Conversation
Remove a second File-only tool default from Workflow lowering. The existing child grant remains the single authority: role, parent permissions, scope and write_authority are intersected before catalog projection and dispatch. Explicit tool allowlists and deny_all_tools remain exact. The stopship fixture now declares its deliberately File-only evidence scope explicitly. Normally write-capable identities narrowed to read_only keep the existing classifier-bounded inspection shell instead of losing every command. Parent shell denials remain binding, arbitrary commands and tests are not inspection, and no write scope is granted. Verifiers retain their bounded Run interface. Do not annotate missing tools and missing source files as unavailable models. Preserve provider/model/route diagnostics for real model access failures. Update the existing agent guide to describe these boundaries accurately. Verification: - cargo fmt --all -- --check: PASS. - cargo clippy -p codewhale-tui --all-targets --all-features --locked -- -D warnings -A clippy::uninlined_format_args -A clippy::too_many_arguments -A clippy::unnecessary_map_or: PASS. - Targeted nextest: 15 passed, 0 failed; 13230 not selected. Includes actual isolated Git inspection through the child executor, mutation denial, parent shell denial, bounded verifier/catalog tests, Workflow narrowing, stopship handoff receipts and accurate failure classification. - Dead-code budget: 279, PASS. Blocking-call budget: 578 sites/171 files, PASS. - git diff --check: PASS. - No web changes. Earlier relevant root-gate evidence was packaging 67, SDK 14, web Vitest 490 passed, and check:web passed; not rerun for this Rust slice. No model substitution is implemented here. Pinned routes, approval decisions, network limits, write claims, and the shared Engine remain authoritative. No provider call or installed-runtime upgrade is claimed. Refs #6407 Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
…tence Hosted macOS CI reproduced a second Stop returning 404 after the first Stop returned 200: cancel_agent_run filtered out its in-memory terminal record and raced the asynchronous disk projection. Return the owning manager's terminal receipt without issuing another cancellation or weakening foreign-session checks. Add a deterministic memory-only-manager regression for repeated Stop. Complete the intentional inspection change from #6423 by asserting the explicit File-only stopship fixture and the exact builder's inherited, read-only runtime grant. These are contracts for the new behavior, not ignored or deleted tests; write refusal, exact-provider identity and deny-all handoffs stay pinned. Verification: - cargo fmt --all -- --check: passed. - cargo clippy -p codewhale-tui -p codewhale-workflow --all-targets --all-features --locked with CI -D warnings and the three CI lint allowances: passed. - Targeted nextest: 7 passed, 0 failed; 13,506 not selected. Covers repeated Stop before persistence, existing live-child Stop, foreign-session refusal, the two hosted fixture failures, bounded Git vs mutation, and exact Fleet authority non-escalation. - Link emitted the existing large __eh_frame warning; tests linked and passed. - Dead-code budget: 279, passed. Blocking-call budget: 578 sites/171 files, passed. - git diff --check: passed. No web changes; web gates were not rerun. Hosted failure receipts: jobs 107088964032, 107088964169 and 107088964192. No provider call, installed-runtime upgrade or hosted-green claim is made here. Refs #6423 Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Hmbown
pushed a commit
that referenced
this pull request
Sep 23, 2026
…tence Hosted macOS CI reproduced a second Stop returning 404 after the first Stop returned 200: cancel_agent_run filtered out its in-memory terminal record and raced the asynchronous disk projection. Return the owning manager's terminal receipt without issuing another cancellation or weakening foreign-session checks. Add a deterministic memory-only-manager regression for repeated Stop. Complete the intentional inspection change from #6423 by asserting the explicit File-only stopship fixture and the exact builder's inherited, read-only runtime grant. These are contracts for the new behavior, not ignored or deleted tests; write refusal, exact-provider identity and deny-all handoffs stay pinned. Verification: - cargo fmt --all -- --check: passed. - cargo clippy -p codewhale-tui -p codewhale-workflow --all-targets --all-features --locked with CI -D warnings and the three CI lint allowances: passed. - Targeted nextest: 7 passed, 0 failed; 13,506 not selected. Covers repeated Stop before persistence, existing live-child Stop, foreign-session refusal, the two hosted fixture failures, bounded Git vs mutation, and exact Fleet authority non-escalation. - Link emitted the existing large __eh_frame warning; tests linked and passed. - Dead-code budget: 279, passed. Blocking-call budget: 578 sites/171 files, passed. - git diff --check: passed. No web changes; web gates were not rerun. Hosted failure receipts: jobs 107088964032, 107088964169 and 107088964192. No provider call, installed-runtime upgrade or hosted-green claim is made here. Refs #6423 Signed-off-by: CodeWhale Bot <bot@codewhale.net>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
A bounded 0.10.1 Workflow/Fleet reliability fix, stacked on #6407. Retarget to
mainafter that integration PR merges; this PR itself must not merge before its checks are green.No-Issue: This fixes read-only agent regressions reproduced during the founder-requested 0.10.1 release work; model replacement remains separate work.
This does not introduce silent model fallback, relax saved route pins, remove approval gates, grant writes or allow arbitrary test programs to an inspection agent.
Verification
cargo fmt --all -- --check: passed.git diff --checkand feature-release-note gate: passed.Hosted CI and an installed-runtime/provider qualification remain pending. The source/test evidence is not a claim that the currently installed binary has changed.
Hosted CI follow-up
The first exact-head run exposed two fixture expectations of the old File-only/no-shell defaults and a real repeated-Stop race on macOS. The follow-up asserts the deliberately narrowed runtime grant and explicit stopship File scope, and returns terminal Stop receipts from the owning manager rather than racing asynchronous persistence. Foreign-session mutation refusal stays covered.
__eh_framewarning; linking and tests completed successfully.