kami/correx

Move the correx server off :8080 to :8090 (mavgpud port conflict) #4

Open

claude wants to merge 6 commits from task/705-712-postmortem-fixes into master

Author	SHA1	Message	Date
claude	496c447d9b	chore: ignore frontend/, the untracked Vite QA client The web-UI QA app at the repo root is a live-QA surface, not a tracked module. Without the rule every run of the experiment or the stack leaves the working tree dirty, which blocks the PR helper. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-27 13:37:40 +04:00
claude	d18075925d	fix(toolintent): key the read-before-write exemption on content provenance, not parameter shape The exemption added in `6a8a7b31` was broader than the invariant it stood on. "Tool declares a SOURCE_PATH" is a claim about the parameter list; the safe property is "every byte written derives from an existing source object rather than from model-supplied content". A future transform or import tool could name a source and still write model-controlled output, and would have inherited the exemption. ToolCapability.CONTENT_FROM_SOURCE now carries that provenance claim explicitly. file_copy declares it; ReadBeforeWriteRule.appliesTo stands down only for calls that do, so ToolCallAssessor skips the rule rather than the rule skipping itself. The capability is recorded on the invocation event like every other one, so replay classifies a call by what it actually claimed instead of re-deriving it from parameters. Tool availability is by declared tool name, not capability-set containment, so the extra capability does not narrow which stages can reach file_copy. Tests: the exemption is asserted through ToolCallAssessor, plus a source-naming tool WITHOUT the provenance capability that stays gated. ./gradlew check green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-27 12:04:04 +04:00
claude	6a8a7b31c1	fix(events,tools,toolintent): failure attribution, one path normalization rule, file_copy (#713 ) Three generic harness fixes from the web-ui postmortem dataset. Nothing here keys on a language, framework, build tool or task type. 1. Failure attribution. WorkflowFailedEvent carries one primary FailureAttribution (AGENT \| HARNESS \| WORKFLOW \| ENVIRONMENT \| PROVIDER \| OPERATOR \| UNKNOWN), defaulted to UNKNOWN so pre-field events replay unchanged. FailureAttributor is the deterministic reason->layer mapping, used both at emission and when classifying history, so the baseline and the live metric are one measurement. Emission sites set it: failWorkflow derives from the reason unless the caller knows the layer, cancellation is OPERATOR, the server catch-all falls back to HARNESS, a grounding-rejected plan is AGENT. Multi-cause chains stay on FailureTicketOpened — no second causal structure. GET /metrics/failure-attribution (FailureAttributionInspectionService, mirroring ToolReliabilityInspectionService) reports counts, share, UNKNOWN share, the preserved reasons and the ticket categories from the same sessions. Read-only: historical events are classified at READ time and reported as `inferred`, never written back over an append-only log. Baseline over the local log, 122 terminal failures: AGENT 51 (41.8%), OPERATOR 28 (23.0%), WORKFLOW 19 (15.6%), PROVIDER 15 (12.3%), HARNESS 6 (4.9%), ENVIRONMENT 3 (2.5%), UNKNOWN 0. 2. The `~` guard bug. ToolPath is now the ONE canonical normalization rule (expand a leading `~`/`~/`, keep absolutes, anchor relatives on the session working dir). Every filesystem tool, all six plane-2 path rules and the approval preview resolve through it, so policy and existence checks inspect the path the tool will operate on. `~/.gradle/init.d/offline.gradle` used to resolve to `<workspace>/~/.gradle/...`: reported non-existent AND in-workspace, so the reference gate called a real file a hallucination and the out-of-workspace prompt never fired. Containment and external-read approval behaviour are unchanged — the expanded path is simply outside the workspace, where it always belonged. 3. file_copy (#713). A first-class tool with the writer's jail, tier, receipt, replay and CAS pre/post images; static and binary assets no longer move through the model's token stream. Needed one generic split: ParamRole.SOURCE_PATH marks a path a call reads FROM, so containment gates judge both params while write-target gates (read-before-write, stale-write, write scope, write manifest) judge the mutated one. ReadBeforeWriteRule exempts any call declaring a SOURCE_PATH: its content comes from disk, not from memory, and requiring a read of a binary is unsatisfiable. Existing tools declare no SOURCE_PATH, so their behaviour is byte-identical. Tests: ToolPathTest (9), FailureAttributionTest (10), PathNormalizationRuleTest (6), FileCopyToolTest (10), plus a home-relative FileReadTool read. ./gradlew check green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-27 11:57:49 +04:00
claude	519290368f	fix(kernel,talkie,context): three instruction-corruption fixes from the 2026-08-26 context audit Each of the three lost or rewrote an instruction before the model saw it. 1. Orphan corrective nudges. pushBack() and the final tools-disabled emission built their nudge as a toolResult with a fresh sourceId, so it had no matching assistantToolCall and reconcileToolPairs() deleted it — the orchestrator believed it had corrected the model while the correction never reached the prompt. Affected the invalid-emit_artifact, premature-stage_complete, missing-write, read-loop, rejection-loop and final-JSON nudges. They are now USER turns (sourceType orchestratorCorrection, REQUIRED bucket, STRUCTURED in ContextClassifier so pruning cannot shred them), appended last so the builder's positional ordinal puts them at the end of the transcript. A superseded nudge is dropped rather than stacking stale demands. 2. Steering laundered through the router. The SteeringNoteAddedEvent carried the router model's paraphrase of the operator's message, not the message — negations, filenames, constraints and priority could change before the orchestrator saw them. It now carries the raw input; the router turn is still produced and shown as conversational acknowledgement, it is just not the mandate. Resolves the ponytail: note at TalkieFacade.kt:220. 3. Journal compaction erased its own history. compactIfNeeded() summarized only state.records while the reducer overwrote summaryArtifactId and dropped covered records, so the second compaction lost everything the first had preserved — and a low-salience-only batch replaced it with the "(no high-salience decisions)" fallback. Compaction is cumulative now, and a blank or fallback-only rewrite never replaces real history. Tests: rendered-prompt regression for (1) — verified to fail against the old toolResult shape — updated steering expectations for (2), two cumulative-compaction tests for (3). Full build green, 1831 tests, 0 failures. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-27 01:33:16 +04:00
claude	d892587420	fix(kernel,workflow): five fixes from the 954da1a9 post-mortem (#705,#706,#709,#710,#712) The run died on a build gate running the wrong toolchain and burned 43% of its tool calls on repeats, rejections and failures. Five fixes, each traceable to a measured cost in docs/audits/2026-08-11-session-954da1a9-postmortem.md. #705 build gate toolchain scope. The gate is armed session-scoped but read the toolchain stage-scoped, so a reviewer stage that wrote nothing fell back to the flat `build` alias and ran ./gradlew assemble on an all-frontend session. It now falls back to the session's own manifest first. 32.5 min, 33% of that run. #706 action ledger. L2 keeps ten conversation entries, so a stage past round five has no memory of what it tried; 29% of tool calls were byte-identical repeats. One pinned line per call (tool, target, outcome) with repeats collapsed to a count, ~3k tokens for a whole run. #709 plan-compile lint for blocked runners. Plans prescribed `npx tailwindcss init -p`, rejected by the shell denylist at every attempt. Rejected at compile time now, where the architect can still rewrite the step. #710 near-greedy sampling on tool-call rounds. temperature 1.0 on argv emitted `./gradlew_`, `npm_prefix=frontend`, `create_vite@latest`. Prose rounds keep the operator's sampling. #712 auto-approve manifest-contained writes. 94 approvals, all APPROVED, no steering, 19 min. A write inside the declared manifest already proved its containment by getting past ManifestContainmentRule. DENY mode still denies. Tests: core:kernel 133, infrastructure:workflow 99, testing:integration 176, testing:deterministic 79, all green. detekt clean (no new findings). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013dVqqci5H5b3s6xzv6Lojq	2026-08-11 22:15:49 +04:00
claude	700f59ef0d	feat(kernel): gate the DoD against discovery scope (#699 ) Session 954da1a9 asked for an eight-view web UI and shipped a Vite starter page. Discovery settled all eight items in brief.scope; the analyst emitted four criteria, all part="Project Foundation"; the architect planned against that DoD, so the run scaffolded Vite, Tailwind and TanStack Query and stopped. The plan-compile gate and the final reviewer both graded the shrunken DoD, so a plan delivering 5% of the request passed clean. Each DoD criterion now carries `covers`: the 0-based indexes into discovery brief.scope it proves. A post-stage scope_coverage gate fails the analyst retryably when an index has no criterion, handing back the dropped items verbatim. Pure function of two recorded artifacts, so replay recomputes it and no verdict event is needed. Ceiling is index bookkeeping, not semantics: a criterion claiming covers:[3] without really proving scope[3] still passes. It catches the silent collapse, not a weak criterion. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013dVqqci5H5b3s6xzv6Lojq	2026-08-11 20:17:17 +04:00