pdurlej/platform

Fork 0

feat(autonomy): add deterministic cascade router #689

Merged

pdurlej merged 1 commit from codex/687-cascade-router into main

2026-06-02 12:16:35 +02:00

codex commented

2026-06-02 12:12:53 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

Adds the first implementation slice for #687: a pure, deterministic autonomy cascade router in platformctl.autonomy.

This PR implements only the safety-critical routing order:

hard-stop -> Tier 3 operator gate;
allowlist/capability catalog input -> Tier 0 immediate;
sandbox-eligible -> Tier 1 sandbox;
everything else -> Tier 2 soft classifier.

The key invariant is tested: hard-stop actions never reach the classifier, even when they also look allowlisted or sandbox-eligible.

Canary Context Pack

Product story

The platform needs a low-friction autonomy gate that reduces operator interruptions without weakening irreversible safety boundaries. The router makes the hard rule structural: classifier logic is reached only after deterministic hard-stops have already been removed from the path.

What changed

Added platformctl.autonomy with AutonomyAction, AutonomyPolicy, AutonomyTier, AutonomyRoute, and route_action().
Added default hard-stop, immediate, and sandbox tag/action sets from the merged #673/#686 design.
Added a pluggable allowlisted_capabilities input so the future capability catalog can feed Tier 0 without hard dependency on #566 being merged.
Added focused tests for cascade order, allowlist behavior, sandbox routing, classifier fallback, normalization, and hard-stop invariants.

Why it changed

PR #686 landed the tiered execution gate design. #687 is the codex-ready implementation issue. This is the first PR in the four-PR train and intentionally keeps runtime, sandbox execution, model calls, and memory receipts out of scope.

Files touched

control-plane/platformctl/autonomy.py
control-plane/platformctl/tests/test_autonomy_router.py

Relevant context

#673 / PR #686 tiered execution gate design.
#687 implementation issue.
#566 capability catalog, future Tier 0 policy input.
#634 future sandbox customer.
ADR-0025 future decision receipt sink.

Runtime evidence

No runtime mutation. No Forgejo write path except this PR. No Infisical, Ollama, Docker, or live apply calls.

Known constraints

The capability catalog is not a hard file dependency in this PR. The router accepts allowlisted capabilities as policy input so a later PR can wire the catalog without changing the cascade invariant.

Explicit out-of-scope

No platformctl apply --sandbox implementation.
No classifier/model calls.
No decision receipt writes.
No live runtime apply.
No issue/comment writer beyond this PR metadata.
Does not close #687.

Requested decision

Merge if the deterministic router and tests correctly establish the cascade safety property.

Merge blockers

Any hard-stop action reaching Tier 2 classifier.
Any runtime, model, or secret access introduced in this slice.
Any hard dependency on the unmerged capability catalog PR.

Spec sources read

state/strategy/autonomy-tiered-execution-design-2026-06-02.md — source design from #673/#686.
control-plane/platformctl/apply.py — existing apply hard-stop and break-glass gate shape.
control-plane/platformctl/tests/test_apply_phase3.py — local pytest style and apply safety regression style.

Validation

UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_autonomy_router.py — failed before Python startup due local uv system-configuration panic.
PYTHONPATH=. python3 -m pytest platformctl/tests/test_autonomy_router.py — 7 passed.
PYTHONPATH=/private/tmp/platform-wt-687-cascade-router/control-plane python3 -m platformctl.cli validate all --json — exitCode 0.

Refs #687

Canary status: missing — fire canary 3+3 manually before merge ## Summary Adds the first implementation slice for #687: a pure, deterministic autonomy cascade router in `platformctl.autonomy`. This PR implements only the safety-critical routing order: 1. hard-stop -> Tier 3 operator gate; 2. allowlist/capability catalog input -> Tier 0 immediate; 3. sandbox-eligible -> Tier 1 sandbox; 4. everything else -> Tier 2 soft classifier. The key invariant is tested: hard-stop actions never reach the classifier, even when they also look allowlisted or sandbox-eligible. ## Canary Context Pack ### Product story The platform needs a low-friction autonomy gate that reduces operator interruptions without weakening irreversible safety boundaries. The router makes the hard rule structural: classifier logic is reached only after deterministic hard-stops have already been removed from the path. ### What changed - Added `platformctl.autonomy` with `AutonomyAction`, `AutonomyPolicy`, `AutonomyTier`, `AutonomyRoute`, and `route_action()`. - Added default hard-stop, immediate, and sandbox tag/action sets from the merged #673/#686 design. - Added a pluggable `allowlisted_capabilities` input so the future capability catalog can feed Tier 0 without hard dependency on #566 being merged. - Added focused tests for cascade order, allowlist behavior, sandbox routing, classifier fallback, normalization, and hard-stop invariants. ### Why it changed PR #686 landed the tiered execution gate design. #687 is the codex-ready implementation issue. This is the first PR in the four-PR train and intentionally keeps runtime, sandbox execution, model calls, and memory receipts out of scope. ### Files touched - `control-plane/platformctl/autonomy.py` - `control-plane/platformctl/tests/test_autonomy_router.py` ### Relevant context - #673 / PR #686 tiered execution gate design. - #687 implementation issue. - #566 capability catalog, future Tier 0 policy input. - #634 future sandbox customer. - ADR-0025 future decision receipt sink. ### Runtime evidence No runtime mutation. No Forgejo write path except this PR. No Infisical, Ollama, Docker, or live apply calls. ### Known constraints The capability catalog is not a hard file dependency in this PR. The router accepts allowlisted capabilities as policy input so a later PR can wire the catalog without changing the cascade invariant. ### Explicit out-of-scope - No `platformctl apply --sandbox` implementation. - No classifier/model calls. - No decision receipt writes. - No live runtime apply. - No issue/comment writer beyond this PR metadata. - Does not close #687. ### Requested decision Merge if the deterministic router and tests correctly establish the cascade safety property. ### Merge blockers - Any hard-stop action reaching Tier 2 classifier. - Any runtime, model, or secret access introduced in this slice. - Any hard dependency on the unmerged capability catalog PR. ## Spec sources read - `state/strategy/autonomy-tiered-execution-design-2026-06-02.md` — source design from #673/#686. - `control-plane/platformctl/apply.py` — existing apply hard-stop and break-glass gate shape. - `control-plane/platformctl/tests/test_apply_phase3.py` — local pytest style and apply safety regression style. ## Validation - `UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_autonomy_router.py` — failed before Python startup due local uv `system-configuration` panic. - `PYTHONPATH=. python3 -m pytest platformctl/tests/test_autonomy_router.py` — 7 passed. - `PYTHONPATH=/private/tmp/platform-wt-687-cascade-router/control-plane python3 -m platformctl.cli validate all --json` — exitCode 0. Refs #687

codex added this to the 10 - Improvements milestone

2026-06-02 12:12:53 +02:00

codex added the

risk/process

class/security-sensitive

tier/full

agent/codex

labels

2026-06-02 12:12:53 +02:00

codex added 1 commit

2026-06-02 12:12:53 +02:00

feat(autonomy): add deterministic cascade router

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

canary-required / collect-diff (pull_request) Successful in 3s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / canary (pull_request) Successful in 13s

Details

python-ci / Python 3.11 (pull_request) Successful in 38s

Details

python-ci / Python 3.12 (pull_request) Successful in 38s

Details

python-ci / Python 3.13 (pull_request) Successful in 40s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 4m4s

Details

63586b65a2

codex referenced this pull request

2026-06-02 12:13:12 +02:00

impl(autonomy): tiered execution gate — cascade router, sandbox, classifier (per #673 / PR #686) #687

pdurlej merged commit 53c7b630de into main

2026-06-02 12:16:35 +02:00

pdurlej deleted branch codex/687-cascade-router

2026-06-02 12:16:35 +02:00

pdurlej referenced this pull request from a commit

2026-06-02 12:16:35 +02:00

Merge pull request 'feat(autonomy): add deterministic cascade router' (#689) from codex/687-cascade-router into main

codex commented

2026-06-02 12:19:38 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 689
Commit: 63586b65a23073154d87dbde86589dcb02afbf77
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: NOT_OK
high from_mapping allows None/empty hard_stop sets, bypassing safety protections
- Evidence: In control-plane/platformctl/autonomy.py lines 119-125, AutonomyPolicy.from_mapping passes values through _normalized_set, which returns frozenset() for both None and empty iterables (lines 82-84). This means AutonomyPolicy.from_mapping({'h
- Next: Either validate that hard_stop_actions and hard_stop_tags are non-empty after normalization (raising ValueError if empty), or treat None as 'use defaults' rather than 'empty set'. Add tests for this edge case.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `689` - Commit: `63586b65a23073154d87dbde86589dcb02afbf77` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** from_mapping allows None/empty hard_stop sets, bypassing safety protections - Evidence: `In control-plane/platformctl/autonomy.py lines 119-125, AutonomyPolicy.from_mapping passes values through _normalized_set, which returns frozenset() for both None and empty iterables (lines 82-84). This means AutonomyPolicy.from_mapping({'h` - Next: Either validate that hard_stop_actions and hard_stop_tags are non-empty after normalization (raising ValueError if empty), or treat None as 'use defaults' rather than 'empty set'. Add tests for this edge case. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

codex referenced this pull request

2026-06-02 13:54:52 +02:00

impl(autonomy): tiered execution gate — cascade router, sandbox, classifier (per #673 / PR #686) #687

codex referenced this pull request

2026-06-02 14:47:31 +02:00

feat(autonomy): add fail-closed classifier gate #695

codex referenced this pull request

2026-06-02 15:24:53 +02:00

feat(autonomy): write decision receipts #696