Repository navigation
Audit agent architecture and remove legacy rule injector - #66
Merged
Merged
Conversation
Make effect declarations mandatory across registry, subagent, MCP, and unavailable plugin surfaces. Replace opaque Crosslink argv dispatch with typed operations and fail closed for unknown or malformed calls.
Migrate tracked legacy Chainlink state to canonical Crosslink project configuration, register Claude/Codex MCP integrations, and ignore generated Python bytecode and runtime artifacts.
Make hard and explicit denials dominate narrow, expiring approval authority across every frontend. Bind one-use execution permits to the exact normalized call, store reusable receipts only in trusted bounded host state, and serialize permit consumption with concurrent revocation.
Enforce a generation-bound host ceiling and exact dispatch permits across every canonical tool entry point. Separate repository permission proposals from trusted host authority, preserve typed failures, and harden sandbox cancellation discovered during adversarial verification.
Remove ambient session authority across dispatch, files, processes, hooks, MCP, prompts, plugins, approvals, and frontend lifecycle boundaries. Add exact-run adversarial coverage, secure plan/control storage, lifecycle retirement evidence, and the completed S-019 artifact receipt.
Capture the host-home toolchain root at run composition, include it in the capability manifest, and preserve it across derived runs instead of consulting ambient HOME during sandbox execution. Strengthen the Linux probe to exercise the exact run-resolved Cargo mount on hosted runners.
Remove shell-string auto-approval and the lexical path authority gate. Keep Bash behind explicit policy and enforce filesystem access in the run-bound OS sandbox, with adversarial dispatch and containment evidence recorded in S-020.
Restore the last machine-maintained changelog state and replay normal issue-close events with Crosslink's exact category, ordering, and multiplicity semantics. Preserve explicit --no-changelog closures.
Replace process-global turn counters with exact-run atomic effect, mutation, line, and canonical-resource reservations. Preserve uncertain started effects as typed partial outcomes and enforce recursive disclosure policy before returning paths.
Introduce a generation-bound, descriptor-relative Unix persistence capability with typed durability and recovery receipts. Preserve session compatibility, strengthen diagnostic path feedback, and document adversarial verification and platform queues for S-031.
Wire fresh semantic workers, effective ACP capability generations, and canonical proxy route lifecycles. Preserve native provider state and worker artifacts, rebind generated retrieval evidence, and allow normal trusted-driver Git operations while retaining destructive guards.\n\nRefs #1166 #1167 #1168 #1169 #1170 #1171
Refs: #1172
Run worktree discovery and lifecycle tests against disposable Git repositories instead of the live checkout and its shared .worktrees directory. Preserve the production sandbox and cleanup behavior while making primary and linked checkout execution deterministic.\n\nRefs #1055
Use the disposable repository capability for the main-worktree exit refusal test and require the exact safety error. This removes the final ambient linked-checkout dependency found by detached-worktree verification.\n\nRefs #1055
Preserve the Crosslink-generated closure entry for #1055 verbatim.\n\nRefs #1173
Keep supervised stdin delivery strict by default, but let command hooks opt into an explicit early-close policy. Record incomplete delivery truthfully while preserving the child exit status, timeout, cancellation, output, and sandbox contracts.\n\nFixes #1174
Preserve the Crosslink-generated closure entry for #1174 verbatim.\n\nRefs #1175
Wire generation-bound plugin capabilities through production frontends, replace the synthetic keybinding path with the shared contextual resolver, and add the host-only alternate-model verifier role. Preserve exact Crosslink changelog output and regenerate cited technical-memory evidence for the final source generation.
Update the main and fuzz lock graphs from yanked chacha20 0.10.1 to the compatible 0.10.2 patch so fresh-index repository policy checks remain enforceable.
Use one artifact-bound verifier ledger, retain transport-observed model identity, join verifier-owned process work, deliver digest-bound source snapshots, and exercise the real child/tool harness end to end. Preserve the generated Crosslink changelog and rebound technical-memory evidence.
Complete S-084, S-085, and S-095 under parent issue #1188. Production-wire durable authorized schedules, measured read speculation, and protocol-correct proxy streaming with honest VDD delivery semantics.
Refs: #1194
Introduce the strict versioned verdict contract, bind finding identities and locations to current reality evidence, and reject malformed or contradictory terminal output. Keep heuristic duplicate and pattern matches advisory so only evidence-backed verification can demote a finding.\n\nRefs: #1196
Make VDD publication host-owned and fail closed across text and worker frontends, while bounding provider calls, subprocesses, usage, and cancellation. Preserve Crosslink closure output and regenerate the exact retrieval-evidence binding for the changed main entrypoint.\n\nCloses #1197 and #1198.
Bind redacted VDD ledgers and Crosslink reconciliation to the host's canonical finalization receipt, exact artifact generation, and task scope. Add retention-aware export/deletion, crash-safe idempotent issue projection, capability-safe storage, and focused recovery tests.\n\nCloses S-102 (#1199).
Complete S-038 session ownership migration, S-058 explicit hook import trust, and S-075 shared typed command registry. Preserve foreign state as bounded imports, keep repository hooks inert until exact host approval, and route CLI/TUI command admission through one registry.
Publish background job completion only after command evidence, freshness generation, and verifier receipt invalidation are settled. This removes the Linux CI race where bash_output reported finished while verification still observed an in-flight mutation.
Poll the actual terminal lifecycle contract instead of assuming twenty jobs settle within 600 ms. Rebind the cited supervisor source, regenerate the retrieval evaluation, and keep the exact independent review rejected.
Deliver S-089 session and call isolation, S-092 authenticated proxy admission, and S-096 launch-scoped TUI cancellation and shutdown. Rebind the S-105 technical-memory evidence after the cited main source changed.
Deliver S-090 bounded ACP transport, S-093 authenticated proxy session isolation, and S-097 descriptor-bound TUI attachment projection. Preserve Crosslink-generated closure entries and record Rust 1.98 verification evidence.
Complete S-060, S-061, and S-098 with canonical hook admission, scoped plugin identity and bounded discovery, and generation-bound provider transitions. Reconcile stale remediation status documents and refresh retrieval evidence for the changed runtime source.
Deliver S-076, S-077, and S-083 with generation-bound transactions, least-privilege Git publication, and bounded inert terminal rendering.\n\nCloses #1221.\nCloses #1222.\nCloses #1223.
Use libc::mode_t at the descriptor-relative mkdirat boundary so transactional initialization compiles on Linux and macOS.\n\nCloses #1224.
Complete S-039, S-049, and S-079 with causal resume and branch identity, reasoning privacy boundaries, and capability-backed legacy attachments and editor input. Includes root reconciliation fixes, updated evidence artifacts, and Crosslink-generated changelog entries.\n\nRefs: #1226, #1227, #1228
Route print execution through the bounded canonical runtime and give private notes and side questions local causal semantics. Rebind the generated retrieval evidence for the shared entrypoint change.\n\nRefs #1230 and #1231.
Make plan approval an immutable artifact-bound transition, enforce its effect ceiling at tool admission, and invalidate stale authority across edits, cancellation, mode changes, and successor runs. Refs #1232
dollspace-gay
marked this pull request as ready for review
August 31, 2026 01:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Why
Repeated rewrites left product claims, incomplete features, duplicated documents, and unsafe or misleading agent-system behavior out of sync with the implementation. The old prompt path treated unrelated strings as trusted based on concatenation position or XML-like wrappers, had no hard context budget, and allowed model-authored compaction/VDD or hook text to reach system authority. Repository hook settings also activated merely because recognized files existed. This branch establishes an evidence-backed baseline and an ordered repair program. Only the legacy rule injector, a duplicate stale behavioral prompt, obsolete unsafe APIs/tests, ambient repository authority, and genuinely stale documentation/artifacts are removed; operational features are retained or repaired.
User-visible impact
openclaudia initno longer creates rule files..openclaudia/output-style.mdis ignored; user-owned~/.openclaudia/output-style.mdremains supported as bounded confidential user instruction input..openclaudia/config.yamlhooks and.claude/settings*.jsonhooks are now inert proposals.openclaudia hooks statusshows canonical source, source/proposal digests, requested events/effects, commands, and bound source files; exact approve/revoke commands manage host-owned receipts.Validation
S-007:
cargo cleanin the root and fuzz cratessha256:0d3b75a6d4f8f06ab0d9841f0fe9c0cf05d48e0f37fa14425265e5b59bf87a16S-008:
cargo check --workspace --all-targets --all-featurescargo fmt --all -- --checkcargo clippy --workspace --all-targets --all-features -- -D warnings -A clippy::large_enum_variant(the one waiver is the pre-existing out-of-scope TUI event enum)git diff --checkcargo test --workspace --all-features -- --test-threads=1: zero failures across 2,624 library tests, 215 binary tests, every integration target, and doc tests; explicitly network/browser-dependent tests remained ignoredsha256:7a83e0db4aadcc6a1e7f261440cb2954bfd8c7a3811e3509dfee6d85647898eaS-009:
cargo fmt --all -- --check, JSON/Python syntax validation, andgit diff --checkCARGO_BUILD_JOBS=1 cargo check --workspace --all-targets --all-featuresCARGO_BUILD_JOBS=1 cargo clippy --workspace --all-targets --all-features -- -D warnings -A clippy::large-enum-variantCARGO_BUILD_JOBS=1 cargo test --workspace --all-features -- --test-threads=1: zero failures across 2,624 library tests, every integration target, and doc tests; explicitly network-dependent tests remained ignoredsha256:6a2337d90765bdf953fdeb5a7b6a7eeaa012a247efd37f6e84c59f29d24157cdS-010:
CARGO_BUILD_JOBS=1 cargo check --workspace --all-targets --all-featuresCARGO_BUILD_JOBS=1 cargo clippy --workspace --all-targets --all-features -- -D warnings -A clippy::large_enum_variantCARGO_BUILD_JOBS=1 cargo test --workspace --all-features -- --test-threads=1: zero failures across 2,624 library tests, every integration target, and doc tests; explicitly network/browser-dependent tests remained ignoredsha256:9b3a2831dc5e9f3e360c3ec7c6a289a971e9cfaedd186fdf970fe2049c2d7c0dCanonical alternate-model VDD remains explicitly queued until S-088 implements that verifier role. S-007, S-008, S-009, and S-010 are recorded as implemented with deterministic verification, not falsely marked as canonically VDD-verified. The PR remains draft while subsequent remediation slices are added to this branch.