Pipeline boundary docs, capability kill switches, and crediting for code the tree cannot reach - #10
Merged
Merged
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 7 minutes Limit details: You’ve used the included review currently available. Your 67 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (25)
Comment |
…aware tests Rebased onto current main and RECONCILED against PR #11, which landed overlapping work while this was in flight. Three of my commits were dropped as superseded: PR #11's partitioned-review registration, its test_gate_blocks_execution correction, and — better placed than mine — its stall-watcher heartbeat, which it put on `watch.classify_lane`, the shared primitive every driver calls, rather than in one sweep. Only my truncation fix survives in redirect_sweep. THE BOUNDARY. Fleet-level conclusions were drawn from local artifacts alone: "the fleet has no work", "true_open: 1 is the ceiling", "something worked those issues without the opener". None were grounded in the pipeline's system-of-record, and the workspace CLAUDE.md forbids exactly that while naming the same incident shape from 2026-04-29. Nothing in THIS repo's docs said the Orchestrator is one part of a larger pipeline, so the module rules read as the whole world. CLAUDE.md gains a §-1 section ahead of §0: the pipeline (approved-issue queue -> opener lane -> Actions keepalive -> closer lane), this tool's three real interfaces to it, and the rule — before any fleet claim, read the owning Workflows doc and NAME it. ARCHITECTURE.md and orchestrator-loop.svg move together per the contract, and the SVG <desc> carries the same correction so a screen reader gets it. Two things that mislead if unstated, now stated: "Orchestrator" is overloaded — the keepalive contract's own "Orchestrator Invariants" means the GitHub Actions concurrency/round orchestration, a different system — and double-dispatch is prevented by a coarse whole-round freshness heartbeat, not a per-issue lock, so no new dispatch path may assume per-target locking. backlog.json and issue_readiness's census now carry a `scope` field naming them orchestrator-local. Prose in a docstring does not travel with the JSON, which is how a 1-item list became "fleet starvation" twice, six weeks apart. backlog's payload is extracted to build_payload() so the label is asserted against the real artifact. KILL SWITCHES. ORCH_DISABLE_STEPS is one mechanism for every step instead of a flag per capability: it announces every skip (a silent disable IS the latched-gate pattern), touches no stamp (deferring work, never faking completion), and warns on an unknown key so a typo cannot leave a step running while you believe it is off. Fails toward motion. ORCH_OFFLOAD_DISABLED refuses before provisioning, model resolution or any ledger write — the selftest asserts the heartbeat is NOT reached, which is what proves nothing was spent. ORCH_REPO_PLAYBOOK=0 stops playbook injection on the next dispatch. ADMISSION. Two declared exemptions, each needing a category AND a rationale: safety_guard (a confinement's OFF state is more dangerous than its ON state) and compute_only (stopping a computation blinds a consumer rather than halting an action). The anti-abuse condition is the point — compute_only must NAME a control_point and known_controls() verifies that switch exists in the tree, because "read-only" is exactly what a capability would self-certify to clear a red. offload is the control case for both: same complaint, real switch. CREDITING CODE THE TREE CANNOT REACH. heartbeat_reachable asked whether a heartbeat sits on the entrypoint's path, unanswerable for two shapes. Lane modules are prompt SCHEMAS that never execute — every non-test reference is a template string — so dispatcher.build_prompt is the real path. docs-drift-fix-agent lives in another repository; the bridge observes that repo's completed workflow runs, idempotent on the run id because this capability's deferral uses its invocation COUNT as a revisit trigger. Both DECLARED from existing mappings, never inferred, each with a narrowness control. LEARNING INTEGRITY. _record_influence_edge_in_conn raises on a null target_event_id unless the caller passes allow_unlinked — the sibling record_capability_consumption already did, while this inserted silently and 296 such edges accumulated, 202 from one backfill that reported plain success. unblock() stops telling three different situations to "fix outcome linkage" when for two of them that work does not exist. collect() recovers an arm's diff from its exp/ branch when the worktree is gone; without it collect returned an empty diff and followup stamped followup-skip.json, permanently recording "evidence lost" while the branch sat intact. MACHINE STATE IS A SKIP PREREQUISITE, NOT A FAILURE. Tests asserting on declaration-owned ledger fields were green where the declarations had been applied and red on a fresh checkout with the code correct. env_prereq gains ledger_declaration_absent(), the sibling missing next to ledger_rows_absent; the skip ceiling rises 24 -> 26 for exactly the two tests that need it, with which and why recorded in the floor file — because the alternative, asserting machine state as a code expectation, is what made three tests red on a correct tree. CONSOLIDATION. watch_sweep.py is DELETED (owner decision). Nothing consumed its report — its only references outside itself were its own CLI strings and the cadence registry entry — while redirect_sweep does the identical claims->classify_lane loop every tick. With PR #11 crediting stall-watcher at watch.classify_lane, the deletion loses nothing. Fixed in passing: max_reports truncated silently, so a sweep could report "50 watched" of 300 live claims and read as complete. HYGIENE. The three _slug helpers are renamed for their namespaces rather than unified — nothing joins their outputs, and merging them would rewrite existing entry_ids, prompt paths and backfill- exp_ids for no gain. Credential reads get a bounded retry and a reason_class so a cloud-sync blip stops reading as a missing credential. Log rotation is copytruncate, not rename, because a rename during a running tick detaches the writer. aider's route entries are deliberately KEPT (owner decision) with a test pinning all three directions. Verified on current main: 343 passed, 0 failed, 0/26 max skipped, 81 selftests, 5/5 gates, activation audit 41/41, admission 5 enforced / 3 legacy debt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
stranske
force-pushed
the
claude/pipeline-boundary-docs
branch
from
August 22, 2026 15:27
f8cc6aa to
ade581d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four commits, off
main(06dff6a), fast-forward. Verified against the exact tree withverify.py:343 passed, 0 failed, 0/24 max skipped, 81 selftests, 5/5 gates, activation audit 41/41, admission 5 enforced / 3 legacy debt.
Why this exists
Fleet-level conclusions were drawn from local artifacts alone — "the fleet has no work", "
true_open: 1is the ceiling", "something worked those issues without the opener". None were grounded in the pipeline's system-of-record, and the workspaceCLAUDE.mdalready forbids exactly that, naming the same incident shape from 2026-04-29. Nothing in this repo's docs said the Orchestrator is one part of a larger pipeline, so the module rules read as the whole world.What's here
docs:the boundary.CLAUDE.mdgains a §−1 section ahead of §0 — the pipeline (approved-issue queue → opener lane → Actions keepalive → closer lane), this tool's three real interfaces to it, and the rule: before any fleet claim, read the owning Workflows doc and name it.ARCHITECTURE.mdandorchestrator-loop.svgmove together per the contract, and the SVG<desc>carries the same correction so a screen reader gets it. Two things that mislead if unstated are now stated: "Orchestrator" is overloaded (the keepalive contract's own "Orchestrator Invariants" means the GitHub Actions round orchestration), and double-dispatch is prevented by a coarse whole-round heartbeat, not a per-issue lock.feat:kill switches and honest reporting.ORCH_DISABLE_STEPSis one mechanism for every step instead of a flag per capability — it announces every skip, touches no stamp, and warns on an unknown key so a typo can't leave a step running while you believe it's off.ORCH_OFFLOAD_DISABLEDrefuses before any spend.ORCH_REPO_PLAYBOOK=0stops prompt injection on the next dispatch. Two declared admission exemptions (safety_guard,compute_only), the second requiring acontrol_pointthatknown_controls()verifies exists in the tree.watch_sweep.pyis deleted andstall-watchercredited from the sweep that actually runs hourly._record_influence_edge_in_connnow refuses a null target unless the caller declares it.unblock()stops telling three different situations to "fix outcome linkage" when for two of them that work doesn't exist.collect()recovers an arm's diff from itsexp/branch when the worktree is gone.fix:machine-local ledger state is a skip prerequisite. Three tests asserted on declaration-owned ledger fields, which are applied to the running instance and never shipped — green where applied, red on a fresh checkout with the code correct.env_prereq.ledger_declaration_absent()is the sibling that was missing; all three now skip with the missing thing named, bounded by the skip ceiling.fix:partitioned-reviewcredited. Registered with a real caller (dispatcher.py review-corpus), a kill switch and a dedup finding, but no heartbeat and no fixture — so the audit read it unreachable andcaller_existsfailed as a consequence. Not my feature; fixed because the gate was red against the shared ledger and the missing parts were two small ones.Notes for review
mainrather than moved fromcodex/partitioned-review-reconciliation, which is behind main by 1317 lines. Nothing of main's is regressed and no other session's in-flight work travels.aider's route entries are deliberately kept (owner decision):BACKUP_AGENTSalready holds it out of routine selection, and--agent aiderresolves through those entries. A new test pins all three directions.🤖 Generated with Claude Code