Skip to content

chore(cluster-meta): mount Loa harness per ADR-009 D-4#3

Merged
zkSoju merged 1 commit into
mainfrom
cluster-meta/loa-mount-2026-05-25
May 25, 2026
Merged

chore(cluster-meta): mount Loa harness per ADR-009 D-4#3
zkSoju merged 1 commit into
mainfrom
cluster-meta/loa-mount-2026-05-25

Conversation

@zkSoju
Copy link
Copy Markdown
Contributor

@zkSoju zkSoju commented May 25, 2026

First cluster-meta cycle remediation per ADR-009 D-4. Cluster-harness audit 2026-05-25 found inventory-api UNMOUNTED (no CLAUDE.md, no .claude/, no grimoires/, no .beads/) despite being L4 PRODUCTION — owns Mibera contract holdings via MIBERA_CONTRACT 0x6666397DFe9a8c469bf65dc744cb1c733416c420 at src/inventory.ts:18. Pre-Loa-introduction inheritance.

Lands: .claude/ 9.2M (863 files, copy from score-api template) · .beads/ init (prefix inventory-api) · grimoires/loa/{cycles,notes,memory}/ · .run/.gitkeep · .loa.config.yaml + .loa-version.json · CLAUDE.md (90 lines, authored from src/inventory.ts + sonar-client.ts + codex-client.ts + README).

ADDITION-ONLY: no src/ touch; no package.json change; runtime identical. Verification: 90/92 tests pass (2 hermetic-mode skips expected); tsc --noEmit clean.

🤖 Generated with Claude Code

inventory-api was built pre-Loa-introduction; cluster-harness audit
2026-05-25 found it had zero Loa harness (no CLAUDE.md, no .claude/,
no grimoires/loa/, no .beads/). Per ADR-009 D-4 doctrine — "Agents
need to be able to run beads/cycles. We mount if not already mounted."

Addition-only mount; runtime unchanged.

What this adds
- CLAUDE.md (cell-specific agent instructions, authored from src/ context)
- .loa.config.yaml (mirrors loa-freeside posture: standard persistence,
  strict integrity; run_mode auto_push/draft_pr disabled — operator-gated)
- .claude/ (substantive 9.2M mount, copied from score-api template,
  cache pruned; lib/skills/scripts/hooks/data/schemas/protocols/etc.)
- grimoires/loa/{cycles,notes,memory}/ (empty, ready for first cycle)
- grimoires/loa/NOTES.md (cell working memory + mount provenance)
- grimoires/loa/memory/observations.jsonl (empty)
- .beads/ (initialized via `br init` with prefix `inventory-api`;
  beads.db gitignored)
- .run/.gitkeep (state dir; contents will be local-only in cycle work)

What was NOT touched
- src/ (no runtime changes)
- index.ts, types.ts, package.json, tsconfig.json
- .well-known/beacon.json (cell's contract surface — governed via BeaconV3)
- README.md, .gitignore
- node_modules/, package-lock.json
- No npm packages installed or dependencies changed

Verification
- npm run typecheck: PASS
- npm test: 90/92 PASS (2 live-smoke SKIPPED — expected hermetic-mode behavior)

Provenance
- Mount mechanism: Path B (manual scaffold + selective copy from
  /Users/zksoju/Documents/GitHub/score-api/.claude/ — os-mounting
  skill not available locally)
- Mount branch: cluster-meta/loa-mount-2026-05-25 (off main)
- Operator-gated: no push, no PR — caller opens after operator GO

Refs
- ADR-009 D-4: https://github.com/0xHoneyJar/loa-freeside/blob/feat/identity-api/decisions/009-freeside-hexagonal-federation.md
- ADR-008 (factory doctrine, building topology)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@socket-security
Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: pypi numpy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?pypi/sentence-transformers@2.7.0pypi/numpy@2.4.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 495766a62a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

version = "1.0.0"
description = "Hounfour multi-model provider adapter for the Loa framework"
requires-python = ">=3.8"
dependencies = []
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Declare YAML parser as required runtime dependency

Add pyyaml to the base runtime dependencies, because config loading always requires YAML parsing before any command can run. Right now a default install (dependencies = []) relies on yq being present on the host; when neither pyyaml nor yq is installed, model-invoke exits with INVALID_CONFIG during startup, which breaks dry-run/validation paths out of the box.

Useful? React with 👍 / 👎.

request = CompletionRequest(
messages=messages,
model=resolved.model_id,
temperature=binding.temperature or 0.7,
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve explicit zero temperature in request construction

Use a None check instead of or 0.7 when assigning temperature; with the current expression, agents configured with temperature: 0 are silently changed to 0.7. This changes model behavior for deterministic workflows and makes a valid config value impossible to apply.

Useful? React with 👍 / 👎.

Comment on lines +172 to +176
cb_state = _check_circuit_breaker(adapter.provider, config)
if cb_state == "OPEN":
logger.info("Circuit breaker OPEN for %s, skipping", adapter.provider)
last_error = f"Circuit open for {adapter.provider}"
# Don't count against retries — just skip
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Count HALF_OPEN probes before calling provider

Increment the HALF_OPEN probe counter before attempting adapter.complete(...); otherwise half_open_max_probes is never enforced. check_state gates on half_open_probes, but this loop only checks for OPEN and proceeds without recording a probe, so concurrent requests can all pass through in HALF_OPEN and overwhelm a recovering provider.

Useful? React with 👍 / 👎.

@zkSoju zkSoju merged commit 5708cf1 into main May 25, 2026
3 checks passed
@zkSoju zkSoju deleted the cluster-meta/loa-mount-2026-05-25 branch May 25, 2026 21:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant