Repository navigation
Integrate authored Pi question and five-rule batch patch - #3820
Merged
Merged
Conversation
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
|
debt-src at eb53cc1, every finding: |
trissim
force-pushed
the
pi-pr-salvage-pi-meant
branch
2 times, most recently
from
November 1, 2026 02:44
0cc8966 to
add9b1c
Compare
trissim
force-pushed
the
pi-pr-salvage-pi-meant
branch
3 times, most recently
from
November 1, 2026 06:53
d3c1bc9 to
9dd6da7
Compare
trissim
force-pushed
the
pi-pr-salvage-pi-meant
branch
2 times, most recently
from
November 1, 2026 11:18
03e03b3 to
8607bcc
Compare
This was referenced Nov 1, 2026
trissim
force-pushed
the
pi-pr-salvage-pi-meant
branch
2 times, most recently
from
November 1, 2026 17:49
dbd71d0 to
b944955
Compare
trissim
added a commit
that referenced
this pull request
Nov 1, 2026
Preserving sessions, inputs and originals had become a reflex that built a carry, backup, locks and a dry run for six dead Claude sessions' open questions (#3820). Preservation protects what a live reader needs; dead state is deleted, and the check is 'who would notice?'. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016gZLdttfQjtizEYZGek9Gh
trissim
force-pushed
the
pi-pr-salvage-pi-meant
branch
from
November 1, 2026 20:02
b525133 to
ed8e84a
Compare
trissim
added a commit
that referenced
this pull request
Nov 1, 2026
…ND_SYSTEM is gone AGENTS.md and .pi/APPEND_SYSTEM.md restated the commander rules, and the copies had drifted from them: merge-vs-rebase, draft-vs-ready PRs, a dead resource-check helper, and an unconditional "preserve UNKNOWN inputs" that outvoted unnecessary.md's named-live-caller test (#3820). Every native Pi unit carried APPEND_SYSTEM ahead of the verbatim rules in its own system prompt, so the rules reached it three times. - AGENTS.md now holds only host facts (paths, checkout commands, limits, permissions, authorization) and opens by pointing at commander/rules and the papers. A behaviour correction goes into its rule, never here. - APPEND_SYSTEM.md is deleted. UnitInstructions renders AGENTS.md as the owner section instead (native_package.OWNER_INSTRUCTIONS; wheel force-include and sdist list updated; stack/AGENTS.md symlink). - Behaviour no rule stated moved into its owner: preservation needs a live reader (storage-and-cleanup), own it through delivery with no hierarchy (no-blocking), answer in a channel what you own (plain-reporting), a correction lands in its rule (owner-authority). - fork-orders, per Tristan 2026-11-01: rebase your own branch instead of merging main; open the PR at the first real commit and mark it ready when the work is ready. - Rule examples (FieldCodec's one owner), project goals (Toad scroll, OpenHCS blind-analysis, P269) and the defunct Codex-cleanup line are dropped. OPENHCS-HISTORY.md keeps only its PR history; nothing points at it. Checked: UnitInstructions.render() reads stack/AGENTS.md and contains the new rule text (22 rule files parse); hatchling wheel ships agent_comms/_native/AGENTS.md and the sdist ships AGENTS.md and stack/AGENTS.md. No pytest run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016gZLdttfQjtizEYZGek9Gh
…open in named batches of 5 The Pi deal was mute: PiRuleGate inherited RuleDeal.voice() -> Mute(), and no Pi tool ever called audit_written, so no Pi thread was ever asked. Now: - PiThreadGate (the gate PiRuleGate.of seats on the bus) speaks: its line is a MeantNotice to the thread, and its answer is heard in the thread's own session file. The transcript source decides whether a deal can ask, so a backend that cannot read back the session's words stays mute instead of locking it behind an unanswerable question. - Pi's write and edit tools call audit_written when they write the audit. - PiMessage owns said()/tally(), the same fold Claude records feed SessionReceipts. - A running turn reads the delivered message in the segment its task names: MeantNotice is a user follow-up, every other message the untrusted bus delivery it was. - Unengaged.batch is 5, declared once; every Unread refusal names the batch size and the batch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AwNvwu1MXjcvCLCcNXLmAc
trissim
force-pushed
the
pi-pr-salvage-pi-meant
branch
from
November 1, 2026 20:08
ed8e84a to
7acf1ed
Compare
trissim
added a commit
that referenced
this pull request
Nov 1, 2026
…owes the witness, not reads A native Pi unit carried every rule in its system prompt and was then dealt the same files again as tool reads after every start and compaction. Its runtime already owns its launch, so it now owns how the deal reaches the session: - rule_deal: DealDelivery is the family. The default delivers nothing (the session reads each file); SystemPromptDelivery seeds the read log at deal time from the prompt's manifest, one DealtRead per file at the exact digest the prompt carries. A file changed after preparation stops matching and is owed as an ordinary read. Unengaged, Unaudited and Unmeant are unchanged: the audit and "did you mean it?" still come before the first tool call. - deal_prompt.DealPrompt replaces unit_instructions: AGENTS.md, a short preamble, then DeckReader.sources() verbatim in deal order (papers first), with its manifest rendered from the same bytes. SYSTEM_PROMPT replaces UNIT_INSTRUCTIONS; RuleFile.render_packaged lost its last consumer. - RuntimeLocation.deal_delivery() defaults to reading; PiSessionFile returns the system prompt it always launches with. PiThreadGate asks its thread's runtime. - Claude Code: Core now owns its command line through claude-comms (cli_bridges/claude_launch), which execs the real claude, never itself, with --append-system-prompt-file (system role, after Claude Code's own prompt) and names the prompt in AGENT_COMMS_SYSTEM_PROMPT. Every session hook record carries it (LaunchedPrompt), so DeckStart deals a launched session by system prompt and tells it to answer, not read. A plain `claude` still reads. Checked here: every changed module imports in a fresh interpreter; the prompt renders all 36 dealt files verbatim in deal order (~114k tokens) and its manifest round-trips current; a prompted deal opens on Unengaged with all 36 reads counted, a plain one on Unread; a manifest digest that no longer matches leaves exactly that file owed as a read; claude-comms skips a `claude` on PATH that resolves to itself and execs the real one with the flag; Claude Code 2.1.316 accepts --append-system-prompt-file and reads it eagerly. No pytest run: tests/test_deal_prompt.py and the touched conftest/test_native_package lines are compiled, not executed. Built on #3820 (7c3437e), which reshapes the same gate files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016gZLdttfQjtizEYZGek9Gh
This was referenced Nov 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit-owned answers — merged; running-turn and idle/new-wake accepted; installation open
Merged as
71773f612c671dc0f8e5e311b1cd73d727129048on2026-11-01, exact head7c343 verified through the forge and Git ancestry. Commander independently accepted the running-turn scope in53555 after reading the original SDK/audit/input artifacts. Fresh prepared-main05 demonstrates pending-question recovery across actual Core idle and one distinct new full wake; commander independently accepted this exact scope in53661 after reading the original sources/journal/state and checking the audit digest. Neither result establishes production installation.Current checkpoint: 14 commits, 65 files, +805/-636 against main38ecc; pushed head 7c3437e. The audit-owner correction itself removed 279 net lines (16 files, +166/-445). This stays on the original #3820, retaining the original claude-ai work, salvage commits and published preservation tags. Rebases preserved all code patches and dropped only the obsolete Toad-lock refresh already superseded by main. The final follow-through updates tracked-main resolution and deletes obsolete tuple/transcript-answer assertions; no old API was restored.
One answer owner instead of transcript proof
Before:
PiRoundGaterecovered assistant text from the current native request, required the matching arrival/committed context and settledMeantRecordfrom transcript lines. Claude also scanned transcript text for settlement. The explanatory answer therefore depended on a second channel and request-identity plumbing.After:
PiThreadGate(Speaking)still publishes a real typedMeantNotice. AMeantAnswercarries its exactMessageIdand written explanation in SessionAudit.RuleDeal.audit_writtenhandles successful decoded audit completion; MeantRecord keeps the original yes/no + 12-word policy. There is no sincerity classifier, transcript settlement or second retained answer list.The refusal shows the current exact question ID, audit path and declaration-derived answer schema. Short written answers escalate on successful audit completion; repeating an unrelated refused tool does not manufacture another dodge. Later escalation quotes the audit's statement, not recovered assistant text. Malformed/foreign-ID/failed-write cases cannot manufacture settlement.
Deleted request/transcript machinery
PiRoundGateand its producer/arrival checks, Claudewords_end/said_afterscans,require_current_request, andmodel_contexts_forhelpers.agentCommsRequestIdfield. Native request observation still owns real progress, original context and callback timing; emitted SDK events are no longer cloned to brand assistant answers.comms_sendcommunication exemption. The configured native exemption is demonstrated below by the original SDK call/result; a Bash spelling is not that proof.Retired questions — no migration layer
Owner decisions 53298/53299, confirmed by the commander in 53307, explicitly retire exactly six inactive Claude question records. Those six
.meantfiles were validated with the existing decoder and deleted; corresponding transcript metadata remained unchanged. Transcripts, audits, other sessions and UNKNOWN-input evidence were not deleted or replayed.The proposed question carry, external-resource inventory, new shared-lock capabilities and Claude-path helper are deleted/reverted, not shipped. Existing SQL, LockedFile and installer code is unchanged by this correction. No question carry, backup or private-copy rehearsal ever ran. File existence had been mistaken for a live-reader requirement; that was a scoping error, not a reason to retain compatibility machinery.
Evidence and limits
CHECKPOINT_SOURCE_COMPILE_IMPORT_OK). No replacement pytest has run.stack/native/prepare-pi-native --update-pinscompleted rc0, under the existing host TestLease, against the actual native sources. The checked-in native pin came from that build. A second supported build after main38ecc also passed; its regenerated pin stayed byte-identical, so no pin change is falsely attributed to the final commit.RuntimeStack.buildresolved current tracked mains and synced noneditable packages; its own installed native/package/import completion passed, followed by an isolated interpreter query provingrule_dealis inside that prefix,MeantAnswerhas the declared schema andPiRoundGateis absent. Prefix:core-7c3437e1d-lock-a8da49b317793777. This is preparation, not a provider journey or production install.pi-commander/service-main-correction-01/pytest.log/pytest.rc). That proof predates P859's declaration moves and is not a post-P859 pass. The other three native-package fixture corrections belong to claude-ai and remain unqualified; this selection did not silently include or waive them.Configured running-turn application result
Demonstrated on exact7c343: original saved SDK metadata records
openai-codex-responses/openai-codex/gpt-6.1-sol, using preserved real native discovery, not ControlledProvider. The model's actual nativecomms_sendreturnedf8c61a0d2c5d. After actual paper/spine reads and a model-authored partial audit, Core published typed privateMeantNoticequestionf59910609e12.InputDispositionsrecords it asContextConsumedInput; its actual SDK user entry174 is before the model's explanatory audit edit177 and fresh final179. The exact-ID answer is107 words, passes the existing MeantRecord policy, and leavesasked=[spine], open=[]. Other rule answers remain visibly unfinished. Evidence:running-turn-result.md, original03 native session, typed bus/input rows andnative03-readonly.log(rc0), under the named persistent evidence directory.The observer03 program itself timed out, rc1: it used
PiRedeal.typed_by, which intentionally excludes Core notices because it owns human words. That failed controller result is retained, not relabelled green. The independent original SDK/bus/audit artifacts establish the narrower working application path. Private owner and host were retired; no failed input/root was reused. The distinct idle-wake path is not established by this result.Prepared-main idle/new-wake result
On commander's genuinely prepared
core-fd0386c55-lock-b9821a662b3d916e, fresh05 returnedrc0 and its final owner-correct read-only extraction returnedrc0. Actual configured SDK209 carries initial input53609; model write210/result211 publishes typed question79314a8b047f, following user213. Readiness finals212/214 leave it open. The observer reads actual Core idle/generation1 with that unchanged open question, THEN sends one unique NEW FullWake53614 /0f9fcb223e5b. SDK215 and its committed NativeRuntimeInput record prove stage=full, a distinct execution, requestGeneration4. Model edit218/result219 writes its own126-word exact-ID explanation; final220 precedes Core idle/generation2 with open=[]. Original assistant metadata names openai-codex-responses/openai-codex/gpt-6.1-sol. Twenty-two other audits remain visibly unanswered. There are zero redundant rule-file reads; the only read is a refused question-store read. This was startup and idle recovery, not actual compaction or production installation.The question FIRST arrived during turn1; the new case proves recovery of that still-open question after genuine idle, not first delivery of the question while idle. Source/chronology/exact IDs are in
idle-wake-main-result.md,native-idle-main-05.logandnative05-readonly-native-owner.logunder the same evidence directory. Earlier extraction01 queried the wrong BUS keys for full selected inputs and included copied historical user-shaped records;02rc1 kept that wrong owner assertion. They are superseded read-only inspections, not new model attempts. Full selected evidence belongs to NativeRuntimeInput; InputDispositions still owns the genuine following-question row. StoredTurnRecord.read follows the registry current reference, so no historical generation is reconstructed from it. Private owner16292 and host retired, lease released to UI; original input/session evidence remains frozen. Commander independently accepted this scope in53661; its actual source receiptpi-commander/heartbeat-publication/native-3820-idle05-review.mdhas now been read. It confirms the successful audit result was3488bytes and its retained SHA256db33ee0e2de0dea5ed436f6e658e753cb7ac3fd9556688423c59d5cf3a3bdaec matches.Remaining follow-through
The one corrected3845 case has passed and05's independent review is accepted at its stated pre-P859 epochs. The separate native-package fixture correction still belongs to claude-ai. Exercise installed start/actual compaction/audit/no-redundant-rule-read behavior once commander's rebased3833 recovery and combined installation succeed. Supported install9f947 failed before activation; production remains ceeed. No second stack, fabricated audit/native record, ACK or replay counts.
ContextManifest.for_requestremains becauseruntime_requests.py:420genuinely consumes it outside question settlement.The first native controller stopped before root creation/send/model on the correct foreign-runtime refusal: a7c343 caller cannot attach to the ceeed-owned production root.02 used the existing source-owned fresh
CheckRoot.create→ publicRootRuntime.publishNEW stopped same-schema-copy boundary → target-owned interpreter, then failed on my wrong observer owner; its retained diagnostic also rejected an inherited old-runtime launcher.03 validated the actual store and declared target launcher before fresh input and produced the running-turn result above. No production root is retagged, no carry/backup is added, and the live source reader closes before model work. Fresh04 returned rc0 and retired its owner/host: original SDK final203 (READY_FOR_IDLE_04) precedes actual question user entry204 and model answer edit207. Core remained busy and the question used the same TrackedTurn following-input path. It is supplemental successful settlement evidence, NOT idle-wake acceptance. Source distinction:OwnerFollowingInputs.openandFollowingPromptretain the active turn even across this SDK final. No controller wake input was sent. That missing case is now demonstrated by fresh05 above; independent review is accepted and installed qualification remains owned here.Assumed: the explicit six-question retirement is the current required domain; unrelated retained session/input state is not disposable. No whole #3824/#3825/retention/board prerequisite is imposed.