← graph

integrate-and-canary

Integrate and canary Pi evaluation plane

Metadata

Statusdone
Assignedagent-928
Agent identity6841f97a7a8e6cbc213051ce0ffb3c85c92c80cb61fd699428ab3fed6cb6ba94
Created2026-07-26T10:25:10.266058219+00:00
Started2026-07-28T12:16:01.887291440+00:00
Completed2026-07-28T13:23:41.384381534+00:00
Tokens26936152 in / 47278 out

Description

Objective

Integrate the authoritative lifecycle, admission deferral, lazy evaluation creation, dedicated Pi bounded-evaluation lane, and deep-readonly FLIP; then roll evaluation back on through controlled canaries. Preserve native Codex execution behavior and executor neutrality without changing direct Codex/Claude task scope.

Rollout (enforced order)

  1. Start with automatic bounded evaluation, FLIP, and all hard gates disabled. Persist an explicit rollout stage; config/reload must reject attempts to skip forward.
  2. Run the credential-free Fake-Pi full lifecycle suite and real daemon/TUI human-flow smoke.
  3. Run a live low-risk Pi/Luna bounded advisory-evaluation canary when the configured Pi route is available. Record success evidence before stage advancement.
  4. Run one explicitly requested deep-readonly system FLIP canary. Verify its observation-only boundary and genuine latent-intent/counterfactual findings; do not call a shallow bounded grader FLIP.
  5. Verify zero evaluation for sources that never ran, zero stuck pending-eval states, zero duplicate records/verdicts, zero worker/build slot use, correct admission-deferral behavior, and idempotent daemon restarts.
  6. Only after steps 2–5 pass, enable auto_evaluate=true in advisory bounded mode with eval_gate_all=false. Leave eager/global FLIP disabled and use explicit/selective high-risk policy.
  7. Observe multiple real source completions and record rollback thresholds. This task may never enable a global hard gate. A later operator may enable a hard gate only for an explicit high-risk policy after reviewing canary evidence.

Produce an operator runbook, machine-readable canary evidence, and before/after Viz evidence.

Validation

  • A RED integration scenario is authored first and fails before wiring: pi_evaluation_rollout_requires_canary_success_before_enable covers disabled start, stage-skip rejection, canary evidence, advisory enablement, and rollback.
  • Credential-free Fake-Pi fixtures run the entire publish → execute → lazy bounded evaluation → advisory verdict → terminal source flow; cancellation, skip, admission deferral, and non-spawn sources create no evaluation work.
  • A live scripted human flow uses the real daemon plus terminal/TUI/Viz controls, not library-only calls, and shows no eager clutter plus legible on-demand evidence.
  • Daemon restart during each stage is idempotent; there are no duplicate records/verdicts, stuck pending-eval states, or worker/build/worktree use by evaluation.
  • The bounded Pi evaluation canary passes before the explicit deep-readonly FLIP canary; deep FLIP's read-only boundary and cross-system understanding are demonstrated separately.
  • Native Codex task routing/config remains selectable and is not silently rewritten or used as Pi fallback; the credential-free regression need not invoke an external Codex login.
  • Advisory auto_evaluate=true can be enabled only after recorded canary success; eval_gate_all remains false, global FLIP remains disabled, and attempts to globally hard-gate in this rollout are rejected.
  • Rollback command/path is exercised through the actual operator terminal flow and documented.
  • Permanent smoke scenario(s) are added under tests/smoke/scenarios/ and registered with this task in tests/smoke/manifest.toml owners.
  • cargo fmt --check, cargo clippy, relevant suites, cargo build, and cargo test pass with no regressions.

Depends on

Required by

✉ Messages 2 messages (2 unread)

  1. #1implement-deep-read2026-07-28T12:12:33.658493059+00:00delivered
    Deep-readonly FLIP landed in commit 9f920d39. Separate explicit/high-risk Pi observation lane; immutable candidate bundle covers intent/graph/attempts/messages/diff/validation/runtime/effective config/repo; custom tool allowlist + bwrap declared validation; closed evidence-linked report and exact observation audit. Bounded default remains independent. Owned smoke: deep_readonly_flip_human_flow.
  2. #2integrate-and-canary2026-07-28T12:16:10.701565930+00:00read
    Acknowledged deep-read handoff — I will integrate commit 9f920d39's dedicated bounded/deep Pi lanes into the staged rollout, keep their boundaries separate, and validate the owned human-flow smoke.

Log