weichen
fed87ad14b
Consolidate approved policies and add local lease, document CAS, commit, candidate and environment gates. Preserve conservative recovery and cleanup limits.
70 lines
4.1 KiB
JSON
70 lines
4.1 KiB
JSON
{
|
|
"status": "complete_all_findings_fixed",
|
|
"scope": "Independent bounded verification of original ce-code-review findings 1-5; no broad review.",
|
|
"worktree": "/home/weichen/projects/Agent-System/.worktrees/agent-governance-implementation",
|
|
"original_receipt": "/tmp/compound-engineering-1000/ce-code-review/20260921-133611-5e4781e6/review.json",
|
|
"findings": [
|
|
{
|
|
"id": 1,
|
|
"status": "fixed",
|
|
"evidence": [
|
|
"agentctl.py:855-865 admit_candidate requires exactly two parents, frozen first parent, current owning task HEAD, and task-bound exact SHA validation.",
|
|
"agentctl.py:880-882 applies shared admission in reference hook and requires integrate kind and old/new fingerprint for dev.",
|
|
"Independent test_validated_linear_commit_cannot_bypass_candidate_entrypoint PASS; exact merge promotion test PASS."
|
|
]
|
|
},
|
|
{
|
|
"id": 2,
|
|
"status": "fixed",
|
|
"evidence": [
|
|
"agentctl.py:517-561 shared supervise used by execute, validate and integrate; installs SIGINT/SIGTERM handler before child spawn, terminates child process group, escalates after five seconds, waits and checks surviving group.",
|
|
"validate preserves recovery if group survives; integrate preserves recovery for nonzero result. Integration holds git:index in addition to git:dev.",
|
|
"Independent test_interrupted_validation_stops_child_before_releasing_scope PASS, using pidfd to verify child exit.",
|
|
"Independent test_validated_merge_candidate_is_exactly_promoted_to_dev PASS, including SIGINT at Git boundary, unchanged dev, blocked index resource until recovery, then successful exact promotion."
|
|
]
|
|
},
|
|
{
|
|
"id": 3,
|
|
"status": "fixed",
|
|
"evidence": [
|
|
"candidate-images-build.sh:55-61 exports immutable requested commit via git archive; both Dockerfiles and both build contexts use that export.",
|
|
"Independent test_build_context_is_frozen_when_managed_source_changes PASS: managed mutable-source change admitted while fake Docker reads original archived content.",
|
|
"Manifest includes source_tree and source_context=git-archive."
|
|
]
|
|
},
|
|
{
|
|
"id": 4,
|
|
"status": "fixed",
|
|
"evidence": [
|
|
"agentctl.py:158-170 build cleanliness retains tracked/unrelated-untracked rejection and permits only untracked files under .doc/test-reports/assets/promotion-receipts/.",
|
|
"Default nightly health, expected-tests and Go evidence all use that prefix before ensure_candidate_images.",
|
|
"Independent test_build_accepts_nightly_evidence_excluded_from_build_context PASS with fake Docker; git archive excludes untracked evidence."
|
|
]
|
|
},
|
|
{
|
|
"id": 5,
|
|
"status": "fixed",
|
|
"evidence": [
|
|
"matrix_states and doc_rows now normalize leading spaces before detecting table rows; status cells are trimmed and canonical states checked.",
|
|
"Independent rerun of test_admin_document_cannot_bypass_done_with_compact_cells PASS with indent 0, 1, 2 and 3; each asserts nonzero exit and unchanged bytes.",
|
|
"Independent original temporary Git/SQLite reproduction rerun: docs:publish and docs:admin without docs:approve cannot replace | core | planned | with one-space-indented | core |done| through @document; exit=1, EVIDENCE_REQUIRED, and document unchanged."
|
|
],
|
|
"verification_history": "Initial verification found one leading-space variant remaining; parent fixed it and independent rerun confirms closure."
|
|
}
|
|
],
|
|
"narrowly_related_regressions": [],
|
|
"validation": {
|
|
"independent_focused_tests_passed": 7,
|
|
"additional_reproductions": {
|
|
"leading_space_done_bypass": "closed: rerun denied EVIDENCE_REQUIRED and preserved document"
|
|
},
|
|
"supplemental_test": "test_failed_revalidation_revokes_old_success_receipt PASS",
|
|
"final_followup_tests_passed": 1
|
|
},
|
|
"limits": [
|
|
"No real Docker image build, full nightly, product runtime, database service, external provider, repository mutation, Git index update or commit performed.",
|
|
"Build tests use fake Docker boundary and real temporary Git/SQLite.",
|
|
"No claim of different-model independence."
|
|
]
|
|
}
|