pdurlej/platform

Fork 0

feat(autonomy): write decision receipts #696

Merged

pdurlej merged 1 commit from codex/687-decision-receipts into main

2026-06-02 15:52:39 +02:00

codex commented

2026-06-02 15:24:53 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

Adds the final #687 autonomy slice: ADR-0025-aligned decision receipts for platformctl autonomy ask.

The receipt is emitted in command output and may be written append-only with --receipt-dir. It stores observable decision metadata only: action, tier, decision, reason, confidence, policy version, task id, repo, agent, and timestamp. It deliberately excludes prompt text, classifier context, raw policy-source bodies, and secrets.

Canary Context Pack

Product story

The tiered autonomy gate should be auditable after it decides. The operator and future cousins need to reconstruct why an action was allowed, sandboxed, retried, or escalated without replaying the whole transcript or storing raw prompt/context.

What changed

Added build_decision_receipt() and write_decision_receipt() in platformctl.autonomy.
Extended platformctl autonomy ask with --task-id and --receipt-dir.
Included a safe receipt payload in CLI JSON output.
Added append-only receipt tests and CLI write tests.

Why it changed

PR #689 added the cascade router, PR #694 added apply sandbox receipts, and PR #695 added the fail-closed classifier interface. This final slice connects Tier-2 decisions to the ADR-0025 memory plane without live DB wiring.

Files touched

control-plane/platformctl/autonomy.py
control-plane/platformctl/cli.py
control-plane/platformctl/tests/test_autonomy_router.py

Relevant context

state/strategy/autonomy-tiered-execution-design-2026-06-02.md
state/memory/task-run-schema.md
decisions/0025-memory-control-plane.md
Issue #687

Runtime evidence

No runtime action, no model call, no live Postgres write. Local validation:

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_autonomy_router.py → 21 passed
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py control-plane/platformctl/tests/test_autonomy_router.py → 140 passed
PYTHONPATH=control-plane python3 -m platformctl.cli validate all --json → exitCode 0

Known constraints

This writes local JSON receipts only when --receipt-dir is explicitly provided. Live ADR-0025 Postgres ingestion remains out of scope.

Explicit out-of-scope

No live DB write.
No model invocation.
No runtime apply.
No issue/comment writer.
No secret values in receipt payloads.

Requested decision

Approve if the receipt shape is sufficient for the #687 final slice and safe for repo/state memory-plane storage.

Merge blockers

Receipt contains raw prompt/context or secret-like data.
Receipt write overwrites an existing file.
CLI silently allows fail-closed decisions without emitting a receipt.

Spec sources read

state/strategy/autonomy-tiered-execution-design-2026-06-02.md — decision receipt requirement.
state/memory/task-run-schema.md — ADR-0025 task_run/task_checkpoint/event naming contract.
decisions/0025-memory-control-plane.md — memory plane invariants: no secrets, observable state only.
control-plane/platformctl/autonomy.py — classifier result and router implementation.
control-plane/platformctl/cli.py — CLI conventions.

Closes #687

Canary status: missing — fire canary 3+3 manually before merge ## Summary Adds the final #687 autonomy slice: ADR-0025-aligned decision receipts for `platformctl autonomy ask`. The receipt is emitted in command output and may be written append-only with `--receipt-dir`. It stores observable decision metadata only: action, tier, decision, reason, confidence, policy version, task id, repo, agent, and timestamp. It deliberately excludes prompt text, classifier context, raw policy-source bodies, and secrets. ## Canary Context Pack ### Product story The tiered autonomy gate should be auditable after it decides. The operator and future cousins need to reconstruct why an action was allowed, sandboxed, retried, or escalated without replaying the whole transcript or storing raw prompt/context. ### What changed - Added `build_decision_receipt()` and `write_decision_receipt()` in `platformctl.autonomy`. - Extended `platformctl autonomy ask` with `--task-id` and `--receipt-dir`. - Included a safe receipt payload in CLI JSON output. - Added append-only receipt tests and CLI write tests. ### Why it changed PR #689 added the cascade router, PR #694 added apply sandbox receipts, and PR #695 added the fail-closed classifier interface. This final slice connects Tier-2 decisions to the ADR-0025 memory plane without live DB wiring. ### Files touched - `control-plane/platformctl/autonomy.py` - `control-plane/platformctl/cli.py` - `control-plane/platformctl/tests/test_autonomy_router.py` ### Relevant context - `state/strategy/autonomy-tiered-execution-design-2026-06-02.md` - `state/memory/task-run-schema.md` - `decisions/0025-memory-control-plane.md` - Issue #687 ### Runtime evidence No runtime action, no model call, no live Postgres write. Local validation: - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_autonomy_router.py` → 21 passed - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py control-plane/platformctl/tests/test_autonomy_router.py` → 140 passed - `PYTHONPATH=control-plane python3 -m platformctl.cli validate all --json` → exitCode 0 ### Known constraints This writes local JSON receipts only when `--receipt-dir` is explicitly provided. Live ADR-0025 Postgres ingestion remains out of scope. ### Explicit out-of-scope - No live DB write. - No model invocation. - No runtime apply. - No issue/comment writer. - No secret values in receipt payloads. ### Requested decision Approve if the receipt shape is sufficient for the #687 final slice and safe for repo/state memory-plane storage. ### Merge blockers - Receipt contains raw prompt/context or secret-like data. - Receipt write overwrites an existing file. - CLI silently allows fail-closed decisions without emitting a receipt. ## Spec sources read - `state/strategy/autonomy-tiered-execution-design-2026-06-02.md` — decision receipt requirement. - `state/memory/task-run-schema.md` — ADR-0025 task_run/task_checkpoint/event naming contract. - `decisions/0025-memory-control-plane.md` — memory plane invariants: no secrets, observable state only. - `control-plane/platformctl/autonomy.py` — classifier result and router implementation. - `control-plane/platformctl/cli.py` — CLI conventions. Closes #687

codex added 1 commit

2026-06-02 15:24:53 +02:00

feat(autonomy): write decision receipts

python-ci / Python 3.11 (pull_request) Successful in 39s

Details

python-ci / Python 3.12 (pull_request) Successful in 41s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.13 (pull_request) Successful in 39s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Successful in 13s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 17s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 4m58s

Details

c0c109b4b1

codex added the

class/security-sensitive

label

2026-06-02 15:25:14 +02:00

codex commented

2026-06-02 15:33:52 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 696
Commit: bd045c30670d2044dec6d103c653439158dfb6eb
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium Receipt dict mutated after write, path field diverges from stored schema
- Evidence: control-plane/platformctl/cli.py lines 363-365: receipt dict is modified in-place with receipt["path"] = str(receipt_path) after write_decision_receipt writes it to disk. The stored JSON file lacks the 'path' field while CLI output includes
- Next: Consider building a separate output dict that extends the receipt with path metadata, rather than mutating the receipt dict post-write. This keeps the receipt schema consistent across storage and output.
low Receipt ID collision within same second for identical decisions
- Evidence: control-plane/platformctl/autonomy.py lines 440-442: receipt_id is derived from timestamp (second-precision via _utc_now().replace(microsecond=0)) and SHA256 digest of payload. Two identical decisions in the same second produce identical re
- Next: Document this as intentional idempotency behavior, or add a sequence counter / random component to receipt_id for sub-second uniqueness if concurrent writes are expected.
low Hardcoded DEFAULT_REPO may produce incorrect receipts in other contexts
- Evidence: control-plane/platformctl/autonomy.py line 177: DEFAULT_REPO = "pdurlej/platform" is hardcoded. In cli.py line 358, build_decision_receipt is called without passing repo parameter, so it always defaults to pdurlej/platform regardless of act
- Next: Add a --repo CLI option or derive repo from git remote, similar to how --task-id was added for ADR-0025 traceability.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
blocker TOCTOU race allows receipt overwrite
- Evidence: control-plane/platformctl/autonomy.py in write_decision_receipt: destination = receipt_dir / f"{receipt_id}.json"followed byif destination.exists(): raise FileExistsError(destination)and thendestination.write_text(...). Two conc
- Next: Replace the check-then-write pattern with Python's atomic exclusive creation: open(destination, 'x', encoding='utf-8') to guarantee append-only semantics under concurrency.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `696` - Commit: `bd045c30670d2044dec6d103c653439158dfb6eb` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Receipt dict mutated after write, path field diverges from stored schema - Evidence: `control-plane/platformctl/cli.py lines 363-365: receipt dict is modified in-place with receipt["path"] = str(receipt_path) after write_decision_receipt writes it to disk. The stored JSON file lacks the 'path' field while CLI output includes` - Next: Consider building a separate output dict that extends the receipt with path metadata, rather than mutating the receipt dict post-write. This keeps the receipt schema consistent across storage and output. - **`low`** Receipt ID collision within same second for identical decisions - Evidence: `control-plane/platformctl/autonomy.py lines 440-442: receipt_id is derived from timestamp (second-precision via _utc_now().replace(microsecond=0)) and SHA256 digest of payload. Two identical decisions in the same second produce identical re` - Next: Document this as intentional idempotency behavior, or add a sequence counter / random component to receipt_id for sub-second uniqueness if concurrent writes are expected. - **`low`** Hardcoded DEFAULT_REPO may produce incorrect receipts in other contexts - Evidence: `control-plane/platformctl/autonomy.py line 177: DEFAULT_REPO = "pdurlej/platform" is hardcoded. In cli.py line 358, build_decision_receipt is called without passing repo parameter, so it always defaults to pdurlej/platform regardless of act` - Next: Add a --repo CLI option or derive repo from git remote, similar to how --task-id was added for ADR-0025 traceability. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`blocker`** TOCTOU race allows receipt overwrite - Evidence: `control-plane/platformctl/autonomy.py in `write_decision_receipt`: `destination = receipt_dir / f"{receipt_id}.json"` followed by `if destination.exists(): raise FileExistsError(destination)` and then `destination.write_text(...)`. Two conc` - Next: Replace the check-then-write pattern with Python's atomic exclusive creation: `open(destination, 'x', encoding='utf-8')` to guarantee append-only semantics under concurrency. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

pdurlej approved these changes

2026-06-02 15:41:32 +02:00

pdurlej left a comment

Codex autonomous approval: PR #696 green in Forgejo Actions/Patchwarden and matches the operator-approved #687 final receipt slice. Uses temporary admin PAT only for narrow approve/merge; no issue/runtime mutation.