feat(feedback): add repair instruction contract #161

Merged

pdurlej merged 2 commits from codex/repair-instruction-contract into main

2026-06-23 23:36:06 +02:00

pdurlej commented

2026-06-23 23:31:09 +02:00

Owner

Summary

add patchwarden.repair_instruction.v1 plus repair-instruction-check for policy-derived agent repair packets
register the new handoff in the external handoff registry and operator status/static HTML
update June vision/D28/self-usable docs so Loop 3 is now a shipped contract with live consumption still external

Safety boundary

read-only only: no jobs, comments, approvals, merges, code authorship, or external writes
exact-head checks are fail-closed through --expected-target-sha
repair packets describe blocker/action/acceptance, not implementation-specific code changes

Tests

PYTHONPATH=src:. python3 -m unittest discover -s tests (665 tests)

Closes #159

## Summary - add `patchwarden.repair_instruction.v1` plus `repair-instruction-check` for policy-derived agent repair packets - register the new handoff in the external handoff registry and operator status/static HTML - update June vision/D28/self-usable docs so Loop 3 is now a shipped contract with live consumption still external ## Safety boundary - read-only only: no jobs, comments, approvals, merges, code authorship, or external writes - exact-head checks are fail-closed through `--expected-target-sha` - repair packets describe blocker/action/acceptance, not implementation-specific code changes ## Tests - `PYTHONPATH=src:. python3 -m unittest discover -s tests` (665 tests) Closes #159

pdurlej added 1 commit

2026-06-23 23:31:09 +02:00

feat(feedback): add repair instruction contract

fallow-py / fallow-py-advisory (pull_request) Successful in 15s

Details

4d61c9ca08

ollama added 1 commit

2026-06-23 23:34:16 +02:00

docs: keep repair instruction scope within contract limit

fallow-py / fallow-py-advisory (pull_request) Successful in 15s

Details

360c384048

claude commented

2026-06-23 23:34:20 +02:00

Collaborator

🏛️ Architect review (loop) — ✅ resolves #159, safe to merge

Verified against the L3 boundary I specified in #159 (the D20/D28 line) — and it's build-time enforced, not just asserted in prose:

Policy-derived, not model-authored: output carries safety.model_authored: false + producer model_id: "deterministic"; actions are deterministic_action.kind (structured, mapped from existing blocker gate_id/blocker_code, not free text or code). The test test_policy_owned_blocker_routes_to_operator_without_code_authorship asserts model_authored is False — so the no-code-authorship line can't silently regress. ✅
Read-only / write-free: write_allowed + external_write_allowed both False; no forgejo_client / requests / subprocess / model imports; no controller/approval/merge surface touched. ✅
Head-bound + fail-closed: repair_instruction_head_missing / repair_instruction_head_mismatch via --expected-target-sha; stale-head and unsupported-schema both fail closed (tested). ✅
Registered in the handoff registry + operator status; 665 green.

This closes the highest-leverage missing loop — Loop 3 of D28. With L2 (post_merge_feedback, #156) already shipped, 2 of the 3 closing loops are now done; L1 (sandbox/web evidence, #150/#151) and the merge-actuation frontier remain per self-usable-milestone.md.

(Optional, non-blocking forward note: the model_authored=False invariant is covered by test_repair_instruction; if you ever want belt-and-suspenders, the test_d20_architectural_boundary lint could also assert the repair surface stays deterministic — but the dedicated test already guards it.) No changes requested. — claude (architect loop)

## 🏛️ Architect review (loop) — ✅ resolves #159, safe to merge Verified against the L3 boundary I specified in #159 (the D20/D28 line) — and it's **build-time enforced**, not just asserted in prose: - **Policy-derived, not model-authored**: output carries `safety.model_authored: false` + producer `model_id: "deterministic"`; actions are `deterministic_action.kind` (structured, mapped from existing blocker `gate_id`/`blocker_code`, **not** free text or code). The test `test_policy_owned_blocker_routes_to_operator_without_code_authorship` asserts `model_authored` is False — so the no-code-authorship line can't silently regress. ✅ - **Read-only / write-free**: `write_allowed` + `external_write_allowed` both False; no `forgejo_client` / `requests` / `subprocess` / model imports; no controller/approval/merge surface touched. ✅ - **Head-bound + fail-closed**: `repair_instruction_head_missing` / `repair_instruction_head_mismatch` via `--expected-target-sha`; stale-head and unsupported-schema both fail closed (tested). ✅ - Registered in the handoff registry + operator status; 665 green. This closes the highest-leverage missing loop — Loop 3 of D28. With L2 (`post_merge_feedback`, #156) already shipped, **2 of the 3 closing loops are now done**; L1 (sandbox/web evidence, #150/#151) and the merge-actuation frontier remain per `self-usable-milestone.md`. (Optional, non-blocking forward note: the `model_authored=False` invariant is covered by `test_repair_instruction`; if you ever want belt-and-suspenders, the `test_d20_architectural_boundary` lint could also assert the repair surface stays deterministic — but the dedicated test already guards it.) No changes requested. — claude (architect loop)

pdurlej commented

2026-06-23 23:35:43 +02:00

Author

Owner

Patchwarden local validation notes:

Full local suite: PYTHONPATH=src:. python3 -m unittest discover -s tests -> 665 tests OK.
Forgejo commit status for head 360c384048e7243ad7389dc07c3c83eb3db2ce21: success.
Local contract-pr dry run blocks on governance_tier_path because this PR intentionally touches Patchwarden governance/status/schema surfaces.
Dogfood repair-instruction-check on that blocked artifact emits verdict=ready with next_agent_action.mode=operator_required, which is the expected outcome for this policy-owned class.

Scope is aligned with #159 and the operator-approved Patchwarden vision work.

Patchwarden local validation notes: - Full local suite: `PYTHONPATH=src:. python3 -m unittest discover -s tests` -> 665 tests OK. - Forgejo commit status for head `360c384048e7243ad7389dc07c3c83eb3db2ce21`: success. - Local `contract-pr` dry run blocks on `governance_tier_path` because this PR intentionally touches Patchwarden governance/status/schema surfaces. - Dogfood `repair-instruction-check` on that blocked artifact emits `verdict=ready` with `next_agent_action.mode=operator_required`, which is the expected outcome for this policy-owned class. Scope is aligned with #159 and the operator-approved Patchwarden vision work.

pdurlej merged commit dc9fa8be21 into main

2026-06-23 23:36:06 +02:00

pdurlej deleted branch codex/repair-instruction-contract

2026-06-23 23:36:06 +02:00

pdurlej referenced this pull request from a commit

2026-06-23 23:36:07 +02:00

Merge pull request #161 from codex/repair-instruction-contract

claude referenced this pull request

2026-06-24 00:19:41 +02:00

feat(evidence): add web smoke contract #163