feat(core): approval lifecycle, evidence-driven closure, artifact and rollback obligations (W2 of #2609) #2626

Open

conductor wants to merge 3 commits from feat/2609-go-interception-w2 into master

pull from: feat/2609-go-interception-w2

merge into: conductor:master

conductor:master

conductor:fix/shared-ci-unblock

conductor:fix/ci-concurrency-per-ref

conductor:fix/2552-handler-triage

conductor:feat/2618-context

conductor:fix/2604-scaffolding-surgical

conductor:feat/2618-provider-stack

conductor:feat/final-integration

conductor:feat/2618-safety-parity

conductor:feat/2609-integration-w6

conductor:feat/2618-audit-forge

conductor:feat/2618-background-memory

conductor:feat/2618-operator-residual

conductor:feat/2618-warm-recall

conductor:feat/2617-research-r3

conductor:feat/2606-spine-w4

conductor:feat/2617-research-r2

conductor:fix/2607-spine-dichotomy

conductor:feat/2609-go-interception-w3

conductor:feat/2618-memory-store

conductor:feat/2617-research-r1

conductor:fix/data-safety-audits

conductor:fix/integration-audits

conductor:fix/sqlite-floor-audits

conductor:feat/2617-research-r0

conductor:feat/2609-model-replay

conductor:fix/tool-boundary-audits

conductor:feat/2609-go-interception-w1

conductor:fix/2582-release-final

conductor:fix/2613-self-hosting-gate

conductor:removal-prep/dead-superseded-pile

conductor:removal-prep/auto-context

conductor:removal-prep/reconcile-tools

conductor:removal-prep/openai-compat-transport

conductor:removal-prep/message-queue

conductor:removal-prep/forge-client

conductor:removal-prep/cache

conductor:removal-prep/paths

conductor:fix/2532-text-selection

conductor:throwaway-force-merge-test

conductor:fix/2582-namespace-cli-flag

conductor:feat/2582-release-reporting

conductor:fix/2535-pane-scrollback

conductor:dichotomy-gap-f0

conductor:gap-transport

conductor:gap-construction-commands

conductor:wave-ca-ms

conductor:tmp-detach

conductor:gap-ltr

conductor:backup-rune-as

conductor:wave-ax

conductor:feat/wave6-rust-backend

conductor:feat/wave4-consolidation-kernel

conductor:ci/build-cognition-core-unit

conductor:ci/register-w34-canaries

conductor:feat/wire-programme-continuation

conductor:feat/wire-construction-commands-dispatch

conductor:feat/wire-stage-guards-transition

conductor:feat/tui-pane-swap-chat-left

conductor:fix/operator-probe-tools-2468

conductor:r2-wave2-memory-retrieval

conductor:r2-wave2-memory-storage

conductor:phase-g-strangler-evidence-provenance

conductor:phase-g-strangler-retrieval-index

conductor:tranche-r1-wave-0

conductor:m10-derive-refresh

conductor:t22-scaffolding-default-path

conductor:research-depth-gate

conductor:fix-407-autolabel

conductor:fix-tui-banner-surface

conductor:r13-m9-pr-proof

conductor:gitea-internal-endpoint

conductor:auto-label-epic-kinds

conductor:issue-templates-heading

conductor:issue-templates

conductor:event-driven-clean

conductor:deadline-return-fix

conductor:hardening-live-proof

conductor:hardening-authority-identity

conductor:event-driven-final-metrics

conductor:event-driven-gates-evidence

conductor:event-driven-continuation

conductor:async-intent-live-proof

conductor:async-intent-normalization

conductor:memory-t0-external-report

conductor:memory-t0-asis-map

conductor:t21.5-pending-class-fix

conductor:t21.5-gate-evidence

conductor:t21.5-root-cause-continuation

conductor:t21.4-gate-evidence

conductor:t21.4-qualify-defaults-fix

conductor:t21.4-final-v1-proof

conductor:prototype/openai-compat-transport

conductor:wr-experiment

conductor:adapt2-route-authority

conductor:pl0-experience-ledger

conductor:d5-authority-audit

conductor:task-d-stage-contracts

conductor:b3v2-fresh

conductor:d5-tightening

conductor:d4d5-artifact-contract

conductor:correction-1-d2d3

conductor:adapt9-artifact-authority

conductor:prov1-source-ledger

conductor:infra1-accept

conductor:infra1-probe5

conductor:infra1-probe4

conductor:infra1-probe3

conductor:infra1-probe2

conductor:infra1-probe

conductor:obs1-telemetry

conductor:rp13-metrics

conductor:rp12-rerun-163

conductor:rp11-retirement

conductor:issue161-harness-v2

conductor:issue161-harness

conductor:rp2-canonical-stage-model

conductor:sweep-live

conductor:umbrella-rewire

conductor:trigger-bump-2

conductor:release-token-fix

conductor:trigger-bump

conductor:version-reconcile

conductor:umbrella-pipeline

conductor:pinned-live

conductor:research-structuralization

conductor:merge-robot-checkout

conductor:p1-03-memory-selection

conductor:coverage-ratchet

conductor:failure-auto-filing

conductor:release-safety-net

conductor:ci-dependency-lock

conductor:bugfix-contract

conductor:merge-robot-fix

conductor:adversarial-gates

conductor:merge-robot

conductor:runner-desktop-gate

conductor:research-gate-evidence

conductor:backup/pinned-20260908-035000

conductor:release-tui-footer

Conversation 1 Commits 3 Files Changed 72

+8933 -192

conductor commented 2026-10-26 03:22:34 +00:00

Owner

Copy link

Copy source

Summary

W2 of #2609, stacked on PR #2621 (W1 commit f5fbd376).

Commit: d220b6022425bd48ef40e32dffacb8504cc38381
Admitted contract: ADMIT-2609-go-interception-w2 (canonical classify → activate → admit; approval ref user:nick-self-hosting-law-2026-10-25; all staged paths verified green by Scaffold.check_scope).

This tranche adds durable approval resume and evidence-gated closure while keeping deterministic verdicts on the authority side of the measured process boundary. It adds no cgo and no Spine registration.

Per-item implementation and evidence

1. Approval lifecycle — src/go/construction/approval.go adds a durable, cross-process-locked, expiring one-use mandate ledger. Construction authorization and effect approval are distinct kinds; work-presentation consent is not accepted into that ledger. Exact stored mutation requests carry operation/target digests, stable turn/call IDs, and serialized resume state. approval_mutation.go rehashes current targets and reauthorizes before returning a permit. rune-core/internal/runecore/approval.go and server.go replace the stub with real /v1/approvals/resolve resume. Tests prove fresh-engine resume, rejection, expiry, stale-target burn, one-use refusal, no duplicate mutation/observation/user message, and construction approval followed by a separate effect approval.

2. Evidence-driven verification and closure — construction_closure.py validates independent git/test/build/working-tree/tool evidence, rejects model-final-answer evidence and failed test/build records, and binds READY verification to a digest of changed files plus evidence. Base close requires prior READY verification and nonempty evidence. Supervised completion uses repaired #2604 request_completion with non-builder authority/actor checks. closure.go collects measured Git diff/status and tool observations; process_closure.go keeps READY/closed verdicts across the process boundary. Direct and live process tests cover mutation → observation → verify → review → close.

3. Artifact obligations — project creation requires README install/run evidence; structural features require ADR rationale; material features require a changelog. Typo-scale changes do not require a README. Hygiene checks account for added vs removed diff lines so pre-existing TODOs are not false positives, while newly introduced unlinked TODOs fail. Independent review includes dead-code confirmation. W2 itself ships docs/adr/0001-go-interception-w2.md and docs/architecture/go-interception-w2-changelog.md without hand-editing the tag-generated root changelog.

4. Rollback and OPEN_GAP — verification measures git rev-parse HEAD and records an executable scoped git restore --source=<HEAD> path. Failed verification/closure records durable OPEN_GAP state; successful verification resolves prior gaps. Real Git fixtures cover restore points, failed builds, scope failures, artifact failures, and TODO hygiene.

5. Independent review — record_review durably binds reviewer, builder, spec compliance, overclaim, dead-code checks, and evidence. Reviewer must differ from builder and contract origin and cannot be a known builder identity. Supervised close refuses missing/self review before it can discharge obligations.

6. Capability-registration events — earned close emits idempotent CAPABILITY_REGISTRATION_EARNED JSONL events with stable entity IDs, evidence refs, linkage/eligibility, and earned maturity (PRESENT / EXERCISED / evidence-qualified LIVE_PROVEN). External projects emit only when explicitly eligible. No Spine absorption or registration is implemented here (W4).

7. Research execution — pending decision routes execute once at admission. TARGETED_EVIDENCE_PROBE calls the real rune.evidence_probe.run_probe artifact workflow, feeds cited results into Build Basis, and blocks STILL_UNKNOWN/CONTRADICTED/failed outcomes. FULL_RESEARCH_PIPELINE launches scripts/research_stage_executor.py --stage ISSUE as a typed background job with PID, command, logs, and durable job evidence while holding the contract in research_required; it never claims pipeline completion. Mutation checks and Go admission both enforce the research hold.

Verification

• go test ./... and go test -race ./...: green in construction, rune-core, local-tool-runtime, rune-entry, and tool-executor (all ten normal/race suites).
• RUNE_PATHS_ENGINE=python PYTHONPATH=src python3 -m pytest -q tests/test_construction_interface.py tests/test_construction_authority_drills.py tests/test_construction_closure_w2.py tests/test_construction_research_w2.py: 89 passed. This includes migrated legacy closure fixtures and real canonical-process lifecycle smoke.
• Ruff: all changed Python files pass. Go formatting checks are clean.
• python3 scripts/check_domain_registry.py: GREEN (61 domains / 600 package paths).
• Final staged Scaffold.check_scope: GREEN with no out-of-scope paths. check_landing.py --staged-only: GREEN. Commit hooks ran normally; no --no-verify.
• Research sweep resolves ADMIT-2609-go-interception-w2 GREEN. The sweep still has the inherited ADMIT-release-reporting violation recorded by W1.
• Staged Henxels also reports the three inherited repository-debt findings: docs/factory/domains.json file type, the two pre-existing oversized authority files, and the pre-existing construction_interface dichotomy facade. No new module was flagged. These were not hidden or bypassed.

Honest gaps for W3/W4 and later research lifecycle

• W3 still owns native Rust decision port-forwarding and Python facade retirement. W2 deliberately keeps verdicts behind the measured Python authority process.
• W4 owns Spine composition, registration/absorption, and TUI projection/viewer. W2 only emits the event data needed for that work; no interactive TUI flow is claimed.
• Full research stage completion, reconciliation, and re-admission remain later work. W2 implements real dispatch and the hold, not a silent full-pipeline success. Tests use an injected probe runner and process launcher so no live model worker or shared Gitea research issue is mutated during verification.

Do not merge as part of this delivery.

## Summary W2 of #2609, **stacked on PR #2621** (W1 commit `f5fbd376`). Commit: `d220b6022425bd48ef40e32dffacb8504cc38381` Admitted contract: `ADMIT-2609-go-interception-w2` (canonical classify → activate → admit; approval ref `user:nick-self-hosting-law-2026-10-25`; all staged paths verified green by `Scaffold.check_scope`). This tranche adds durable approval resume and evidence-gated closure while keeping deterministic verdicts on the authority side of the measured process boundary. It adds no cgo and no Spine registration. ## Per-item implementation and evidence 1. **Approval lifecycle** — `src/go/construction/approval.go` adds a durable, cross-process-locked, expiring one-use mandate ledger. Construction authorization and effect approval are distinct kinds; work-presentation consent is not accepted into that ledger. Exact stored mutation requests carry operation/target digests, stable turn/call IDs, and serialized resume state. `approval_mutation.go` rehashes current targets and reauthorizes before returning a permit. `rune-core/internal/runecore/approval.go` and `server.go` replace the stub with real `/v1/approvals/resolve` resume. Tests prove fresh-engine resume, rejection, expiry, stale-target burn, one-use refusal, no duplicate mutation/observation/user message, and construction approval followed by a separate effect approval. 2. **Evidence-driven verification and closure** — `construction_closure.py` validates independent git/test/build/working-tree/tool evidence, rejects model-final-answer evidence and failed test/build records, and binds READY verification to a digest of changed files plus evidence. Base close requires prior READY verification and nonempty evidence. Supervised completion uses repaired #2604 `request_completion` with non-builder authority/actor checks. `closure.go` collects measured Git diff/status and tool observations; `process_closure.go` keeps READY/closed verdicts across the process boundary. Direct and live process tests cover mutation → observation → verify → review → close. 3. **Artifact obligations** — project creation requires README install/run evidence; structural features require ADR rationale; material features require a changelog. Typo-scale changes do not require a README. Hygiene checks account for added vs removed diff lines so pre-existing TODOs are not false positives, while newly introduced unlinked TODOs fail. Independent review includes dead-code confirmation. W2 itself ships `docs/adr/0001-go-interception-w2.md` and `docs/architecture/go-interception-w2-changelog.md` without hand-editing the tag-generated root changelog. 4. **Rollback and OPEN_GAP** — verification measures `git rev-parse HEAD` and records an executable scoped `git restore --source=<HEAD>` path. Failed verification/closure records durable OPEN_GAP state; successful verification resolves prior gaps. Real Git fixtures cover restore points, failed builds, scope failures, artifact failures, and TODO hygiene. 5. **Independent review** — `record_review` durably binds reviewer, builder, spec compliance, overclaim, dead-code checks, and evidence. Reviewer must differ from builder and contract origin and cannot be a known builder identity. Supervised close refuses missing/self review before it can discharge obligations. 6. **Capability-registration events** — earned close emits idempotent `CAPABILITY_REGISTRATION_EARNED` JSONL events with stable entity IDs, evidence refs, linkage/eligibility, and earned maturity (`PRESENT` / `EXERCISED` / evidence-qualified `LIVE_PROVEN`). External projects emit only when explicitly eligible. **No Spine absorption or registration is implemented here (W4).** 7. **Research execution** — pending decision routes execute once at admission. TARGETED_EVIDENCE_PROBE calls the real `rune.evidence_probe.run_probe` artifact workflow, feeds cited results into Build Basis, and blocks STILL_UNKNOWN/CONTRADICTED/failed outcomes. FULL_RESEARCH_PIPELINE launches `scripts/research_stage_executor.py --stage ISSUE` as a typed background job with PID, command, logs, and durable job evidence while holding the contract in `research_required`; it never claims pipeline completion. Mutation checks and Go admission both enforce the research hold. ## Verification - `go test ./...` and `go test -race ./...`: green in **construction, rune-core, local-tool-runtime, rune-entry, and tool-executor** (all ten normal/race suites). - `RUNE_PATHS_ENGINE=python PYTHONPATH=src python3 -m pytest -q tests/test_construction_interface.py tests/test_construction_authority_drills.py tests/test_construction_closure_w2.py tests/test_construction_research_w2.py`: **89 passed**. This includes migrated legacy closure fixtures and real canonical-process lifecycle smoke. - Ruff: all changed Python files pass. Go formatting checks are clean. - `python3 scripts/check_domain_registry.py`: GREEN (61 domains / 600 package paths). - Final staged `Scaffold.check_scope`: GREEN with no out-of-scope paths. `check_landing.py --staged-only`: GREEN. Commit hooks ran normally; no `--no-verify`. - Research sweep resolves `ADMIT-2609-go-interception-w2` GREEN. The sweep still has the inherited `ADMIT-release-reporting` violation recorded by W1. - Staged Henxels also reports the three inherited repository-debt findings: `docs/factory/domains.json` file type, the two pre-existing oversized authority files, and the pre-existing `construction_interface` dichotomy facade. No new module was flagged. These were not hidden or bypassed. ## Honest gaps for W3/W4 and later research lifecycle - W3 still owns native Rust decision port-forwarding and Python facade retirement. W2 deliberately keeps verdicts behind the measured Python authority process. - W4 owns Spine composition, registration/absorption, and TUI projection/viewer. W2 only emits the event data needed for that work; no interactive TUI flow is claimed. - Full research stage completion, reconciliation, and re-admission remain later work. W2 implements real dispatch and the hold, not a silent full-pipeline success. Tests use an injected probe runner and process launcher so no live model worker or shared Gitea research issue is mutated during verification. Do not merge as part of this delivery.

conductor added 3 commits 2026-10-26 03:22:34 +00:00

fix(scaffolding): surgical defect repairs (#2604) ... fb2830d8dd

Restore supervised completion and basis enforcement, preserve Need toolchain evidence and refusal semantics, bind active-contract discovery to canonical project/task lanes, stabilize obligation identifiers, and restore the MiMo mutation-boundary reference.

feat(core): native construction coordinator + mutation gates (ADMIT-2609-go-interception-w1) ... f5fbd37625

W1 of #2609: bound turn admission, per-door permits and observations, shell reconciliation, polyglot evidence, and the measured Python authority boundary. Contract: ADMIT-2609-go-interception-w1

feat(core): approval lifecycle, evidence-driven closure, artifact and rollback obligations (ADMIT-2609-go-interception-w2) ... d220b60224

W2 of #2609: durable construction/effect approvals, independent verification and supervised closure, artifact/rollback/OPEN_GAP gates, independent review, capability registration events, and research execution. Contract: ADMIT-2609-go-interception-w2

gitea-actions Bot added the P0 — criticalbugcustodianidentityinfrastructurelifememoryperception labels 2026-10-26 03:22:43 +00:00

gitea-actions Bot commented 2026-10-26 03:23:21 +00:00

Copy link

Copy source

🤖 Headless spec gate (non-blocking, #204 first slice)

Spec-gate agent produced no text output — check runner logs.

Deterministic floors still govern the merge

This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.

🤖 **Headless spec gate (non-blocking, #204 first slice)** Spec-gate agent produced no text output — check runner logs. <details><summary>Deterministic floors still govern the merge</summary> This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>

conductor referenced this pull request 2026-10-26 05:15:25 +00:00

feat(core): native Rust decision port-forward with serving-path proof (W3 of #2609) #2630

conductor referenced this pull request 2026-10-26 06:13:28 +00:00

feat(spine): runtime composition, capability absorption, and TUI Spine viewer (W4 of #2609, #2606, #2615) #2634

Some required checks failed

Hide all checks

deploy / deploy (push) Skipped

Details

CI Pipeline / unit-tests (push) Failing after 44s

Details

CI Pipeline / lint (push) Failing after 44s

Details

CI Pipeline / rust-surface (push) Failing after 14s

Details

CI Pipeline / go-surface (push) Failing after 25s

Details

CI Pipeline / best-practices (push) Successful in 2s

Details

CI Pipeline / documentation (push) Successful in 3s

Details

CI Pipeline / gitea-offline (push) Canceled after 0s

Details

CI Pipeline / required-checks (push) Canceled after 0s

Details

CI Pipeline / CI Pipeline / notify-event-bridge (push) Canceled after 0s

Details

CI Pipeline / canary (push) Canceled after 50s

Details

CI Pipeline / type-check (push) Canceled after 38s

Details

Auto-label / auto-label (pull_request) Successful in 1s

Details

Local-Model First-Pass Review (#131) / first-pass-review (pull_request) Successful in 23s

Details

Spec gate (headless) / spec-gate (pull_request) Successful in 16s

Details

CI Pipeline / lint (pull_request) Failing after 46s

Details

CI Pipeline / unit-tests (pull_request) Failing after 37s

Details

CI Pipeline / rust-surface (pull_request) Failing after 8s

Details

CI Pipeline / go-surface (pull_request) Failing after 22s

Details

CI Pipeline / best-practices (pull_request) Successful in 3s

Details

CI Pipeline / documentation (pull_request) Successful in 3s

Details

CI Pipeline / type-check (pull_request) Failing after 40s

Details

CI Pipeline / canary (pull_request) Failing after 1m3s

Details

CI Pipeline / gitea-offline (pull_request) Successful in 21s

Details

CI Pipeline / required-checks (pull_request) Failing after 1s

Required

Details

CI Pipeline / CI Pipeline / notify-event-bridge (pull_request) Failing after 7s

Details

This pull request has changes conflicting with the target branch.

• store/scaffold/segments/observations.jsonl

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/2609-go-interception-w2:feat/2609-go-interception-w2

git checkout feat/2609-go-interception-w2

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0 — critical

Spine/core correctness or blocks other work — do first

P1 — high

Material user value or real defect (money, bugs, next-stage dep)

P2 — medium

Quality/consolidation improvement

P3 — low

Measurement / benchmark / deferred policy

blocked

Dependencies open

bug

Confirmed defect or regression

custodian

epic

Rune v1 course-correction issue graph

feature

New capability or improvement

governance

growth

identity

in-progress

Currently being worked on by Rune

incomplete

Incomplete work — draft PR with ledger, awaiting resume

infrastructure

life

memory

memory-atlas

Memory Research Atlas child domain

needs-testing

Needs manual testing with dumbed-down steps before close

perception

ready

Order satisfied - Rune may start

release-drift

research

Research jobs — spikes, watchlists, evidence work

rune

rune

scaffolding

scaffolding

spine,correction

spine,correction

spine,deferred

spine,deferred

spine,resolved

spine,resolved

strangler,burn,endgame,deferred

strangler,burn,endgame,deferred

strangler,burn,endgame,inventory,epic

strangler,burn,endgame,inventory,epic

tui

tui

tui,epic

tui,epic

tui,openspec

tui,openspec

v1-course-correction

Rune v1 course-correction issue graph

No labels P0 — critical bug custodian identity infrastructure life memory perception

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

conductor

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: conductor/rune#2626