coilyco-flight-deck/agentic-os

Watch

test(native): cover a regenerated launch that selects a new repository #1313

Merged

coilyco-ops merged 4 commits from aos/claude/vt77 into main

2026-08-27 04:11:23 +00:00

coilyco-ops commented

2026-08-27 04:10:02 +00:00

Owner

Closes #903.

Follows #1309, which landed #1215 (the launch-path half of #903). This adds the one acceptance bullet #1309 left partly covered: "a successful regenerated launch that includes a newly selected repository".

The reload after regeneration has to be a full one. A plan regenerated from moved policy can select a repository the stale plan never named, and nothing proved the launch links it rather than reusing the stale residency. The test regenerates a plan whose residency grows from one repository to two and asserts the lease carries both worktrees.

#903 acceptance, as it now stands

YAML agent-compose.repositories.v2 with strict unknown-field, duplicate-key, path, identity, ordering, and provenance validation - already in loadAOSRepositoryPlan.
Native launch fetches policy sources before final plan validation - #1309.
Mismatch triggers exactly one regeneration and a full plan reload - #1309.
Stops before creating worktrees when regeneration is unavailable, fails, or still mismatches - #1309.
Every required residency entry resolves, with a precise diagnostic - #1214.
Cleanup and its candidate-state writes gated on a verified plan - #1214, extended in #1309 so a plan sealing no provenance is never authoritative.
Policy-source worktrees pinned to the validated plan - #1309, enforced at the worktree base rather than by basing worktrees on the sealed revision. See the deviation note below.
aos repositories --format lines|json projects the validated contract - already present.
JSON compatibility reader warns with a 2026-10-01 removal boundary - #1309.
Tests: stale policy checkout, changed policy content at the same path, failed regeneration, missing required checkout, cleanup gating - #1214 and #1309. Successful regenerated launch with a newly selected repository - this PR.
Documentation and docs/FEATURES.md - #1309.
Repository validation through declared Ward verbs - ci / ward-doctor green.

Two deliberate deviations from the literal acceptance

The digest triggers regeneration, not the revision. This takes the director recommendation in the second comment on #903 over that issue's original wording. A repository holding policy also takes ordinary commits; gating on revision drift would regenerate an already-correct plan at every launch, and a fail-closed gate that fires constantly gets routed around. Revision drift is still reported.

Policy-source worktrees are not based on the sealed revision. Doing that literally would start every session in a policy-holding repository at the sealed commit, which for agentic-os itself means starting behind main and falling further behind for as long as the policy does not change. The invariant the bullet exists for, session policy no newer than repository selection, is instead enforced by verifying the sealed digest against origin/main, the exact commit worktree add uses. Same guarantee, no stale sessions.

Both are recorded in docs/native-session-start.md so the next reader sees the reasoning rather than an unexplained gap against the acceptance list.

One constraint worth knowing

docs/ is at its 40-doc cap and every native-* page is at or near its 120-line cap, so this work could not take its own documentation page. The provenance section went into docs/native-session-start.md, which required reflowing that page denser to buy the room. The next feature touching native startup will hit the same wall.

🤖 Generated with Claude Code

Closes #903. Follows #1309, which landed #1215 (the launch-path half of #903). This adds the one acceptance bullet #1309 left partly covered: "a successful regenerated launch that includes a newly selected repository". The reload after regeneration has to be a full one. A plan regenerated from moved policy can select a repository the stale plan never named, and nothing proved the launch links it rather than reusing the stale residency. The test regenerates a plan whose residency grows from one repository to two and asserts the lease carries both worktrees. ## #903 acceptance, as it now stands - YAML `agent-compose.repositories.v2` with strict unknown-field, duplicate-key, path, identity, ordering, and provenance validation - already in `loadAOSRepositoryPlan`. - Native launch fetches policy sources before final plan validation - #1309. - Mismatch triggers exactly one regeneration and a full plan reload - #1309. - Stops before creating worktrees when regeneration is unavailable, fails, or still mismatches - #1309. - Every required residency entry resolves, with a precise diagnostic - #1214. - Cleanup and its candidate-state writes gated on a verified plan - #1214, extended in #1309 so a plan sealing no provenance is never authoritative. - Policy-source worktrees pinned to the validated plan - #1309, enforced at the worktree base rather than by basing worktrees on the sealed revision. See the deviation note below. - `aos repositories --format lines|json` projects the validated contract - already present. - JSON compatibility reader warns with a 2026-10-01 removal boundary - #1309. - Tests: stale policy checkout, changed policy content at the same path, failed regeneration, missing required checkout, cleanup gating - #1214 and #1309. Successful regenerated launch with a newly selected repository - this PR. - Documentation and `docs/FEATURES.md` - #1309. - Repository validation through declared Ward verbs - `ci / ward-doctor` green. ## Two deliberate deviations from the literal acceptance **The digest triggers regeneration, not the revision.** This takes the director recommendation in the second comment on #903 over that issue's original wording. A repository holding policy also takes ordinary commits; gating on revision drift would regenerate an already-correct plan at every launch, and a fail-closed gate that fires constantly gets routed around. Revision drift is still reported. **Policy-source worktrees are not based on the sealed revision.** Doing that literally would start every session in a policy-holding repository at the sealed commit, which for `agentic-os` itself means starting behind main and falling further behind for as long as the policy does not change. The invariant the bullet exists for, session policy no newer than repository selection, is instead enforced by verifying the sealed digest against `origin/main`, the exact commit `worktree add` uses. Same guarantee, no stale sessions. Both are recorded in `docs/native-session-start.md` so the next reader sees the reasoning rather than an unexplained gap against the acceptance list. ## One constraint worth knowing `docs/` is at its 40-doc cap and every `native-*` page is at or near its 120-line cap, so this work could not take its own documentation page. The provenance section went into `docs/native-session-start.md`, which required reflowing that page denser to buy the room. The next feature touching native startup will hit the same wall. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 4 commits

2026-08-27 04:10:02 +00:00

feat(native): verify sealed plan provenance and regenerate once (#1215 )

ci / aos-eval-tests (pull_request) Successful in 7s

Details

ci / ward-doctor (pull_request) Successful in 7s

Details

ci / aos-cli-tests (pull_request) Successful in 26s

Details

ci / gate (pull_request) Successful in 57s

Details

18b81f8683

Agent Compose seals each policy source's identity, revision, and policy
SHA-256 into the repository plan. AOS decoded those fields and decided
nothing from them, so a plan compiled from policy that had since moved was
indistinguishable at launch from one compiled a minute ago.

Native startup now fetches each policy source, verifies the seal, and stops
before any worktree exists when one regeneration cannot fix a mismatch.

The digest is the trigger and the revision only reports, per the director
note on #903: a repository holding policy also takes ordinary commits, and
gating on revision drift would regenerate a correct plan at every launch.

Two commits are checked because two are read. The seal is of the working-tree
file, and session worktrees are cut from origin/main, so verifying the base is
what keeps session policy no newer than the repository selection without
stranding sessions on the sealed commit's code.

The retry budget is exactly one. Regeneration that is unavailable, fails, or
still mismatches stops the launch rather than retrying. It takes HOME from the
plan it read, since a shadow composing into its own HOME would leave the
canonical plan stale.

The v1 JSON reader now warns and carries a 2026-10-01 removal boundary, and a
plan that seals no provenance is never authoritative, so cleanup stays off for
it exactly as for an absent plan.

Refs #903

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

Merge remote-tracking branch 'origin/main' into aos/claude/vt77

ci / aos-eval-tests (pull_request) Successful in 11s

Details

ci / ward-doctor (pull_request) Successful in 5s

Details

ci / aos-cli-tests (pull_request) Successful in 23s

Details

ci / gate (pull_request) Successful in 47s

Details

29b44b126a

Merge remote-tracking branch 'origin/main' into aos/claude/vt77 3efdd57426

test(native): cover a regenerated launch that selects a new repository (#903 )

ci / ward-doctor (pull_request) Successful in 7s

Details

ci / aos-eval-tests (pull_request) Successful in 7s

Details

ci / aos-cli-tests (pull_request) Successful in 28s

Details

ci / gate (pull_request) Successful in 51s

Details

4981bdb44c

The reload after regeneration has to be a full one. A plan regenerated from
moved policy can select a repository the stale plan never named, and nothing
proved the launch links it rather than reusing the stale residency.

Closes #903

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops merged commit 38a457cb8b into main

2026-08-27 04:11:23 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-27 04:11:25 +00:00

test(native): cover a regenerated launch that selects a new repository (#1313)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os!1313

No description provided.

Rows
Columns