diff --git a/docs/change/change_log.md b/docs/change/change_log.md index bab03e4..70c2cba 100644 --- a/docs/change/change_log.md +++ b/docs/change/change_log.md @@ -6,6 +6,8 @@ This file provides a chronological, human-readable record of applied codebase an ## [Unreleased] +- Closed out CR-DD-016 after merge (documentation only): CR-DD-016 is complete, accepted, and merged into `main` across three PRs on 2026-08-11 — the requirements contract through PR #155 as merge commit `a3bdd7ca6b940e48a8271d11de7ec5e166494615` (parents `e842ed598a78b6481c7201d0ac43a72832658016` and `afbd47046e43eb89392cfc206263780a25588542`), a corrective amendment through PR #156 as merge commit `35de5068f97090e5e32c24f8a8285a3cd86705f2`, and the bounded implementation through PR #157 as merge commit `7c7fb720aea546763fe062dd08438125d81bdd8c` (implementation commit `01e8b14`, merge-safe status wording `b2d56e3`). The CR defined its own completion as merge of the implementation PR into `main`; that condition was satisfied at `7c7fb72`, and this entry records the resulting final bounded state. Unlike the CR-131, CR-DD-013, and CR-OC-001C closeouts, this entry **retires no false status language**: commit `b2d56e3` deliberately rephrased the status, implementation-authority, and evidence wording before merge so the same text would stay true on both sides of it, so the document needed no post-merge correction and this closeout adds a completion record rather than repairing one. What the merge actually delivered is narrow and text-only. `docs/daily_driver_quickstart.md` gained an "Understand local-capability probing" operator section stating the three-case contract — a `[capability]` declaration with a resolved model binding permits `local_fast`/`local_heavy` route consideration **by itself** and records `Configured`, an operator assertion rather than a checked observation; a fresh probe whose path is also set as `[capability].local_probe_record_path` upgrades that to `ObservedAvailable`, or on an unreachable result conclusively suppresses the declared route the declaration alone would have permitted; and with neither usable, capability is `Unknown` and `local_only` work fails closed — together with the consequence that a probe record older than the 300-second default `freshness_seconds` window is treated identically to no probe at all. `triage_core/tc_cli.py` changed by exactly one `argparse` `help=` string, on `tc probe --output`, which now names `[capability].local_probe_record_path` as the required follow-up config key and states that writing the output file alone has no effect on `tc run`. `tests/test_tc_cli.py` gained one regression test, `test_tc_probe_help_names_capability_probe_record_path`, asserting that against whitespace-normalized help output with `COLUMNS` pinned so the assertion does not depend on ambient terminal width. The four-path Authorized Implementation Allowlist held exactly: the union of files across all five CR-DD-016 commits is the CR document, `docs/daily_driver_quickstart.md`, `tests/test_tc_cli.py`, and `triage_core/tc_cli.py`, and all five named exclusions — `local_backend_probe.py`, `capability_evidence.py`, `config.py`, `client.py`, and `routing/resilience_router.py` — were untouched. No schema, CLI flag shape, default value, command dispatch, probe execution, capability resolution, routing decision, or persistence behavior changed, and CR-DD-013 remains the governing runtime semantics, unreopened. The corrective amendment carried in PR #156 is preserved as part of the durable record rather than applied as a silent fix: the CR as originally merged in PR #155 cited two trials as one root cause, and read-only reconciliation against `resolve_capability` and this repository's own tracked `triagecore.toml` **withdrew** the Aug-8 trial (`task_id` `12fe348e-94fd-43da-8bb8-2aa61a3eb949`) as evidence for a probe-absence-causes-blocking claim, because both routes were declared and bound there and the block traced instead to a sensitivity-driven routing selection; Day-1 Trial 001, which ran before CR-DD-014 added the declarations, remains a genuine no-declaration/no-probe fail-closed instance. That amendment restated the CR's finding as a discoverability gap about what probing assures, not an undiscoverable prerequisite for local execution. Verification at closeout on 2026-08-29 re-ran the pinned regression against merged `main` at `fa66c64`: `test_tc_probe_help_names_capability_probe_record_path` passes, and `tests/test_tc_cli.py` with `tests/test_capability_binding.py` is 55 passed, 0 failed. No backlog retirement was required — CR-DD-016 appears in neither `docs/backlog.md` nor `docs/current_backlog.md`, so unlike the CR-131 and CR-DD-013 closeouts this slice touches no backlog file. Proposal acceptance, the bounded implementation authority, and merge are recorded as granted or decided and now spent; closeout authority was granted by the human operator on 2026-08-29, scoped to exactly this entry and the CR document, and does **not** include merge authority for the closeout PR, which remains a separate human decision. Tracks B and C named in the CR's Sequencing section — the classifier terminal `"refactor"` fallback and the hardcoded `privacy_level="local_ok"` in `_build_resilience_route_input` — are explicitly **not** closed, addressed, or resolved by this closeout; no separate investigation record for either exists under `docs/` as of this entry, and CR-DD-017 independently records both as remaining separately scoped. This entry changes no code, tests, workflow, schema, dependency, fixture, or configuration. + - Closed out CR-131 after merge (documentation only): CR-131 is complete, accepted, and merged through PR #168 as merge commit `2ac5814b37401d3c5ec13b44d9ac961a04bdfbf4` (parents `25734855afd4aca9e28dcfd344731637b2ead39e` and `1da8bc03a2347992d910d9907e193d3050b0e47a`). This entry records the final bounded state now that implementation, merge, release-applicability, and closeout are all resolved. What the merge actually delivered: the repository-root `AGENTS.md`, previously an inherited, generic "Global Orchestration Configuration" document (a Local Worker Council / Cloud Supervisor feedback loop and an unrelated "Cybernetic Ecology Rubric" referencing domain-specific concerns such as water intakes and tribal layers), was replaced in full with a TriageCore-specific repository-governance document — 61 lines, SHA-256 `58d83280245b053718b04cab0fe84c8d9640c09780018761bcf880add088a77e` — covering repository authority precedence, before-acting preflight and worktree hygiene, the full CR lifecycle chain (proposal acceptance through closeout), writable-scope versus read-only-verification separation, evidence and current-state rules, stop-and-request-direction triggers, a pointer to `docs/verification_guide.md` rather than a restatement, non-authority of agent verdicts and instructions, optional tooling, and explicit exclusions. The replacement was reconstructed fresh from then-current `main`, not by committing or cherry-picking a pre-existing uncommitted draft found on the unrelated `codex/agents-governance-separation` checkout, which was consulted read-only as source material only and left untouched throughout. Release was determined **not applicable**: CR-131 changes repository-governance documentation only, with no package, deployment, runtime rollout, or artifact-publication action associated with it. Proposal acceptance, design acceptance, implementation authority, implementation acceptance, merge authority, the release-applicability decision, and closeout are all recorded as **granted or decided and now spent**; the lifecycle-record corrections that kept CR-131's durable status in sync with each stage were carried through PR #167, PR #169, PR #170, and PR #171. This entry does not claim CR-131 resolved every reference to the prior `AGENTS.md` content elsewhere in the repository: `triage_core/project_steward.py`'s embedded "Cybernetic Ecology" escalation-packet language, `docs/operations/control-plane-invariant-checklist.md`'s stale `AGENTS.md §7` citation, and `docs/submission/claim_boundaries.md`'s definition of the now-orphaned `ARTIFACT_REVIEW_PASSED` term were identified during closeout triage and remain explicitly out of scope, tracked separately. The current backlog's stale PR #140-era `AGENTS.md` description is updated in this same closeout slice to a compact current-state record. This entry changes no code, tests, workflow, schema, dependency, fixture, or runtime configuration. - Closed out CR-DD-013 after merge (documentation only): CR-DD-013 is complete, accepted, and merged through PR #116 as merge commit `98df9c1a51d8d67999517eb8e1008cd55c51e738`. This entry records the final bounded state and retires the pre-merge status language that became false at the moment of merge; before it, the CR's status section still read "Approved for implementation. The bounded implementation is complete on its branch" and the backlog still carried CR-DD-013 as "proposed; documentation only; implementation unauthorized" in the active list, in the daily-driver recommendation paragraph, and in the next-candidate-slices list. What the merge actually delivered is stated narrowly. `tc run` resolves local capability once, before governed route selection, by **reading an already-recorded local-runtime observation** — the existing validated `local_backend_probe_record.v1` from the merged CR-114/CR-118/CR-119 probe lane — through a new `[capability]` section in `triagecore.toml` read via the existing `Config.get_global` mechanism. It performs **no probe of its own**: no automatic probe, completion, chat, embedding, model execution, or provider expansion, no circuit-breaker behavior, and no new ledger schema, with capability provenance carried additively through the existing open `route_decision` payload while the closed `route-worker-ledger.v1` contract stays untouched and `choose_resilience_route`'s decision logic is unmodified. Explicit `declare_local_fast` and `declare_local_heavy` declarations can declare `local_fast` and `local_heavy` for route consideration; ordinary backend configuration — an endpoint, an enabled backend entry, a model name — deliberately does not qualify and still resolves to unknown. **Observed runtime reachability and configured route-class availability remain distinct evidence**, as separate variants of a validated discriminated union: a reachable runtime records `ObservedAvailable` with its source type, evidence tier, `observed_at`, and the applied freshness bound, while a declaration standing in for an absent observation records `Configured` with `source_type=operator_config` and a `config_reference`, and is forbidden at construction from carrying a probe evidence tier or an `observed_at`, so configured capability can never serialize as observed health. Missing, `probe_disabled`, stale, malformed, freshness-indeterminate, and otherwise insufficient evidence all remain **unknown rather than healthy**, through the closed reason set `missing`, `probe_disabled`, `stale`, `invalid_record`, and `insufficient_model_evidence`; a record carrying no `observed_at` — which the probe contract forbids for `synthetic_fixture` records — resolves to unknown with reason `stale`, covering both an expired observation and one whose freshness cannot be established at all. The two asymmetries the CR exists to protect are enforced in the merged precedence: **a fresh observed-unavailable result overrides declarations** and suppresses every route depending on that runtime, so a declaration cannot revive an unavailable runtime; and **a fresh reachable runtime does not by itself prove `local_fast` or `local_heavy`**, because a metadata probe measures neither the memory nor the context envelope those classes imply, so reachability confirms the runtime only and class availability comes from the declarations. With no usable observation and no declaration, all three availability booleans are false and local-only work fails closed through the existing `LocalRouteUnavailableError` path rather than through a second enforcement path. **Direct `TriageClient.run_task` callers that omit the optional capability object retain the previous library behavior exactly** — the prior route-input literals are preserved for them and no observation is inferred on their behalf — so the behavioral change is scoped to the `tc run` construction path, which always supplies a resolution. Two boundaries remain explicitly outside the slice and require new authority: **class-to-model evidence is G3 work**, since nothing here binds a route class to a specific model, and **runtime disappearance after the single pre-route resolution is G6 work**, since capability is resolved once before routing and nothing claims the selected route is still executable when the worker runs — no retry, re-probe, re-route, or execution-time verification exists. Implementation and merge authority for CR-DD-013 are recorded as **exercised and now spent**; any correction, expansion, or downstream integration requires new, separate, explicit authority, and CR-DD-012B remains an independent lane that receives none of it, keeping its own CR-YK-002 atomic-claiming gate and its own separate approval requirement. Historical proposal text is preserved rather than rewritten: the "Proposed Field Shape", "Recommended Design", "Explicit Exclusions", "Provisional Implementation File Allowlist", "Deferred To The Implementation CR", and "Open Questions" sections keep their original wording under supersession notes recording that each was true when written, which parts the merge settled, and which remain open — Open Question 2, whether `local_fast` and `local_heavy` can ever be distinguished from probe evidence alone, is recorded as still unresolved G3 work rather than quietly closed. The merged path set is also recorded against the provisional allowlist in both directions rather than smoothed over: nine paths changed, and `triage_core/config.py` and `triage_core/tc_cli.py` were among them although the provisional section had named `tc_cli.py` as deliberately excluded, while `triage_core/local_backend_probe.py` and `tests/test_local_only_routing.py` were not changed by the merge. The backlog moves CR-DD-013 out of the active list into the completed status section as a compact entry, with design history left in the CR document. This entry changes no code, tests, workflow, schema, dependency, fixture, or configuration, and touches no README or architecture file. diff --git a/docs/change/requests/CR-DD-016-capability-probe-operator-workflow-discoverability.md b/docs/change/requests/CR-DD-016-capability-probe-operator-workflow-discoverability.md index 52311b5..841703a 100644 --- a/docs/change/requests/CR-DD-016-capability-probe-operator-workflow-discoverability.md +++ b/docs/change/requests/CR-DD-016-capability-probe-operator-workflow-discoverability.md @@ -2,21 +2,33 @@ ## Status -- **Status:** Implementation candidate verified; completion is defined by merge of the - implementation PR into `main`. +- **Status:** Complete. The requirements contract, its corrective amendment, and the + bounded implementation are all merged into `main`; the completion condition stated + below — merge of the implementation PR — was satisfied by PR #157 on 2026-08-11. + Closeout is granted and recorded. All CR-DD-016 authorities are spent; this CR + creates no standing authority. - **Type:** Documentation / Operator Workflow. - **Priority:** Research backlog. Downstream of CR-DD-013; does not reopen or amend it. - **Implementation authority:** Authorized for exactly the four-path Implementation Allowlist below, exercised only within it. No further changes are authorized. Merge of - the implementation PR is the final human gate; once merged, that bounded authority is - spent. + the implementation PR was the final human gate; it occurred at merge commit `7c7fb72` + on 2026-08-11, and that bounded authority is now spent. - **Human approval requirement:** Explicit human review and approval of this Change Request was required before implementation began, and was given separately. Merge of - the implementation PR is the final acceptance gate. - -This document records a requirements contract with a verified implementation candidate, -bounded to exactly the allowlist below. It grants no execution, integration, or standing -authority beyond that bounded implementation. + the implementation PR was the final acceptance gate, and it was satisfied at + `7c7fb72`. +- **Closeout:** Granted by the human operator on 2026-08-29. This closeout-recording + grant separately and explicitly authorized exactly two paths — this CR file and + `docs/change/change_log.md` — to record CR-DD-016's completed lifecycle. It creates no + new implementation, runtime, or scope authority; it does not reopen the Authorized + Implementation Allowlist below, which is preserved as the historical record of what + the implementation stage was permitted to touch. This grant is spent upon writing the + closeout; it does not include merge authority for the closeout PR, which remains a + separate human decision. See the Closeout section at the end of this document. + +This document records a requirements contract whose bounded implementation is merged and +closed out. It grants no execution, integration, or standing authority beyond that +bounded, now-spent implementation. **Implementation evidence:** commit `01e8b14` on PR #157 (`claude/cr-dd-016-implementation` → `main`). @@ -203,6 +215,17 @@ bounded authority is spent. No further file on this list — or any other file touched under this authorization, before or after merge, without a separate, explicit approval. +> **Closeout note (2026-08-29):** The allowlist above reflects this CR's +> implementation-stage authorization and is preserved as written for historical +> accuracy — it is not silently rewritten, and it was honored exactly (see the Closeout +> section for the verified file union). The separate, explicit approval its final +> sentence requires was subsequently granted as a closeout-recording decision, which +> additionally authorized exactly one path outside this list — +> `docs/change/change_log.md` — bounded to recording CR-DD-016's completed lifecycle +> only. That grant does not retroactively expand the implementation-stage allowlist +> above, reopen any of the four paths for further implementation change, or authorize +> any other file. + ## Explicitly Out of Scope - **No default `--output` path for `tc probe`.** A predictable default location (something @@ -306,3 +329,57 @@ read-only investigations that must not be combined with each other or with this and the post-decision guard in `client.py`. Establish whether `privacy_level="local_ok"` is intentional normalization, legacy dead code, or a genuine propagation gap. Read-only until its own findings warrant a separately scoped CR. + +## Closeout + +Recorded 2026-08-29 under separately granted closeout authority (see Status). +CR-DD-016's lifecycle is complete. + +**Merge record.** Three PRs, all merged into `main` on 2026-08-11: + +| Stage | PR | Merge commit | +| --- | --- | --- | +| Requirements contract (with in-review scope repair `afbd470`) | #155 | `a3bdd7ca6b940e48a8271d11de7ec5e166494615` | +| Corrective amendment — capability-observation semantics | #156 | `35de5068f97090e5e32c24f8a8285a3cd86705f2` | +| Bounded implementation (`01e8b14`, status wording `b2d56e3`) | #157 | `7c7fb720aea546763fe062dd08438125d81bdd8c` | + +**No false status language was retired.** This closeout differs from the CR-131, +CR-DD-013, and CR-OC-001C closeouts in one respect worth recording: commit `b2d56e3` +rephrased the Status, implementation-authority, and evidence wording *before* merge so +the same text would remain true on both sides of it. Nothing in this document became +false at the moment of merge, so this closeout records completion rather than repairing +a stale claim. + +**Allowlist verification.** The union of files across all five CR-DD-016 commits +(`76713fb`, `afbd470`, `65dca1e`, `01e8b14`, `b2d56e3`) is exactly the four authorized +paths, and all five named exclusions — `local_backend_probe.py`, +`capability_evidence.py`, `config.py`, `client.py`, `routing/resilience_router.py` — +were untouched. The `triage_core/tc_cli.py` change is a single `argparse` `help=` string +on `tc probe --output`. No schema, CLI flag shape, default value, command dispatch, +probe execution, capability resolution, routing decision, or persistence behavior +changed; CR-DD-013 remains the governing runtime semantics, unreopened. + +**Verification at closeout.** Re-run against merged `main` at `fa66c64`: +`tests/test_tc_cli.py::test_tc_probe_help_names_capability_probe_record_path` passes, +and `tests/test_tc_cli.py` with `tests/test_capability_binding.py` is 55 passed, +0 failed. All five Invariants Preserved above remain true and unmodified by this slice. + +**Backlog.** No retirement was required. CR-DD-016 appears in neither `docs/backlog.md` +nor `docs/current_backlog.md`, so this closeout touches no backlog file — unlike the +CR-131 and CR-DD-013 closeouts, which each had a stale active-list entry to retire. + +**Release.** Not applicable — documentation and CLI help text only, with no package, +deployment, runtime rollout, or artifact-publication action associated with this change. + +**Tracks B and C are not closed by this.** The classifier terminal `"refactor"` fallback +and the hardcoded `privacy_level="local_ok"` normalization remain exactly as described +in Sequencing above: independently scoped, read-only, and unresolved. No separate +investigation record for either exists under `docs/` as of this closeout, and CR-DD-017 +independently records both as remaining separately scoped. Nothing here addresses, +resolves, or folds them into CR-DD-016's acceptance. + +**Authorities.** Proposal acceptance, the bounded four-path implementation authority, +and merge are all granted or decided and now **spent**. The closeout-recording grant of +2026-08-29 is spent upon writing this record and did not include merge authority for the +closeout PR. Any correction, expansion, or downstream integration requires new, +separate, explicit authority.