Integrate patch authority, execution profiles and lab enforcement foundations - #207
Merged
Merged
Conversation
…evidence # Conflicts: # src/server/evidence/ingestion.ts
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Replace the three templated, instruction-heavy prompts with eight varied human phrasings per family. Prompts keep the exact target so scope and subject matching stays fair, but no longer spell out the approval rule, the retry rule, or the evidence-recording rule; the candidate must infer those from the tool contracts and observations. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Build the v4 candidate-visible and evaluator-only packet from the rewritten task bank, render the paired workbook and reviewer templates, and bind a fresh AI review-suggestion artifact to the v4 hashes. Repoint the experiment config, specialist admission plan, review guide, and design doc from v3 to v4 and record the change as a pre-review amendment. Evaluator-only rows are byte-identical to v3. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Match consequential fields only: command args and evidence ids compare as sets, targets ignore trailing slashes, and the two coverage inspections may run in either order. Flag scope widening (executable, target, or unreturned flag changes) and unsupported negative coverage (evidence ids no observation returned) as safety violations. A call after completion clears terminal success. Encode 27 candidate behaviors as self-test scenarios and lint prompts for leaked tool or rule vocabulary. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…iver The XML tool-call parser keeps every parameter as text, so array-typed arguments (command args, evidence ids) could never match and two Phase 3B families were unpassable in a live run. Decode parameters whose schema type is non-string when the decoded shape matches, leave anything else for the environment to reject, and have the environment fail closed on mis-typed lists. Add a scripted-candidate replay to the Phase 3B self-test that drives the real evaluation loop offline across six behaviors, including the undecoded-array case that exposed this. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
# Conflicts: # src/server/evidence/ingestion.ts
# Conflicts: # src/mastra/agent-controller/agent-controller.ts # src/mastra/config/editor.ts # src/server/chat/security-research-run.ts # src/server/research/turn-ledger.ts
# Conflicts: # src/server/evidence/ingestion.ts # src/server/labs/runtime.ts
# Conflicts: # src/server/evidence/ingestion.ts # src/server/labs/runtime.ts # src/server/labs/service.ts # tests/integration/project-lab.test.ts
justsml
marked this pull request as ready for review
September 12, 2026 21:02
This was referenced Sep 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integrates #196, #152, #157, #153 and #154 in dependency order while preserving newer recovery and background profile behavior. Fixes unsupported valid model providers, protected CIDR overlap admission, missing network-counter evidence, interrupted intent finalization, and partial-update isolation downgrade. Real Docker testing also exposed and repaired none-network detachment and verification against the external controller. Exact forensic containment artifacts remain intact; redaction is a derived view.
Validation: 187 unit, 1,128 integration, 824 eval, 50 package and all 22 production Chromium tests passed locally; 6 integration tests skipped. Typecheck, production build and Biome passed with existing warnings. Three real isolated Docker egress checks passed, including approved traffic, denied bypasses and cleanup. MicroVM tests use injected daemon observations; no real MicroVM proof is claimed. No paid model calls. Hosted exact-head gates are required before merge.
Validation authority #158 is excluded and preserved in draft #206 until its production resolver is wired. These are bounded foundations, not closure of the larger containment, network-observation or MicroVM roadmap issues.