From 41b69a43592d467b24485925372acc7a1a192596 Mon Sep 17 00:00:00 2001 From: Decebal Dobrica <352761+decebal@users.noreply.github.com> Date: Wed, 28 Oct 2026 11:17:42 +0000 Subject: [PATCH] feat(skills): bind native runtime and recovery evidence Carry executable identity and independent acceptance through native host handoffs. Preserve final artifacts and archived project context, with real Prime application qualification and bounded CI prerequisite evidence. Allstack-Run: a4abab43-5ae5-4618-8efa-7d61f0e5f323 --- docs/README.md | 10 ++++ ...26-10-28-native-runtime-evidence-design.md | 57 +++++++++++++++++++ ...ck-1414ddc7-4b9e-424f-bf1e-e73ad57d091d.md | 57 +++++++++++++++++++ ...ck-a4abab43-5ae5-4618-8efa-7d61f0e5f323.md | 57 +++++++++++++++++++ .../native-runtime-evidence-request.md | 19 +++++++ docs/reference/native-skills.md | 4 ++ ...28-native-runtime-evidence-verification.md | 47 +++++++++++++++ skills/allstack-handoff/SKILL.md | 2 + skills/allstack-qa/SKILL.md | 4 ++ skills/allstack-recall/SKILL.md | 2 + skills/allstack-ship/SKILL.md | 4 ++ templates/native-skills.md | 4 ++ 12 files changed, 267 insertions(+) create mode 100644 docs/plans/2026-10-28-native-runtime-evidence-design.md create mode 100644 docs/plans/allstack-1414ddc7-4b9e-424f-bf1e-e73ad57d091d.md create mode 100644 docs/plans/allstack-a4abab43-5ae5-4618-8efa-7d61f0e5f323.md create mode 100644 docs/reference/native-runtime-evidence-request.md create mode 100644 docs/reports/2026-10-28-native-runtime-evidence-verification.md diff --git a/docs/README.md b/docs/README.md index 45d08fa..8ff52ea 100644 --- a/docs/README.md +++ b/docs/README.md @@ -2,6 +2,8 @@ ## Design +- [2026-10-28: Native runtime evidence and Prime control values](plans/2026-10-28-native-runtime-evidence-design.md) — installed-runtime identity, final artifact qualification, archived memory recovery and the next real AllSource delivery. + - [2026-10-27: Native evidence checkpoints and Chronis qualification](plans/2026-10-27-native-evidence-and-chronis-design.md) — hosted-proof lessons in existing skills, preserved receipt streams, and real CLI integrity acceptance across Codex and Claude. - [2026-10-25: Native runtime checks and AllSource Prime validation](plans/2026-10-25-native-runtime-checks-design.md) — lessons from real native delivery, bounded command receipts, and authenticated AllSource application qualification. @@ -18,6 +20,10 @@ ## Reference +- [Native runtime evidence qualification](reports/2026-10-28-native-runtime-evidence-verification.md) — installed methods, independent C0-value regression, real Codex/Claude handoffs, final artifacts and archived Prime recovery. + +- [Native runtime evidence request](reference/native-runtime-evidence-request.md) — accepted method changes, packaging and real AllSource qualification. + - [Native evidence checkpoints and real Chronis delivery](reports/2026-10-27-native-evidence-chronis-verification.md) — actual Codex/Claude calls, baseline failures, independent runtime QA, durable handoff and exact-commit publication. - [Fixed compression dependencies with Arrow 59 compatibility](decisions/2026-10-27-parquet-compression-patch.md) — provenance and removal condition for the manifest-only Parquet patch required by strict dependency auditing. @@ -64,3 +70,7 @@ The repository is an implementation preview. Source-level contracts and fixture - [Allstack delivery plan 26340e4d-9eba-4ad5-bbe0-0832086978b5](plans/allstack-26340e4d-9eba-4ad5-bbe0-0832086978b5.md) - [Allstack delivery plan f870b303-2b8f-4385-9f6a-c0ed60bb6b61](plans/allstack-f870b303-2b8f-4385-9f6a-c0ed60bb6b61.md) + +- [Allstack delivery plan 1414ddc7-4b9e-424f-bf1e-e73ad57d091d](plans/allstack-1414ddc7-4b9e-424f-bf1e-e73ad57d091d.md) + +- [Allstack delivery plan a4abab43-5ae5-4618-8efa-7d61f0e5f323](plans/allstack-a4abab43-5ae5-4618-8efa-7d61f0e5f323.md) diff --git a/docs/plans/2026-10-28-native-runtime-evidence-design.md b/docs/plans/2026-10-28-native-runtime-evidence-design.md new file mode 100644 index 0000000..d1fb6ee --- /dev/null +++ b/docs/plans/2026-10-28-native-runtime-evidence-design.md @@ -0,0 +1,57 @@ +# Native runtime evidence and Prime control-value qualification + +Status: accepted. The user authorized `feat/native-runtime-evidence` in Allstack and `fix/prime-toon-control-values` in AllSource, one PR each. + +## Complete job + +A developer updates Allstack, invokes native skills in a real AllSource checkout, carries accepted source and ownership between authenticated Codex and Claude, verifies the final application artifact, and publishes one exact-tested commit per repository. AllSource retains delivery history, Chronis owns task claims/completion, and Prime retains source-linked context. + +The native skills remain the main interface. This change extends their existing instructions without introducing a workflow catalog entry, another command family, or a mandatory managed run for independent planning/review/QA. + +## Observed evidence + +- AllSource PR #369 merged as `fc908dd3227c64049820a95ef1ad66432610e6f7`. Its tree equals tested feature commit `0adf7d265eba0650775a012cb519f89b08447c93`: `0f8ecdc1ec89d9495912da8df9e9d494d732c343`. +- The indexed [Prime verification report](https://github.com/all-source-os/all-source/blob/fc908dd3227c64049820a95ef1ad66432610e6f7/docs/reports/2026-10-27-prime-toon-native-verification.md) records real native host calls, retained-memory checks and installed-runtime drift. +- The shared Allstack executable changed during that qualification. The current update restores the artifact from successful CI 40518653382, SHA-256 `c29cc5f1d143878e38e726e4a1fc45d6cfb40b0b5e49b674067407fb77724d78`. Artifact tree `2739520c7835934f00ed344465c192f607eb5a28` equals merged Allstack main `12af0eeb2004c91d6d3d5b3000c4a7de90d0dd1c`. The previous executable is backed up and this run has a pinned copy. +- Copied Rust integration executables can retain a compile-time `CARGO_BIN_EXE_*` path. Keeping their bytes alone does not preserve a later test's runtime dependency. +- After cleanup, Allstack recall requires a Git repository even when archived Prime data exists. The prior archive was successfully reopened through Prime's own MCP engine: five knowledge nodes and two delivery nodes, with the final QA source digest verified. +- A new real MCP probe preserves five JSON properties but produces a TOON response rejected by the pinned 4.4.0 decoder: `Line 5: Invalid escape sequence: \f`. The value is document text containing a comma and form-feed. This is a presentation-encoder defect. + +The earlier proposed Prime decision has a historical source digest; its accepted successor and qualification report match current source. Recalled proposals remain context, not permission. + +The next application has a 375-case independent reference corpus frozen before implementation, SHA-256 `94117f98fd9a753e2cd977cb236d777cc54dc31fe03d0c3b47cf04093f38a165`. Real authenticated Claude planning read its installed method and producer/tests/policy through sixteen observed calls, fourteen successful. Candidate implementation and execution remain pending. + +## Method updates + +| Method | Narrow instruction change | +| --- | --- | +| `allstack-handoff` | Bind actual toolkit/host executable paths, digests and bundled methods when an installed runtime changes or multiple installations exist. Carry the chosen runtime into the receiving host rather than trusting PATH or a version string. | +| `allstack-qa` | For serialization changes, freeze representative input and independent expected output before implementation. Check persisted JSON and decoded output, then qualify final immutable runtime artifacts. Distinguish copied harness bytes from embedded executable paths. | +| `allstack-ship` | Preserve required runtime dependencies as well as streams before cleanup. Inspect actual forge enforcement separately from merge mode. Keep final artifact/source identity and exact-commit gate claims distinct. | +| `allstack-recall` | Distinguish Git-bound coordinator commands from Prime store recovery. Reopen an archived copy through its own engine, probe identity/counts, and validate source digests without inventing replacement memory. | + +Keep these conditional instructions concise and local to the relevant methods. Update the native reference and generated guide only where their current contract needs clarification. Do not add tests that merely match prose. + +## Real application qualification + +Use the indexed AllSource control-value plan. Authenticated Claude plans against current source; authenticated Codex implements Rust encoder/test changes; independent Claude reviews and exercises actual MCP processes and the pinned decoder. Native ownership moves Codex → Claude → Codex, with actual resume calls and Chronis claimant readbacks. + +The application repair preserves stored JSON and ordinary compact strings, including existing entity-ID behavior. C0-containing values use TOON-specific quoting/escaping. Existing key coverage remains active. Reference JavaScript is used only for independent decoding/corpus generation because that implementation is published as a JavaScript package; application code and permanent tests remain Rust. + +## Verification and publication + +1. Validate changed skills structurally with the skill-creator validator and inspect both generated host variants. Verify conflicts remain preserved. +2. Build/install an exclusively owned Allstack candidate from the intended source under the existing compiler/deadline rules. Pin it for both hosts and verify its actual packaged methods; version equality alone is insufficient. +3. Execute existing Allstack policy and changed-component checks. Use the updated installed methods in the real AllSource qualification, retaining actual calls and outputs. +4. Freeze regression inputs before application implementation. Establish a negative merged-source baseline, then prove the candidate on the same corpus and retained store. +5. Run each repository's unchanged exact-commit policy, publish one commit and one PR per repository, read remote heads, and inspect CI. Do not merge or deploy. +6. Read AllSource history, Chronis completion and matching Prime context through their engines. Archive receipts, raw streams, necessary binaries, source documents and project state before removing owned worktrees/build directories. + +Confidence: rock. The failure, output owner and compatibility boundary are observed. Compiler contention, source/runtime drift and missing external permissions remain explicit prerequisites rather than inferred successes. + +## Requested branches + +- Allstack: `feat/native-runtime-evidence`, one PR for method updates, indexed evidence and required fixes. +- AllSource: `fix/prime-toon-control-values`, one PR for the application repair and real-host evidence. + +Allstack PR #8 belongs to separate existing work and is outside this proposal. diff --git a/docs/plans/allstack-1414ddc7-4b9e-424f-bf1e-e73ad57d091d.md b/docs/plans/allstack-1414ddc7-4b9e-424f-bf1e-e73ad57d091d.md new file mode 100644 index 0000000..d1fb6ee --- /dev/null +++ b/docs/plans/allstack-1414ddc7-4b9e-424f-bf1e-e73ad57d091d.md @@ -0,0 +1,57 @@ +# Native runtime evidence and Prime control-value qualification + +Status: accepted. The user authorized `feat/native-runtime-evidence` in Allstack and `fix/prime-toon-control-values` in AllSource, one PR each. + +## Complete job + +A developer updates Allstack, invokes native skills in a real AllSource checkout, carries accepted source and ownership between authenticated Codex and Claude, verifies the final application artifact, and publishes one exact-tested commit per repository. AllSource retains delivery history, Chronis owns task claims/completion, and Prime retains source-linked context. + +The native skills remain the main interface. This change extends their existing instructions without introducing a workflow catalog entry, another command family, or a mandatory managed run for independent planning/review/QA. + +## Observed evidence + +- AllSource PR #369 merged as `fc908dd3227c64049820a95ef1ad66432610e6f7`. Its tree equals tested feature commit `0adf7d265eba0650775a012cb519f89b08447c93`: `0f8ecdc1ec89d9495912da8df9e9d494d732c343`. +- The indexed [Prime verification report](https://github.com/all-source-os/all-source/blob/fc908dd3227c64049820a95ef1ad66432610e6f7/docs/reports/2026-10-27-prime-toon-native-verification.md) records real native host calls, retained-memory checks and installed-runtime drift. +- The shared Allstack executable changed during that qualification. The current update restores the artifact from successful CI 40518653382, SHA-256 `c29cc5f1d143878e38e726e4a1fc45d6cfb40b0b5e49b674067407fb77724d78`. Artifact tree `2739520c7835934f00ed344465c192f607eb5a28` equals merged Allstack main `12af0eeb2004c91d6d3d5b3000c4a7de90d0dd1c`. The previous executable is backed up and this run has a pinned copy. +- Copied Rust integration executables can retain a compile-time `CARGO_BIN_EXE_*` path. Keeping their bytes alone does not preserve a later test's runtime dependency. +- After cleanup, Allstack recall requires a Git repository even when archived Prime data exists. The prior archive was successfully reopened through Prime's own MCP engine: five knowledge nodes and two delivery nodes, with the final QA source digest verified. +- A new real MCP probe preserves five JSON properties but produces a TOON response rejected by the pinned 4.4.0 decoder: `Line 5: Invalid escape sequence: \f`. The value is document text containing a comma and form-feed. This is a presentation-encoder defect. + +The earlier proposed Prime decision has a historical source digest; its accepted successor and qualification report match current source. Recalled proposals remain context, not permission. + +The next application has a 375-case independent reference corpus frozen before implementation, SHA-256 `94117f98fd9a753e2cd977cb236d777cc54dc31fe03d0c3b47cf04093f38a165`. Real authenticated Claude planning read its installed method and producer/tests/policy through sixteen observed calls, fourteen successful. Candidate implementation and execution remain pending. + +## Method updates + +| Method | Narrow instruction change | +| --- | --- | +| `allstack-handoff` | Bind actual toolkit/host executable paths, digests and bundled methods when an installed runtime changes or multiple installations exist. Carry the chosen runtime into the receiving host rather than trusting PATH or a version string. | +| `allstack-qa` | For serialization changes, freeze representative input and independent expected output before implementation. Check persisted JSON and decoded output, then qualify final immutable runtime artifacts. Distinguish copied harness bytes from embedded executable paths. | +| `allstack-ship` | Preserve required runtime dependencies as well as streams before cleanup. Inspect actual forge enforcement separately from merge mode. Keep final artifact/source identity and exact-commit gate claims distinct. | +| `allstack-recall` | Distinguish Git-bound coordinator commands from Prime store recovery. Reopen an archived copy through its own engine, probe identity/counts, and validate source digests without inventing replacement memory. | + +Keep these conditional instructions concise and local to the relevant methods. Update the native reference and generated guide only where their current contract needs clarification. Do not add tests that merely match prose. + +## Real application qualification + +Use the indexed AllSource control-value plan. Authenticated Claude plans against current source; authenticated Codex implements Rust encoder/test changes; independent Claude reviews and exercises actual MCP processes and the pinned decoder. Native ownership moves Codex → Claude → Codex, with actual resume calls and Chronis claimant readbacks. + +The application repair preserves stored JSON and ordinary compact strings, including existing entity-ID behavior. C0-containing values use TOON-specific quoting/escaping. Existing key coverage remains active. Reference JavaScript is used only for independent decoding/corpus generation because that implementation is published as a JavaScript package; application code and permanent tests remain Rust. + +## Verification and publication + +1. Validate changed skills structurally with the skill-creator validator and inspect both generated host variants. Verify conflicts remain preserved. +2. Build/install an exclusively owned Allstack candidate from the intended source under the existing compiler/deadline rules. Pin it for both hosts and verify its actual packaged methods; version equality alone is insufficient. +3. Execute existing Allstack policy and changed-component checks. Use the updated installed methods in the real AllSource qualification, retaining actual calls and outputs. +4. Freeze regression inputs before application implementation. Establish a negative merged-source baseline, then prove the candidate on the same corpus and retained store. +5. Run each repository's unchanged exact-commit policy, publish one commit and one PR per repository, read remote heads, and inspect CI. Do not merge or deploy. +6. Read AllSource history, Chronis completion and matching Prime context through their engines. Archive receipts, raw streams, necessary binaries, source documents and project state before removing owned worktrees/build directories. + +Confidence: rock. The failure, output owner and compatibility boundary are observed. Compiler contention, source/runtime drift and missing external permissions remain explicit prerequisites rather than inferred successes. + +## Requested branches + +- Allstack: `feat/native-runtime-evidence`, one PR for method updates, indexed evidence and required fixes. +- AllSource: `fix/prime-toon-control-values`, one PR for the application repair and real-host evidence. + +Allstack PR #8 belongs to separate existing work and is outside this proposal. diff --git a/docs/plans/allstack-a4abab43-5ae5-4618-8efa-7d61f0e5f323.md b/docs/plans/allstack-a4abab43-5ae5-4618-8efa-7d61f0e5f323.md new file mode 100644 index 0000000..d1fb6ee --- /dev/null +++ b/docs/plans/allstack-a4abab43-5ae5-4618-8efa-7d61f0e5f323.md @@ -0,0 +1,57 @@ +# Native runtime evidence and Prime control-value qualification + +Status: accepted. The user authorized `feat/native-runtime-evidence` in Allstack and `fix/prime-toon-control-values` in AllSource, one PR each. + +## Complete job + +A developer updates Allstack, invokes native skills in a real AllSource checkout, carries accepted source and ownership between authenticated Codex and Claude, verifies the final application artifact, and publishes one exact-tested commit per repository. AllSource retains delivery history, Chronis owns task claims/completion, and Prime retains source-linked context. + +The native skills remain the main interface. This change extends their existing instructions without introducing a workflow catalog entry, another command family, or a mandatory managed run for independent planning/review/QA. + +## Observed evidence + +- AllSource PR #369 merged as `fc908dd3227c64049820a95ef1ad66432610e6f7`. Its tree equals tested feature commit `0adf7d265eba0650775a012cb519f89b08447c93`: `0f8ecdc1ec89d9495912da8df9e9d494d732c343`. +- The indexed [Prime verification report](https://github.com/all-source-os/all-source/blob/fc908dd3227c64049820a95ef1ad66432610e6f7/docs/reports/2026-10-27-prime-toon-native-verification.md) records real native host calls, retained-memory checks and installed-runtime drift. +- The shared Allstack executable changed during that qualification. The current update restores the artifact from successful CI 40518653382, SHA-256 `c29cc5f1d143878e38e726e4a1fc45d6cfb40b0b5e49b674067407fb77724d78`. Artifact tree `2739520c7835934f00ed344465c192f607eb5a28` equals merged Allstack main `12af0eeb2004c91d6d3d5b3000c4a7de90d0dd1c`. The previous executable is backed up and this run has a pinned copy. +- Copied Rust integration executables can retain a compile-time `CARGO_BIN_EXE_*` path. Keeping their bytes alone does not preserve a later test's runtime dependency. +- After cleanup, Allstack recall requires a Git repository even when archived Prime data exists. The prior archive was successfully reopened through Prime's own MCP engine: five knowledge nodes and two delivery nodes, with the final QA source digest verified. +- A new real MCP probe preserves five JSON properties but produces a TOON response rejected by the pinned 4.4.0 decoder: `Line 5: Invalid escape sequence: \f`. The value is document text containing a comma and form-feed. This is a presentation-encoder defect. + +The earlier proposed Prime decision has a historical source digest; its accepted successor and qualification report match current source. Recalled proposals remain context, not permission. + +The next application has a 375-case independent reference corpus frozen before implementation, SHA-256 `94117f98fd9a753e2cd977cb236d777cc54dc31fe03d0c3b47cf04093f38a165`. Real authenticated Claude planning read its installed method and producer/tests/policy through sixteen observed calls, fourteen successful. Candidate implementation and execution remain pending. + +## Method updates + +| Method | Narrow instruction change | +| --- | --- | +| `allstack-handoff` | Bind actual toolkit/host executable paths, digests and bundled methods when an installed runtime changes or multiple installations exist. Carry the chosen runtime into the receiving host rather than trusting PATH or a version string. | +| `allstack-qa` | For serialization changes, freeze representative input and independent expected output before implementation. Check persisted JSON and decoded output, then qualify final immutable runtime artifacts. Distinguish copied harness bytes from embedded executable paths. | +| `allstack-ship` | Preserve required runtime dependencies as well as streams before cleanup. Inspect actual forge enforcement separately from merge mode. Keep final artifact/source identity and exact-commit gate claims distinct. | +| `allstack-recall` | Distinguish Git-bound coordinator commands from Prime store recovery. Reopen an archived copy through its own engine, probe identity/counts, and validate source digests without inventing replacement memory. | + +Keep these conditional instructions concise and local to the relevant methods. Update the native reference and generated guide only where their current contract needs clarification. Do not add tests that merely match prose. + +## Real application qualification + +Use the indexed AllSource control-value plan. Authenticated Claude plans against current source; authenticated Codex implements Rust encoder/test changes; independent Claude reviews and exercises actual MCP processes and the pinned decoder. Native ownership moves Codex → Claude → Codex, with actual resume calls and Chronis claimant readbacks. + +The application repair preserves stored JSON and ordinary compact strings, including existing entity-ID behavior. C0-containing values use TOON-specific quoting/escaping. Existing key coverage remains active. Reference JavaScript is used only for independent decoding/corpus generation because that implementation is published as a JavaScript package; application code and permanent tests remain Rust. + +## Verification and publication + +1. Validate changed skills structurally with the skill-creator validator and inspect both generated host variants. Verify conflicts remain preserved. +2. Build/install an exclusively owned Allstack candidate from the intended source under the existing compiler/deadline rules. Pin it for both hosts and verify its actual packaged methods; version equality alone is insufficient. +3. Execute existing Allstack policy and changed-component checks. Use the updated installed methods in the real AllSource qualification, retaining actual calls and outputs. +4. Freeze regression inputs before application implementation. Establish a negative merged-source baseline, then prove the candidate on the same corpus and retained store. +5. Run each repository's unchanged exact-commit policy, publish one commit and one PR per repository, read remote heads, and inspect CI. Do not merge or deploy. +6. Read AllSource history, Chronis completion and matching Prime context through their engines. Archive receipts, raw streams, necessary binaries, source documents and project state before removing owned worktrees/build directories. + +Confidence: rock. The failure, output owner and compatibility boundary are observed. Compiler contention, source/runtime drift and missing external permissions remain explicit prerequisites rather than inferred successes. + +## Requested branches + +- Allstack: `feat/native-runtime-evidence`, one PR for method updates, indexed evidence and required fixes. +- AllSource: `fix/prime-toon-control-values`, one PR for the application repair and real-host evidence. + +Allstack PR #8 belongs to separate existing work and is outside this proposal. diff --git a/docs/reference/native-runtime-evidence-request.md b/docs/reference/native-runtime-evidence-request.md new file mode 100644 index 0000000..7560435 --- /dev/null +++ b/docs/reference/native-runtime-evidence-request.md @@ -0,0 +1,19 @@ +# Native runtime evidence request + +The user authorized `feat/native-runtime-evidence` and one Allstack PR, alongside the real AllSource `fix/prime-toon-control-values` qualification. + +## Accepted change + +Keep native skills as the main interface. Add conditional guidance for choosing and carrying installed runtime identity across hosts, freezing independent serialization expectations, qualifying final immutable artifacts, preserving copied-harness dependencies, inspecting actual forge enforcement, and recovering archived Prime context through its own engine. + +Update the existing handoff, QA, ship and recall methods and their native guide/reference. Preserve unchanged skill discovery, host overlays, conflict handling and standalone operation. No new catalog entry, workflow family, engine command or dependency is requested. + +## Acceptance + +- Build the actual packaged methods and verify all seven shared bodies plus fourteen generated host variants against source. +- Preserve conflicting local files and replace only verified previous generated resources. +- Exercise the updated interface in the real AllSource control-value workflow with authenticated Codex and Claude. Record actual reads, calls, checks and limits rather than model summaries alone. +- Keep existing toolkit, example, fixture and lint/format policies active. Publish one exact-verified commit on the authorized live branch and one PR, with remote head and CI readback. +- Preserve indexed design/report documents, private raw streams, runtime inputs, task state and source-linked Prime context. Keep merge and deployment separate. + +The [accepted design](../plans/2026-10-28-native-runtime-evidence-design.md) records observed lessons and the complete application job. diff --git a/docs/reference/native-skills.md b/docs/reference/native-skills.md index ec0bf3f..abaa1e9 100644 --- a/docs/reference/native-skills.md +++ b/docs/reference/native-skills.md @@ -10,10 +10,14 @@ AllSource continues to validate managed-run event chains and exact-commit receip `recall` reads the repository's local Prime memory, combines standalone knowledge with retained delivery outcomes, and returns context only. An absent local memory returns an empty result without creating a store. Open the cited source and compare its recorded digest before treating a historical note as current. Hosted synchronization and vector search are outside this local preview. +Repository commands require a Git checkout. An archived Prime copy can instead be opened through Prime's engine with an explicit data path. Verify the expected node counts/dates and source-document digests; retain the original archive when exercising recovery. Opening context at another path does not relocate a coordinator's path-bound delivery history. + ## Native work to managed shipping `adopt` accepts the completed native candidate, indexed request, existing accepted plan, and frozen policy. It requires commit authority, an authorized live feature branch, real initialized Chronis, and explicit staging of new files. It uses the existing snapshot, task setup, accepted-plan, handoff, verification, and publication paths without invoking a model again. Adoption does not imply that the candidate passed any checks. `current` folds and validates AllSource histories to discover one active job. It refuses ambiguous or oversized discovery; explicit run commands remain available. Skills keep those protocol identifiers inside tool calls. Changing hosts preserves immutable scope and advances ownership; native tools outside managed calls remain under host policy rather than epoch fencing. +After installing or changing runtimes, verify the actual executable, source/artifact identity and bundled methods. Pin the selected paths for cross-host calls when PATH could select another installation. Final runtime proof binds immutable application artifacts to their build inputs, while exact-commit gates bind publication. Retained Rust test binaries may still require their original compile-time application path. + See the [application request](native-application-request.md) for the concrete expense-filter job used to verify native planning, real implementation, source review, actual CLI QA, source-linked recall, and exact-commit delivery. diff --git a/docs/reports/2026-10-28-native-runtime-evidence-verification.md b/docs/reports/2026-10-28-native-runtime-evidence-verification.md new file mode 100644 index 0000000..873cd39 --- /dev/null +++ b/docs/reports/2026-10-28-native-runtime-evidence-verification.md @@ -0,0 +1,47 @@ +# Native runtime evidence qualification + +The native handoff, QA, ship and recall skills now carry installed-runtime identity, independent serialization expectations, final-artifact checks and archived project-memory recovery. The AllSource application qualification repairs C0 string-value output in Prime without changing stored JSON, entity-ID formatting or the existing key corpus. + +## Installed methods and runtime + +The merged-main Allstack artifact from successful CI run 40518653382 has SHA-256 `c29cc5f1d143878e38e726e4a1fc45d6cfb40b0b5e49b674067407fb77724d78`. Its build tree `2739520c7835934f00ed344465c192f607eb5a28` matches merged main `12af0eeb2004c91d6d3d5b3000c4a7de90d0dd1c`. + +The candidate executable, built with Rust 1.95 from that base and the method/template changes, has SHA-256 `c06e006476f9aa10c4bffd447ac2d1c3af5963ac76bb27910ee32841be5b9af9`. Both hosts use its absolute pinned path. All seven bundled skill bodies, fourteen generated host variants and the native guide match the intended source. The initialization preview preserves conflicts; only byte-verified previous generated resources were updated. Four changed skills pass the skill-creator structural validator. + +These changes modify packaged workflow data and documentation. They add no engine command, dependency or catalog entry. Preflight execution passed 74 toolkit tests with two configured skips and strict all-target Clippy. Publication remains subject to the unchanged eight-gate native policy on its exact candidate commit. + +## Real application and independent expectations + +The [AllSource qualification report](https://github.com/all-source-os/all-source/blob/a7ee229ad54a9e9c5bfa16a2fbf3b6232fd439ed/docs/reports/2026-10-28-prime-toon-values-verification.md) contains the application plan, source boundary and permanent Rust tests. Application commit `a7ee229ad54a9e9c5bfa16a2fbf3b6232fd439ed` shares one TOON string quoter between keys and values and quotes every C0-containing value. The authenticated handoff and final-artifact qualification ran on `c76811ab9e6bc90862f83038c9a17d3848bddd66`; its successor changes only workflow configuration and indexed documentation. Runtime build inputs and the actual built Prime executable remain unchanged. + +The frozen 375-case corpus was generated and round-tripped with published `@toon-format/toon@4.4.0` before implementation. Its SHA-256 is `94117f98fd9a753e2cd977cb236d777cc54dc31fe03d0c3b47cf04093f38a165`. It covers all 32 C0 code points in five output shapes, comma-forced quoting and compatibility strings. The unchanged baseline harness produced 220 reference matches and 155 mismatches. Real MCP persistence retained all 78 properties, while 31 of 75 value encodings differed from the reference. A canonical-encoding mismatch does not imply decoder rejection; the separately observed quoted form-feed and backspace responses specifically failed with invalid `\f` and `\b` escapes. + +The repaired candidate passes all 375 reference comparisons and all 75 MCP value comparisons. The integration test verifies all 78 properties after separate write, JSON-reopen and TOON-reopen processes. Existing 132-case key expectations remain unchanged. The exact application commit passed format, 165 executed tests with five existing environment-dependent ignores, strict Clippy and whitespace gates. + +## Authenticated native handoffs and final runtime QA + +Authenticated Claude session `2328098f-b22b-49c8-a2c3-ee4dd6e5829f` planned against actual source and the frozen reference corpus. Authenticated Codex session `01a181fb-eb38-78f1-8a84-e6a975bf5672` authored the regression tests and encoder repair. Independent Claude session `2391c324-1923-453b-94ab-b69a14ee560e` reviewed source, executed runtime checks and recovered archived project context. Private transcripts retain actual calls and tool results; model summaries alone are not counted as evidence. + +Native run `66712413-6a19-4587-a359-387994e20530` carries Codex epoch 1 → Claude epoch 2 → Codex epoch 3. Receiving hosts read the updated installed handoff method, resume the actual run and inspect the returned workspace. Chronis claimant readbacks bind ownership to the receiving host and epoch. AllSource delivery history remains underneath the native interface. + +Final immutable Prime SHA-256 is `5e26082b533fecd085f7d0b8c38377f066256bc1b8dfa187abe6133a20da8688`; final frozen-corpus harness SHA-256 is `32745ae6994b40a951166fc2b5b9e4de1c4a1de9f767664f9ddac2102a062082`. Claude rechecked those identities before and after execution, ran the 375-case encoder test and reopened the original baseline-created store through sequential JSON and TOON processes. The independent decoder confirmed all five original properties and the complete normalized result, including format and executable identity. + +The full copied integration harness embeds an application path through `CARGO_BIN_EXE_*`. Its full 78-property result belongs to the retained build environment. The standalone final-artifact check uses the explicit immutable Prime path and a separate five-property store; it does not claim that copying the harness removes its embedded dependency. + +## Archived Prime recovery and retained evidence + +Claude reopened a closed copy of the project Prime store outside any Git repository through Prime's own MCP engine, explicitly selecting its data directory. Health and query results returned 13 nodes: ten knowledge nodes and three delivery nodes, zero edges, with source dates spanning 2026-10-27 and 2026-10-28. The QA and review nodes cite the retained application report with matching SHA-256 `1ea4d066596ff6115a296514326e88df68f4e5ef9a48021d959bf2c95cbbe791`. Older plan digests identify historical snapshots; the accepted successor exists on disk. + +The project-context store and application test store are distinct. Retrieval used the reported lexical fallback because embeddings were unavailable. Hosted synchronization and vector recall were not exercised. After publication, the live project store reports fifteen nodes, eleven knowledge and four delivery nodes. The archived thirteen-node snapshot remains independently recoverable. + +Before application publication, 8,055 private receipt, raw-stream, document and state files were copied outside disposable worktrees and verified byte-for-byte with lengths and SHA-256 digests. Immutable application artifacts, reference decoder, requests and source maps are retained alongside that archive. Subsequent publication receipts and store readbacks are retained separately. Private material stays in ignored proof storage; this indexed report is the public evidence summary. + +## Limits and acceptance boundary + +AllSource PR #370 includes the inherited Criterion compilation prerequisite. CI run 40678542842 exhausted its dependency-phase deadline before running benchmarks. A dependency-only recipe separates registry compilation from real Core library compilation. Local nightly graph comparison matched all 506 registry units, and the workflow enforces that identity again at runtime. The existing benchmark cases, optimization flags, thresholds and 285-second phase limits remain intact. The amended application commit passed all four native gates again, with 165 executed tests and five existing ignores; CI remains the execution check for the new Linux recipe. + +Both authenticated hosts run on the same machine. This proves host handoff and durable ownership across Codex and Claude, not transport between physical machines. Five application tests require model assets, OCR or hosted credentials and remain ignored. No deployment, merge, new credential or hosted-sync operation is part of this qualification. + +Merge mode and required-check enforcement are separate forge settings. Exact-commit local gates and observed CI results must be reported against their actual authority, without treating a rebase-only setting as a required-check rule. + +The [accepted design](../plans/2026-10-28-native-runtime-evidence-design.md) and [request](../reference/native-runtime-evidence-request.md) define the publication and installed-artifact acceptance. diff --git a/skills/allstack-handoff/SKILL.md b/skills/allstack-handoff/SKILL.md index b200b6a..c18b961 100644 --- a/skills/allstack-handoff/SKILL.md +++ b/skills/allstack-handoff/SKILL.md @@ -9,6 +9,8 @@ Use handoff only when the user requests another host or continuation requires it Read current run state and resolve any pending operation through its destination-specific recovery path before transferring. Confirm the requested host exists and is authenticated when execution is required. Preserve already granted authority; ask only for an actually missing authorization against a concrete result. +After an update, with multiple installations, or after observed runtime drift, resolve the chosen Allstack and host executables to absolute paths. Bind their bytes to the intended source/artifact and packaged methods, then carry those paths into receiving-host calls. A version string or inherited PATH does not establish the same runtime. + Use `allstack handoff --epoch --to codex|claude-code`, then `allstack resume --epoch `. Keep these identifiers inside the tool calls. Read the returned workspace and Chronis claimant before acting. The new worktree, accepted plan, selected methods, and outstanding evidence define continuation; prior hidden reasoning is unnecessary. If invoking another real host CLI, use existing supervised Allstack plan/build operations with normal authentication and permission modes. Native tools used outside those operations have the host's own authority and are not fenced by the epoch. Do not claim global protection. diff --git a/skills/allstack-qa/SKILL.md b/skills/allstack-qa/SKILL.md index a0ff28d..3018c6b 100644 --- a/skills/allstack-qa/SKILL.md +++ b/skills/allstack-qa/SKILL.md @@ -11,6 +11,8 @@ Identify the target and the complete user job. Use an explicit supplied target d Trace the success path from user input to persisted result or delivered output. Include representative empty input, invalid input, and a boundary that could produce a plausible but incorrect success. For a filter, compare matching, nonmatching, and unfiltered results and inspect the original data for silently skipped failures. +For serialization changes, freeze representative inputs and independent expected output before implementation. Exercise the changed positions, such as keys and values separately, and compare retained data plus the complete decoded result. Distinguish an encoder's required representation from forms its decoder merely accepts; preserve unrelated compatibility choices. + For a UI, use an available browser to perform the interaction and inspect the visible result plus relevant runtime failures. For a CLI, execute the built program with concrete input, capture exit status, stdout, and stderr. For an API or job, exercise its actual ingress and read back its result through the owning system. Do not substitute a source inspection or unit test for a claimed browser check. ## Execute safely and retain evidence @@ -19,6 +21,8 @@ Use an isolated local target when mutations would otherwise affect production. V Establish that the application was rebuilt from the intended source before recording its executable digest. Warm build directories can reuse stale binaries after timestamp-preserving copies; invalidate the affected application artifact or otherwise prove the rebuild. Run the actual built program, including negative cases with explicit expected exits. +Qualify immutable copies of the final runtime artifacts when later builds or cleanup can replace their paths. Rehash after execution and bind observations to their actual build inputs. A copied Rust integration executable may still embed a `CARGO_BIN_EXE_*` path; invoke the retained application directly or preserve that dependency before claiming the copied harness remains runnable. + When installed, `allstack check --expect-exit 4 --seconds 120 -- /absolute/program arguments` retains a private receipt without creating a delivery run or task. Omit `--expect-exit` for zero; `--input prompt.txt` supplies bounded UTF-8 stdin. The deadline includes metadata. The repository must ignore `.allstack/`. A matching expected negative exit succeeds; timeout, signal, spawn failure, changed executable, and status mismatch fail and retain their receipt. Inspect `outcome`, separated raw stream paths and digests, and the target's result. Decoded text can be lossy; raw streams preserve bytes. Host tool summaries can combine channels and do not replace those files. An executable digest binds observed bytes, not the source that produced them. Record the target version, command or interaction, input, observed result, expected result, and executed test count where available. A zero-case run, timeout, skipped browser, or unavailable credential remains unverified. Inspect the underlying result rather than trusting a model summary or green wrapper. diff --git a/skills/allstack-recall/SKILL.md b/skills/allstack-recall/SKILL.md index 1eee73d..6e2c214 100644 --- a/skills/allstack-recall/SKILL.md +++ b/skills/allstack-recall/SKILL.md @@ -11,6 +11,8 @@ Inspect the cited source for every result that affects the recommendation. A ret An explicit absent-store result is a verification limit. Continue from the supplied indexed plan and relevant project source; do not search the toolkit's implementation to invent missing memory or create a replacement store merely to satisfy recall. +Allstack's repository commands require a Git checkout. When recovering archived Prime context outside one, open an archived copy through Prime's own engine with an explicit data path; a Git-context error does not establish missing data. Probe store identity, counts and record dates, then compare the retained source documents and digests. Keep this context recovery separate from path-bound coordinator history, and never fold store files through an unrelated engine. + Distinguish proposals, accepted decisions, observed outcomes, and actual current state. Query AllSource workflow state, Chronis ownership, or GitHub publication through their own tools when that is what the question asks. Prime context cannot establish those facts or grant authority. Return the relevant decision, why it applies, source path, and any conflicting or superseding evidence. Do not dump unrelated memory. Preserve useful accepted knowledge through `allstack remember --kind decision|review|qa --source --summary ` when requested or within an authorized documentation workflow. Never store secrets, proprietary source, or full file contents. diff --git a/skills/allstack-ship/SKILL.md b/skills/allstack-ship/SKILL.md index f66a2f3..9368627 100644 --- a/skills/allstack-ship/SKILL.md +++ b/skills/allstack-ship/SKILL.md @@ -23,8 +23,12 @@ Use the returned run identity and epoch internally. `allstack verify` prepares t Before `allstack ship`, preserve required epoch-local receipts and separate raw streams outside disposable worktrees, with paths, lengths, and digests verified. Shipping can remove accepted epoch worktrees. Put the public evidence summary under indexed repo docs and keep private transcripts in ignored storage; preserving only a receipt whose stream paths will disappear is insufficient. +Include the runtime dependencies needed to reproduce the claimed checks: application binaries, inputs and referenced fixtures or executable paths. Keeping a copied harness alone may leave a compile-time application path pointing into a deleted build directory. + Use `allstack ship` to publish the exact verified commit and read back the branch and PR head. Confirm Chronis task completion and the Prime source-linked outcome. If publication is uncertain, read the destination before repeating a side effect. Never bypass hooks, push trunk, weaken gates, or rewrite another author's history. +Read applicable branch rules/protection before describing CI as merge enforcement. Rebase-only settings control commit shape; they do not require green checks. Report advisory CI and exact-commit verification according to their actual authority. + Read back required project memory through its engine before archiving an isolated coordinator. Use queries that match each recorded summary; an unrelated lexical search can omit a node that still exists. Preserve tracker/memory state and verified receipts before removing owned checkouts and idle build directories. Recheck PR liveness before any later commit; a merged branch requires newly authorized continuation. Report the application behavior delivered, PR, exact commit, actual executed checks, and material limits. Required documentation stays indexed under repo docs. Keep private process receipts out of source. The user should not need to manage run IDs or epochs to ask for shipping. diff --git a/templates/native-skills.md b/templates/native-skills.md index 510d7aa..11ed4f7 100644 --- a/templates/native-skills.md +++ b/templates/native-skills.md @@ -20,6 +20,8 @@ For CLI/runtime evidence, `allstack check --expect-exit 4 --seconds 120 -- /abso Installation preserves conflicting files. To update a generated skill, compare the installed file with its known previous generated version, review the new shared method and host overlay, and preserve local customization. Resolve reviewed replacements explicitly; initialization never silently overwrites them. +After an update or observed runtime drift, bind executable bytes to their source/artifact and packaged methods, then pin the selected paths across hosts. A version string does not identify the installed methods. Serialization QA should freeze independent inputs/expected output and exercise the changed positions as well as retained-data equality. + Save plans and required reports under indexed repo docs. `allstack remember --kind decision --source docs/plans/change.md --summary 'Accepted decision'` records a bounded source-linked summary and source digest in local Prime. Use `allstack recall 'relevant query'` to retrieve context; inspect the remembered source before relying on it. Memory creates no delivery run or task. Keep private stores ignored; never record secrets or full source contents. For a complete durable delivery, initialize with a project policy using the CLI/recovery guide. `allstack current` discovers the single active run behind the skill interface. Multiple active runs require explicit selection. `allstack adopt --request docs/requests/change.md --plan docs/plans/change.md --policy workflows/verification.toml --host codex --allow-commit --allow-publish` enrolls a completed native candidate and its existing plan without repeating model work. Stage intended new files explicitly before adoption. Initialize real Chronis first; branch, commit, and publication authority still come from the user. @@ -29,3 +31,5 @@ AllSource owns managed run history and receipts, Chronis owns delivery claims an Keep the coordinator at its original path through verification and publication. Native adoption verifies the candidate in that checkout; an epoch worktree may retain the base. Preserve existing project tracker/memory state and archive path-bound history before removing an isolated coordinator. Archive required epoch-local receipts and raw streams before `allstack ship`, which can remove accepted epoch worktrees. Verify copied byte lengths and digests. Report host execution from actual calls, preserve failed HTTP observations with safely redacted responses, and distinguish running-image proof from final-commit checks. Existing consumer compatibility and changed-component checks belong in acceptance even when a frozen policy covers another component. + +Preserve the application binaries, inputs and path bindings a copied harness needs before cleanup. Repository-bound recall needs Git; recover an archived Prime copy through its own engine and verify counts/dates plus source digests. This recovers context without relocating coordinator history. Inspect actual branch rules before treating visible CI as merge enforcement.