Codex/verified residual intelligence foundry v1 - #200
Merged
endomorphosis merged 68 commits intoAug 26, 2026
Conversation
…oups for family, repository, language, framework, risk, model, quantization, hardware, and context tier and six closed dispositions. Attempt: 1
…rified-residual-intelligence-foundry-v1
…rated-protected-board]
…sor:generated-protected-board]" This reverts commit 2f535b4.
…oups for family, repository, language, framework, risk, model, quantization, hardware, and context tier and six closed dispositions. Attempt: 1
…rified-residual-intelligence-foundry-v1
…ervative family, schema, effect, authority, repository, calibration, capability, and context boundary checks. Attempt: 1
…rified-residual-intelligence-foundry-v1
…nkings, and bounded linear/logistic baseline contracts before any learned or remote route, with complete abstention and cost receipts. Attempt: 1
…rified-residual-intelligence-foundry-v1
…, input/output schemas, grammar, token/output limits, risk ceiling, privacy, capabilities, validation, errors, and abstention behavior. Attempt: 1
…rified-residual-intelligence-foundry-v1 # Conflicts:
Managed daemon child env only carried non-secret program bindings, so Quack attach depended on ambient inheritance. Forward the already-admitted env:// credential into trusted daemon env, resolve the same handle at ATTACH, fingerprint auth failures, and probe vault attach before launch.
…ilures Crash-looping attaches can leave the live owner rejecting even the admitted token. Retry a bounded number of ATTACH attempts before fail-closed.
Portal attempt projections queued onto the shared markdown merge consumer were rejected as foreign boards, leaving VRIF-010 blocked and the remaining tasks with no_ready_tasks. Recognize the same DuckDB task across a sealed projection and the canonical board, revive leftover cross_board quarantines when declared outputs are already on the target, skip merging stale side-branch commits, and rearm blocked database tasks when the latest terminal is only a merge-completion authority failure. Tampered attempt projections still fail closed.
Database-portal merge candidates carry empty cross-board completion authority fields, so the shared-board consumer quarantines them as metadata invalid even after the declared outputs are already on the target. Revive those rows and complete them as already merged without merging the stale candidate or re-entering the foreign-board rejection. Tampered attempt projections still fail closed.
…ticks DuckDB lanes never consumed the merge train, so portal projections quarantined for empty cross-board authority metadata sat forever. Those lanes also died on Quack attach before later recovery ran. Settle invalid-metadata portal quarantines whose declared outputs are already on the target at the start of each database run_once, before DuckDB reconciliation. If attach then fails, keep the settlement and idle instead of crashing the pass. Tampered attempt projections still fail closed.
Quack reports Authentication failed when its listen backlog is overrun. Each DuckDB query opened a new ATTACH, and a failed pass crashed the daemon so the supervisor immediately relaunched four more attaches. Serialize ATTACH behind a process-shared lock, retry transient auth and connect failures with jitter, reuse one Quack read connection per IntentRepository, and idle a database run_once on attach failure instead of exiting nonzero.
ATTACH serialization held attach.lock across retry sleeps, so sibling lanes timed out and crashed instead of idling. TimeoutError was not mapped as quack_attach_failed. Hold the lock only around the ATTACH syscall, wrap lock timeouts as DuckDBConnectionPolicyError, and idle run_once on those timeouts. Native Quack listen backlog does not need to be widened once ATTACH syscalls are sequential.
Idle daemon passes compact away the attach failure detail, so four live lanes could sit on quack_attach_failed with no token or exception class in the operator log. Keep control_plane_error in the bounded heartbeat.
… catalog SQL ATTACH with a matching token succeeds, then unqualified FROM tasks is rejected as Authorization failed. That traceback killed the daemon, and the restart storm wedged the owner so the next wave could not attach. Qualify FROM/JOIN tables with the attached catalog, and idle run_once on Authorization failed so lanes stay up instead of crashing.
A live ATTACH was closed on every SQL exception, so the next tick opened a new ATTACH. That reconnect storm failed authentication even with a valid token and starved post-merge recovery, so blocked tasks never rearmed and dependents stayed unready. Keep the attached session unless a keepalive probe fails or the error is session death (authentication / connection reset). Query-level Authorization failed no longer forces a new ATTACH.
Task-status lookup swallowed every exception as \"not this lane's row\", so attach failures advanced the recovery cursor past blocked tasks and the DuckDB frontier never rearmed. Reraise attach and authorization errors so recovery retries the same completed repair row once the control-plane session is live again.
…n HEAD VRIF-010 stayed blocked after its declared outputs were restored, so 013+ never became ready. Post-merge recovery sent a large typed owner command that the Quack owner rejected, then attach died and the frontier stayed empty. Compact the recovery CAS receipt and, when claim_next is idle, rearm blocked tasks whose declared files already exist on HEAD. Any database lane can apply that compact CAS so supervisors keep coordinating through DuckDB instead of stalling the board.
Blocked tasks may not carry predicted-file metadata in DuckDB. Use completed post_merge_declared_outputs_repaired merge rows, prove those blobs on HEAD, and apply the same compact retrying CAS so a restored task can be claimed through the shared control plane.
Attach storms left VRIF-010 blocked and claim_next idle because unstall listed blocked rows over Quack before it could CAS. Clients now submit a typed rearm_blocked_task owner command from merge-queue repair receipts, and the exclusive owner reads the current revision on its bound DuckDB connection. Run that unstall before attach-using reconcile so lanes keep coordinating through the DuckDB control plane until the board is finished.
Eight ATTACH retries after Authentication failed fill Quack's listen backlog and wedge the exclusive owner, so every lane idles even with a live token. Fail that error closed on the first attempt and keep retries for connect-time refusals while the owner is still binding its port.
Launch-time ATTACH shared Quack's listen backlog with the four lanes and left VRIF-010 blocked even though repair receipts were already on disk. Read those completed JSON files for the owner-command rearm, skip the launch probe, and cool down ATTACH after a failure so lanes keep coordinating through the DuckDB owner instead of wedging it.
A later completed merge row for the same VRIF-010 identity hid the post_merge_declared_outputs_repaired receipt, so owner-command rearm never ran and dependents stayed unselectable. Load every completed JSON receipt and let the repair-reason filter choose the unstall row.
Database wait_for_wake slept at most one second, so four lanes retried ATTACH continuously after the first authentication failure and wedged the exclusive owner. Sleep the configured interval and remaining attach cooldown instead, and keep declared-output rearm on the idle heartbeat.
VRIF-010 rearm was rejected as a generic owner_error, which hid the bound-connection failure and left the DuckDB frontier blocked. Include the exception type in the owner-command response and owner log so lanes can diagnose and retry the compact blocked-to-retrying CAS.
Updating VRIF-010 from blocked to retrying fatally failed inside the tasks_status_idx ART index and invalidated the exclusive control-plane connection. Drop those status indexes at owner start; a 33-row board does not need them for exact scans.
…, local specialists/general, remote standard/strong, and human using hard family/risk/capability/privacy/validation constraints plus budget and expected decision value. Attempt: 1
… for admitted low/medium-risk classification and ranking families with batching, abstention, OOD, calibration, and independent validation. Attempt: 1
…rified-residual-intelligence-foundry-v1
…undry-v1 VRIF-013 cascade router landed on a side branch while VRIF-014 merged first. Bring cascade.py, router.py, and test_router.py onto the execution branch.
Keep MAIN fail-closed supervisor policy (auto-clear, namespaced boards, Codex default, inflight wait, recovery-unavailable pin identity) and the process-shared Quack attach.lock landed on main.
The merge kept a dead shared-checkout auto-clear method and a mangled ATTACH import block. Restore process-shared attach.lock from main and delete the untyped-foreign-recovery terminal test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.