Repository navigation
Add fleet and Adoption views with native workstation reads - #899
Merged
Merged
Conversation
seathatflowsinourveins
added
the
lane:foundation
seathatflowsinourveins
changed the title
This was referenced Oct 9, 2026
seathatflowsinourveins
force-pushed
the
codex/ns2604-fleet-page-20261008
branch
3 times, most recently
from
October 9, 2026 09:19
6c42fd6 to
32671af
Compare
seathatflowsinourveins
added a commit
that referenced
this pull request
Oct 9, 2026
### Scope The local source pages use independent exact path permissions before native or linked file access, preserve raw receipt custody and render portable text. FIX3 `0b66de07b6e1437084ab39e1f0ac7dce802f8b93` adds four permissions from current main so the default refresh continues after merge, tests policy/index parity and fail-closed policy handling, and documents the four flags' actual permitted files. - Base commit: `e48de2e6fa1dd3b740af4793ea5824ea35476dba` (main merge base); FIX3 parent `7fac0184674168898e51787c85069fc35d2bb47f`. - Lane: `lane:foundation`. - This corrective head changes `tools/local-pages/source_policy.json`, its test module and README. All earlier read-boundary, port21090, redirect, sanitizer, date/reset and view corrections remain in the PR. ### SOTA sources - [Current native source index](https://github.com/seathatflowsinourveins/native-agent-stack/blob/958a6d1ab770c807c5ee59748475a5c14df7ba52/tools/north-star/sources.json), pin `958a6d1ab770c807c5ee59748475a5c14df7ba52`, SHA-256 `4cdfe0a722a8e2a620551f5b092e2db762555deb06eef085686623561996dcd2`: independently approved exact root/path declarations for `cc_g2_started`, `cc_g2_started_correction`, `cc_g5_closure` and `cc_g6_f9`. - [Maintained native readiness](https://github.com/seathatflowsinourveins/native-agent-stack/blob/958a6d1ab770c807c5ee59748475a5c14df7ba52/tools/north-star/build_readiness.py), same pin, reader SHA-256 `59428d63e09bab10e216e86af377891f8546aca6b3f9cc08c59d0803573b57b0`: original reader/portable export APIs under a module-local version-bound guard. - [Maintained CI selector](https://github.com/seathatflowsinourveins/native-agent-stack/blob/958a6d1ab770c807c5ee59748475a5c14df7ba52/scripts/validate_shards.py), same pin, `discover()`/module assignment and `.github/workflows/validate.yml:265`; installed CPython `3.13.16` [unittest discovery](https://docs.python.org/3.13/library/unittest.html#test-discovery) is the native harness. - Existing CPython3.13 descriptor `os.open/fstat/O_NOFOLLOW`, urllib redirect-handler and zoneinfo interfaces remain the implementation sources for safe reads, loopback collection and New York timestamps. - Exact CC FIX2 micro SHA-256 `e4a149c1fa20ab42647f71090aa6e1442369605a89cdb22121d242ebf95a8eba`; prior policy/read-boundary evidence retained. No dependency, installation or upstream fork introduced. ### Evidence-class table | Claim | Evidence class | Command / receipt | | --- | --- | --- | | FIX3 policy approves every exact declaration in the current main28-key index | `local_integration` | Metadata-only old7facpolicy RED/currentpolicy GREEN; no state bodies followed | | Every committed index key requires exact root/path approval | `local_integration` | New committed-index parity regression; in-memory omitted grant makes it fail | | Ordinary unlisted names cannot bypass role permissions; invalid/missing policy fails before native opens | `local_integration` with synthetic inputs | Policy18tests with actual open watchers; existing protected cases retained | | Local-page modules already run through maintained CI selection | `local_integration` | Native bounded discovery5modules/69cases,0loader errors,each assignedonce; selector13tests | | Earlier view/collector/native behavior remains compatible | `local_integration` with synthetic inputs | Composer27/current10/sanitizer6/workstation8/native32 | | Repository integrity/scope | `source_review` | Validator0 and diff0 | ### Local commands run Each test command used `nice -n 10 ionice -c2 -n7 timeout 600`: ```sh python3 -B -m unittest discover -s tests -p test_local_pages.py # rc0,27 python3 -B -m unittest discover -s tests -p test_local_pages_current_view.py # rc0,10 python3 -B -m unittest discover -s tests -p test_local_pages_sanitization.py # rc0,6 python3 -B -m unittest discover -s tests -p test_local_pages_workstation.py # rc0,8 python3 -B -m unittest discover -s tests -p test_local_pages_source_policy.py # rc0,18 python3 -B -m unittest discover -s tests -p test_north_star_readiness.py # rc0,32 python3 -B -m unittest tests.test_validate_shards # rc0,13 python3 scripts/validate.py # rc0 git diff --check # rc0 bash command-center/cc-tools/base_tests_at_head.sh <repo> e48de2e 0b66de0 unittest # rc0; modified_existing_test_files=0; every failing ID:none. ``` **114 tests PASS**:101page/native and13selector. The maintained pre-cue tool has no existing modified testfiles at the main merge base because these page modules are new in this PR; it does not replace executed tests. No expectation change in FIX3. CI-selection investigation corrects the omission claim: the workflow runs eight native shards; `discover()` uses `test*.py` without an allowlist and already selects all five local-page modules. Workflow/selector bytes equal both7fac018 and fetched main958a6d1, so duplicate selection was unnecessary. ### Decision record `research/fullspeed-20261008/g5-stars-gap/local-pages/architecture/stack-891-fix3-review.md` under the local state root records the exact source grants, old-policy failure/new-policy parity, tests and CI-selection proof. Policy SHA-256 `872bf19a9469e519cc1d4e08331689b5cdcf05db8c2bd7d9ccf85bcafb43886a`:28direct roles, with the existing exact index/supporting/SDK/override sets preserved. Missing/malformed policy and all unlisted input refusals happen before native file access. ### Host evidence No registered host evidence changes or component/provider E2E inferred from fixtures. #899/#913 rebase onto FIX3; both reader micros, required CI/pre-cue and bottom-up CC landing cues through5f remain mandatory. F5 pruning remains separate. ### Checklist - [x] CI selection verified through its maintained harness; workflow pins/permissions preserved. - [x] No secrets printed/logged/committed; no required secret added. - [x] No paid hosting or billing surface introduced. - [x] Peer files/supplied worktrees preserved; generated pages uncommitted.
seathatflowsinourveins
force-pushed
the
codex/ns2604-fleet-page-20261008
branch
from
October 9, 2026 10:55
32671af to
698c658
Compare
seathatflowsinourveins
added a commit
that referenced
this pull request
Oct 9, 2026
1. Isolate the sealed producer bootstrap with Python -I and explicit sibling imports. 2. Degrade optional Fleet adapter errors to UNKNOWN without aborting other pages. 3. Preserve ordinary lane names and drop only individually unsafe roster rows. 4. Mask identity values at bounded text seams, preserving completed HTML tags. 5. Normalize scalar/dictionary fallback dates; reject invalid or overflowing dates. 6. Use native actual_usd/max_usd event sums and dated empty-ledger zero spend. 7. Bound producer sessions at 90 seconds and kill the timed-out descendant group. 8. Sample Actions cache time after acquiring the native lock. 9. Refresh Actions after 540 seconds, before the ten-minute publisher period. 10. Distinguish unknown pool/session observations from recorded empty lists. 11. Keep both default/fast tiers unknown when the source policy is incomplete. 12. Preserve public Unicode/punctuation workflow names with bounded privacy checks. 13. Preserve native portable context for classified decoded identifiers/accounts. 14. Reuse source_policy regular/no-follow/protected-name source reads. 15. Validate and normalize once on the composer path and remove dead branches. Independent review reproduced additional native-fragment, live-total/date, UTC-overflow, unknown-owner, empty-native-ledger and punctuated-token edges; all receive regression coverage in this same fix commit. Source: CC Claude /code-review max at 698c658, SHA-256 33cbb0f17c44f42bcc33cc3ebb91f3a6482788a4a041fcfe01b0839b2d694d82. Native APIs: CPython 3.13.16 subprocess Popen/start_new_session/communicate, os.killpg, pathlib and datetime; existing protected source reader reused.
1. Isolate the sealed producer bootstrap with Python -I and explicit sibling imports. 2. Degrade optional Fleet adapter errors to UNKNOWN without aborting other pages. 3. Preserve ordinary lane names and drop only individually unsafe roster rows. 4. Mask identity values at bounded text seams, preserving completed HTML tags. 5. Normalize scalar/dictionary fallback dates; reject invalid or overflowing dates. 6. Use native actual_usd/max_usd event sums and dated empty-ledger zero spend. 7. Bound producer sessions at 90 seconds and kill the timed-out descendant group. 8. Sample Actions cache time after acquiring the native lock. 9. Refresh Actions after 540 seconds, before the ten-minute publisher period. 10. Distinguish unknown pool/session observations from recorded empty lists. 11. Keep both default/fast tiers unknown when the source policy is incomplete. 12. Preserve public Unicode/punctuation workflow names with bounded privacy checks. 13. Preserve native portable context for classified decoded identifiers/accounts. 14. Reuse source_policy regular/no-follow/protected-name source reads. 15. Validate and normalize once on the composer path and remove dead branches. Independent review reproduced additional native-fragment, live-total/date, UTC-overflow, unknown-owner, empty-native-ledger and punctuated-token edges; all receive regression coverage in this same fix commit. Source: CC Claude /code-review max at 698c658, SHA-256 33cbb0f17c44f42bcc33cc3ebb91f3a6482788a4a041fcfe01b0839b2d694d82. Native APIs: CPython 3.13.16 subprocess Popen/start_new_session/communicate, os.killpg, pathlib and datetime; existing protected source reader reused.
N1 (P2): restore long prefix-less alphanumeric refusal, reject known secret prefixes after hyphen/underscore boundaries, and restore the original 34-character guarding fixture from reviewed 698c658. N2 (P3): nonempty all-rejected rosters remain UNKNOWN when no valid dated source is available; known empty and mixed-valid lists retain their meaning. N3 (P3): overflowing parsed Fleet/cache dates degrade to an unavailable stamp. N4 (P3): source notes display the Actions-reported cache TTL instead of a hard-coded ten-minute claim. N5 (P3): collect the independent Actions observation before the producer. N6 (P3): include the Fleet regression module in the documented focused checks. The CC micro found all 15 prior findings fixed at a920b34 and identified the N1 regression. This ONE additional commit preserves those fixes and uses actual red/green boundary/cache/roster/composer regressions. No rebase. Native reference remains CPython 3.13.16 cbc944f4bc59639a444dd971c737788ba2283a91 re/datetime and the existing native source/cache/producer APIs. No dependency, workflow, service or client configuration change.
seathatflowsinourveins
force-pushed
the
codex/ns2604-fleet-page-20261008
branch
from
October 9, 2026 16:47
d7d02b4 to
4537fb6
Compare
seathatflowsinourveins
marked this pull request as ready for review
October 9, 2026 17:02
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4537fb64fb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+193
to
+194
| codex_key = "codex_by_role" if "codex_by_role" in document else "codex_by_lane" | ||
| fallback = codex_key == "codex_by_lane" |
There was a problem hiding this comment.
When a valid snapshot contains codex_by_role: null alongside populated codex_by_lane, validation accepts both, but this key-presence check selects the null role map. The Fleet page consequently omits all recorded lane rows and incorrectly states that it uses the producer-published role projection. Treat a null role projection as absent and select codex_by_lane in this case.
Useful? React with 👍 / 👎.
Comment on lines
+558
to
+561
| producer, producer_receipt = _read_source(producer_path, state_root, inputs, kind="native Fleet producer") | ||
| if producer is None: | ||
| raise ValueError("native producer unavailable") | ||
| result = _execute_producer(producer_path, producer, producer_receipt, run) |
There was a problem hiding this comment.
When the state-root producer is stale, replaced before this read, or otherwise differs from the cited implementation, this path executes it without comparing producer_receipt["sha256"] to an independently approved digest. The later memfd check only compares the captured bytes with a hash computed from those same bytes, so any regular Python file at this path can execute before the output schema check and be reported as direct native; bind the producer to the approved pin before calling _execute_producer.
AGENTS.md reference: AGENTS.md:L5-L6
Useful? React with 👍 / 👎.
Comment on lines
+215
to
+219
| if capture_output: | ||
| kwargs.update(stdout=subprocess.PIPE, stderr=subprocess.PIPE) | ||
| with subprocess.Popen(command, text=text, **kwargs) as child: | ||
| try: | ||
| stdout, stderr = child.communicate(timeout=timeout) |
There was a problem hiding this comment.
If the Fleet producer becomes noisy or loops while writing output, communicate() buffers unlimited stdout and stderr for up to 90 seconds. The subsequent len(result.stdout) check happens only after all bytes have already been retained, and stderr is never size-checked, so a failed producer can exhaust the page refresh process or host memory; enforce the output limit during capture rather than after process completion.
Useful? React with 👍 / 👎.
Comment on lines
+368
to
+369
| except OSError: | ||
| return [] |
There was a problem hiding this comment.
When .github/workflows is missing or unreadable, this returns the same empty list as a successfully inspected checkout with no model workflows. _actions_locked then performs a successful gh run list, filters every run against that empty list, records a fresh timestamp, and the Fleet page reports no matching runs instead of an unavailable workflow classification. Propagate discovery failure separately so an unobserved inventory cannot become a measured zero.
AGENTS.md reference: AGENTS.md:L7-L7
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Add the Fleet page and published Adoption views to the native local-page composer. Unavailable observations remain UNKNOWN, recorded empty lists and zero spend stay distinct, and each value retains its source date. The verified Fleet producer runs from sealed bytes through an isolated Python child; optional adapter failures preserve the other pages.
aeb6ea585e7ee1db6150314229a45070edf9da4c(current main after Record blinded skills validator trials and stale source rule #918).4537fb64fbc92c49bc572d9e5c5de36ea83bea59.lane:foundation.tools/local-pages/composer, Fleet/Adoption/current/workstation/sanitizer helpers, assets and focused tests.The producer bootstrap uses installed Python isolated mode (
-I), verifies the sealed descriptor's digest, then adds the approved sibling import directory. A 90-second process-session bound kills and reaps timed-out descendants. Fleet source reads reuse the independent protected/no-follow reader. Actions cache time is sampled after locking and expires at 540 seconds; exact bounded public workflow names retain Unicode and punctuation.Actual ledger
actual_usdevent amounts sum as spend.max_usdreservations remain separate from the CC credit ceiling. Both native and file observations of a valid empty ledger report dated zero spend; missing or unrecognized formats stay unknown. Malformed fallback dates become unreported, valid live memory readings replace fallback provenance, and optional total failures do not abort mandatory readings. Identity projection applies to source text at bounded label seams; finished documents and native HTML fragments are not rewritten.SOTA sources
tools/local-pages/source_policy.py/json,build_pages.py,current_view.py, and the native readiness builder.cbc944f4bc59639a444dd971c737788ba2283a91: subprocess, os, HTML escaping. Supported Popen/start_new_session/communicate and os.killpg APIs replace the direct-child-only timeout path; the existing regular/no-follow reader is reused.coordination/ns2604-coop/tools/fleet_block.py, SHA-256b7b6936e421682da7d699e3f22e8fdf04a2e838c8dff4b8bace60e88edd77cf3, event sums at lines 325–343; exact approved producer bytes are the source for the ledger schema.adoption-now/1andcc-now/1published producer contracts; no live telemetry collector or raw account/config source is added.Evidence-class table
local_integrationwith synthetic producertest_local_pages_fleet_regressions.py; prior sealed-byte execution testslocal_integrationwith synthetic inputstest_local_pages.pysyntheticsyntheticlocal_integrationwith synthetic filessource_reviewThe Claude deep read at 698c658 requested 15 changes. The CC micro subsequently confirmed 15/15 FIXED at a920b34. The authorized ONE additional commit d7d02b4 restores a regression in the opaque-label guard: the exact ASCII boundary rejects prefixes after hyphens/underscores and rejects long prefixless alphanumeric runs. The original 34-character guarding fixture from 698c658 is restored in both insertion and assertion. Ordinary hyphenated lane names remain valid. Cheap N2–N6 folds distinguish all-rejected vs observed empty rosters, guard Fleet/cache date overflow, show the source-reported TTL, collect independent Actions before the producer, and document the regression module. Each correction has a red/green source/cache/composer seam. Final CC micro, co-op GPT and exact-head CI/thread/landing gates remain independent.
Local commands run
These are local execution/fixture/integrity checks, not native macOS, provider/GPU acceptance or approval. The CC's a920b34..d7d02b4 micro is PASS: N1 exact and discriminating, N2–N6 fixed. Current 4537fb6 hosted CI/thread and CC/co-op landing checks remain required. Earlier a920b34 CI/zero-thread observations remain dated predecessor evidence, not current-head success.
Decision record
The final N1–N6 packet is
research/fullspeed-20261008/g5-stars-gap/local-pages/fleet-899-n1-dispositions.mdunder the local state root, bound to d7d02b4. The prior 15-finding packet remains bound to a920b34 and Claude review SHA-25633cbb0f17c44f42bcc33cc3ebb91f3a6482788a4a041fcfe01b0839b2d694d82; the CC micro confirms those fixes remain intact. This authorized additional descendant push used a fresh a920b34 lease, with no rebase.On the CC's landing turn, ONE rebase onto current main aeb6ea5 and ONE leased push produced 4537fb6. Main still matched the chosen tip at push time; the exact PR lease was d7d02b4. Root and independent immutable-object checks verify the full net patch is byte-identical: 224993 bytes, SHA-256
e82179fb30bb506627fea6a116069c9c37fad467a82856840f6877b93d001c26; all 18 statuses/modes/blob IDs/content bytes match, drift0. No implementation edit, extra commit or hot-file regeneration was needed.pr899-landing-rebase-verified.jsonbinds parity, local command/exit/head/UTC and lease proofs. Co-op/CC independently confirms parity before landing on green CI and zero threads.The earlier required pre-cue run at 698c658 against main c945ea1 returned 1, with ten declared baseline test/subcase expectations. That is a dated predecessor observation, never current-head PASS or READY. The declarations remain:
Classifications: output count7→8 for Fleet; optional totals expand FIELDS/METRICS beyond the prior three-value fallback and two-item swap slice; Windows samples require the native workstation-windows exporter job. Updated tests retain available/swap values, original timestamps, redirect refusal and swap validity. The complete IDs/classifications and current-head landing-turn pre-cue decision remain in the CC packet; the prior result1 is not recast as success.
Host evidence
No registered host evidence or component/platform acceptance change. No generated page, service or client configuration is committed. W2 manifest and macOS portability changes are separate tasks. F5 pruning remains separate.
Checklist