implement-deep-read — WorksGood live mirror

Metadata

Status	done
Assigned	`agent-927`
Agent identity	`6841f97a7a8e6cbc213051ce0ffb3c85c92c80cb61fd699428ab3fed6cb6ba94`
Created	2026-07-26T10:24:56.007337710+00:00
Started	2026-07-28T11:27:11.196915922+00:00
Completed	2026-07-28T12:14:33.907511158+00:00
Tokens	22753008 in / 55084 out

Description

Objective

Implement deep-readonly system FLIP as the high-fidelity mode the user described: it must genuinely understand and assess the whole relevant system, not merely grade a summary. Default routine evaluation remains the preceding bounded no-tools mode; FLIP is selective, observation-only, evidence-linked, and bounded.

Requirements

Trigger only by explicit manual/high-risk policy after a real source attempt reaches candidate completion. Enabling default bounded evaluation must never globally enable FLIP.
Give Pi a read-only evidence/tool allowlist covering original user intent/conversation, task/dependency graph, source attempt history, messages, artifacts, source diff, validation logs, canonical runtime traces, effective configuration, and relevant repository files.
Provide a controlled validation runner for declared tests when required; never grant source/config/graph mutation, arbitrary shell, credential access, authoring identity, or unrestricted network.
Perform latent-intent and counterfactual probes, identify omitted work, examine cross-component consequences, and produce structured findings with evidence references/confidence. Merely restating or grading an evidence summary is not a passing FLIP.
Defend against prompt injection in logs/artifacts through explicit trust boundaries and structured outputs.
Record exactly which evidence/tools were observed so findings are reproducible/auditable.

Validation

RED tests are written first: deep_flip_finds_cross_component_omission_bounded_summary_misses and deep_flip_capabilities_are_observation_only; they fail before implementation.
A credential-free Fake-Pi/replay fixture plants a cross-file/system inconsistency and omitted user intent: bounded summary evaluation misses it while deep-readonly FLIP finds it with references and a counterfactual explanation.
Read-only enforcement blocks attempted source/config/graph mutation, arbitrary command/network use, credential reads, and identity impersonation without corrupting state.
Original intent, graph/dependency context, diff, tests, messages, configuration, and runtime evidence are all demonstrably considered and recorded; tool/evidence budgets and timeout failures are deterministic.
A real terminal/TUI human flow explicitly requests deep FLIP after source completion, observes progress, opens the evidence-linked report, and verifies bounded evaluation alone never triggers it. The report is legible and does not echo hostile payloads unsafely.
The permanent credential-free live scenario is added under tests/smoke/scenarios/ and registered with this task in tests/smoke/manifest.toml owners.
cargo fmt --check, cargo clippy, focused tests, cargo build, and cargo test pass with no regressions.

## Objective
Implement deep-readonly system FLIP as the high-fidelity mode the user described: it must genuinely understand and assess the whole relevant system, not merely grade a summary. Default routine evaluation remains the preceding bounded no-tools mode; FLIP is selective, observation-only, evidence-linked, and bounded.

## Requirements
- Trigger only by explicit manual/high-risk policy after a real source attempt reaches candidate completion. Enabling default bounded evaluation must never globally enable FLIP.
- Give Pi a read-only evidence/tool allowlist covering original user intent/conversation, task/dependency graph, source attempt history, messages, artifacts, source diff, validation logs, canonical runtime traces, effective configuration, and relevant repository files.
- Provide a controlled validation runner for declared tests when required; never grant source/config/graph mutation, arbitrary shell, credential access, authoring identity, or unrestricted network.
- Perform latent-intent and counterfactual probes, identify omitted work, examine cross-component consequences, and produce structured findings with evidence references/confidence. Merely restating or grading an evidence summary is not a passing FLIP.
- Defend against prompt injection in logs/artifacts through explicit trust boundaries and structured outputs.
- Record exactly which evidence/tools were observed so findings are reproducible/auditable.

## Validation
- [ ] RED tests are written first: `deep_flip_finds_cross_component_omission_bounded_summary_misses` and `deep_flip_capabilities_are_observation_only`; they fail before implementation.
- [ ] A credential-free Fake-Pi/replay fixture plants a cross-file/system inconsistency and omitted user intent: bounded summary evaluation misses it while deep-readonly FLIP finds it with references and a counterfactual explanation.
- [ ] Read-only enforcement blocks attempted source/config/graph mutation, arbitrary command/network use, credential reads, and identity impersonation without corrupting state.
- [ ] Original intent, graph/dependency context, diff, tests, messages, configuration, and runtime evidence are all demonstrably considered and recorded; tool/evidence budgets and timeout failures are deterministic.
- [ ] A real terminal/TUI human flow explicitly requests deep FLIP after source completion, observes progress, opens the evidence-linked report, and verifies bounded evaluation alone never triggers it. The report is legible and does not echo hostile payloads unsafely.
- [ ] The permanent credential-free live scenario is added under `tests/smoke/scenarios/` and registered with this task in `tests/smoke/manifest.toml` owners.
- [ ] `cargo fmt --check`, `cargo clippy`, focused tests, `cargo build`, and `cargo test` pass with no regressions.

Depends on

done implement-dedicated-pi

Required by

done integrate-and-canary

✉ Messages 2 messages (2 unread)

#1implement-dedicated-pi2026-07-28T11:23:58.923757089+00:00delivered

Dedicated executor-neutral boundary landed in 98c0923c: src/evaluation/bounded.rs exposes AdapterRequest, BoundedEvaluationAdapter, content-addressed EvidenceManifest/budgets/capability scan, and hidden record attempt/verdict/failure provenance. Deep-readonly records remain untouched (runner selects only EvaluationProduct::Bounded), so your task can add a separate adapter/runner without graph tasks or worker slots.

#2implement-deep-read2026-07-28T11:27:19.136621954+00:00read

Acknowledged dedicated-lane handoff — I’ll build deep-readonly as a separate explicit adapter/runner on the exposed evidence boundary, preserving bounded evaluation defaults.

Log

2026-07-26T10:24:55.992302407+00:00 Task paused
2026-07-26T10:25:30.969038015+00:00 Task published
2026-07-28T11:25:37.331847302+00:00 Spawn preparation deferred before launch permit; rollback is complete and no circuit-breaker charge was recorded. Repair the reported checkout/configuration condition and retry: spawn transaction for agent-927 rolled back (task remains dispatchable; rollback diagnostics: complete): failed to establish isolated-worktree observer baseline: observer source tuple mismatch
2026-07-28T11:27:11.399612129+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-07-28T11:27:19.238885847+00:00 Starting implementation; inspecting prior WIP and dedicated evaluation boundary before writing RED tests.
2026-07-28T11:36:06.485680257+00:00 RED established: deep_flip_finds_cross_component_omission_bounded_summary_misses and deep_flip_capabilities_are_observation_only fail to compile because deep runner/report/capabilities do not exist. Implementing separate observation-only lane now.
2026-07-28T11:55:06.856861445+00:00 Core implementation passes RED regressions: separate deep Pi lane materializes immutable candidate, exposes four custom observation-only tools, enforces closed evidence-linked reports and audit, fails closed on forbidden tools/budget/timeout, and keeps bounded defaults independent. Real candidate-binary terminal+tmux/TUI smoke passes.
2026-07-28T12:07:53.973703390+00:00 Validation: cargo fmt --check, cargo clippy --all-targets, cargo build --locked, focused deep/dedicated/lazy suites, and owned candidate-binary terminal+tmux/TUI smoke pass. Full cargo test reaches 3023 pass/36 ignored; exactly 7 pre-existing named-profile global-env poison failures reproduce dependency handoff and first passes in isolation (no deep/dedicated/lazy failure).
2026-07-28T12:08:27.334072339+00:00 Committed: 9f920d39 — pushed to remote
2026-07-28T12:12:33.582168900+00:00 Installed commit globally with cargo install --path . --locked; installed-binary owned terminal/TUI smoke passes.
2026-07-28T12:14:33.907511449+00:00 Task marked as done