diff --git a/.github/workflows/promote-qualified-release.yml b/.github/workflows/promote-qualified-release.yml index 888cf872cc..f74fbbe941 100644 --- a/.github/workflows/promote-qualified-release.yml +++ b/.github/workflows/promote-qualified-release.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: version: - description: "Existing DRAFT release tag qualified on luigi.home.arpa (vX.Y.Z or prerelease)" + description: "Existing DRAFT release tag qualified on the qualification host (vX.Y.Z or prerelease)" required: true type: string publish_registries: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9cab5b00cb..037aeaf111 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -476,7 +476,7 @@ jobs: # ── 8. External qualification hold ─────────────────────────── # Default release behavior stops here after CI verification. The exact draft - # bytes are then qualified on luigi.home.arpa. The promotion workflow validates + # bytes are then qualified on the qualification host. The promotion workflow validates # attached qualification evidence before registries are published or the # release is made public. qualification-hold: @@ -491,7 +491,7 @@ jobs: VERSION: ${{ inputs.version }} run: | echo "Release $VERSION is verified and remains DRAFT." - echo "Qualify the exact GitHub release bytes on luigi.home.arpa." + echo "Qualify the exact GitHub release bytes on the qualification host." echo "Attach qualification-manifest.json and qualification-summary.md to the draft." echo "Then dispatch Promote Qualified Release for the same tag." diff --git a/BACKLOG.md b/BACKLOG.md index 3840b1d2cc..44b76fe2e9 100644 --- a/BACKLOG.md +++ b/BACKLOG.md @@ -70,15 +70,15 @@ See [the canonical source audit](docs/UPSTREAM_308_CANDIDATE_AUDIT_20260912.md). - [ ] Finish independent reconciliation of the Luna team evidence. All R3 handoffs were partial; all 40 declared checksums and exact 111/170/86 assignments - were verified and archived. R4 successors continue interactively in Herdr - `wC:pB` / `wC:pC` / `wC:pD`. The 2026-10-02T23:53Z checkpoint contains 54 + were verified and archived. R4 successors continue interactively in managed terminal + `managed terminal` / `managed terminal` / `managed terminal`. The 2026-10-02T23:53Z checkpoint contains 54 non-unresolved worker claims and 313 unresolved claims; no whole-commit coverage or completion is inferred. Parent retains 356 whole non-merge / 311 merge remainders pending exact source/test review. Full hashes are in the canonical ledger; the [consolidated report](docs/UPSTREAM_RECONCILIATION_REPORT_20261002.md) records provenance, source corrections, scope and validation limits. Parallel split followup: `CBM-RECON-ADAPTER-LOW-20261003` ran Luna low in - Herdr `wC:pE` on 16 explicitly released, previously unreviewed runtime hashes; + managed terminal on 16 explicitly released, previously unreviewed runtime hashes; all 16 were source-reviewed, 8 closing as adapter-only and 8 retaining shared-semantic remainders. The consolidation auditor verified the run's 67-file manifest, confirmed every changed path is `src/mcp/**` or @@ -96,7 +96,7 @@ reports, including after persisted steering and direct follow-ups. Sessions were stopped; zero assigned comparisons or correlated worker acknowledgements were established by that failed attempt. Interactive recovery now runs Codex - `--model deepseek-flash` in Herdr `wC:pF` / `wC:pG` / `wC:pH`, with correct + `--model deepseek-flash` in managed terminal / `managed terminal` / `managed terminal`, with correct worker-issued run/cwd/count launch acknowledgements and actual process Jev-token inheritance verified. The same 115 hashes remain the comparison scope; see the canonical interactive recovery section. No completion/acceptance is inferred. @@ -237,7 +237,7 @@ completion/acceptance or semantic-closure counter advanced. Group262ab012 telemetry with3507d955 Windows OS hard cap; no runtime/acceptance credit. Canonical308 finished-batch review owns corrections. - [ ] Diagnose generic full-index pipeline failure for clean frozen worktree - `/tmp/cbm-recon-luna-medium20-20261003`; logs preserved in medium20 staging. + `local run evidence`; logs preserved in medium20 staging. Worker safely uses verified existing runtime graph; no daemon changes made. - [x] Review resumed DeepSeek pilot20 submission; four bounded source dispositions @@ -271,7 +271,7 @@ Native Windows qualification and fresh Jenkins51 result remain separate. ## External Luna worker CLI cache resolution — 2026-10-05 -- [ ] Investigate `codebase-memory-cli: secure CLI coordination could not be created (cache-resolve)` in prepared external Herdr workers. Observed on `cbm status --project ttm-jenkins-repair-20261005 --json` / exact-project status/projects probes in Tax Machine runs `ttm-jenkins-repair-20261005` and `ttm-jenkins-verify-20261005`; installed parent CLI reports `dev`. Both exact worktrees under `/home/nate/.local/share/agent-workflow/worktrees/the-tax-machine/jenkins-{repair,verify}-20261005` were fully indexed with persistence false, ready at 2026-10-05T14:27:42/43Z, source `efa9b0a1971ec6d9a33457401ddeb337c1eeea3b`, and unchanged empty Git porcelain. Parent status/projects succeed; worker calls fail before graph query despite launch args approval never / danger-full-access. Expected workers to access those ready graphs. Runtime/environment cause remains unproven. Workers preserve unchanged porcelain and use exact source/config fallback; issue remains open. Durable evidence: `/home/nate/.local/state/agent-workflow/runs/ttm-jenkins-verify-20261005/output.log` and both runs' `evidence/launch-preflight/`. Do not reset the shared daemon or widen allow-roots as a workaround. Reproduced 2026-11-01 in AW-owned headless Luna runs `cbm-sync-{security,ci,13a}-20261101` on clean isolated CLI worktrees at `ff8b8906`; all full persistence-disabled parent preflights were ready, with 63,168 nodes, 142 parse-partial files and no porcelain changes. Parent projects/status succeed; workers fail projects/status before query, despite danger-full-access in recorded launch. Exact runtime cause remains unproven. Receipts: each run owns `evidence/launch-preflight/`; worker failures are in `output.log` and `executor-events.jsonl`. Source fallback used; no shared daemon reset, cache-root switch or widened authorization. +- [ ] Investigate `codebase-memory-cli: secure CLI coordination could not be created (cache-resolve)` in prepared external managed terminal workers. Observed on `cbm status --project ttm-jenkins-repair-20261005 --json` / exact-project status/projects probes in Tax Machine runs `ttm-jenkins-repair-20261005` and `ttm-jenkins-verify-20261005`; installed parent CLI reports `dev`. Both exact worktrees under `local run evidence` were fully indexed with persistence false, ready at 2026-10-05T14:27:42/43Z, source `efa9b0a1971ec6d9a33457401ddeb337c1eeea3b`, and unchanged empty Git porcelain. Parent status/projects succeed; worker calls fail before graph query despite launch args approval never / danger-full-access. Expected workers to access those ready graphs. Runtime/environment cause remains unproven. Workers preserve unchanged porcelain and use exact source/config fallback; issue remains open. Durable evidence: `local run evidence` and both runs' `evidence/launch-preflight/`. Do not reset the shared daemon or widen allow-roots as a workaround. Reproduced 2026-11-01 in AW-owned headless Luna runs `cbm-sync-{security,ci,13a}-20261101` on clean isolated CLI worktrees at `ff8b8906`; all full persistence-disabled parent preflights were ready, with 63,168 nodes, 142 parse-partial files and no porcelain changes. Parent projects/status succeed; workers fail projects/status before query, despite danger-full-access in recorded launch. Exact runtime cause remains unproven. Receipts: each run owns `evidence/launch-preflight/`; worker failures are in `output.log` and `executor-events.jsonl`. Source fallback used; no shared daemon reset, cache-root switch or widened authorization. - [ ] Isolate diff-scoped clang-tidy diagnostics outside selected hunks. In `cbm-sync-13a-20261101`, `make -f Makefile.cbm lint-tidy-diff` with clang-tidy-22 diff --git a/MEMLAB_ANALYSIS_AND_RUN_REPORT_2026-09-05.md b/MEMLAB_ANALYSIS_AND_RUN_REPORT_2026-09-05.md deleted file mode 100644 index efca1d429a..0000000000 --- a/MEMLAB_ANALYSIS_AND_RUN_REPORT_2026-09-05.md +++ /dev/null @@ -1,141 +0,0 @@ -# Memlab Analysis and Build/Test Run Report - -Date: 2026-09-05 -Repository: `codebase-memory-cli` -Branch: `release-tooling` -Source state: CP72 overlay applied on the working tree; repository baseline -reported by the overlay is `4f0d7b9`. - -## Executive result - -The clean production build passed. The canonical full test leg did not reach -test execution because it hung in the venue-parity preflight. Memory analysis -completed its static scan and debug build, but the dynamic run was non-green: -Heaptrack reported 85 leaked allocations and the analyzed test runner had -three daemon IPC failures. Valgrind reported no lost memory, with only -still-reachable allocations. - -## Build run - -Command: - -```text -scripts/build.sh -``` - -Result: PASS (exit 0). - -The clean production binary was built at: - -```text -build/c/codebase-memory-cli -``` - -The build used GCC on Linux x86_64 and completed the full production object -and link step after CP72 changes. - -## Canonical full test run - -Command: - -```text -scripts/test.sh -``` - -Result: BLOCKED before suite execution. - -Passed preflight checks included build-directory safety, Windows VM worktree -manifest, UI proxy security, daemon soak recovery, Windows bundle, tree-sitter -dependencies, security fuzz self-test, smoke fixture, parallel scheduler, and -venue parity checks. - -The run then stalled in the venue-parity check while invoking: - -```text -scripts/ci/generate-sbom.py --help -``` - -The child process stopped at `import datetime`, consistent with the existing -shell-versus-Python invocation defect. The stalled process was terminated; -the canonical sanitizer build and full suite were therefore not reached. - -## Memory analysis run - -Command: - -```text -scripts/analyze-memory.sh -``` - -Suites: - -```text -daemon_application daemon_ipc -``` - -Results directory: - -```text -memlab-memory-analysis/20260905-170357-91427 -``` - -### scan-build - -Result: PASS. No findings were reported in the targeted sources: - -- `src/operations/session_state.c` -- `src/operations/store_host.c` -- `src/operations/mutation.c` -- `src/daemon/application.c` - -### Plain debug build - -Result: PASS. The dedicated test runner linked successfully in the temporary -memory-analysis build directory. - -### Heaptrack - -Result: FAIL under the script's leak policy. - -- Allocations: 35,173 -- Leaked allocations: 85 -- Temporary allocations: 1,174 -- Total memory leaked in the Heaptrack analysis: 8.53 KiB - -The complete capture and analysis are included in `heaptrack.zst`, -`heaptrack.analysis`, and the corresponding stdout/stderr files. - -### Valgrind Memcheck - -Result: FAIL as a test-runner result, not as a lost-memory result. - -The runner reported 84 passed and 3 failed tests. The failures were: - -- `daemon_ipc_posix_startup_lock_is_cross_process` -- `daemon_ipc_posix_lifetime_reservation_rejects_fork_inheritance` -- `daemon_ipc_posix_child_participant_handoff_retains_legacy_bridge` - -Leak summary: - -- Definitely lost: 0 bytes -- Indirectly lost: 0 bytes -- Possibly lost: 0 bytes -- Still reachable: 2,816 bytes in 16 blocks -- Valgrind error contexts: 0 - -The complete Memcheck log is `valgrind.log`. - -## Qualification state - -This evidence does not establish a green full-suite or leak-free release -state. The next useful work is to fix the venue-parity Python invocation, -classify the three daemon IPC failures, and attribute Heaptrack's 85 retained -allocations before adding teardown code. - -## Included files - -This report is packaged with the complete run directory, including: - -- Heaptrack compressed capture and analysis; -- Heaptrack stdout/stderr; -- Valgrind log and stdout/stderr. diff --git a/README.md b/README.md index e02f87d8d4..16d3303094 100644 --- a/README.md +++ b/README.md @@ -332,7 +332,7 @@ See [`SECURITY.md`](SECURITY.md) and [`docs/SECURITY-DISCLOSURE.md`](docs/SECURI ## Migration documents -- [`docs/CLI_MIGRATION_STATUS.md`](docs/CLI_MIGRATION_STATUS.md) — current port and qualification status. +- [`docs/internal/CLI_MIGRATION_STATUS.md`](docs/internal/CLI_MIGRATION_STATUS.md) — current port and qualification status. - [`docs/RELEASE_QUALIFICATION_PLAN.md`](docs/RELEASE_QUALIFICATION_PLAN.md) — build, platform, benchmark, and release gates. - [`docs/CLI_ONLY_MIGRATION_PLAN.md`](docs/CLI_ONLY_MIGRATION_PLAN.md) — historical rationale and scope of the MCP removal. diff --git a/SESSION_HANDOFF.md b/SESSION_HANDOFF.md deleted file mode 100644 index 25e163e8ee..0000000000 --- a/SESSION_HANDOFF.md +++ /dev/null @@ -1,43 +0,0 @@ -# Developer Handoff - -Date: 2026-09-03 - -## Repository - -- Local path: `/lump/apps/codebase-memory-cli` -- Branch: `release-tooling` -- HEAD: `fae6ff45` (`docs: deprecate MCP-dependent tests`) -- Fork: `https://github.com/ngallodev/codebase-memory-cli` - -## Completed - -- Applied the cumulative `codebase-memory-cli-production-mcp-unlinked` overlay. -- Production `MCP_SRCS` is empty; neutral JSON arguments, result wire, - operation catalog, index admission, session state, and store host own the - production paths. -- Deleted the daemon MCP frontend, its test, and MCP index-supervisor sources. -- Preserved focused incremental local build rules and neutral session teardown. -- Added `scripts/analyze-memory.sh` and maintained `BACKLOG.md`. -- Marked all detected MCP-dependent test and repro sources deprecated in - `tests/DEPRECATED_MCP_TESTS.md`. - -## Validation - -- `scripts/build-dev.sh`: passed; production binary linked without MCP. -- `scripts/test.sh --suites daemon_application,daemon_ipc`: blocked at the - test-runner link because legacy MCP-dependent tests and repro harnesses still - reference `cbm_mcp_*` while `MCP_SRCS` is empty. These remnants are outside - the CLI test scope and are recorded in `BACKLOG.md`. -- `git diff --check`: passed before commit. - -## Working-tree policy - -- The overlay archives and `.codebase-memory/` are intentionally untracked and - preserved; they are not included in the source handoff archive. -- No push was performed. - -## Next work - -1. Retire or migrate the remaining MCP-dependent test/repro source lists. -2. Classify residual neutral daemon Heaptrack allocations in `BACKLOG.md`. -3. Complete native Windows release evidence and full phase-end CI validation. diff --git a/docs/CLI_FIRST_VERTICAL_SLICE_IMPLEMENTATION_PLAN.md b/docs/CLI_FIRST_VERTICAL_SLICE_IMPLEMENTATION_PLAN.md deleted file mode 100644 index 68fc36a33e..0000000000 --- a/docs/CLI_FIRST_VERTICAL_SLICE_IMPLEMENTATION_PLAN.md +++ /dev/null @@ -1,647 +0,0 @@ -# Codebase Memory CLI-First Migration — First Vertical Slice Implementation Plan - -Status: implementation plan and pre-implementation critical review -Date: 2026-09-01 -Authoritative source: `codebase-memory-mcp-cli-only-handoff-17786374.tar.zst` - -## 1. Objective - -Deliver the first usable CLI-first vertical slice without rewriting the graph engine. - -At the end of this slice: - -- normal product invocation is CLI-only; -- running the binary with no command does **not** start JSON-RPC/MCP or a daemon-backed MCP session; -- the primary exploration loop is available as ordinary named commands; -- machine-readable output remains available; -- skills teach the named CLI, not MCP tools; -- supported hooks continue to provide useful discovery/coverage context while pointing agents at the CLI; -- installers stop creating new MCP server registrations for the integrations touched by the slice; -- legacy `cli ` remains only as a temporary compatibility/parity surface; -- the internal MCP dispatcher may remain temporarily as a private execution kernel for unmigrated business logic, but there is no supported MCP server surface. - -This slice intentionally separates **external MCP disablement** from the larger follow-on job of extracting every tool handler out of `src/mcp/mcp.c`. - -## 2. Why this boundary - -The current code couples three different concerns: - -1. JSON-RPC/MCP transport and session behavior; -2. tool metadata/schema/argument parsing; -3. graph/index business logic. - -The CLI, hook augmenter, daemon application, generated client adapters, and installer all depend on pieces currently named `mcp`. -Attempting to physically delete `src/mcp` in the first slice would therefore require a broad horizontal rewrite before the user receives any useful CLI product. - -The first slice instead makes the **product contract** CLI-first now, then leaves a clearly documented private compatibility kernel to extract in subsequent slices. - -## 3. User-visible vertical slice - -### 3.1 Canonical commands - -The first slice exposes: - -```text -codebase-memory-cli index [PATH] [options] -codebase-memory-cli status [options] -codebase-memory-cli search [QUERY] [options] -codebase-memory-cli trace [options] -codebase-memory-cli snippet [options] -codebase-memory-cli coverage [PATH] [options] -codebase-memory-cli projects [options] -``` - -The binary name remains `codebase-memory-mcp` during this slice to avoid coupling functional migration to packaging/rename work. A later phase renames it to `codebase-memory` with `cbm` as an optional alias. - -### 3.2 Compatibility commands - -The existing form remains temporarily: - -```text -codebase-memory-cli cli ... -``` - -It is not shown as the recommended interface. It exists for parity, old scripts, generated adapters not yet migrated, and characterization during extraction. - -### 3.3 Command mapping - -| CLI | Existing operation | -|---|---| -| `index` | `index_repository` | -| `status` | `index_status` | -| `search` | `search_graph` | -| `trace` | `trace_path` | -| `snippet` | `get_code_snippet` | -| `coverage` | `check_index_coverage` | -| `projects` | `list_projects` | - -Aliases are declared centrally rather than implemented as separate business logic. - -## 4. Agent and human interface contract - -### 4.1 Humans - -Interactive/default output stays readable. Help shows examples and maps ordinary nouns/verbs to behavior. Errors go to stderr and return non-zero. - -### 4.2 Agents - -Every canonical command accepts `--json`. JSON stdout must contain no progress prose. Progress/diagnostics remain on stderr. - -Agents should be able to discover the product with: - -```text -codebase-memory-cli --help -codebase-memory-cli search --help -codebase-memory-cli projects --json -``` - -### 4.3 Positional convenience - -Named commands add only thin positional sugar: - -- `index PATH` -> `--repo-path PATH` -- `search QUERY` -> a safe name-pattern query suitable for ordinary discovery -- `trace SYMBOL` -> `--function SYMBOL` -- `snippet SYMBOL` -> `--qualified-name SYMBOL` -- `coverage PATH` -> `--path PATH` - -Explicit flags remain available and authoritative. Positional sugar must not create a second schema. - -## 5. Phase plan through Vertical Slice 1 - -## Phase 0 — Baseline and migration guardrails - -### Purpose - -Record what is being changed and prevent accidental engine/security simplification. - -### Work - -1. Preserve the archive untouched as the source baseline. -2. Add this implementation plan and decision ledger. -3. Inventory every path that can currently start MCP: - - default process role; - - daemon MCP frontend; - - installer-created MCP configs; - - generated client adapters; - - docs/help/examples. -4. Record mechanisms that must survive: - - project mutation locks; - - version-cohort admission; - - secure runtime/cache validation; - - indexing worker supervision; - - cancellation/maintenance observation; - - allowed-root human authorization; - - hook fail-open behavior; - - existing graph/index format compatibility. -5. Do not change the graph parser, store, Cypher engine, extraction pipeline, or index format. - -### Exit - -The plan and guardrails exist in-tree and all first-slice product entry points are identified. - -## Phase 1 — Make process startup CLI-first - -### Purpose - -Remove the externally reachable/default MCP server behavior before adding convenience commands. - -### Work - -1. Change process-role classification so an invocation with no product command is not an MCP client. -2. Make no-argument invocation print top-level CLI help and exit successfully. -3. Ensure unknown top-level commands fail with an actionable CLI error instead of falling into MCP startup. -4. Keep hidden daemon/worker roles only for implementation mechanisms still required by the first slice. -5. Keep `daemon` as an internal/compatibility lifecycle mechanism only if existing named CLI execution still needs it; do not advertise it as a primary product workflow. -6. Update help so MCP server startup, `--tool-profile`, prompts, and MCP-client language are not presented as product features. - -### Exit - -There is no supported argv shape where “normal usage” enters the MCP JSON-RPC frontend. - -## Phase 2 — Add the canonical named CLI surface - -### Purpose - -Make the product useful without requiring agents/humans to know MCP tool identifiers or JSON argument objects. - -### Work - -1. Add a small command descriptor table containing: - - canonical command; - - underlying compatibility operation ID; - - short description; - - positional argument mapping; - - whether command mutates/indexes; - - examples. -2. Route the seven first-slice commands to the existing one-shot execution path. -3. Reuse current schema-derived flag parsing/help to avoid a parallel parser. -4. Teach `run_cli` whether it is operating under: - - legacy `cli ` mode; or - - canonical named-command mode. -5. Preserve `--json`, `--progress`, `--args-file`, and schema-driven flags. -6. Improve command-specific usage without changing underlying operation semantics. -7. Keep raw JSON accepted only on the legacy compatibility form. - -### Exit - -All seven canonical commands work through ordinary argv and expose useful `--help`. - -## Phase 3 — Reframe skills around the CLI - -### Purpose - -Make agents use Codebase Memory as a shell capability instead of an MCP capability. - -### Work - -1. Update the canonical generated `SKILL.md` content: - - replace MCP/tool-call wording with shell command examples; - - preserve Scout / Verify / Auditor tiers; - - preserve graph-first discovery; - - preserve exact source verification; - - preserve trace direction discipline; - - preserve pagination discipline; - - preserve coverage verification and direct-source fallback. -2. Rewrite tiered agent/subagent profile text to reference named commands. -3. Keep the skill focused on *when and how* to use Codebase Memory; do not turn it into a CLI manual. -4. Ensure examples use `--json` when machine parsing matters and ordinary text when an agent simply needs concise evidence. - -### Exit - -A newly generated skill contains no instruction telling the agent to call MCP tools or open an MCP session. - -## Phase 4 — Preserve useful hooks, remove MCP assumptions from their user contract - -### Purpose - -Keep the agent ergonomics that add value without treating hooks as an MCP transport. - -### Work - -1. Preserve search augmentation and post-read coverage warnings. -2. Preserve fail-open and time-budget behavior. -3. Update lifecycle/reminder text to point at canonical CLI commands. -4. Remove notices that tell users to “open an MCP session”. -5. Do **not** broadly rewrite `hook_augment.c` in this slice: it currently calls the private compatibility dispatcher directly, and extracting it is part of the next internal-kernel slice. -6. Ensure hook installation can stand on its own as a CLI/skill integration. - -### Exit - -Hooks remain useful and no longer teach or require an externally reachable MCP product surface. - -## Phase 5 — Stop creating new MCP registrations - -### Purpose - -Prevent a CLI-first installation from re-enabling the old product contract in coding-agent configuration. - -### Work - -1. Change default agent configuration so it installs only CLI-oriented assets that are safe/useful: - - skills/instructions; - - supported hooks; - - tiered agent profiles where they add value. -2. Do not write new `mcpServers`, `mcp_servers`, or equivalent registrations. -3. Preserve MCP removal code temporarily so uninstall/migration can clean entries owned by older Codebase Memory installations. -4. Generated adapters that exist solely to create MCP-like tool registrations are not installed by default in this slice. -5. Installation plan output should describe skill/hook/CLI integration rather than MCP registration. - -### Exit - -A clean first-slice install creates no new MCP server configuration. - -## Phase 6 — First-slice docs and executable acceptance - -### Purpose - -Close the loop and prove the new public contract. - -### Work - -1. Update README quick start to CLI-first. -2. Mark MCP as disabled/legacy migration internals where references must temporarily remain. -3. Add/adjust focused CLI acceptance checks for: - - no-arg help; - - unknown command error; - - command help; - - canonical-to-operation mapping; - - `--json` stdout cleanliness; - - no default MCP startup; - - installed skill wording; - - no new MCP registration in a clean install plan/configuration path. -4. Run the normal build plus a narrow high-value E2E path only after implementation is assembled. - -### Vertical Slice 1 user story - -From a repository: - -```text -codebase-memory-cli index . -codebase-memory-cli status -codebase-memory-cli search ClaimValidator -codebase-memory-cli snippet ClaimValidator.validate -codebase-memory-cli trace ClaimValidator.validate --direction both -codebase-memory-cli coverage src/Claims/ClaimValidator.cs -``` - -An agent can learn the same flow from the installed skill, and useful hooks can augment searches/reads without asking the user to start MCP. - -## 6. Critical review before implementation - -The following review changes the earlier, more ambitious proposal. - -### 6.1 Risk: confusing “MCP disabled” with “MCP code deleted” - -The first proposal made “no migrated command calls `cbm_mcp_handle_tool()`” an exit criterion for the first vertical slice. In this source tree that turns the first slice into a broad internal rewrite because search, trace, snippet, coverage, hooks, schema/help, worker supervision, and daemon request state all share MCP-named structures. - -**Decision:** Vertical Slice 1 disables the MCP *product surface* and establishes the canonical CLI. Physical extraction of the private dispatcher is Vertical Slice 2. The temporary dependency is documented, fenced, and not presented as a finished architecture. - -### 6.2 Risk: deleting daemon/coordination too early - -The archive's initial CLI-only note proposes removing the daemon. Current source shows the daemon family also owns exact-build coordination, index-worker budgeting/coalescing, watcher lifecycle, and safe mutation behavior. - -**Decision:** Do not delete daemon/coordination in Slice 1. Remove its role as the public MCP product mechanism first. Later distinguish protocol-neutral runtime coordination from optional long-lived services. - -### 6.3 Risk: hooks become slower if they shell out recursively - -Rewriting `hook-augment` to spawn the CLI for every graph query would add process startup, identity hashing, coordination, and potentially recursion to a latency-sensitive fail-open path. - -**Decision:** Keep in-process private dispatch inside hooks for this slice. Change the hook's *contract and guidance* now; extract its execution dependency only after a protocol-neutral operation API exists. - -### 6.4 Risk: duplicate CLI schemas - -A hand-built getopt implementation for seven commands would immediately drift from the existing registry and tool schemas. - -**Decision:** Named commands remain thin aliases over the existing schema parser during Slice 1. The operation registry replaces MCP metadata in Slice 2/3. - -### 6.5 Risk: search positional sugar changes semantics - -`search_graph` accepts many filters and a regex-like `name_pattern`; blindly inserting raw user input into that field can change regex semantics or produce unexpected results. - -**Decision:** positional `search QUERY` must escape literal input into the existing pattern contract, while advanced callers may still provide explicit flags. If safe escaping cannot be implemented without changing semantics, require `--name-pattern` in the first checkpoint and add literal positional search in a subsequent checkpoint. - -### 6.6 Risk: installer cleanup destroys user-owned configuration - -Stopping new MCP installs is safe; deleting all old MCP config on update is not. Config files may contain user changes or foreign server entries. - -**Decision:** Slice 1 stops adding registrations. Existing ownership-aware removal functions stay for uninstall/migration and continue preserving modified/foreign entries. - -### 6.7 Risk: renaming the binary multiplies the migration - -Renaming `codebase-memory-mcp` affects installer targets, updater, hooks, skills, scripts, release metadata, process identity, and potentially external package managers. - -**Decision:** do not rename the executable in Slice 1. Functional CLI-first behavior lands first. Rename is a later release phase. - -### 6.8 Risk: claiming protocol neutrality too early - -A new `operations/` wrapper that simply calls `cbm_mcp_handle_tool()` would make dependency diagrams look cleaner without changing the dependency. - -**Decision:** do not add a fake operation layer in Slice 1. Keep the temporary compatibility call explicit so it is easy to find and remove. The real operation layer begins only when handlers/results stop depending on MCP types/envelopes. - -## 7. Implementation checkpoints - -Work is checkpointed cumulatively from the authoritative archive. Each overlay must be: - -- self-applying; -- deletion-aware; -- repository-context validated; -- path-safe (no absolute paths or `..` deletion entries); -- cumulative so the latest checkpoint can be applied directly to the authoritative archive. - -Expected checkpoints: - -1. **CP1 — CLI startup + named command skeleton** - - no default MCP startup; - - named command dispatch table; - - top-level help revised. -2. **CP2 — complete first-slice named command ergonomics** - - positional mappings where safe; - - machine/human output behavior retained; - - command-specific help/examples. -3. **CP3 — skills and hook guidance** - - generated skill/profile text rewritten; - - lifecycle notices rewritten; - - useful hook behavior retained. -4. **CP4 — install surface disables new MCP registration** - - default config path installs CLI-oriented integrations only; - - ownership-aware legacy removal preserved. -5. **CP5 — docs + focused acceptance fixes** - - README/docs aligned; - - build and high-value E2E acceptance completed; - - final first-slice overlay. - -Checkpoint numbering may compress or expand based on what the source reveals, but no implementation interval should exceed the requested checkpoint cadence without emitting an overlay first. - -### Checkpoint status - -- CP1 complete: CLI startup + named command skeleton. -- CP2 complete: canonical help + MCP-envelope-free canonical JSON output. -- CP3 complete: CLI-first skill, agent guidance, and lifecycle hook messaging. -- CP4 complete: new install paths are gated against MCP config/profile/adapter creation while ownership-aware legacy cleanup remains compiled. -- CP5 partially complete: primary docs/setup surfaces are CLI-first and executable acceptance exposed a canonical read-path hang. -- CP6 complete: local-read/product-rename boundary established. -- CP7 complete: canonical stdin deadlock resolved and canonical read loop verified. -- CP8 complete: product/distribution rename and Windows build contract migrated. -- CP9 complete: active release containers are CLI-only; MCPB production/publication removed. -- CP10 complete: Windows source-build path is native MSYS2 Clang and produces `codebase-memory-cli.exe`. -- CP11 complete: final product-surface audit and focused compile/link/install checks passed. -- CP12 complete: fresh cold-repository E2E and generated Claude/Gemini/Aider integration fixtures passed; Vertical Slice 1 is closed. - -## 8. Deferred immediately after Vertical Slice 1 - -The next vertical slice begins the architectural extraction: - -```text -CLI / hooks / runtime - | - v -protocol-neutral operation registry + context + result - | - v -engine -``` - -Its first targets should be `list_projects`, `index_status`, `check_index_coverage`, then `search_graph`, because those are heavily used by both the CLI and hooks and create a real seam quickly. - -Only after that seam exists should we: - -- move index supervision out of `src/mcp`; -- convert daemon `REQUEST_MCP` / `REQUEST_TOOL` into `REQUEST_OPERATION`; -- delete `daemon/frontend.*`; -- remove JSON-RPC/MCP schemas/prompts/tool profiles; -- delete `src/mcp`; -- retire legacy `cli `; -- finish distribution/package migration after the product binary has been renamed in Vertical Slice 1. - -## 9. Definition of done for Vertical Slice 1 - -The slice is complete when all are true: - -1. No-argument invocation prints CLI help and does not start MCP. -2. Unknown top-level commands fail as CLI errors and do not fall into MCP. -3. `index`, `status`, `search`, `trace`, `snippet`, `coverage`, and `projects` are canonical named commands. -4. `--json` remains script/agent usable and stdout-clean. -5. Legacy `cli ` still works only as a compatibility surface. -6. Generated skill text teaches the CLI and preserves Scout/Verify/Auditor evidence discipline. -7. Hook lifecycle/search/coverage guidance no longer tells users to start or use MCP. -8. Clean installation paths touched by this slice do not create new MCP registrations. -9. Existing ownership-aware uninstall/migration code remains capable of removing old Codebase Memory MCP entries without deleting foreign/modified entries. -10. Build succeeds and the focused end-to-end CLI story succeeds. -11. No graph/index schema rewrite is required and existing indexes remain readable. -12. The remaining internal `cbm_mcp_handle_tool()` dependency is explicitly documented as temporary private compatibility debt for the next slice, not hidden behind a fake abstraction. -13. The canonical executable/build artifact is named `codebase-memory-cli` (`codebase-memory-cli.exe` on Windows). -14. Windows 10/11 x86-64 remains a supported native executable target; Windows build/release configuration must produce the renamed `.exe`, not depend on WSL. - -## 10. Caveats added during implementation — 2026-09-01 - -Two requirements were promoted into Vertical Slice 1 acceptance criteria during implementation: - -1. **Product rename now:** the user-facing application and executable are `codebase-memory-cli`. Internal `cbm_*` C symbols, `CBM_*` environment variables, cache/database locations, and persisted index formats stay unchanged in this slice so the rename does not become a storage migration. -2. **Windows is a first-class build target:** the application must compile as a native Windows 10/11 executable. The existing MinGW/Clang compatibility code, Windows UTF-8 argv handling, process/lock implementation, and Windows CI architecture are preserved. Renamed Windows release targets must emit `codebase-memory-cli.exe`. - -Implementation consequence: the current read-path hang is being fixed without POSIX-only shortcuts. Canonical one-shot reads use the existing cross-platform coordination/runtime primitives; indexing retains the supervised worker path. The Windows requirement will be checked at both source/build-configuration level and, where the local environment lacks a Windows cross-compiler, through the repository's Windows CI build recipe rather than being treated as a packaging afterthought. - -### CP6 scope in progress - -- defer creation of the legacy in-memory MCP store for canonical one-shot CLI reads; -- infer the current repository project when canonical read commands omit `--project`, while preserving explicit project selectors; -- rename the runtime/help identity and primary build target to `codebase-memory-cli`; -- validate the local-read hang fix before extending the rename across installer/release/Windows packaging surfaces. - -## 11. CP7 acceptance finding — canonical stdin deadlock resolved - -Executable acceptance identified the apparent read-path "daemon hang" as an implicit-stdin deadlock in the shared CLI parser. In non-interactive environments, stdin can be an open pipe with no writer/EOF. Canonical commands whose legacy tool schema had optional properties (`projects`, `status`, and similar forms) therefore entered `cli_slurp_stream()` and waited indefinitely before dispatch. - -Resolution: - -- canonical named commands do **not** read stdin implicitly; -- canonical machine callers use flags or `--args-file`; -- legacy `cli ` retains the historical piped-JSON channel during migration; -- canonical one-shot reads use deferred store initialization and infer the current-repository project when no explicit project selector is supplied. - -Verified with the renamed acceptance executable against an isolated indexed C repository: - -```text -codebase-memory-cli projects --json PASS -codebase-memory-cli status --json PASS -codebase-memory-cli search helper --json PASS -codebase-memory-cli snippet helper --json PASS -codebase-memory-cli trace helper --direction both --json PASS -codebase-memory-cli coverage main.c --json PASS -``` - -The next checkpoint carries the product rename through install/setup/release artifacts and the native Windows build configuration. - -## 12. CP8 checkpoint — product/distribution rename and Windows build contract - -The first distribution pass now treats `codebase-memory-cli` as the product artifact while retaining the current repository URL and legacy MCP/storage identifiers where they are needed for compatibility or cleanup. - -Changed in this checkpoint: - -- the primary Makefile target remains `build/c/codebase-memory-cli`; -- Unix and Windows setup/install scripts install `codebase-memory-cli` / `codebase-memory-cli.exe` and request release archives named `codebase-memory-cli-...`; -- Nix installs and exposes `codebase-memory-cli` as the main program; -- Windows x86-64 (`CLANG64` on `windows-latest`) and Windows ARM64 (`CLANGARM64` on `windows-11-arm`) build jobs now stage `build/c/codebase-memory-cli.exe`; -- release-candidate selection/staging expects the renamed executable; -- Windows product-surface tests point at `build/c/codebase-memory-cli.exe`; -- the legacy monolithic skill cleanup path remains `codebase-memory-mcp` intentionally so upgrades can remove historical owned state. - -Compatibility boundaries deliberately *not* renamed here: - -- GitHub repository coordinates such as `DeusData/codebase-memory-mcp`; -- `CBM_*` environment variables and internal `cbm_*` symbols; -- existing cache/database locations such as `~/.cache/codebase-memory-mcp`; -- MCP-era configuration keys/ownership markers needed to recognize and remove legacy registrations. - -Validation at this checkpoint: - -- modified shell installer/build scripts pass `bash -n`; -- the Makefile retains native `_WIN32` detection and Windows system-link dependencies (`ws2_32`, `psapi`, `shell32`, `advapi32`, `bcrypt`) with a static Windows link path; -- the CI build matrix continues to use native MSYS2 Clang toolchains for Windows x86-64 and ARM64, now targeting the renamed executable. - -Remaining rename work before Vertical Slice 1 closes: release-container/archive naming and smoke/soak workflows still contain MCP-era artifact names, and MCPB release production must be explicitly disabled rather than silently carried forward into a CLI-only release. - -## 13. CP9 checkpoint — CLI-only release containers - -The active release path no longer produces or publishes MCP bundles. Canonical release containers are now eight CLI archives named `codebase-memory-cli-.tar.gz` or `.zip`, each containing exactly the renamed executable plus LICENSE, the platform installer, and third-party notices. - -Changes include: - -- `scripts/package-release.sh` emits only CLI archives and has no MCPB builder; -- the release workflow no longer includes `*.mcpb` in checksums, signing, upload, download, or verification; -- the MCP Registry publication job is removed from the active release workflow; -- release verification expects eight archives/eight selected executables/24 non-executable runtime members rather than the former archive+MCPB matrix; -- canonical smoke/soak/PR/test workflows now reference `build/c/codebase-memory-cli[.exe]` and the new archive names; -- the all-tests driver no longer invokes the obsolete MCPB packaging/registry contract tests. - -Focused packaging acceptance used the linked CLI acceptance executable to build a Linux amd64 release archive. The archive inventory was exactly: - -```text -codebase-memory-cli -LICENSE -install.sh -THIRD_PARTY_NOTICES.md -``` - -The executable SHA-256 inside the archive matched the selected input byte-for-byte, and no `.mcpb` file was produced. - -Legacy MCP cleanup identifiers and historical test/helper files may still exist in-tree during the migration; they are no longer part of the active install or release product surface. Deleting those remaining implementation artifacts belongs to the protocol-extraction/deletion phase rather than this first vertical slice. - -## 14. CP10 checkpoint — native Windows source-build path - -The Windows source installer previously violated the Windows caveat: `setup-windows.ps1 -FromSource` built a Linux executable inside WSL. That path has been removed. - -A new `scripts/build-windows.ps1` provides an explicit native build entry point: - -- Windows x64 selects MSYS2 `CLANG64`; -- Windows ARM64 selects MSYS2 `CLANGARM64`; -- the script requires the matching native Clang and zlib libraries plus GNU make; -- it invokes `Makefile.cbm` with `SANITIZE=` and the native Windows compiler; -- it requires and executes `build\\c\\codebase-memory-cli.exe --version` before reporting success. - -`setup-windows.ps1 -FromSource` now clones/updates the source on the Windows filesystem, invokes this native build script, and installs the resulting `.exe`. It no longer presents WSL as a Windows source-build implementation. - -The current Linux execution environment does not contain a Windows SDK/MinGW sysroot, and network package bootstrap was unavailable within the bounded checkpoint interval, so this checkpoint does not falsely claim an on-box Windows link. Native proof remains represented by the repository's `windows-latest` CLANG64 and `windows-11-arm` CLANGARM64 jobs; the next native Windows runner must execute the renamed build and Windows product guards. The important product correction is complete: the supported source-build path itself now produces a Windows PE executable rather than a WSL ELF binary. - -## 15. CP11 checkpoint — final product-surface audit - -A fresh product-surface audit found and corrected two remaining usability leaks: - -- the active Aider instructions now use canonical `codebase-memory-cli status/search/trace/snippet/coverage/index/projects` commands rather than the legacy generic `cli ` form; -- current Gemini hook/session payloads now teach the same CLI-first workflow. Separate arrays containing previously released MCP hook command strings remain unchanged solely so upgrades/uninstalls can identify and remove historical owned hooks safely. - -Additional acceptance in this checkpoint: - -- all modified C translation units (`main`, CLI/profile/hook, daemon bootstrap/application, MCP compatibility dispatcher) compile under the production `-Wall -Wextra -Werror` gate; -- the acceptance executable links successfully with the cached production vendored objects and reports `codebase-memory-cli dev`; -- no-argument invocation displays CLI help; -- explicit `mcp`, `--mcp-profile`, and `--tool-profile` top-level probes fail as unknown CLI commands rather than starting an MCP server; -- the canonical `projects -> status -> search -> snippet -> trace -> coverage` loop still passes against the indexed fixture without an explicit `--project` and without MCP content envelopes; -- `install --dry-run` in an isolated HOME produces no MCP-registration language and performs no filesystem mutation; -- `install --help` is now a real human-facing help surface and explicitly states that new installs do not create MCP registrations; -- all edited GitHub workflow YAML parses successfully; -- active build/smoke/soak/workflow references no longer expect `build/c/codebase-memory-mcp[.exe]` or MCP-era canonical platform archive names. - -At this point the remaining first-slice work is closeout: run a completely fresh cold-repository index loop with the latest linked executable, audit generated skill/hook output using detected-client fixtures rather than prose/source inspection alone, and reconcile the definition-of-done/remaining-debt sections. Native Windows execution remains delegated to the repository's native Windows runner because this Linux environment has no usable Windows sysroot; the source-build and CI paths now both target the renamed native `.exe`. - -## 16. CP12 closeout — Vertical Slice 1 complete - -The final closeout reran the first-slice story from a genuinely cold repository with a private isolated HOME/cache and the latest linked `codebase-memory-cli` executable. The complete loop passed without an explicit project selector: - -```text -codebase-memory-cli index . --json PASS -codebase-memory-cli projects --json PASS -codebase-memory-cli status --json PASS -codebase-memory-cli search helper --json PASS -codebase-memory-cli snippet helper --json PASS -codebase-memory-cli trace helper --direction both --json PASS -codebase-memory-cli coverage main.c --json PASS -``` - -The index was created from scratch in this run. `projects` resolved the new project, subsequent commands automatically bound the current repository, search returned the indexed `helper` function, snippet returned its exact source, trace returned the `main -> helper` caller relation, and coverage returned current metadata for `main.c`. Canonical JSON remained free of the MCP `content` envelope. - -Generated integration output was then exercised rather than inferred from source text. In an isolated HOME with detected Claude Code, Gemini CLI, and Aider fixtures, `install -y --force --skip-binary --clients=claude,gemini,aider` produced: - -- Claude CLI-first skill plus fail-open search/read/session/subagent hooks that invoke `codebase-memory-cli`; -- Gemini CLI-first `GEMINI.md` plus BeforeTool, AfterTool coverage, and SessionStart hooks using the renamed executable; -- Aider CLI-first `CONVENTIONS.md` plus loader configuration; -- no `mcpServers`, `tools/list`, `tools/call`, MCP profile, or tool-profile registration. - -The historical `codebase-memory-mcp:start/end` comment markers remain in some owned instruction blocks intentionally. They are non-executable ownership markers used to recognize/remove prior Codebase Memory-managed content safely during upgrades and uninstall; renaming them in this slice would weaken cleanup compatibility. - -### Definition-of-done reconciliation - -All Vertical Slice 1 criteria are satisfied at the source/product-contract level: - -1. no-argument startup is CLI help; -2. unknown/MCP-only top-level probes fail as CLI commands; -3. `index`, `status`, `search`, `trace`, `snippet`, `coverage`, and `projects` are canonical commands; -4. canonical machine output is stdout-clean JSON without MCP envelopes; -5. legacy generic dispatch remains private/compatibility debt rather than the advertised interface; -6. generated skills preserve Scout/Verify/Auditor evidence discipline while teaching CLI use; -7. generated hook guidance/invocation is CLI-first and fail-open; -8. clean installs create no MCP registrations; -9. ownership-aware legacy cleanup remains intact; -10. modified C units pass the production warning gate, the acceptance executable links, and the fresh E2E loop passes; -11. existing index/store compatibility is preserved; -12. `cbm_mcp_handle_tool()` remains explicitly documented temporary internal debt for Vertical Slice 2; -13. the canonical executable and release artifact are `codebase-memory-cli` / `codebase-memory-cli.exe`; -14. Windows 10/11 is represented by a native MSYS2 Clang build path and native Windows CI/release jobs rather than WSL. - -The only proof not executable in this Linux environment is the final native PE compile/run itself because no Windows SDK/MinGW sysroot is installed. That is not being represented as locally verified. The repository's Windows build path, workflow targets, product guards, installer, and release staging all now require `codebase-memory-cli.exe`; the first native Windows runner is the authoritative execution proof. - -### Remaining architectural debt — next slice - -Vertical Slice 1 intentionally disables MCP as a product surface before deleting its internal compatibility kernel. The next slice should now extract protocol-neutral operations in this order: - -1. `list_projects`; -2. `index_status`; -3. `check_index_coverage`; -4. `search_graph`; -5. `get_code_snippet`; -6. `trace_path`; -7. remaining operations, then indexing supervision. - -The target remains: - -```text -CLI / hooks / daemon - | - v -protocol-neutral operations - | - v -engine -``` - -Only after consumers use that seam should `src/mcp`, daemon MCP request kinds/frontends, JSON-RPC framing, MCP schemas/prompts/profiles, and legacy generic `cli ` dispatch be deleted. - - -## Runtime Assurance / Concurrency Safety Track - -Added during Vertical Slice 2 in response to the concurrency risks of a CLI-first process model. The authoritative detailed plan lives in `docs/RUNTIME_ASSURANCE_PLAN.md`. - -Architectural decision: the daemon is retained as the authoritative coordinator for substantive writes. Canonical local execution is restricted by the neutral operation registry to operations marked `read_only=true`; mutating operations must route through daemon/project-lock coordination. SQLite WAL/transactions remain the final integrity layer, and BUSY/LOCKED outcomes are contention, never corruption evidence. - -Planned product surfaces are `codebase-memory-cli doctor` (fast and deep integrity/coordination verification) and `codebase-memory-cli benchmark` plus a real-process concurrency eval runner. The release gate will include same-project concurrent index requests, reader-during-write, different-project parallel writes, worker/daemon crash injection, WAL-starvation observation, and explicit proof that forced BUSY/LOCKED conditions cannot trigger quarantine/rebuild. Windows 10/11 process/file-lock behavior is part of the required matrix. diff --git a/docs/CLI_SELF_HOSTING_UX_REPORT_20260912.md b/docs/CLI_SELF_HOSTING_UX_REPORT_20260912.md deleted file mode 100644 index 8da29993f3..0000000000 --- a/docs/CLI_SELF_HOSTING_UX_REPORT_20260912.md +++ /dev/null @@ -1,98 +0,0 @@ -# CLI self-hosting usability report — 2026-09-12 - -## Scope - -Exercised the locally built `build/c/codebase-memory-cli` against this checkout. -The trial used a disposable directory outside the repository for both cache and -runtime state, with `--persistence false`; it created no new repository index -state. - -```bash -trial_dir=$(mktemp -d) -mkdir -m 700 "$trial_dir/cache" "$trial_dir/run" -export CBM_CACHE_DIR="$trial_dir/cache" -export CBM_RUNTIME_DIR="$trial_dir/run" -build/c/codebase-memory-cli index . --mode moderate \ - --name codebase-memory-cli-ux --persistence false --json -``` - -## Result summary - -| Area | Result | Notes | -|---|---|---| -| `--help` and command help | works | Clear command list and detailed option descriptions. | -| `doctor --deep --json` | works | Healthy after secure directories were pre-created; useful structured diagnosis. | -| Index | works | Moderate index completed; project appeared in `projects --json`. | -| Search | works | BM25 search returned ranked symbols with source location. | -| Architecture | works | Overview reported 20,646 nodes, 130,806 edges, a ten-language mix, and package rollups. | -| Outline, schema, snippet | works | JSON output is machine-friendly; ambiguous short names provide useful suggestions. | -| Cypher query | works | Simple node-count query returned expected rows. | -| Changes | works, with caveat | Correctly reports uncommitted files, but that can mask the previous-commit comparison. | -| Semantic search | accepts input; relevance needs work | The documented JSON-array form worked but `secure`/`endpoint` ranked unrelated cgroup tests. | - -## First-run issue and recovery - -The initial index attempt failed immediately with: - -```text -codebase-memory-cli: secure CLI coordination could not be created (endpoint) -``` - -`doctor --deep --json` also showed an absent, insecure cache directory and an -unreachable daemon. The cause was the trial configuration: the runtime and -cache parent directories did not yet exist. Creating both beforehand with mode -`0700` resolved the condition; a subsequent deep doctor was `healthy` and the -index completed. - -This is safe behavior, but the setup friction is high: a first-time user can -reasonably expect the CLI to create an owner-only directory or print the exact -recovery command in the failure itself. The current short `(endpoint)` label -does not identify the missing secure parent. - -## Discovery observations - -The core discovery loop is practical once a project name is known: - -```bash -build/c/codebase-memory-cli search --project codebase-memory-cli-ux \ - --query 'secure endpoint' --format json --limit 5 -build/c/codebase-memory-cli architecture --project codebase-memory-cli-ux --aspects overview -build/c/codebase-memory-cli outline --project codebase-memory-cli-ux --file-path src/main.c -build/c/codebase-memory-cli snippet --project codebase-memory-cli-ux \ - --qualified-name codebase-memory-cli-ux.src.main.main --include-neighbors true -``` - -`search`, `architecture`, and `outline` are easy to discover from help and -give compact, actionable output. `snippet main` deliberately refuses to guess -and supplies qualified-name choices; that is a good safety/usability tradeoff. -The `--project` flag is marked required in help even though its introductory -text says inference may be possible; consistently showing the current project -or accepting a session default would make the normal path clearer. - -`query` is powerful but necessarily specialist-facing: it requires Cypher and -the separate `schema` lookup. This is appropriate, but it is not the easiest -entry point for ordinary source discovery. - -`changes --since HEAD~1` included untracked workspace artifacts as changed -files and consequently found no indexed seed symbols. This is accurate for a -working-tree view but unexpected for a user who reads `--since` as a pure Git -commit comparison. The command should make the working-tree inclusion explicit -in its result/help, or offer a committed-only switch. - -## Follow-up implemented - -The immediate setup and discovery clarity fixes are now in the working tree: - -1. A missing `CBM_RUNTIME_DIR` override is created with the existing secure, - no-follow owner-private path. Existing directories remain fail-closed and - are never re-owned or permission-modified. -2. Command help now consistently says that `--project` selects the indexed - project, matching its required flag. -3. `changes` help and JSON output explicitly say that the working tree is - included (`working_tree_included: true`). - -Semantic ranking remains a separate relevance-quality task; no ranking -heuristic was changed based on one exploratory query. - -No product changes were made by this exercise. The disposable cache/runtime -directory can be removed after the session. diff --git a/docs/CONSOLIDATED_SOURCE_RECONCILIATION_2026-09-01.md b/docs/CONSOLIDATED_SOURCE_RECONCILIATION_2026-09-01.md deleted file mode 100644 index 969b07b42f..0000000000 --- a/docs/CONSOLIDATED_SOURCE_RECONCILIATION_2026-09-01.md +++ /dev/null @@ -1,27 +0,0 @@ -# Consolidated Source Reconciliation — 2026-09-01 - -This note records the pre-edit reconciliation of the authoritative consolidated archive against the CLI-first engineering handoff. - -## Confirmed - -- The neutral operation registry contains the six expected reads: `projects`, `status`, `coverage`, `search`, `snippet`, and `trace`. -- Canonical CLI reads execute through `cbm_operation_execute()` locally rather than through MCP. -- Hook augmentation calls neutral operations directly. -- The daemon's legacy tool request path checks the operation registry before falling back to the MCP dispatcher. -- MCP's six migrated read entry points are compatibility adapters to neutral operations; the former authoritative handler bodies are absent. -- The product/build/install surfaces use `codebase-memory-cli`; Windows workflows explicitly validate `codebase-memory-cli.exe`. -- Native Windows x64 uses MSYS2/CLANG64; an experimental Windows ARM64 path is also present. -- `docs/RUNTIME_ASSURANCE_PLAN.md` already records the daemon-authoritative mutation invariant, BUSY/LOCKED-not-corruption rule, doctor/benchmark direction, stable event names, and real-process concurrency scenarios. - -## Discrepancies / remaining migration debt - -- The daemon wire vocabulary still exposed `REQUEST_MCP` and `REQUEST_TOOL`; neutral operations were reached only as a branch inside `REQUEST_TOOL` and their daemon response was re-wrapped as an MCP text result. -- `main_local_cli_daemon_execute()` is still a legacy-tool path for commands whose behavior has not yet been extracted. This is legitimate transition debt and must not become the neutral operation API. -- Daemon session/context and bootstrap naming still contains MCP concepts (`cbm_mcp_server_t`, MCP tool profiles, MCP client role). These are broader extraction tasks; removing them in the operation-wire checkpoint would mix protocol cleanup with behavior migration. -- Index worker execution still intentionally uses the historical MCP dispatcher until `index_repository` is extracted. - -## Checkpoint decision - -Introduce a distinct `REQUEST_OPERATION` wire request with canonical operation payloads and no MCP envelope. Keep `REQUEST_MCP` and a separately numbered transitional `REQUEST_TOOL` only for unextracted compatibility behavior. New/extracted daemon callers must use the operation request; legacy tool fallback must not be reachable from it. - -The runtime-assurance event vocabulary is also promoted into source as stable identifiers so subsequent coordinator/store instrumentation does not invent incompatible names ad hoc. diff --git a/docs/FULL_SUITE_FAILURES_2026-09-04.md b/docs/FULL_SUITE_FAILURES_2026-09-04.md deleted file mode 100644 index 1e26a17232..0000000000 --- a/docs/FULL_SUITE_FAILURES_2026-09-04.md +++ /dev/null @@ -1,75 +0,0 @@ -# Full Suite Failure Details - -Date: 2026-09-04 -Branch: `release-tooling` -Baseline: `4f0d7b9` - -## Status - -The full sanitized suite is not green. The production incremental build and -sanitized test-runner build completed successfully, but the direct full-run -execution ended with 12 assertion failures and an AddressSanitizer heap-buffer-overflow. - -The focused memory suite remains separate: 52/52 tests passed with -`ASAN_OPTIONS=detect_leaks=1`. - -## Canonical runner preflight failures - -`scripts/test.sh` did not reach the suite execution because two preflight -contracts failed: - -1. The build-directory safety contract failed. -2. The Windows VM worktree manifest contract reported stale expectations for - the maintained driver and the old `codebase-memory-mcp.exe`. - -The full result below therefore came from the direct sanitized runner, not a -successful canonical `scripts/test.sh` gate. - -## Assertion failures - -| Location | Test | Assertion | -|---|---|---| -| `tests/test_subprocess.c:551` | `subprocess_quiet_timeout_kills_ignoring_tree` | `ASSERT(ready)` | -| `tests/test_daemon_runtime.c:3813` | daemon runtime test | `ASSERT(second_usable_before)` | -| `tests/test_daemon_application.c:707` | `daemon_application_requires_immutable_explicit_context` | `ASSERT(operation_response)` | -| `tests/test_daemon_application.c:1887` | `initialize_coalesces_auto_index_for_full_sessions` | `ASSERT(restricted_started_nothing)` | -| `tests/test_daemon_application.c:2026` | `sensitive_root_blocks_auto_index` | `ASSERT(sensitive_blocked)` | -| `tests/test_daemon_application.c:2149` | `sensitive_root_blocks_watch` | `ASSERT(ordinary_watched)` | -| `tests/test_daemon_application.c:2228` | `auto_index_honors_tracked_file_limit` | `ASSERT(limit_prevented_admission)` | -| `tests/test_daemon_application.c:2383` | `auto_index_retries_transient_busy_admission` | `ASSERT(initially_deferred)` | -| `tests/test_daemon_application.c:2461` | `update_generation_notifies_initial_and_late_sessions_once` | `ASSERT(initial_notified)` | -| `tests/test_daemon_application.c:2506` | `update_generation_retries_worker_start_failure` | `ASSERT(failed_generation_started)` | -| `tests/test_daemon_application.c:2570` | `update_generation_retries_cancelled_check` | `ASSERT(first_started)` | -| `tests/test_daemon_application.c:2644` | `final_disconnect_cancels_and_joins_update_generation` | `ASSERT(generation_started)` | - -## Sanitizer failure - -After the assertion failures, AddressSanitizer reported a heap-buffer-overflow -while executing the daemon application tests: - -- Reported read: `strstr()` read 58 bytes. -- Test location: `tests/test_daemon_application.c:2744`. -- Allocated buffer: 57 bytes. -- Allocation site: `src/daemon/application.c:2545`. -- Relevant dispatch path: `application_operation_request()` through daemon - application request dispatch. - -This is an active correctness and memory-safety failure. The report does not -yet establish whether the length mismatch is in the producer, the response -buffer contract, or the test's string handling; reproduce it in the smallest -daemon-application invocation before changing ownership or bounds logic. - -## Follow-up - -- Reproduce the ASan overflow with only the daemon-application suite. -- Classify the ten daemon-application assertions as setup, timing, protocol, - or implementation failures; several concern auto-index/update-generation - admission and retry behavior. -- Re-run `subprocess_quiet_timeout_kills_ignoring_tree` independently to check - whether its readiness failure is flaky. -- Repair or update the two stale `scripts/test.sh` preflight contracts before - treating that script as the full-suite gate. -- Re-run the canonical full suite, focused foundation runner, and LeakSanitizer - memory suite after remediation. - -No assertion or sanitizer failure is marked resolved by this artifact. diff --git a/docs/GITHUB_CI_RECOVERY_PLAN_2026-09-08.md b/docs/GITHUB_CI_RECOVERY_PLAN_2026-09-08.md deleted file mode 100644 index b3395d1d8d..0000000000 --- a/docs/GITHUB_CI_RECOVERY_PLAN_2026-09-08.md +++ /dev/null @@ -1,132 +0,0 @@ -# GitHub CI Recovery Plan — 2026-09-08 - -Status: **BLOCKED — upstream Actions reruns require repository administrator permission** - -## Execution record — 2026-09-09 - -- Prepared durable Agent Run `ci-recovery-20260908` against local source - `bed05b9947bb10959cbf112b8051b80450145304`. -- Confirmed PR #2115 includes commit `92cb3b9`, which bounds the activation - fixture's readiness/reap waits. That commit is not present in this local - checkout, so this worktree cannot supply source-level acceptance for it. -- Confirmed the current `apt.llvm.org` Noble LLVM 22 index contains `clang-22`, - `libclang-rt-22-dev`, and `llvm-22`; the MSan package outage is no longer - reproducible from the configured source. -- A focused local `scripts/test.sh --suites cli` run on `bed05b99` remained - incomplete after 204 seconds and was stopped. It made no worktree changes. -- GitHub rejected reruns of failed workflow runs `34288397854` and - `34282381014`: `Must have admin rights to Repository`. -- Direct GitHub CLI verification confirms `ngallodev` has `pull` only (no - push, maintain, or admin) on `DeusData/codebase-memory-mcp`; both affected - PR branches are owned by `DeusData`. - -Required upstream action: an administrator must rerun the failed jobs (or push -a new commit to each PR) and inspect the fresh `MSan`, Windows guards, ARM -Unix shard, and `ci-ok` results. Until those runs pass on their current merge -SHAs, this plan is not complete. - -## Scope and evidence - -This plan resolves the failures seen in the required `PR` workflows, then -verifies fresh GitHub Actions results. It does not weaken or bypass a test. - -| Failure | Evidence | Classification | -| --- | --- | --- | -| Windows concurrent cold start | Runs [34288397854](https://github.com/DeusData/codebase-memory-mcp/actions/runs/34288397854) and [34282381014](https://github.com/DeusData/codebase-memory-mcp/actions/runs/34282381014) both fail `test-windows-guards`: a cold-storm client reports `secure CLI coordination could not be created (endpoint)`. | Shared product/coordination defect; the same failure crosses unrelated PRs. | -| ARM CLI suite | Run [34288397854](https://github.com/DeusData/codebase-memory-mcp/actions/runs/34288397854) exhausts the 900-second `cli` suite limit after `ASSERT(host_serving)` in `cli_install_into_host_namespace_still_drains_host_cohort`. | Product or test-contract regression specific to PR #2115's activation-guard change. | -| MSan image build | Run [34282381014](https://github.com/DeusData/codebase-memory-mcp/actions/runs/34282381014) cannot install `clang-22`, `libclang-rt-22-dev`, or `llvm-22` from its configured LLVM apt source. | CI image/toolchain provisioning defect, before product tests run. | - -`ci-ok` is an aggregate failure and requires no separate repair. - -## Order of work - -1. Record a fresh failure matrix before editing: workflow run, merge SHA, failed - job/step, runner image, and exact first error. Keep this evidence with the - repair PR. Do not use historical logs as pass evidence. -2. Repair MSan provisioning first because it is isolated from product behavior. -3. Repair the Windows cold-start race on a branch based on current `main`. -4. Rebase the activation-guard PR onto that baseline, then resolve its ARM CLI - hang without changing the suite timeout. -5. Rerun required checks on the resulting merge SHAs and inspect each job, - rather than treating a successful workflow dispatch as success. - -## 1. MSan provisioning - -1. In the exact failing Docker build context, capture `apt-get update` output - and `apt-cache policy` for all three LLVM 22 packages. Confirm the - repository suite, key, architecture, and package names actually published - by apt.llvm.org for the runner's Ubuntu release. -2. Replace the unavailable source with one reproducible LLVM 22 provisioning - route already compatible with the MSan image. Prefer the repository's - existing source-built runtime path if it supplies the required compiler and - runtimes; otherwise use the correct published LLVM repository. Pin the - selected compiler/runtime version together. -3. Run `scripts/ci/msan-lane.sh build`, then `scripts/ci/msan-lane.sh run`. - Retain the build output proving the compiler and MSan runtimes are present. - -Acceptance: the MSan image builds without retries masking a missing package, -and the MSan test job reaches and passes its intended suite. - -## 2. Windows concurrent cold start - -1. Reproduce the existing six-client scenario from - `tests/windows/test_daemon_stability.py` on the Windows runner or the - authoritative Windows host. Repeat it enough to distinguish deterministic - failure from a timing-only flake. -2. Instrument only the shared endpoint/coordination creation failure path: - capture the platform error code, operation, and safe runtime-path category. - Do not log endpoint secrets, user paths, or broaden the test's deadlines. -3. Trace endpoint construction, startup-lock acquisition, generation probing, - spawn handoff, and cleanup as one state transition. Fix the shared state - handoff that permits a racing client to observe an unusable endpoint; do not - add per-client retries that merely conceal a failed handoff. -4. Add or extend the smallest deterministic regression assertion at the shared - boundary if the current cold-storm test cannot distinguish the broken state. - -Acceptance: repeated cold storms succeed, all clients either share the valid -ephemeral daemon or receive the defined recoverable state, and the daemon -retires as the existing guard requires. Run the focused Windows guard followed -by the complete Windows test matrix. - -## 3. ARM activation-guard hang - -1. Run the `cli` suite alone with its normal 900-second ceiling, preserving its - captured output. On the stall, collect the host/target daemon status, cohort - claims, startup-lock state, and child-process tree before cleanup. -2. Compare the install target's `HOME`/runtime namespace with the host namespace - used by `cli_install_into_host_namespace_still_drains_host_cohort`. Establish - whether the test's expectation is still valid or the activation guard now - fails to drain a legitimate host cohort. -3. Repair the lifecycle ownership at the common activation/cohort boundary. A - sandbox install must not drain an unrelated host daemon, while an explicit - host-target install must complete its expected drain and restore service. -4. Add a bounded regression test for both namespaces. Do not solve the failure - by skipping the test, extending its timeout, or serializing unrelated suites. - -Acceptance: the focused `cli` suite completes under its current limit on ARM -and x86 Linux; the exact host and sandbox cases pass; the full Unix shard matrix -has no timed-out suite. - -## Integration and evidence gate - -1. Keep MSan, shared Windows coordination, and activation-guard changes in - reviewable commits. Rebase dependent PRs after the shared repair merges. -2. Before push, run the smallest relevant local checks: - - - `scripts/ci/msan-lane.sh all` for the image repair; - - the focused Windows daemon stability guard on Windows; - - `scripts/test.sh --suites cli` for the activation path. - -3. For each changed branch, inspect the new `PR` workflow's individual jobs: - MSan, Windows guards/matrix, Unix ARM shards, diagnostics, lint, security, - and final `ci-ok`. -4. Declare the work complete only when every required job is `success` on the - post-repair merge SHA. Attach the URLs, SHAs, command output, and any - remaining environmental limitation to the PR or a durable handoff. - -## Explicit non-solutions - -- Do not rerun until green without identifying the failing transition. -- Do not suppress Windows cold-storm coverage. -- Do not raise the ARM suite timeout or mark the CLI suite optional. -- Do not make `ci-ok` ignore a failed `test` job. diff --git a/docs/LINUX_BENCHMARK_RUNBOOK.md b/docs/LINUX_BENCHMARK_RUNBOOK.md index 6feb14a95b..fb4640fc35 100644 --- a/docs/LINUX_BENCHMARK_RUNBOOK.md +++ b/docs/LINUX_BENCHMARK_RUNBOOK.md @@ -18,7 +18,7 @@ The corpus is defined by `docs/qualification/BENCHMARK_CORPUS.json`. The five re 2. `specgen-aw`; 3. `agent-workflow`; 4. `agent-workflow-spec-contracts`; -5. `herdr`. +5. `managed terminal`. The manifest, not this runbook, is authoritative for each repository's operations, workload file, query, symbol, base branch, initialization ref, and eventually frozen commit. @@ -89,7 +89,7 @@ A successful corpus run creates a timestamped directory beneath the results root specgen-aw/ agent-workflow/ agent-workflow-spec-contracts/ - herdr/ + managed terminal/ corpus-results.json RESULT ``` diff --git a/docs/LINUX_RELEASE_QUALIFICATION.md b/docs/LINUX_RELEASE_QUALIFICATION.md index b502d41661..0873c37043 100644 --- a/docs/LINUX_RELEASE_QUALIFICATION.md +++ b/docs/LINUX_RELEASE_QUALIFICATION.md @@ -89,7 +89,7 @@ Do not expand test count solely to improve coverage statistics; prefer existing The broad sanitized `build/c/test-runner` build was resumed incrementally across three bounded compiler windows. It progressed through production, pipeline, and test objects with no compiler correctness failure, but did not yet reach the vendored link boundary in this environment. This remains **IN PROGRESS**, not a pass. -In parallel, the GitHub release workflow was reconciled with the external native-Windows qualification contract. Releases now default to a draft hold after CI verification; npm/PyPI publication and public un-drafting are deferred until `promote-qualified-release.yml` validates qualification evidence produced on `luigi.home.arpa` against the exact Windows ZIP and executable hashes. +In parallel, the GitHub release workflow was reconciled with the external native-Windows qualification contract. Releases now default to a draft hold after CI verification; npm/PyPI publication and public un-drafting are deferred until `promote-qualified-release.yml` validates qualification evidence produced on `the qualification host` against the exact Windows ZIP and executable hashes. ## RC authoritative-build boundary diff --git a/docs/PERFORMANCE_BASELINE.md b/docs/PERFORMANCE_BASELINE.md index bb96758ce3..2b64b2fafd 100644 --- a/docs/PERFORMANCE_BASELINE.md +++ b/docs/PERFORMANCE_BASELINE.md @@ -235,7 +235,7 @@ The older `scripts/benchmark-index.sh` was also corrected to invoke the canonica ## CP61 release-qualification boundary For release gating on Windows, this general harness contract is subordinate to -`docs/WINDOWS_BENCHMARK_PROTOCOL.md`. The authoritative benchmark host is `luigi.home.arpa`, binary +`docs/WINDOWS_BENCHMARK_PROTOCOL.md`. The authoritative benchmark host is `the qualification host`, binary inputs are immutable GitHub-published artifacts, and repository inputs come from the frozen corpus manifest in `docs/qualification/BENCHMARK_CORPUS.json`. diff --git a/docs/RELEASE_QUALIFICATION_PLAN.md b/docs/RELEASE_QUALIFICATION_PLAN.md index 26588b8777..354932ffb9 100644 --- a/docs/RELEASE_QUALIFICATION_PLAN.md +++ b/docs/RELEASE_QUALIFICATION_PLAN.md @@ -47,7 +47,7 @@ GitHub release-candidate workflow +-- production Windows artifact + checksums/provenance | v -luigi.home.arpa (authoritative Windows 11 x64 qualification host) +the qualification host (authoritative Windows 11 x64 qualification host) | +-- portable-artifact functional/reliability validation +-- installed-product validation @@ -114,7 +114,7 @@ The release workflow must build immutable Windows artifact bytes and associated ### Gate 3 — Native Windows functional/reliability qualification -Authoritative host: `luigi.home.arpa`. +Authoritative host: `the qualification host`. Validate both: @@ -198,9 +198,9 @@ The first Windows benchmark generation (`windows-corpus-1`) uses five fixed repo - `agent-workflow-spec-contracts` (`https://github.com/ngallodev-software/agent-workflow-spec-contracts.git`); For the current integration set, qualification expects SpecGen `0.2.1`, Agent-Workflow `0.10.0`, and the released `specgen-agent-workflow-contracts` package `0.2.1`. The corpus manifest records both the expected version and the pre-freeze initialization ref: `master` for SpecGen and Agent-Workflow, and release tag `v0.2.1` for the shared contracts repository because its current `master` project metadata still reports `0.2.0`. Frozen commit SHAs remain the authoritative benchmark identity after initialization. The machine-verifiable `version_check` object is enforced by `scripts/qualification/validate-corpus-checkouts.py`; initialization uses `--allow-unpinned`, then the validator is rerun without that flag after exact commit SHAs are recorded. -- `herdr` (`https://github.com/herdrdev/herdr.git`). +- `managed terminal` (`https://github.com/managed terminaldev/managed terminal.git`). -Exact commit SHAs are not selected from remote HEAD during planning. They are recorded from the actual clean checkouts frozen for qualification on `luigi.home.arpa`. After that freeze, any commit change creates a new corpus generation and requires new baseline capture. +Exact commit SHAs are not selected from remote HEAD during planning. They are recorded from the actual clean checkouts frozen for qualification on `the qualification host`. After that freeze, any commit change creates a new corpus generation and requires new baseline capture. ## Change/retest policy @@ -217,7 +217,7 @@ If qualification finds a defect and the candidate changes: 1. Finish this qualification-plan re-baseline. 2. Complete Linux consolidation/build reliability evidence. 3. Publish GitHub RC. -4. Run native Windows qualification on `luigi.home.arpa`. +4. Run native Windows qualification on `the qualification host`. 5. Run Windows baseline/candidate benchmarking on the frozen corpus. 6. Run agent usability user stories. 7. Make evidence-driven changes only. diff --git a/docs/UPSTREAM_308_CANDIDATE_AUDIT_20260912.md b/docs/UPSTREAM_308_CANDIDATE_AUDIT_20260912.md index cc47731782..846939eaa5 100644 --- a/docs/UPSTREAM_308_CANDIDATE_AUDIT_20260912.md +++ b/docs/UPSTREAM_308_CANDIDATE_AUDIT_20260912.md @@ -83,7 +83,7 @@ runtime 20/170, history 4/86, and no whole differing merge was closed. Touching row did not prove all hunks. Parent verified exact assignment coverage and all 40 declared artifact checksums, preserved the raw evidence, and rejected ambiguous upstream-versus-target verdict orientation. R4 interactive successors in the same -three Herdr panes continue those assignments. At the evidence capture +three managed terminals continue those assignments. At the evidence capture `2026-10-02T23:53:00.456924+00:00`, extraction had 30 non-unresolved checkpoint claims, runtime 5 and history 19; 313 other claims remained explicitly unresolved. These 54 claims are not 54 parent-verified whole commits. No R4 final result, @@ -124,7 +124,7 @@ The user authorized splitting only unfinished work and Luna low for straightforw comparisons. Runtime R4 explicitly released 16 unreviewed MCP-adapter/test followup hashes, with no reviewed/current-batch overlap and a correlated worker-issued Agent-Workflow acknowledgement. New external interactive run -`CBM-RECON-ADAPTER-LOW-20261003` is observed working in Herdr `wC:pE` on an isolated +`CBM-RECON-ADAPTER-LOW-20261003` is observed working in managed terminal on an isolated clean `559214af` worktree, full nonpersistent index generation `2026-10-03T00:48:33Z`, 26,764 nodes / 129,702 edges, 91 parse-partial files. TypeSafe environment readiness was observed after sourcing in its launch shell, without exposing values. @@ -151,7 +151,7 @@ hashes and all completed runtime/extraction/history comparisons are excluded. The first low worker's corrected 16-row source review finalized **partial** with 8 unresolved shared-semantic mappings and an unrecoverable original Jev request; its manifest/reference checks passed, full handoff was preserved, and its user-created -Herdr pane `wC:pE` was closed. Closure is not acceptance or semantic completeness. +managed terminal `managed terminal` was closed. Closure is not acceptance or semantic completeness. **Phase1 objective:** inspect every whole diff/hunk in the 115-hash released scope, compare exact upstream and all three frozen CLI targets, record upstream fate, @@ -176,7 +176,7 @@ prerequisites may be consulted only as context. Parent alone reconciles conclusi All three were prepared before native `agents.spawn_agent(model=deepseek-flash)` execution and bound to external runtime `native-agent-api`. They are workspace -subagents, **not Herdr terminal processes**. A task-scoped fail-closed local adapter +subagents, **not managed terminal processes**. A task-scoped fail-closed local adapter only satisfies Agent-Workflow executable validation; it is not executed and does not emulate a DeepSeek CLI. Shared runtime configuration was unchanged. Each has an isolated clean exact `559214af` worktree and a verified full nonpersistent index: @@ -221,17 +221,17 @@ run/cwd/branch/hash acknowledgement before comparison resumes. No predecessor completion is reissued, and no sealed predecessor evidence is rewritten by recovery. This is a preparation/failed-delivery record; Phase1 is incomplete. -### Interactive Herdr recovery — 2026-10-03 UTC +### Interactive managed terminal recovery — 2026-10-03 UTC The user explicitly requested interactive **Codex `--model deepseek-flash`** workers, with Jev credentials/instructions and indexed worktrees. Three new -external runs were prepared before launching in the same Herdr workspace: +external runs were prepared before launching in the same managed terminal: -| Piece | Successor durable run | Herdr pane / agent | Hashes | +| Piece | Successor durable run | managed terminal / agent | Hashes | |---|---|---|---:| -| Runtime/process/resources | `CBM-RECON-DEEPSEEK-RUNTIME-HERDR-PHASE1-20261003` | `wC:pF` / `ds-runtime-phase1` | 39 | -| Operations/pipeline/query | `CBM-RECON-DEEPSEEK-OPS-HERDR-PHASE1-20261003` | `wC:pG` / `ds-ops-phase1` | 26 | -| CLI/build/adapter/integration | `CBM-RECON-DEEPSEEK-INTEGRATION-HERDR-PHASE1-20261003` | `wC:pH` / `ds-integration-phase1` | 50 | +| Runtime/process/resources | `CBM-RECON-DEEPSEEK-RUNTIME-managed terminal-PHASE1-20261003` | `managed terminal` / `ds-runtime-phase1` | 39 | +| Operations/pipeline/query | `CBM-RECON-DEEPSEEK-OPS-managed terminal-PHASE1-20261003` | `managed terminal` / `ds-ops-phase1` | 26 | +| CLI/build/adapter/integration | `CBM-RECON-DEEPSEEK-INTEGRATION-managed terminal-PHASE1-20261003` | `managed terminal` / `ds-integration-phase1` | 50 | All three are observed working and have written correct worker-issued launch acknowledgements naming their run, isolated cwd/branch and assigned count. The @@ -249,12 +249,12 @@ the token was verified as a boolean, without recording its value. The verified A destination is `https://api.typesafe.ai`. Each session uses `--no-daemon`, approvals never and full filesystem access within its evidence-only assignment. -Run-owned evidence includes `parent-herdr-launch-receipt.json`, +Run-owned evidence includes `parent-managed terminal-launch-receipt.json`, `codex-process-env-receipt.json`, `launch-acknowledgement.json`, index/assignment receipts and correlated worker acknowledgement evidence. Runtime/operations acknowledgements are worker-issued handoff control intents; integration also has a journal acknowledgement. Full launch staging is the original Phase1 handoff -directory's `herdr-launch/`. Detailed batch/stopping handoffs remain required. +directory's `managed terminal-launch/`. Detailed batch/stopping handoffs remain required. Activity and launch acknowledgement establish execution of the assigned task; they establish no source completeness, Jev decision result, review, Jenkins validation, acceptance or integration. Phase1 comparison remains in progress. @@ -329,13 +329,13 @@ were found orphaned: no live worker and no finalized result; their last activity was near 18:16Z. The lifecycle projection still saying `running` did not establish live execution. Their provisional outputs remain preserved and unreviewed. Unstarted R2 headless retries were superseded when the user requested interactive -Herdr terminals to the right. New external preparations are now visibly working: +managed terminal to the right. New external preparations are now visibly working: -| Current interactive run | Herdr pane | Assignment | +| Current interactive run | managed terminal | Assignment | |---|---|---| -| `CBM-RECON-EXTRACT-20261002-R3` | `wC:pB` | 111 non-merges | -| `CBM-RECON-RUNTIME-20261002-R3` | `wC:pC` | 170 non-merges | -| `CBM-RECON-HISTORY-20261002-R3` | `wC:pD` | 86 non-merges and 311 merges | +| `CBM-RECON-EXTRACT-20261002-R3` | `managed terminal` | 111 non-merges | +| `CBM-RECON-RUNTIME-20261002-R3` | `managed terminal` | 170 non-merges | +| `CBM-RECON-HISTORY-20261002-R3` | `managed terminal` | 86 non-merges and 311 merges | Each uses GPT-6-Luna high, full access and approvals `never`, bound to its durable external run. The unchanged worktrees still have exact ready graph roots, matching @@ -549,7 +549,7 @@ significant. No earlier agent verdict or Jev answer was supplied to this call. ### Exact remaining limits, evidence and validation Run `CBM-UPSTREAM-SOL-20261002-R2`, under -`/home/nate/.local/state/agent-workflow/runs/CBM-UPSTREAM-SOL-20261002-R2/evidence/`, +`local run evidence`, owns `merge-crosswalk.jsonl`, `nonmerge-crosswalk.jsonl`, `first-parent-history.tsv`, `canonical-reconciliation.jsonl`, `slice-grouping.json`, `next-five-slices.json`, `unresolved-dispositions.tsv`, source/combined diffs, @@ -593,7 +593,7 @@ convert its exit or scoped doc commit into review, acceptance or integration. ## Current fetch — 2026-10-01 PDT CLI `upstream` was refreshed with `git fetch upstream --prune`; MCP `main` was -fast-forwarded with `git pull --ff-only` in `/lump/apps/codebase-memory-mcp`. +fast-forwarded with `git pull --ff-only` in `local run evidence`. No CLI pull was performed. | Item | Value | @@ -879,7 +879,7 @@ completion; its documentation commit `fd2aca2a` is separate from these slices. ## 2026-10-01 recovery evidence and outstanding work The independent parity audit is available at -`/home/nate/.local/state/agent-workflow/runs/CBM-MCP-CLI-PARITY-20260930/evidence/parity-report.md`. +`local run evidence`. It found no operation-name absence, but `manage_adr` is compatibility-only: there is no top-level `manage-adr` alias/help route, and CLI omits MCP's `outline` mode while using a different default. The report prioritizes adding @@ -989,7 +989,7 @@ Maintainer instruction: commit to local `release-tooling` and use the existing `codebase-memory-cli-release-tooling` job. `CBM_TEST_SUITES` accepts whitespace or comma-separated names; blank runs the full gate. Do not create task jobs. All five temporary jobs were retired after archiving configuration and build -logs under `/tmp/cbm-jev-delegation/retired-jenkins`. Historical URLs no longer +logs under `local run evidence`. Historical URLs no longer resolve; archived logs remain the evidence source. The AST slice now also includes upstream `77ab4bea` definition-stack ceiling @@ -1164,28 +1164,28 @@ interactive Codex, `danger-full-access`, and approvals `never`. Global runtime configuration was not changed. Builds/tests remain parent-scheduled in the existing shared Jenkins job; workers may format, inspect diffs and commit regression source. -The requested Herdr right-hand panes could not be launched because this caller -is outside a Herdr-managed pane (`HERDR_ENV` unset). No Herdr control was attempted +The requested managed terminal could not be launched because this caller +is outside a managed terminal-managed pane (`managed terminal_ENV` unset). No managed terminal control was attempted and no headless fallback was substituted. The durable launch handoff is -`/home/nate/.local/state/agent-workflow/handoffs/CBM-THREE-VERTICALS-20261002/README.md`. +`local run evidence`. Preparation is not running, implementation completion, review or acceptance. -### Interactive Herdr launch verified — 2026-10-02T04:52Z +### Interactive managed terminal launch verified — 2026-10-02T04:52Z -The maintainer confirmed this is a Herdr session and authorized setting -`HERDR_ENV=1`. Herdr then verified the current Codex parent in `wC:p1`. +The maintainer confirmed this is a managed terminal session and authorized setting +`managed terminal_ENV=1`. managed terminal then verified the current Codex parent in `managed terminal`. All three external workers are launched in the same tab, stacked in the right-hand column; the parent's focus remains unchanged. -| Vertical | Herdr worker / pane | Durable delivery and live state | +| Vertical | managed terminal worker / pane | Durable delivery and live state | |---|---|---| -| Daemon ownership | `luna-daemon-ownership`, `wC:p5` | Working; steering acknowledged by worker | -| ReScript hangs | `luna-rescript-hang`, `wC:p6` | Working; steering acknowledged by worker | -| Internal cache stores | `luna-cache-stores`, `wC:p7` | Working; steering acknowledged by worker | +| Daemon ownership | `luna-daemon-ownership`, `managed terminal` | Working; steering acknowledged by worker | +| ReScript hangs | `luna-rescript-hang`, `managed terminal` | Working; steering acknowledged by worker | +| Internal cache stores | `luna-cache-stores`, `managed terminal` | Working; steering acknowledged by worker | -Each prepared Agent Run is bound to its Herdr pane at external generation 1; +Each prepared Agent Run is bound to its managed terminal at external generation 1; `start-external` records launch, and all three correlated steering IDs have -worker acknowledgements. Herdr's actual launch argv confirms GPT-6-Luna, +worker acknowledgements. managed terminal's actual launch argv confirms GPT-6-Luna, medium reasoning, `danger-full-access` and approvals `never`. This supersedes the earlier prepared/not-launched state. Implementation, Jenkins evaluation, independent review, acceptance and integration remain separate pending gates. @@ -1196,8 +1196,8 @@ Both workers finished committed implementation candidates and were idle. Daemon branch `impl/cbm-daemon-ownership-20261002` retains `028a4bfb`; cache branch `impl/cbm-cache-stores-20261002` retains `fa5a180b`. Their worktrees were verified clean, bundles verified, patches/reports/terminal -transcripts preserved under each run's `evidence/closeout/`, and Herdr panes -`wC:p5` / `wC:p7` closed at the user's request. Only those two worktrees were +transcripts preserved under each run's `evidence/closeout/`, and managed terminals +`managed terminal` / `managed terminal` closed at the user's request. Only those two worktrees were removed; branches remain available for review/integration. Worker `agent finish --result partial` had produced handoff completions but left @@ -1217,10 +1217,10 @@ without a remote fetch or moving shared CLI refs. `0f52d30c..96c3f41c` contains non-merge commits. These are deterministic census counts, not completed semantic classification or applicability claims. -| Agent Run | Independent worktree / branch suffix | Herdr pane | Task | +| Agent Run | Independent worktree / branch suffix | managed terminal | Task | |---|---|---|---| -| `CBM-UPSTREAM-ASSESS-20261002` | `cbm-upstream-assess-20261002` | `wC:p8`, `codex - luna-upstream-assess` | Source/Jev assessment of new and older unclassified commits; group applicable verticals with prerequisites/prior QA commits; propose canonical ledger/backlog edits on isolated branch | -| `CBM-UPSTREAM-VERIFY-20261002` | `cbm-upstream-verify-20261002` | `wC:p9`, `codex - luna-upstream-verify` | Independent full-hash/source coverage audit of all differing applicable commits; evidence/report only, no competing canonical-doc edits | +| `CBM-UPSTREAM-ASSESS-20261002` | `cbm-upstream-assess-20261002` | `managed terminal`, `codex - luna-upstream-assess` | Source/Jev assessment of new and older unclassified commits; group applicable verticals with prerequisites/prior QA commits; propose canonical ledger/backlog edits on isolated branch | +| `CBM-UPSTREAM-VERIFY-20261002` | `cbm-upstream-verify-20261002` | `managed terminal`, `codex - luna-upstream-verify` | Independent full-hash/source coverage audit of all differing applicable commits; evidence/report only, no competing canonical-doc edits | Both GPT-6-Luna interactive workers launched with full access, approvals never, and acknowledged generation-1 durable steering. Each worktree was indexed in @@ -1237,7 +1237,7 @@ Previously implemented daemon/cache/ReScript candidates remain unmerged and unvalidated; do not confuse their surviving branch commits with accepted ports. Compact handoff, frozen universes, index/process receipts, native launch and acknowledgement evidence are retained at -`/home/nate/.local/state/agent-workflow/handoffs/CBM-UPSTREAM-AUDIT-20261002/`. +`local run evidence`. ## Three-candidate integration review resumed — 2026-10-02 @@ -1268,7 +1268,7 @@ Jenkins evaluation, runtime acceptance, remote push and main integration remain separate pending gates. The requested GPT-6.1-Sol audit is independently running as -`CBM-UPSTREAM-SOL-20261002-R2`, pane `wC:pA`, against frozen QA base +`CBM-UPSTREAM-SOL-20261002-R2`, pane `managed terminal`, against frozen QA base `5fe820df` and upstream `96c3f41c`. Its scope includes all upstream merge commits, constituent commits, canonical backlog reconciliation, vertical grouping and the next five new slices. Its exact-worktree index completed with @@ -2121,7 +2121,7 @@ retained in run evidence. ### DeepSeek Phase1 independent review — 2026-10-03 UTC -All three Herdr workers are idle with saved dispositions matching their exact +All three managed terminal workers are idle with saved dispositions matching their exact 39/26/50 assignments. Parent verified all115 assignment sets, all cited evidence links and342 manifest entries. Three Jev requests batched six bounded primary-source questions using jev-1.13.0; worker verdicts and earlier Jev answers were excluded. @@ -2161,13 +2161,13 @@ source diffs/receipts are reused as discovery, not verdict authority; every chan hunk and frozen target behavior must receive source evidence or explicit unknowns. Interactive Codex `gpt-6-luna` with `model_reasoning_effort=low` launched in -Herdr `wC:pJ`, label `codex - luna-review-pilot20`, with `--no-daemon`. Actual +managed terminal, label `codex - luna-review-pilot20`, with `--no-daemon`. Actual Codex process argv, managed pane environment and Jev-token inheritance are verified without logging credential values. The official Jev footer is in the prepared prompt once; bounded shared-context questions must be batched through the official helper, with saved requests, full distributions and advice-use notes. -The pilot reuses `/tmp/cbm-recon-deepseek-integration-20261003` after its prior +The pilot reuses `local run evidence` after its prior worker stopped: source remains clean frozenQA `559214af`, and fresh status/root/ coverage generation matches its full persistence-disabled index `2026-10-03T01:27:06Z` (26,764nodes/129,775edges,91 partial files). @@ -2175,16 +2175,16 @@ Exact launch/index/assignment/ownership plan remains run evidence and `handoffs/CBM-LUNA-LOW-PILOT20-20261003/`, not a second canonical ledger. The worker must retain detailed checkpoints/handoffs at each batch and stop. -User-authorized cleanup: completed DeepSeek operations `wC:pG` and integration -`wC:pH` panes closed after handoff/checkpoint/disposition and manifest verification. -Runtime `wC:pF` was already absent. Other panes and all worktrees/evidence retained. +User-authorized cleanup: completed DeepSeek operations `managed terminal` and integration +`managed terminal` panes closed after handoff/checkpoint/disposition and manifest verification. +Runtime `managed terminal` was already absent. Other panes and all worktrees/evidence retained. Pilot launch is not completed verification, runtime validation or acceptance; no tests/builds/Jenkins/remote operations are authorized or performed. ## Luna pane cleanup and pilot partial — 2026-10-03 UTC User requested closure of the three original Luna high panes. All were verified -idle immediately before closing `wC:pB`, `wC:pC`, and `wC:pD`; subsequent pane +idle immediately before closing `managed terminal`, `managed terminal`, and `managed terminal`; subsequent pane inventory confirms absence. Worktrees and saved evidence remain intact. Parent recorded external exits for generation1, separately from completion or acceptance. @@ -2201,13 +2201,13 @@ lack all-target semantic comparison, all-hunk dispositions and comprehensive CBM coverage/trace/snippet receipts. No fully verified pilot commit is credited; all20 remain open, plus89 outside pilot scope. One successful batched Jev response is advisory only. Stopping reason was a time-bounded checkpoint, not a controlled -environment blocker. The idle pilot pane `wC:pJ` remains open. Continuation requires +environment blocker. The idle pilot pane `managed terminal` remains open. Continuation requires successor lineage without rewriting sealed evidence. Exact full-hash remainders and immutable worker checkpoints remain under the four run evidence directories. Cleanup inventory SHA256s, before/after pane receipts, and external exits are saved at -`/home/nate/.local/state/agent-workflow/handoffs/CBM-LUNA-CLEANUP-20261003/`. +`local run evidence`. No local builds/tests, Jenkins, independent acceptance, push or main integration occurred in this cleanup. Overall audit remains incomplete. @@ -2217,13 +2217,13 @@ User authorized a different20-commit comparison with Luna medium. Run `CBM-RECON-LUNA-MEDIUM20-20261003` owns20 independently unreviewed runtime hashes, disjoint from the previous pilot20 and six parent-reviewed rows. Exact assignment, prepared prompt and launch receipts: -`/home/nate/.local/state/agent-workflow/handoffs/CBM-LUNA-MEDIUM20-20261003/`. -Worker uses interactive Herdr `wC:pK`, `codex - luna-review-medium20`, with +`local run evidence`. +Worker uses interactive managed terminal, `codex - luna-review-medium20`, with GPT-6-Luna medium, sourced Jev environment and batched primary-evidence guidance. New isolated worktree full index failed with only a generic pipeline error; clean failed worktree retained for diagnosis. Reused idle former runtime worker -worktree `/tmp/cbm-recon-adapter-low2-20261003`, frozen QA559214af, ready full +worktree `local run evidence`, frozen QA559214af, ready full index generation2026-10-03T01:07:59Z,26764nodes/129401edges,91 partial files. Fresh status/root/coverage generation and unchanged clean Git baseline verified. No shared daemon/cache changes. Launch does not establish source closure, @@ -2231,7 +2231,7 @@ runtime validation, review or acceptance; detailed checkpoints are required. ### DeepSeek pilot continuation recovery — 2026-10-03 UTC -User switched old pilot pane `wC:pJ` to DeepSeek Flash and requested execution +User switched old pilot pane `managed terminal` to DeepSeek Flash and requested execution help. Transcript showed `unsupported call: exec`: JSON function calls replayed Luna's old executor format. Direct `exec_command` with `pwd` succeeded after corrective guidance; no permission change was needed. Prepared external successor @@ -2242,7 +2242,7 @@ live worker Jev credential inheritance confirmed without values. New evidence must remain in successor run; prior evidence is immutable. Renamed pane/worker `codex - deepseek-pilot20-continue`, durably steered and resumed with mandatory acknowledgement. Recovery receipts/prompt at -`/home/nate/.local/state/agent-workflow/handoffs/CBM-DEEPSEEK-PILOT20-CONTINUE-20261003/`. +`local run evidence`. No source closure, Jenkins, review or acceptance credited from recovery. ### Finished pilot20 independent verification and new ops20 — 2026-10-03 UTC @@ -2282,11 +2282,11 @@ bounded adaptation gap P=.98 (exact port .01, represented .01, insufficient .00) Advice corroborated source distinctions; it did not close whole-commit gaps. Before review, user-authorized NEW ops20 assignment was delivered to existing pane -wC:pJ as prepared run `CBM-RECON-DEEPSEEK-BATCH2-20-20261003`. Exact20 hashes +managed terminal as prepared run `CBM-RECON-DEEPSEEK-BATCH2-20-20261003`. Exact20 hashes are disjoint from pilot20 and Luna medium runtime20. Same clean frozen indexed worktree reused; direct shell/CBM/Jev guidance and mandatory durable acknowledgement retained. Assignment/prompt/launch receipts at -`/home/nate/.local/state/agent-workflow/handoffs/CBM-DEEPSEEK-BATCH2-20-20261003/`. +`local run evidence`. No builds/tests/Jenkins, runtime validation, acceptance or main integration claimed. ## Finished ops20 and Luna medium20 independent reviews — 2026-10-03 UTC @@ -2341,7 +2341,7 @@ adaptation review remains required; worker represented claims are not automatica parent-verified. These counts describe these two batches only, not global parity. Workers requested completed but finish returned verification_required without native acceptance bindings. No builds/tests/Jenkins, runtime validation, acceptance, -push or main integration occurred. Panes wC:pJ and wC:pK remain idle/open. +push or main integration occurred. Panes managed terminal and managed terminal remain idle/open. Overall upstream merge/constituent and older canonical disposition audit remains incomplete; no exhaustive closure or new five-slice ranking claimed here. @@ -2417,7 +2417,7 @@ merge-history and old canonical-row obligations remain separate and open. Canonical BACKLOG tracks continuation; this308 document owns disposition context; UPSTREAM_RECONCILIATION_REPORT_20261002.md consolidates the checkpoint. Full-hash machine crosswalks remain run evidence, not a second repository ledger. DeepSeek -pane wC:pJ remains idle/open; no new assignment sent in this checkpoint. No builds, +pane managed terminal remains idle/open; no new assignment sent in this checkpoint. No builds, tests, Jenkins triggers, implementation, push, main integration or acceptance. ## Ten recorded merged/adapted tasks independently confirmed — 2026-10-03 UTC diff --git a/docs/UPSTREAM_RECONCILIATION_REPORT_20261002.md b/docs/UPSTREAM_RECONCILIATION_REPORT_20261002.md index 181817d7c0..f085686300 100644 --- a/docs/UPSTREAM_RECONCILIATION_REPORT_20261002.md +++ b/docs/UPSTREAM_RECONCILIATION_REPORT_20261002.md @@ -147,7 +147,7 @@ are a prior snapshot; they were neither refreshed nor repaired here. Original headless workers lost their live processes near 18:16Z despite `running` projections. Their evidence remains preserved; process-loss cause was not proved. Unstarted R2 headless retries were superseded at the user's request. R3 interactive -Luna high workers ran in real managed Herdr panes with independent full exact-root +Luna high workers ran in real managed managed terminals with independent full exact-root indexes and clean frozen QA trees. All R3 handoffs were **partial**: | R3 auditor | Assignment | Touched rows | Untouched rows | @@ -163,7 +163,7 @@ representation in the target. Raw claims remain available separately from parent judgment. None was automatically accepted from a finished terminal state. R4 successors preserve official retry lineage and continue interactively in -`wC:pB`, `wC:pC`, `wC:pD`. They retain all remaining assignments and incrementally +`managed terminal`, `managed terminal`, `managed terminal`. They retain all remaining assignments and incrementally save full diffs/source/coverage. The capture time is `2026-10-02T23:53:00.456924+00:00`. It is not a sealed result: | R4 auditor | Rows accounted for | Non-unresolved raw claims | Unresolved raw claims | @@ -400,7 +400,7 @@ Luna low for straightforward comparisons. Runtime R4 released exactly 16 still unreviewed adapter/test followup hashes, outside both its reviewed rows and active batch, and issued a correlated durable acknowledgement. New interactive external run `CBM-RECON-ADAPTER-LOW-20261003`, worker `luna-adapter-low`, is observed working -in Herdr `wC:pE` with Luna low. It has a separately indexed clean exact-QA worktree +in managed terminal with Luna low. It has a separately indexed clean exact-QA worktree and TypeSafe credentials sourced silently in the actual launch shell. No finished comparison was reassigned. Runtime retains 154 hashes; the effective ownership crosswalk still accounts for all 367 differing non-merges once. Exact source and @@ -423,7 +423,7 @@ handoff/hash checks are preserved and pane closed; this is not acceptance. [The canonical Phase1 plan](UPSTREAM_308_CANDIDATE_AUDIT_20260912.md#phase1-plan-three-disjoint-deepseek-flash-workers--2026-10-03-utc) owns current plan/status. Exact machine assignments/effective ownership and launch/ index receipts remain in the three run evidence roots. Native workspace subagents -use isolated frozen worktrees; they are not Herdr terminal agents. Each must retain +use isolated frozen worktrees; they are not managed terminal agents. Each must retain full source comparisons, bounded primary-evidence Jev calls and resumable batch checkpoints. Subsequent delivery checks found that all three returned predecessor tasks instead of their assignments, even after persisted steering and direct @@ -435,8 +435,8 @@ activity. No result is represented as complete or accepted. The original capture tables remain dated evidence, not silently refreshed progress counters. Interactive recovery now uses three Codex `--model deepseek-flash` sessions in -Herdr `wC:pF` / `wC:pG` / `wC:pH` under the corresponding -`CBM-RECON-DEEPSEEK-{RUNTIME,OPS,INTEGRATION}-HERDR-PHASE1-20261003` runs. +managed terminal / `managed terminal` / `managed terminal` under the corresponding +`CBM-RECON-DEEPSEEK-{RUNTIME,OPS,INTEGRATION}-managed terminal-PHASE1-20261003` runs. All three are observed working and have correct run/cwd/count launch acknowledgements. Actual Codex processes inherited the silently sourced Jev token; destination, official footer and matching ready CBM index generations are verified. The exact @@ -561,22 +561,22 @@ Graph generations match recorded exact-worktree indexes. Partial internal/cbm/cb ## Luna low pilot20 launch — 2026-10-03 UTC Independent verification continues with a bounded20-commit Luna low pilot in -Herdr `wC:pJ`, run `CBM-RECON-LUNA-LOW-PILOT20-20261003`. Its exact assignment +managed terminal, run `CBM-RECON-LUNA-LOW-PILOT20-20261003`. Its exact assignment excludes six already-reviewed hashes and is grouped by shared behavior;89 other unreviewed commits remain outside scope. The canonical308 pilot section owns current plan. Actual Codex low-model argv/Jev-token inheritance and ready exact full-index generation were verified. Existing comparisons remain discovery only, and detailed batched Jev/source/checkpoint evidence is required. Completed -DeepSeek panes `wC:pG`/`wC:pH` closed; runtime pane was already absent. +DeepSeek panes `managed terminal`/`managed terminal` closed; runtime pane was already absent. All worktrees and saved handoffs retained. Launch is not semantic closure. ## Cleanup and pilot outcome — 2026-10-03 UTC -Original idle Luna high panes `wC:pB`/`wC:pC`/`wC:pD` closed; evidence/worktrees +Original idle Luna high panes `managed terminal`/`managed terminal`/`managed terminal` closed; evidence/worktrees retained. History still has an unfinished checkpoint. The pilot finalized partial: 6 incompletely examined,14 untouched,0 credited as fully verified. All20 plus89 outside scope remain open. Canonical308 cleanup section records exact resumption -boundaries and evidence locations. Pilot pane `wC:pJ` remains idle/open. +boundaries and evidence locations. Pilot pane `managed terminal` remains idle/open. ## Luna medium independent batch20 launch — 2026-10-03 UTC @@ -584,13 +584,13 @@ User authorized a different20-commit comparison with Luna medium. Run `CBM-RECON-LUNA-MEDIUM20-20261003` owns20 independently unreviewed runtime hashes, disjoint from the previous pilot20 and six parent-reviewed rows. Exact assignment, prepared prompt and launch receipts: -`/home/nate/.local/state/agent-workflow/handoffs/CBM-LUNA-MEDIUM20-20261003/`. -Worker uses interactive Herdr `wC:pK`, `codex - luna-review-medium20`, with +`local run evidence`. +Worker uses interactive managed terminal, `codex - luna-review-medium20`, with GPT-6-Luna medium, sourced Jev environment and batched primary-evidence guidance. New isolated worktree full index failed with only a generic pipeline error; clean failed worktree retained for diagnosis. Reused idle former runtime worker -worktree `/tmp/cbm-recon-adapter-low2-20261003`, frozen QA559214af, ready full +worktree `local run evidence`, frozen QA559214af, ready full index generation2026-10-03T01:07:59Z,26764nodes/129401edges,91 partial files. Fresh status/root/coverage generation and unchanged clean Git baseline verified. No shared daemon/cache changes. Launch does not establish source closure, @@ -598,7 +598,7 @@ runtime validation, review or acceptance; detailed checkpoints are required. ### DeepSeek pilot continuation recovery — 2026-10-03 UTC -User switched old pilot pane `wC:pJ` to DeepSeek Flash and requested execution +User switched old pilot pane `managed terminal` to DeepSeek Flash and requested execution help. Transcript showed `unsupported call: exec`: JSON function calls replayed Luna's old executor format. Direct `exec_command` with `pwd` succeeded after corrective guidance; no permission change was needed. Prepared external successor @@ -609,13 +609,13 @@ live worker Jev credential inheritance confirmed without values. New evidence must remain in successor run; prior evidence is immutable. Renamed pane/worker `codex - deepseek-pilot20-continue`, durably steered and resumed with mandatory acknowledgement. Recovery receipts/prompt at -`/home/nate/.local/state/agent-workflow/handoffs/CBM-DEEPSEEK-PILOT20-CONTINUE-20261003/`. +`local run evidence`. No source closure, Jenkins, review or acceptance credited from recovery. ### Pilot20 verification and ops20 successor — 2026-10-03 UTC New DeepSeek ops20 run `CBM-RECON-DEEPSEEK-BATCH2-20-20261003` assigned in -wC:pJ; disjoint from prior pilot20 and Luna medium runtime20. Prior pilot20 +managed terminal; disjoint from prior pilot20 and Luna medium runtime20. Prior pilot20 independent review requests changes: all20 rows assessed,4 bounded whole-commit source reviews completed,16 full-hash remainders retained. Corrected absent-alias, YAML indicator, fd-capture guard and Codex policy claims; found missing original CLI @@ -706,7 +706,7 @@ merge-history and old canonical-row obligations remain separate and open. Canonical BACKLOG tracks continuation; this308 document owns disposition context; UPSTREAM_RECONCILIATION_REPORT_20261002.md consolidates the checkpoint. Full-hash machine crosswalks remain run evidence, not a second repository ledger. DeepSeek -pane wC:pJ remains idle/open; no new assignment sent in this checkpoint. No builds, +pane managed terminal remains idle/open; no new assignment sent in this checkpoint. No builds, tests, Jenkins triggers, implementation, push, main integration or acceptance. ## Ten recorded merged/adapted tasks independently confirmed — 2026-10-03 UTC diff --git a/docs/WINDOWS_BENCHMARK_PROTOCOL.md b/docs/WINDOWS_BENCHMARK_PROTOCOL.md index 7afd2c9115..a27b75f4ed 100644 --- a/docs/WINDOWS_BENCHMARK_PROTOCOL.md +++ b/docs/WINDOWS_BENCHMARK_PROTOCOL.md @@ -2,7 +2,7 @@ Status: **AUTHORITATIVE RELEASE BENCHMARK PROCEDURE** -Authoritative host: `luigi.home.arpa`. +Authoritative host: `the qualification host`. ## Goal @@ -32,7 +32,7 @@ Every entry records: - expected clean-tree state; - intended scale/category; - operations enabled for that repository; -- canonical local checkout path on `luigi.home.arpa` when established. +- canonical local checkout path on `the qualification host` when established. Rules: @@ -52,9 +52,9 @@ Use the following stable five-repository corpus for `windows-corpus-1`: 4. `agent-workflow-spec-contracts` — the shared contract dependency used by SpecGen/Agent-Workflow integration: `https://github.com/ngallodev-software/agent-workflow-spec-contracts.git`. Current integration-version expectations for the first frozen corpus are SpecGen `0.2.1`, Agent-Workflow `0.10.0`, and the released shared contracts package `0.2.1`. Before freeze, initialize SpecGen and Agent-Workflow from their declared `master` integration refs, and initialize `agent-workflow-spec-contracts` from release tag `v0.2.1`; its current `master` metadata still reports `0.2.0` and must not be substituted for the released contract package consumed by the two applications. These initialization refs are pre-freeze selection constraints, not substitutes for the immutable commit SHA captured from each frozen checkout. If upstream moves again before the corpus is frozen, update the expected version/ref and the resulting pinned commit before baseline capture. Before recording the frozen SHAs, run `python scripts/qualification/validate-corpus-checkouts.py --allow-unpinned`; after replacing the commit placeholders, rerun the validator without `--allow-unpinned`. -5. `herdr` — larger open-source, multi-language workload used to add scale and language diversity: `https://github.com/herdrdev/herdr.git`. +5. `managed terminal` — larger open-source, multi-language workload used to add scale and language diversity: `https://github.com/managed terminaldev/managed terminal.git`. -The repository identities are fixed for this corpus generation. The exact commit for each entry is deliberately captured from the actual frozen checkout used to initialize `luigi.home.arpa`; do not substitute current remote HEAD during planning. Once those commits are recorded, changing any one of them creates a new corpus generation and requires a new baseline. +The repository identities are fixed for this corpus generation. The exact commit for each entry is deliberately captured from the actual frozen checkout used to initialize `the qualification host`; do not substitute current remote HEAD during planning. Once those commits are recorded, changing any one of them creates a new corpus generation and requires a new baseline. ## Trial design @@ -94,7 +94,7 @@ Repeated read operations receive one unrecorded warm-up before recorded timings. ## Host controls -Run all comparative trials on `luigi.home.arpa` with: +Run all comparative trials on `the qualification host` with: - same Windows build; - same power plan; diff --git a/docs/WINDOWS_BENCHMARK_RUNBOOK.md b/docs/WINDOWS_BENCHMARK_RUNBOOK.md index 0381630103..d27cc4bb1d 100644 --- a/docs/WINDOWS_BENCHMARK_RUNBOOK.md +++ b/docs/WINDOWS_BENCHMARK_RUNBOOK.md @@ -1,6 +1,6 @@ # Windows RC Benchmark Runbook -This runbook establishes `windows-corpus-1` and captures the first Windows CLI baseline on `luigi.home.arpa` from the exact release-candidate executable. The first qualified CLI release is **BASELINE_ZERO**: its measurements become generation zero; they are not compared to the older MCP-era release. +This runbook establishes `windows-corpus-1` and captures the first Windows CLI baseline on `the qualification host` from the exact release-candidate executable. The first qualified CLI release is **BASELINE_ZERO**: its measurements become generation zero; they are not compared to the older MCP-era release. ## Fixed five-repository corpus @@ -12,7 +12,7 @@ The repository identities are fixed. Do not substitute repositories without crea | `specgen-aw` | `https://github.com/ngallodev-software/specgen-aw.git` | SpecGen `0.2.1`, `master`; snapshot observed 2026-09-08: `466debfec788c7aeeee858c6b51e98b1b9afe653`. | | `agent-workflow` | `https://github.com/ngallodev-software/agent-workflow.git` | Agent-Workflow `0.10.0`, `master`; snapshot observed 2026-09-08: `e84925205301ff7169aff5a8cb14d10680c3739c`. | | `agent-workflow-spec-contracts` | `https://github.com/ngallodev-software/agent-workflow-spec-contracts.git` | released tag `v0.2.1`; commit `0b32e556ef33bd00c0111d30a8b9225eb5196fcd`. | -| `herdr` | `https://github.com/herdrdev/herdr.git` | `master`; snapshot observed 2026-09-08: `68c7b78ec237034cbb0e21c8666842ed7991641d`. | +| `managed terminal` | `https://github.com/managed terminaldev/managed terminal.git` | `master`; snapshot observed 2026-09-08: `68c7b78ec237034cbb0e21c8666842ed7991641d`. | The two moving `master` references above are **initialization references only**. Once `BENCHMARK_CORPUS.json` is frozen on Luigi, its exact commit SHAs are authoritative even when upstream moves. diff --git a/docs/WINDOWS_RELEASE_VALIDATION.md b/docs/WINDOWS_RELEASE_VALIDATION.md index 48800dc1a9..ae22691875 100644 --- a/docs/WINDOWS_RELEASE_VALIDATION.md +++ b/docs/WINDOWS_RELEASE_VALIDATION.md @@ -2,7 +2,7 @@ Status: **AUTHORITATIVE EXTERNAL QUALIFICATION PROCEDURE** -Authoritative host: `luigi.home.arpa` (Windows 11 x64). +Authoritative host: `the qualification host` (Windows 11 x64). This procedure validates the exact GitHub release-candidate bytes. It does not build the executable locally. diff --git a/docs/agents/GITHUB_RC_DISPATCH_AGENT.md b/docs/agents/GITHUB_RC_DISPATCH_AGENT.md index dd772840d2..3f2557820f 100644 --- a/docs/agents/GITHUB_RC_DISPATCH_AGENT.md +++ b/docs/agents/GITHUB_RC_DISPATCH_AGENT.md @@ -2,7 +2,7 @@ Status: **STANDALONE RELEASE-OPERATOR INSTRUCTIONS** -Use this runbook after Linux qualification has reached the release-candidate boundary and before native-Windows qualification on `luigi.home.arpa`. +Use this runbook after Linux qualification has reached the release-candidate boundary and before native-Windows qualification on `the qualification host`. ## Objective @@ -113,7 +113,7 @@ Record the release asset listing and release ID in the evidence bundle. ## Step 6 — Create Windows qualification handoff -Provide the Windows qualification agent on `luigi.home.arpa` with: +Provide the Windows qualification agent on `the qualification host` with: - release tag; - release URL/ID; diff --git a/docs/agents/WINDOWS_RELEASE_QUALIFICATION_AGENT.md b/docs/agents/WINDOWS_RELEASE_QUALIFICATION_AGENT.md index 08ac9fe172..a0a0edba13 100644 --- a/docs/agents/WINDOWS_RELEASE_QUALIFICATION_AGENT.md +++ b/docs/agents/WINDOWS_RELEASE_QUALIFICATION_AGENT.md @@ -2,7 +2,7 @@ Status: **STANDALONE OPERATOR/AGENT INSTRUCTIONS** -You are qualifying a `codebase-memory-cli` release candidate on the authoritative Windows host `luigi.home.arpa`. +You are qualifying a `codebase-memory-cli` release candidate on the authoritative Windows host `the qualification host`. Your job is to collect evidence, not to improve the product during the run. @@ -199,7 +199,7 @@ Only after every required gate is PASS (or the first qualified release legitimat 2. copy the final human summary to `qualification-summary.md`; 3. compute SHA-256 of `qualification-summary.md` and store it as `summary_sha256`; 4. record the exact draft tag, Windows ZIP SHA-256, and extracted `codebase-memory-cli.exe` SHA-256 in `release`; -5. set `host` to `luigi.home.arpa` and `corpus_generation` to `windows-corpus-1`; +5. set `host` to `the qualification host` and `corpus_generation` to `windows-corpus-1`; 6. set `portable_result`, `installed_result`, `windows_guards_result`, and `recovery_result` to `PASS`; 7. set `benchmark_result` to `PASS`, or `BASELINE_ZERO` only when establishing the first qualified baseline; 8. upload both files to the existing GitHub DRAFT release with authenticated `gh release upload`; @@ -213,7 +213,7 @@ Required manifest shape: { "schema_version": 1, "result": "PASS", - "host": "luigi.home.arpa", + "host": "the qualification host", "corpus_generation": "windows-corpus-1", "portable_result": "PASS", "installed_result": "PASS", diff --git a/docs/CLI_MIGRATION_STATUS.md b/docs/internal/CLI_MIGRATION_STATUS.md similarity index 97% rename from docs/CLI_MIGRATION_STATUS.md rename to docs/internal/CLI_MIGRATION_STATUS.md index 11b70dd227..746794568e 100644 --- a/docs/CLI_MIGRATION_STATUS.md +++ b/docs/internal/CLI_MIGRATION_STATUS.md @@ -4,7 +4,7 @@ This repository is the CLI-only fork and C port of Codebase Memory MCP. The MCP server and third-party MCP integration surface were removed to meet workplace policies that prohibit third-party MCP servers; the local graph, indexing, daemon, watcher, and analysis capabilities remain. -> **Planning re-baseline (CP61):** the CLI-first/MCP-removal architecture phase is closed unless qualification evidence exposes a concrete defect. Remaining work is release qualification: Linux consolidation, immutable GitHub RC artifacts, native Windows validation on `luigi.home.arpa`, frozen-corpus comparative benchmarking, agent usability, production skill, and release decision. See `docs/RELEASE_QUALIFICATION_PLAN.md`. +> **Planning re-baseline (CP61):** the CLI-first/MCP-removal architecture phase is closed unless qualification evidence exposes a concrete defect. Remaining work is release qualification: Linux consolidation, immutable GitHub RC artifacts, native Windows validation on `the qualification host`, frozen-corpus comparative benchmarking, agent usability, production skill, and release decision. See `docs/RELEASE_QUALIFICATION_PLAN.md`. **Updated:** 2026-09-03 **Current authoritative baseline:** latest complete consolidated source attached to the project sources page @@ -253,16 +253,16 @@ unoptimized/older binary was used for measurements. See `docs/PERFORMANCE_BASELI ## CP61 — Release qualification planning re-baseline - **COMPLETE:** migration-era sequencing is superseded by `docs/RELEASE_QUALIFICATION_PLAN.md`; further architecture changes require evidence from qualification rather than generic cleanup. -- **COMPLETE:** native Windows release validation is specified as an external procedure against immutable GitHub-published bytes on `luigi.home.arpa`; portable and installed forms are both required. +- **COMPLETE:** native Windows release validation is specified as an external procedure against immutable GitHub-published bytes on `the qualification host`; portable and installed forms are both required. - **COMPLETE:** comparative Windows benchmarking is specified around a frozen repository corpus, exact artifact identity, fresh-cache alternating trials, correctness/shape parity, and retained raw evidence. - **COMPLETE:** a standalone Windows qualification-agent runbook defines acquisition, identity verification, frozen-corpus checks, functional/recovery testing, install/update/uninstall validation, benchmarking, failure classification, and evidence summary requirements. - **COMPLETE:** benchmark corpus revisions are immutable within a corpus generation. Any repository revision change creates a new generation and requires a new baseline capture rather than comparison against older results. -- **REMAINING:** finalize the exact `agent-workflow` remote and select/pin the fourth larger open-source repository already available on `r6d12`/the qualification environment. +- **REMAINING:** finalize the exact `agent-workflow` remote and select/pin the fourth larger open-source repository already available on the CI host / the qualification environment. - **REMAINING:** complete Linux consolidation, publish an immutable GitHub release candidate, execute native Windows qualification and comparative baselines, then run agent usability and produce the final product skill. ## CP62 — Frozen benchmark corpus finalization -**COMPLETE (planning):** `windows-corpus-1` now has fixed repository identities: codebase-memory-cli, specgen-aw, agent-workflow, agent-workflow-spec-contracts, and herdr. Repository remotes are explicit in `docs/qualification/BENCHMARK_CORPUS.json`. Exact commit SHAs remain deliberately unset until the one-time initialization reads them from the actual clean frozen checkouts used on `luigi.home.arpa`; after pinning, any commit change creates a new corpus generation and requires new baseline capture. +**COMPLETE (planning):** `windows-corpus-1` now has fixed repository identities: codebase-memory-cli, specgen-aw, agent-workflow, agent-workflow-spec-contracts, and managed terminal. Repository remotes are explicit in `docs/qualification/BENCHMARK_CORPUS.json`. Exact commit SHAs remain deliberately unset until the one-time initialization reads them from the actual clean frozen checkouts used on `the qualification host`; after pinning, any commit change creates a new corpus generation and requires new baseline capture. @@ -276,7 +276,7 @@ The current optimized production build has not yet reached final link within thi ## CP64 — external qualification release hold -**COMPLETE:** GitHub release preparation now defaults to a draft external-qualification hold. A separate promotion workflow validates `luigi.home.arpa` qualification evidence against the exact Windows release archive/executable hashes before registry publication or public un-drafting. Linux broad sanitized qualification remains in progress due build duration; no source failure has surfaced in the incremental build. +**COMPLETE:** GitHub release preparation now defaults to a draft external-qualification hold. A separate promotion workflow validates `the qualification host` qualification evidence against the exact Windows release archive/executable hashes before registry publication or public un-drafting. Linux broad sanitized qualification remains in progress due build duration; no source failure has surfaced in the incremental build. ### CP65 — RC dispatch reproducibility (release qualification) @@ -405,7 +405,7 @@ Status: **IMPLEMENTED / REQUIRES EXTERNAL RERUN** ### CP86 — Windows benchmark automation and CLI contract repair - **COMPLETE (static implementation):** added native Windows benchmark execution (`scripts/benchmark-agent-workflows.ps1`) and five-repository corpus orchestration (`scripts/qualification/run-windows-benchmark-corpus.ps1`) while retaining exact candidate-byte provenance. -- **COMPLETE:** reconciled the benchmark integration set to SpecGen `0.2.1`, Agent-Workflow `0.10.0`, shared contracts `v0.2.1`, and the selected `herdr` scale corpus. +- **COMPLETE:** reconciled the benchmark integration set to SpecGen `0.2.1`, Agent-Workflow `0.10.0`, shared contracts `v0.2.1`, and the selected `managed terminal` scale corpus. - **EVIDENCE:** external full-suite execution reduced CLI failures from 64 to 22; every non-CLI suite remained green. ### CP87 — CLI test-contract closeout @@ -421,7 +421,7 @@ Status: **IMPLEMENTED / REQUIRES EXTERNAL RERUN** - **FIXED (benchmark correctness):** the PowerShell benchmark harness now fails a repository run on any required warm-up/measured operation failure and emits explicit `RESULT`/`FAILURES.txt` evidence instead of silently excluding failures from performance summaries. - **FIXED (evidence isolation):** corpus initialization writes the frozen manifest into the qualification evidence tree rather than dirtying the exact RC source checkout. - **RECONCILED:** the last two known Claude-hook tests now enforce exact current CLI command ownership while preserving MCP-era hook identities as foreign, matching the CP78 side-by-side contract. -- **PENDING EXTERNAL EVIDENCE:** run the external CLI/full suite after CP88 and then execute the Windows RC orchestrator on `luigi.home.arpa` against the immutable draft artifact. No compile or test execution was performed locally for CP88. +- **PENDING EXTERNAL EVIDENCE:** run the external CLI/full suite after CP88 and then execute the Windows RC orchestrator on `the qualification host` against the immutable draft artifact. No compile or test execution was performed locally for CP88. ### CP89 — Windows RC qualification provenance closeout diff --git a/docs/internal/README.md b/docs/internal/README.md new file mode 100644 index 0000000000..0e9ee61f96 --- /dev/null +++ b/docs/internal/README.md @@ -0,0 +1 @@ +Working notes kept for history; not maintained as user documentation. diff --git a/docs/RUNTIME_ASSURANCE_PLAN.md b/docs/internal/RUNTIME_ASSURANCE_PLAN.md similarity index 100% rename from docs/RUNTIME_ASSURANCE_PLAN.md rename to docs/internal/RUNTIME_ASSURANCE_PLAN.md diff --git a/docs/specs/upstream-next-three/cache-stores/SPEC.md b/docs/internal/specs/upstream-next-three/cache-stores/SPEC.md similarity index 93% rename from docs/specs/upstream-next-three/cache-stores/SPEC.md rename to docs/internal/specs/upstream-next-three/cache-stores/SPEC.md index c2ef758ebd..32fe86db55 100644 --- a/docs/specs/upstream-next-three/cache-stores/SPEC.md +++ b/docs/internal/specs/upstream-next-three/cache-stores/SPEC.md @@ -237,19 +237,19 @@ _None._ ### `SRC-USER` — Provenance sources -- **Description:** Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive Herdr panes. +- **Description:** Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive managed terminals. - **Kind:** user_input ### `SRC-BASE` — Provenance sources - **Description:** Exact release-tooling source baseline and selected upstream diffs - **Kind:** repository -- **Locator:** /tmp/claude-1000/-lump-apps-codebase-memory-cli/70854de5-bd44-40b4-8ac2-4cf2d6b24d01/scratchpad/wt-rt +- **Locator:** local run evidence - **Revision:** 5824239b9c37664f0a389bd1deb86ca1ac28a26c ## Extensions -`{"delivery":{"interactive_host":"Herdr; launch pending managed-session context","production_branch":"main","promotion":"Future origin PR targets main after QA passing; no automatic merge/tag/release.","push_gate":"Exact-SHA shared Jenkins required before remote push.","qa_branch":"release-tooling","review":"Worker commits are candidates; parent evaluation/review/acceptance remain separate.","sync_policy":"Frozen shared QA baseline; parent reconciles with normal merges, never rewrites published history.","version_gate":"No version/tag changes for these compatible fixes.","worker_permissions":"danger-full-access; approval never"}}` +`{"delivery":{"interactive_host":"managed terminal; launch pending managed-session context","production_branch":"main","promotion":"Future origin PR targets main after QA passing; no automatic merge/tag/release.","push_gate":"Exact-SHA shared Jenkins required before remote push.","qa_branch":"release-tooling","review":"Worker commits are candidates; parent evaluation/review/acceptance remain separate.","sync_policy":"Frozen shared QA baseline; parent reconciles with normal merges, never rewrites published history.","version_gate":"No version/tag changes for these compatible fixes.","worker_permissions":"danger-full-access; approval never"}}` ## Traceability diff --git a/docs/specs/upstream-next-three/cache-stores/spec.json b/docs/internal/specs/upstream-next-three/cache-stores/spec.json similarity index 98% rename from docs/specs/upstream-next-three/cache-stores/spec.json rename to docs/internal/specs/upstream-next-three/cache-stores/spec.json index 5c31f900a5..3a745b51fb 100644 --- a/docs/specs/upstream-next-three/cache-stores/spec.json +++ b/docs/internal/specs/upstream-next-three/cache-stores/spec.json @@ -124,7 +124,7 @@ ], "extensions": { "delivery": { - "interactive_host": "Herdr; launch pending managed-session context", + "interactive_host": "managed terminal; launch pending managed-session context", "production_branch": "main", "promotion": "Future origin PR targets main after QA passing; no automatic merge/tag/release.", "push_gate": "Exact-SHA shared Jenkins required before remote push.", @@ -212,7 +212,7 @@ "provenance": { "sources": [ { - "description": "Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive Herdr panes.", + "description": "Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive managed terminals.", "id": "SRC-USER", "kind": "user_input" }, @@ -220,7 +220,7 @@ "description": "Exact release-tooling source baseline and selected upstream diffs", "id": "SRC-BASE", "kind": "repository", - "locator": "/tmp/claude-1000/-lump-apps-codebase-memory-cli/70854de5-bd44-40b4-8ac2-4cf2d6b24d01/scratchpad/wt-rt", + "locator": "local run evidence, "revision": "5824239b9c37664f0a389bd1deb86ca1ac28a26c" } ] diff --git a/docs/specs/upstream-next-three/daemon-ownership/SPEC.md b/docs/internal/specs/upstream-next-three/daemon-ownership/SPEC.md similarity index 94% rename from docs/specs/upstream-next-three/daemon-ownership/SPEC.md rename to docs/internal/specs/upstream-next-three/daemon-ownership/SPEC.md index 29f36a6cb3..eefde3b8d8 100644 --- a/docs/specs/upstream-next-three/daemon-ownership/SPEC.md +++ b/docs/internal/specs/upstream-next-three/daemon-ownership/SPEC.md @@ -237,19 +237,19 @@ _None._ ### `SRC-USER` — Provenance sources -- **Description:** Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive Herdr panes. +- **Description:** Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive managed terminals. - **Kind:** user_input ### `SRC-BASE` — Provenance sources - **Description:** Exact release-tooling source baseline and selected upstream diffs - **Kind:** repository -- **Locator:** /tmp/claude-1000/-lump-apps-codebase-memory-cli/70854de5-bd44-40b4-8ac2-4cf2d6b24d01/scratchpad/wt-rt +- **Locator:** local run evidence - **Revision:** 5824239b9c37664f0a389bd1deb86ca1ac28a26c ## Extensions -`{"delivery":{"interactive_host":"Herdr; launch pending managed-session context","production_branch":"main","promotion":"Future origin PR targets main after QA passing; no automatic merge/tag/release.","push_gate":"Exact-SHA shared Jenkins required before remote push.","qa_branch":"release-tooling","review":"Worker commits are candidates; parent evaluation/review/acceptance remain separate.","sync_policy":"Frozen shared QA baseline; parent reconciles with normal merges, never rewrites published history.","version_gate":"No version/tag changes for these compatible fixes.","worker_permissions":"danger-full-access; approval never"}}` +`{"delivery":{"interactive_host":"managed terminal; launch pending managed-session context","production_branch":"main","promotion":"Future origin PR targets main after QA passing; no automatic merge/tag/release.","push_gate":"Exact-SHA shared Jenkins required before remote push.","qa_branch":"release-tooling","review":"Worker commits are candidates; parent evaluation/review/acceptance remain separate.","sync_policy":"Frozen shared QA baseline; parent reconciles with normal merges, never rewrites published history.","version_gate":"No version/tag changes for these compatible fixes.","worker_permissions":"danger-full-access; approval never"}}` ## Traceability diff --git a/docs/specs/upstream-next-three/daemon-ownership/spec.json b/docs/internal/specs/upstream-next-three/daemon-ownership/spec.json similarity index 98% rename from docs/specs/upstream-next-three/daemon-ownership/spec.json rename to docs/internal/specs/upstream-next-three/daemon-ownership/spec.json index 0b1257439e..97c9df1d8f 100644 --- a/docs/specs/upstream-next-three/daemon-ownership/spec.json +++ b/docs/internal/specs/upstream-next-three/daemon-ownership/spec.json @@ -124,7 +124,7 @@ ], "extensions": { "delivery": { - "interactive_host": "Herdr; launch pending managed-session context", + "interactive_host": "managed terminal; launch pending managed-session context", "production_branch": "main", "promotion": "Future origin PR targets main after QA passing; no automatic merge/tag/release.", "push_gate": "Exact-SHA shared Jenkins required before remote push.", @@ -212,7 +212,7 @@ "provenance": { "sources": [ { - "description": "Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive Herdr panes.", + "description": "Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive managed terminals.", "id": "SRC-USER", "kind": "user_input" }, @@ -220,7 +220,7 @@ "description": "Exact release-tooling source baseline and selected upstream diffs", "id": "SRC-BASE", "kind": "repository", - "locator": "/tmp/claude-1000/-lump-apps-codebase-memory-cli/70854de5-bd44-40b4-8ac2-4cf2d6b24d01/scratchpad/wt-rt", + "locator": "local run evidence, "revision": "5824239b9c37664f0a389bd1deb86ca1ac28a26c" } ] diff --git a/docs/specs/upstream-next-three/rescript-hang/SPEC.md b/docs/internal/specs/upstream-next-three/rescript-hang/SPEC.md similarity index 93% rename from docs/specs/upstream-next-three/rescript-hang/SPEC.md rename to docs/internal/specs/upstream-next-three/rescript-hang/SPEC.md index 35a4a6c715..114c33f183 100644 --- a/docs/specs/upstream-next-three/rescript-hang/SPEC.md +++ b/docs/internal/specs/upstream-next-three/rescript-hang/SPEC.md @@ -238,19 +238,19 @@ _None._ ### `SRC-USER` — Provenance sources -- **Description:** Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive Herdr panes. +- **Description:** Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive managed terminals. - **Kind:** user_input ### `SRC-BASE` — Provenance sources - **Description:** Exact release-tooling source baseline and selected upstream diffs - **Kind:** repository -- **Locator:** /tmp/claude-1000/-lump-apps-codebase-memory-cli/70854de5-bd44-40b4-8ac2-4cf2d6b24d01/scratchpad/wt-rt +- **Locator:** local run evidence - **Revision:** 5824239b9c37664f0a389bd1deb86ca1ac28a26c ## Extensions -`{"delivery":{"interactive_host":"Herdr; launch pending managed-session context","production_branch":"main","promotion":"Future origin PR targets main after QA passing; no automatic merge/tag/release.","push_gate":"Exact-SHA shared Jenkins required before remote push.","qa_branch":"release-tooling","review":"Worker commits are candidates; parent evaluation/review/acceptance remain separate.","sync_policy":"Frozen shared QA baseline; parent reconciles with normal merges, never rewrites published history.","version_gate":"No version/tag changes for these compatible fixes.","worker_permissions":"danger-full-access; approval never"}}` +`{"delivery":{"interactive_host":"managed terminal; launch pending managed-session context","production_branch":"main","promotion":"Future origin PR targets main after QA passing; no automatic merge/tag/release.","push_gate":"Exact-SHA shared Jenkins required before remote push.","qa_branch":"release-tooling","review":"Worker commits are candidates; parent evaluation/review/acceptance remain separate.","sync_policy":"Frozen shared QA baseline; parent reconciles with normal merges, never rewrites published history.","version_gate":"No version/tag changes for these compatible fixes.","worker_permissions":"danger-full-access; approval never"}}` ## Traceability diff --git a/docs/specs/upstream-next-three/rescript-hang/spec.json b/docs/internal/specs/upstream-next-three/rescript-hang/spec.json similarity index 98% rename from docs/specs/upstream-next-three/rescript-hang/spec.json rename to docs/internal/specs/upstream-next-three/rescript-hang/spec.json index f13bcc4129..8a19e1e9c7 100644 --- a/docs/specs/upstream-next-three/rescript-hang/spec.json +++ b/docs/internal/specs/upstream-next-three/rescript-hang/spec.json @@ -125,7 +125,7 @@ ], "extensions": { "delivery": { - "interactive_host": "Herdr; launch pending managed-session context", + "interactive_host": "managed terminal; launch pending managed-session context", "production_branch": "main", "promotion": "Future origin PR targets main after QA passing; no automatic merge/tag/release.", "push_gate": "Exact-SHA shared Jenkins required before remote push.", @@ -213,7 +213,7 @@ "provenance": { "sources": [ { - "description": "Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive Herdr panes.", + "description": "Implement the three selected verticals with GPT-6-Luna, full permissions, isolated worktrees and interactive managed terminals.", "id": "SRC-USER", "kind": "user_input" }, @@ -221,7 +221,7 @@ "description": "Exact release-tooling source baseline and selected upstream diffs", "id": "SRC-BASE", "kind": "repository", - "locator": "/tmp/claude-1000/-lump-apps-codebase-memory-cli/70854de5-bd44-40b4-8ac2-4cf2d6b24d01/scratchpad/wt-rt", + "locator": "local run evidence, "revision": "5824239b9c37664f0a389bd1deb86ca1ac28a26c" } ] diff --git a/docs/qualification/BENCHMARK_CORPUS.json b/docs/qualification/BENCHMARK_CORPUS.json index b09746ab18..cbf35021ad 100644 --- a/docs/qualification/BENCHMARK_CORPUS.json +++ b/docs/qualification/BENCHMARK_CORPUS.json @@ -1,7 +1,7 @@ { "schema": "codebase-memory-cli/benchmark-corpus/v1", "generation": "windows-corpus-1", - "host": "luigi.home.arpa", + "host": "the qualification host", "repositories": [ { "id": "codebase-memory-cli", @@ -124,9 +124,9 @@ } }, { - "id": "herdr", - "name": "herdr", - "remote": "https://github.com/herdrdev/herdr.git", + "id": "managed terminal", + "name": "managed terminal", + "remote": "https://github.com/managed terminaldev/managed terminal.git", "commit": "TO_BE_PINNED_FROM_FROZEN_CHECKOUT", "clean_required": true, "category": "large-open-source-scale-language-coverage", diff --git a/docs/upstream-sync/PLAN.md b/docs/upstream-sync/PLAN.md index 8c408d9a2d..a09513b9d9 100644 --- a/docs/upstream-sync/PLAN.md +++ b/docs/upstream-sync/PLAN.md @@ -34,7 +34,7 @@ To verify PRs automatically, an operator should configure a Jenkins GitHub Branc ## Platform and benchmark follow-up -Use the existing pinned corpus at `benchmark-runs/linux/20260911T045124Z/BENCHMARK_CORPUS.frozen.json` for Linux/Windows parity: codebase-memory-cli `0c6d00d6011c1fdb50b90c53538f536cc3b5e4d9`, specgen-aw `466debfec788c7aeeee858c6b51e98b1b9afe653`, agent-workflow `e84925205301ff7169aff5a8cb14d10680c3739c`, agent-workflow-spec-contracts `0b32e556ef33bd00c0111d30a8b9225eb5196fcd`, and herdr `61ca85d5895bb530b59da85beeccdd767f4720d2`. Preserve these manifest pins; candidate version and platform evidence are separate. No current benchmark or Windows result is implied by this inventory. +Use the existing pinned corpus at `benchmark-runs/linux/20260911T045124Z/BENCHMARK_CORPUS.frozen.json` for Linux/Windows parity: codebase-memory-cli `0c6d00d6011c1fdb50b90c53538f536cc3b5e4d9`, specgen-aw `466debfec788c7aeeee858c6b51e98b1b9afe653`, agent-workflow `e84925205301ff7169aff5a8cb14d10680c3739c`, agent-workflow-spec-contracts `0b32e556ef33bd00c0111d30a8b9225eb5196fcd`, and managed terminal. Preserve these manifest pins; candidate version and platform evidence are separate. No current benchmark or Windows result is implied by this inventory. ## Delivery checkpoint diff --git a/docs/upstream-sync/security.md b/docs/upstream-sync/security.md index fc42c8ddee..a7b6785bd1 100644 --- a/docs/upstream-sync/security.md +++ b/docs/upstream-sync/security.md @@ -1,6 +1,6 @@ # Security hotfix receipt -Base: `ff8b8906c6807953336609cc7f464e7e4ef3cf7b` +Base: `ff8b8906c6807953336609cc7f464e7e4ef3cf7b` Branch: `sync/security-20261101` ## Changes