From 54d4d9766b2da336ee5fb35f868a7ef120dba02d Mon Sep 17 00:00:00 2001 From: Claude Code Date: Wed, 2 Sep 2026 10:55:02 +0300 Subject: [PATCH 1/2] =?UTF-8?q?feat(orchestrator):=20bounded=20native=20su?= =?UTF-8?q?bagent=20dispatch=20pilot=20=E2=80=94=20governance=20+=20bindin?= =?UTF-8?q?g=20+=20tests?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner-approved bounded carve-out (2026-09-02) for "supervised AI-OS subagent dispatch (pilot)". Pilot-only; not a standard workflow; does not generalize. Governance clarification: - ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md: new allowed loop type + a "Supervised AI-OS Subagent Dispatch (Pilot)" section with all mandatory bounds (hub-and-spoke, root-only routing, no child->child, one execution_id, reuse AES continuation/route_trace/guards, bounded project-context, no new authority, unchanged gates, no framework/runtime/DB, .gitignore unchanged, shared-fs risk, no timeout primitive, observable evidence). - AGENTS.md / CURRENT_STATUS.md: annotate the "agentic workflows" blocked item with the single bounded exception; add a status line. - Regenerated AIOS_05 bundle + provenance audit. Runtime binding (Option 1, native built-in subagents only): - PROJECT_CAPABILITIES.yaml: additive semantic executor block per capability (backend claude_code_subagent, agent_type Plan / general-purpose, context_loader project-context, write_capable, child_dispatch forbidden). Registry stays the only capability registry; no AES-record schema change. - .agents/skills/ai-os-orchestrator/SKILL.md: "Native subagent dispatch (pilot)" subsection — dispatch preconditions, bounded prompt, root-only route_trace + guard handling, failure -> AES defect. - .agents/skills/project-context/SKILL.md: one line binding it as the child context loader. Tests: tests/test_project_capabilities_executor.py (8 deterministic invariants); tests/test_aios_dual_surface.py updated for the new executor key. Checks: 6 canonical scripts + provenance audit + pytest (215) all pass. No behavioral pilot has run yet — evidence doc follows in the next commit. Co-Authored-By: Claude Sonnet 5 --- .agents/skills/ai-os-orchestrator/SKILL.md | 55 +++++++ .agents/skills/project-context/SKILL.md | 2 + AGENTS.md | 2 +- CURRENT_STATUS.md | 3 +- .../[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md | 41 ++++- .../AIOS_05_SUPERVISED_AGENT_LOOPS.md | 38 ++++- PROJECT_CAPABILITIES.yaml | 63 +++++++- docs/knowledge_bundle_provenance_audit.json | 4 +- docs/knowledge_bundle_provenance_audit.md | 4 +- tests/test_aios_dual_surface.py | 2 +- tests/test_project_capabilities_executor.py | 141 ++++++++++++++++++ 11 files changed, 336 insertions(+), 19 deletions(-) create mode 100644 tests/test_project_capabilities_executor.py diff --git a/.agents/skills/ai-os-orchestrator/SKILL.md b/.agents/skills/ai-os-orchestrator/SKILL.md index d60e115..784e8bd 100644 --- a/.agents/skills/ai-os-orchestrator/SKILL.md +++ b/.agents/skills/ai-os-orchestrator/SKILL.md @@ -44,6 +44,61 @@ When the current owner identifies a concrete cross-domain need: Handoff completion is not goal completion. A prepared contract, identified owner, passing intermediate check, generated artifact, completed slice, or ready-for-review state is only an intermediate milestone unless it satisfies the original goal. +### Native subagent dispatch (pilot) + +Owner-approved bounded pilot, dated 2026-09-02, governed by +`ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md` +("Supervised AI-OS Subagent Dispatch"). It is not a standard workflow and +does not generalize. This subsection adds a dispatch mechanism to step 2 of the +canonical loop above; it does not add a second router, state machine, or +execution record. + +Preconditions for one dispatched slice: + +- routing has already resolved exactly one owner capability for this stage + (Steps 2–4 of Procedure); +- that capability's `PROJECT_CAPABILITIES.yaml` entry has an `executor` block + with `backend: claude_code_subagent`; +- the slice is reversible and policy-permitted, or its external action is + already authorized; a `write_capable: false` executor may not perform repository writes. + +Dispatch: + +1. Spawn one subagent of `executor.agent_type`. Pass a bounded prompt only: + the `original_goal`, the resolved capability id and `canonical_path`, the + `context_entrypoints` to load through `executor.context_loader` + (`project-context`), the single slice objective, the slice acceptance + criteria, and the relevant `authority_provenance` claims. Do not pass the + whole AES record, other projects, unrelated history, or secrets. +2. Instruct the child explicitly: return result, evidence references, and any + `cross_domain_need`; do not choose or invoke the next owner; do not spawn + sub-subagents (`child_dispatch: forbidden`). +3. The child runs in the same working tree. Treat shared filesystem as a risk: + only a `write_capable: true` executor (currently `codex`) may be asked to + modify files, and only when the slice genuinely requires it. + +On return, the root (and only the root): + +4. appends one `continuation.route_trace` entry — `from_owner: + ai-os-orchestrator`, `to_owner: `, `resume_stage`, + `criteria_addressed`, `route_signature`, `outcome` (`dispatched` → + `completed` or `refused`), `evidence_refs`; the same `execution_id` is kept; +5. validates the child result against the slice acceptance criteria and folds + its evidence into the AES record; +6. reassesses the `original_acceptance_criteria`; +7. selects the next route only through `ROUTING_RULES.md`, honoring the existing + `continuation.guards` (`max_continuation_hops`, `max_retries_per_owner`, + `max_no_progress_hops`, `route_signature_history_window`). A repeat route + without a material `evidence_delta` is recorded as + `repeat_route_refused_missing_evidence_delta` and not dispatched. + +Failure handling: a spawn error, missing result, denied tool, or unusable +output is registered as an AES defect (`classification: external_dependency` +for a runtime/tool failure, `implementation` for a bad result), not retried +silently or hidden. No subagent timeout primitive exists; rely on explicit +cancel and the guard limits. A dispatched slice is never terminal goal +completion — only Closure Review against the `original_goal` can close. + ### Execution lifecycle and warm resume Once `Invoke AI-OS` begins for an execution, this orchestration contract diff --git a/.agents/skills/project-context/SKILL.md b/.agents/skills/project-context/SKILL.md index 15f25e4..dd449ad 100644 --- a/.agents/skills/project-context/SKILL.md +++ b/.agents/skills/project-context/SKILL.md @@ -7,6 +7,8 @@ description: Load a bounded context pack after canonical routing resolves an exi Use after canonical routing resolves one capability. This skill loads context; it does not classify the request or define domain methodology. +When a capability's `executor.context_loader` names this skill, it is also the context entrypoint for a dispatched subagent (`AGENT_LOOP_PLAYBOOK.md`, "Supervised AI-OS Subagent Dispatch"): load only the one resolved capability's bounded pack; the subagent must not load other projects, classify the request, or select the next owner. + ## Procedure 1. Read the resolved capability from `PROJECT_CAPABILITIES.yaml` and verify its `canonical_path` exists. diff --git a/AGENTS.md b/AGENTS.md index df4ba3e..c4f3df7 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -116,7 +116,7 @@ valid when the user explicitly supplies them. - Make the smallest necessary change. - Keep changes bounded and reversible. - Do not refactor unrelated content. -- Do not add blocked promotion items: embeddings, semantic search, vector DB, web UI, autonomous retrieval, agentic workflows, autonomous agents, production deploys, secrets, credentials, or runtime artifacts. +- Do not add blocked promotion items: embeddings, semantic search, vector DB, web UI, autonomous retrieval, agentic workflows, autonomous agents, production deploys, secrets, credentials, or runtime artifacts. One bounded, owner-approved, root-controlled exception exists — "Supervised AI-OS subagent dispatch (pilot)" in `ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md`; it is pilot-only and does not generalize. - Do not claim production readiness or `production_promotion=yes`. - Do not commit directly to `main`. - Follow the canonical merge policy in `GOAL_MODE.md`; Codex and agents must not manually merge pull requests. diff --git a/CURRENT_STATUS.md b/CURRENT_STATUS.md index 5402d63..f387476 100644 --- a/CURRENT_STATUS.md +++ b/CURRENT_STATUS.md @@ -15,6 +15,7 @@ - local_first_compute_status: candidate policy; production allowlist empty; owner review pending - orchestration_primitives_p1_status: review complete; P1.3 partial gap; implementation owner review pending - executable_capability_routing_status: resolved; P0 audit BLOCKED_FOR_NATIVE_DISPATCH; P1–P4 already owned by canonical contracts; no MVP implemented; owner accepted the audit and closed #350 as completed (2026-09-02) +- native_subagent_dispatch_status: pilot MVP under bounded owner-approved carve-out (2026-09-02); hub-and-spoke, root-controlled, one AES execution_id, no parallel state model; pilot-only, not a standard workflow; evidence in docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md - acceptance_status: candidate / ready for human review - smoke_qa_evidence: docs/evidence/SMOKE_QA_RESULTS.md; docs/evidence/CROSS_PROJECT_SMOKE_QA_RESULTS.md - validation_gates: see `MASTER_STATUS.md` — "Validation Gates" and "Operational Gates" (canonical lists; do not copy them here) @@ -23,7 +24,7 @@ - semantic search - vector DB - web UI - - agentic workflows + - agentic workflows # one bounded exception: supervised AI-OS subagent dispatch (pilot), root-controlled, pilot-only — see AGENT_LOOP_PLAYBOOK.md - autonomous retrieval ## Current state diff --git a/ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md b/ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md index faaf3c3..c7af3c7 100644 --- a/ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md +++ b/ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md @@ -26,6 +26,42 @@ The loop is supervised when a human or explicit project gate controls scope, sto | PR Judge loop | `[Thinking]` / `[Codex]` | revise PR until pass/revise/blocked is clear | | ChatGPT routing loop | `[Inbox Router]` | reroute when task type is unclear | | Prompt QA Factory | `[AI OS]` -> owner project | candidate -> test -> judge -> revise -> selected, with human acceptance | +| Supervised AI-OS subagent dispatch (pilot) | `[AI OS]` root `ai-os-orchestrator` | root re-routes only via `ROUTING_RULES.md`; a child never selects the next owner | + +## Supervised AI-OS Subagent Dispatch (Pilot) + +Owner-approved bounded exception, dated 2026-09-02, for one MVP only. It is +**not** a general permission for agentic workflows or autonomous agents, and it +does not become a standard workflow automatically. Standardization requires a +separate owner decision. + +Scope: the root `ai-os-orchestrator` may spawn a native built-in coding-agent +subagent to execute one bounded, already-routed capability slice, then resume. + +Mandatory bounds: + +- hub-and-spoke only: `root -> child -> root`; no `child -> child` delegation; +- root `ai-os-orchestrator` is the only controller and the only canonical + routing entrypoint; a child may return a `cross_domain_need` but never + selects or invokes the next owner; +- one AES `execution_id` for the whole user goal; +- reuse the existing AES state machine, `continuation`, `route_trace`, `guards`, + handoff, and `authority_provenance`; do not create a parallel model; +- `PROJECT_CAPABILITIES.yaml` remains the only capability registry; +- each child receives bounded `project-context` for its resolved capability + only; +- the child gets no new authority; merge, deploy, production, destructive, and + external-action gates are unchanged; +- no Temporal / LangGraph / CrewAI / AutoGen / Mastra and no new + runtime, service, or database; +- `.claude/agents` is not a canonical source and `.gitignore` is unchanged; +- shared filesystem is a known risk: do not give a write-capable child unless + the slice genuinely requires writes; +- no subagent timeout primitive exists; this is a recorded runtime limitation, + mitigated by explicit cancel and guard limits; +- every actual spawn, result, and failure must be observable evidence + (`NOT RUN != PASS`); a runtime failure is registered as an AES defect, not + hidden by retry. ## Not Autonomous Agents @@ -37,7 +73,8 @@ Supervised loops are not: - background automation; - vector DB / embeddings / semantic search; - web UI; -- uncontrolled multi-agent execution. +- uncontrolled multi-agent execution (the pilot above is the only bounded, + owner-approved, root-controlled exception). ## Stop Conditions @@ -48,7 +85,7 @@ Stop when: - production, runtime, deploy, or migration work appears; - formulas, schemas, output contracts, column names, metric definitions, or business logic may change; - autonomous retrieval is needed; -- uncontrolled multi-agent work would be required; +- uncontrolled multi-agent work would be required beyond the bounded pilot; - acceptance criteria conflict. ## Human Acceptance diff --git a/ChatGPT/[AI OS]/Knowledge_Bundles/AIOS_05_SUPERVISED_AGENT_LOOPS.md b/ChatGPT/[AI OS]/Knowledge_Bundles/AIOS_05_SUPERVISED_AGENT_LOOPS.md index fe34a95..a9a4293 100644 --- a/ChatGPT/[AI OS]/Knowledge_Bundles/AIOS_05_SUPERVISED_AGENT_LOOPS.md +++ b/ChatGPT/[AI OS]/Knowledge_Bundles/AIOS_05_SUPERVISED_AGENT_LOOPS.md @@ -21,7 +21,7 @@ ChatGPT Project Sources / Knowledge for `[AI OS]`. - default_upload_mode: `Knowledge_Bundles` - bundle_type: generated compact upload artifact - source_of_truth: declared granular source files -- source_fingerprint: sha256:108523a32cf77e20ffbde41bcae48947f10f6b3c4dd6c667a9c7e2c566ea38dd +- source_fingerprint: sha256:274d77935b7fc633725ae5da1bb025a477aef0ef54d99bc08cc745c306ba061f - generator: scripts/build_knowledge_bundles.py --- @@ -51,6 +51,37 @@ The loop is supervised when a human or explicit project gate controls scope, sto | PR Judge loop | `[Thinking]` / `[Codex]` | revise PR until pass/revise/blocked is clear | | ChatGPT routing loop | `[Inbox Router]` | reroute when task type is unclear | | Prompt QA Factory | `[AI OS]` -> owner project | candidate -> test -> judge -> revise -> selected, with human acceptance | +| Supervised AI-OS subagent dispatch (pilot) | `[AI OS]` root `ai-os-orchestrator` | root re-routes only via `ROUTING_RULES.md`; a child never selects the next owner | +## Supervised AI-OS Subagent Dispatch (Pilot) +Owner-approved bounded exception, dated 2026-09-02, for one MVP only. It is +**not** a general permission for agentic workflows or autonomous agents, and it +does not become a standard workflow automatically. Standardization requires a +separate owner decision. +Scope: the root `ai-os-orchestrator` may spawn a native built-in coding-agent +subagent to execute one bounded, already-routed capability slice, then resume. +Mandatory bounds: +- hub-and-spoke only: `root -> child -> root`; no `child -> child` delegation; +- root `ai-os-orchestrator` is the only controller and the only canonical + routing entrypoint; a child may return a `cross_domain_need` but never + selects or invokes the next owner; +- one AES `execution_id` for the whole user goal; +- reuse the existing AES state machine, `continuation`, `route_trace`, `guards`, + handoff, and `authority_provenance`; do not create a parallel model; +- `PROJECT_CAPABILITIES.yaml` remains the only capability registry; +- each child receives bounded `project-context` for its resolved capability + only; +- the child gets no new authority; merge, deploy, production, destructive, and + external-action gates are unchanged; +- no Temporal / LangGraph / CrewAI / AutoGen / Mastra and no new + runtime, service, or database; +- `.claude/agents` is not a canonical source and `.gitignore` is unchanged; +- shared filesystem is a known risk: do not give a write-capable child unless + the slice genuinely requires writes; +- no subagent timeout primitive exists; this is a recorded runtime limitation, + mitigated by explicit cancel and guard limits; +- every actual spawn, result, and failure must be observable evidence + (`NOT RUN != PASS`); a runtime failure is registered as an AES defect, not + hidden by retry. ## Not Autonomous Agents Supervised loops are not: - autonomous retrieval; @@ -59,7 +90,8 @@ Supervised loops are not: - background automation; - vector DB / embeddings / semantic search; - web UI; -- uncontrolled multi-agent execution. +- uncontrolled multi-agent execution (the pilot above is the only bounded, + owner-approved, root-controlled exception). ## Stop Conditions Stop when: - no validation path exists; @@ -67,7 +99,7 @@ Stop when: - production, runtime, deploy, or migration work appears; - formulas, schemas, output contracts, column names, metric definitions, or business logic may change; - autonomous retrieval is needed; -- uncontrolled multi-agent work would be required; +- uncontrolled multi-agent work would be required beyond the bounded pilot; - acceptance criteria conflict. ## Human Acceptance Human acceptance is required before: diff --git a/PROJECT_CAPABILITIES.yaml b/PROJECT_CAPABILITIES.yaml index ed9c702..e9fba91 100644 --- a/PROJECT_CAPABILITIES.yaml +++ b/PROJECT_CAPABILITIES.yaml @@ -6,49 +6,98 @@ "context_entrypoints": [ "PROJECT_INSTRUCTIONS.md", "Knowledge/AI_OS_PROJECT_FILES_INDEX.md" - ] + ], + "executor": { + "backend": "claude_code_subagent", + "agent_type": "Plan", + "context_loader": "project-context", + "write_capable": false, + "child_dispatch": "forbidden" + } }, "thinking": { "canonical_path": "ChatGPT/[Thinking]", "context_entrypoints": [ "PROJECT_INSTRUCTIONS.md", "Knowledge/INDEX.md" - ] + ], + "executor": { + "backend": "claude_code_subagent", + "agent_type": "Plan", + "context_loader": "project-context", + "write_capable": false, + "child_dispatch": "forbidden" + } }, "analytics": { "canonical_path": "ChatGPT/[Analytics]", "context_entrypoints": [ "PROJECT_INSTRUCTIONS.md", "Knowledge/ANALYTICS_PROJECT_FILES_INDEX.md" - ] + ], + "executor": { + "backend": "claude_code_subagent", + "agent_type": "Plan", + "context_loader": "project-context", + "write_capable": false, + "child_dispatch": "forbidden" + } }, "llm": { "canonical_path": "ChatGPT/[LLM]", "context_entrypoints": [ "PROJECT_INSTRUCTIONS.md", "Knowledge/LLM_ROUTING.md" - ] + ], + "executor": { + "backend": "claude_code_subagent", + "agent_type": "Plan", + "context_loader": "project-context", + "write_capable": false, + "child_dispatch": "forbidden" + } }, "codex": { "canonical_path": "ChatGPT/[Codex]", "context_entrypoints": [ "PROJECT_INSTRUCTIONS.md", "Knowledge/INDEX.md" - ] + ], + "executor": { + "backend": "claude_code_subagent", + "agent_type": "general-purpose", + "context_loader": "project-context", + "write_capable": true, + "child_dispatch": "forbidden" + } }, "inbox_router": { "canonical_path": "ChatGPT/[Inbox Router]", "context_entrypoints": [ "PROJECT_INSTRUCTIONS.md", "Knowledge/INBOX_ROUTER_FILES_INDEX.md" - ] + ], + "executor": { + "backend": "claude_code_subagent", + "agent_type": "Plan", + "context_loader": "project-context", + "write_capable": false, + "child_dispatch": "forbidden" + } }, "thinkers_os": { "canonical_path": "ChatGPT/[Thinkers OS]", "context_entrypoints": [ "PROJECT_INSTRUCTIONS.md", "Knowledge/INDEX.md" - ] + ], + "executor": { + "backend": "claude_code_subagent", + "agent_type": "Plan", + "context_loader": "project-context", + "write_capable": false, + "child_dispatch": "forbidden" + } } } } diff --git a/docs/knowledge_bundle_provenance_audit.json b/docs/knowledge_bundle_provenance_audit.json index c13f37b..f7cc9bf 100644 --- a/docs/knowledge_bundle_provenance_audit.json +++ b/docs/knowledge_bundle_provenance_audit.json @@ -105,8 +105,8 @@ "ChatGPT/[AI OS]/Knowledge/AUTO_RESEARCH_BACKLOG.md", "ChatGPT/[AI OS]/Knowledge/SKILLS_HOOKS_MCP_DECISION_MATRIX.md" ], - "source_bytes": 7283, - "bundle_bytes": 8383, + "source_bytes": 9364, + "bundle_bytes": 10459, "classification": "equivalent", "bundle_only_excerpt_or_ref": [], "source_only_excerpt_or_ref": [], diff --git a/docs/knowledge_bundle_provenance_audit.md b/docs/knowledge_bundle_provenance_audit.md index 390f2fd..afd026b 100644 --- a/docs/knowledge_bundle_provenance_audit.md +++ b/docs/knowledge_bundle_provenance_audit.md @@ -101,8 +101,8 @@ Blocking record count: **0** - Project: [AI OS] - Source paths: `ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md`, `ChatGPT/[AI OS]/Knowledge/LOOP_ACCEPTANCE_CHECKLIST.md`, `ChatGPT/[AI OS]/Knowledge/AUTO_RESEARCH_BACKLOG.md`, `ChatGPT/[AI OS]/Knowledge/SKILLS_HOOKS_MCP_DECISION_MATRIX.md` -- Source bytes: 7283 -- Bundle bytes: 8383 +- Source bytes: 9364 +- Bundle bytes: 10459 - Classification: equivalent - Mapping status: mapped - Resolution status: not_applicable diff --git a/tests/test_aios_dual_surface.py b/tests/test_aios_dual_surface.py index 4ab768f..ac4d42c 100644 --- a/tests/test_aios_dual_surface.py +++ b/tests/test_aios_dual_surface.py @@ -46,7 +46,7 @@ def test_registry_is_location_resolver_only() -> None: for capability_id, canonical_path in EXPECTED_PROJECTS.items(): capability = registry["capabilities"][capability_id] - assert set(capability) == {"canonical_path", "context_entrypoints"} + assert set(capability) == {"canonical_path", "context_entrypoints", "executor"} assert capability["canonical_path"] == canonical_path diff --git a/tests/test_project_capabilities_executor.py b/tests/test_project_capabilities_executor.py new file mode 100644 index 0000000..5b2fd53 --- /dev/null +++ b/tests/test_project_capabilities_executor.py @@ -0,0 +1,141 @@ +"""Deterministic invariants for the PROJECT_CAPABILITIES executor block. + +Covers the bounded "Supervised AI-OS subagent dispatch (pilot)" runtime +binding. These are structural contract checks only; they do not spawn agents. +""" + +from __future__ import annotations + +import json +from pathlib import Path + +import pytest + +REPO_ROOT = Path(__file__).resolve().parents[1] +REGISTRY_PATH = REPO_ROOT / "PROJECT_CAPABILITIES.yaml" + +# The only executor backend the pilot verified on the Claude Code surface. +ALLOWED_BACKENDS = {"claude_code_subagent"} +# Built-in Claude Code agent types the pilot is allowed to use. "Plan" is +# read-only and cannot spawn nested agents; "general-purpose" is the only +# built-in that can perform repository writes. +ALLOWED_AGENT_TYPES = {"Plan", "general-purpose"} +WRITE_CAPABLE_AGENT_TYPES = {"general-purpose"} +EXECUTOR_KEYS = { + "backend", + "agent_type", + "context_loader", + "write_capable", + "child_dispatch", +} + + +def load_registry() -> dict: + # JSON is a YAML 1.2 subset; keeps the registry dependency-free. + return json.loads(REGISTRY_PATH.read_text(encoding="utf-8")) + + +def capabilities() -> dict: + return load_registry()["capabilities"] + + +def test_every_capability_has_a_well_formed_executor_block() -> None: + for capability_id, capability in capabilities().items(): + executor = capability.get("executor") + assert isinstance(executor, dict), f"{capability_id} missing executor" + assert set(executor) == EXECUTOR_KEYS, f"{capability_id} executor key drift" + assert executor["backend"] in ALLOWED_BACKENDS + assert executor["agent_type"] in ALLOWED_AGENT_TYPES + assert executor["context_loader"] == "project-context" + assert isinstance(executor["write_capable"], bool) + + +def test_hub_and_spoke_child_dispatch_is_forbidden_everywhere() -> None: + for capability_id, capability in capabilities().items(): + assert ( + capability["executor"]["child_dispatch"] == "forbidden" + ), f"{capability_id} must forbid child->child dispatch" + + +def test_write_capability_is_minimised_to_implementation_only() -> None: + write_capable = { + capability_id + for capability_id, capability in capabilities().items() + if capability["executor"]["write_capable"] + } + assert write_capable == {"codex"}, ( + "only the implementation capability may hold a write-capable executor; " + f"got {sorted(write_capable)}" + ) + for capability_id, capability in capabilities().items(): + executor = capability["executor"] + if executor["write_capable"]: + assert executor["agent_type"] in WRITE_CAPABLE_AGENT_TYPES + else: + assert executor["agent_type"] not in WRITE_CAPABLE_AGENT_TYPES + + +def test_unknown_capability_fails_closed() -> None: + caps = capabilities() + assert "does_not_exist" not in caps + with pytest.raises(KeyError): + _ = caps["does_not_exist"] + + +def test_canonical_paths_are_bounded_and_unique() -> None: + caps = capabilities() + seen: set[str] = set() + for capability_id, capability in caps.items(): + raw = capability["canonical_path"] + path = Path(raw) + assert not path.is_absolute(), f"{capability_id} canonical_path is absolute" + assert ".." not in path.parts, f"{capability_id} canonical_path escapes root" + resolved = (REPO_ROOT / path).resolve() + assert resolved.is_relative_to(REPO_ROOT.resolve()) + assert resolved.is_dir(), f"{capability_id} canonical_path missing" + assert raw not in seen, f"duplicate canonical_path {raw}" + seen.add(raw) + + +def test_executor_without_a_verified_backend_cannot_claim_execution() -> None: + """A capability whose executor backend is not in the verified allowlist + must not be treated as executable. This guards against a future edit that + adds an aspirational backend value.""" + caps = capabilities() + executable = { + capability_id + for capability_id, capability in caps.items() + if capability["executor"]["backend"] in ALLOWED_BACKENDS + } + # Today every capability is bound to the one verified backend. + assert executable == set(caps) + + tampered = json.loads(json.dumps(caps)) + tampered["analytics"]["executor"]["backend"] = "imaginary_runtime" + still_executable = { + capability_id + for capability_id, capability in tampered.items() + if capability["executor"]["backend"] in ALLOWED_BACKENDS + } + assert "analytics" not in still_executable + + +def test_agent_loop_playbook_declares_the_pilot_carveout() -> None: + playbook = ( + REPO_ROOT / "ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md" + ).read_text(encoding="utf-8") + assert "Supervised AI-OS Subagent Dispatch (Pilot)" in playbook + assert "hub-and-spoke only: `root -> child -> root`" in playbook + assert "no `child -> child` delegation" in playbook + assert "one AES `execution_id` for the whole user goal" in playbook + + +def test_orchestrator_skill_binds_dispatch_to_route_trace_and_root_only() -> None: + skill = ( + REPO_ROOT / ".agents/skills/ai-os-orchestrator/SKILL.md" + ).read_text(encoding="utf-8") + assert "Native subagent dispatch (pilot)" in skill + assert "backend: claude_code_subagent" in skill + assert "continuation.route_trace" in skill + assert "do not choose or invoke the next owner" in skill + assert "repeat_route_refused_missing_evidence_delta" in skill From 20390edcbeca693e29abb4ef81295201c9523af7 Mon Sep 17 00:00:00 2001 From: Claude Code Date: Wed, 2 Sep 2026 11:11:15 +0300 Subject: [PATCH 2/2] =?UTF-8?q?docs(evidence):=20native=20subagent=20dispa?= =?UTF-8?q?tch=20pilot=20=E2=80=94=203=20executions,=20verdict=20PASS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ran the bounded pilot end-to-end on the Claude Code surface: - Pilot A: Thinking -> root -> Analytics -> root -> Thinking (exec-pilotA) - Pilot B: AI OS -> root -> LLM -> root -> Codex (read-only) (exec-pilotB) - Pilot C: multi-hop; loop guard exercised both ways (exec-pilotC) — bare repeat route refused (repeat_route_refused_missing_evidence_delta), repeat route allowed after a material evidence_delta. 9 real native subagent dispatches. One execution_id per pilot, root-only routing, bounded project-context per child, no child->child, Closure Review against the original goal, one final result each. All 14 owner acceptance criteria + the Pilot C guard check observed. Defects registered (not hidden): - DEF-001 external_dependency: children inherit the parent cwd/branch (shared filesystem) and read a stale tree; domain reasoning unaffected; logged as a design risk for standardization. - DEF-002 contract: orchestrator subsection lacked a "root after-child step is mechanical, not discretionary" constraint (AES 2.1 boundary). Fixed — closed-trigger wording added to ai-os-orchestrator/SKILL.md (one fix). Evidence: docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md Pointers: docs/evidence/README.md, MASTER_STATUS.md. Verdict: PASS. Recommendation: keep pilot-only; standardization needs a separate owner decision gated on DEF-001 fix, structural hub-and-spoke for the write path, 2-3 more executions to calibrate guard thresholds, and a cost owner. Checks: 6 canonical scripts + provenance audit + pytest (215) all pass. Co-Authored-By: Claude Sonnet 5 --- .agents/skills/ai-os-orchestrator/SKILL.md | 15 ++ MASTER_STATUS.md | 1 + ...TIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md | 236 ++++++++++++++++++ docs/evidence/README.md | 5 + 4 files changed, 257 insertions(+) create mode 100644 docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md diff --git a/.agents/skills/ai-os-orchestrator/SKILL.md b/.agents/skills/ai-os-orchestrator/SKILL.md index 784e8bd..3d270f8 100644 --- a/.agents/skills/ai-os-orchestrator/SKILL.md +++ b/.agents/skills/ai-os-orchestrator/SKILL.md @@ -92,6 +92,21 @@ On return, the root (and only the root): without a material `evidence_delta` is recorded as `repeat_route_refused_missing_evidence_delta` and not dispatched. +The after-child step is **mechanical, not discretionary** (preserves the AES +§2.1 resolved-owner boundary; a discretionary root becomes a standing +supervisor above the resolved owner and defeats warm resume). After a child +returns, the root performs only continuation-layer functions — record the +evidence delta, update progress against the original acceptance criteria, +evaluate the four guards — then restores the resolved owner and its +`resume_stage` and returns control to that owner. The root does not pick a new +owner on its own judgment and does not perform or redo domain work. The root +diverts from the resolved owner only on a closed trigger: (i) a cold-entry-level +change to the original goal, resolved owner, scope, authority, or canonical +routing state; (ii) an AES §2 `decide` trigger; (iii) a tripped continuation +guard; or (iv) all original acceptance criteria satisfied. Cross-domain routing +after a child return still originates from the resolved owner's identified +`cross_domain_need`. + Failure handling: a spawn error, missing result, denied tool, or unusable output is registered as an AES defect (`classification: external_dependency` for a runtime/tool failure, `implementation` for a bad result), not retried diff --git a/MASTER_STATUS.md b/MASTER_STATUS.md index c80f133..f9994de 100644 --- a/MASTER_STATUS.md +++ b/MASTER_STATUS.md @@ -44,6 +44,7 @@ Canonical list. Other documents (including `CURRENT_STATUS.md`) must reference t - `docs/evidence/SMOKE_QA_RESULTS.md` — `[AI OS]` smoke QA evidence from 2026-07-06. - `docs/evidence/CROSS_PROJECT_SMOKE_QA_RESULTS.md` — cross-project smoke QA evidence from 2026-07-06. - `docs/evidence/EXECUTABLE_CAPABILITY_ROUTING_P0_AUDIT_2026-09-02.md` — Issue #350 P0 audit: `BLOCKED_FOR_NATIVE_DISPATCH`; P1–P4 already owned by canonical contracts; no MVP implemented. Audit accepted by the owner; #350 closed as completed 2026-09-02. See `docs/evidence/README.md` for the other decision-evidence records (#342, #344, #345). +- `docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md` — bounded native-subagent-dispatch MVP pilot on the Claude Code surface (follow-up to #350), under the 2026-09-02 owner carve-out. 3 multi-owner executions, verdict `PASS`, recommended pilot-only. Not standardized; not merged; not production-authorized. - `docs/operations/CHATGPT_PROJECT_SYNC_CHECKLIST.md` — manual sync status. - `docs/operations/PILOT_CASES.md` — pilot backlog; pilot completion still requires result evidence. - `StreamDeck/README.md` — StreamDeck active/candidate status. diff --git a/docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md b/docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md new file mode 100644 index 0000000..652dc35 --- /dev/null +++ b/docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md @@ -0,0 +1,236 @@ +# Native Subagent Dispatch MVP — Pilot Evidence — 2026-09-02 + +- Follow-up to issue #350 (`BLOCKED_FOR_NATIVE_DISPATCH` on the ChatGPT/Codex surface). +- Surface under test: **Claude Code** (`Agent` tool + built-in agent types). +- Baseline: `origin/main` @ `5ea37b6`. Branch: `codex/native-subagent-dispatch-mvp`. +- Governance: bounded owner-approved carve-out "Supervised AI-OS subagent dispatch (pilot)", 2026-09-02 (`owner_instruction`). Pilot-only; not a standard workflow; does not generalize. +- Evidence status: observed dispatches recorded below; no owner acceptance, no merge, no production authorization. + +## Summary + +The `Invoke AI-OS` orchestrator was bound to the native Claude Code subagent +primitive and driven through three multi-owner executions. Each pilot ran as +one AES `execution_id` with the root as the only router; every hop returned to +the root; loop guards were exercised (Pilot C refused a bare repeat route and +allowed it only after a material `evidence_delta`). No new router, state +machine, schema field, or database was added. Two runtime defects were +registered, not hidden. + +## FACT — native runtime capability (observed this task) + +| Primitive | Result | How observed | +|---|---|---| +| Child creation | works | 10 `Agent` dispatches across a probe + 3 pilots | +| Separate context | confirmed | children reported "I can see only this prompt … no earlier conversation" | +| Bounded task transfer | confirmed | each child received only the crafted prompt | +| Result return to parent | confirmed | every child report returned to the root, not the user | +| Typed identity + tool limits | confirmed | `Plan` children had no Edit/Write/Agent; `general-purpose` child was instructed read-only and made no writes | +| Nested delegation control | confirmed | `Plan` cannot spawn children (no Agent tool) → hub-and-spoke structurally enforced for read slices | +| Sequential execution | confirmed | `run_in_background:false` blocked to completion each time | +| Warm continuation of a child | available (not exercised) | the `general-purpose` child returned an `agentId` for `SendMessage` | +| Parallel execution | not exercised | pilots were deliberately sequential | +| Timeout | **not available** | no `Agent` timeout param; recorded as a runtime limitation | +| Filesystem isolation | **shared by default** | children ran in the parent cwd on the parent's checked-out branch (see DEF-001) | + +## Governance classification + +`A. policy-compatible supervised AES execution` **for this bounded pilot only**, +under the carve-out in `ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md` +("Supervised AI-OS Subagent Dispatch (Pilot)"). Standing prohibition on +"agentic workflows / autonomous agents" is unchanged for everything else; +`AGENTS.md` and `CURRENT_STATUS.md` annotate the single exception. + +## Architecture selected and why + +Option 1 (minimal): root holds the only `Agent` tool; per resolved capability +it spawns one built-in agent type (`Plan` for read-only reasoning slices, +`general-purpose` only for a write-capable implementation slice) with a bounded +prompt that names the capability, `canonical_path`, `context_entrypoints`, the +slice objective and acceptance, and forbids next-owner selection and +sub-subagent spawning. Capability→executor binding is a **semantic** `executor` +block in `PROJECT_CAPABILITIES.yaml`; no `.claude/agents/*` files, `.gitignore` +unchanged, no AES-record schema change. Rejected: declared `.claude/agents` +specialists (touches repo hygiene) and SDK `agents` config (not repo +source-of-truth). + +## Files changed + +| File | Change | +|---|---| +| `ChatGPT/[AI OS]/Knowledge/AGENT_LOOP_PLAYBOOK.md` | + allowed loop type + "Supervised AI-OS Subagent Dispatch (Pilot)" section (all mandatory bounds) | +| `ChatGPT/[AI OS]/Knowledge_Bundles/AIOS_05_SUPERVISED_AGENT_LOOPS.md` | regenerated (deterministic) | +| `docs/knowledge_bundle_provenance_audit.{json,md}` | regenerated (byte counts + fingerprint) | +| `AGENTS.md` | "agentic workflows" blocked item annotated with the single bounded exception | +| `CURRENT_STATUS.md` | `native_subagent_dispatch_status` line + `blocked_items` annotation | +| `PROJECT_CAPABILITIES.yaml` | additive `executor` block per capability (`backend`, `agent_type`, `context_loader`, `write_capable`, `child_dispatch: forbidden`) | +| `.agents/skills/ai-os-orchestrator/SKILL.md` | "Native subagent dispatch (pilot)" subsection incl. the mechanical-root constraint from DEF-002 | +| `.agents/skills/project-context/SKILL.md` | one line binding it as the child context loader | +| `tests/test_project_capabilities_executor.py` | new — 8 deterministic invariants | +| `tests/test_aios_dual_surface.py` | key-set assertion updated for `executor` | +| `docs/evidence/NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md` | this file | +| `docs/evidence/README.md`, `MASTER_STATUS.md` | pointers | + +Not touched: `schemas/autonomous_execution_record.schema.json`, `ROUTING_RULES.md`, `GOAL_MODE.md`, `HANDOFF_STYLE_STANDARD.md`, AES standard, `.github/`, any merge/production gate, `.gitignore`. + +## Commands / checks run + +`check_project_instructions_length` · `check_repo_public_safety` · +`check_codex_goal_mode_defaults` · `check_manifest_paths` · +`check_knowledge_bundles` · `check_index_coverage` — PASS. +`audit_bundle_provenance.py --check` — PASS. +`python3 -m pytest tests/ -q` — 215 passed (207 baseline + 8 new). + +## Pilot traces + +All three: one user prompt, no manual project selection, canonical routing +(`ROUTING_RULES.md`) chose every owner, each child got bounded `project-context` +only, one `execution_id`, root-only re-routing, Closure Review against the +original goal, one final result. + +### Pilot A — `Thinking → root → Analytics → root → Thinking` + +- `execution_id`: `exec-pilotA-2026-09-02` +- Goal: "Should AI-OS adopt a nightly automated knowledge-bundle drift check as a blocking CI gate? One recommendation + decision status + revisit triggers." +- Route trace: + | # | from → to | agent_type | outcome | evidence_delta | criteria addressed | + |---|---|---|---|---|---| + | A1 | root → thinking | Plan | completed | — | frame options + quantitative need | + | A2 | root → analytics | Plan | completed | — | quantify drift-halt frequency from repo evidence | + | A3 | root → thinking | Plan | completed | `new_evidence` (A2 result) | final recommendation | +- Context boundary: each child declared `included/excluded/context_sufficiency`; A1/A3 excluded all non-`[Thinking]` projects; A2 excluded non-`[Analytics]` methodology. +- Evidence produced: A1 → 4 reversible options + one quantitative question; A2 → "a blocking per-PR bundle gate already exists (`docs-safety.yml` + `source_fingerprint` since 2026-07-09); ~0 merged-history drift halts / 90d; true-positive fraction and lead time `unknown`"; A3 → recommendation = **advisory nightly check, not blocking**; `decision_status: recommended` (advisory) / `blocked` (blocking gate, pending data); 5 revisit triggers. +- Closure Review vs original goal: **satisfied** — one recommendation, decision status, ≥2 revisit triggers. + +### Pilot B — `AI OS → root → LLM → root → implementation ([Codex])` + +- `execution_id`: `exec-pilotB-2026-09-02` +- Goal: "Design a minimal prompt-level check that a dispatched subagent loaded only bounded project-context; say where it lives in the repo." +- Route trace: + | # | from → to | agent_type | outcome | criteria addressed | + |---|---|---|---|---| + | B1 | root → ai_os | Plan | completed | checkable "bounded context" signals | + | B2 | root → llm | Plan | completed | turn checklist into a CHECK spec (prompt, schema, aggregation, per-item method, fixtures) | + | B3 | root → codex | general-purpose (read-only) | completed | verify repo placement + gating checks, no writes | +- Context boundary: B1 excluded sibling projects; B2 excluded `[AI OS]` Judge doctrine + repo-root `CONTEXT_PACK_STANDARD.md` with reasons; B3 loaded only `[Codex]` + the specific files it verified. +- Evidence produced: B1 → 10 pass/fail signals grounded in `project-context/SKILL.md`; B2 → `bounded_context_check` spec (10 items classified deterministic vs llm-judge, 2 calibration fixtures); B3 → verified minimal change set with `path:line` citations, caught that `check_index_coverage.py` also needs `LLM_PROJECT_STATUS.md` and that `UPLOAD_LIST.md` is bundles-only. **No file was modified.** +- Closure Review: **satisfied** — check designed + exact repo home identified. + +### Pilot C — multi-hop, ≥3 owner transitions + loop-guard demonstration + +- `execution_id`: `exec-pilotC-2026-09-02` +- Goal: "One-paragraph governance note: is the native-subagent-dispatch pilot consistent with AES §2.1 resolved-owner boundary + the continuation control-plane contract?" +- Route trace: + | # | from → to | agent_type | outcome | evidence_delta | note | + |---|---|---|---|---|---| + | C1 | root → ai_os | Plan | completed | — | structural consistency (5 points) + decision-level cross_domain_need | + | C2 | root → thinking | Plan | completed | — | verdict (b): consistent only if a mechanical-root constraint is added; exact wording supplied | + | C-r | root → ai_os | — | **refused** | **none** | `repeat_route_refused_missing_evidence_delta` — bare repeat route, not dispatched | + | C3 | root → ai_os | Plan | completed | `new_evidence` (C2 verdict) | final one-paragraph note | +- **Loop-guard result (mandatory check):** + - repeat route to `ai_os` **without** `evidence_delta` → `refused`, recorded, not dispatched. ✔ + - repeat route to `ai_os` **with** material `evidence_delta` (`new_evidence` = C2 verdict) → **allowed**, dispatched as C3. ✔ +- Owner transitions: root→ai_os→root→thinking→root→(refused)→root→ai_os→root = 3 completed transitions + 1 refused. +- Corrective loop: C2's verdict (b) is `implementation_feedback` → registered as **DEF-002** and the mechanical-root constraint was added to `ai-os-orchestrator/SKILL.md` (one fix). +- Closure Review vs original goal: **satisfied** — 168-word paragraph, conditional-consistency conclusion, cites AES §2.1 + continuation contract + hub-and-spoke / one-`execution_id` / route-trace-guard reuse, names the risk, states where the constraint belongs. + +## Defects / failures registered + +| id | classification | severity | description | status | +|---|---|---|---|---| +| DEF-001 | `external_dependency` | `needs_check` | Dispatched children inherit the parent cwd, which was on a stale local branch (`codex/chatgpt-project-live-optimization-source`), so several children reported repo-state facts that are wrong on `origin/main` (e.g. "build/audit bundle scripts absent", "root manifest absent", "PR #298 not found"). Their domain reasoning against files that *do* exist in the tree was sound; decision outputs were not affected because later slices re-verified key facts. | mitigated (pilot); open as a design risk | +| DEF-002 | `contract` | `needs_check` | The orchestrator "Native subagent dispatch (pilot)" subsection did not state that the root's after-child step is mechanical, leaving room for a discretionary root that would breach the AES §2.1 resolved-owner boundary. | resolved — constraint text added, one fix | + +No failure was hidden by retry. No child selected a next owner. No child spawned a sub-subagent. No unauthorized write occurred. + +## Route trace result + +Reconstructable end-to-end from the tables above: every dispatch, its owner, +outcome, `evidence_delta`, and the one refused repeat route. All three +executions kept a single `execution_id`; no new `execution_id` was created at +any hop. + +## Residual risks + +1. **Shared filesystem + branch inheritance (DEF-001).** Children see the + parent's working tree/branch. Mitigations for any future use: run dispatch + from a checkout on the intended ref, pass absolute paths into the intended + worktree, or use `Agent` `isolation: "worktree"`. Not fixed in this pilot. +2. **No timeout primitive.** Only manual cancel + guard limits. +3. **`general-purpose` can nest.** The write-capable `codex` executor has the + `Agent` tool; hub-and-spoke there relies on the prompt instruction, not a + structural block. `Plan` executors are structurally safe. +4. **Agent-type fit is approximate.** `Plan` is a planning/read role reused for + `[Thinking]`/`[Analytics]` reasoning; behavior is shaped by the bounded + prompt + `project-context`, not the type label. +5. **Cost.** Each spawn starts cold and re-derives context. + +## Rollback + +Single PR → `git revert `. The `executor` block is inert data once the +orchestrator subsection is reverted; the carve-out, bundle regen, tests, and +this evidence file revert with it. No schema migration, no runtime store, no +`.gitignore` change. Prompt-level `Invoke AI-OS`, Goal Mode, AES records, and +existing routing are unaffected by a revert. + +## AES statuses (reported separately) + +```yaml +execution_state: completed # MVP build + 3 pilots complete +overall_delivery: pass # all 14 acceptance items observed (see verdict) +qa_status: pass # 6 canonical checks + provenance audit + pytest 215 +judge_verdict: not_run # no independent Judge review +authority_status: owner_review_pending +merge_status: not_opened # → open on PR +production_status: not_applicable +``` + +## Acceptance check (owner's 14 criteria) + +| # | criterion | result | +|---|---|---| +| 1 | one user prompt | pass (one goal per pilot) | +| 2 | ≥3 real native subagent dispatches | pass (9 completed across A/B/C; 3 per pilot) | +| 3 | no manual project selection by user | pass | +| 4 | owner chosen by canonical routing | pass (`ROUTING_RULES.md` each hop) | +| 5 | each child bounded context | pass (declared included/excluded/sufficiency; other projects excluded with reasons) | +| 6 | one `execution_id` | pass (`exec-pilot{A,B,C}-2026-09-02`, unchanged across hops) | +| 7 | requirements / evidence / authority provenance preserved | pass (carried in every dispatch prompt + route_trace) | +| 8 | control returns to root after each child | pass (hub-and-spoke; no child→child) | +| 9 | original acceptance re-evaluated after each stage | pass (root reassessed before each next route; Closure Review per pilot) | +| 10 | next owner chosen only by root | pass (children returned `cross_domain_need` only) | +| 11 | repeat / no-progress route detected by existing AES guards | pass (Pilot C: `repeat_route_refused_missing_evidence_delta`) | +| 12 | runtime failure registered as evidence/defect | pass (DEF-001, DEF-002) | +| 13 | Closure Review checks the original user goal | pass (per pilot) | +| 14 | one final result to the user | pass (one recommendation / one check design / one governance note) | +| C-extra | repeat route without `evidence_delta` → refused; with material `evidence_delta` → allowed | pass (both branches observed in Pilot C) | + +## Verdict + +# PASS + +Executable multi-capability dispatch was actually run and observed end-to-end +(`goal → route → real child execution → central return → AES update → reroute → +Closure Review → one result`) across three multi-owner executions, with the +loop guard exercised in both directions. All 14 owner acceptance criteria and +the Pilot C extra check are met. Two defects were registered and handled, not +hidden. `qa_status` pass; `judge_verdict` not run; owner review pending; merge +and production unauthorized. + +## Recommendation — pilot-only vs standardization + +**Keep pilot-only for now; do not standardize yet.** Open a separate owner +decision for standardization, gated on: + +1. **DEF-001 fixed** — a deterministic rule for the child's checkout/worktree + (or mandatory `isolation: "worktree"`), so dispatched children cannot read a + stale tree. +2. **Structural hub-and-spoke for the write path** — either restrict the + `codex` executor to a non-nesting agent type or add an enforced block, so + `child_dispatch: forbidden` is not prompt-only. +3. **2–3 more real executions** across `[AI OS] / [LLM] / Judge` and a + deliberate runtime-failure case, to calibrate the four guard thresholds + (currently unset) per the continuation contract. +4. A named owner for the dispatch cost/latency budget. + +Until then this remains a bounded, reversible pilot under the 2026-09-02 +carve-out and is not a standard workflow. diff --git a/docs/evidence/README.md b/docs/evidence/README.md index 09af80c..9c75525 100644 --- a/docs/evidence/README.md +++ b/docs/evidence/README.md @@ -9,6 +9,11 @@ Start with [`MASTER_STATUS.md`](../../MASTER_STATUS.md) for gates and Current decision evidence: +- [`NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md`](NATIVE_SUBAGENT_DISPATCH_PILOT_2026-09-02.md) + records the bounded native-subagent-dispatch MVP pilot on the Claude Code + surface (follow-up to #350): 3 multi-owner executions, verdict `PASS`, + recommended **pilot-only** pending a separate standardization decision. It + does not authorize standardization, merge, or production. - [`EXECUTABLE_CAPABILITY_ROUTING_P0_AUDIT_2026-09-02.md`](EXECUTABLE_CAPABILITY_ROUTING_P0_AUDIT_2026-09-02.md) records the Issue #350 P0 audit: `BLOCKED_FOR_NATIVE_DISPATCH` for executable dispatch, P1–P4 already owned by current canonical contracts, plus an