pdurlej/platform

Fork 0

docs(prompts): tooling-smoke-sh-rewrite master prompt for Codex #50

Merged

pdurlej merged 2 commits from claude/orders/codex-smoke-sh-rewrite-prompt into main

2026-05-04 01:40:00 +02:00

claude commented

2026-05-04 01:03:40 +02:00

Collaborator

Canary status: missing — fire canary 3+3 before merge (or operator_override per Rule 2 if direction is clear)

Summary

Master prompt for Codex to rewrite tests/smoke.sh fixing PR #40 v1 canary findings (4 NOT_OK + 3 HIGH risks).

Per operator decision 2026-05-04: "codex jest demonem prędkości, dowiezie w kilkadziesiąt minut" — Codex master-prompt route preferred over orchestrator-direct rewrite.

Canary Context Pack

Product story

tests/smoke.sh is the only continuous quality signal we have for Phase 02 v2 modules (drift detection between image_observed and live registry digest). v1 (PR #40) has 4 NOT_OK from canary 3+3 — including 3 HIGH bugs that make it unreliable. This PR delivers the master prompt; Codex executes the rewrite as a separate PR (authored as codex per identity-isolation).

What changed

New file: prompts/tooling-smoke-sh-rewrite.md (307 lines)

Why it changed

Operator chose Codex-via-master-prompt route for smoke.sh rewrite (consistent with wave 3 + wave 4 patterns). Master prompt codifies the bug list + constraints so Codex can execute autonomously.

Files touched

prompts/tooling-smoke-sh-rewrite.md (new)

Relevant context

PR #40 (closed, rewrite needed): canary findings in state/reviews/PR-40/decision_packet.md
AGENTS.md (on main, PR #43 merged) — Codex reads this for identity-isolation + canary conventions
ADR 0001 + ADR 0002 (on main) — canary mandatory + hard 3-iter cap
Issue #46 — smoke.sh rewrite tracking
Master prompt convention: prompts/phase-02-wave-3.md + prompts/phase-02-wave-4.md (wave-style); this is tooling-style

Runtime evidence

N/A — this PR is a master prompt (text only). Runtime evidence will appear in the actual rewrite PR Codex opens.

Known constraints

Master prompt is doc-only (no code, no workflow change)
Per operator default 2026-05-04: minimal viable scope (no --remediate, no --cron-friendly)
Codex MUST author rewrite PR as codex (not pdurlej, not claude)
Hard 3-iter cap enforced on rewrite PR per ADR 0002 Rule 2

Explicit out-of-scope

The rewrite itself (Codex does that as separate PR)
Workflow file rewrite (separate ADR 0002 follow-up; tracked Issue #49)
Honcho Wave 4 execution (separate; PR #36 merged, awaits Codex run)
Wave 3 canary verification on PRs #37/#38/#39 (separate task)

Requested decision

approve_merge after canary 3+3 passes (or operator_override if direction is clear and content is straightforward).

Merge blockers

Canary 3+3 not yet fired (OR operator_override per Rule 2)
If reviewer cites scope creep in the prompt — iterate (within cap)

How operator triggers Codex

After this PR merges, in master operator (Codex thread):

cd ~/Developer/iskra-platform-2026-04-30
git pull
codex exec < prompts/tooling-smoke-sh-rewrite.md

Codex executes per prompt; opens rewrite PR as codex; orchestrator (claude) reports back when PR opens.

Test plan

Operator readback: prompt scope feels right (minimal viable, not creep)
Canary 3+3 fires (or operator override rationale clear)
After merge: Codex runs prompt, opens rewrite PR
Rewrite PR has Canary status line per ADR 0001 Rule 1a
Rewrite PR authored as codex (verify Forgejo user.login field)
Rewrite PR includes n8n-worker drift status (real or v1 false-positive)

Canary status: missing — fire canary 3+3 before merge (or operator_override per Rule 2 if direction is clear) ## Summary Master prompt for Codex to rewrite `tests/smoke.sh` fixing PR #40 v1 canary findings (4 NOT_OK + 3 HIGH risks). Per operator decision 2026-05-04: "codex jest demonem prędkości, dowiezie w kilkadziesiąt minut" — Codex master-prompt route preferred over orchestrator-direct rewrite. ## Canary Context Pack ### Product story `tests/smoke.sh` is the only continuous quality signal we have for Phase 02 v2 modules (drift detection between `image_observed` and live registry digest). v1 (PR #40) has 4 NOT_OK from canary 3+3 — including 3 HIGH bugs that make it unreliable. This PR delivers the master prompt; Codex executes the rewrite as a separate PR (authored as `codex` per identity-isolation). ### What changed - New file: `prompts/tooling-smoke-sh-rewrite.md` (307 lines) ### Why it changed Operator chose Codex-via-master-prompt route for smoke.sh rewrite (consistent with wave 3 + wave 4 patterns). Master prompt codifies the bug list + constraints so Codex can execute autonomously. ### Files touched - `prompts/tooling-smoke-sh-rewrite.md` (new) ### Relevant context - PR #40 (closed, rewrite needed): canary findings in `state/reviews/PR-40/decision_packet.md` - AGENTS.md (on main, PR #43 merged) — Codex reads this for identity-isolation + canary conventions - ADR 0001 + ADR 0002 (on main) — canary mandatory + hard 3-iter cap - Issue #46 — smoke.sh rewrite tracking - Master prompt convention: prompts/phase-02-wave-3.md + prompts/phase-02-wave-4.md (wave-style); this is tooling-style ### Runtime evidence N/A — this PR is a master prompt (text only). Runtime evidence will appear in the actual rewrite PR Codex opens. ### Known constraints - Master prompt is doc-only (no code, no workflow change) - Per operator default 2026-05-04: minimal viable scope (no --remediate, no --cron-friendly) - Codex MUST author rewrite PR as `codex` (not pdurlej, not claude) - Hard 3-iter cap enforced on rewrite PR per ADR 0002 Rule 2 ### Explicit out-of-scope - The rewrite itself (Codex does that as separate PR) - Workflow file rewrite (separate ADR 0002 follow-up; tracked Issue #49) - Honcho Wave 4 execution (separate; PR #36 merged, awaits Codex run) - Wave 3 canary verification on PRs #37/#38/#39 (separate task) ### Requested decision approve_merge after canary 3+3 passes (or operator_override if direction is clear and content is straightforward). ### Merge blockers - Canary 3+3 not yet fired (OR operator_override per Rule 2) - If reviewer cites scope creep in the prompt — iterate (within cap) ## How operator triggers Codex After this PR merges, in master operator (Codex thread): ``` cd ~/Developer/iskra-platform-2026-04-30 git pull codex exec < prompts/tooling-smoke-sh-rewrite.md ``` Codex executes per prompt; opens rewrite PR as `codex`; orchestrator (claude) reports back when PR opens. ## Test plan - [ ] Operator readback: prompt scope feels right (minimal viable, not creep) - [ ] Canary 3+3 fires (or operator override rationale clear) - [ ] After merge: Codex runs prompt, opens rewrite PR - [ ] Rewrite PR has `Canary status` line per ADR 0001 Rule 1a - [ ] Rewrite PR authored as `codex` (verify Forgejo `user.login` field) - [ ] Rewrite PR includes n8n-worker drift status (real or v1 false-positive)

claude added 1 commit

2026-05-04 01:03:40 +02:00

docs(prompts): tooling-smoke-sh-rewrite master prompt for Codex

canary-required / collect-diff (pull_request) Failing after 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

02d40dbe0f

Per operator decision 2026-05-04: smoke.sh rewrite via Codex master prompt
("codex jest demonem prędkości, dowiezie w kilkadziesiąt minut").

Codifies PR #40 v1 canary findings (4 NOT_OK + 3 HIGH risks) as bug list
Codex fixes:
1. HIGH: drift detection identifier ({{.Image}} → {{index .RepoDigests 0}})
2. HIGH: container name hardcoding (read from runbook, not pattern)
3. HIGH: Python deps fragile (recommend bash-only core + separate
   validate-schema.sh for schema validation)
4. MEDIUM: dead read_field function — remove
5. MEDIUM: JSON output unsafe escaping (printf → jq -n or python json.dumps)
6. MEDIUM: hardcoded home-platform- prefix (same root cause as #2)

Constraints:
- Authored as codex (not pdurlej, not claude) per AGENTS.md identity-isolation
- PR size: Medium (script change with runtime evidence + recovery semantics)
- Canary 3+3 required + full Canary Context Pack
- Hard 3-iter cap per ADR 0002 Rule 2
- Minimal viable scope (no --remediate, no --cron-friendly, no per-module
  hooks framework — defer to platformctl Phase 03)

Test plan: 4 target modules across 3 different container-name patterns
(home-platform-*, agaria-*, karakeep with sidecars). n8n-worker drift
status (real or false-positive from PR #40 v1) MUST be answered.

Length: ~290 lines, ~5k tokens. Fits comfortably in Codex session.

PR for this prompt itself opens as claude (orchestrator); rewrite PR
opens as codex (producer). Identity-isolation discipline preserved.

claude referenced this pull request from a commit

2026-05-04 01:11:51 +02:00

docs(prompts): tooling-canary-workflow-rewrite master prompt for Codex

claude added 1 commit

2026-05-04 01:11:51 +02:00

docs(prompts): tooling-canary-workflow-rewrite master prompt for Codex

canary-required / collect-diff (pull_request) Failing after 3s

Details

canary-required / canary (pull_request) Has been skipped

Details

eaf217ff7f

Per operator decision 2026-05-04: parallel master prompt to smoke.sh
rewrite (PR #50). Workflow live on main since PR #44 merge fired
on PR #50 and FAILED at exactly predicted point — Oracle's HIGH
finding "actions/checkout@v4 requires Node runtime; Alpine is
musl-only" confirmed live.

Codifies PR #44 v2 canary findings (BLOCKER + 4 HIGH) + PR #50 live
failure as bug list Codex fixes:
1. BLOCKER: iter counter via PR comments (not git tree; hard cap
   currently non-functional because state/reviews/ is gitignored)
2. HIGH: container alpine:3.19 → node:20-alpine (Node runtime
   needed for actions/checkout@v4)
3. HIGH: soft-skip mode when secrets absent (eliminates live red
   checks during scaffold phase; honest "not configured" state)
4. HIGH: absolute WORKSPACE paths (no .. traversal; consistent)
5. MEDIUM: env-var indirection for ${{ }} (injection-safe)
6. MEDIUM: container images SHA-pinned + actions SHA-pinned
7. MEDIUM: path classifier extracted to .forgejo/canary-paths.txt

Constraints:
- Authored as codex (not pdurlej, not claude) per AGENTS.md identity
- PR size: Large (workflow + ADR text + config file)
- Hard 3-iter cap per ADR 0002 Rule 2
- Minimal viable scope (no auto-derive scope, no auto-status, no
  branch protection setup, no multi-actor PAT rotation)
- Trust boundary preserved (2-job pattern stays; Oracle validated)
- Manual canary fire by orchestrator since the workflow this PR
  rewrites is what would normally auto-fire

Length: ~280 lines, ~5k tokens. Fits comfortably in Codex session.

Plus ADR 0002 text update in same PR (Rule 1 reflects actual
implementation; Status stays "Accepted design, NOT operational"
until operator updates post Issue #49 setup tasks + first real
test PR passes).

PR for this prompt opens as claude (orchestrator); workflow
rewrite PR opens as codex (producer). Identity-isolation preserved.

claude force-pushed claude/orders/codex-smoke-sh-rewrite-prompt from eaf217ff7f

canary-required / collect-diff (pull_request) Failing after 3s

Details

canary-required / canary (pull_request) Has been skipped

Details

to 02d40dbe0f

canary-required / collect-diff (pull_request) Failing after 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

2026-05-04 01:12:16 +02:00

Compare

claude referenced this pull request from a commit

2026-05-04 01:12:16 +02:00

docs(prompts): tooling-canary-workflow-rewrite master prompt for Codex

claude referenced this pull request

2026-05-04 01:13:05 +02:00

docs(prompts): tooling-canary-workflow-rewrite master prompt for Codex #51

claude added 1 commit

2026-05-04 01:20:42 +02:00

docs(prompts): smoke.sh rewrite — append iter 1 canary context for Codex

canary-required / collect-diff (pull_request) Failing after 3s

Details

canary-required / canary (pull_request) Has been skipped

Details

8447e0242a

Per operator instruction 2026-05-04: stop iterating on master prompts;
let Codex egzekwować with full agency. Append canary iter 1 findings as
context Codex reads + responds to in implementation, not as gates we
keep refining pre-execution.

Findings appended (5 worth Codex's attention):
1. {{index .RepoDigests 0}} hard-errors on locally-built images
   (use safe-access pattern: {{if gt (len .RepoDigests) 0}}...{{end}})
2. Internal scope contradiction (tests/ files in scope, not just smoke.sh)
3. jq dep listed if bash-only path chosen
4. Container-from-runbook convention to verify across 4 test targets
5. Meta-ratio observation (don't replicate 307:280 prompt:script)

Plus operator override framing: canary status = operator_override;
quality gate shifts from prompt review to artifact review (Codex's
PR canary). Sustainable; closes the prompt-iteration loop trap.

Authored as claude per identity-isolation.

claude commented

2026-05-04 01:22:35 +02:00

Author

Collaborator

Canary status: operator_override — per operator decision in chat 2026-05-04.

Iter 1 canary returned ELEVATED defer with 5 substantive findings (1 medium-correctness on {{index .RepoDigests 0}} empty-handling + scope contradiction + jq dep + container-from-runbook verification). Operator decision: stop iterating on master prompts, append findings as context Codex addresses during execution, ship.

See commit 8447e02 — context section appended at end of prompts/tooling-smoke-sh-rewrite.md. Codex reads it; Codex picks; Codex documents choices in resulting rewrite PR.

Quality gate shifts from prompt review to artifact review (canary on Codex's actual smoke.sh rewrite PR will catch what we missed in the prompt). Sustainable; closes the prompt-iteration loop trap.

Ready for merge.

**Canary status: operator_override** — per operator decision in chat 2026-05-04. Iter 1 canary returned ELEVATED defer with 5 substantive findings (1 medium-correctness on `{{index .RepoDigests 0}}` empty-handling + scope contradiction + jq dep + container-from-runbook verification). Operator decision: stop iterating on master prompts, append findings as context Codex addresses during execution, ship. See commit `8447e02` — context section appended at end of `prompts/tooling-smoke-sh-rewrite.md`. Codex reads it; Codex picks; Codex documents choices in resulting rewrite PR. Quality gate shifts from prompt review to **artifact review** (canary on Codex's actual smoke.sh rewrite PR will catch what we missed in the prompt). Sustainable; closes the prompt-iteration loop trap. Ready for merge.