recomposing fields
* test: expose existing execution deadlines to review actors
* fix: distinguish CEO decision records from incidental headings
* test: bind split-scope choices to the registered native actor
* test: connect reviewed regressions to required evaluation coverage
* Clarify CEO decision routing and completion stages
* test: expose existing section review deadlines to fixture actors
* test: recognize complete native CEO pacing inventories
* test: exclude answered history from current CEO payloads
* test: detect phase entry through owned skill HOME aliases
* test: validate native review completion and owned report permissions
* fix: make Autoplan close packets carry the parent handoff steps
* test: assess source-bound HOLD decisions within the existing deadline
* fix: keep CEO native decision fields under one formatting authority
* test: register integrated review and permission dependencies
* test: align native review adapters and finding coverage
Preserve explicit AUTO decisions, apply native single-select defaults, and bind complete cropped questions and report permissions to their owned requests. Require seeded review findings instead of crediting setup menus.
Keep captured failure controls and additive selection dependencies. The integrated candidate passed 3,099 focused tests across 65 files; affected paid validation remains required before publication.
* fix(autoplan): require phase reports before advancing
* fix(evals): bind setup and evidence to complete attempts
* fix(evals): bind native answers and pending writes to fixture scope
Preserve complete option rows when native descriptions wrap, retain current
owned Write arguments before journal publication, and keep engineering and
DX answers within their declared fixture interfaces. Add captured free
regressions without increasing model budgets or relaxing completion checks.
* fix(autoplan): verify phase reports across native tool paths
Guard owned methodology reads and reviewer dispatches, detect complete driver
loads through Bash, and distinguish report-only edits from implementation
changes. Follow authenticated native UUID ancestry when journal writes arrive
out of order and verify earlier native content for cached phase reads.
Keep current close acknowledgment and parent publication in order, require CEO
entry before later phases, and register captured failure regressions.
* fix(evals): honor native input and collection lifecycles
Match complete native Edit panes and truncated question borders, reject stderr close before EOF, and stop the CEO split fixture once its acknowledged scope decisions are collected. Keep semantic validation, process failures, report requirements, and absolute deadlines authoritative.
Add captured-event and real-process regressions with selection dependencies. Focused checks pass; final integrated paid and full-suite acceptance remain pending.
* fix(autoplan): retain native session ownership across directory changes
Recover missed native UUID ancestry through the existing strict graph while preserving ordinary event order and legacy scoping. Bind publication hooks to Claude's original project directory while retaining current cwd for requested file paths.
Captured public-event regressions, existing caller checks, and a pinned native CLI loopback verify both fixes. Preserve failed attempts and require fresh paid and final full-suite acceptance.
* docs: align evaluation limits and completion version
* fix(autoplan): allow authenticated phase reads during journal streaming
* fix(evals): bind clipped native questions and owned edit dialogs
* fix: preserve overlay retries and bounded cleanup
* fix: recognize owned planning preludes in native questions
* docs: explain overlay scheduling and cleanup guarantees
* fix: require fresh publication after Autoplan phase reruns
* Release gstack 1.87.6
* fix: preserve CI paths, process identity, and test deadlines
* fix: keep informational setup commands independent of install probes
* fix: clarify plan review decisions and bound source audit reports
* Fix remaining Windows identity and native path CI failures
* Clarify CEO review decision and reviewer-result routing
* test: accept no-install planner in retry supervision
* fix(ceo-review): make review decisions and report completion explicit
* perf(test): add fast PR gates, input-keyed judge reuse and isolated free shards
* fix(test): start isolated CEO smoke from its existing project plan
* fix(test): repair CI fixture races and preserve retry evidence
* fix(ceo-review): clarify approvals, depth and saved completion
---------
Co-authored-by: OpenAI Codex <noreply@openai.com>
* ci: bump CI image Bun 1.3.10 -> 1.3.13
Matches the local toolchain and brings native `bun test --shard=M/N` /
--parallel to CI (needed by the free-test lane and shard runner work).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: stop version bumps rebuilding the eval Docker image (cache key trio)
Three coupled fixes, atomic because any subset is worse than none:
1. Image tag keys on hashFiles(Dockerfile.ci, bun.lock) — package.json is
out: its version field changed on 60/60 recent commits, forcing a ~2min
image rebuild per PR for a dependency set only bun.lock determines.
2. ci-image.yml now pushes that same content-hash tag (previously only
:latest/:sha, so the weekly prebuild never warmed the tag the eval
matrix actually looks up) and both eval workflows get registry layer
cache (cache-to export gated to same-repo runs; fork tokens cannot
write GHCR).
3. Dockerfile bakes /opt/node_modules_cache/.bun.lock and the runtime
Restore-deps guard diffs bun.lock instead of package.json — otherwise
every version-only bump made all 14 matrix jobs fall back to a live
bun install, which is slower than today's behavior.
Worst-case failure mode is self-healing: a missing tag or cache falls
back to exactly the previous rebuild-and-install path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: stop double-running lint + skill-docs on every PR commit
Both fired on unrestricted push AND pull_request, so each PR push ran
them twice (12 duplicate (headSha, workflow) pairs in the last 200 runs).
push is now main-only; pull_request covers PR branches.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: run actionlint from the prebuilt image (16s -> ~2s)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: right-size five single-core jobs to ubicloud-standard-2
actionlint, skill-docs, version-gate, pr-title-sync, and the evals report
job never exceed one core; standard-8 was ~4x the cost for zero wall-clock.
build-image and the eval matrix keep standard-8.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: fix workflow_dispatch concurrency collisions (head_ref || run_id)
head_ref is empty on workflow_dispatch, so every manual dispatch of these
four workflows shared one empty-suffix group and cancelled each other.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(windows): cache bun installs; run the curated suite, not a hand list
- actions/cache on ~/.bun/install/cache keyed on bun.lock (install was
35-45s of both 55-64s jobs, all network) and Bun pinned to 1.3.13 to
match the other lanes.
- windows-free-tests now runs `bun run test:windows` (the runner's
--windows-only curation) instead of a hand-listed 13-file subset that
had drifted from the registry it sampled. POSIX-bound tests get
excluded in ONE place (the curation patterns), not two.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: retry 1, not 2, on every paid path
Measured on the llm-judge shard: --retry 2 amplified 25 tests into 46
executions (+84%), with retried runs at 138s vs a 10-12s baseline (429
backoff), and a permanently-failing test paying 3x. One retry still
absorbs one-off flakes; chronic flakes become visible fix-work instead
of silent wall-clock.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: split skill-e2e-review into three per-file CI shards
Bun runs describe blocks as concurrency barriers, so the e2e-review CI
job executed its tests serially: 741s of an 860s PR critical path for
tests whose slowest member is 224s. The per-file matrix is the repo's
parallelism unit, so the split moves:
- Retro E2E + retro-base-branch -> test/skill-e2e-retro.test.ts
- review/ship base-branch + Review Dashboard Via Attribution
-> test/skill-e2e-review-attribution.test.ts
- sql-injection / enum-completeness / design-lite stay in
test/skill-e2e-review.test.ts
One 741s job becomes three ~180-250s jobs. Locally the worst paid shard
drops from 1705s (94.7% of the 1800s kill) to under 700s. Test names,
bodies, suite strings, and eval-store collectors are unchanged, so
baselines carry over. Matrix rows added to both eval workflows
(attribution is gate-only, so no periodic row); the report job's
hardcoded runner count is gone (drift-proof).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: gate security-bench on SECURITY_BENCH=1, not model-cache existence
The existsSync gate ran ~12s of ONNX inference (plus a HuggingFace
dataset fetch) on every free-suite run on any dev box that had ever
warmed the classifier, while CI (no cache) silently skipped it. Now
explicit opt-in: SECURITY_BENCH=1 bun test browse/test/security-bench.test.ts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: watchdog E2E in 1.5s instead of 22.7s (tunable poll interval)
server.ts gains BROWSE_WATCHDOG_INTERVAL_MS (floor 50ms, default 15s
unchanged). The #994 stay-alive test runs a 250ms tick and waits for the
stay-alive log line instead of blind-sleeping 2s + 20s past the
production interval.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: dedupe coverage gates; route both walks through skill-census
skill-coverage-floor duplicated two matrix assertions (registry
completeness, gate-tier floor) with a DIFFERENT hand-rolled directory
walk — matrix's skipped nothing, floor's skipped node_modules/docs/test.
Two 'same' gates disagreeing on the census is the bug class
test/helpers/skill-census.ts was written to kill. Registry assertions
now live in matrix only (with floor's better error message), both files
walk via skillCensus().authoredSkills, and floor keeps the per-skill
structural checks it owns.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: EVALS_JOBS for shard processes; explicit within-shard concurrency
EVALS_CONCURRENCY was overloaded: the legacy bun-test path used it as
--max-concurrency (default 15) while the sharded runner read it as the
process count — exporting the legacy value gave 15 concurrent Bun
processes each spawning claude (the 429 storm). Now: EVALS_JOBS = shard
processes (default 4); EVALS_CONCURRENCY = bun --max-concurrency inside
a shard (default 4, explicit in shard args — omitting it made
within-shard parallelism silently differ from the legacy path). Stale
49/59 header math replaced with the live-count rule.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: enforce detach-timeout floor from the live shard census
New free tripwire: eval:bg:gate / eval:bg:periodic --timeout must cover
ceil(shards/jobs) x shard-timeout x 1.05, recomputed from the actual paid
test census every run. Hand-derived numbers go stale every time a paid
file lands — the review split just proved it: periodic's 28800s dropped
BELOW its new 32130s worst case (raised to 32400s here). An undersized
watchdog kills healthy runs and the tail reports never-started.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: preflight ping once in the sharded parent, not per shard
The Anthropic fail-fast ping ran at module load in every paid test file
importing e2e-helpers — ~30 paid claude -p calls (30s timeout each) per
full sharded run for one bit of information. The parent now pings once
before spawning shards and sets EVALS_PREFLIGHT_OK=1; the module-load
path honors the flag. Extracted to test/helpers/anthropic-preflight.ts
(injectable spawn seam) with regression pins in both directions: the
flag must skip, its absence must ping exactly once, dead API must throw.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: split touchfiles into pure data + selection logic + facade
touchfiles.ts listed ITSELF in GLOBAL_TOUCHFILES, so adding one test's
dep entry forced the full ~$38 / 30-45min suite — measured on 21.9% of
recent commits (42/192). The self-reference existed because data and
logic shared a file: any edit COULD be a selection-logic change.
Now: touchfiles-data.ts (the four maps, literals only, zero imports —
the future map-diff target), test-selection.ts (matchGlob/detectBase
Branch/getChangedFiles/selectTests), and touchfiles.ts as a re-export
facade so all ~12 import sites are untouched. GLOBAL_TOUCHFILES drops
the self-ref, adds test-selection.ts (logic stays maximally
conservative), and TEMPORARILY adds touchfiles-data.ts until the
map-diff change lands. New free test pins the literal-only property
(comment-aware state-machine scan with a self-test) and facade export
parity (===), so neither can silently rot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: free runner — strict output, parallel execution, stable shard indices
Three coupled changes to scripts/test-free-shards.ts:
1. STRICT OUTPUT: runFreeShard streams through the paid runner's
BunTestOutputClassifier — exit 0 without bun's 'Ran N tests across M
files' summary, with (fail) lines, or with a wrong file count is a
FAILURE (anti-truncation backstop at the runner layer), plus an
external wall-clock timeout that SIGKILLs the process group
(timed-out distinct from failed; exit 124 vs 1). Also fixes a latent
shard-bleed: file selectors now use exactTestFileSelectors (relative
paths were substring filters that matched sibling roots).
2. PARALLEL: full-suite mode is one 'bun test --parallel' invocation
(Bun 1.3.13). Measured semantics recorded in the header: per-file
worker isolation, standard summary, and mid-suite process.exit
surfaces as a crashed-worker FAIL with exit 1 — strictly safer than
serial, where the same exit truncates silently. No static weight
lists; --shards M --shard i keeps deterministic hash partitioning for
CI matrices (native --shard rejected: round-robin renumbers when
files land). Spawned shards get throwaway GSTACK_HOME/TMPDIR so
parallel shards can't contend on real state. Per-shard epilogue
prints files/seconds/status every run.
3. Stable indices: assignFilesToShards no longer drops empty shards, so
a shard's index depends only on the file hash and requested count —
an empty CI matrix slot is a fast no-op success, not a renumbering.
package.json 'test' now delegates to the runner (TEST_ROOTS becomes the
single source of truth for roots; slop:diff tail preserved; the runner
inherits the 30s per-test timeout the old glob passed inline).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: Linux free-test lane — ~400 files get CI coverage for the first time
New required, secretless free-tests job: the canonical runner's single
'bun test --parallel' invocation with strict-output classification on
ubicloud-standard-8. The free suite previously ran on NO Linux CI — only
a curated Windows subset ran anywhere — so every 'tests pass' claim
about main rested on contributors running them locally.
Secretless by design (no API keys; fork PRs finally get real test
signal) and pinned by test/free-tests-workflow-wiring.test.ts: canonical
runner invoked, zero secrets.* references, pull_request never
pull_request_target, and matrix-count/--shards agreement if anyone
switches to the sharded fallback.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: map-diff selection — a touchfiles-data edit runs only what changed
Editing the eval dep-list data no longer forces the full ~$38 /
30-45min suite (measured on 21.9% of recent commits). When
touchfiles-data.ts is in the diff, selection now evaluates the BASE
version (git show -> mkdtemp -> spawnSync bun child printing the four
maps as JSON — sync because e2e-helpers selects at module scope) and
JSON-diffs per key: added entries, edited dep lists, and tier flips are
selected; keys removed from all maps are reported, never silently
dropped; a GLOBAL_TOUCHFILES edit still runs everything.
FAIL-CLOSED with named causes: missing-base-ref, git-show-failed,
import-failed, shape-mismatch each degrade to run-all and print
'selection: global — touchfiles-data changed (<cause>)' (D9 — silently
expensive beats silently wrong, but never silently). eval:select prints
'selected N of M, reason: ...' + removed tests; --base scopes the
map-diff too.
The temporary conservative GLOBAL entry for touchfiles-data.ts is gone —
its changes route through the map-diff. 23 new free tests: pure-core
fixtures, selectTests wiring incl. a poison-injection guard, and a temp
git repo exercising every fail-closed cause end-to-end.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: selection sees uncommitted work; git errors fail closed
getChangedFiles is now the deduped union of committed (base...HEAD),
staged+unstaged (git diff HEAD), and untracked (git status --porcelain
--untracked-files=all) — an agent that edits files and runs evals
BEFORE committing no longer gets the full $38 suite every time because
the committed diff looked empty. Clean tree still returns [] (run-all
by design for main-branch/periodic runs).
Git failures now THROW with the failing command, stderr, and 'set
EVALS_ALL=1 to deliberately run the full suite' — the old return []
silently became run-all, which is silently expensive. 11 new free tests
cover every source, dedupe, quoted paths, and both failure shapes via
an injectable spawn seam.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: revert GSTACK_HOME injection in the free runner — shared mutable state
The first full run under the strict runner surfaced 12 failures with one
root cause: injecting a single throwaway GSTACK_HOME per invocation made
6,900 tests share a MUTABLE scratch home. gstack-config tests wrote keys
into it; relink and update-check tests then read them (e.g. relink saw
skill_prefix left behind by a config test and produced prefixed names).
All 12 pass when run directly.
TMPDIR isolation stays (mkdtemp inside it is still per-call unique).
Tests needing GSTACK_HOME isolation mkdtemp their own per test — the
repo convention — and hermetic-env covers E2E children. The env-dump pin
now asserts GSTACK_HOME passes through UNTOUCHED so the injection can't
come back.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: rebase parity baseline to v1.64.0.0; fix capture-vs-check drift
The parity ratchet had quietly failed for 7 skills — v1.58-v1.64 growth
landed past the v1.57.7.0 anchors and nothing caught it because this
test had no CI lane (verified pre-existing: SKILL.md content is
byte-identical to origin/main). Same rebase protocol as
v1.53->v1.57.7.0; old baseline retained for the audit trail.
Root-caused a second latent bug while rebasing: captureBaseline recorded
SKELETON-ONLY bytes while the checker compares UNION bytes (skeleton +
carved sections/*.md), so a fresh capture read carved skills at ~2x
ratio (ship: 82KB captured vs 183KB checked). captureBaseline now takes
sectionedSkills and records unions for carved skills — capture and check
measure the same thing, so the NEXT rebase can't hit this. Four
CARVE_GUARDS skeleton caps re-ratcheted to current +headroom
(plan-ceo 92K, plan-eng 70K, office-hours 100K, design-consultation
70K), annotated inline.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: package.json version matches VERSION (1.64.0.0)
v1.64.0.0 shipped with VERSION bumped but package.json left at 1.63.0.0
— the 'package.json version matches VERSION file' test fails on
origin/main today. Nothing caught it because that test had no CI lane
until this branch's free-tests job.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: fix variants-retry-after HTTP-date flake (TODOS P2)
toUTCString() truncates to whole seconds, so a +3000ms Retry-After date
could mean an effective wait of ~2001ms — flaking against the 2500ms
assertion floor ~1-2 in 9 runs under suite load. +4000ms puts the
truncation floor at 3001ms with the assertion floor safely below it.
Pulled forward from U4 because the free-tests lane is now a required
check and this flake would randomly block PRs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: skill-fixture helper — extract SKILL.md sections, don't copy files
extractSkillSections (fence-aware H2 scanner, loud-throw on missing
sections with available-heading list), extractSkillBody (drops the
shared generated preamble), extractSkillHead (frontmatter + first 30
lines, for routing fixtures). Pinned section lists per consumer, and
free-tier real-skill pins so a gen-skill-docs heading rename fails the
FREE suite instead of a paid run. skill-fixture.ts joins
GLOBAL_TOUCHFILES (fail-safe polarity: over-select).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): review E2E fixtures extract sections — 1871 -> 207 lines
CLAUDE.md's extract-don't-copy rule, applied: the three review fixtures
carry only the sections the sql-injection/enum/design-lite prompts and
judges exercise (89% cut). Full-file copies made claude -p read 1871
lines per test — the direct cause of the 1705s worst shard (94.7% of
the 1800s kill).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): retro E2E fixtures extract sections — 1821 -> 757 lines
Keeps every section the retro flow exercises incl. base-branch detect;
drops preamble, Global Retrospective Mode, Compare Mode (58% cut).
retro-base-branch was the single slowest CI test at 224s.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): review-army fixture extracts sections — 1871 -> 650 lines
CS1's set plus Step 1.5 (PLAN COMPLETION AUDIT machinery) and Step 4.5
(army dispatch, quality_score, findings schema) that the 7 army tests
assert on. Pin test guards the three load-bearing strings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): skillify fixtures via extractSkillBody — 63-83% smaller
Tests follow all 11 skillify steps, so the whole body stays; only the
shared generated preamble drops (skillify 1239->453, scrape 958->167).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): context-skills fixtures via extractSkillBody — 74-82% smaller
context-save 1037->267 lines, context-restore 952->168; the 8 tests
exercise full save/restore/list flows so the body stays, preamble drops.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): opus-47 discovery fixtures via extractSkillHead — ~95% smaller
Routing/fanout tests only read frontmatter + opening lines of the 14
installed skills (review 1871->54, office-hours 1706->80).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): codex runner gains sections option — review variant 88% smaller
runCodexSkill/installSkillToTempHome accept sections?: string[] routed
through extractSkillSections; codex-review-findings wired (1465->181
lines). codex-discover-skill deliberately keeps the FULL copy — its
stderr assertions validate that the real generated artifact loads.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(evals): routing fixture installs skill HEADS, not ~18 full SKILL.md
Routing reads frontmatter only; extractSkillHead per skill (root
611->48, ship 1435->54 lines). This was the single worst fixture bloat
site: one fixture dir holding ~18 full skills.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: parent-side shard skipping — a one-test diff runs 3 of 44 shards
The sharded runner spawned every shard regardless of diff; only the
child self-skipped, so a typical single-skill change still paid 44 Bun
boots + container-equivalent setup for shards with zero selected tests.
The parent now computes selection once (mirroring e2e-helpers exactly:
EVALS_ALL -> run-all, empty union -> run-all, git errors propagate the
fail-closed throw) and drops shards where no selected test name maps in.
Mapping = quoted E2E map keys in the file's source UNION keys whose dep
list registers the file (constructed-name families need the second
direction). FAIL-OPEN everywhere it matters: run-all, non-skill-e2e
files, unreadable source, zero mapped names all keep the shard — the
child filter stays authoritative, so a parent bug can only run extra.
New taxonomy status skipped-by-diff (never conflated with
never-started); selection banner prints once; --list is selection-aware.
C6 lands in the same commit: a HARD tier-alignment test — every paid
skill-e2e file must be parent-mappable or provably fail-open-safe.
Note: this change-set's 14 dep-list registrations in touchfiles-data.ts
rode along in f945c841 (concurrent-agent staging); they belong to this
change logically.
Demo: selection of one test -> 'running 3 of 44 shards, 41
skipped-by-diff'. 13 new $0 tests via injected seams.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: fix context-save-list test that was 0-for-26 ($5.28, zero passes)
Disposition for the eval store's only permanently-red test. Root cause:
the hide-other-branches assertions scanned the FULL output surface
(incl. bash tool_results), so any agent that ran ls on the checkpoints
dir — the natural first step of a list flow — surfaced all three seeded
filenames and failed, even when its user-facing listing filtered
correctly. The test punished the agent for looking at the directory.
The hide-assertions now scan the agent's FINAL TEXT (the listing the
user sees); showsMain keeps the broad surface for its documented reason.
Validated live in the final gate run rather than quarantined: the test
guards real behavior (branch filtering) and the assertion was the bug.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: wire 12 orphaned test files into the free suite (D3a)
ios-qa/daemon/test (10 files), ios-qa/scripts/gen-accessors.test.ts, and
browser-skills/hackernews-frontpage/script.test.ts ran under NO script
or CI — written coverage catching nothing. All 174 tests green on
arrival (4.6s), zero quarantines needed. TODOS P2 closed: main wired
design/test in v1.64, the variants-retry-after flake it named is fixed
on this branch, and this commit lands the remaining orphans.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: supabase-provision runs in-process — 16.5s -> 0.45s
bin/gstack-gbrain-supabase-provision (482-line bash) becomes a 26-line
bun-shebang entry over a new importable lib/gbrain-supabase-provision.ts
with an injected-deps seam (fetch/env/stdout/sleep — D7: args, never
env-mutation-before-import). The 33 spawn-per-test cases run in-process
against the same Bun.serve mocks; exactly one spawn smoke keeps the
shebang/CLI/receipt contract covered.
Byte-compat proven by a 25-case differential harness (old bash bin from
git vs new, same mock): stdout, stderr, exit codes identical across all
subcommands, JSON/plain modes, and error paths. Egress receipts stay
per-attempt, receipt-before-send, fail-closed (scanner updated:
SHELL_SINKS -> MODULE_SINKS). No-op sleep injection makes retry/backoff
paths instant.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: kill the 3,372-line zombie monolith; revive 4 never-run tests
test/skill-e2e.test.ts survived the v1.56 split as a zombie: the paid
glob needs the skill-e2e-* hyphen, so with EVALS=1 NOTHING has executed
it for ~8 releases — and it held the ONLY implementations of four
map-registered tests: review-coverage-audit (gate), plan-eng-coverage-
audit (gate), ship-triage (gate), ship-idempotency (periodic). Three
gate tests silently never ran — the exact 0%-execution class this
branch exists to kill.
Rehomed into test/skill-e2e-coverage-audit.test.ts, -triage.test.ts, and
-ship-idempotency-sdk.test.ts with bodies byte-identical modulo collector
wiring and fixture extraction (drift observed in the skills since v1.56
is DOCUMENTED in each header, not fixed — their first paid run in 8
releases must attribute failures to drift, not to this move). All 24
other monolith names were true duplicates of the split files — dropped
with the monolith. Matrix rows added to both eval workflows; the paid
glob's zombie-exclusion is now a commented regression pin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: fix two parallelism-exposed flakes (probe re-run, live-tree census)
Both pass solo and on main but flaked under the parallel runner:
1. gstack-brain-context-load probed 'gbrain --version' PER QUERY with a
500ms budget — a cold probe on a saturated box timed out (observed
505ms), branding gbrain 'missing' for one query while siblings
passed. The probe is now memoized (availability can't change
mid-invocation) with a generous one-time 5s budget; query calls keep
the tight timeout.
2. skill-size-budget's catalog estimate read the LIVE tree, so a
concurrent worker's transient skill-shaped scratch dirs exactly
doubled it (8356 vs 4177). The ratchet now counts git-TRACKED skills
only — the catalog that ships, immune to sibling workers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: demote 4 expensive posture tests to periodic (D2a)
design-consultation-research ($0.91/304s) and -preview ($0.89/481s) —
the two most expensive gate tests — plus office-hours-forcing-energy
(LLM-judge posture score; its sibling was already demoted) and
cso-full-audit (250s/$0.57; the targeted cso tests stay gate). Saves
~$8-12 and 10-15 min per gate run. The plan-*-finding-floor tests stay
gate deliberately: cheap insurance on the most-edited skill surface.
Housing files have no whole-file self-gates, so the runtime E2E_TIERS
filter handles both tiers; tier-alignment tripwire green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: judge default Sonnet -> Haiku 4.5 (D1a)
The 25 doc-quality judges are rubric-scoring calls — a duty Haiku is
already proven at in this repo (pty hung/working classifier,
first-task-scaffold, hermetic-canary). Tests needing a stronger judge
pass a model explicitly. Note: eval-store judge costs were hardcoded
synthetic (0.02), so no baseline distortion. Re-baselined by the
periodic run in this branch's final verification.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: SDK runner default Opus -> Sonnet (D1a)
agent-sdk-runner defaulted to Opus 4.7 while session-runner (the claude
-p path) defaulted to Sonnet — an inconsistency between the two runners,
not a decision anyone made. Unpinned tests were implicitly asserting the
expensive model. The 30+ tests that genuinely need Opus already pin it
via opts.model. Re-baselined by the periodic run in this branch's final
verification; regressors get explicit Opus pins.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: CLAUDE.md tells the truth about the free suite; make-pdf gate is macOS-only
The '<2s' claim was off by two orders of magnitude (measured 454s serial
at v1.63; ~90-100s now under the parallel runner), and the bare
'bun test' guidance walked the whole repo, loading paid eval files and
missing the strict classifier. Commands now say 'bun run test' with real
numbers, document the strict-output invariant, the EVALS_JOBS /
EVALS_CONCURRENCY split, the computed detach-timeout floor, and the
required free-tests lane. make-pdf-gate drops its Linux leg (redundant
with the free lane running make-pdf tests on every PR); macOS rendering
coverage stays.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: catalog ratchet reads committed content; SDK unit pins follow D1a default
Two follow-ups from the verification runs:
1. skill-size-budget's catalog estimate still flaked under --parallel
(8356, then 8041, vs 4177 solo) even after filtering to tracked
skills: sibling workers REGENERATE real SKILL.md files mid-run, so
any live-tree read is a moving target. The ratchet now reads each
tracked skill's frontmatter from git show HEAD: — the catalog that
ships — which no concurrent worker can perturb.
2. agent-sdk-runner unit pins asserted the old Opus default through the
default-flow fixtures; flipped to the Sonnet default (the explicit-
override pass-through pins keep Opus — that path is unchanged).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(browse): SIGKILL abandoned Chromium on close-race timeout (suite wedge)
close()'s launched-mode path raced browser.close() against 5s and on
timeout ABANDONED the child: this.browser nulled, process handle lost,
Chromium alive holding keep-alive connections into test servers whose
stop() then waits forever. Reproduced twice as an intermittent (~50%)
whole-suite wedge — a 44min 0.1%-CPU hang pinned by a leaked LISTEN
socket, and a 400s hang with commands.test.ts teardown in flight.
The child handle is now captured BEFORE the race and SIGKILLed on
race-timeout (launched mode only; headed keeps context.close). Race
timers are unref'd so a successful close stops pinning the caller's
event loop for the window. The four browse test servers force-close
keep-alives (stop(true)) as belt-and-braces.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: delete two dead-architecture security contract tests
browse/test/security-source-contracts.test.ts and sidebar-security.test.ts
read browse/src/sidebar-agent.ts at module scope — a file deleted (on main
too) when the sidebar chat-queue path was ripped in favor of the terminal
PTY. Both files have errored on load ever since: the old truncating suite
never surfaced it, and no CI lane ran them. Their subjects (queue-spawn
canary injection, preSpawnSecurityCheck, queued args, chat system prompt)
no longer exist; server.ts retains processAgentEvent only in a comment.
Live security coverage continues in security.test.ts (canary/verdict),
content-security.test.ts (L1-L3), server-sanitize-surrogates.test.ts,
and the security-bench suite. If the terminal-agent path should inherit
any of the deleted contracts, that is a separately scoped piece of work
against the component that actually exists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): calibrate placeholder recognition for code and doc shapes
Three pushed-secret false positives blocked this branch's push; each is
now recognized as a placeholder in the url_with_password/basic_auth_url
validators, with real passwords still blocking (all pinned):
- ${camelCase} JS template interpolations (the old check only skipped
uppercase env-style ${DB_PASS}, so the supabase-provision bash->TS
port's `postgresql://${dbUser}:${dbPass}@...` flagged as two
pushed secrets).
- The literal PASSWORD/pass placeholder in URL-format doc comments.
- The provision lib's doc comments now use <PASSWORD>/PASSWORD forms.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: opt-in gate for live-playwright ML tests; ios-qa build hygiene
security-live-playwright's L4 tests dlopen onnxruntime inside a bun
--parallel worker whenever the dev box has a warm model cache — the
source of the intermittent 'panic: Segmentation fault' + crashed-worker
retries (and likely the residual run wedges). Same SECURITY_BENCH=1
opt-in as security-bench.test.ts; the L1-L3 tests in the file still run
everywhere.
Also: gitignore the ios-qa gen-accessors-tool Swift .build/ output (a
side-effect of running its tests that kept polluting git status) and
commit its Package.resolved so tool builds resolve reproducibly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: free runner output contract — name the failure, quiet the noise
Diagnosing a red run used to mean re-running with output captured to a
file and grepping past ~1000 lines of tab-close spam and ASCII art —
several runs today ended with no way to even NAME the failing test, and
a wall-timeout kill said nothing about which file wedged.
New contract: the full child stream ALWAYS lands in a per-run log file
(path printed up front); the console shows only runner lines, (fail)
results, crash markers, and the terminal summary (--verbose restores
the firehose; the strict classifier consumes the full stream in every
mode). After every run a stable epilogue names the outcome:
[test:free] FAIL — k failing test(s) in j file(s), c crashed
worker(s). Full log: <path>
✗ <file> — <test name>
⚠ crashed+retried: <file>
⏱ in flight at kill: <files> (timeout only — the wedge suspects)
Attribution rides bun --parallel's per-file output grouping
(ANSI-stripped — color codes defeated a plain grep today). 12 new pins:
epilogue formats, crash surfacing, quiet/verbose console policy, log
completeness, in-flight-at-kill on a real hang.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: quarantine 5 pre-existing env failures individually (receipts in-file)
Three snapshot tests (stale-ref error, snapshot -D diff, annotation
cleanup) and two extension-sender-auth behavioral tests fail identically
on origin/main v1.64.1.0, solo, on dev machines — verified per the blame
protocol. Main's CI lane skip-lists both FILES wholesale; quarantining
only the five failing tests keeps the other 60 guarding. Each carries
the un-skip condition.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: stealth-webdriver launch gets parallel-load headroom (120s)
Playwright's default 30s launch timeout dies under the full-suite
--parallel run when ~400 workers contend for Chromium launches — bun
reports the hook death as an '(unnamed)' 30006ms failure (named on
sight by the new runner epilogue). Both launch sites get explicit 120s
timeouts; the runner's external wall-clock still bounds the ceiling.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: free-runner wall timeout 15min -> 6min (faster wedge diagnosis)
The suite completes in ~100-160s; a wedge used to mean 15 minutes of
silence before the kill-and-name epilogue fired. 6min keeps ~3.5x
headroom over the slowest observed clean run while naming wedge
suspects in minutes. --wall-timeout <secs> overrides per run.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: run worker-hostile files in a serial child (first entry: security-live-playwright)
The residual full-suite wedge, named by the new epilogue: Bun 1.3.13
segfaults running browse/test/security-live-playwright.test.ts in a
--parallel worker ('panic: Segmentation fault ... a bug in Bun'), and
the crashed-worker retry then wedges the whole invocation past the wall
clock. The file passes serially.
New WORKER_HOSTILE placement list: full-suite mode excludes listed files
from the parallel invocation and runs them in their own strict-classified
serial child afterward — execution placement, not a skip; each entry
carries its reason and removal condition.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: gate compare-board's file-level hooks too — the intermittent staller
Skipped describes do NOT skip file-level hooks: the quarantined
compare-board file still ran its top-level beforeAll (PNG fixtures +
Bun.serve + a BrowserManager launch — exactly the 'needs a
display-shaped env' code) on every run, and under parallel load that
setup wedges. Caught red-handed by the runner's in-flight-at-kill
epilogue: '⏱ in flight at kill: browse/test/compare-board.test.ts'.
This was the suite's intermittent staller. Hooks now honor the same
GSTACK_COMPARE_BOARD_TESTS gate; the gated file drops from 3.7s of live
setup to 0.4s of pure skips.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: full suite runs as N shard processes; scrub spec-sync child env
Two fixes from the wedge-hunt endgame:
1. Full-suite mode switches from one 'bun test --parallel' invocation to
N concurrent shard PROCESSES, serial within each (the paid runner's
proven model; N = min(6, cpus-2)). The single-invocation strategy hit
three distinct Bun 1.3.13 worker pathologies in one day — a segfault
whose crashed-worker retry wedged the run, a quarantined file's
still-running file-level hooks stalling a worker, and spawn-heavy
files hanging under load — and each one stalled the WHOLE invocation.
Process shards isolate any wedge to its own shard. First full run
under this model: no wedge, six epilogues, one real failure named.
WORKER_HOSTILE stays as the paper trail; --parallel remains available
per-shard for a future Bun.
2. That one real failure: spec-template-sync regenerates SKILL.md via a
child that inherited the shard process's env — an earlier test's
GSTACK_*/GBRAIN_* mutations changed generator output (failed in-suite,
passed solo on an identical tree). The child now gets a scrubbed env:
generator output must be a function of the templates, not of whichever
test ran before.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: tree-mutating tests run after the parallel shards; scrub relink env
The flake family's root cause, finally: five test files REGENERATE
shared repo artifacts in place (catalog-mode-full rewrites every
SKILL.md in full-catalog mode; spec-sync and idempotency regenerate all
skills; gen-skill-docs and skill-validation rewrite .agents/). Any
concurrent shard reading those files sees a moving target — this one
family produced the exactly-doubled catalog estimate, the golden-file
drift, and the spec-sync mismatch chased earlier today. Full-suite mode
now runs TREE_MUTATING files in one serial shard AFTER the parallel
shards complete; CI's matrix is unaffected (per-runner checkouts).
Also: relink's run() helper spread process.env into its children, so a
sibling file's leaked GSTACK_HOME made the 'fresh install' test see a
neighbor's skill_prefix. GSTACK_HOME is now dropped unless the test
passes it explicitly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: gbrain-detection-override joins TREE_MUTATING (mutator #6)
It regenerates SKILL.md in place with --respect-detection (the gbrain
variant adds ~1-3KB per carved skeleton) and git-restores afterward —
its own header documents the approach. During that window the parity
suite in a concurrent shard read inflated skeletons and failed 4 caps.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: tree-ratchet readers join the serial phase (quiet tree by construction)
Two consecutive runs failed the parity caps with byte-identical inflated
skeletons (+~2KB gbrain-variant blocks) while the tree was clean before
and after — some concurrent regen window keeps escaping the mutator
census. Rather than hunt every present and future mutator, the tests
that MEASURE the shared tree (parity caps, size budgets, carve guards)
now run in the serial phase after the parallel shards: a quiet tree by
construction, immune to any regen we haven't found.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* evals: judge default back to Sonnet — Haiku regressed the rubric family (A/B receipts)
The partial-diff rehearsal was the Haiku judge default's first live run
and it failed all three selected doc-rubric judges. Controlled A/B on
the identical health-rubric prompt: Haiku 2/2/2 vs Sonnet 4/3/4, both
with coherent reasoning — Haiku is simply a harsher grader on
long-document rubrics, and every >=4 threshold in skill-llm-eval was
calibrated against months of Sonnet baselines. Per D1a's
pin-on-regressors protocol the default reverts; a new
GSTACK_EVAL_MODEL_JUDGE override makes future recalibration a one-var
experiment. Haiku keeps the classifier-grade duties (pty hung/working,
warmup, distill via lib/eval-model.ts) and D1a's capture->Sonnet stands.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(test-runner): per-origin classifier buffers — interleaved pipes can't shear lines
stdout and stderr are independent pipes; a chunk from one can arrive
between two halves of a line from the other. The single shared
pending-buffer glued those fragments into garbled lines: a sheared
(fail) line went uncounted (defeating the exit-0-with-failures
backstop) and a sheared terminal summary read as truncation.
Counters stay shared; line assembly is now per-stream, and both
runners tag the stream origin. Also drops the dead ChildProcess
type import left by the killProcessGroup move.
* fix(test-runner): real carve-guard keys in TREE_MUTATING; census pins; size-scaled wall deadlines
TREE_MUTATING listed 'test/carve-guard-checks.test.ts' — a file that
has never existed (the real ratchet readers are
carve-guard-completeness and carve-section-ordering), so the intended
serialization was silently absent. New census pin tests fail on any
key that doesn't name a real free test file, and on a TEST_ROOTS
entry that stops contributing files. Full-suite wall deadlines now
scale with shard size (max(6min, files x 5s)) so a jobs=1 machine or
the ~130-file Windows shards can't false-timeout a healthy run;
explicit --wall-timeout disables scaling. Stale --parallel wording in
the dry-run message, jsdoc, and the TREE_MUTATING ordering comment
corrected to the shipped process-shard model.
* fix(evals): selection under-selection fixes — duplicate keys, self-paths, quotePath
Three under-selection holes: (1) duplicate E2E_TOUCHFILES keys
(ship-plan-completion/-verification) — JS keeps the LAST duplicate, so
the earlier dep lists were dead; pair deleted and a duplicate-key scan
added to the literal-only tripwire. (2) The five rehomed e2e files
didn't list themselves in their own dep lists, so editing the test
never selected it. (3) git C-escapes non-ASCII paths without
core.quotePath=false, so an accented filename matched no glob and
deselected its tests. Also updates the stale --retry cost comment.
* fix(evals): destructive-actions guard actually inspects Bash commands
The rehomed guard filtered on typeof input === 'string', but
session-runner records tool inputs as objects ({command} for Bash) —
the filter matched nothing and the assertion could never fail, even
against a real 'git push'. Now extracts the command from the object
shape, same as the usedGitDiff check above it.
* fix(redact): interpolation allowance can't swallow a real $word password
The placeholder calibration used optional braces on both sides, which
also suppressed bare $lowercase — a real password starting with '$'
would have passed the HIGH gate. Interpolation now means ${identifier}
(braced, any case) or bare $UPPER_SNAKE only; both connection-string
patterns share one validator so they can't drift. Pins added for the
bare-$word block, $UPPER allowance, and mismatched-brace block.
* fix(gbrain): wait --timeout validates up front instead of polling forever on NaN
Number('abc') is NaN, NaN comparisons are always false, and the
poll loop never hit its deadline — an infinite 5s loop where the bash
predecessor errored immediately. die(2) at parse time, with a test.
* ci: least-privilege tokens on the two lanes that execute PR-controlled code
free-tests runs PR code (install lifecycle scripts + the suite) with
whatever the repo-default GITHUB_TOKEN grant is, persisted into
.git/config by checkout. Now: permissions contents:read,
persist-credentials false, pinned by the wiring test. actionlint gets
the same treatment plus a digest pin on the third-party Docker Hub
image (a tag is repointable with no GitHub-side audit trail, and the
image sees the mounted checkout). restore-keys added to both caches so
a lockfile bump warms from the previous cache; stale --parallel header
wording corrected.
* test(browse): unit coverage for the close() SIGKILL fallback
The wedge fix (capture the Chromium child before the close race,
SIGKILL on timeout) shipped without a test of the branch it added —
the coverage audit flagged it as the diff's one regression-gap. The
5s race window becomes an injectable closeRaceMs field, and four unit
tests pin: SIGKILL on hang, no SIGKILL on clean close, no SIGKILL on
an already-exited child, SIGKILL on a rejecting close.
* docs: CLAUDE.md describes the shipped shard-process model, not the abandoned --parallel probe
* fix(test-runner): cancellation terminates the run; win32 kills the whole tree
Installing SIGINT/SIGTERM forwarders suppresses Node's default
terminate-on-signal, so a cancelled run killed the current child and
kept LAUNCHING shards — observed as paid runs continuing to burn API
spend after Ctrl-C (codex adversarial, repro'd ALIVE_AFTER_SIGTERM).
The first signal now also schedules the parent's own exit after the
children's SIGKILL grace, and both shard pools consult
isTerminationRequested() before taking new work. On win32,
killProcessGroup uses taskkill /T /F — detached:true creates no
killable group there, and a bare child.kill orphaned every grandchild
(ports, locks, and the inherited pipes that kept close from firing).
Also: the tree-mutating serial shard prints dirty generated artifacts
when it dies mid-regeneration, and --shard CI-matrix mode gets the
same size-scaled wall deadline as full-suite mode.
* fix(evals): preflight fails fast on spawn error, timeout, and exit 127
The ping only grepped stdout for two connection strings — a missing
claude binary, a 30s timeout kill, or command-not-found all returned
'ok', and the fleet then burned ~30 shard timeouts discovering the
outage one child at a time. Cross-model finding (testing specialist +
codex adversarial). Other non-zero exits stay deliberately fail-open:
a flaky preflight must not block a runnable suite; pinned both ways.
* fix(redact): lowercase 'password'/'pass' at the URL-password position blocks
The case-insensitive placeholder words waved postgres://admin:password@host
through the HIGH gate as a doc placeholder (codex adversarial,
verified zero findings pre-fix). URL-password position is now stricter
than generic placeholder detection: ALL-CAPS doc convention
(USER:PASSWORD), ${identifier} interpolations, bare $UPPER_SNAKE, and
structural shapes (<your-password>) suppress; lowercase dictionary
words block. Pinned in both directions.
* fix(gbrain): DSNs percent-encode the password; body reads retry; stdout drains
Three codex-adversarial findings in the provision port: (1) raw DB_PASS
interpolation — a reserved character (/ # ? % @) restructured the URI,
provisioning succeeded, and every consumer then failed to parse the DSN
(unusable billable orphan); now encodeURIComponent, round-trip pinned.
(2) await res.text() sat outside the transport try — a server that sent
headers then reset the stream was an uncaught exit 1 instead of a
retry-then-exit-8. (3) The bin entrypoint called process.exit() after
unawaited stdout writes, truncating piped JSON; exitCode lets writes
drain.
* fix(evals): selection-path helpers join GLOBAL_TOUCHFILES; base-branch keys self-register
The three-file split moved test-selection.ts into the globals but
dropped the facade — an edit to test/helpers/touchfiles.ts (executable
selection-path code imported by every consumer) selected ZERO paid
tests, the exact invisible-non-execution class this branch exists to
kill (claude adversarial, finding 1). e2e-helpers.ts (the harness every
paid test imports) and paid-test-set.ts (paid-vs-free classification)
had the same gap. The review/ship base-branch keys also register
test/skill-e2e-review-attribution.test.ts so editing those tests
selects them.
* ci(free-tests): PR-number concurrency, failure-log artifact, main-push runs
Three red-team/adversarial findings on the new required lane:
(1) concurrency keyed on bare head_ref — two forks with the same
branch name shared one group, so a push to fork B cancelled fork A's
in-flight REQUIRED check (merge-pipeline DoS with no code fault); key
on the PR number. (2) The runner's full logs die with the runner in
os.tmpdir() — a red check named WHICH test failed but never why;
upload the shard logs as an artifact on failure. (3) PR-only trigger
meant two individually-green PRs could merge into a red main with
nothing running the suite there; add push: branches: [main].
* ci: PR-number concurrency keying on the eval and Windows lanes too
Same fork-branch-name collision as free-tests.yml: bare head_ref
carries no owner prefix, so same-name branches from different forks
shared a cancel-in-progress group.
* test(evals): retro E2E passes require the report on disk
Both retro tests passed with zero work product: error_max_turns
counted as success and the content assertion was guarded by
fs.existsSync — a run that burned 30 turns and wrote nothing recorded
green (red team). The report is now load-bearing for pass/fail.
* chore: bump version and changelog (v1.66.0.0)
Test/evals/CI speedup pass: release summary + itemized changes in
CHANGELOG.md; TODOS.md marks the free-suite exit-code P1 complete and
files the review-army follow-ups.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(redact): fully-braced ${...} interpolations are code, whatever they contain
The identifier-only braced form flagged the DSN builder's own
${encodeURIComponent(dbPass)} call site as a pushed secret — a scan
that cries wolf on the fix for the previous finding. Any ${...}
spanning the whole password segment is template code; bare $word
stays uppercase-only so $hunter2 still blocks. The mismatched-brace
negative fixture assembles at runtime so this file's own pushed bytes
carry no blockable URL shape.
* test(gbrain): assemble the pooler expected-URL from parts (scan-clean pushed bytes)
* docs: sync docs for v1.66.0.0 (test/evals/CI speedup)
CONTRIBUTING.md, AGENTS.md, and ARCHITECTURE.md still taught bare
`bun test` for the suite; the shipped runner deprecates it (walks the
whole repo, loads paid eval files, misses the strict classifier). All
suite-level references now say `bun run test`, the Tier 1 section
describes the strict shard runner (~90-100s, --verbose, --wall-timeout),
the sharded paid-runner paragraph documents diff-based shard skipping
and the EVALS_JOBS / EVALS_CONCURRENCY split, the Tier 3 row points at
the actual judge-only invocation, and GSTACK_EVAL_MODEL_JUDGE is
documented at the judge it overrides.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(free-tests): restore the PR-number concurrency + failure-log artifact; truth-fix stale comments
The workspace-revert incident that hit CHANGELOG/TODOS mid-ship also
caught free-tests.yml between edits: commit 8d6c2ff8's message claims
PR-number concurrency + artifact upload + main-push runs, but only the
push trigger survived to the commit (caught by the /document-release
doc-vs-code audit). Both re-applied. Also: eval-model.ts header said
capture defaults to Opus (it's Sonnet per D1a), paid-shards' header
pinned a stale 44/63 shard census, and two CHANGELOG phrases
over-claimed ('six' -> 'up to six' shard processes; retry-1 scoped to
retry-bearing paid paths).
* ci: setup-buildx before every cache-exporting image build
First live run of the cache trio failed at flag-parse time: the
default buildx `docker` driver hard-errors on cache-to registry
export ('Cache export is not supported for the docker driver'), which
failed build-image on PR #2593 and skipped the entire gate eval
matrix behind it. docker/setup-buildx-action creates the
docker-container builder that supports registry cache export; all
three build sites (evals, evals-periodic, ci-image) get it.
* fix(browse): Xvfb identity is argv[0]'s basename, not a cmdline substring
First Linux CI run: isOurXvfb identified the TEST RUNNER as our Xvfb —
the suite's own argv contains 'xvfb.test.ts', the substring match over
the whole cmdline passed, and the start-time check matched because the
pid was real. Any process whose ARGUMENTS mention xvfb (a runner, an
editor) was killable — the sibling-kill class the identity check
exists to prevent. Identity now rests on argv[0]'s basename ('Xvfb'),
with a sh-$0 regression pin. isDisplayFree falls back to the X
socket/lock files when xdpyinfo isn't installed (x11-utils is absent
on some images that ship Xvfb).
* fix(test-runner): strip GHA ::group:: wrappers before file attribution
On GitHub Actions bun wraps each file's log section in ::group::. The
un-stripped header failed FILE_HEADER_RE, failures attributed to the
PREVIOUS file, and the terminal recap's re-printed (fail) lines landed
under a phantom second file — the first Linux run reported 5 real
failures as 10 across 2 files (one of them innocent). Strip the prefix
before matching; the existing file+test dedupe then absorbs the recap.
* test: first-Linux-run environment fixes — bun-only PATH shim, claude gate, darwin-scoped pdf gates
Three environmental assumptions the Linux lane exposed:
(1) gbrain-detect's deterministic SAFE_PATH lacked the bun runtime, so
every env-shebang spawn exited 127 on CI; a scratch dir holding ONLY a
bun symlink joins the PATH (appending bun's real dir would leak its
siblings — dev boxes keep gbrain there too).
(2) host-config's 'detect finds claude' assumed a claude binary; the
secretless lane deliberately has none — gated on Bun.which.
(3) The four make-pdf render gates hard-required prerequisites on ANY
CI, but the make-pdf gate workflow is macOS-only by decision and the
Linux lane doesn't build dist/pdf — hard-require scoped to darwin.
* ci(free-tests): run the suite under xvfb-run
Headed-browser tests (handoff, extension sidepanel DOM) need a real
DISPLAY; the first Linux run died on Playwright's 'headed browser
without an XServer' banner. xvfb-run -a provides the display; x11-utils
ships xdpyinfo for display probing.
* fix(test-runner): bun's headerless failure recap can't invent a phantom failing file
Round-3 CI showed the remaining half of the recap bug: bun prints
'N tests failed:' then re-prints every (fail) line with NO file
headers, so they attributed to the stale currentFile — an innocent
file (test/uninstall.test.ts) was charged with another file's 5
failures. The recap marker now ends attribution (currentFile=null,
chunk closed) and recap re-prints of already-recorded test names
dedupe; a recap-only failure the main run never attributed still
records, unattributed, as belt and braces.
* test(browse): sidepanel DOM suite launches with --no-sandbox on CI + console capture
The suite's raw chromium.launch had no --no-sandbox — every browse
test that goes through gstack's launcher (which always passes it)
survived the Linux lane, while this file's sandboxed renderer died on
first navigation: waitForFunction hung to the 15s test timeout, then
every newContext failed with Target.createBrowserContext. Also wires
pageerror/console-error capture at all six pages so a page-side
failure reads as itself in CI logs instead of a bare timeout.
* test(browse): delete the sidepanel security-DOM suite — it tests UI removed in v1.14
Another member of the never-ran class: the file skipped everywhere
(Playwright chromium absent locally, no Linux CI until this branch),
so it rotted invisibly through THREE contract changes — the v1.63
/extension-token bootstrap, the endpoint growth (/memory,
/pty-session, /sse-session), and finally the v1.14 sidebar-REPL
rewrite that removed the security shield/banner UI it asserts on
(#security-shield survives in sidepanel.html as a dead hidden stub
with no JS driver; sidepanel.js:87 and :1317 document the removal).
The Linux lane executed it for the first time and it can never pass:
the behavior is gone. The L1-L3 security filters it name-checked stay
covered by the ~83 unit/behavioral security tests. The free-tests
lane also vendors xterm assets (bun run vendor:xterm) so the
sidepanel terminal scripts load for any future DOM coverage.
* ci(evals): per-row retry override — two receipted rows keep the third attempt
Three PR rounds of receipts: pty-plan-smoke failed attempt 2 in two
consecutive rounds with ROTATING members (plan-design-review, then
plan-eng-review) and e2e-workflow's document-release timed out on
attempt 2 in round 4 — while both families pass on branches still
running three attempts, and every other row stayed green at --retry 1
across all rounds. Matrix rows gain an optional retries field
(default 1); only these two rows set 2, keeping the measured
retry-amplification win everywhere else.
* test(windows): curate the seven POSIX-bound files the expanded lane surfaced; fix flag-utils path embedding
First full run of the expanded Windows lane (13 -> ~258 files, PR #2593
run 31918591602) failed in exactly 8 files. One was a real test bug,
fixed: design-flag-utils embedded a raw Windows ROOT into a bun -e
string where backslashes act as escapes (D:\a\gstack imported as
D:agstack) — forward slashes work on every platform. The other seven
are POSIX-bound in ways the content patterns cannot see (sed/ln/bash
ARE their subject, a shebang shim arrives via variable, wall-clock
retry bounds on the slowest runner) — each gets a receipted
KNOWN_WINDOWS_INCOMPATIBLE entry, and the census pin now covers that
list so a renamed file fails the suite instead of silently keeping a
stale exclusion.
* test(windows): curate skill-census + browser-manager-unit; surface unhandled errors in the epilogue
Round-2 Windows census (zero failing TESTS — the first curation wave
held): shard 1 failed on an unhandled module-load throw in
skill-census (the skills-tree symlink layout needs Developer Mode CI
runners lack) and shard 2 wedged to its wall deadline inside
browser-manager-unit — both get receipted exclusions; macOS + Linux
lanes keep covering the files. The unhandled-error class also exposed
an epilogue gap: it fails the shard via the strict classifier but
produces no (fail) lines, so the epilogue read 'FAIL — 0 failing
test(s)' with no culprit. The reporter now attributes each
'# Unhandled error between tests' marker to its chunk and the FAIL
line carries the count.
* docs: file the two Windows-lane follow-ups (browser-manager wedge, skill-census symlinks)
* test(windows): round-3 curation — seven files the round-2 wedge had been truncating
The browser-manager-unit wedge was cutting shard 2 short, so each
Windows round revealed the next segment of never-run files. With the
wedge excluded, shard 2 completes (50s) and shows its real failures:
seven more POSIX-environment files (PID/cmdline identity probing,
bash scripts as the subject under test, env-scrubbed bun spawns).
Shards 1 and 3 (including all tree-mutators) now PASS on
windows-latest — this should be the fixed point: ~234 files of real
Windows coverage vs the 13 hand-picked before.
* test(windows): round-4 curation (spawnSkill env, symlink fixtures) + shard-log artifact
Shard 2 ran all 132 files with zero (fail) lines yet bun exited 1 —
unhandled errors in a shape neither counter names, and the Windows
lane had no log artifact to attribute them. Statically attributed and
excluded: browser-skill-commands (spawnSkill spawns bun with a
constructed env; resolution fails under Windows spawn) and
security-audit-r2 (evil-link symlink fixtures need Developer Mode).
The lane now uploads its shard logs on failure like free-tests.yml,
with os.tmpdir() pointed at runner.temp so the glob can find them.
* evals: Opus pin on the spec AUQ-matrix entry — D1a regressor, receipts in-file
The periodic re-baseline for the capture default (Opus -> Sonnet)
found exactly one regressor across the seven-entry AUQ behavioral
matrix: spec failed twice under Sonnet ('never reached a question in
budget', 242s) while its six siblings passed; the controlled Opus
re-run passed cleanly (7/7 format, substance 5, 160s), and a second
run through the new per-entry model plumbing confirms. MatrixSkill
gains an optional model field wired into captureFirstAuq; only spec
sets it. TODOS gains the re-baseline receipts for the never-baselined
periodic tail (three setup-gbrain files + ship-idempotency, all
local-only).
* test(evals): scope-gate assertion carries its evidence tail; file the detector-flake TODO
The plan-design-review member fails ONLY scopeGateQuestionObserved
intermittently on unchanged code (PR #2593: red rounds 3/11 + rerun,
green rounds 5/6 — every attempt terminal, no plan-mode leak), and a
bare Expected-true/Received-false is undiagnosable from CI logs. The
check now throws with the last-2KB visible evidence, so the next
failure distinguishes a detector-sensitivity miss from a real silent
bypass. TODO filed with the full receipt trail.
* test(evals): review-dashboard-via budget 300s -> 360s — third ratchet of the same contention story
PR #2472 documented the 180s deterministic 0-turn startup timeouts and
ratcheted to 300s; PR #2593 hit 302s timeouts on attempt 2 in two
consecutive runs while five sibling rounds passed — marginal at 300s
under 40-way in-shard concurrency. Same headroom its contention-class
sibling (retro-base-branch) carries; outer bun timeout rises to 480s.
* test(evals): document-release budget 180s -> 300s — same contention ratchet, receipts in-file
Timed out at exactly 180s on its final attempt twice on PR #2593
(rounds 4 and 13) while passing four other rounds — a 30-turn
multi-step doc workflow is marginal at 180s under 40-way in-shard CI
concurrency. Same story and same fix as review-dashboard-via and
retro-base-branch; outer bun timeout rises to 360s.
* docs: file the systemic in-shard-concurrency follow-up behind the timeout-flake family
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: diff-based test selection for E2E and LLM-judge evals
Each test declares file dependencies in a TOUCHFILES map. The test runner
checks git diff against the base branch and only runs tests whose
dependencies were modified. Global touchfiles (session-runner, eval-store,
gen-skill-docs) trigger all tests.
New scripts: test:e2e:all, test:evals:all, eval:select
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: bump version and changelog (v0.6.1.0)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: plan-design-review-audit eval — bump turns to 30, add efficiency hints
The test was flaky at 20 turns because the agent reads a 300-line SKILL.md,
navigates, extracts design data, and writes a report. Added hints to skip
preamble/batch commands/write early while still testing the real SKILL.md.
Now completes in ~13 turns consistently.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
