feat(automations): human oversight projection slice — daemon run-state projection with honest staleness semantics - #5230
Closed
CompleteDotTech wants to merge 31 commits into
Conversation
Re-verify every blocker of the Chat v1 Phase 2 gate (cave-8ywi2, #4839) on dated, read-only evidence gathered 2026-08-30 via gh api. Verdict: the gate cannot pass. Three of five blockers have closed since the gate issue was written (cave-mfcsz #4834, cave-g9d49 #4835, cave-3yax4 #4836); two remain open (cave-ff3j6 #4837, cave-hjy2f #4838). The failing criterion is 'all Phase 2 beads are closed'. Facts only, no invented progress. Refs #4839. Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
Read-only verification (2026-08-30) of Phase 1 bead state for issue #4818 (cave-fz01p): per-bead table with owner repos, verified main-branch state, evidence links and dates, remaining work, overall verdict against the acceptance criteria, and the critical path through cave-tsvfj (#4830), cave-p8qkk (#4780), and the Phase 1 gate cave-23nmv (#4833). No code or workflow changes. Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
Record Gate C0 (bead cave-6sles.13) as a PROPOSED decision record covering hosted repository/account ownership, Cloudflare environments and bindings, auth/tenant authority, budgets, retention, alerts, operators, staging tenants, and deletion-test tenants. Every proposal is grounded in the umbrella program and approved design; unresolved operational choices are recorded as open questions. The hard gate stands: no cloud resource or hosted endpoint before this decision is ratified. Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
…e scope Verified 2026-08-30 working record for cave-tsvfj / issue #4830: the recorded blocker cave-9pifu closed 2026-08-22 (PRs #4840, #4875), and OpenCoven/chat merged the Phase 1c native connection implementation plus the Phase 1d real-authority conformance gate on 2026-08-28/29 (chat#31, #34, #36, #38, #39, #30). Code search can no longer serve as evidence for that repo (stale index). Remaining claimable work is evidence closure: land open chat#41, produce the secret-scanned phase1-conformance report at the locked revisions, and refresh the stale issue/bead records. Refs #4830 Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
Issue #4781 (cave-udcn7) asks for the three-OS acceptance journey, staged rollout, and rollback drill. The journey is manual by design — no-source-checkout installs on real machines — and this environment is a Linux host without a desktop session, so what can be delivered now is the verified status record and the evidence runbook that makes the human execution checkable. Verified read-only, 2026-08-30: - cave-j65ie: tracker #4820 open (its predecessor #4778 was closed the same day as an accidental repository-issue conversion); the Chat v1 signed installers and published @opencoven/* packages its criteria require do not exist yet (chat has no releases/tags; npm returns 404 for all five packages). - cave-as76u: no mirror card in any visible surface; identified by dependency position with the plan's Cave-side compatibility row and marked derived. - Cave-side rollback machinery verified live: release-rollback-readiness reports ready=true for baseline v0.3.11 with 4/4 updater platforms, and verify-release-updater passes end-to-end against the v0.3.12 release. The runbook adds what the existing docs leave implicit: the per-step evidence artifact for every journey step and every global CLI command, the regression conditions that stop rollout, and the rollback-drill evidence checklist. Anything not stated in the plan of record or the landed workflow docs is marked derived. Refs #4781 Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
Runs 30158074443, 30158074458, 30158095776 and 30158095786 have been queued since 2026-07-25; both cancellation endpoints returned HTTP 500 through 2026-08-10. On 2026-08-30 they return HTTP 403 to a PAT without actions:write, so the backend error has changed and the next retry should run under a token that holds it. - scripts/cancel-stuck-action-runs.mjs: manual retry tooling (not wired into CI). Tries /cancel then /force-cancel per run with retries and a doubling backoff on transient failures, polls the resulting status, prints a per-attempt and final status table, and exits non-zero while any run remains queued. Defaults to the four run IDs; never deletes workflow history. - docs/stuck-action-runs.md: the run list, the HTTP-500 history, the 2026-08-30 HTTP-403 retry record verbatim, the instruction not to delete workflow history, and the close condition. - docs/README.md: index the new document (Living / Integrity and integrations). Refs #4905 Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
Re-verify the Phase 1 discovery-and-pairing gate working record (cave-23nmv, #4833) read-only as of 2026-08-30, superseding the 2026-08-22 recorded state. The 2026-08-22 basis ("no Phase 1 implementation exists on main") is stale: all five blocking beads now have implementations merged on their owner repositories' main branches (cave-9pifu via #4840/#4875, cave-lf7bu via sdk#54, cave-p8qkk deliverables via sdk#30/#54, cave-tsvfj via chat#31/#36/#38/#39, cave-0prpu harness via chat#30). The gate verdict remains cannot pass: trackers #4830 and #4780 are still open with no owner-recorded closure, the register-defined phase1-conformance report is not a durable verifiable artifact, and gate closure is a Beads-database state this docs-only record cannot perform. The record states exactly what evidence closes the gate. Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
Verified 2026-08-30 read-only against the Phase 7 plan of record and program register in OpenCoven/chat, the tracker issues in OpenCoven/coven-cave, coven-cave origin/main (dacbe61), and default branches of OpenCoven/chat, OpenCoven/sdk, and OpenCoven/coven. Records the per-bead state of Phase 7 (cave-j65ie, cave-mbekl, cave-gcb0i, cave-563z7, cave-as76u, cave-udcn7, gate cave-ilh1h, plus execution beads cave-0wg and cave-7yo), the landed Cave-side artifacts (PRs #4785/#4782/#4789), owner-repo artifact probes, and a verdict against issue #4820's acceptance criteria: beads not all closed (two mirrors open, three beads without tracker issues, closures to date accidental) and no gate record of passing commands and artifacts. Documents the earlier-phase dependency chain that gates Phase 7. Refs #4820 Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
…cope Verify (2026-08-30) the Phase 2 shell blockers and the actual implementation state in OpenCoven/chat, then decompose the remaining work into claimable, testable items for the implementing repo. - cave-mfcsz (#4834) and cave-3yax4 (#4836) verified closed with delivery evidence, plus gate context (#4839/#4838 residuals) - shell state corrected from "not started": a first canonical shell landed 2026-08-28 (chat#31) and was repaired 2026-08-30 (chat#40); search verified absent across the whole stack - claimable scope for conversation list, filters, search, canonical transcript, and conformance, ordered fixture-first Refs #4837 Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
Verified 2026-08-30 read-only status for issue #4780 (bead cave-p8qkk): - OpenCoven/sdk already ships the coven.daemon.v1 IPC lane on main (Wave 1 #30, 2026-08-22; hardened through #54/#64/#73) — code search reports 0 hits due to a stale index; Contents API is authoritative. - Dependency beads cave-p8qkk.1 / cave-bt9wx / cave-fz01p mapped to tracker issues 4780/4818/4833; cave-bt9wx has no tracker record. - coven-cave daemon-side contract verified at dacbe61 (startup contract gate, socket discovery, fail-closed validation). - Implementation contract handoff + sdk PR checklist marked derived; no push access to OpenCoven/sdk from this token (push:false). Refs #4780 Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
The Status section still opened with "awaiting maintainer review and does not authorize implementation" while the body of the same document — and main — tell a different story: the cave-8i8q5 MVP shipped, and the cave-uajyn reconciliation (2026-08-24) already rewrote the sections the code departs from. A document that both "does not authorize implementation" and documents exactly what implementing it shipped is contradicting itself in its first paragraph; this replaces that paragraph with the state the rest of the document already records, and names what still actually gates a release — the native-room pass and the live X smoke evidence the Acceptance audit section lists. Refs #4816 (bead cave-8i8q5). Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
…nce checklist Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
Issue #4689 item 1. The podcast drafter collapsed every section's bullets into one run-on narration unit (`details.map(speakable).join(" ")`) and only split it mechanically at 1,000 characters, so a whole section was read as a single continuous narration unit — the flat, declination-prone delivery the issue describes. Details now keep their source shape: adjacent bullets pack into spoken turns of at most one breath unit (400 characters, the published show's median spoken turn), a single detail over the 1,000-character conditional trigger splits at clause boundaries the source already contains (sentence, then `;`/`:`/dashes, then comma, then word), and a well-formed detail under the trigger is never force-split — the issue measured that splitting a 115-word well-written turn caused the very pitch decline the cap exists to prevent. Nothing is reworded: turns are the source's own sentences re-joined with single spaces. The conditional trigger is the design the issue review asked for before item 1 could land; a blanket word cap was measured to degrade well-written prose. All shaping sits before the TTS seam and is provider-agnostic — local Piper/Kokoro renders receive the same bounded segments. Items 2-4 (voice_settings, podcast model decoupling, cross-segment context) already landed in #4706/#4765/#4926; item 5 (rewrite stage) remains follow-up. Refs #4689 Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
…tool events Extend the bridge contract in src/lib/openclaw-bridge.ts with versioned gateway/bridge event negotiation (issue #4892, first slice: gateway/runtime version and schema hash discovery). streaming/toolEvents become negotiated per-conversation outcomes instead of static implementation flags: - negotiateOpenClawBridgeSession validates a discovery record (version, wire protocol, catalogs, discovered AgentEventSchema hash) against validated compatibility profiles and returns either structured capabilities (supported version -> validated schema + profile) or a degraded plain-chat outcome with a granular, value-free diagnostic (unsupported gateway version, unsupported wire protocol, schema hash not declared by any validated profile, tool-event contract not offered, discovery unavailable). - validateOpenClawBridgeSchemaHash is the schema-hash validation hook: a discovered hash may only back new event shapes when a validated profile declares exactly it, so concurrent schema versions (built-in plus a verified registry refresh) can be negotiated side by side. - OpenClawBridgeNegotiationLedger provides rollback protection: only validated outcomes are recorded per conversation, degraded turns never adopt an unvalidated schema, and a later valid discovery restores structured mode. - createOpenClawBridgeToolProjector projects validated tool events onto bridge events with stable ids and bounded inputs/outputs; the first unknown event settles open calls, emits one visible value-free diagnostic (shape fingerprint only, never payloads), and pauses projection fail-closed. - RuntimeBridge gains an optional negotiateSession member. Fixture-based conformance tests cover the supported-version happy path (running/completed/error with stable ids and inputs/outputs), unsupported- version fallback (authentic beta4 plus a fixture future gateway), unknown- event fallback, schema-hash mismatch rollback, and concurrent schema versions. No live OpenClaw calls, no stdout parsing, no new dependencies. Refs #4892 Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
…tatus docs(program): re-verify Chat v1 Phase 2 gate working record
…ance-runbook docs(program): Chat v1 Phase 7 acceptance status and evidence runbook
…-cancel chore(ci): retry tooling for the four stuck July Actions runs
…andoff docs(program): Coven IPC SDK status and implementation contract handoff
…m-status docs(program): Chat v1 Phase 1 discovery/pairing verified status record
…t-status docs(program): Chat v1 Phase 7 rollout verified status record
…ery-status docs(program): Chat v1 P1 native discovery working record and claimable scope
…tatus docs(program): re-verify Chat v1 Phase 1 gate working record
…earch docs(research): record the X API spec as shipped in its status header
…-status docs(program): Chat v1 P2 chat shell working record and claimable scope
…rmance-status docs(program): Chat v1 P2 canonical-read conformance record and evidence checklist
…nership-record docs(program): propose Research Cloud ownership decision record
…tts-delivery feat(podcast): directed, cadence-safe ElevenLabs renders
…-negotiation feat(bridge): versioned OpenClaw gateway negotiation and fail-closed tool events
…d/offline semantics Slice 1 of the Coven Automations human-oversight contract (coven-cave#5217): a pure, fixture-tested client projection of the Coven daemon's authoritative automations state, plus the run-state mapping fixes that make today's projection honest. - daemon-projection.ts: a bounded reducer over authoritative contacts (snapshots, run histories, changefeed events, unavailable spans). Deduplicates canonical event ids (bounded FIFO window), refuses impossible sequence regressions, and fails closed on unreadable payloads — an accepted envelope advances only the cursor, never state. automationProjectionFreshness derives live/degraded/stale/offline from recency and the last failed contact; isStaleRunObservation flags in-flight runs that may no longer be live without ever inventing a terminal outcome. The state is derived data only — Cave projects, it never authors run state. - The daemon's RoutineRun vocabulary carries , and the runs route passes it through: teach the compatibility type, the shared status color/icon maps, and the run-now card that. A cancelled run previously rendered as an unknown-status dot and kept the live-run card in "Running…" forever; it now settles with a prohibit mark. - research-missions: ResearchAutomationLink.lastRunStatus shares the same vocabulary, and its parser accepts what it now stores. Upstream PR #5219 owns the Automations v1 roadmap documents; this lands the first code slice beneath it. Signed-off-by: Timothy Wayne Gregg <5861166+CompleteDotTech@users.noreply.github.com>
9 tasks
Contributor
Author
|
Migrated to the upstream-head PR #5239, which carries the exact same commit on an OpenCoven-owned branch. Closing this fork-backed CI vehicle as a duplicate. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Slice 1 of the Coven Automations human-oversight contract (recommended candidate (a)): a pure, fixture-tested client projection of the Coven daemon's authoritative automations state, with honest stale/degraded/offline semantics — plus the run-state mapping fixes that make the projection Cave already renders truthful today.
What lands
src/lib/automations/daemon-projection.ts(new) — a bounded reducer over authoritative contacts:unavailablespans;MAX_SEEN_EVENT_IDS = 1024), refuses impossible sequence regressions, and fails closed on unreadable payloads — an accepted envelope advances only the cursor, never state;automationProjectionFreshnessderiveslive | degraded | stale | offlinefrom observation recency and the last failed contact (degraded = daemon just went unreachable within the threshold; stale = nothing authoritative inside the threshold; offline = no projection ever built);isStaleRunObservationflags in-flight runs whose start time has aged past a caller-supplied threshold — Cave never infers that a stalerunningobservation is live, and never invents a terminal outcome.cancelledis a real terminal outcome. The daemon'sRoutineRunvocabulary carries it and the runs route passes it through, but the UI vocabulary, status color/icon maps, and run-now card all fell back to "unknown": a cancelled run rendered as a plain dot and kept the run-now card in "Running…" forever. Now it settles the card (Cancelled after Ns) with a distinctph:prohibitmark and a calm tint — deliberately not a failure color.ResearchAutomationLink.lastRunStatusshares the same vocabulary and its parser accepts what it now stores (a parser rejectingcancelledwould reject a real persisted state).Boundary compliance
~/.codexaccess anywhere in the slice; no runtime launching; no scheduler policy duplication. The only applied event payload shape is the run observation Cave already receives fromcoven.automations.runs— no wire format is invented ahead of the coven#855 protocol; unknown event types are counted (eventsUnhandled) and never applied.nowMs, and the staleness thresholds are caller decisions (staleAfterMsis required for run staleness — a defaulted guess would silently relabel long-but-legitimate runs).Relationship to upstream PR #5219
#5219 (docs) operationalizes the Coven Automations v1 roadmap and records the ownership boundary this slice implements — "Cave: human oversight, safe creation/proposal flows, approvals, diagnostics, and recovery controls" vs "must not own: scheduler policy, direct runtime launch, or a second run ledger". This PR is the first code slice beneath that roadmap; it touches no roadmap documents.
What remains of #5217 (slice 1 of N)
Issue
Refs #5217 (the issue is a full program; this PR satisfies only its first projection slice, so it does not close it).
Test plan
node --experimental-strip-types src/lib/automations/daemon-projection.test.ts— 25 tests: dedupe, regression refusal, fail-closed payloads, bounded dedupe window with seq-guard backstop, freshness matrix, stale-run guard, boundary proof (stale running stays "running, stale" — no invented outcome)node --experimental-strip-types src/lib/automations/run-status.test.ts/live-run.test.ts— cancelled tint/glyph and settled cancelled cardnode --experimental-strip-types src/lib/research-missions.test.ts— 59 tests pass with the widened link vocabularynode scripts/check-tests-wired.mjs— all test files wired exactly once (new test wired into theappsuite)pnpm typecheck(tsc --noEmit) — cleannpx eslinton every changed file — cleanpnpm codemod:design:check,pnpm check:tokens:defined,node scripts/check-test-clock-consistency.mjs— cleanpnpm test:appsuite — deferred to CI (targeted suites above ran locally)Upstream migration
Recreated from CompleteDotTech/coven-cave#17 at source head 06b384e. The source branch is retained for provenance.