From d0424879c23a33cdd5ff91209f876eb09c521d9c Mon Sep 17 00:00:00 2001 From: Paul O'Reilly Date: Mon, 19 Oct 2026 00:24:55 +1300 Subject: [PATCH] R2: remove AU-51 bearer layer from planning/spec-writing model composites; delete retired @1 templates (dbc5efc6) The @2 templates use CP-side verdict/WIA decompose and never read the bearer. Triggers already pin version 2. Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF --- .../planning-sonnet-repo/v1/harness.yaml | 5 - .../spec-writing-sonnet-repo/v1/harness.yaml | 3 - .../workflow/bug-verify-sonnet@1.yaml | 103 ------------------ .../workflow/scope-decompose-sonnet@1.yaml | 68 ------------ tests/__init__.py | 0 tests/invariants/test_state_tx_runtime_env.py | 2 - 6 files changed, 181 deletions(-) delete mode 100644 task-templates/workflow/bug-verify-sonnet@1.yaml delete mode 100644 task-templates/workflow/scope-decompose-sonnet@1.yaml create mode 100644 tests/__init__.py diff --git a/harnesses/composites/planning-sonnet-repo/v1/harness.yaml b/harnesses/composites/planning-sonnet-repo/v1/harness.yaml index 1e2d6a0..f03b14a 100644 --- a/harnesses/composites/planning-sonnet-repo/v1/harness.yaml +++ b/harnesses/composites/planning-sonnet-repo/v1/harness.yaml @@ -8,8 +8,3 @@ layers: - context: anthropic-cloud-paul-oauth/v1 - context: gitea-ssh/v1 - context: agent-repo/v1 - # AU-51/AU-51b: this composite backs bug-verify-sonnet@1, whose agent node - # self-transitions its own item's flow_state (PATCH /v1/work-items/{id}) - # as its final step — see work item 88ecd23e ("agent self-transition" - # pattern, spec/typed-workflows.md). Needs a CP write credential. - - context: cp-service-token/v1 diff --git a/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml b/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml index e1cdd7b..a3eae18 100644 --- a/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml +++ b/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml @@ -8,6 +8,3 @@ layers: - context: anthropic-cloud-paul-oauth/v1 - context: gitea-ssh/v1 - context: agent-repo/v1 - # AU-51/AU-51b: this composite backs scope-decompose-sonnet@1, which - # calls back POST /v1/work-items/{id}/decompose — needs a credential. - - context: cp-service-token/v1 diff --git a/task-templates/workflow/bug-verify-sonnet@1.yaml b/task-templates/workflow/bug-verify-sonnet@1.yaml deleted file mode 100644 index 932959c..0000000 --- a/task-templates/workflow/bug-verify-sonnet@1.yaml +++ /dev/null @@ -1,103 +0,0 @@ -name: bug-verify-sonnet -version: 1 -description: Read-only verification of an ai-resolve-tagged bug using Sonnet planning -runtime: planning-sonnet-repo -input: - state: verify-pending - tags_required: [ai-resolve] - tags_forbidden: [] - required_artifacts: [] -output: - state: 'verified|rejected' -scope_budget: - files_modified_max: 1 - lines_diff_max: 400 - wall_clock_seconds_max: 1800 -nodes: - # NOTE (2026-09-09, work item 88ecd23e): the `verdict-tx` script node that - # used to follow this one has been REMOVED. `kind: script` nodes are - # harness-exempt (WF-COMP-6 / MN-38) — they run in their own empty - # container with no credentialed way to clone the agent's branch or read - # /workspace/verdict, so verdict-tx never actually worked (it always ran - # against its own empty /workspace). Replaced with the "agent - # self-transition" pattern (spec/typed-workflows.md): this node's own - # `cp-service-token/v1` layer (via the `planning-sonnet-repo` composite) - # gives it CP write credentials, so the agent PATCHes its own item's - # flow_state directly as its final step, instead of relying on a second - # node to read a hand-off file. finalize_run's output.state auto-advance - # is intentionally disabled for this template (its `output.state` is the - # pipe-separated "verified|rejected" — finalize.py treats any - # pipe-separated output.state as schema-validation-only, never a literal - # value to PATCH, so it never clobbers the value set below). - - id: agent - kind: agent - template: planning-sonnet-repo - model: sonnet - runtime_env: - AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git" - AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git" - AGENT_UPSTREAM_BRANCH: "main" - AGENT_BRANCH: "bug-verify/${item.uuid}" - CP_URL: "https://agents.oreillyit.nz/api" - prompt: | - The agent-runtimes project repo is cloned at /workspace/project. - Change to that directory before doing any work. - - Verify the following bug report. This is a READ-ONLY investigation — - do NOT modify any source code. Your only file changes are the - verification artifact described below. - - **Title**: ${item.title} - - **Bug report**: - ${item.body} - - Steps: - 1. cd /workspace/project - 2. Investigate the codebase to determine whether the reported bug is - real, reproducible, and correctly diagnosed. Do not make code - changes — this is verification, not a fix. - 3. Write your findings to - spec/bugs/-verification.md (derive from this item's - own slug) with exactly these sections, in order: - - `## Reproduction` — concrete steps or evidence confirming (or - failing to confirm) the reported symptom - - `## Root-Cause Hypothesis` — the mechanism you believe causes it, - with file/line references - - `## Verdict` — exactly one of `verified` or `rejected` - - `## Rationale` — why you reached that verdict - 4. Commit and push the verification artifact on this branch. - 5. Transition this work item's own flow_state to your verdict by - PATCHing the control plane directly — you have a scoped CP - write credential for exactly this (`CP_SERVICE_TOKEN_FILE`, - `CP_URL`). Set `flow_state` to exactly `verified` or exactly - `rejected` (matching the `## Verdict` you wrote above) — no other - value is accepted. Run: - - ``` - python3 - <<'PY' - import json, os, urllib.request, uuid - - VERDICT = "verified" # or "rejected" — must match your ## Verdict - ITEM_UUID = "${item.uuid}" - - token = open(os.environ["CP_SERVICE_TOKEN_FILE"]).read().strip() - url = os.environ["CP_URL"].rstrip("/") + f"/v1/work-items/{ITEM_UUID}" - body = json.dumps({ - "flow_state": VERDICT, - "description": f"bug-verify-sonnet@1: verdict={VERDICT}", - }).encode() - req = urllib.request.Request(url, data=body, method="PATCH", headers={ - "Authorization": f"Bearer {token}", - "Content-Type": "application/json", - "Idempotency-Key": str(uuid.uuid4()), - }) - with urllib.request.urlopen(req, timeout=30) as resp: - print(resp.status, resp.read().decode()) - PY - ``` - - Replace `VERDICT` with your actual verdict before running. This is - the ONLY code you may run outside the investigation itself — do - not use this credential for anything else. - 6. Call task_complete only after the PATCH above returns 200. diff --git a/task-templates/workflow/scope-decompose-sonnet@1.yaml b/task-templates/workflow/scope-decompose-sonnet@1.yaml deleted file mode 100644 index 4cdc986..0000000 --- a/task-templates/workflow/scope-decompose-sonnet@1.yaml +++ /dev/null @@ -1,68 +0,0 @@ -name: scope-decompose-sonnet -version: 1 -description: Scope and decompose a spec into tagged tasks using Sonnet planning -runtime: spec-writing-sonnet-repo -input: - state: spec-reviewed-arch - tags_forbidden: [] - required_artifacts: [] -output: - state: scoped-tagged -scope_budget: - files_modified_max: 10 - lines_diff_max: 500 - wall_clock_seconds_max: 2400 -nodes: - - id: agent - kind: agent - # Decomposition is spec-test-tier work (claude/stage-routing.md): Sonnet, - # not airouter. 2026-07-04 E2E: Qwen3.6 empty-delivered this stage (task - # "succeeded" touching only .gitignore, zero work items created) — the - # template NAME never set the model; the node model: field does. - template: spec-writing-sonnet-repo - # cli defaults to "claude" — the anthropic-cloud OAuth composite drives - # the claude CLI; "cli: agentic" is the OpenAI-compatible runner and - # fails fast with "OPENAI_BASE_URL required" (E2E 2026-07-04). - model: sonnet - runtime_env: - AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git" - AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git" - AGENT_UPSTREAM_BRANCH: "main" - AGENT_BRANCH: "spec/${item.uuid}" - CP_URL: "https://agents.oreillyit.nz/api" - # AR-38: this stage's deliverable is work items POSTed to the CP, not a - # repo diff — the empty-deliverable audit would fail every success. - AGENT_EMPTY_DELIVERABLE_CHECK: "false" - prompt: | - The agent-runtimes project repo is cloned at /workspace/project. - Change to that directory before doing any work. - - Find the spec file in /workspace/project/spec/ (the spec was - written in an earlier pipeline stage — look for a file whose name matches - the concept title '${item.title}' as a slug, e.g. spec/.md). - Read that spec carefully. - - Write a decomposition plan to /workspace/.agent-output/decompose.json with - exactly this structure: - { - "project_id": "${item.project_id}", - "space_id": "${item.space_id}", - "parent_item_uuid": "${item.uuid}", - "tasks": [ - { - "title": "...", - "description": "...", - "flow_state": "needs-tests", - "spec_ids": ["WT-EVAL-1", "..."], - "test_files": ["tests/triggers/test_schema.py", "..."], - "tags": ["airouter-eligible"] - } - ] - } - - Include "airouter-eligible" in tags only for single-file, self-contained - tasks that Qwen3.6 can handle alone. Omit tags for complex multi-file tasks. - - After writing decompose.json, run this command to create the work items: - - python3 -m lib.cp_cli planner items decompose ${item.uuid} --file /workspace/.agent-output/decompose.json \ No newline at end of file diff --git a/tests/__init__.py b/tests/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/tests/invariants/test_state_tx_runtime_env.py b/tests/invariants/test_state_tx_runtime_env.py index d72d868..72f49b4 100644 --- a/tests/invariants/test_state_tx_runtime_env.py +++ b/tests/invariants/test_state_tx_runtime_env.py @@ -93,9 +93,7 @@ def test_cp_url_templates_discovered(): assert { "test-validate@1.yaml", "frozen-fixture-emit@1.yaml", - "scope-decompose-sonnet@1.yaml", "scope-decompose-sonnet@2.yaml", - "bug-verify-sonnet@1.yaml", "bug-verify-sonnet@2.yaml", } <= names