weichen/Agent-System-Dev
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Remove host fallback and enforce strict normal routes

Browse Source 
Why: The approved contract requires exactly three safe attempts for Cursor, agy, and PI, then one Codex emergency attempt, never host implementation authority.

Evidence: Routing/config tests were RED for never, max attempts, forbidden adapters, and legacy host fallback; 133 related tests now pass with one opt-in probe skipped.

Impact: Normal emergency-mode roles reject all non-Cursor/agy/PI adapters, project fallback is never, and Codex remains available through emergency/review paths.

Refs: independent Codex review of feature/agent-cli-enforcement
This commit is contained in:
weichen
2026-10-15 18:45:08 +00:00
parent 28f000af8b
commit 818e17f421
12 changed files with 494 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENT-EXECUTION.md
+11 -6
View File
@@ -8,11 +8,16 @@ parser accepts exactly one `agent-execution` fenced block.
U3's execution controller and U4's project wiring are integrated. This file is
the execution-routing authority for implementation, repair, test, and review.
Normal implementation, repair, and test routes stay Cursor, Antigravity
(`agy`), and PI. Each profile may be attempted up to
`max_attempts_per_profile`. Only after those candidates safely exhaust their
attempts does the enabled emergency `codex` profile run once. Codex remains out
of the three normal role lists and may also appear in review. A configured
emergency profile replaces host write fallback. Cursor uses
(`agy`), and PI. Each of those profiles may be attempted up to
`max_attempts_per_profile`, which is exactly 3 whenever `emergency_profile`
is configured. Only after those candidates safely exhaust their attempts does
the enabled emergency `codex` profile run once. Codex remains out of the three
normal role lists and may also appear in review. `fallback_to_host` is
`never`: the controller does not emit `host-fallback-authorized` and does not
increment host fallback authorizations. Safe exhaustion without an emergency
candidate ends `unavailable` or `blocked`, and that result does not authorize
the host to write the unit. The legacy value `all-unavailable` remains
parseable and likewise grants no host write authority. Cursor uses
`cursor-agent-stable`. `model: auto` lets each CLI use its configured default
model; PI therefore uses the operator-selected MiniMax default.
@@ -22,7 +27,7 @@ schema: agent-execution/v1
execution:
fresh_process_per_unit: true
permission: run-everything
fallback_to_host: all-unavailable
fallback_to_host: never
max_parallel: 3
timeout_seconds: 7200
idle_timeout_seconds: 600