Add host authority and non-blocking pending operations #62

Merged

lost-rob0t merged 42 commits from feature/issue-53-authority-pending-async into main

2026-08-17 05:53:07 +00:00

lost-rob0t commented

2026-08-16 17:21:50 +00:00

(Migrated from github.com)

Implements #53 host-controlled authority and completes the core pending-operation integration while preserving the canonical async direction established by #59, #60, and #61.

Final implemented state

canonical authority tiers: approve_diff, allow_once, allow_session, dangerous; safe default approve_diff, no public yolo
trusted-host authority ownership with child narrowing-only inheritance
exact normalized executable fingerprints; incidental trace/session/run correlation excluded from executable identity
atomic allow_once consumption and exact replay semantics
deferred/manual Futures for unbounded human approval latency; no shared scheduler worker is held while waiting for a person
approve / deny / edit with stale-fingerprint rejection and edited proposals receiving new IDs/fingerprints
capability/schema/hard-policy checks remain before authority
shared authority integration across tools, MCP lifecycle, agents, and graph side effects
root-agent authority regression fixed and authority tests loaded by the canonical deterministic runner
graph approval pause/resume proves zero pre-approval mutation and no hostage scheduler worker
canonical async-first MCP option-bearing facades restored; lifecycle connect result-shape regression fixed
completed-Future pre-bound result mismatch now fails deterministically instead of polling forever
#63 solved: approval scheduling attaches the execution Future before a private gate is armed; cancellation and execution then race one mutex-protected execution claim. Cancellation before claim guarantees the trusted continuation cannot mutate later. Scheduler-saturation and concurrent approve/cancel adversarial tests cover the race.
#64 solved: terminal executable control state is released immediately; sanitized terminal history plus resolved pending-resolution Futures are bounded to 64 records per authority context and old entries are pruned/destroyed. Stress and edit/supersede-chain tests cover retention and stale revival.
stale rlm_tool.pl singleton binding removed
architecture documented in docs/authority-runtime.md

Exact-head validation

Final head: 1dddd22e0d4bdd8c862cc06c6a3d609c26c96094

Deterministic CI passed:

supported SWI-Prolog runtime
static load of all production modules and live integration definitions
full canonical PlUnit suite, including authority lifecycle adversarial tests
deterministic benchmark/conformance (16/16)
deterministic deep-recursion experiment (15/15)
credential-free CLI + trace smoke
fresh-process persistent graph resume
fresh-process durable artifact handoff
whitespace checks

Configured REAL OpenRouter CI also passed on the same exact head:

core suite
structured repair
live benchmark
depth 0/1/2 recursion experiment
one-command REAL CLI smoke

No unresolved inline review threads remain.

Closes #53
Refs #54
Refs #52
Closes #63
Closes #64

Implements #53 host-controlled authority and completes the core pending-operation integration while preserving the canonical async direction established by #59, #60, and #61. ## Final implemented state - canonical authority tiers: `approve_diff`, `allow_once`, `allow_session`, `dangerous`; safe default `approve_diff`, no public `yolo` - trusted-host authority ownership with child narrowing-only inheritance - exact normalized executable fingerprints; incidental trace/session/run correlation excluded from executable identity - atomic `allow_once` consumption and exact replay semantics - deferred/manual Futures for unbounded human approval latency; no shared scheduler worker is held while waiting for a person - approve / deny / edit with stale-fingerprint rejection and edited proposals receiving new IDs/fingerprints - capability/schema/hard-policy checks remain before authority - shared authority integration across tools, MCP lifecycle, agents, and graph side effects - root-agent authority regression fixed and authority tests loaded by the canonical deterministic runner - graph approval pause/resume proves zero pre-approval mutation and no hostage scheduler worker - canonical async-first MCP option-bearing facades restored; lifecycle connect result-shape regression fixed - completed-Future pre-bound result mismatch now fails deterministically instead of polling forever - #63 solved: approval scheduling attaches the execution Future before a private gate is armed; cancellation and execution then race one mutex-protected execution claim. Cancellation before claim guarantees the trusted continuation cannot mutate later. Scheduler-saturation and concurrent approve/cancel adversarial tests cover the race. - #64 solved: terminal executable control state is released immediately; sanitized terminal history plus resolved pending-resolution Futures are bounded to 64 records per authority context and old entries are pruned/destroyed. Stress and edit/supersede-chain tests cover retention and stale revival. - stale `rlm_tool.pl` singleton binding removed - architecture documented in `docs/authority-runtime.md` ## Exact-head validation Final head: `1dddd22e0d4bdd8c862cc06c6a3d609c26c96094` Deterministic CI passed: - supported SWI-Prolog runtime - static load of all production modules and live integration definitions - full canonical PlUnit suite, including authority lifecycle adversarial tests - deterministic benchmark/conformance (16/16) - deterministic deep-recursion experiment (15/15) - credential-free CLI + trace smoke - fresh-process persistent graph resume - fresh-process durable artifact handoff - whitespace checks Configured REAL OpenRouter CI also passed on the same exact head: - core suite - structured repair - live benchmark - depth 0/1/2 recursion experiment - one-command REAL CLI smoke No unresolved inline review threads remain. Closes #53 Refs #54 Refs #52 Closes #63 Closes #64

lost-rob0t (Migrated from github.com) reviewed

2026-08-17 05:52:06 +00:00

lost-rob0t (Migrated from github.com) left a comment

Final hardening verification: exact PR head 1dddd22e0d4bdd8c862cc06c6a3d609c26c96094 is green across the complete deterministic job and complete configured REAL OpenRouter job. #63 cancellation-linearizability and #64 bounded terminal retention are implemented with adversarial coverage; the stale rlm_tool.pl singleton warning is removed. No inline review threads remain.

Final hardening verification: exact PR head `1dddd22e0d4bdd8c862cc06c6a3d609c26c96094` is green across the complete deterministic job and complete configured REAL OpenRouter job. #63 cancellation-linearizability and #64 bounded terminal retention are implemented with adversarial coverage; the stale `rlm_tool.pl` singleton warning is removed. No inline review threads remain.