diff --git a/.egg-state/brc-history/3200-implement-slice-3.json b/.egg-state/brc-history/3200-implement-slice-3.json new file mode 100644 index 0000000000..997732b04d --- /dev/null +++ b/.egg-state/brc-history/3200-implement-slice-3.json @@ -0,0 +1,749 @@ +[ + { + "id": "55134257-0286-42", + "pipeline_id": "issue-3200", + "from_role": "tester", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=propose (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:21:45.898740+00:00", + "phase": "implement" + }, + { + "id": "5ba05389-7b39-47", + "pipeline_id": "issue-3200", + "from_role": "coder", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=propose (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:21:45.905746+00:00", + "phase": "implement" + }, + { + "id": "751f46b5-d4ab-4e", + "pipeline_id": "issue-3200", + "from_role": "documenter", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=propose (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:21:46.367947+00:00", + "phase": "implement" + }, + { + "id": "d373dada-3ca2-4e", + "pipeline_id": "issue-3200", + "from_role": "documenter", + "to_role": "all", + "message_type": "CONSENSUS_PROPOSE", + "subject": "Proposal from documenter", + "body": "documenter no-op for slice-3 (derive #3189 anchor fields). This slice is pure internal-substrate derivation (shared/egg_anchor model extension + orchestrator-sourced anchor computation) plus fixture-based unit tests, with no documenter task and no user-facing documentation surface. No docs change is warranted at this layer; mechanism documentation belongs to the later flag-gating/generalization slices and the PR phase. Proposing no_changes_needed so consensus is not blocked on the documenter for slice-3.", + "metadata": { + "payload": { + "summary": "documenter no-op for slice-3 (derive #3189 anchor fields). This slice is pure internal-substrate derivation (shared/egg_anchor model extension + orchestrator-sourced anchor computation) plus fixture-based unit tests, with no documenter task and no user-facing documentation surface. No docs change is warranted at this layer; mechanism documentation belongs to the later flag-gating/generalization slices and the PR phase. Proposing no_changes_needed so consensus is not blocked on the documenter for slice-3.", + "attestation": {}, + "artifacts": [], + "risk_considered": "", + "commit_sha": "", + "files_changed": [], + "tests_run": [], + "tasks_satisfied": [], + "no_changes_needed": true, + "no_changes_reason": "Slice-3 derives the four #3189 anchor fields (last-reviewed SHA/producer, latest verdicts, open NACK reasons, conditional-ACK obligations) deterministically from the BRC message record and extends the shared/egg_anchor model additively. Both tasks (task-3-1 derivation, task-3-2 fixture tests) are pure internal substrate/code + unit tests with no documenter assignment and no user-facing documentation surface. User-facing docs for the overall context-discipline mechanism are appropriate once the feature is wired behind the flag (later slices) / at the PR phase, not for this isolated derivation layer. No documentation changes needed in this slice \u2014 consistent with the documenter no-op in slice-1." + }, + "version": 1, + "commit_sha": "", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:22:30.879784+00:00", + "phase": "implement" + }, + { + "id": "28f2612b-19fe-4b", + "pipeline_id": "issue-3200", + "from_role": "coder", + "to_role": "all", + "message_type": "CONSENSUS_PROPOSE", + "subject": "Proposal from coder", + "body": "slice-3 / task-3-1: deterministic derivation of the four #3189 BRC anchors from the message record. New shared/egg_anchor/brc_derive.py:derive_brc_anchors(messages) consumes the serialized BRC message record (read_peer_artifact / _write_brc_history shape) and mechanically computes: (i) last-reviewed SHA per producer (latest reviewed proposal_commit_sha), (ii) latest verdict per reviewer->producer edge (ACK/NACK/conditional-ACK), (iii) open NACK reasons (current-version NACKs not yet superseded by a re-propose), (iv) conditional-ACK obligations (pre_merge_condition, resolved/unresolved). Reads only structured message fields \u2014 never agent-authored prose \u2014 and mirrors orchestrator.peer_consensus replay semantics (versions advance on re-propose; superseded-version verdicts/obligations become historical) without importing the orchestrator package. egg_anchor models extended additively (ReviewVerdict, ReviewEdgeVerdict, OpenNack, ConditionalAckObligation, BRCDerivedAnchors + optional BRCState.derived default None); legacy BRCState.acks/nacks/last_message_id untouched. Verified deterministic + order-stable against the real .egg-state/brc-history record and a synthetic fixture (ACK->re-propose->NACK, conditional-ACK unresolved, obligation-resolved); AgentAnchor to_dict/from_dict round-trips; ruff+mypy clean; existing 98 egg_anchor tests pass. Tests for the fixture stream are task-3-2 (tester).", + "metadata": { + "payload": { + "summary": "slice-3 / task-3-1: deterministic derivation of the four #3189 BRC anchors from the message record. New shared/egg_anchor/brc_derive.py:derive_brc_anchors(messages) consumes the serialized BRC message record (read_peer_artifact / _write_brc_history shape) and mechanically computes: (i) last-reviewed SHA per producer (latest reviewed proposal_commit_sha), (ii) latest verdict per reviewer->producer edge (ACK/NACK/conditional-ACK), (iii) open NACK reasons (current-version NACKs not yet superseded by a re-propose), (iv) conditional-ACK obligations (pre_merge_condition, resolved/unresolved). Reads only structured message fields \u2014 never agent-authored prose \u2014 and mirrors orchestrator.peer_consensus replay semantics (versions advance on re-propose; superseded-version verdicts/obligations become historical) without importing the orchestrator package. egg_anchor models extended additively (ReviewVerdict, ReviewEdgeVerdict, OpenNack, ConditionalAckObligation, BRCDerivedAnchors + optional BRCState.derived default None); legacy BRCState.acks/nacks/last_message_id untouched. Verified deterministic + order-stable against the real .egg-state/brc-history record and a synthetic fixture (ACK->re-propose->NACK, conditional-ACK unresolved, obligation-resolved); AgentAnchor to_dict/from_dict round-trips; ruff+mypy clean; existing 98 egg_anchor tests pass. Tests for the fixture stream are task-3-2 (tester).", + "attestation": {}, + "artifacts": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py" + ], + "risk_considered": "Additive-only model change (new optional field + new sibling models) preserves the existing BRCState schema and AgentAnchor serialization (None-default field omitted by to_dict). Derivation tolerates pre-versioning historical messages (version fallback to producer's current proposal) and missing/empty metadata/payload defensively. No orchestrator dependency, so the shared package stays import-light.", + "commit_sha": "34278c681", + "files_changed": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "tests_run": [], + "tasks_satisfied": [ + "task-3-1" + ], + "no_changes_needed": false, + "no_changes_reason": "" + }, + "version": 1, + "commit_sha": "34278c681", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:02.109257+00:00", + "phase": "implement" + }, + { + "id": "f5827665-5fbb-43", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:09.717717+00:00", + "phase": "implement" + }, + { + "id": "31932193-44b5-4a", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:09.745977+00:00", + "phase": "implement" + }, + { + "id": "b537bf08-c657-49", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:11.147276+00:00", + "phase": "implement" + }, + { + "id": "a5292b8f-6185-4a", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:12.689936+00:00", + "phase": "implement" + }, + { + "id": "c8193200-4c6f-46", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:13.683691+00:00", + "phase": "implement" + }, + { + "id": "1d889305-7440-42", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_security for coder", + "body": "Security review clean. Pure additive deterministic derivation (brc_derive.derive_brc_anchors) + additive egg_anchor models. No dangerous sinks (no eval/exec/pickle/subprocess/file/network/secrets), no untrusted deserialization, no injection sinks. Reads only structured message fields and deliberately excludes free-form `body` prose \u2014 a trust-boundary positive that prevents agent narration from poisoning reseed-gating anchors. bool-rejection in _version and to_role=='all' filtering are correct. O(n), no regex/ReDoS. No new attack surface.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "Security review clean. Pure additive deterministic derivation (brc_derive.derive_brc_anchors) + additive egg_anchor models. No dangerous sinks (no eval/exec/pickle/subprocess/file/network/secrets), no untrusted deserialization, no injection sinks. Reads only structured message fields and deliberately excludes free-form `body` prose \u2014 a trust-boundary positive that prevents agent narration from poisoning reseed-gating anchors. bool-rejection in _version and to_role=='all' filtering are correct. O(n), no regex/ReDoS. No new attack surface.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:30:16.443882+00:00", + "phase": "implement" + }, + { + "id": "cd6ddecf-aec9-43", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_concurrency for coder", + "body": "Concurrency review PASS. derive_brc_anchors is a pure function: no module-level mutable state (only immutable str constants + __all__), all working state is function-local, so it is thread-safe across concurrent event-pump agents. No input mutation \u2014 _ordered materializes a fresh list(messages), messages are read-only via .get(), and the sole state[\"resolved\"]=True write targets brc_derive's own local edge dict, not the shared message snapshot. Deterministic replay order via (timestamp,id) tiebreak matches peer_consensus.py:2172 canonical ordering; outputs sorted by (producer,reviewer). Verified the one race that could drop a live NACK \u2014 version inflation under rapid/auto re-propose \u2014 is not possible: CONSENSUS_PROPOSE messages stamp metadata.version on both the manual (signals.py:2129) and auto-push (signals.py:3224) paths, and _version() reads the stamped version first; the incrementing fallback only triggers for legacy unstamped messages. No concurrency blockers.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "Concurrency review PASS. derive_brc_anchors is a pure function: no module-level mutable state (only immutable str constants + __all__), all working state is function-local, so it is thread-safe across concurrent event-pump agents. No input mutation \u2014 _ordered materializes a fresh list(messages), messages are read-only via .get(), and the sole state[\"resolved\"]=True write targets brc_derive's own local edge dict, not the shared message snapshot. Deterministic replay order via (timestamp,id) tiebreak matches peer_consensus.py:2172 canonical ordering; outputs sorted by (producer,reviewer). Verified the one race that could drop a live NACK \u2014 version inflation under rapid/auto re-propose \u2014 is not possible: CONSENSUS_PROPOSE messages stamp metadata.version on both the manual (signals.py:2129) and auto-push (signals.py:3224) paths, and _version() reads the stamped version first; the incrementing fallback only triggers for legacy unstamped messages. No concurrency blockers.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:32:55.876428+00:00", + "phase": "implement" + }, + { + "id": "18641460-6594-4b", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_contract for coder", + "body": "Contract-conformance ACK for slice-3 / task-3-1 (commit 34278c681). All acceptance criteria met: (1) the four #3189 anchors derive purely and mechanically from the BRC message record \u2014 derive_brc_anchors reads only structured fields (message_type/from_role/to_role/metadata[.payload]), never agent prose; NACK reason comes from structured payload.reason, not the free-form body. (2) Models extended additively \u2014 BRCDerivedAnchors + BRCState.derived (default None); acks/nacks/last_message_id at models.py:189+ keep their original agent-id-list meaning untouched, so no existing field breaks. (3) The four computations are correct against the real serialization schema: field-reading probes both metadata and metadata.payload defensively (version via metadata.version|payload.version|ack_version|nack_version; pre_merge_condition/resolved_in_diff via payload; OBLIGATION_RESOLVED via metadata.reviewer_role/producer_role), so it matches what signals.py actually stamps. last-reviewed SHA = SHA of highest reviewed version; open NACKs and conditional-ACK obligations correctly gated to the producer's current proposal version (re-propose supersedes), with resolved/unresolved replayed in chronological order. (4) No agent-authored content enters this layer. Output is deterministic (sorted edge keys + SHA map). Touching only shared/egg_anchor/ (not orchestrator/) is correct by design \u2014 the task requires the derivation to avoid an orchestrator dependency. Tests are the separate pending task-3-2.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "Contract-conformance ACK for slice-3 / task-3-1 (commit 34278c681). All acceptance criteria met: (1) the four #3189 anchors derive purely and mechanically from the BRC message record \u2014 derive_brc_anchors reads only structured fields (message_type/from_role/to_role/metadata[.payload]), never agent prose; NACK reason comes from structured payload.reason, not the free-form body. (2) Models extended additively \u2014 BRCDerivedAnchors + BRCState.derived (default None); acks/nacks/last_message_id at models.py:189+ keep their original agent-id-list meaning untouched, so no existing field breaks. (3) The four computations are correct against the real serialization schema: field-reading probes both metadata and metadata.payload defensively (version via metadata.version|payload.version|ack_version|nack_version; pre_merge_condition/resolved_in_diff via payload; OBLIGATION_RESOLVED via metadata.reviewer_role/producer_role), so it matches what signals.py actually stamps. last-reviewed SHA = SHA of highest reviewed version; open NACKs and conditional-ACK obligations correctly gated to the producer's current proposal version (re-propose supersedes), with resolved/unresolved replayed in chronological order. (4) No agent-authored content enters this layer. Output is deterministic (sorted edge keys + SHA map). Touching only shared/egg_anchor/ (not orchestrator/) is correct by design \u2014 the task requires the derivation to avoid an orchestrator dependency. Tests are the separate pending task-3-2.", + "ack_version": 1, + "attestation": { + "tasks_verified": [ + "task-3-1" + ] + } + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:33:21.891549+00:00", + "phase": "implement" + }, + { + "id": "d7849a9a-efdc-49", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_code_holistic for coder", + "body": "Holistic review PASS (first review, slice-3 task-3-1). derive_brc_anchors mechanically derives the four #3189 anchors from the BRC message record, and I verified it end-to-end \u2014 not just by reading. Ran the PROPOSED code against the REAL .egg-state/brc-history/3200-implement-slice-2.json record: it produced exactly-correct anchors (last_reviewed_sha coder->55387ff1, tester->335979385; 11 latest verdicts), and crucially it correctly SUPERSEDED reviewer_code_holistic's earlier NACK-on-tester with its later ACK (edge resolves to ack, open_nacks empty) \u2014 confirming the chronological replay + latest-verdict-per-edge logic mirrors orchestrator.peer_consensus without depending on it. Field-reading matches actual orchestrator message shapes (cross-checked signals.py + the live record): ACK carries metadata.version, NACK carries metadata.version=None with payload.nack_version (the _version() fallback chain handles this exact case), ACK/NACK to_role is the producer role (so the ==\\\"all\\\" guard doesn't drop verdicts), pre_merge_condition is in payload, OBLIGATION_RESOLVED carries reviewer_role/producer_role in metadata. Determinism holds (identical output under shuffled input; outputs sorted by (producer,reviewer); empty input safe). open_nacks/obligations correctly gated on version==producer-current so re-propose supersedes. Models are additive: BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched, None-omitting serialization keeps legacy anchors byte-identical. ruff clean; bool-is-int-subclass rejection in _version handled. Non-blocking note for the slice-4/5 consumer: CONSENSUS_WITHDRAW is not handled (would leave a stale edge), but the four enumerated message types are exactly the documented task scope, so out of scope here.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "Holistic review PASS (first review, slice-3 task-3-1). derive_brc_anchors mechanically derives the four #3189 anchors from the BRC message record, and I verified it end-to-end \u2014 not just by reading. Ran the PROPOSED code against the REAL .egg-state/brc-history/3200-implement-slice-2.json record: it produced exactly-correct anchors (last_reviewed_sha coder->55387ff1, tester->335979385; 11 latest verdicts), and crucially it correctly SUPERSEDED reviewer_code_holistic's earlier NACK-on-tester with its later ACK (edge resolves to ack, open_nacks empty) \u2014 confirming the chronological replay + latest-verdict-per-edge logic mirrors orchestrator.peer_consensus without depending on it. Field-reading matches actual orchestrator message shapes (cross-checked signals.py + the live record): ACK carries metadata.version, NACK carries metadata.version=None with payload.nack_version (the _version() fallback chain handles this exact case), ACK/NACK to_role is the producer role (so the ==\\\"all\\\" guard doesn't drop verdicts), pre_merge_condition is in payload, OBLIGATION_RESOLVED carries reviewer_role/producer_role in metadata. Determinism holds (identical output under shuffled input; outputs sorted by (producer,reviewer); empty input safe). open_nacks/obligations correctly gated on version==producer-current so re-propose supersedes. Models are additive: BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched, None-omitting serialization keeps legacy anchors byte-identical. ruff clean; bool-is-int-subclass rejection in _version handled. Non-blocking note for the slice-4/5 consumer: CONSENSUS_WITHDRAW is not handled (would leave a stale edge), but the four enumerated message types are exactly the documented task scope, so out of scope here.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:13.551428+00:00", + "phase": "implement" + }, + { + "id": "37f0f439-8eb7-43", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_code for coder", + "body": "ACK slice-3 task-3-1 (derive #3189 BRC anchors). Verified field extraction against the real orchestrator serialization (routes/signals.py + message_store.py): PROPOSE version=metadata.version, commit_sha=metadata.commit_sha w/ payload fallback; ACK version=metadata.version/payload.ack_version; NACK version=payload.nack_version (NACK carries no metadata.version \u2014 the _version() fallback chain handles it); NACK reason=payload.reason; pre_merge_condition + ..._resolved_in_diff under payload; OBLIGATION_RESOLVED uses metadata.reviewer_role/producer_role with no payload wrapper. All paths match. Derivation is purely mechanical (reads only structured fields, never body prose) \u2014 satisfies the no-agent-content AC. Replay semantics correct: superseded-version NACKs/obligations drop out of open_nacks/obligations on re-propose (verified by smoke test: NACK@v1 dropped after re-propose to v2; obligation resolution via both pre_merge_condition_resolved_in_diff and the OBLIGATION_RESOLVED message works). Models extended additively \u2014 BRCState.acks/nacks/last_message_id untouched, derived defaults None on legacy anchors. Deterministic: identical output under input reordering. ruff clean; 98 existing egg_anchor tests pass, no regression. Non-blocking notes for the wiring slices (not this task): last_reviewed_sha is a producer-level rollup (max version across reviewers) but per-edge reviewed_sha is preserved in latest_verdicts for the slice-4 role-parameterized root; and the deriver is slice-agnostic so callers must pass a per-slice record (read_peer_artifact/_write_brc_history already partition per slice). Tests are task-3-2 (tester).", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "ACK slice-3 task-3-1 (derive #3189 BRC anchors). Verified field extraction against the real orchestrator serialization (routes/signals.py + message_store.py): PROPOSE version=metadata.version, commit_sha=metadata.commit_sha w/ payload fallback; ACK version=metadata.version/payload.ack_version; NACK version=payload.nack_version (NACK carries no metadata.version \u2014 the _version() fallback chain handles it); NACK reason=payload.reason; pre_merge_condition + ..._resolved_in_diff under payload; OBLIGATION_RESOLVED uses metadata.reviewer_role/producer_role with no payload wrapper. All paths match. Derivation is purely mechanical (reads only structured fields, never body prose) \u2014 satisfies the no-agent-content AC. Replay semantics correct: superseded-version NACKs/obligations drop out of open_nacks/obligations on re-propose (verified by smoke test: NACK@v1 dropped after re-propose to v2; obligation resolution via both pre_merge_condition_resolved_in_diff and the OBLIGATION_RESOLVED message works). Models extended additively \u2014 BRCState.acks/nacks/last_message_id untouched, derived defaults None on legacy anchors. Deterministic: identical output under input reordering. ruff clean; 98 existing egg_anchor tests pass, no regression. Non-blocking notes for the wiring slices (not this task): last_reviewed_sha is a producer-level rollup (max version across reviewers) but per-edge reviewed_sha is preserved in latest_verdicts for the slice-4 role-parameterized root; and the deriver is slice-agnostic so callers must pass a per-slice record (read_peer_artifact/_write_brc_history already partition per slice). Tests are task-3-2 (tester).", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:43.900548+00:00", + "phase": "implement" + }, + { + "id": "c0981656-e036-4b", + "pipeline_id": "issue-3200", + "from_role": "tester", + "to_role": "all", + "message_type": "CONSENSUS_PROPOSE", + "subject": "Proposal from tester", + "body": "slice-3 (task-3-2): tests for the #3189 deterministic BRC anchor derivation, aligned to the merged coder implementation (task-3-1: derive_brc_anchors / BRCDerivedAnchors). Adds shared/egg_anchor/tests/test_brc_anchor_derivation.py and orchestrator/tests/test_brc_anchor_derivation.py. All 9 tests pass. Covers the four derived fields against a realistic AC-scenario message record (multiple producers; ACK-then-repropose+NACK; an unresolved obligation and a resolved-in-cycle obligation): last_reviewed_sha per producer (current reviewed head, superseded SHA absent); latest_verdicts per reviewer->producer edge; open_nacks reason on the current proposal version; conditional_ack_obligations with resolved/unresolved status flipped by CONSENSUS_OBLIGATION_RESOLVED; deterministic output (slice-4 byte-stability prereq); an ApprovalMatrix substrate cross-check; and BRCState legacy-field non-regression for the additive model extension.", + "metadata": { + "payload": { + "summary": "slice-3 (task-3-2): tests for the #3189 deterministic BRC anchor derivation, aligned to the merged coder implementation (task-3-1: derive_brc_anchors / BRCDerivedAnchors). Adds shared/egg_anchor/tests/test_brc_anchor_derivation.py and orchestrator/tests/test_brc_anchor_derivation.py. All 9 tests pass. Covers the four derived fields against a realistic AC-scenario message record (multiple producers; ACK-then-repropose+NACK; an unresolved obligation and a resolved-in-cycle obligation): last_reviewed_sha per producer (current reviewed head, superseded SHA absent); latest_verdicts per reviewer->producer edge; open_nacks reason on the current proposal version; conditional_ack_obligations with resolved/unresolved status flipped by CONSENSUS_OBLIGATION_RESOLVED; deterministic output (slice-4 byte-stability prereq); an ApprovalMatrix substrate cross-check; and BRCState legacy-field non-regression for the additive model extension.", + "attestation": { + "tests_run": 9, + "checks_passed": [ + "test", + "lint", + "security" + ], + "tests_passed": 9, + "tests_skipped": 0, + "test_command": "pytest shared/egg_anchor/tests/test_brc_anchor_derivation.py orchestrator/tests/test_brc_anchor_derivation.py", + "lint": "ruff check clean", + "security": "manual review: test-only files, no exec/subprocess/network/secrets; bandit unavailable in sandbox", + "notes": "All 9 tests pass against merged coder impl 34278c681." + }, + "artifacts": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py", + "3c0c9ad5a" + ], + "risk_considered": "Changed files are test-only (pytest fixtures + asserts): no subprocess/eval/network/filesystem/secret handling, so zero security surface. bandit is not installed in this sandbox; security attested via manual review of the diff. lint (ruff) and the 9-test suite were executed and pass.", + "commit_sha": "3c0c9ad5a", + "files_changed": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "tests_run": [], + "tasks_satisfied": [ + "task-3-2" + ], + "no_changes_needed": false, + "no_changes_reason": "" + }, + "version": 1, + "commit_sha": "3c0c9ad5a", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:54.658138+00:00", + "phase": "implement" + }, + { + "id": "255855d1-9b48-41", + "pipeline_id": "issue-3200", + "from_role": "orchestrator", + "to_role": "documenter", + "message_type": "STATUS", + "subject": "Ready to confirm \u2014 all confirm preconditions satisfied", + "body": "Your proposal (version 1) is ready to confirm \u2014 all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm.", + "metadata": { + "ready_to_confirm": true, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:54.660116+00:00", + "phase": "implement" + }, + { + "id": "88066e33-2c64-49", + "pipeline_id": "issue-3200", + "from_role": "documenter", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by documenter", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:57.918580+00:00", + "phase": "implement" + }, + { + "id": "f462b025-7ad2-44", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_security for tester", + "body": "Security review clean. Test-only change aligning slice-3 fixtures to the merged coder derivation (brc_derive.derive_brc_anchors). No dangerous sinks: no eval/exec/pickle/subprocess/file/network/secrets, no untrusted deserialization, no injection. The only flagged constructs are __import__ calls in the skip-guard locators, which iterate hardcoded module-name allowlists with no untrusted input \u2014 standard parallel-BRC test pattern. pre_merge_condition strings (\"git mv old new\", \"update import path\") are inert fixture data asserted on, never executed. Fixtures exercise the same structured-field-only derivation already reviewed and ACKed for the coder. No new attack surface.", + "metadata": { + "payload": { + "artifact_references": [ + "orchestrator/tests/test_brc_anchor_derivation.py", + "shared/egg_anchor/tests/test_brc_anchor_derivation.py" + ], + "reason": "Security review clean. Test-only change aligning slice-3 fixtures to the merged coder derivation (brc_derive.derive_brc_anchors). No dangerous sinks: no eval/exec/pickle/subprocess/file/network/secrets, no untrusted deserialization, no injection. The only flagged constructs are __import__ calls in the skip-guard locators, which iterate hardcoded module-name allowlists with no untrusted input \u2014 standard parallel-BRC test pattern. pre_merge_condition strings (\"git mv old new\", \"update import path\") are inert fixture data asserted on, never executed. Fixtures exercise the same structured-field-only derivation already reviewed and ACKed for the coder. No new attack surface.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:35:55.262917+00:00", + "phase": "implement" + }, + { + "id": "91581d7d-9882-40", + "pipeline_id": "issue-3200", + "from_role": "coder", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by coder", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:35:56.961713+00:00", + "phase": "implement" + }, + { + "id": "ed948970-93f5-4d", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_security", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:35:56.964741+00:00", + "phase": "implement" + }, + { + "id": "9a1ed663-7385-4b", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_concurrency for tester", + "body": "Concurrency review PASS (first review, v1). The slice-3 derivation tests align fixtures to the merged derive_brc_anchors contract and introduce no concurrency hazards: each test builds fresh fixtures via _scenario_messages()/_build_scenario_matrix() (new lists+dicts per call), module state is limited to immutable SHA_* string constants, and there are no shared mutable fixtures \u2014 so the suite is safe under pytest-xdist parallelism with no test-ordering interference. The function under test is pure/thread-safe (verified for coder); fixtures feed read-only dicts and the two _derive calls in test_derivation_is_deterministic never mutate input. Determinism is asserted, locking the slice-4 reproducibility prereq. Non-blocking coverage note: fixtures omit `timestamp`, so _ordered (brc_derive.py:118-124) takes its input-order fallback rather than the (timestamp,id) canonical-sort path; the determinism test thus validates same-order reproducibility but not order-independence \u2014 the actual convergence guarantee for concurrent event-pump agents. That property is correctly implemented in already-ACKed derivation code, so this is a coverage gap not a defect. No concurrency blockers.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "reason": "Concurrency review PASS (first review, v1). The slice-3 derivation tests align fixtures to the merged derive_brc_anchors contract and introduce no concurrency hazards: each test builds fresh fixtures via _scenario_messages()/_build_scenario_matrix() (new lists+dicts per call), module state is limited to immutable SHA_* string constants, and there are no shared mutable fixtures \u2014 so the suite is safe under pytest-xdist parallelism with no test-ordering interference. The function under test is pure/thread-safe (verified for coder); fixtures feed read-only dicts and the two _derive calls in test_derivation_is_deterministic never mutate input. Determinism is asserted, locking the slice-4 reproducibility prereq. Non-blocking coverage note: fixtures omit `timestamp`, so _ordered (brc_derive.py:118-124) takes its input-order fallback rather than the (timestamp,id) canonical-sort path; the determinism test thus validates same-order reproducibility but not order-independence \u2014 the actual convergence guarantee for concurrent event-pump agents. That property is correctly implemented in already-ACKed derivation code, so this is a coverage gap not a defect. No concurrency blockers.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:36:35.937877+00:00", + "phase": "implement" + }, + { + "id": "0666e4b8-5149-48", + "pipeline_id": "issue-3200", + "from_role": "orchestrator", + "to_role": "coder", + "message_type": "STATUS", + "subject": "Ready to confirm \u2014 all confirm preconditions satisfied", + "body": "Your proposal (version 1) is ready to confirm \u2014 all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm.", + "metadata": { + "ready_to_confirm": true, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:36:35.940695+00:00", + "phase": "implement" + }, + { + "id": "de055fe3-f600-4c", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_concurrency", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:36:38.302556+00:00", + "phase": "implement" + }, + { + "id": "5c9dbf47-08cf-4d", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_code_holistic for tester", + "body": "Holistic review PASS (first review, slice-3 task-3-2). Verified end-to-end, not just by reading: ran BOTH test files at proposed commit 3c0c9ad5a against the merged derive_brc_anchors implementation -> 9 passed, 0 skipped. The delta realigns the fixtures from the old _Msg attribute-class shape (to_role hardcoded 'all', producer in metadata.producer_role, proposal_commit_sha helpers) to the merged plain-dict contract: producer carried in to_role, version/commit_sha/pre_merge_condition/reason in nested metadata. This alignment was NECESSARY and correct -- derive_brc_anchors reads producer=msg.get('to_role') and skips to_role=='all', so the pre-merge fixtures would have produced empty edges and failed; the realigned fixtures exercise the real four-field derivation (last_reviewed_sha supersedes coder v1->v2 to SHA_CODER_V2, NACK 'missing guard' surfaced on current version, conditional-ACK obligation 'git mv old new' unresolved vs tester's 'update import path' resolved via OBLIGATION_RESOLVED, deterministic output). Strong per-edge assertions live on the orchestrator side (test_derivation_agrees_with_matrix) which also cross-checks the REAL ApprovalMatrix substrate un-guarded; the egg_anchor side deliberately uses tolerant _get/_flatten matching to stay field-name-agnostic. Scope clean: two test files only, no production code; legacy BRCState non-regression passes (additive extension intact). Both locators resolve derive_brc_anchors via the egg_anchor package re-export (__init__.py __all__) despite the module being brc_derive.py. No blockers.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "reason": "Holistic review PASS (first review, slice-3 task-3-2). Verified end-to-end, not just by reading: ran BOTH test files at proposed commit 3c0c9ad5a against the merged derive_brc_anchors implementation -> 9 passed, 0 skipped. The delta realigns the fixtures from the old _Msg attribute-class shape (to_role hardcoded 'all', producer in metadata.producer_role, proposal_commit_sha helpers) to the merged plain-dict contract: producer carried in to_role, version/commit_sha/pre_merge_condition/reason in nested metadata. This alignment was NECESSARY and correct -- derive_brc_anchors reads producer=msg.get('to_role') and skips to_role=='all', so the pre-merge fixtures would have produced empty edges and failed; the realigned fixtures exercise the real four-field derivation (last_reviewed_sha supersedes coder v1->v2 to SHA_CODER_V2, NACK 'missing guard' surfaced on current version, conditional-ACK obligation 'git mv old new' unresolved vs tester's 'update import path' resolved via OBLIGATION_RESOLVED, deterministic output). Strong per-edge assertions live on the orchestrator side (test_derivation_agrees_with_matrix) which also cross-checks the REAL ApprovalMatrix substrate un-guarded; the egg_anchor side deliberately uses tolerant _get/_flatten matching to stay field-name-agnostic. Scope clean: two test files only, no production code; legacy BRCState non-regression passes (additive extension intact). Both locators resolve derive_brc_anchors via the egg_anchor package re-export (__init__.py __all__) despite the module being brc_derive.py. No blockers.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:37:35.023142+00:00", + "phase": "implement" + }, + { + "id": "98213206-e3da-49", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_code_holistic", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:37:35.632248+00:00", + "phase": "implement" + }, + { + "id": "1b41298c-8ffa-47", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_contract for tester", + "body": "Contract-conformance ACK for slice-3/task-3-2 (commit 3c0c9ad5a): tests aligned to the merged derive_brc_anchors. Fixtures faithfully match the real serialization contract (plain message dicts with nested metadata; verdicts carry the producer in to_role; version/commit_sha/pre_merge_condition/reason in metadata; OBLIGATION_RESOLVED carries reviewer_role/producer_role) \u2014 the inaccurate dual attribute/dict _Msg shim was correctly dropped. All four #3189 anchors are asserted: (i) last-reviewed SHA per producer (coder->v2, tester->v1, superseded v1 absent), (ii) latest verdict per reviewer->producer edge, (iii) open NACK reason on current version (\"missing guard\"), (iv) conditional-ACK obligations resolved/unresolved. Assertions match real model field names and ReviewVerdict enum values exactly. The orchestrator file adds an ApprovalMatrix ground-truth cross-check locking the anchors as a deterministic projection of the existing consensus substrate; legacy BRCState non-regression and determinism are also covered. Verified against the merged implementation (local brc_derive.py byte-identical to 3c0c9ad5a): ran both files \u2014 9 passed, 0 skipped, confirming the previously skip-guarded assertions now activate per the slice-3 \"Derive\" merge convention. No blockers.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "reason": "Contract-conformance ACK for slice-3/task-3-2 (commit 3c0c9ad5a): tests aligned to the merged derive_brc_anchors. Fixtures faithfully match the real serialization contract (plain message dicts with nested metadata; verdicts carry the producer in to_role; version/commit_sha/pre_merge_condition/reason in metadata; OBLIGATION_RESOLVED carries reviewer_role/producer_role) \u2014 the inaccurate dual attribute/dict _Msg shim was correctly dropped. All four #3189 anchors are asserted: (i) last-reviewed SHA per producer (coder->v2, tester->v1, superseded v1 absent), (ii) latest verdict per reviewer->producer edge, (iii) open NACK reason on current version (\"missing guard\"), (iv) conditional-ACK obligations resolved/unresolved. Assertions match real model field names and ReviewVerdict enum values exactly. The orchestrator file adds an ApprovalMatrix ground-truth cross-check locking the anchors as a deterministic projection of the existing consensus substrate; legacy BRCState non-regression and determinism are also covered. Verified against the merged implementation (local brc_derive.py byte-identical to 3c0c9ad5a): ran both files \u2014 9 passed, 0 skipped, confirming the previously skip-guarded assertions now activate per the slice-3 \"Derive\" merge convention. No blockers.", + "ack_version": 1, + "attestation": { + "tasks_verified": [ + "task-3-2" + ] + } + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:37:53.175862+00:00", + "phase": "implement" + }, + { + "id": "92c7997b-7171-4e", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_contract", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:37:57.673227+00:00", + "phase": "implement" + }, + { + "id": "4c8b3378-6e41-47", + "pipeline_id": "issue-3200", + "from_role": "tester", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from tester for coder", + "body": "tester review of slice-3 task-3-1 (derive #3189 BRC anchors). Verified the derivation against real orchestrator replay semantics (peer_consensus.py replay + signals.py emission): PROPOSE producer=from_role with authoritative metadata.version; ACK/NACK producer=to_role with payload.ack_version/nack_version; OBLIGATION_RESOLVED roles from metadata. The version-increment path is a legacy-only fallback, so superseded-version logic for open_nacks/obligations cannot silently drop an open NACK. All four anchor fields (last_reviewed_sha, latest_verdicts, open_nacks, conditional_ack_obligations) derive purely from structured fields (no agent prose). Model extension is additive \u2014 BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched (legacy non-regression test passes). Output is deterministic (sorted, byte-stable \u2014 slice-4 prereq). Acceptance criteria met: 9/9 derivation tests pass against merged impl, ruff clean. The egg_anchor directory-level pytest collection error is a pre-existing environment path-collision (shadow copy at /opt/egg-runtime), unrelated to this proposal.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "tester review of slice-3 task-3-1 (derive #3189 BRC anchors). Verified the derivation against real orchestrator replay semantics (peer_consensus.py replay + signals.py emission): PROPOSE producer=from_role with authoritative metadata.version; ACK/NACK producer=to_role with payload.ack_version/nack_version; OBLIGATION_RESOLVED roles from metadata. The version-increment path is a legacy-only fallback, so superseded-version logic for open_nacks/obligations cannot silently drop an open NACK. All four anchor fields (last_reviewed_sha, latest_verdicts, open_nacks, conditional_ack_obligations) derive purely from structured fields (no agent prose). Model extension is additive \u2014 BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched (legacy non-regression test passes). Output is deterministic (sorted, byte-stable \u2014 slice-4 prereq). Acceptance criteria met: 9/9 derivation tests pass against merged impl, ruff clean. The egg_anchor directory-level pytest collection error is a pre-existing environment path-collision (shadow copy at /opt/egg-runtime), unrelated to this proposal.", + "ack_version": 1, + "attestation": { + "tests_run": 9, + "checks_passed": [ + "test", + "lint" + ], + "tests_verified": [ + "task-3-1" + ], + "files_reviewed": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "review_basis": "verified derivation against orchestrator/peer_consensus.py replay + orchestrator/routes/signals.py message emission; ran shared/egg_anchor/tests/test_brc_anchor_derivation.py + orchestrator/tests/test_brc_anchor_derivation.py = 9 passed; ruff clean" + } + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:38:01.429495+00:00", + "phase": "implement" + }, + { + "id": "14898758-3712-4a", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_code for tester", + "body": "ACK slice-3 task-3-2 (align #3189 anchor tests to merged derivation). Ran both suites against working-tree egg_anchor with the proposed brc_derive.py/BRCDerivedAnchors (verified __file__, not the stale /opt copy): 9/9 pass, 0 skipped \u2014 the alignment commit correctly activates the previously skip-guarded assertions now that coder task-3-1 merged. Fixtures match the real BRC serialization I validated in my prior coder ACK (PROPOSE from_role=producer + metadata.version/commit_sha; ACK/NACK from_role=reviewer, to_role=producer, metadata.version/pre_merge_condition/reason; OBLIGATION_RESOLVED metadata.reviewer_role/producer_role). Assertions are non-vacuous across all four anchors: last-reviewed SHA per producer (superseded coder-v1 excluded), latest verdict per edge (NACK vs conditional-ACK), open NACK reason on current version, resolved-vs-unresolved obligation distinction; plus determinism (slice-4 prereq) and an unguarded BRCState legacy non-regression test. test_derivation_agrees_with_matrix cross-checks against the real ApprovalMatrix ground truth. ruff clean. Non-blocking nit only: _MODEL_CANDIDATES (line 54) defined-but-unused; _DERIVATION_CANDIDATES relies on the __init__ re-export rather than listing egg_anchor.brc_derive directly.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "reason": "ACK slice-3 task-3-2 (align #3189 anchor tests to merged derivation). Ran both suites against working-tree egg_anchor with the proposed brc_derive.py/BRCDerivedAnchors (verified __file__, not the stale /opt copy): 9/9 pass, 0 skipped \u2014 the alignment commit correctly activates the previously skip-guarded assertions now that coder task-3-1 merged. Fixtures match the real BRC serialization I validated in my prior coder ACK (PROPOSE from_role=producer + metadata.version/commit_sha; ACK/NACK from_role=reviewer, to_role=producer, metadata.version/pre_merge_condition/reason; OBLIGATION_RESOLVED metadata.reviewer_role/producer_role). Assertions are non-vacuous across all four anchors: last-reviewed SHA per producer (superseded coder-v1 excluded), latest verdict per edge (NACK vs conditional-ACK), open NACK reason on current version, resolved-vs-unresolved obligation distinction; plus determinism (slice-4 prereq) and an unguarded BRCState legacy non-regression test. test_derivation_agrees_with_matrix cross-checks against the real ApprovalMatrix ground truth. ruff clean. Non-blocking nit only: _MODEL_CANDIDATES (line 54) defined-but-unused; _DERIVATION_CANDIDATES relies on the __init__ re-export rather than listing egg_anchor.brc_derive directly.", + "ack_version": 1, + "attestation": { + "files_reviewed": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "tests_run": 9, + "tests_passed": 9, + "tests_skipped": 0, + "issues_found": 0, + "lint": "ruff clean" + } + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.794562+00:00", + "phase": "implement" + }, + { + "id": "af9d23e0-c4b1-4c", + "pipeline_id": "issue-3200", + "from_role": "orchestrator", + "to_role": "tester", + "message_type": "STATUS", + "subject": "Ready to confirm \u2014 all confirm preconditions satisfied", + "body": "Your proposal (version 1) is ready to confirm \u2014 all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm.", + "metadata": { + "ready_to_confirm": true, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.796486+00:00", + "phase": "implement" + }, + { + "id": "cb40bc60-c813-40", + "pipeline_id": "issue-3200", + "from_role": "tester", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by tester", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.897805+00:00", + "phase": "implement" + }, + { + "id": "a13ce8c4-06aa-4b", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_code", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.899565+00:00", + "phase": "implement" + }, + { + "id": "78278c64-2c8a-44", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_code_holistic", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.900662+00:00", + "phase": "implement" + }, + { + "id": "b6c6b78e-ec34-46", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_contract", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.901205+00:00", + "phase": "implement" + }, + { + "id": "395212e7-af3a-48", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_security", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.902601+00:00", + "phase": "implement" + }, + { + "id": "351556a8-2372-48", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_concurrency", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.902847+00:00", + "phase": "implement" + } +] \ No newline at end of file diff --git a/.egg-state/brc-history/3200-implement-slice-3.md b/.egg-state/brc-history/3200-implement-slice-3.md new file mode 100644 index 0000000000..e37705114f --- /dev/null +++ b/.egg-state/brc-history/3200-implement-slice-3.md @@ -0,0 +1,815 @@ +# BRC Consensus History — implement phase, slice-3 + +Generated: 2026-06-25T06:39:40Z +Pipeline: issue-3200 +Slice: slice-3 + +### [2026-06-25T06:21:45Z] tester (HEARTBEAT): heartbeat: WORKING + +one-shot event arm action=propose (slice=slice-3) + +````yaml +id: 55134257-0286-42 +phase: implement +metadata: + state: WORKING + slice_id: slice-3 +```` + +### [2026-06-25T06:21:45Z] coder (HEARTBEAT): heartbeat: WORKING + +one-shot event arm action=propose (slice=slice-3) + +````yaml +id: 5ba05389-7b39-47 +phase: implement +metadata: + state: WORKING + slice_id: slice-3 +```` + +### [2026-06-25T06:21:46Z] documenter (HEARTBEAT): heartbeat: WORKING + +one-shot event arm action=propose (slice=slice-3) + +````yaml +id: 751f46b5-d4ab-4e +phase: implement +metadata: + state: WORKING + slice_id: slice-3 +```` + +### [2026-06-25T06:22:30Z] documenter (CONSENSUS_PROPOSE): Proposal from documenter + +documenter no-op for slice-3 (derive #3189 anchor fields). This slice is pure internal-substrate derivation (shared/egg_anchor model extension + orchestrator-sourced anchor computation) plus fixture-based unit tests, with no documenter task and no user-facing documentation surface. No docs change is warranted at this layer; mechanism documentation belongs to the later flag-gating/generalization slices and the PR phase. Proposing no_changes_needed so consensus is not blocked on the documenter for slice-3. + +````yaml +id: d373dada-3ca2-4e +phase: implement +metadata: + payload: + summary: 'documenter no-op for slice-3 (derive #3189 anchor fields). This slice + is pure internal-substrate derivation (shared/egg_anchor model extension + orchestrator-sourced + anchor computation) plus fixture-based unit tests, with no documenter task and + no user-facing documentation surface. No docs change is warranted at this layer; + mechanism documentation belongs to the later flag-gating/generalization slices + and the PR phase. Proposing no_changes_needed so consensus is not blocked on + the documenter for slice-3.' + attestation: {} + artifacts: [] + risk_considered: '' + commit_sha: '' + files_changed: [] + tests_run: [] + tasks_satisfied: [] + no_changes_needed: true + no_changes_reason: "Slice-3 derives the four #3189 anchor fields (last-reviewed\ + \ SHA/producer, latest verdicts, open NACK reasons, conditional-ACK obligations)\ + \ deterministically from the BRC message record and extends the shared/egg_anchor\ + \ model additively. Both tasks (task-3-1 derivation, task-3-2 fixture tests)\ + \ are pure internal substrate/code + unit tests with no documenter assignment\ + \ and no user-facing documentation surface. User-facing docs for the overall\ + \ context-discipline mechanism are appropriate once the feature is wired behind\ + \ the flag (later slices) / at the PR phase, not for this isolated derivation\ + \ layer. No documentation changes needed in this slice \u2014 consistent with\ + \ the documenter no-op in slice-1." + version: 1 + commit_sha: '' + slice_id: slice-3 +```` + +### [2026-06-25T06:29:02Z] coder (CONSENSUS_PROPOSE): Proposal from coder + +slice-3 / task-3-1: deterministic derivation of the four #3189 BRC anchors from the message record. New shared/egg_anchor/brc_derive.py:derive_brc_anchors(messages) consumes the serialized BRC message record (read_peer_artifact / _write_brc_history shape) and mechanically computes: (i) last-reviewed SHA per producer (latest reviewed proposal_commit_sha), (ii) latest verdict per reviewer->producer edge (ACK/NACK/conditional-ACK), (iii) open NACK reasons (current-version NACKs not yet superseded by a re-propose), (iv) conditional-ACK obligations (pre_merge_condition, resolved/unresolved). Reads only structured message fields — never agent-authored prose — and mirrors orchestrator.peer_consensus replay semantics (versions advance on re-propose; superseded-version verdicts/obligations become historical) without importing the orchestrator package. egg_anchor models extended additively (ReviewVerdict, ReviewEdgeVerdict, OpenNack, ConditionalAckObligation, BRCDerivedAnchors + optional BRCState.derived default None); legacy BRCState.acks/nacks/last_message_id untouched. Verified deterministic + order-stable against the real .egg-state/brc-history record and a synthetic fixture (ACK->re-propose->NACK, conditional-ACK unresolved, obligation-resolved); AgentAnchor to_dict/from_dict round-trips; ruff+mypy clean; existing 98 egg_anchor tests pass. Tests for the fixture stream are task-3-2 (tester). + +````yaml +id: 28f2612b-19fe-4b +phase: implement +metadata: + payload: + summary: "slice-3 / task-3-1: deterministic derivation of the four #3189 BRC anchors\ + \ from the message record. New shared/egg_anchor/brc_derive.py:derive_brc_anchors(messages)\ + \ consumes the serialized BRC message record (read_peer_artifact / _write_brc_history\ + \ shape) and mechanically computes: (i) last-reviewed SHA per producer (latest\ + \ reviewed proposal_commit_sha), (ii) latest verdict per reviewer->producer\ + \ edge (ACK/NACK/conditional-ACK), (iii) open NACK reasons (current-version\ + \ NACKs not yet superseded by a re-propose), (iv) conditional-ACK obligations\ + \ (pre_merge_condition, resolved/unresolved). Reads only structured message\ + \ fields \u2014 never agent-authored prose \u2014 and mirrors orchestrator.peer_consensus\ + \ replay semantics (versions advance on re-propose; superseded-version verdicts/obligations\ + \ become historical) without importing the orchestrator package. egg_anchor\ + \ models extended additively (ReviewVerdict, ReviewEdgeVerdict, OpenNack, ConditionalAckObligation,\ + \ BRCDerivedAnchors + optional BRCState.derived default None); legacy BRCState.acks/nacks/last_message_id\ + \ untouched. Verified deterministic + order-stable against the real .egg-state/brc-history\ + \ record and a synthetic fixture (ACK->re-propose->NACK, conditional-ACK unresolved,\ + \ obligation-resolved); AgentAnchor to_dict/from_dict round-trips; ruff+mypy\ + \ clean; existing 98 egg_anchor tests pass. Tests for the fixture stream are\ + \ task-3-2 (tester)." + attestation: {} + artifacts: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + risk_considered: Additive-only model change (new optional field + new sibling + models) preserves the existing BRCState schema and AgentAnchor serialization + (None-default field omitted by to_dict). Derivation tolerates pre-versioning + historical messages (version fallback to producer's current proposal) and missing/empty + metadata/payload defensively. No orchestrator dependency, so the shared package + stays import-light. + commit_sha: 34278c681 + files_changed: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + - shared/egg_anchor/__init__.py + tests_run: [] + tasks_satisfied: + - task-3-1 + no_changes_needed: false + no_changes_reason: '' + version: 1 + commit_sha: 34278c681 + slice_id: slice-3 +```` + +### [2026-06-25T06:29:09Z] reviewer_code (HEARTBEAT): heartbeat: WORKING + +one-shot event arm action=ack (slice=slice-3) + +````yaml +id: f5827665-5fbb-43 +phase: implement +metadata: + state: WORKING + slice_id: slice-3 +```` + +### [2026-06-25T06:29:09Z] reviewer_code_holistic (HEARTBEAT): heartbeat: WORKING + +one-shot event arm action=ack (slice=slice-3) + +````yaml +id: 31932193-44b5-4a +phase: implement +metadata: + state: WORKING + slice_id: slice-3 +```` + +### [2026-06-25T06:29:11Z] reviewer_contract (HEARTBEAT): heartbeat: WORKING + +one-shot event arm action=ack (slice=slice-3) + +````yaml +id: b537bf08-c657-49 +phase: implement +metadata: + state: WORKING + slice_id: slice-3 +```` + +### [2026-06-25T06:29:12Z] reviewer_security (HEARTBEAT): heartbeat: WORKING + +one-shot event arm action=ack (slice=slice-3) + +````yaml +id: a5292b8f-6185-4a +phase: implement +metadata: + state: WORKING + slice_id: slice-3 +```` + +### [2026-06-25T06:29:13Z] reviewer_concurrency (HEARTBEAT): heartbeat: WORKING + +one-shot event arm action=ack (slice=slice-3) + +````yaml +id: c8193200-4c6f-46 +phase: implement +metadata: + state: WORKING + slice_id: slice-3 +```` + +### [2026-06-25T06:30:16Z] reviewer_security → coder (CONSENSUS_ACK): ACK from reviewer_security for coder + +Security review clean. Pure additive deterministic derivation (brc_derive.derive_brc_anchors) + additive egg_anchor models. No dangerous sinks (no eval/exec/pickle/subprocess/file/network/secrets), no untrusted deserialization, no injection sinks. Reads only structured message fields and deliberately excludes free-form `body` prose — a trust-boundary positive that prevents agent narration from poisoning reseed-gating anchors. bool-rejection in _version and to_role=='all' filtering are correct. O(n), no regex/ReDoS. No new attack surface. + +````yaml +id: 1d889305-7440-42 +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + - shared/egg_anchor/__init__.py + reason: "Security review clean. Pure additive deterministic derivation (brc_derive.derive_brc_anchors)\ + \ + additive egg_anchor models. No dangerous sinks (no eval/exec/pickle/subprocess/file/network/secrets),\ + \ no untrusted deserialization, no injection sinks. Reads only structured message\ + \ fields and deliberately excludes free-form `body` prose \u2014 a trust-boundary\ + \ positive that prevents agent narration from poisoning reseed-gating anchors.\ + \ bool-rejection in _version and to_role=='all' filtering are correct. O(n),\ + \ no regex/ReDoS. No new attack surface." + ack_version: 1 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:32:55Z] reviewer_concurrency → coder (CONSENSUS_ACK): ACK from reviewer_concurrency for coder + +Concurrency review PASS. derive_brc_anchors is a pure function: no module-level mutable state (only immutable str constants + __all__), all working state is function-local, so it is thread-safe across concurrent event-pump agents. No input mutation — _ordered materializes a fresh list(messages), messages are read-only via .get(), and the sole state["resolved"]=True write targets brc_derive's own local edge dict, not the shared message snapshot. Deterministic replay order via (timestamp,id) tiebreak matches peer_consensus.py:2172 canonical ordering; outputs sorted by (producer,reviewer). Verified the one race that could drop a live NACK — version inflation under rapid/auto re-propose — is not possible: CONSENSUS_PROPOSE messages stamp metadata.version on both the manual (signals.py:2129) and auto-push (signals.py:3224) paths, and _version() reads the stamped version first; the incrementing fallback only triggers for legacy unstamped messages. No concurrency blockers. + +````yaml +id: cd6ddecf-aec9-43 +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + - shared/egg_anchor/__init__.py + reason: "Concurrency review PASS. derive_brc_anchors is a pure function: no module-level\ + \ mutable state (only immutable str constants + __all__), all working state\ + \ is function-local, so it is thread-safe across concurrent event-pump agents.\ + \ No input mutation \u2014 _ordered materializes a fresh list(messages), messages\ + \ are read-only via .get(), and the sole state[\"resolved\"]=True write targets\ + \ brc_derive's own local edge dict, not the shared message snapshot. Deterministic\ + \ replay order via (timestamp,id) tiebreak matches peer_consensus.py:2172 canonical\ + \ ordering; outputs sorted by (producer,reviewer). Verified the one race that\ + \ could drop a live NACK \u2014 version inflation under rapid/auto re-propose\ + \ \u2014 is not possible: CONSENSUS_PROPOSE messages stamp metadata.version\ + \ on both the manual (signals.py:2129) and auto-push (signals.py:3224) paths,\ + \ and _version() reads the stamped version first; the incrementing fallback\ + \ only triggers for legacy unstamped messages. No concurrency blockers." + ack_version: 1 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:33:21Z] reviewer_contract → coder (CONSENSUS_ACK): ACK from reviewer_contract for coder + +Contract-conformance ACK for slice-3 / task-3-1 (commit 34278c681). All acceptance criteria met: (1) the four #3189 anchors derive purely and mechanically from the BRC message record — derive_brc_anchors reads only structured fields (message_type/from_role/to_role/metadata[.payload]), never agent prose; NACK reason comes from structured payload.reason, not the free-form body. (2) Models extended additively — BRCDerivedAnchors + BRCState.derived (default None); acks/nacks/last_message_id at models.py:189+ keep their original agent-id-list meaning untouched, so no existing field breaks. (3) The four computations are correct against the real serialization schema: field-reading probes both metadata and metadata.payload defensively (version via metadata.version|payload.version|ack_version|nack_version; pre_merge_condition/resolved_in_diff via payload; OBLIGATION_RESOLVED via metadata.reviewer_role/producer_role), so it matches what signals.py actually stamps. last-reviewed SHA = SHA of highest reviewed version; open NACKs and conditional-ACK obligations correctly gated to the producer's current proposal version (re-propose supersedes), with resolved/unresolved replayed in chronological order. (4) No agent-authored content enters this layer. Output is deterministic (sorted edge keys + SHA map). Touching only shared/egg_anchor/ (not orchestrator/) is correct by design — the task requires the derivation to avoid an orchestrator dependency. Tests are the separate pending task-3-2. + +````yaml +id: 18641460-6594-4b +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + - shared/egg_anchor/__init__.py + reason: "Contract-conformance ACK for slice-3 / task-3-1 (commit 34278c681). All\ + \ acceptance criteria met: (1) the four #3189 anchors derive purely and mechanically\ + \ from the BRC message record \u2014 derive_brc_anchors reads only structured\ + \ fields (message_type/from_role/to_role/metadata[.payload]), never agent prose;\ + \ NACK reason comes from structured payload.reason, not the free-form body.\ + \ (2) Models extended additively \u2014 BRCDerivedAnchors + BRCState.derived\ + \ (default None); acks/nacks/last_message_id at models.py:189+ keep their original\ + \ agent-id-list meaning untouched, so no existing field breaks. (3) The four\ + \ computations are correct against the real serialization schema: field-reading\ + \ probes both metadata and metadata.payload defensively (version via metadata.version|payload.version|ack_version|nack_version;\ + \ pre_merge_condition/resolved_in_diff via payload; OBLIGATION_RESOLVED via\ + \ metadata.reviewer_role/producer_role), so it matches what signals.py actually\ + \ stamps. last-reviewed SHA = SHA of highest reviewed version; open NACKs and\ + \ conditional-ACK obligations correctly gated to the producer's current proposal\ + \ version (re-propose supersedes), with resolved/unresolved replayed in chronological\ + \ order. (4) No agent-authored content enters this layer. Output is deterministic\ + \ (sorted edge keys + SHA map). Touching only shared/egg_anchor/ (not orchestrator/)\ + \ is correct by design \u2014 the task requires the derivation to avoid an orchestrator\ + \ dependency. Tests are the separate pending task-3-2." + ack_version: 1 + attestation: + tasks_verified: + - task-3-1 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:34:13Z] reviewer_code_holistic → coder (CONSENSUS_ACK): ACK from reviewer_code_holistic for coder + +Holistic review PASS (first review, slice-3 task-3-1). derive_brc_anchors mechanically derives the four #3189 anchors from the BRC message record, and I verified it end-to-end — not just by reading. Ran the PROPOSED code against the REAL .egg-state/brc-history/3200-implement-slice-2.json record: it produced exactly-correct anchors (last_reviewed_sha coder->55387ff1, tester->335979385; 11 latest verdicts), and crucially it correctly SUPERSEDED reviewer_code_holistic's earlier NACK-on-tester with its later ACK (edge resolves to ack, open_nacks empty) — confirming the chronological replay + latest-verdict-per-edge logic mirrors orchestrator.peer_consensus without depending on it. Field-reading matches actual orchestrator message shapes (cross-checked signals.py + the live record): ACK carries metadata.version, NACK carries metadata.version=None with payload.nack_version (the _version() fallback chain handles this exact case), ACK/NACK to_role is the producer role (so the ==\"all\" guard doesn't drop verdicts), pre_merge_condition is in payload, OBLIGATION_RESOLVED carries reviewer_role/producer_role in metadata. Determinism holds (identical output under shuffled input; outputs sorted by (producer,reviewer); empty input safe). open_nacks/obligations correctly gated on version==producer-current so re-propose supersedes. Models are additive: BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched, None-omitting serialization keeps legacy anchors byte-identical. ruff clean; bool-is-int-subclass rejection in _version handled. Non-blocking note for the slice-4/5 consumer: CONSENSUS_WITHDRAW is not handled (would leave a stale edge), but the four enumerated message types are exactly the documented task scope, so out of scope here. + +````yaml +id: d7849a9a-efdc-49 +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + - shared/egg_anchor/__init__.py + reason: "Holistic review PASS (first review, slice-3 task-3-1). derive_brc_anchors\ + \ mechanically derives the four #3189 anchors from the BRC message record, and\ + \ I verified it end-to-end \u2014 not just by reading. Ran the PROPOSED code\ + \ against the REAL .egg-state/brc-history/3200-implement-slice-2.json record:\ + \ it produced exactly-correct anchors (last_reviewed_sha coder->55387ff1, tester->335979385;\ + \ 11 latest verdicts), and crucially it correctly SUPERSEDED reviewer_code_holistic's\ + \ earlier NACK-on-tester with its later ACK (edge resolves to ack, open_nacks\ + \ empty) \u2014 confirming the chronological replay + latest-verdict-per-edge\ + \ logic mirrors orchestrator.peer_consensus without depending on it. Field-reading\ + \ matches actual orchestrator message shapes (cross-checked signals.py + the\ + \ live record): ACK carries metadata.version, NACK carries metadata.version=None\ + \ with payload.nack_version (the _version() fallback chain handles this exact\ + \ case), ACK/NACK to_role is the producer role (so the ==\\\"all\\\" guard doesn't\ + \ drop verdicts), pre_merge_condition is in payload, OBLIGATION_RESOLVED carries\ + \ reviewer_role/producer_role in metadata. Determinism holds (identical output\ + \ under shuffled input; outputs sorted by (producer,reviewer); empty input safe).\ + \ open_nacks/obligations correctly gated on version==producer-current so re-propose\ + \ supersedes. Models are additive: BRCState.derived defaults None, legacy acks/nacks/last_message_id\ + \ untouched, None-omitting serialization keeps legacy anchors byte-identical.\ + \ ruff clean; bool-is-int-subclass rejection in _version handled. Non-blocking\ + \ note for the slice-4/5 consumer: CONSENSUS_WITHDRAW is not handled (would\ + \ leave a stale edge), but the four enumerated message types are exactly the\ + \ documented task scope, so out of scope here." + ack_version: 1 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:34:43Z] reviewer_code → coder (CONSENSUS_ACK): ACK from reviewer_code for coder + +ACK slice-3 task-3-1 (derive #3189 BRC anchors). Verified field extraction against the real orchestrator serialization (routes/signals.py + message_store.py): PROPOSE version=metadata.version, commit_sha=metadata.commit_sha w/ payload fallback; ACK version=metadata.version/payload.ack_version; NACK version=payload.nack_version (NACK carries no metadata.version — the _version() fallback chain handles it); NACK reason=payload.reason; pre_merge_condition + ..._resolved_in_diff under payload; OBLIGATION_RESOLVED uses metadata.reviewer_role/producer_role with no payload wrapper. All paths match. Derivation is purely mechanical (reads only structured fields, never body prose) — satisfies the no-agent-content AC. Replay semantics correct: superseded-version NACKs/obligations drop out of open_nacks/obligations on re-propose (verified by smoke test: NACK@v1 dropped after re-propose to v2; obligation resolution via both pre_merge_condition_resolved_in_diff and the OBLIGATION_RESOLVED message works). Models extended additively — BRCState.acks/nacks/last_message_id untouched, derived defaults None on legacy anchors. Deterministic: identical output under input reordering. ruff clean; 98 existing egg_anchor tests pass, no regression. Non-blocking notes for the wiring slices (not this task): last_reviewed_sha is a producer-level rollup (max version across reviewers) but per-edge reviewed_sha is preserved in latest_verdicts for the slice-4 role-parameterized root; and the deriver is slice-agnostic so callers must pass a per-slice record (read_peer_artifact/_write_brc_history already partition per slice). Tests are task-3-2 (tester). + +````yaml +id: 37f0f439-8eb7-43 +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + - shared/egg_anchor/__init__.py + reason: "ACK slice-3 task-3-1 (derive #3189 BRC anchors). Verified field extraction\ + \ against the real orchestrator serialization (routes/signals.py + message_store.py):\ + \ PROPOSE version=metadata.version, commit_sha=metadata.commit_sha w/ payload\ + \ fallback; ACK version=metadata.version/payload.ack_version; NACK version=payload.nack_version\ + \ (NACK carries no metadata.version \u2014 the _version() fallback chain handles\ + \ it); NACK reason=payload.reason; pre_merge_condition + ..._resolved_in_diff\ + \ under payload; OBLIGATION_RESOLVED uses metadata.reviewer_role/producer_role\ + \ with no payload wrapper. All paths match. Derivation is purely mechanical\ + \ (reads only structured fields, never body prose) \u2014 satisfies the no-agent-content\ + \ AC. Replay semantics correct: superseded-version NACKs/obligations drop out\ + \ of open_nacks/obligations on re-propose (verified by smoke test: NACK@v1 dropped\ + \ after re-propose to v2; obligation resolution via both pre_merge_condition_resolved_in_diff\ + \ and the OBLIGATION_RESOLVED message works). Models extended additively \u2014\ + \ BRCState.acks/nacks/last_message_id untouched, derived defaults None on legacy\ + \ anchors. Deterministic: identical output under input reordering. ruff clean;\ + \ 98 existing egg_anchor tests pass, no regression. Non-blocking notes for the\ + \ wiring slices (not this task): last_reviewed_sha is a producer-level rollup\ + \ (max version across reviewers) but per-edge reviewed_sha is preserved in latest_verdicts\ + \ for the slice-4 role-parameterized root; and the deriver is slice-agnostic\ + \ so callers must pass a per-slice record (read_peer_artifact/_write_brc_history\ + \ already partition per slice). Tests are task-3-2 (tester)." + ack_version: 1 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:34:54Z] tester (CONSENSUS_PROPOSE): Proposal from tester + +slice-3 (task-3-2): tests for the #3189 deterministic BRC anchor derivation, aligned to the merged coder implementation (task-3-1: derive_brc_anchors / BRCDerivedAnchors). Adds shared/egg_anchor/tests/test_brc_anchor_derivation.py and orchestrator/tests/test_brc_anchor_derivation.py. All 9 tests pass. Covers the four derived fields against a realistic AC-scenario message record (multiple producers; ACK-then-repropose+NACK; an unresolved obligation and a resolved-in-cycle obligation): last_reviewed_sha per producer (current reviewed head, superseded SHA absent); latest_verdicts per reviewer->producer edge; open_nacks reason on the current proposal version; conditional_ack_obligations with resolved/unresolved status flipped by CONSENSUS_OBLIGATION_RESOLVED; deterministic output (slice-4 byte-stability prereq); an ApprovalMatrix substrate cross-check; and BRCState legacy-field non-regression for the additive model extension. + +````yaml +id: c0981656-e036-4b +phase: implement +metadata: + payload: + summary: 'slice-3 (task-3-2): tests for the #3189 deterministic BRC anchor derivation, + aligned to the merged coder implementation (task-3-1: derive_brc_anchors / BRCDerivedAnchors). + Adds shared/egg_anchor/tests/test_brc_anchor_derivation.py and orchestrator/tests/test_brc_anchor_derivation.py. + All 9 tests pass. Covers the four derived fields against a realistic AC-scenario + message record (multiple producers; ACK-then-repropose+NACK; an unresolved obligation + and a resolved-in-cycle obligation): last_reviewed_sha per producer (current + reviewed head, superseded SHA absent); latest_verdicts per reviewer->producer + edge; open_nacks reason on the current proposal version; conditional_ack_obligations + with resolved/unresolved status flipped by CONSENSUS_OBLIGATION_RESOLVED; deterministic + output (slice-4 byte-stability prereq); an ApprovalMatrix substrate cross-check; + and BRCState legacy-field non-regression for the additive model extension.' + attestation: + tests_run: 9 + checks_passed: + - test + - lint + - security + tests_passed: 9 + tests_skipped: 0 + test_command: pytest shared/egg_anchor/tests/test_brc_anchor_derivation.py orchestrator/tests/test_brc_anchor_derivation.py + lint: ruff check clean + security: 'manual review: test-only files, no exec/subprocess/network/secrets; + bandit unavailable in sandbox' + notes: All 9 tests pass against merged coder impl 34278c681. + artifacts: + - shared/egg_anchor/tests/test_brc_anchor_derivation.py + - orchestrator/tests/test_brc_anchor_derivation.py + - 3c0c9ad5a + risk_considered: 'Changed files are test-only (pytest fixtures + asserts): no + subprocess/eval/network/filesystem/secret handling, so zero security surface. + bandit is not installed in this sandbox; security attested via manual review + of the diff. lint (ruff) and the 9-test suite were executed and pass.' + commit_sha: 3c0c9ad5a + files_changed: + - shared/egg_anchor/tests/test_brc_anchor_derivation.py + - orchestrator/tests/test_brc_anchor_derivation.py + tests_run: [] + tasks_satisfied: + - task-3-2 + no_changes_needed: false + no_changes_reason: '' + version: 1 + commit_sha: 3c0c9ad5a + slice_id: slice-3 +```` + +### [2026-06-25T06:34:54Z] orchestrator → documenter (STATUS): Ready to confirm — all confirm preconditions satisfied + +Your proposal (version 1) is ready to confirm — all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm. + +````yaml +id: 255855d1-9b48-41 +phase: implement +metadata: + ready_to_confirm: true + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:34:57Z] documenter (CONSENSUS_CONFIRMED): Consensus confirmed by documenter + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: 88066e33-2c64-49 +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:35:55Z] reviewer_security → tester (CONSENSUS_ACK): ACK from reviewer_security for tester + +Security review clean. Test-only change aligning slice-3 fixtures to the merged coder derivation (brc_derive.derive_brc_anchors). No dangerous sinks: no eval/exec/pickle/subprocess/file/network/secrets, no untrusted deserialization, no injection. The only flagged constructs are __import__ calls in the skip-guard locators, which iterate hardcoded module-name allowlists with no untrusted input — standard parallel-BRC test pattern. pre_merge_condition strings ("git mv old new", "update import path") are inert fixture data asserted on, never executed. Fixtures exercise the same structured-field-only derivation already reviewed and ACKed for the coder. No new attack surface. + +````yaml +id: f462b025-7ad2-44 +phase: implement +metadata: + payload: + artifact_references: + - orchestrator/tests/test_brc_anchor_derivation.py + - shared/egg_anchor/tests/test_brc_anchor_derivation.py + reason: "Security review clean. Test-only change aligning slice-3 fixtures to\ + \ the merged coder derivation (brc_derive.derive_brc_anchors). No dangerous\ + \ sinks: no eval/exec/pickle/subprocess/file/network/secrets, no untrusted deserialization,\ + \ no injection. The only flagged constructs are __import__ calls in the skip-guard\ + \ locators, which iterate hardcoded module-name allowlists with no untrusted\ + \ input \u2014 standard parallel-BRC test pattern. pre_merge_condition strings\ + \ (\"git mv old new\", \"update import path\") are inert fixture data asserted\ + \ on, never executed. Fixtures exercise the same structured-field-only derivation\ + \ already reviewed and ACKed for the coder. No new attack surface." + ack_version: 1 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:35:56Z] coder (CONSENSUS_CONFIRMED): Consensus confirmed by coder + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: 91581d7d-9882-40 +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:35:56Z] reviewer_security (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_security + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: ed948970-93f5-4d +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:36:35Z] reviewer_concurrency → tester (CONSENSUS_ACK): ACK from reviewer_concurrency for tester + +Concurrency review PASS (first review, v1). The slice-3 derivation tests align fixtures to the merged derive_brc_anchors contract and introduce no concurrency hazards: each test builds fresh fixtures via _scenario_messages()/_build_scenario_matrix() (new lists+dicts per call), module state is limited to immutable SHA_* string constants, and there are no shared mutable fixtures — so the suite is safe under pytest-xdist parallelism with no test-ordering interference. The function under test is pure/thread-safe (verified for coder); fixtures feed read-only dicts and the two _derive calls in test_derivation_is_deterministic never mutate input. Determinism is asserted, locking the slice-4 reproducibility prereq. Non-blocking coverage note: fixtures omit `timestamp`, so _ordered (brc_derive.py:118-124) takes its input-order fallback rather than the (timestamp,id) canonical-sort path; the determinism test thus validates same-order reproducibility but not order-independence — the actual convergence guarantee for concurrent event-pump agents. That property is correctly implemented in already-ACKed derivation code, so this is a coverage gap not a defect. No concurrency blockers. + +````yaml +id: 9a1ed663-7385-4b +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/tests/test_brc_anchor_derivation.py + - orchestrator/tests/test_brc_anchor_derivation.py + reason: "Concurrency review PASS (first review, v1). The slice-3 derivation tests\ + \ align fixtures to the merged derive_brc_anchors contract and introduce no\ + \ concurrency hazards: each test builds fresh fixtures via _scenario_messages()/_build_scenario_matrix()\ + \ (new lists+dicts per call), module state is limited to immutable SHA_* string\ + \ constants, and there are no shared mutable fixtures \u2014 so the suite is\ + \ safe under pytest-xdist parallelism with no test-ordering interference. The\ + \ function under test is pure/thread-safe (verified for coder); fixtures feed\ + \ read-only dicts and the two _derive calls in test_derivation_is_deterministic\ + \ never mutate input. Determinism is asserted, locking the slice-4 reproducibility\ + \ prereq. Non-blocking coverage note: fixtures omit `timestamp`, so _ordered\ + \ (brc_derive.py:118-124) takes its input-order fallback rather than the (timestamp,id)\ + \ canonical-sort path; the determinism test thus validates same-order reproducibility\ + \ but not order-independence \u2014 the actual convergence guarantee for concurrent\ + \ event-pump agents. That property is correctly implemented in already-ACKed\ + \ derivation code, so this is a coverage gap not a defect. No concurrency blockers." + ack_version: 1 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:36:35Z] orchestrator → coder (STATUS): Ready to confirm — all confirm preconditions satisfied + +Your proposal (version 1) is ready to confirm — all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm. + +````yaml +id: 0666e4b8-5149-48 +phase: implement +metadata: + ready_to_confirm: true + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:36:38Z] reviewer_concurrency (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_concurrency + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: de055fe3-f600-4c +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:37:35Z] reviewer_code_holistic → tester (CONSENSUS_ACK): ACK from reviewer_code_holistic for tester + +Holistic review PASS (first review, slice-3 task-3-2). Verified end-to-end, not just by reading: ran BOTH test files at proposed commit 3c0c9ad5a against the merged derive_brc_anchors implementation -> 9 passed, 0 skipped. The delta realigns the fixtures from the old _Msg attribute-class shape (to_role hardcoded 'all', producer in metadata.producer_role, proposal_commit_sha helpers) to the merged plain-dict contract: producer carried in to_role, version/commit_sha/pre_merge_condition/reason in nested metadata. This alignment was NECESSARY and correct -- derive_brc_anchors reads producer=msg.get('to_role') and skips to_role=='all', so the pre-merge fixtures would have produced empty edges and failed; the realigned fixtures exercise the real four-field derivation (last_reviewed_sha supersedes coder v1->v2 to SHA_CODER_V2, NACK 'missing guard' surfaced on current version, conditional-ACK obligation 'git mv old new' unresolved vs tester's 'update import path' resolved via OBLIGATION_RESOLVED, deterministic output). Strong per-edge assertions live on the orchestrator side (test_derivation_agrees_with_matrix) which also cross-checks the REAL ApprovalMatrix substrate un-guarded; the egg_anchor side deliberately uses tolerant _get/_flatten matching to stay field-name-agnostic. Scope clean: two test files only, no production code; legacy BRCState non-regression passes (additive extension intact). Both locators resolve derive_brc_anchors via the egg_anchor package re-export (__init__.py __all__) despite the module being brc_derive.py. No blockers. + +````yaml +id: 5c9dbf47-08cf-4d +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/tests/test_brc_anchor_derivation.py + - orchestrator/tests/test_brc_anchor_derivation.py + reason: 'Holistic review PASS (first review, slice-3 task-3-2). Verified end-to-end, + not just by reading: ran BOTH test files at proposed commit 3c0c9ad5a against + the merged derive_brc_anchors implementation -> 9 passed, 0 skipped. The delta + realigns the fixtures from the old _Msg attribute-class shape (to_role hardcoded + ''all'', producer in metadata.producer_role, proposal_commit_sha helpers) to + the merged plain-dict contract: producer carried in to_role, version/commit_sha/pre_merge_condition/reason + in nested metadata. This alignment was NECESSARY and correct -- derive_brc_anchors + reads producer=msg.get(''to_role'') and skips to_role==''all'', so the pre-merge + fixtures would have produced empty edges and failed; the realigned fixtures + exercise the real four-field derivation (last_reviewed_sha supersedes coder + v1->v2 to SHA_CODER_V2, NACK ''missing guard'' surfaced on current version, + conditional-ACK obligation ''git mv old new'' unresolved vs tester''s ''update + import path'' resolved via OBLIGATION_RESOLVED, deterministic output). Strong + per-edge assertions live on the orchestrator side (test_derivation_agrees_with_matrix) + which also cross-checks the REAL ApprovalMatrix substrate un-guarded; the egg_anchor + side deliberately uses tolerant _get/_flatten matching to stay field-name-agnostic. + Scope clean: two test files only, no production code; legacy BRCState non-regression + passes (additive extension intact). Both locators resolve derive_brc_anchors + via the egg_anchor package re-export (__init__.py __all__) despite the module + being brc_derive.py. No blockers.' + ack_version: 1 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:37:35Z] reviewer_code_holistic (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_code_holistic + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: 98213206-e3da-49 +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:37:53Z] reviewer_contract → tester (CONSENSUS_ACK): ACK from reviewer_contract for tester + +Contract-conformance ACK for slice-3/task-3-2 (commit 3c0c9ad5a): tests aligned to the merged derive_brc_anchors. Fixtures faithfully match the real serialization contract (plain message dicts with nested metadata; verdicts carry the producer in to_role; version/commit_sha/pre_merge_condition/reason in metadata; OBLIGATION_RESOLVED carries reviewer_role/producer_role) — the inaccurate dual attribute/dict _Msg shim was correctly dropped. All four #3189 anchors are asserted: (i) last-reviewed SHA per producer (coder->v2, tester->v1, superseded v1 absent), (ii) latest verdict per reviewer->producer edge, (iii) open NACK reason on current version ("missing guard"), (iv) conditional-ACK obligations resolved/unresolved. Assertions match real model field names and ReviewVerdict enum values exactly. The orchestrator file adds an ApprovalMatrix ground-truth cross-check locking the anchors as a deterministic projection of the existing consensus substrate; legacy BRCState non-regression and determinism are also covered. Verified against the merged implementation (local brc_derive.py byte-identical to 3c0c9ad5a): ran both files — 9 passed, 0 skipped, confirming the previously skip-guarded assertions now activate per the slice-3 "Derive" merge convention. No blockers. + +````yaml +id: 1b41298c-8ffa-47 +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/tests/test_brc_anchor_derivation.py + - orchestrator/tests/test_brc_anchor_derivation.py + reason: "Contract-conformance ACK for slice-3/task-3-2 (commit 3c0c9ad5a): tests\ + \ aligned to the merged derive_brc_anchors. Fixtures faithfully match the real\ + \ serialization contract (plain message dicts with nested metadata; verdicts\ + \ carry the producer in to_role; version/commit_sha/pre_merge_condition/reason\ + \ in metadata; OBLIGATION_RESOLVED carries reviewer_role/producer_role) \u2014\ + \ the inaccurate dual attribute/dict _Msg shim was correctly dropped. All four\ + \ #3189 anchors are asserted: (i) last-reviewed SHA per producer (coder->v2,\ + \ tester->v1, superseded v1 absent), (ii) latest verdict per reviewer->producer\ + \ edge, (iii) open NACK reason on current version (\"missing guard\"), (iv)\ + \ conditional-ACK obligations resolved/unresolved. Assertions match real model\ + \ field names and ReviewVerdict enum values exactly. The orchestrator file adds\ + \ an ApprovalMatrix ground-truth cross-check locking the anchors as a deterministic\ + \ projection of the existing consensus substrate; legacy BRCState non-regression\ + \ and determinism are also covered. Verified against the merged implementation\ + \ (local brc_derive.py byte-identical to 3c0c9ad5a): ran both files \u2014 9\ + \ passed, 0 skipped, confirming the previously skip-guarded assertions now activate\ + \ per the slice-3 \"Derive\" merge convention. No blockers." + ack_version: 1 + attestation: + tasks_verified: + - task-3-2 + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:37:57Z] reviewer_contract (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_contract + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: 92c7997b-7171-4e +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:38:01Z] tester → coder (CONSENSUS_ACK): ACK from tester for coder + +tester review of slice-3 task-3-1 (derive #3189 BRC anchors). Verified the derivation against real orchestrator replay semantics (peer_consensus.py replay + signals.py emission): PROPOSE producer=from_role with authoritative metadata.version; ACK/NACK producer=to_role with payload.ack_version/nack_version; OBLIGATION_RESOLVED roles from metadata. The version-increment path is a legacy-only fallback, so superseded-version logic for open_nacks/obligations cannot silently drop an open NACK. All four anchor fields (last_reviewed_sha, latest_verdicts, open_nacks, conditional_ack_obligations) derive purely from structured fields (no agent prose). Model extension is additive — BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched (legacy non-regression test passes). Output is deterministic (sorted, byte-stable — slice-4 prereq). Acceptance criteria met: 9/9 derivation tests pass against merged impl, ruff clean. The egg_anchor directory-level pytest collection error is a pre-existing environment path-collision (shadow copy at /opt/egg-runtime), unrelated to this proposal. + +````yaml +id: 4c8b3378-6e41-47 +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + - shared/egg_anchor/__init__.py + reason: "tester review of slice-3 task-3-1 (derive #3189 BRC anchors). Verified\ + \ the derivation against real orchestrator replay semantics (peer_consensus.py\ + \ replay + signals.py emission): PROPOSE producer=from_role with authoritative\ + \ metadata.version; ACK/NACK producer=to_role with payload.ack_version/nack_version;\ + \ OBLIGATION_RESOLVED roles from metadata. The version-increment path is a legacy-only\ + \ fallback, so superseded-version logic for open_nacks/obligations cannot silently\ + \ drop an open NACK. All four anchor fields (last_reviewed_sha, latest_verdicts,\ + \ open_nacks, conditional_ack_obligations) derive purely from structured fields\ + \ (no agent prose). Model extension is additive \u2014 BRCState.derived defaults\ + \ None, legacy acks/nacks/last_message_id untouched (legacy non-regression test\ + \ passes). Output is deterministic (sorted, byte-stable \u2014 slice-4 prereq).\ + \ Acceptance criteria met: 9/9 derivation tests pass against merged impl, ruff\ + \ clean. The egg_anchor directory-level pytest collection error is a pre-existing\ + \ environment path-collision (shadow copy at /opt/egg-runtime), unrelated to\ + \ this proposal." + ack_version: 1 + attestation: + tests_run: 9 + checks_passed: + - test + - lint + tests_verified: + - task-3-1 + files_reviewed: + - shared/egg_anchor/brc_derive.py + - shared/egg_anchor/models.py + - shared/egg_anchor/__init__.py + review_basis: verified derivation against orchestrator/peer_consensus.py replay + + orchestrator/routes/signals.py message emission; ran shared/egg_anchor/tests/test_brc_anchor_derivation.py + + orchestrator/tests/test_brc_anchor_derivation.py = 9 passed; ruff clean + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:39:40Z] reviewer_code → tester (CONSENSUS_ACK): ACK from reviewer_code for tester + +ACK slice-3 task-3-2 (align #3189 anchor tests to merged derivation). Ran both suites against working-tree egg_anchor with the proposed brc_derive.py/BRCDerivedAnchors (verified __file__, not the stale /opt copy): 9/9 pass, 0 skipped — the alignment commit correctly activates the previously skip-guarded assertions now that coder task-3-1 merged. Fixtures match the real BRC serialization I validated in my prior coder ACK (PROPOSE from_role=producer + metadata.version/commit_sha; ACK/NACK from_role=reviewer, to_role=producer, metadata.version/pre_merge_condition/reason; OBLIGATION_RESOLVED metadata.reviewer_role/producer_role). Assertions are non-vacuous across all four anchors: last-reviewed SHA per producer (superseded coder-v1 excluded), latest verdict per edge (NACK vs conditional-ACK), open NACK reason on current version, resolved-vs-unresolved obligation distinction; plus determinism (slice-4 prereq) and an unguarded BRCState legacy non-regression test. test_derivation_agrees_with_matrix cross-checks against the real ApprovalMatrix ground truth. ruff clean. Non-blocking nit only: _MODEL_CANDIDATES (line 54) defined-but-unused; _DERIVATION_CANDIDATES relies on the __init__ re-export rather than listing egg_anchor.brc_derive directly. + +````yaml +id: 14898758-3712-4a +phase: implement +metadata: + payload: + artifact_references: + - shared/egg_anchor/tests/test_brc_anchor_derivation.py + - orchestrator/tests/test_brc_anchor_derivation.py + reason: "ACK slice-3 task-3-2 (align #3189 anchor tests to merged derivation).\ + \ Ran both suites against working-tree egg_anchor with the proposed brc_derive.py/BRCDerivedAnchors\ + \ (verified __file__, not the stale /opt copy): 9/9 pass, 0 skipped \u2014 the\ + \ alignment commit correctly activates the previously skip-guarded assertions\ + \ now that coder task-3-1 merged. Fixtures match the real BRC serialization\ + \ I validated in my prior coder ACK (PROPOSE from_role=producer + metadata.version/commit_sha;\ + \ ACK/NACK from_role=reviewer, to_role=producer, metadata.version/pre_merge_condition/reason;\ + \ OBLIGATION_RESOLVED metadata.reviewer_role/producer_role). Assertions are\ + \ non-vacuous across all four anchors: last-reviewed SHA per producer (superseded\ + \ coder-v1 excluded), latest verdict per edge (NACK vs conditional-ACK), open\ + \ NACK reason on current version, resolved-vs-unresolved obligation distinction;\ + \ plus determinism (slice-4 prereq) and an unguarded BRCState legacy non-regression\ + \ test. test_derivation_agrees_with_matrix cross-checks against the real ApprovalMatrix\ + \ ground truth. ruff clean. Non-blocking nit only: _MODEL_CANDIDATES (line 54)\ + \ defined-but-unused; _DERIVATION_CANDIDATES relies on the __init__ re-export\ + \ rather than listing egg_anchor.brc_derive directly." + ack_version: 1 + attestation: + files_reviewed: + - shared/egg_anchor/tests/test_brc_anchor_derivation.py + - orchestrator/tests/test_brc_anchor_derivation.py + tests_run: 9 + tests_passed: 9 + tests_skipped: 0 + issues_found: 0 + lint: ruff clean + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:39:40Z] orchestrator → tester (STATUS): Ready to confirm — all confirm preconditions satisfied + +Your proposal (version 1) is ready to confirm — all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm. + +````yaml +id: af9d23e0-c4b1-4c +phase: implement +metadata: + ready_to_confirm: true + version: 1 + slice_id: slice-3 +```` + +### [2026-06-25T06:39:40Z] tester (CONSENSUS_CONFIRMED): Consensus confirmed by tester + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: cb40bc60-c813-40 +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:39:40Z] reviewer_code (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_code + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: a13ce8c4-06aa-4b +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:39:40Z] reviewer_code_holistic (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_code_holistic + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: 78278c64-2c8a-44 +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:39:40Z] reviewer_contract (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_contract + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: b6c6b78e-ec34-46 +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:39:40Z] reviewer_security (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_security + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: 395212e7-af3a-48 +phase: implement +metadata: + slice_id: slice-3 +```` + +### [2026-06-25T06:39:40Z] reviewer_concurrency (CONSENSUS_CONFIRMED): Consensus confirmed by reviewer_concurrency + +orchestrator-side confirm (#3064 event loop) + +````yaml +id: 351556a8-2372-48 +phase: implement +metadata: + slice_id: slice-3 +```` diff --git a/orchestrator/agent_model_resolution.py b/orchestrator/agent_model_resolution.py index fec5995c35..3d1df11383 100644 --- a/orchestrator/agent_model_resolution.py +++ b/orchestrator/agent_model_resolution.py @@ -457,11 +457,7 @@ def real_backend_window(model: str) -> int: conservative unknown window (:func:`_conservative_unknown_window`), which is 200_000 under the current registry. """ - bare = ( - model.removesuffix(_CONTEXT_1M_SUFFIX) - if model.endswith(_CONTEXT_1M_SUFFIX) - else model - ) + bare = model.removesuffix(_CONTEXT_1M_SUFFIX) if model.endswith(_CONTEXT_1M_SUFFIX) else model # Registry first: authoritative over the [1m] alias for sub-1M backends, so # a stray ``[1m]`` suffix can never inflate a sub-1M window to the implied 1M. if bare in _SUB_1M_CONTEXT_MODELS: diff --git a/orchestrator/tests/test_brc_anchor_derivation.py b/orchestrator/tests/test_brc_anchor_derivation.py new file mode 100644 index 0000000000..3c491fc5cf --- /dev/null +++ b/orchestrator/tests/test_brc_anchor_derivation.py @@ -0,0 +1,247 @@ +"""Orchestrator-side tests for the #3189 BRC anchor derivation (slice-3, task-3-2). + +#3200 / slice-3 ("Derive"). Companion to +``shared/egg_anchor/tests/test_brc_anchor_derivation.py``. That file feeds a +message-record fixture to the derivation; this file anchors the *ground truth* +to the existing consensus substrate — ``ApprovalMatrix`` / +``ApprovalEntry`` (``orchestrator/approval_matrix.py``) already track per-edge +verdict, ``ack_commit_sha``, NACK ``reason``, ``pre_merge_condition`` and the +``obligation_resolved`` flag. The four #3189 anchor fields are exactly a +deterministic projection of that matrix, so we build the matrix with its public +API (stable today) and assert the coder's derivation agrees. + +Tester and coder run as parallel BRC producers, so the derivation symbol may be +absent on the tester branch. ``_derivation`` skips until it lands (the slice +convention, see ``test_reseed_threshold.py``). The matrix-projection test +``test_matrix_substrate_models_four_fields`` carries NO guard: it asserts the +substrate the derivation must read, and runs today. +""" + +from __future__ import annotations + +import sys +from pathlib import Path +from typing import Any + +import pytest + +# Add orchestrator to sys.path the way the sibling orchestrator tests do. +_orchestrator_path = Path(__file__).parent.parent +if str(_orchestrator_path) not in sys.path: + sys.path.insert(0, str(_orchestrator_path)) + + +SHA_CODER_V1 = "aaaaaaa1111111111111111111111111111111aa" +SHA_CODER_V2 = "bbbbbbb2222222222222222222222222222222bb" +SHA_TESTER_V1 = "ccccccc3333333333333333333333333333333cc" + + +def _build_scenario_matrix() -> Any: + """The task-3-2 AC scenario, expressed against the real ApprovalMatrix. + + coder: ACK v1 -> re-propose v2 -> reviewer_code NACK v2 ("missing guard") + + reviewer_security conditional-ACK v2 (obligation, UNRESOLVED). + tester: conditional-ACK v1 (obligation) then obligation RESOLVED in-cycle. + """ + from approval_matrix import ApprovalMatrix + from review_graph import ReviewCriticality, ReviewEdge, ReviewGraph + + graph = ReviewGraph( + [ + ReviewEdge("reviewer_code", "coder", ReviewCriticality.CRITICAL), + ReviewEdge("reviewer_security", "coder", ReviewCriticality.CRITICAL), + ReviewEdge("reviewer_code", "tester", ReviewCriticality.CRITICAL), + ] + ) + matrix = ApprovalMatrix(graph) + + # coder v1 — reviewed (ACK), then superseded by v2. + matrix.record_proposal("coder") + matrix.record_ack("reviewer_code", "coder", version=1, commit_sha=SHA_CODER_V1) + matrix.record_proposal("coder") # v2 supersedes v1 + matrix.record_nack("reviewer_code", "coder", version=2, reason="missing guard") + matrix.record_ack( + "reviewer_security", + "coder", + version=2, + commit_sha=SHA_CODER_V2, + pre_merge_condition="git mv old new", + ) + + # tester v1 — conditional ACK then obligation resolved in-cycle. + matrix.record_proposal("tester") + matrix.record_ack( + "reviewer_code", + "tester", + version=1, + commit_sha=SHA_TESTER_V1, + pre_merge_condition="update import path", + ) + # Another role (not the producer) satisfies the obligation in-cycle: the + # producer may not self-resolve their own conditional-ACK obligation. + matrix.mark_obligation_resolved("reviewer_code", "tester", resolved_by="coder") + + return matrix + + +def _derivation() -> Any: + """Locate the coder's matrix-or-message derivation, or skip until it lands.""" + candidates = ( + ("brc_anchors", "derive_brc_anchors"), + ("brc_anchors", "derive_anchors"), + ("anchor_derivation", "derive_brc_anchors"), + ("approval_matrix", "derive_brc_anchors"), + ("peer_consensus", "derive_brc_anchors"), + ) + for module_name, attr in candidates: + try: + module = __import__(module_name, fromlist=[attr]) + except ImportError: + continue + fn = getattr(module, attr, None) + if fn is not None: + return fn + # Also try the egg_anchor package (shared is on PYTHONPATH). + for module_name, attr in ( + ("egg_anchor.brc_anchors", "derive_brc_anchors"), + ("egg_anchor", "derive_brc_anchors"), + ): + try: + module = __import__(module_name, fromlist=[attr]) + except ImportError: + continue + fn = getattr(module, attr, None) + if fn is not None: + return fn + pytest.skip("BRC anchor derivation not found yet (coder task-3-1 unmerged)") + + +# --------------------------------------------------------------------------- +# Ground-truth substrate — runs today, no guard. Locks the four-field +# projection the derivation must reproduce. +# --------------------------------------------------------------------------- + + +def test_matrix_substrate_models_four_fields() -> None: + """The ApprovalMatrix already carries all four #3189 anchor facts.""" + from approval_matrix import ApprovalState + + matrix = _build_scenario_matrix() + + # (ii) latest verdict per edge — current versions. + assert matrix.get_proposal_version("coder") == 2 + assert matrix.get_proposal_version("tester") == 1 + rc_coder = matrix.get_entry("reviewer_code", "coder") + rs_coder = matrix.get_entry("reviewer_security", "coder") + rc_tester = matrix.get_entry("reviewer_code", "tester") + assert rc_coder is not None and rc_coder.state is ApprovalState.NACKED + assert rs_coder is not None and rs_coder.state is ApprovalState.ACKED + assert rc_tester is not None and rc_tester.state is ApprovalState.ACKED + + # (i) last-reviewed SHA per edge (the reviewed proposal commit). + assert rs_coder.ack_commit_sha == SHA_CODER_V2 + assert rc_tester.ack_commit_sha == SHA_TESTER_V1 + + # (iii) open NACK reason on the current version. + nack_entries = matrix.get_nack_entries_for("coder") + reasons = {e.reason for _r, e in nack_entries} + assert "missing guard" in reasons + + # (iv) conditional-ACK obligations — unresolved vs resolved. + assert rs_coder.pre_merge_condition == "git mv old new" + assert rs_coder.obligation_resolved is False + assert rc_tester.pre_merge_condition == "update import path" + assert rc_tester.obligation_resolved is True + + +# --------------------------------------------------------------------------- +# Derivation agreement — skip-guarded until the coder's symbol lands. +# --------------------------------------------------------------------------- + + +def _scenario_messages() -> list[dict[str, Any]]: + """The same AC scenario as a BRC message record (derivation input). + + Equivalent to ``_build_scenario_matrix`` but expressed as the serialized + message dicts the derivation consumes — verdicts carry the producer in + ``to_role`` and the version/commit/reason/condition in ``metadata``. + """ + + def m(mtype: str, frm: str, seq: int, to: str = "all", **meta: Any) -> dict[str, Any]: + return { + "message_type": mtype, + "from_role": frm, + "to_role": to, + "id": f"msg-{seq:03d}", + "metadata": meta, + } + + return [ + m("CONSENSUS_PROPOSE", "coder", 1, version=1, commit_sha=SHA_CODER_V1), + m("CONSENSUS_ACK", "reviewer_code", 2, "coder", version=1, commit_sha=SHA_CODER_V1), + m("CONSENSUS_PROPOSE", "coder", 3, version=2, commit_sha=SHA_CODER_V2), + m("CONSENSUS_NACK", "reviewer_code", 4, "coder", version=2, reason="missing guard"), + m( + "CONSENSUS_ACK", + "reviewer_security", + 5, + "coder", + version=2, + commit_sha=SHA_CODER_V2, + pre_merge_condition="git mv old new", + ), + m("CONSENSUS_PROPOSE", "tester", 6, version=1, commit_sha=SHA_TESTER_V1), + m( + "CONSENSUS_ACK", + "reviewer_code", + 7, + "tester", + version=1, + commit_sha=SHA_TESTER_V1, + pre_merge_condition="update import path", + ), + m( + "CONSENSUS_OBLIGATION_RESOLVED", + "coder", + 8, + "tester", + producer_role="tester", + reviewer_role="reviewer_code", + ), + ] + + +def test_derivation_agrees_with_matrix() -> None: + """Message-record derivation reproduces the ApprovalMatrix four-field projection.""" + from approval_matrix import ApprovalState + + fn = _derivation() + matrix = _build_scenario_matrix() + anchors = fn(_scenario_messages()) + + # (i) last-reviewed SHA per producer == the matrix's reviewed proposal head. + last_reviewed = dict(anchors.last_reviewed_sha) + assert last_reviewed.get("coder") == SHA_CODER_V2, last_reviewed + assert last_reviewed.get("tester") == SHA_TESTER_V1, last_reviewed + assert SHA_CODER_V1 not in last_reviewed.values(), last_reviewed + + # (ii) latest verdict per edge agrees with matrix entry states. + verdict_by_edge = {(v.reviewer, v.producer): v.verdict.value for v in anchors.latest_verdicts} + assert verdict_by_edge[("reviewer_code", "coder")] == "nack" + assert verdict_by_edge[("reviewer_security", "coder")] in ("ack", "conditional_ack") + assert verdict_by_edge[("reviewer_code", "tester")] in ("ack", "conditional_ack") + assert ( + matrix.get_entry("reviewer_code", "coder").state is ApprovalState.NACKED + ) # ground-truth cross-check + + # (iii) open NACK reason on the current version. + nack_reasons = {(n.reviewer, n.producer): n.reason for n in anchors.open_nacks} + assert nack_reasons.get(("reviewer_code", "coder")) == "missing guard", nack_reasons + + # (iv) conditional-ACK obligations: coder's unresolved, tester's resolved. + obligations = {(o.reviewer, o.producer): o for o in anchors.conditional_ack_obligations} + coder_ob = obligations.get(("reviewer_security", "coder")) + tester_ob = obligations.get(("reviewer_code", "tester")) + assert coder_ob is not None and coder_ob.condition == "git mv old new" + assert coder_ob.resolved is False + assert tester_ob is not None and tester_ob.resolved is True diff --git a/shared/egg_anchor/__init__.py b/shared/egg_anchor/__init__.py index 46d6984bff..b84201d299 100644 --- a/shared/egg_anchor/__init__.py +++ b/shared/egg_anchor/__init__.py @@ -5,15 +5,21 @@ milestones. """ +from .brc_derive import derive_brc_anchors from .loader import load_anchor, save_anchor, sync_anchor_to_api from .models import ( AgentAnchor, AnchorMeta, + BRCDerivedAnchors, BRCState, + ConditionalAckObligation, Decision, ErrorEncountered, KeyContext, + OpenNack, ProgressItem, + ReviewEdgeVerdict, + ReviewVerdict, TaskInfo, ) from .validator import check_size_budget, validate_anchor @@ -21,13 +27,19 @@ __all__ = [ "AgentAnchor", "AnchorMeta", + "BRCDerivedAnchors", "BRCState", + "ConditionalAckObligation", "Decision", "ErrorEncountered", "KeyContext", + "OpenNack", "ProgressItem", + "ReviewEdgeVerdict", + "ReviewVerdict", "TaskInfo", "check_size_budget", + "derive_brc_anchors", "load_anchor", "save_anchor", "sync_anchor_to_api", diff --git a/shared/egg_anchor/brc_derive.py b/shared/egg_anchor/brc_derive.py new file mode 100644 index 0000000000..5dc8a51025 --- /dev/null +++ b/shared/egg_anchor/brc_derive.py @@ -0,0 +1,283 @@ +"""Mechanical derivation of the #3189 deterministic BRC anchors. + +From the BRC **message record** — the same list-of-dicts that +``read_peer_artifact`` and the orchestrator's ``_write_brc_history`` already +serialize — :func:`derive_brc_anchors` computes the four anchor fields the +protected root needs: + + (i) last-reviewed SHA per producer (latest reviewed ``proposal_commit_sha``); + (ii) latest verdict per reviewer->producer edge (ACK / NACK / conditional-ACK); + (iii) open NACK reasons (current-version NACKs not yet superseded); + (iv) conditional-ACK obligations (``pre_merge_condition``, resolved/unresolved). + +The derivation is **purely mechanical**: it reads only structured message +fields (``message_type``, ``from_role``, ``to_role``, ``metadata``), never +agent-authored prose, so the anchors cannot drift from the record. It mirrors +the message-replay semantics of ``orchestrator.peer_consensus`` — proposal +versions advance on re-propose, and verdicts / obligations against a +superseded version become historical — without taking a dependency on the +orchestrator package. + +This is the authoritative layer of the protected root: a threshold reseed +that re-derives these anchors from the record provably does not re-review a +settled SHA or drop a NACK obligation. + +**Caller scoping responsibility.** :func:`derive_brc_anchors` does NO slice +or phase filtering — unlike the orchestrator's +``reconstruct_tracker_from_messages``, which filters by ``slice_id`` + +``phase`` to avoid cross-slice state conflation (#2761). The contract is that +the caller passes a *pre-scoped* record: one slice's one phase. The +``.egg-state/brc-history/-.json`` files are already +per-slice/per-phase, so reading one of those satisfies the contract; passing +an unscoped, multi-slice stream would conflate versions across slices. +""" + +from __future__ import annotations + +from collections.abc import Iterable, Mapping +from typing import Any + +from .models import ( + BRCDerivedAnchors, + ConditionalAckObligation, + OpenNack, + ReviewEdgeVerdict, + ReviewVerdict, +) + +CONSENSUS_PROPOSE = "CONSENSUS_PROPOSE" +CONSENSUS_ACK = "CONSENSUS_ACK" +CONSENSUS_NACK = "CONSENSUS_NACK" +CONSENSUS_OBLIGATION_RESOLVED = "CONSENSUS_OBLIGATION_RESOLVED" + +__all__ = ["derive_brc_anchors"] + + +def _metadata(msg: Mapping[str, Any]) -> Mapping[str, Any]: + meta = msg.get("metadata") + return meta if isinstance(meta, Mapping) else {} + + +def _payload(msg: Mapping[str, Any]) -> Mapping[str, Any]: + payload = _metadata(msg).get("payload") + return payload if isinstance(payload, Mapping) else {} + + +def _version(msg: Mapping[str, Any]) -> int | None: + """Best-effort proposal version stamped on PROPOSE/ACK/NACK messages. + + Prefers the orchestrator-stamped ``metadata.version``; falls back to the + ``ack_version`` / ``nack_version`` the BRC MCP tools carry in the payload. + Returns None when no version is present (a pre-versioning historical + message), letting the caller fall back to the producer's current version. + """ + meta = _metadata(msg) + payload = _payload(msg) + for candidate in ( + meta.get("version"), + payload.get("version"), + payload.get("ack_version"), + payload.get("nack_version"), + ): + if isinstance(candidate, bool): # bool is an int subclass — reject + continue + if isinstance(candidate, int): + return candidate + if isinstance(candidate, str) and candidate.isdigit(): + return int(candidate) + return None + + +def _commit_sha(msg: Mapping[str, Any]) -> str: + meta = _metadata(msg) + return str(meta.get("commit_sha") or _payload(msg).get("commit_sha") or "") + + +def _pre_merge_condition(msg: Mapping[str, Any]) -> str: + meta = _metadata(msg) + payload = _payload(msg) + return str(meta.get("pre_merge_condition") or payload.get("pre_merge_condition") or "").strip() + + +def _resolved_in_diff(msg: Mapping[str, Any]) -> bool: + meta = _metadata(msg) + payload = _payload(msg) + in_diff = str( + meta.get("pre_merge_condition_resolved_in_diff") + or payload.get("pre_merge_condition_resolved_in_diff") + or "" + ).strip() + return bool(in_diff) or bool(payload.get("obligation_resolved")) + + +def _nack_reason(msg: Mapping[str, Any]) -> str: + meta = _metadata(msg) + payload = _payload(msg) + # Structured reason only — never the free-form ``body`` prose, which would + # make the anchor large and non-deterministic. + return str(payload.get("reason") or meta.get("reason") or "").strip() + + +def _ordered(messages: Iterable[Mapping[str, Any]]) -> list[Mapping[str, Any]]: + """Chronological order for deterministic replay. + + The serialized record is already chronological, but when every message + carries a timestamp we sort by ``(timestamp, id)`` to match the canonical + replay tiebreak in ``orchestrator.peer_consensus`` and to be robust to a + merged live+history stream. If any timestamp is missing we preserve input + order (a stable, deterministic fallback). + """ + msgs = list(messages) + if msgs and all(m.get("timestamp") for m in msgs): + return sorted(msgs, key=lambda m: (str(m.get("timestamp")), str(m.get("id") or ""))) + return msgs + + +def derive_brc_anchors(messages: Iterable[Mapping[str, Any]]) -> BRCDerivedAnchors: + """Derive the four #3189 anchor fields from a BRC message record. + + ``messages`` is the serialized BRC message record (a list of message + dicts as produced by ``read_peer_artifact`` / ``_write_brc_history``). + Non-consensus message types are ignored. The result is deterministic for a + given record: output lists are sorted by ``(producer, reviewer)`` and the + SHA map by producer. + """ + ordered = _ordered(messages) + + # producer -> current (latest) proposal version + producer_version: dict[str, int] = {} + # (producer, version) -> proposal_commit_sha + version_sha: dict[tuple[str, int], str] = {} + # (reviewer, producer) -> latest verdict state for that edge + edges: dict[tuple[str, str], dict[str, Any]] = {} + + for msg in ordered: + mtype = msg.get("message_type") + + if mtype == CONSENSUS_PROPOSE: + producer = msg.get("from_role") + if not producer: + continue + version = _version(msg) + if version is None: + version = producer_version.get(producer, 0) + 1 + producer_version[producer] = version + sha = _commit_sha(msg) + if sha: + version_sha[(producer, version)] = sha + + elif mtype in (CONSENSUS_ACK, CONSENSUS_NACK): + reviewer = msg.get("from_role") + producer = msg.get("to_role") + if not reviewer or not producer or producer == "all": + continue + version = _version(msg) + if version is None: + # No stamped version — attribute to the producer's current + # proposal (the version under review when this verdict landed). + version = producer_version.get(producer, 0) + key = (reviewer, producer) + if mtype == CONSENSUS_ACK: + condition = _pre_merge_condition(msg) + edges[key] = { + "verdict": (ReviewVerdict.CONDITIONAL_ACK if condition else ReviewVerdict.ACK), + "version": version, + "reason": "", + "condition": condition, + "resolved": _resolved_in_diff(msg), + } + else: # CONSENSUS_NACK + edges[key] = { + "verdict": ReviewVerdict.NACK, + "version": version, + "reason": _nack_reason(msg), + "condition": "", + "resolved": False, + } + + elif mtype == CONSENSUS_OBLIGATION_RESOLVED: + meta = _metadata(msg) + reviewer = meta.get("reviewer_role") + producer = meta.get("producer_role") or msg.get("to_role") + if not reviewer or not producer: + continue + state = edges.get((reviewer, producer)) + if state and state["verdict"] == ReviewVerdict.CONDITIONAL_ACK: + state["resolved"] = True + + return _assemble(producer_version, version_sha, edges) + + +def _assemble( + producer_version: dict[str, int], + version_sha: dict[tuple[str, int], str], + edges: dict[tuple[str, str], dict[str, Any]], +) -> BRCDerivedAnchors: + # Stable edge order: (producer, reviewer). + edge_keys = sorted(edges, key=lambda k: (k[1], k[0])) + + # (i) last-reviewed SHA per producer: SHA of the highest version any + # reviewer has verdicted on for that producer. NOTE this is a + # per-producer *max-across-reviewers* aggregate — NOT a per-edge value. + # The per-edge reviewed SHA (what a specific reviewer signed off on) + # lives in ``latest_verdicts[].reviewed_sha`` instead. + max_reviewed_version: dict[str, int] = {} + for (_reviewer, producer), state in edges.items(): + version = state["version"] + if version > max_reviewed_version.get(producer, -1): + max_reviewed_version[producer] = version + last_reviewed_sha: dict[str, str] = {} + for producer in sorted(max_reviewed_version): + sha = version_sha.get((producer, max_reviewed_version[producer]), "") + if sha: + last_reviewed_sha[producer] = sha + + # (ii) latest verdict per edge. + latest_verdicts: list[ReviewEdgeVerdict] = [ + ReviewEdgeVerdict( + reviewer=reviewer, + producer=producer, + verdict=edges[(reviewer, producer)]["verdict"], + version=edges[(reviewer, producer)]["version"], + reviewed_sha=version_sha.get((producer, edges[(reviewer, producer)]["version"]), ""), + ) + for (reviewer, producer) in edge_keys + ] + + # (iii) open NACKs: latest verdict is NACK AND it targets the producer's + # current proposal version (older NACKs are superseded). + open_nacks: list[OpenNack] = [] + # (iv) conditional-ACK obligations: latest verdict is a conditional ACK + # against the current proposal version (re-propose clears obligations). + obligations: list[ConditionalAckObligation] = [] + for reviewer, producer in edge_keys: + state = edges[(reviewer, producer)] + current = producer_version.get(producer, state["version"]) + if state["version"] != current: + continue + if state["verdict"] == ReviewVerdict.NACK: + open_nacks.append( + OpenNack( + reviewer=reviewer, + producer=producer, + version=state["version"], + reason=state["reason"], + ) + ) + elif state["verdict"] == ReviewVerdict.CONDITIONAL_ACK: + obligations.append( + ConditionalAckObligation( + reviewer=reviewer, + producer=producer, + version=state["version"], + condition=state["condition"], + resolved=state["resolved"], + ) + ) + + return BRCDerivedAnchors( + last_reviewed_sha=last_reviewed_sha, + latest_verdicts=latest_verdicts, + open_nacks=open_nacks, + conditional_ack_obligations=obligations, + ) diff --git a/shared/egg_anchor/models.py b/shared/egg_anchor/models.py index e696f28948..491785fccb 100644 --- a/shared/egg_anchor/models.py +++ b/shared/egg_anchor/models.py @@ -57,6 +57,19 @@ class ProgressState(StrEnum): BLOCKED = "blocked" +class ReviewVerdict(StrEnum): + """Latest verdict on a reviewer->producer review edge (#3189). + + Derived mechanically from the BRC message record, never transcribed by + an agent. ``CONDITIONAL_ACK`` is an ACK that carries a + ``pre_merge_condition`` pre-merge obligation (#1998). + """ + + ACK = "ack" + NACK = "nack" + CONDITIONAL_ACK = "conditional_ack" + + class AnchorMeta(BaseModel): """Anchor metadata for versioning and ordering.""" @@ -93,6 +106,81 @@ class Decision(BaseModel): timestamp: datetime = Field(..., description="When this decision was recorded") +class ReviewEdgeVerdict(BaseModel): + """Latest verdict on a single reviewer->producer edge (#3189). + + ``version`` is the producer proposal version the verdict applies to; + ``reviewed_sha`` is that proposal's ``proposal_commit_sha`` — the SHA the + reviewer actually reviewed — so a git-log delta against the producer's + current HEAD reveals exactly what changed since the last review. + """ + + reviewer: str = Field(..., description="Reviewer role") + producer: str = Field(..., description="Producer role") + verdict: ReviewVerdict = Field(..., description="Latest verdict on the edge") + version: int = Field(..., ge=0, description="Producer proposal version reviewed") + reviewed_sha: str = Field(default="", description="proposal_commit_sha reviewed") + + +class OpenNack(BaseModel): + """An unresolved NACK against the producer's CURRENT proposal version (#3189). + + A NACK whose ``version`` is older than the producer's current proposal + version is historical — superseded by a re-propose — and is NOT listed + here. This is the obligation a threshold reseed must never drop. + """ + + reviewer: str = Field(..., description="Reviewer role that NACKed") + producer: str = Field(..., description="Producer role NACKed") + version: int = Field(..., ge=0, description="Producer proposal version NACKed") + reason: str = Field(default="", description="Blocking reason cited in the NACK") + + +class ConditionalAckObligation(BaseModel): + """A pre-merge obligation attached to a conditional ACK (#1998, #3189). + + Carries ``resolved`` so the protected root distinguishes an obligation + still owed to the merger from one already satisfied in-cycle (#2338). + Only obligations against the producer's current proposal version are + listed — a re-propose clears prior obligations. + """ + + reviewer: str = Field(..., description="Reviewer role that conditionally ACKed") + producer: str = Field(..., description="Producer role the obligation is on") + version: int = Field(..., ge=0, description="Producer proposal version") + condition: str = Field(..., description="The pre_merge_condition text") + resolved: bool = Field(default=False, description="Whether satisfied in-cycle") + + +class BRCDerivedAnchors(BaseModel): + """The four #3189 deterministic BRC anchors derived from the message record. + + Every field is computed MECHANICALLY from the CONSENSUS_PROPOSE / ACK / + NACK / OBLIGATION_RESOLVED message record (see + :func:`egg_anchor.brc_derive.derive_brc_anchors`) — no agent-authored + content enters this layer, so it cannot drift from the record. These are + the authoritative anchors a threshold reseed must preserve: dropping them + would re-review settled SHAs or lose NACK obligations. + """ + + last_reviewed_sha: dict[str, str] = Field( + default_factory=dict, + description=("producer -> commit SHA of the latest proposal any reviewer has verdicted on"), + ) + latest_verdicts: list[ReviewEdgeVerdict] = Field( + default_factory=list, + description="Latest verdict per reviewer->producer edge", + ) + open_nacks: list[OpenNack] = Field( + default_factory=list, + description="Current-version NACKs not yet resolved by a re-propose", + ) + conditional_ack_obligations: list[ConditionalAckObligation] = Field( + default_factory=list, + description="Live pre-merge obligations with resolved/unresolved status", + ) + + class BRCState(BaseModel): """Broadcast-Review-Converge protocol state.""" @@ -101,6 +189,17 @@ class BRCState(BaseModel): acks: list[str] = Field(default_factory=list, description="Agent IDs that acknowledged") nacks: list[str] = Field(default_factory=list, description="Agent IDs that rejected") last_message_id: str | None = Field(default=None, description="Last message ID processed") + # Additive #3189 layer (default None on legacy anchors). Mechanically + # derived from the BRC message record; NEVER replaces acks/nacks/ + # last_message_id above — those keep their original agent-id-list meaning. + derived: BRCDerivedAnchors | None = Field( + default=None, + description=( + "Mechanically-derived #3189 anchors: last-reviewed SHA per producer, " + "latest verdict per edge, open NACKs, conditional-ACK obligations. " + "Additive and optional — None on legacy anchors." + ), + ) class KeyContext(BaseModel): diff --git a/shared/egg_anchor/tests/data/brc_record_real.json b/shared/egg_anchor/tests/data/brc_record_real.json new file mode 100644 index 0000000000..997732b04d --- /dev/null +++ b/shared/egg_anchor/tests/data/brc_record_real.json @@ -0,0 +1,749 @@ +[ + { + "id": "55134257-0286-42", + "pipeline_id": "issue-3200", + "from_role": "tester", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=propose (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:21:45.898740+00:00", + "phase": "implement" + }, + { + "id": "5ba05389-7b39-47", + "pipeline_id": "issue-3200", + "from_role": "coder", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=propose (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:21:45.905746+00:00", + "phase": "implement" + }, + { + "id": "751f46b5-d4ab-4e", + "pipeline_id": "issue-3200", + "from_role": "documenter", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=propose (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:21:46.367947+00:00", + "phase": "implement" + }, + { + "id": "d373dada-3ca2-4e", + "pipeline_id": "issue-3200", + "from_role": "documenter", + "to_role": "all", + "message_type": "CONSENSUS_PROPOSE", + "subject": "Proposal from documenter", + "body": "documenter no-op for slice-3 (derive #3189 anchor fields). This slice is pure internal-substrate derivation (shared/egg_anchor model extension + orchestrator-sourced anchor computation) plus fixture-based unit tests, with no documenter task and no user-facing documentation surface. No docs change is warranted at this layer; mechanism documentation belongs to the later flag-gating/generalization slices and the PR phase. Proposing no_changes_needed so consensus is not blocked on the documenter for slice-3.", + "metadata": { + "payload": { + "summary": "documenter no-op for slice-3 (derive #3189 anchor fields). This slice is pure internal-substrate derivation (shared/egg_anchor model extension + orchestrator-sourced anchor computation) plus fixture-based unit tests, with no documenter task and no user-facing documentation surface. No docs change is warranted at this layer; mechanism documentation belongs to the later flag-gating/generalization slices and the PR phase. Proposing no_changes_needed so consensus is not blocked on the documenter for slice-3.", + "attestation": {}, + "artifacts": [], + "risk_considered": "", + "commit_sha": "", + "files_changed": [], + "tests_run": [], + "tasks_satisfied": [], + "no_changes_needed": true, + "no_changes_reason": "Slice-3 derives the four #3189 anchor fields (last-reviewed SHA/producer, latest verdicts, open NACK reasons, conditional-ACK obligations) deterministically from the BRC message record and extends the shared/egg_anchor model additively. Both tasks (task-3-1 derivation, task-3-2 fixture tests) are pure internal substrate/code + unit tests with no documenter assignment and no user-facing documentation surface. User-facing docs for the overall context-discipline mechanism are appropriate once the feature is wired behind the flag (later slices) / at the PR phase, not for this isolated derivation layer. No documentation changes needed in this slice \u2014 consistent with the documenter no-op in slice-1." + }, + "version": 1, + "commit_sha": "", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:22:30.879784+00:00", + "phase": "implement" + }, + { + "id": "28f2612b-19fe-4b", + "pipeline_id": "issue-3200", + "from_role": "coder", + "to_role": "all", + "message_type": "CONSENSUS_PROPOSE", + "subject": "Proposal from coder", + "body": "slice-3 / task-3-1: deterministic derivation of the four #3189 BRC anchors from the message record. New shared/egg_anchor/brc_derive.py:derive_brc_anchors(messages) consumes the serialized BRC message record (read_peer_artifact / _write_brc_history shape) and mechanically computes: (i) last-reviewed SHA per producer (latest reviewed proposal_commit_sha), (ii) latest verdict per reviewer->producer edge (ACK/NACK/conditional-ACK), (iii) open NACK reasons (current-version NACKs not yet superseded by a re-propose), (iv) conditional-ACK obligations (pre_merge_condition, resolved/unresolved). Reads only structured message fields \u2014 never agent-authored prose \u2014 and mirrors orchestrator.peer_consensus replay semantics (versions advance on re-propose; superseded-version verdicts/obligations become historical) without importing the orchestrator package. egg_anchor models extended additively (ReviewVerdict, ReviewEdgeVerdict, OpenNack, ConditionalAckObligation, BRCDerivedAnchors + optional BRCState.derived default None); legacy BRCState.acks/nacks/last_message_id untouched. Verified deterministic + order-stable against the real .egg-state/brc-history record and a synthetic fixture (ACK->re-propose->NACK, conditional-ACK unresolved, obligation-resolved); AgentAnchor to_dict/from_dict round-trips; ruff+mypy clean; existing 98 egg_anchor tests pass. Tests for the fixture stream are task-3-2 (tester).", + "metadata": { + "payload": { + "summary": "slice-3 / task-3-1: deterministic derivation of the four #3189 BRC anchors from the message record. New shared/egg_anchor/brc_derive.py:derive_brc_anchors(messages) consumes the serialized BRC message record (read_peer_artifact / _write_brc_history shape) and mechanically computes: (i) last-reviewed SHA per producer (latest reviewed proposal_commit_sha), (ii) latest verdict per reviewer->producer edge (ACK/NACK/conditional-ACK), (iii) open NACK reasons (current-version NACKs not yet superseded by a re-propose), (iv) conditional-ACK obligations (pre_merge_condition, resolved/unresolved). Reads only structured message fields \u2014 never agent-authored prose \u2014 and mirrors orchestrator.peer_consensus replay semantics (versions advance on re-propose; superseded-version verdicts/obligations become historical) without importing the orchestrator package. egg_anchor models extended additively (ReviewVerdict, ReviewEdgeVerdict, OpenNack, ConditionalAckObligation, BRCDerivedAnchors + optional BRCState.derived default None); legacy BRCState.acks/nacks/last_message_id untouched. Verified deterministic + order-stable against the real .egg-state/brc-history record and a synthetic fixture (ACK->re-propose->NACK, conditional-ACK unresolved, obligation-resolved); AgentAnchor to_dict/from_dict round-trips; ruff+mypy clean; existing 98 egg_anchor tests pass. Tests for the fixture stream are task-3-2 (tester).", + "attestation": {}, + "artifacts": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py" + ], + "risk_considered": "Additive-only model change (new optional field + new sibling models) preserves the existing BRCState schema and AgentAnchor serialization (None-default field omitted by to_dict). Derivation tolerates pre-versioning historical messages (version fallback to producer's current proposal) and missing/empty metadata/payload defensively. No orchestrator dependency, so the shared package stays import-light.", + "commit_sha": "34278c681", + "files_changed": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "tests_run": [], + "tasks_satisfied": [ + "task-3-1" + ], + "no_changes_needed": false, + "no_changes_reason": "" + }, + "version": 1, + "commit_sha": "34278c681", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:02.109257+00:00", + "phase": "implement" + }, + { + "id": "f5827665-5fbb-43", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:09.717717+00:00", + "phase": "implement" + }, + { + "id": "31932193-44b5-4a", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:09.745977+00:00", + "phase": "implement" + }, + { + "id": "b537bf08-c657-49", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:11.147276+00:00", + "phase": "implement" + }, + { + "id": "a5292b8f-6185-4a", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:12.689936+00:00", + "phase": "implement" + }, + { + "id": "c8193200-4c6f-46", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "all", + "message_type": "HEARTBEAT", + "subject": "heartbeat: WORKING", + "body": "one-shot event arm action=ack (slice=slice-3)", + "metadata": { + "state": "WORKING", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:29:13.683691+00:00", + "phase": "implement" + }, + { + "id": "1d889305-7440-42", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_security for coder", + "body": "Security review clean. Pure additive deterministic derivation (brc_derive.derive_brc_anchors) + additive egg_anchor models. No dangerous sinks (no eval/exec/pickle/subprocess/file/network/secrets), no untrusted deserialization, no injection sinks. Reads only structured message fields and deliberately excludes free-form `body` prose \u2014 a trust-boundary positive that prevents agent narration from poisoning reseed-gating anchors. bool-rejection in _version and to_role=='all' filtering are correct. O(n), no regex/ReDoS. No new attack surface.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "Security review clean. Pure additive deterministic derivation (brc_derive.derive_brc_anchors) + additive egg_anchor models. No dangerous sinks (no eval/exec/pickle/subprocess/file/network/secrets), no untrusted deserialization, no injection sinks. Reads only structured message fields and deliberately excludes free-form `body` prose \u2014 a trust-boundary positive that prevents agent narration from poisoning reseed-gating anchors. bool-rejection in _version and to_role=='all' filtering are correct. O(n), no regex/ReDoS. No new attack surface.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:30:16.443882+00:00", + "phase": "implement" + }, + { + "id": "cd6ddecf-aec9-43", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_concurrency for coder", + "body": "Concurrency review PASS. derive_brc_anchors is a pure function: no module-level mutable state (only immutable str constants + __all__), all working state is function-local, so it is thread-safe across concurrent event-pump agents. No input mutation \u2014 _ordered materializes a fresh list(messages), messages are read-only via .get(), and the sole state[\"resolved\"]=True write targets brc_derive's own local edge dict, not the shared message snapshot. Deterministic replay order via (timestamp,id) tiebreak matches peer_consensus.py:2172 canonical ordering; outputs sorted by (producer,reviewer). Verified the one race that could drop a live NACK \u2014 version inflation under rapid/auto re-propose \u2014 is not possible: CONSENSUS_PROPOSE messages stamp metadata.version on both the manual (signals.py:2129) and auto-push (signals.py:3224) paths, and _version() reads the stamped version first; the incrementing fallback only triggers for legacy unstamped messages. No concurrency blockers.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "Concurrency review PASS. derive_brc_anchors is a pure function: no module-level mutable state (only immutable str constants + __all__), all working state is function-local, so it is thread-safe across concurrent event-pump agents. No input mutation \u2014 _ordered materializes a fresh list(messages), messages are read-only via .get(), and the sole state[\"resolved\"]=True write targets brc_derive's own local edge dict, not the shared message snapshot. Deterministic replay order via (timestamp,id) tiebreak matches peer_consensus.py:2172 canonical ordering; outputs sorted by (producer,reviewer). Verified the one race that could drop a live NACK \u2014 version inflation under rapid/auto re-propose \u2014 is not possible: CONSENSUS_PROPOSE messages stamp metadata.version on both the manual (signals.py:2129) and auto-push (signals.py:3224) paths, and _version() reads the stamped version first; the incrementing fallback only triggers for legacy unstamped messages. No concurrency blockers.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:32:55.876428+00:00", + "phase": "implement" + }, + { + "id": "18641460-6594-4b", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_contract for coder", + "body": "Contract-conformance ACK for slice-3 / task-3-1 (commit 34278c681). All acceptance criteria met: (1) the four #3189 anchors derive purely and mechanically from the BRC message record \u2014 derive_brc_anchors reads only structured fields (message_type/from_role/to_role/metadata[.payload]), never agent prose; NACK reason comes from structured payload.reason, not the free-form body. (2) Models extended additively \u2014 BRCDerivedAnchors + BRCState.derived (default None); acks/nacks/last_message_id at models.py:189+ keep their original agent-id-list meaning untouched, so no existing field breaks. (3) The four computations are correct against the real serialization schema: field-reading probes both metadata and metadata.payload defensively (version via metadata.version|payload.version|ack_version|nack_version; pre_merge_condition/resolved_in_diff via payload; OBLIGATION_RESOLVED via metadata.reviewer_role/producer_role), so it matches what signals.py actually stamps. last-reviewed SHA = SHA of highest reviewed version; open NACKs and conditional-ACK obligations correctly gated to the producer's current proposal version (re-propose supersedes), with resolved/unresolved replayed in chronological order. (4) No agent-authored content enters this layer. Output is deterministic (sorted edge keys + SHA map). Touching only shared/egg_anchor/ (not orchestrator/) is correct by design \u2014 the task requires the derivation to avoid an orchestrator dependency. Tests are the separate pending task-3-2.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "Contract-conformance ACK for slice-3 / task-3-1 (commit 34278c681). All acceptance criteria met: (1) the four #3189 anchors derive purely and mechanically from the BRC message record \u2014 derive_brc_anchors reads only structured fields (message_type/from_role/to_role/metadata[.payload]), never agent prose; NACK reason comes from structured payload.reason, not the free-form body. (2) Models extended additively \u2014 BRCDerivedAnchors + BRCState.derived (default None); acks/nacks/last_message_id at models.py:189+ keep their original agent-id-list meaning untouched, so no existing field breaks. (3) The four computations are correct against the real serialization schema: field-reading probes both metadata and metadata.payload defensively (version via metadata.version|payload.version|ack_version|nack_version; pre_merge_condition/resolved_in_diff via payload; OBLIGATION_RESOLVED via metadata.reviewer_role/producer_role), so it matches what signals.py actually stamps. last-reviewed SHA = SHA of highest reviewed version; open NACKs and conditional-ACK obligations correctly gated to the producer's current proposal version (re-propose supersedes), with resolved/unresolved replayed in chronological order. (4) No agent-authored content enters this layer. Output is deterministic (sorted edge keys + SHA map). Touching only shared/egg_anchor/ (not orchestrator/) is correct by design \u2014 the task requires the derivation to avoid an orchestrator dependency. Tests are the separate pending task-3-2.", + "ack_version": 1, + "attestation": { + "tasks_verified": [ + "task-3-1" + ] + } + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:33:21.891549+00:00", + "phase": "implement" + }, + { + "id": "d7849a9a-efdc-49", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_code_holistic for coder", + "body": "Holistic review PASS (first review, slice-3 task-3-1). derive_brc_anchors mechanically derives the four #3189 anchors from the BRC message record, and I verified it end-to-end \u2014 not just by reading. Ran the PROPOSED code against the REAL .egg-state/brc-history/3200-implement-slice-2.json record: it produced exactly-correct anchors (last_reviewed_sha coder->55387ff1, tester->335979385; 11 latest verdicts), and crucially it correctly SUPERSEDED reviewer_code_holistic's earlier NACK-on-tester with its later ACK (edge resolves to ack, open_nacks empty) \u2014 confirming the chronological replay + latest-verdict-per-edge logic mirrors orchestrator.peer_consensus without depending on it. Field-reading matches actual orchestrator message shapes (cross-checked signals.py + the live record): ACK carries metadata.version, NACK carries metadata.version=None with payload.nack_version (the _version() fallback chain handles this exact case), ACK/NACK to_role is the producer role (so the ==\\\"all\\\" guard doesn't drop verdicts), pre_merge_condition is in payload, OBLIGATION_RESOLVED carries reviewer_role/producer_role in metadata. Determinism holds (identical output under shuffled input; outputs sorted by (producer,reviewer); empty input safe). open_nacks/obligations correctly gated on version==producer-current so re-propose supersedes. Models are additive: BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched, None-omitting serialization keeps legacy anchors byte-identical. ruff clean; bool-is-int-subclass rejection in _version handled. Non-blocking note for the slice-4/5 consumer: CONSENSUS_WITHDRAW is not handled (would leave a stale edge), but the four enumerated message types are exactly the documented task scope, so out of scope here.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "Holistic review PASS (first review, slice-3 task-3-1). derive_brc_anchors mechanically derives the four #3189 anchors from the BRC message record, and I verified it end-to-end \u2014 not just by reading. Ran the PROPOSED code against the REAL .egg-state/brc-history/3200-implement-slice-2.json record: it produced exactly-correct anchors (last_reviewed_sha coder->55387ff1, tester->335979385; 11 latest verdicts), and crucially it correctly SUPERSEDED reviewer_code_holistic's earlier NACK-on-tester with its later ACK (edge resolves to ack, open_nacks empty) \u2014 confirming the chronological replay + latest-verdict-per-edge logic mirrors orchestrator.peer_consensus without depending on it. Field-reading matches actual orchestrator message shapes (cross-checked signals.py + the live record): ACK carries metadata.version, NACK carries metadata.version=None with payload.nack_version (the _version() fallback chain handles this exact case), ACK/NACK to_role is the producer role (so the ==\\\"all\\\" guard doesn't drop verdicts), pre_merge_condition is in payload, OBLIGATION_RESOLVED carries reviewer_role/producer_role in metadata. Determinism holds (identical output under shuffled input; outputs sorted by (producer,reviewer); empty input safe). open_nacks/obligations correctly gated on version==producer-current so re-propose supersedes. Models are additive: BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched, None-omitting serialization keeps legacy anchors byte-identical. ruff clean; bool-is-int-subclass rejection in _version handled. Non-blocking note for the slice-4/5 consumer: CONSENSUS_WITHDRAW is not handled (would leave a stale edge), but the four enumerated message types are exactly the documented task scope, so out of scope here.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:13.551428+00:00", + "phase": "implement" + }, + { + "id": "37f0f439-8eb7-43", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_code for coder", + "body": "ACK slice-3 task-3-1 (derive #3189 BRC anchors). Verified field extraction against the real orchestrator serialization (routes/signals.py + message_store.py): PROPOSE version=metadata.version, commit_sha=metadata.commit_sha w/ payload fallback; ACK version=metadata.version/payload.ack_version; NACK version=payload.nack_version (NACK carries no metadata.version \u2014 the _version() fallback chain handles it); NACK reason=payload.reason; pre_merge_condition + ..._resolved_in_diff under payload; OBLIGATION_RESOLVED uses metadata.reviewer_role/producer_role with no payload wrapper. All paths match. Derivation is purely mechanical (reads only structured fields, never body prose) \u2014 satisfies the no-agent-content AC. Replay semantics correct: superseded-version NACKs/obligations drop out of open_nacks/obligations on re-propose (verified by smoke test: NACK@v1 dropped after re-propose to v2; obligation resolution via both pre_merge_condition_resolved_in_diff and the OBLIGATION_RESOLVED message works). Models extended additively \u2014 BRCState.acks/nacks/last_message_id untouched, derived defaults None on legacy anchors. Deterministic: identical output under input reordering. ruff clean; 98 existing egg_anchor tests pass, no regression. Non-blocking notes for the wiring slices (not this task): last_reviewed_sha is a producer-level rollup (max version across reviewers) but per-edge reviewed_sha is preserved in latest_verdicts for the slice-4 role-parameterized root; and the deriver is slice-agnostic so callers must pass a per-slice record (read_peer_artifact/_write_brc_history already partition per slice). Tests are task-3-2 (tester).", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "ACK slice-3 task-3-1 (derive #3189 BRC anchors). Verified field extraction against the real orchestrator serialization (routes/signals.py + message_store.py): PROPOSE version=metadata.version, commit_sha=metadata.commit_sha w/ payload fallback; ACK version=metadata.version/payload.ack_version; NACK version=payload.nack_version (NACK carries no metadata.version \u2014 the _version() fallback chain handles it); NACK reason=payload.reason; pre_merge_condition + ..._resolved_in_diff under payload; OBLIGATION_RESOLVED uses metadata.reviewer_role/producer_role with no payload wrapper. All paths match. Derivation is purely mechanical (reads only structured fields, never body prose) \u2014 satisfies the no-agent-content AC. Replay semantics correct: superseded-version NACKs/obligations drop out of open_nacks/obligations on re-propose (verified by smoke test: NACK@v1 dropped after re-propose to v2; obligation resolution via both pre_merge_condition_resolved_in_diff and the OBLIGATION_RESOLVED message works). Models extended additively \u2014 BRCState.acks/nacks/last_message_id untouched, derived defaults None on legacy anchors. Deterministic: identical output under input reordering. ruff clean; 98 existing egg_anchor tests pass, no regression. Non-blocking notes for the wiring slices (not this task): last_reviewed_sha is a producer-level rollup (max version across reviewers) but per-edge reviewed_sha is preserved in latest_verdicts for the slice-4 role-parameterized root; and the deriver is slice-agnostic so callers must pass a per-slice record (read_peer_artifact/_write_brc_history already partition per slice). Tests are task-3-2 (tester).", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:43.900548+00:00", + "phase": "implement" + }, + { + "id": "c0981656-e036-4b", + "pipeline_id": "issue-3200", + "from_role": "tester", + "to_role": "all", + "message_type": "CONSENSUS_PROPOSE", + "subject": "Proposal from tester", + "body": "slice-3 (task-3-2): tests for the #3189 deterministic BRC anchor derivation, aligned to the merged coder implementation (task-3-1: derive_brc_anchors / BRCDerivedAnchors). Adds shared/egg_anchor/tests/test_brc_anchor_derivation.py and orchestrator/tests/test_brc_anchor_derivation.py. All 9 tests pass. Covers the four derived fields against a realistic AC-scenario message record (multiple producers; ACK-then-repropose+NACK; an unresolved obligation and a resolved-in-cycle obligation): last_reviewed_sha per producer (current reviewed head, superseded SHA absent); latest_verdicts per reviewer->producer edge; open_nacks reason on the current proposal version; conditional_ack_obligations with resolved/unresolved status flipped by CONSENSUS_OBLIGATION_RESOLVED; deterministic output (slice-4 byte-stability prereq); an ApprovalMatrix substrate cross-check; and BRCState legacy-field non-regression for the additive model extension.", + "metadata": { + "payload": { + "summary": "slice-3 (task-3-2): tests for the #3189 deterministic BRC anchor derivation, aligned to the merged coder implementation (task-3-1: derive_brc_anchors / BRCDerivedAnchors). Adds shared/egg_anchor/tests/test_brc_anchor_derivation.py and orchestrator/tests/test_brc_anchor_derivation.py. All 9 tests pass. Covers the four derived fields against a realistic AC-scenario message record (multiple producers; ACK-then-repropose+NACK; an unresolved obligation and a resolved-in-cycle obligation): last_reviewed_sha per producer (current reviewed head, superseded SHA absent); latest_verdicts per reviewer->producer edge; open_nacks reason on the current proposal version; conditional_ack_obligations with resolved/unresolved status flipped by CONSENSUS_OBLIGATION_RESOLVED; deterministic output (slice-4 byte-stability prereq); an ApprovalMatrix substrate cross-check; and BRCState legacy-field non-regression for the additive model extension.", + "attestation": { + "tests_run": 9, + "checks_passed": [ + "test", + "lint", + "security" + ], + "tests_passed": 9, + "tests_skipped": 0, + "test_command": "pytest shared/egg_anchor/tests/test_brc_anchor_derivation.py orchestrator/tests/test_brc_anchor_derivation.py", + "lint": "ruff check clean", + "security": "manual review: test-only files, no exec/subprocess/network/secrets; bandit unavailable in sandbox", + "notes": "All 9 tests pass against merged coder impl 34278c681." + }, + "artifacts": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py", + "3c0c9ad5a" + ], + "risk_considered": "Changed files are test-only (pytest fixtures + asserts): no subprocess/eval/network/filesystem/secret handling, so zero security surface. bandit is not installed in this sandbox; security attested via manual review of the diff. lint (ruff) and the 9-test suite were executed and pass.", + "commit_sha": "3c0c9ad5a", + "files_changed": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "tests_run": [], + "tasks_satisfied": [ + "task-3-2" + ], + "no_changes_needed": false, + "no_changes_reason": "" + }, + "version": 1, + "commit_sha": "3c0c9ad5a", + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:54.658138+00:00", + "phase": "implement" + }, + { + "id": "255855d1-9b48-41", + "pipeline_id": "issue-3200", + "from_role": "orchestrator", + "to_role": "documenter", + "message_type": "STATUS", + "subject": "Ready to confirm \u2014 all confirm preconditions satisfied", + "body": "Your proposal (version 1) is ready to confirm \u2014 all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm.", + "metadata": { + "ready_to_confirm": true, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:54.660116+00:00", + "phase": "implement" + }, + { + "id": "88066e33-2c64-49", + "pipeline_id": "issue-3200", + "from_role": "documenter", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by documenter", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:34:57.918580+00:00", + "phase": "implement" + }, + { + "id": "f462b025-7ad2-44", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_security for tester", + "body": "Security review clean. Test-only change aligning slice-3 fixtures to the merged coder derivation (brc_derive.derive_brc_anchors). No dangerous sinks: no eval/exec/pickle/subprocess/file/network/secrets, no untrusted deserialization, no injection. The only flagged constructs are __import__ calls in the skip-guard locators, which iterate hardcoded module-name allowlists with no untrusted input \u2014 standard parallel-BRC test pattern. pre_merge_condition strings (\"git mv old new\", \"update import path\") are inert fixture data asserted on, never executed. Fixtures exercise the same structured-field-only derivation already reviewed and ACKed for the coder. No new attack surface.", + "metadata": { + "payload": { + "artifact_references": [ + "orchestrator/tests/test_brc_anchor_derivation.py", + "shared/egg_anchor/tests/test_brc_anchor_derivation.py" + ], + "reason": "Security review clean. Test-only change aligning slice-3 fixtures to the merged coder derivation (brc_derive.derive_brc_anchors). No dangerous sinks: no eval/exec/pickle/subprocess/file/network/secrets, no untrusted deserialization, no injection. The only flagged constructs are __import__ calls in the skip-guard locators, which iterate hardcoded module-name allowlists with no untrusted input \u2014 standard parallel-BRC test pattern. pre_merge_condition strings (\"git mv old new\", \"update import path\") are inert fixture data asserted on, never executed. Fixtures exercise the same structured-field-only derivation already reviewed and ACKed for the coder. No new attack surface.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:35:55.262917+00:00", + "phase": "implement" + }, + { + "id": "91581d7d-9882-40", + "pipeline_id": "issue-3200", + "from_role": "coder", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by coder", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:35:56.961713+00:00", + "phase": "implement" + }, + { + "id": "ed948970-93f5-4d", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_security", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:35:56.964741+00:00", + "phase": "implement" + }, + { + "id": "9a1ed663-7385-4b", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_concurrency for tester", + "body": "Concurrency review PASS (first review, v1). The slice-3 derivation tests align fixtures to the merged derive_brc_anchors contract and introduce no concurrency hazards: each test builds fresh fixtures via _scenario_messages()/_build_scenario_matrix() (new lists+dicts per call), module state is limited to immutable SHA_* string constants, and there are no shared mutable fixtures \u2014 so the suite is safe under pytest-xdist parallelism with no test-ordering interference. The function under test is pure/thread-safe (verified for coder); fixtures feed read-only dicts and the two _derive calls in test_derivation_is_deterministic never mutate input. Determinism is asserted, locking the slice-4 reproducibility prereq. Non-blocking coverage note: fixtures omit `timestamp`, so _ordered (brc_derive.py:118-124) takes its input-order fallback rather than the (timestamp,id) canonical-sort path; the determinism test thus validates same-order reproducibility but not order-independence \u2014 the actual convergence guarantee for concurrent event-pump agents. That property is correctly implemented in already-ACKed derivation code, so this is a coverage gap not a defect. No concurrency blockers.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "reason": "Concurrency review PASS (first review, v1). The slice-3 derivation tests align fixtures to the merged derive_brc_anchors contract and introduce no concurrency hazards: each test builds fresh fixtures via _scenario_messages()/_build_scenario_matrix() (new lists+dicts per call), module state is limited to immutable SHA_* string constants, and there are no shared mutable fixtures \u2014 so the suite is safe under pytest-xdist parallelism with no test-ordering interference. The function under test is pure/thread-safe (verified for coder); fixtures feed read-only dicts and the two _derive calls in test_derivation_is_deterministic never mutate input. Determinism is asserted, locking the slice-4 reproducibility prereq. Non-blocking coverage note: fixtures omit `timestamp`, so _ordered (brc_derive.py:118-124) takes its input-order fallback rather than the (timestamp,id) canonical-sort path; the determinism test thus validates same-order reproducibility but not order-independence \u2014 the actual convergence guarantee for concurrent event-pump agents. That property is correctly implemented in already-ACKed derivation code, so this is a coverage gap not a defect. No concurrency blockers.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:36:35.937877+00:00", + "phase": "implement" + }, + { + "id": "0666e4b8-5149-48", + "pipeline_id": "issue-3200", + "from_role": "orchestrator", + "to_role": "coder", + "message_type": "STATUS", + "subject": "Ready to confirm \u2014 all confirm preconditions satisfied", + "body": "Your proposal (version 1) is ready to confirm \u2014 all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm.", + "metadata": { + "ready_to_confirm": true, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:36:35.940695+00:00", + "phase": "implement" + }, + { + "id": "de055fe3-f600-4c", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_concurrency", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:36:38.302556+00:00", + "phase": "implement" + }, + { + "id": "5c9dbf47-08cf-4d", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_code_holistic for tester", + "body": "Holistic review PASS (first review, slice-3 task-3-2). Verified end-to-end, not just by reading: ran BOTH test files at proposed commit 3c0c9ad5a against the merged derive_brc_anchors implementation -> 9 passed, 0 skipped. The delta realigns the fixtures from the old _Msg attribute-class shape (to_role hardcoded 'all', producer in metadata.producer_role, proposal_commit_sha helpers) to the merged plain-dict contract: producer carried in to_role, version/commit_sha/pre_merge_condition/reason in nested metadata. This alignment was NECESSARY and correct -- derive_brc_anchors reads producer=msg.get('to_role') and skips to_role=='all', so the pre-merge fixtures would have produced empty edges and failed; the realigned fixtures exercise the real four-field derivation (last_reviewed_sha supersedes coder v1->v2 to SHA_CODER_V2, NACK 'missing guard' surfaced on current version, conditional-ACK obligation 'git mv old new' unresolved vs tester's 'update import path' resolved via OBLIGATION_RESOLVED, deterministic output). Strong per-edge assertions live on the orchestrator side (test_derivation_agrees_with_matrix) which also cross-checks the REAL ApprovalMatrix substrate un-guarded; the egg_anchor side deliberately uses tolerant _get/_flatten matching to stay field-name-agnostic. Scope clean: two test files only, no production code; legacy BRCState non-regression passes (additive extension intact). Both locators resolve derive_brc_anchors via the egg_anchor package re-export (__init__.py __all__) despite the module being brc_derive.py. No blockers.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "reason": "Holistic review PASS (first review, slice-3 task-3-2). Verified end-to-end, not just by reading: ran BOTH test files at proposed commit 3c0c9ad5a against the merged derive_brc_anchors implementation -> 9 passed, 0 skipped. The delta realigns the fixtures from the old _Msg attribute-class shape (to_role hardcoded 'all', producer in metadata.producer_role, proposal_commit_sha helpers) to the merged plain-dict contract: producer carried in to_role, version/commit_sha/pre_merge_condition/reason in nested metadata. This alignment was NECESSARY and correct -- derive_brc_anchors reads producer=msg.get('to_role') and skips to_role=='all', so the pre-merge fixtures would have produced empty edges and failed; the realigned fixtures exercise the real four-field derivation (last_reviewed_sha supersedes coder v1->v2 to SHA_CODER_V2, NACK 'missing guard' surfaced on current version, conditional-ACK obligation 'git mv old new' unresolved vs tester's 'update import path' resolved via OBLIGATION_RESOLVED, deterministic output). Strong per-edge assertions live on the orchestrator side (test_derivation_agrees_with_matrix) which also cross-checks the REAL ApprovalMatrix substrate un-guarded; the egg_anchor side deliberately uses tolerant _get/_flatten matching to stay field-name-agnostic. Scope clean: two test files only, no production code; legacy BRCState non-regression passes (additive extension intact). Both locators resolve derive_brc_anchors via the egg_anchor package re-export (__init__.py __all__) despite the module being brc_derive.py. No blockers.", + "ack_version": 1 + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:37:35.023142+00:00", + "phase": "implement" + }, + { + "id": "98213206-e3da-49", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_code_holistic", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:37:35.632248+00:00", + "phase": "implement" + }, + { + "id": "1b41298c-8ffa-47", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_contract for tester", + "body": "Contract-conformance ACK for slice-3/task-3-2 (commit 3c0c9ad5a): tests aligned to the merged derive_brc_anchors. Fixtures faithfully match the real serialization contract (plain message dicts with nested metadata; verdicts carry the producer in to_role; version/commit_sha/pre_merge_condition/reason in metadata; OBLIGATION_RESOLVED carries reviewer_role/producer_role) \u2014 the inaccurate dual attribute/dict _Msg shim was correctly dropped. All four #3189 anchors are asserted: (i) last-reviewed SHA per producer (coder->v2, tester->v1, superseded v1 absent), (ii) latest verdict per reviewer->producer edge, (iii) open NACK reason on current version (\"missing guard\"), (iv) conditional-ACK obligations resolved/unresolved. Assertions match real model field names and ReviewVerdict enum values exactly. The orchestrator file adds an ApprovalMatrix ground-truth cross-check locking the anchors as a deterministic projection of the existing consensus substrate; legacy BRCState non-regression and determinism are also covered. Verified against the merged implementation (local brc_derive.py byte-identical to 3c0c9ad5a): ran both files \u2014 9 passed, 0 skipped, confirming the previously skip-guarded assertions now activate per the slice-3 \"Derive\" merge convention. No blockers.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "reason": "Contract-conformance ACK for slice-3/task-3-2 (commit 3c0c9ad5a): tests aligned to the merged derive_brc_anchors. Fixtures faithfully match the real serialization contract (plain message dicts with nested metadata; verdicts carry the producer in to_role; version/commit_sha/pre_merge_condition/reason in metadata; OBLIGATION_RESOLVED carries reviewer_role/producer_role) \u2014 the inaccurate dual attribute/dict _Msg shim was correctly dropped. All four #3189 anchors are asserted: (i) last-reviewed SHA per producer (coder->v2, tester->v1, superseded v1 absent), (ii) latest verdict per reviewer->producer edge, (iii) open NACK reason on current version (\"missing guard\"), (iv) conditional-ACK obligations resolved/unresolved. Assertions match real model field names and ReviewVerdict enum values exactly. The orchestrator file adds an ApprovalMatrix ground-truth cross-check locking the anchors as a deterministic projection of the existing consensus substrate; legacy BRCState non-regression and determinism are also covered. Verified against the merged implementation (local brc_derive.py byte-identical to 3c0c9ad5a): ran both files \u2014 9 passed, 0 skipped, confirming the previously skip-guarded assertions now activate per the slice-3 \"Derive\" merge convention. No blockers.", + "ack_version": 1, + "attestation": { + "tasks_verified": [ + "task-3-2" + ] + } + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:37:53.175862+00:00", + "phase": "implement" + }, + { + "id": "92c7997b-7171-4e", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_contract", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:37:57.673227+00:00", + "phase": "implement" + }, + { + "id": "4c8b3378-6e41-47", + "pipeline_id": "issue-3200", + "from_role": "tester", + "to_role": "coder", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from tester for coder", + "body": "tester review of slice-3 task-3-1 (derive #3189 BRC anchors). Verified the derivation against real orchestrator replay semantics (peer_consensus.py replay + signals.py emission): PROPOSE producer=from_role with authoritative metadata.version; ACK/NACK producer=to_role with payload.ack_version/nack_version; OBLIGATION_RESOLVED roles from metadata. The version-increment path is a legacy-only fallback, so superseded-version logic for open_nacks/obligations cannot silently drop an open NACK. All four anchor fields (last_reviewed_sha, latest_verdicts, open_nacks, conditional_ack_obligations) derive purely from structured fields (no agent prose). Model extension is additive \u2014 BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched (legacy non-regression test passes). Output is deterministic (sorted, byte-stable \u2014 slice-4 prereq). Acceptance criteria met: 9/9 derivation tests pass against merged impl, ruff clean. The egg_anchor directory-level pytest collection error is a pre-existing environment path-collision (shadow copy at /opt/egg-runtime), unrelated to this proposal.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "reason": "tester review of slice-3 task-3-1 (derive #3189 BRC anchors). Verified the derivation against real orchestrator replay semantics (peer_consensus.py replay + signals.py emission): PROPOSE producer=from_role with authoritative metadata.version; ACK/NACK producer=to_role with payload.ack_version/nack_version; OBLIGATION_RESOLVED roles from metadata. The version-increment path is a legacy-only fallback, so superseded-version logic for open_nacks/obligations cannot silently drop an open NACK. All four anchor fields (last_reviewed_sha, latest_verdicts, open_nacks, conditional_ack_obligations) derive purely from structured fields (no agent prose). Model extension is additive \u2014 BRCState.derived defaults None, legacy acks/nacks/last_message_id untouched (legacy non-regression test passes). Output is deterministic (sorted, byte-stable \u2014 slice-4 prereq). Acceptance criteria met: 9/9 derivation tests pass against merged impl, ruff clean. The egg_anchor directory-level pytest collection error is a pre-existing environment path-collision (shadow copy at /opt/egg-runtime), unrelated to this proposal.", + "ack_version": 1, + "attestation": { + "tests_run": 9, + "checks_passed": [ + "test", + "lint" + ], + "tests_verified": [ + "task-3-1" + ], + "files_reviewed": [ + "shared/egg_anchor/brc_derive.py", + "shared/egg_anchor/models.py", + "shared/egg_anchor/__init__.py" + ], + "review_basis": "verified derivation against orchestrator/peer_consensus.py replay + orchestrator/routes/signals.py message emission; ran shared/egg_anchor/tests/test_brc_anchor_derivation.py + orchestrator/tests/test_brc_anchor_derivation.py = 9 passed; ruff clean" + } + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:38:01.429495+00:00", + "phase": "implement" + }, + { + "id": "14898758-3712-4a", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code", + "to_role": "tester", + "message_type": "CONSENSUS_ACK", + "subject": "ACK from reviewer_code for tester", + "body": "ACK slice-3 task-3-2 (align #3189 anchor tests to merged derivation). Ran both suites against working-tree egg_anchor with the proposed brc_derive.py/BRCDerivedAnchors (verified __file__, not the stale /opt copy): 9/9 pass, 0 skipped \u2014 the alignment commit correctly activates the previously skip-guarded assertions now that coder task-3-1 merged. Fixtures match the real BRC serialization I validated in my prior coder ACK (PROPOSE from_role=producer + metadata.version/commit_sha; ACK/NACK from_role=reviewer, to_role=producer, metadata.version/pre_merge_condition/reason; OBLIGATION_RESOLVED metadata.reviewer_role/producer_role). Assertions are non-vacuous across all four anchors: last-reviewed SHA per producer (superseded coder-v1 excluded), latest verdict per edge (NACK vs conditional-ACK), open NACK reason on current version, resolved-vs-unresolved obligation distinction; plus determinism (slice-4 prereq) and an unguarded BRCState legacy non-regression test. test_derivation_agrees_with_matrix cross-checks against the real ApprovalMatrix ground truth. ruff clean. Non-blocking nit only: _MODEL_CANDIDATES (line 54) defined-but-unused; _DERIVATION_CANDIDATES relies on the __init__ re-export rather than listing egg_anchor.brc_derive directly.", + "metadata": { + "payload": { + "artifact_references": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "reason": "ACK slice-3 task-3-2 (align #3189 anchor tests to merged derivation). Ran both suites against working-tree egg_anchor with the proposed brc_derive.py/BRCDerivedAnchors (verified __file__, not the stale /opt copy): 9/9 pass, 0 skipped \u2014 the alignment commit correctly activates the previously skip-guarded assertions now that coder task-3-1 merged. Fixtures match the real BRC serialization I validated in my prior coder ACK (PROPOSE from_role=producer + metadata.version/commit_sha; ACK/NACK from_role=reviewer, to_role=producer, metadata.version/pre_merge_condition/reason; OBLIGATION_RESOLVED metadata.reviewer_role/producer_role). Assertions are non-vacuous across all four anchors: last-reviewed SHA per producer (superseded coder-v1 excluded), latest verdict per edge (NACK vs conditional-ACK), open NACK reason on current version, resolved-vs-unresolved obligation distinction; plus determinism (slice-4 prereq) and an unguarded BRCState legacy non-regression test. test_derivation_agrees_with_matrix cross-checks against the real ApprovalMatrix ground truth. ruff clean. Non-blocking nit only: _MODEL_CANDIDATES (line 54) defined-but-unused; _DERIVATION_CANDIDATES relies on the __init__ re-export rather than listing egg_anchor.brc_derive directly.", + "ack_version": 1, + "attestation": { + "files_reviewed": [ + "shared/egg_anchor/tests/test_brc_anchor_derivation.py", + "orchestrator/tests/test_brc_anchor_derivation.py" + ], + "tests_run": 9, + "tests_passed": 9, + "tests_skipped": 0, + "issues_found": 0, + "lint": "ruff clean" + } + }, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.794562+00:00", + "phase": "implement" + }, + { + "id": "af9d23e0-c4b1-4c", + "pipeline_id": "issue-3200", + "from_role": "orchestrator", + "to_role": "tester", + "message_type": "STATUS", + "subject": "Ready to confirm \u2014 all confirm preconditions satisfied", + "body": "Your proposal (version 1) is ready to confirm \u2014 all blocking reviews are clear and global confirm preconditions are met. Run `egg-orch consensus confirmed` to confirm.", + "metadata": { + "ready_to_confirm": true, + "version": 1, + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.796486+00:00", + "phase": "implement" + }, + { + "id": "cb40bc60-c813-40", + "pipeline_id": "issue-3200", + "from_role": "tester", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by tester", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.897805+00:00", + "phase": "implement" + }, + { + "id": "a13ce8c4-06aa-4b", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_code", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.899565+00:00", + "phase": "implement" + }, + { + "id": "78278c64-2c8a-44", + "pipeline_id": "issue-3200", + "from_role": "reviewer_code_holistic", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_code_holistic", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.900662+00:00", + "phase": "implement" + }, + { + "id": "b6c6b78e-ec34-46", + "pipeline_id": "issue-3200", + "from_role": "reviewer_contract", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_contract", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.901205+00:00", + "phase": "implement" + }, + { + "id": "395212e7-af3a-48", + "pipeline_id": "issue-3200", + "from_role": "reviewer_security", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_security", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.902601+00:00", + "phase": "implement" + }, + { + "id": "351556a8-2372-48", + "pipeline_id": "issue-3200", + "from_role": "reviewer_concurrency", + "to_role": "all", + "message_type": "CONSENSUS_CONFIRMED", + "subject": "Consensus confirmed by reviewer_concurrency", + "body": "orchestrator-side confirm (#3064 event loop)", + "metadata": { + "slice_id": "slice-3" + }, + "timestamp": "2026-06-25T06:39:40.902847+00:00", + "phase": "implement" + } +] \ No newline at end of file diff --git a/shared/egg_anchor/tests/test_brc_anchor_derivation.py b/shared/egg_anchor/tests/test_brc_anchor_derivation.py new file mode 100644 index 0000000000..e1ada6a552 --- /dev/null +++ b/shared/egg_anchor/tests/test_brc_anchor_derivation.py @@ -0,0 +1,448 @@ +"""Tests for the #3189 deterministic BRC anchor derivation (slice-3, task-3-2). + +#3200 / slice-3 ("Derive"). The coder (task-3-1) lands a *deterministic* +derivation that, from the BRC message record (CONSENSUS_PROPOSE / ACK / NACK / +conditional-ACK / OBLIGATION_RESOLVED), computes the four #3189 anchor fields +that become the authoritative layer of the protected root (slice-4): + + (i) last-reviewed SHA per producer — the latest *reviewed* proposal commit + per reviewer->producer edge; + (ii) latest verdict per reviewer->producer edge (acked / nacked / pending); + (iii) open NACK reasons — NACKs on the producer's *current* proposal version + that are not yet resolved; + (iv) conditional-ACK obligations — ``pre_merge_condition`` text per edge with + a resolved / unresolved status. + +The derivation is mechanical (never agent-transcribed) and the +``shared/egg_anchor`` model is extended *additively* — ``BRCState.acks`` / +``nacks`` / ``last_message_id`` (``models.py:96-103``) must keep working. + +Tester and coder run as parallel BRC producers on separate branches, so the +coder's derivation symbol and the extended model fields may be absent when this +file is collected on the tester branch. The locator helpers ``pytest.skip`` +until the implementation merges — the established slice convention (see +``orchestrator/tests/test_reseed_threshold.py``) — which keeps the suite green +pre-merge and runs the assertions at PR assembly. The legacy-non-regression +test below has no such guard: it asserts the existing ``BRCState`` contract that +must survive the additive extension, and therefore runs today. +""" + +from __future__ import annotations + +import json +from pathlib import Path +from typing import Any, cast + +import pytest + +# --------------------------------------------------------------------------- +# Locators (skip-guard convention) — resolve the coder's symbols or skip. +# --------------------------------------------------------------------------- + +# Candidate (module, attribute) pairs for the derivation entry point. The coder +# owns the exact name; these cover the plausible spellings so the assertions +# activate the moment any one of them lands. +_DERIVATION_CANDIDATES: tuple[tuple[str, str], ...] = ( + ("egg_anchor.brc_anchors", "derive_brc_anchors"), + ("egg_anchor.brc_anchors", "derive_anchors"), + ("egg_anchor.derivation", "derive_brc_anchors"), + ("egg_anchor.derivation", "derive_anchors"), + ("egg_anchor.models", "derive_brc_anchors"), + ("egg_anchor", "derive_brc_anchors"), + ("egg_anchor", "derive_anchors"), +) + +# Candidate names for the additive model carrying the four derived fields. +_MODEL_CANDIDATES: tuple[tuple[str, str], ...] = ( + ("egg_anchor.models", "BRCAnchors"), + ("egg_anchor.models", "BRCReviewAnchors"), + ("egg_anchor.models", "ReviewAnchors"), + ("egg_anchor.models", "DeterministicAnchors"), + ("egg_anchor", "BRCAnchors"), +) + + +def _resolve(candidates: tuple[tuple[str, str], ...], what: str) -> Any: + for module_name, attr in candidates: + try: + module = __import__(module_name, fromlist=[attr]) + except ImportError: + continue + obj = getattr(module, attr, None) + if obj is not None: + return obj + pytest.skip( + f"{what} not found yet (coder task-3-1 unmerged); " + f"tried {[f'{m}.{a}' for m, a in candidates]}" + ) + + +def _derivation() -> Any: + return _resolve(_DERIVATION_CANDIDATES, "BRC anchor derivation") + + +def _derive(messages: list[Any]) -> Any: + """Call the coder's derivation with whichever call shape it accepts.""" + fn = _derivation() + for kwargs in ({}, {"messages": messages}): + try: + if kwargs: + return fn(**kwargs) + return fn(messages) + except TypeError: + continue + pytest.skip("derivation present but call signature did not match (messages list)") + + +# --------------------------------------------------------------------------- +# Field accessors — tolerate dict-shaped or attribute-shaped output and the +# several reasonable names for each of the four fields. +# --------------------------------------------------------------------------- + + +def _get(obj: Any, names: tuple[str, ...], what: str) -> Any: + for name in names: + if isinstance(obj, dict) and name in obj: + return obj[name] + if hasattr(obj, name): + return getattr(obj, name) + pytest.skip(f"derived anchors expose no {what} field (tried {list(names)})") + + +def _last_reviewed(anchors: Any) -> Any: + return _get( + anchors, + ("last_reviewed_shas", "last_reviewed_sha", "last_reviewed_commit_shas", "last_reviewed"), + "last-reviewed-SHA", + ) + + +def _verdicts(anchors: Any) -> Any: + return _get( + anchors, + ("latest_verdicts", "verdicts", "latest_verdict", "verdict_by_edge"), + "latest-verdict", + ) + + +def _open_nacks(anchors: Any) -> Any: + return _get( + anchors, + ("open_nacks", "open_nack_reasons", "open_nacks_by_edge", "nacks"), + "open-NACK", + ) + + +def _obligations(anchors: Any) -> Any: + return _get( + anchors, + ("conditional_ack_obligations", "obligations", "pre_merge_obligations", "ack_obligations"), + "conditional-ACK-obligation", + ) + + +def _flatten(value: Any) -> str: + """Render a (possibly nested) container as one searchable string.""" + return repr(value) + + +# --------------------------------------------------------------------------- +# Fixture: a realistic BRC message record exercising the task-3-2 AC scenario. +# --------------------------------------------------------------------------- + +SHA_CODER_V1 = "aaaaaaa1111111111111111111111111111111aa" +SHA_CODER_V2 = "bbbbbbb2222222222222222222222222222222bb" +SHA_TESTER_V1 = "ccccccc3333333333333333333333333333333cc" + + +def _msg( + message_type: str, + from_role: str, + seq: int, + *, + to_role: str = "all", + **metadata: Any, +) -> dict[str, Any]: + """A BRC message record entry — the plain-dict shape the derivation consumes. + + Mirrors ``read_peer_artifact`` / ``_write_brc_history`` output: top-level + ``message_type`` / ``from_role`` / ``to_role`` / ``id`` plus a nested + ``metadata`` dict carrying the orchestrator-stamped consensus fields. + """ + return { + "message_type": message_type, + "from_role": from_role, + "to_role": to_role, + "id": f"msg-{seq:03d}", + "metadata": metadata, + } + + +def _scenario_messages() -> list[dict[str, Any]]: + """Multiple producers; ACK then re-propose + NACK; conditional ACKs. + + coder: v1 proposed -> reviewer_code ACK v1; re-proposed v2 -> + reviewer_code NACK v2 ("missing guard") AND reviewer_security + conditional-ACK v2 (obligation "git mv old new", UNRESOLVED). + tester: v1 proposed -> reviewer_code conditional-ACK v1 + (obligation "update import path") then OBLIGATION_RESOLVED. + + Verdict messages carry the producer in ``to_role`` (the edge target) and the + proposal version + commit/condition/reason in ``metadata``. + """ + return [ + # coder v1 — ACKed, then superseded. + _msg("CONSENSUS_PROPOSE", "coder", 1, version=1, commit_sha=SHA_CODER_V1), + _msg( + "CONSENSUS_ACK", "reviewer_code", 2, to_role="coder", version=1, commit_sha=SHA_CODER_V1 + ), + # coder re-proposes v2 — supersedes v1. + _msg("CONSENSUS_PROPOSE", "coder", 3, version=2, commit_sha=SHA_CODER_V2), + _msg( + "CONSENSUS_NACK", "reviewer_code", 4, to_role="coder", version=2, reason="missing guard" + ), + _msg( + "CONSENSUS_ACK", + "reviewer_security", + 5, + to_role="coder", + version=2, + commit_sha=SHA_CODER_V2, + pre_merge_condition="git mv old new", + ), + # tester v1 — conditional ACK then obligation resolved in-cycle. + _msg("CONSENSUS_PROPOSE", "tester", 6, version=1, commit_sha=SHA_TESTER_V1), + _msg( + "CONSENSUS_ACK", + "reviewer_code", + 7, + to_role="tester", + version=1, + commit_sha=SHA_TESTER_V1, + pre_merge_condition="update import path", + ), + _msg( + "CONSENSUS_OBLIGATION_RESOLVED", + "coder", # a non-producer role satisfies it; tester cannot self-resolve + 8, + to_role="tester", + producer_role="tester", + reviewer_role="reviewer_code", + resolved_by="coder", + ), + ] + + +# --------------------------------------------------------------------------- +# Legacy non-regression — runs today (no skip-guard), guards the additive +# extension required by task-3-1. +# --------------------------------------------------------------------------- + + +def test_legacy_brcstate_fields_untouched() -> None: + """``BRCState.acks`` / ``nacks`` / ``last_message_id`` survive the extension.""" + from egg_anchor.models import BRCState + + state = BRCState( + acks=["reviewer_code"], + nacks=["reviewer_security"], + last_message_id="msg-008", + ) + assert state.acks == ["reviewer_code"] + assert state.nacks == ["reviewer_security"] + assert state.last_message_id == "msg-008" + + # Defaults remain backwards-compatible (empty lists, no last id). + default = BRCState() + assert default.acks == [] + assert default.nacks == [] + assert default.last_message_id is None + + +# --------------------------------------------------------------------------- +# Derivation correctness — skip-guarded until the coder's symbol lands. +# --------------------------------------------------------------------------- + + +def test_last_reviewed_sha_per_producer() -> None: + """Latest *reviewed* proposal commit is surfaced per producer.""" + anchors = _derive(_scenario_messages()) + blob = _flatten(_last_reviewed(anchors)) + # coder's reviewed head advanced to v2; tester reviewed at v1. + assert SHA_CODER_V2 in blob, blob + assert SHA_TESTER_V1 in blob, blob + # The superseded v1 coder proposal is NOT the last-reviewed SHA. + assert SHA_CODER_V1 not in blob, blob + + +def test_latest_verdict_per_edge() -> None: + """Each reviewer->producer edge resolves to its current-version verdict.""" + verdicts = _verdicts(_derive(_scenario_messages())) + blob = _flatten(verdicts).lower() + # reviewer_code -> coder is NACKED on v2; reviewer_security -> coder ACKED; + # reviewer_code -> tester ACKED. + assert "nack" in blob, blob + assert "ack" in blob, blob + + +def test_open_nack_reason_on_current_version() -> None: + """The current-version NACK reason is an open anchor; ACKs are not NACKs.""" + nacks = _open_nacks(_derive(_scenario_messages())) + blob = _flatten(nacks) + assert "missing guard" in blob, blob + + +def test_unresolved_obligation_surfaced() -> None: + """An unresolved conditional-ACK obligation is carried with its text.""" + obligations = _derive(_scenario_messages()) + blob = _flatten(_obligations(obligations)) + assert "git mv old new" in blob, blob + + +def test_resolved_obligation_marked_resolved() -> None: + """A resolved obligation is distinguished from an unresolved one. + + The tester's ``update import path`` obligation was resolved in-cycle; the + coder's ``git mv old new`` obligation was not. The derived anchors must let + a consumer tell them apart — whether by omitting the resolved one from an + "open obligations" view or by carrying an explicit resolved flag. + """ + obligations = _obligations(_derive(_scenario_messages())) + blob = _flatten(obligations) + unresolved_present = "git mv old new" in blob + + assert unresolved_present, blob + if "update import path" not in blob: + # Resolved obligation filtered out of the open view — acceptable. + return + # Resolved obligation retained — then a resolved/unresolved marker must + # exist so the two are distinguishable. + assert any( + token in blob.lower() for token in ("resolved", "true", "false", "open", "satisfied") + ), blob + + +def test_derivation_is_deterministic() -> None: + """Identical message records derive byte-identical anchors (slice-4 prereq).""" + first = _derive(_scenario_messages()) + second = _derive(_scenario_messages()) + assert _flatten(first) == _flatten(second) + + +# --------------------------------------------------------------------------- +# Real-record regression — feed an *actual* captured BRC message record, not a +# hand-built fixture, so a future rename of an orchestrator metadata key breaks +# a test here rather than silently turning the derivation into a no-op on live +# data (egg-reviewer suggestion, PR #3238). +# --------------------------------------------------------------------------- + +# A verbatim copy of a real ``.egg-state/brc-history/-.json`` record +# (this very slice's implement phase), committed under ``tests/data/`` so the +# test is self-contained and does not depend on the transient state directory. +_REAL_RECORD_PATH = Path(__file__).parent / "data" / "brc_record_real.json" + + +def _real_record() -> list[dict[str, Any]]: + if not _REAL_RECORD_PATH.exists(): # pragma: no cover - fixture is committed + pytest.skip(f"real BRC record fixture missing: {_REAL_RECORD_PATH}") + return cast(list[dict[str, Any]], json.loads(_REAL_RECORD_PATH.read_text())) + + +def test_real_record_locks_live_message_shape() -> None: + """Derive against a real captured record (37 messages incl. HEARTBEAT/STATUS). + + The hand-built fixtures above mirror the orchestrator's message shape by + hand. This feeds the real serialized record through the derivation and pins + the exact output, so any drift in the field names the derivation reads + (``metadata.version`` / ``metadata.commit_sha`` / ``to_role`` / …) surfaces + as a failing assertion instead of a silently-empty anchor on live data. + """ + anchors = _derive(_real_record()) + + # Both producers' reviewed heads surface; the no-op documenter (no proposal + # commit) is correctly absent. Non-consensus messages are ignored. + last_reviewed = dict(_last_reviewed(anchors)) + assert last_reviewed == {"coder": "34278c681", "tester": "3c0c9ad5a"}, last_reviewed + + # 6 reviewers ACK coder + 5 ACK tester == 11 edges in this real pipeline. + assert len(list(_verdicts(anchors))) == 11 + + # That pipeline reached clean consensus — no open NACK, no obligation. + assert list(_open_nacks(anchors)) == [] + assert list(_obligations(anchors)) == [] + + +# --------------------------------------------------------------------------- +# Timestamp-ordering path — the hand-built fixtures omit ``timestamp`` and so +# take the input-order fallback in ``_ordered``. Real records always carry +# timestamps and take the ``(timestamp, id)`` sort path; this exercises it +# directly (egg-reviewer suggestion, PR #3238). +# --------------------------------------------------------------------------- + + +def _ts_msg( + message_type: str, + from_role: str, + seq: int, + timestamp: str, + *, + to_role: str = "all", + **metadata: Any, +) -> dict[str, Any]: + msg = _msg(message_type, from_role, seq, to_role=to_role, **metadata) + msg["timestamp"] = timestamp + return msg + + +def test_timestamp_sort_path_recovers_chronology() -> None: + """A timestamped record delivered out of order is replayed chronologically. + + Messages are handed to the derivation newest-first; only the ``_ordered`` + ``(timestamp, id)`` sort recovers the real sequence. The assertions below + fail under the input-order fallback (the edge would settle on the earlier + v1 ACK), so this test genuinely pins the timestamp path the unit fixtures + never reach. + """ + out_of_order = [ + _ts_msg( + "CONSENSUS_NACK", + "reviewer_code", + 4, + "2026-06-25T00:00:40+00:00", + to_role="coder", + version=2, + reason="missing guard", + ), + _ts_msg( + "CONSENSUS_PROPOSE", + "coder", + 3, + "2026-06-25T00:00:30+00:00", + version=2, + commit_sha=SHA_CODER_V2, + ), + _ts_msg( + "CONSENSUS_ACK", + "reviewer_code", + 2, + "2026-06-25T00:00:20+00:00", + to_role="coder", + version=1, + commit_sha=SHA_CODER_V1, + ), + _ts_msg( + "CONSENSUS_PROPOSE", + "coder", + 1, + "2026-06-25T00:00:10+00:00", + version=1, + commit_sha=SHA_CODER_V1, + ), + ] + anchors = _derive(out_of_order) + + # Chronology recovered: the current verdict is the v2 NACK, not the v1 ACK. + assert "missing guard" in _flatten(_open_nacks(anchors)) + last_reviewed = _flatten(_last_reviewed(anchors)) + assert SHA_CODER_V2 in last_reviewed, last_reviewed + assert SHA_CODER_V1 not in last_reviewed, last_reviewed