Repository navigation
Decisions of 2026-09-28 (later): no rollback and Recovery mode (0166); the Platform Launchpad replaces the resident one (0167); the Team exception ends and the strict install command (0168) - #442
Conversation
…; the Platform Launchpad replaces the resident one without a side-by-side period (0167); the Team Environment works through the Organization's bot and the 0159 exception ends there, strict first-install command (0168) Records three decisions of the Principal in the public decision register and aligns the texts that would otherwise become false: amendment markers on 0049, 0137, 0148, 0159, 0161, 0164 and 0165; the Launchpad lifecycle and Hosted Resident rollback passages of ARCHITECTURE.md; the Team VM sign-in rules of the hosted first-login manual and the workspace root instructions. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ith state transfer; canary on the pilot Organization's work VMs and its operators' personal VMs Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… shaping's proposal Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
agentrozjedemeai
left a comment
agentrozjedemeai
left a comment
There was a problem hiding this comment.
CHANGES_REQUESTED na exact head f4e7936 (main 7a81278). Dvě věcné nesrovnalosti v nové autoritě 0168: (1) Manuál prvního přihlášení na ř. 50 pořád říká, že owner.assignment určuje jen postup, nikoli kdo se smí přihlásit, a souhrn na ř. 199 říká, že přihlášení neomezuje; nová týmová větev na ř. 40–41 a 129–135 naopak osobní přihlášení zakazuje. Vymezte výjimku jen pro osobní pracovní VM, případně opravte nejednoznačný fallback při neplatném assignmentu. (2) 0168 bod 2 přítomným časem tvrdí, že LazurioPlatform osobní gh/SSH přihlášení již odmítá a umožňuje odhlášení; odkazovaný LazurioPlatform #66 je stále OPEN. Formulujte jako cílové chování / rozpracovaný PR, ne jako vydanou vlastnost. Ostatní revizní vztahy 0049/0137/0148/0159/0161/0164/0165 a body 0166–0167 drží hranici dosavadních Root instalací, shaping návrhů (0167 body 2, 9), nehotového Recovery, zvláštního Machines rozhodnutí i směrů traileru a přestavby osobních VM. Rezidentní Launchpad zůstává do cutoveru. Bezpečnostní scan přidaných řádků a git diff --check čisté. Lokálně 50 cílených testů prošlo, doctor:agent-skills OK, pr:preflight na dočasné feature branch ready (detached preflight vyžaduje branch). Exact-head CI: Ubuntu bun run check a guide/npm gates zelené, Windows bun run check při podání review ještě IN_PROGRESS; znovu ověřit na opraveném headu. macOS plný bun run check jsem zde neopakoval (autor uvádí 13 známých baseline selhání). Nejde o návrh merge; žádný merge jsem neprovedl. @immakermatty prosím srovnat uvedené věty a vrátit nový head k review.
…; the first-login manual no longer says the assignment does not limit the sign-in Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…orary Environment URL as a lease; the Folder manual tells agents never to send a localhost link Pablo's review of LazurioPlatform #65 found the preview direction attributed to the Principal without a register record. The Principal decided it on 2026-09-28 in the working thread (temporary URL registered like a module's hostname, cleanup after 24 hours and when the port dies; the VM profile must tell agents how previews work so operators never get a localhost link). The row 0167 now carries the addendum, rows 0049 and 0137 point to it instead of calling the preview an open question; the rules stay a shaping proposal. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…2, the handover example carries a real port and the wire-to-binding projection, the switch removes only the proven Machines-owned resident unit Pablo's review of a52d93c: (1) the preview direction is now recorded as the 2026-09-28 addendum of root decision 0167 (HumanAndMachines/Lazurio#442) and cited here; the F22 block labels the launchpad.gen3*.json successor question (H5) as the unconfirmed proposal it is. (2) The handover example used listen_port 0, which parseHostedEntry refuses; it is now the real route port and the projection of every wire member into the binding is specified. (3) The point of no return removes the resident unit only after positive proof (byte-for-byte the unit Machines renders for this Machine, no Platform marker); any other unit is foreign and stops the apply, as the product's own rule says. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
There was a problem hiding this comment.
CHANGES_REQUESTED — exact head af9d907. The earlier f4e7936 CHANGES_REQUESTED verdict was not reused.
-
manual/hosted-machine-first-login.md:63–65: The 0168 summary at line 50 is corrected, but if lazurio.machine.json is missing/invalid or owner.assignment is undeclared, the active fallback still treats the Machine as an operator VM and permits a personal gh sign-in. It cannot prove the Machine is not a Team VM. This leaves the original fail-open finding open (existing thread discussion_r4122261119). Please fail closed for personal sign-in until kind/assignment is established, or document a verified alternate identity gate.
-
manual/decision-register.md:103: 0049 and 0137 now point to the 0167 addendum and correctly separate the URL direction from shaping. Inside 0167 the still-active “Otevřené: náhled pull requestu”/“Otázka se navrhne ... později” contradicts the later decision unless marked as the earlier historical state. The addendum also attributes “úklid po 24 hodinách, úklid, když port zemře” specifically to the Principal, whereas Lazurio/LazurioPlatform#65 H3 and B14 call 24h and free-port cleanup open design rules. Mark the old wording as superseded and the specific cleanup mechanics as proposed, unless a precise founder decision explicitly approved them (then reconcile #65).
Evidence: git diff --check origin/main...HEAD clean; live main 7a81278 merges cleanly with this head; 15 focused Bun tests passed, doctor:agent-skills OK; all six exact-head GitHub checks SUCCESS (Ubuntu/Windows bun run check, guide build, three npm gates). No local full suite was run; no merge. Added-line safety scan found no secrets or runnable destructive changes. @immakermatty please repair both and request a fresh exact-head review.
…s its earlier open state as superseded and keeps the lease rules a proposal Pablo's review 5339555709: (1) the first-login manual let a missing or invalid handover fall back to a personal work VM and a personal gh sign-in, which cannot rule out a Team VM; the agent now performs no personal sign-in until the handover proves the kind and assignment. (2) Row 0167 still called the preview an open question next to its addendum and attributed the 24-hour and port-death cleanup to the Principal as decided; the earlier state is marked as superseded and the cleanup mechanics are the Principal's examples of the direction, the rules remaining LazurioPlatform #65 proposal B14. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… lease rules stay a proposal Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
agentrozjedemeai
left a comment
agentrozjedemeai
left a comment
There was a problem hiding this comment.
CHANGES_REQUESTED — exact head d11ccba (main 7a81278). @immakermatty
-
[P1] The manual fixes its fallback at manual/hosted-machine-first-login.md:63–69, but the same manual at :38–40 still says a missing/invalid owner.assignment is not a sign-in blocker. More importantly, distribution/profiles/workspace/root-instructions.md:47–54 (the generated resident instruction for agents) explicitly routes a missing/invalid assignment to the personal flow and asks the operator to sign in. On a Team VM without a valid handover this remains a fail-open personal gh sign-in path, contrary to 0168. Change both summaries so personal sign-in requires a valid workspace-vm/operator handover; otherwise report the state, ask Machines to verify via resident
lazurio machine inspect, and continue only work needing no sign-in. I leave discussion_r4122261119 unresolved because this original boundary is still broken on the distributed surface. -
[P2] ARCHITECTURE.md:277–281 newly calls the hosted PR preview an “open design question”; 0167 now decides the direction (temporary Environment URL as a lease), while only the concrete lease rules remain proposed in LazurioPlatform #65 H3/B14. Align this new architecture sentence and the PR description, which also still says the preview itself is an open question. The 0167 historical row and 24-hour/port-death examples now correctly distinguish founder direction from proposed lease rules; I resolved the earlier discussion_r4122881509 after checking #65.
Evidence: git diff --check clean; focused tests passed after completing the temporary clone objects (the initial partial-clone fixture failure was environmental), doctor:agent-skills OK. All six exact-head GitHub checks SUCCESS, including Windows. No merge. Please repair both and request a fresh review on the new head.
…uctions and ARCHITECTURE agree — no personal sign-in without a valid handover; the preview direction is decided Pablo's review 5340031936: the manual's summary at the top still said the assignment never limits the sign-in and the distributed root-instructions routed a missing or invalid assignment into the personal sign-in procedure, contradicting the fail-closed rule below; ARCHITECTURE.md and the PR body still called the pull-request preview an open question. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
agentrozjedemeai
left a comment
agentrozjedemeai
left a comment
There was a problem hiding this comment.
APPROVED — exact head 39bc88d (main 7a81278). @immakermatty Both findings from review 5340031936 are fixed. manual/hosted-machine-first-login.md:36–42 and :63–70, together with distribution/profiles/workspace/root-instructions.md:47–63, distinguish a valid operator handover (any chosen GitHub account) from missing/invalid/undeclared handover (no personal sign-in; report and ask Machines to verify), and keep team VMs bot-only as in 0168. Resolved discussion_r4122261119 after readback. ARCHITECTURE.md:277–285, the 0167 addendum and the PR description agree: the hosted PR preview gets a temporary Environment URL as a lease; concrete lease rules remain shaping proposals. Local frozen-checkout git diff --check clean; 24 focused Bun tests pass; doctor:agent-skills OK. All six GitHub checks completed SUCCESS for this exact head, all three review threads resolved, no pending review requests, PR mergeable. This is a QA verdict, not a merge; no merge performed.
…chpad and replaces it (proposed decision F22) (#65) * Shaping: Launchpad parity, the Platform Launchpad replaces the resident in one apply Inventory of every resident Launchpad capability against the Platform, the concept-by-concept design (CLI first, no new Folder state), the hosted switch without a side-by-side period and without rollback (depends on F21 Recovery mode), workstation parity for macOS, slices with the switch line, what is not carried over, risks and questions. Proposes F22. Analysis only, no code. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Launchpad parity shaping: record the Principal's decisions of 2026-09-28 H1: canonical-only Organizations run applications (F22 point 1 stands). H3: previews of a pull request on hosted Work Machines go through SSH port forwarding to a localhost link, so P9 leaves the switch line; recommended to drop it. H4: agent-led clone until P10. H6: Lazurio-Environment trailer. H2, H5, H7 stay open; implementation proceeds on the recommendations. The three drops of section F are confirmed. The approved shell's proof of concept finishes in the resident Launchpad and is the input for the visual design (B1, G). Linux means Ubuntu 24.04 in the first phase (C.5, E). Machines does not roll back either (C.6). The strict install one-liner. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Launchpad parity shaping: preview path open, personal VMs on Ubuntu H3: SSH port forwarding with a localhost link works only when an agent on the operator's own computer is connected over SSH, not from the web T3 Code on the Machine. The preview path is an open design question (candidates: SSH forwarding, a per-worktree hostname through the gateway); P9 stays off the switch line and is not dropped. Hosted personal VMs are rebuilt on Ubuntu 24.04 at the next Machines rollout; recommended as a separate Machines slice M6, before M5. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Launchpad parity shaping: worktree previews as leases, M6 carries state H3 decided in direction: a worktree gets a temporary Environment URL registered like a module's hostname. New B14 proposes the rules: a catalog declaration served as a plain admitted proxy, a lease with a 24-hour time to live renewed on open, ended by unit exit, free port, removed worktree or a merged or closed pull request (checked on open and list), a cap per Machine, "Stop preview", no Folder state. The label keeps root decision 0146's single hyphen because the catalog merges "--"; one label stays under the Machine's wildcard certificate. P9 stays off the switch line. M6 becomes a rebuild with state transfer: Machine identity, tailnet node, SSH host keys and the operator's home including the Buddy are carried and proven by a readback; the inventory is part of the slice. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Launchpad parity shaping: M6 acceptance without re-pairing, preview guidance in the Folder M6: acceptance criteria as the Principal states them, each with its readback: T3 Code pairing keeps working, the Buddy is back with its memory, SSH works with the same keys and host identity, the gh sign-in is intact; the outage window is announced beforehand. T3 Code's pairing state is carried explicitly. P9/B14: the hosted Folder instructions tell agents that a preview is reached only through its temporary URL or the operator's own SSH forwarding, never a localhost link (template revision bump); an interim sentence goes into the hosted manual at the next template change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Parity shaping: H3 cites the 0167 addendum, H5 stays a proposal in F22, the handover example carries a real port and the wire-to-binding projection, the switch removes only the proven Machines-owned resident unit Pablo's review of a52d93c: (1) the preview direction is now recorded as the 2026-09-28 addendum of root decision 0167 (HumanAndMachines/Lazurio#442) and cited here; the F22 block labels the launchpad.gen3*.json successor question (H5) as the unconfirmed proposal it is. (2) The handover example used listen_port 0, which parseHostedEntry refuses; it is now the real route port and the projection of every wire member into the binding is specified. (3) The point of no return removes the resident unit only after positive proof (byte-for-byte the unit Machines renders for this Machine, no Platform marker); any other unit is foreign and stops the apply, as the product's own rule says. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Proč
Principál 2026-09-28 (odpoledne až noc) rozhodl další věci, které mění dřívější rozhodnutí. Bez zápisu do registru by žily jen v chatu.
Co se mění
Nové 0166: Lazurio nemá rollback; Recovery režim. Žádný
update rollback, žádná jednotka pro rollback, žádná ponechaná předchozí verze ani automatický návrat po nezdravém restartu. Rollbackem není a zůstává: atomické selhání jedné operace, odmítnutí dřív, než se cokoli změní, a odmítnutí downgradu. Když je Lazurio rozbité, nabízí jen spuštění agenta, který opraví vpřed nebo založí issue; každý vstup do Recovery režimu končí issue. Machines se řídí stejným pravidlem. Vydání po stupních, zkušební běh 8 hodin na pracovních VM pilotní Organizace a osobních VM jejích operátorů. Automatické issue nese jen strukturovaná pole, volný text opouští Mašinu jen rukou agenta.Nové 0167: Launchpad LazurioPlatform nahradí rezidentní Launchpad bez souběhu. Maximální priorita, CLI first, přepnutí jedním applyem bez cesty zpět, Ubuntu jako Linux první fáze, osobní VM přejdou na Ubuntu 24.04 přestavbou s převodem stavu (Owner se znovu nepřihlašuje ani nepáruje), co se ze starého Launchpadu záměrně nepřebírá, náhled pull requestu dostane dočasnou URL Environmentu jako lease (dodatek 0167 z téhož dne; pravidla lease zůstávají návrhem shapingu), trailer
Lazurio-Environment, schválený shell jako proof of concept.Nové 0168: konec výjimky 0159 pro Pracovní týmové Environment; přísný instalační příkaz. Týmová VM funguje s botem Organizace hned po předání; chybějící broker je vada Machines, ne důvod přihlásit člověka.
Značky v dřívějších řádcích: 0049, 0137, 0148, 0159, 0161, 0164, 0165. Sjednocené texty v
ARCHITECTURE.md, manuálu prvního přihlášení a instrukcích rezidentního profilu.Co se nemění
Pravidla instalací Root Repa a jejich Launchpadu do migrace; 0047, 0132, 0146, 0157; 0147 a 0149 se potvrzují.
Co text poctivě netvrdí jako hotové
Recovery režim se staví (LazurioPlatform #64, #65 jsou shaping, implementace probíhá), vydané releases rollback dosud obsahují; změna rolí Machines je samostatné rozhodnutí; trailer
Lazurio-Environmentje směr; přestavba osobních VM je navazující krok Machines. Kde je něco návrh shapingu a ne výslovné rozhodnutí Principála, řádek to říká.Ověření
Testy registru, terminologie, hranice veřejných příkladů a kontraktu integrací: 276 prošlo.
doctor:agent-skillsok,pr:preflightready.bun run checkna macOS padá jen ve 13 testechmacos-launcher-installer, které stejně padají namain.🤖 Generated with Claude Code