From 3a550837aa6a02a689c749508957f35787621032 Mon Sep 17 00:00:00 2001 From: Paul O'Reilly Date: Sun, 6 Sep 2026 23:59:52 +1200 Subject: [PATCH] docs(bug-verify-sonnet): note the scratchpad/verdict follow-up, not yet wired MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Attempted to wire verdict-tx to clone the agent's branch and read scratchpad/verdict (the new cross-node artifact convention, agent-repo/v1 init.sh) instead of the ephemeral /workspace/verdict. Reverted: script tasks (dispatcher/task_manager.py::_run_script_task) have no credentialed way to clone a private repo — the per-task SSH key is provisioned through the full ESO/account harness resolution pipeline, which script tasks deliberately bypass entirely. Left the template on its current (still-broken-for-cross-container-reasons) /workspace/verdict contract with a note, pending a scoped follow-up on how script nodes get read access to the branch (new secrets plumbing, vs. folding the state transition into the agent node's own already- credentialed CP access). --- task-templates/workflow/bug-verify-sonnet@1.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/task-templates/workflow/bug-verify-sonnet@1.yaml b/task-templates/workflow/bug-verify-sonnet@1.yaml index 4b1d2ee..e73bba8 100644 --- a/task-templates/workflow/bug-verify-sonnet@1.yaml +++ b/task-templates/workflow/bug-verify-sonnet@1.yaml @@ -52,6 +52,10 @@ nodes: 5. Write the bare verdict token — exactly `verified` or exactly `rejected`, nothing else, no trailing whitespace or punctuation — to /workspace/verdict. This file is NOT committed to the repo. + (NOTE 2026-09-06: this SHOULD move to scratchpad/verdict, + committed+pushed, once verdict-tx can clone the branch to read it + back — see the runtime_env note on the verdict-tx node below. + Left as the working /workspace/verdict contract for now.) 6. Call task_complete. - id: verdict-tx kind: script @@ -59,3 +63,10 @@ nodes: depends_on: [agent] runtime_env: STATE_TX_ALLOWED_STATES: "verified,rejected" + # NOTE (2026-09-06): scratchpad/verdict cross-node wiring is NOT yet + # live — script tasks (dispatcher/task_manager.py::_run_script_task) + # have no credentialed way to clone the agent's branch (the per-task + # SSH key is provisioned through the full ESO/account harness + # resolution pipeline, which script tasks deliberately bypass). Left + # at the /workspace/verdict default pending that follow-up; see + # spec/bugs or the M-something item tracking it.