8d7b3af77d
Fresh agent branches were seeded from the stale fork main (AR-39 fell through to fork). Work item 18efa01f-f941-4f16-bb67-9cafbb6d668a. Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
104 lines
4.6 KiB
YAML
104 lines
4.6 KiB
YAML
name: bug-verify-sonnet
|
|
version: 1
|
|
description: Read-only verification of an ai-resolve-tagged bug using Sonnet planning
|
|
runtime: planning-sonnet-repo
|
|
input:
|
|
state: verify-pending
|
|
tags_required: [ai-resolve]
|
|
tags_forbidden: []
|
|
required_artifacts: []
|
|
output:
|
|
state: 'verified|rejected'
|
|
scope_budget:
|
|
files_modified_max: 1
|
|
lines_diff_max: 400
|
|
wall_clock_seconds_max: 1800
|
|
nodes:
|
|
# NOTE (2026-09-09, work item 88ecd23e): the `verdict-tx` script node that
|
|
# used to follow this one has been REMOVED. `kind: script` nodes are
|
|
# harness-exempt (WF-COMP-6 / MN-38) — they run in their own empty
|
|
# container with no credentialed way to clone the agent's branch or read
|
|
# /workspace/verdict, so verdict-tx never actually worked (it always ran
|
|
# against its own empty /workspace). Replaced with the "agent
|
|
# self-transition" pattern (spec/typed-workflows.md): this node's own
|
|
# `cp-service-token/v1` layer (via the `planning-sonnet-repo` composite)
|
|
# gives it CP write credentials, so the agent PATCHes its own item's
|
|
# flow_state directly as its final step, instead of relying on a second
|
|
# node to read a hand-off file. finalize_run's output.state auto-advance
|
|
# is intentionally disabled for this template (its `output.state` is the
|
|
# pipe-separated "verified|rejected" — finalize.py treats any
|
|
# pipe-separated output.state as schema-validation-only, never a literal
|
|
# value to PATCH, so it never clobbers the value set below).
|
|
- id: agent
|
|
kind: agent
|
|
template: planning-sonnet-repo
|
|
model: sonnet
|
|
runtime_env:
|
|
AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
|
|
AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
|
|
AGENT_UPSTREAM_BRANCH: "main"
|
|
AGENT_BRANCH: "bug-verify/${item.uuid}"
|
|
CP_URL: "https://agents.oreillyit.nz/api"
|
|
prompt: |
|
|
The agent-runtimes project repo is cloned at /workspace/project.
|
|
Change to that directory before doing any work.
|
|
|
|
Verify the following bug report. This is a READ-ONLY investigation —
|
|
do NOT modify any source code. Your only file changes are the
|
|
verification artifact described below.
|
|
|
|
**Title**: ${item.title}
|
|
|
|
**Bug report**:
|
|
${item.body}
|
|
|
|
Steps:
|
|
1. cd /workspace/project
|
|
2. Investigate the codebase to determine whether the reported bug is
|
|
real, reproducible, and correctly diagnosed. Do not make code
|
|
changes — this is verification, not a fix.
|
|
3. Write your findings to
|
|
spec/bugs/<slug>-verification.md (derive <slug> from this item's
|
|
own slug) with exactly these sections, in order:
|
|
- `## Reproduction` — concrete steps or evidence confirming (or
|
|
failing to confirm) the reported symptom
|
|
- `## Root-Cause Hypothesis` — the mechanism you believe causes it,
|
|
with file/line references
|
|
- `## Verdict` — exactly one of `verified` or `rejected`
|
|
- `## Rationale` — why you reached that verdict
|
|
4. Commit and push the verification artifact on this branch.
|
|
5. Transition this work item's own flow_state to your verdict by
|
|
PATCHing the control plane directly — you have a scoped CP
|
|
write credential for exactly this (`CP_SERVICE_TOKEN_FILE`,
|
|
`CP_URL`). Set `flow_state` to exactly `verified` or exactly
|
|
`rejected` (matching the `## Verdict` you wrote above) — no other
|
|
value is accepted. Run:
|
|
|
|
```
|
|
python3 - <<'PY'
|
|
import json, os, urllib.request, uuid
|
|
|
|
VERDICT = "verified" # or "rejected" — must match your ## Verdict
|
|
ITEM_UUID = "${item.uuid}"
|
|
|
|
token = open(os.environ["CP_SERVICE_TOKEN_FILE"]).read().strip()
|
|
url = os.environ["CP_URL"].rstrip("/") + f"/v1/work-items/{ITEM_UUID}"
|
|
body = json.dumps({
|
|
"flow_state": VERDICT,
|
|
"description": f"bug-verify-sonnet@1: verdict={VERDICT}",
|
|
}).encode()
|
|
req = urllib.request.Request(url, data=body, method="PATCH", headers={
|
|
"Authorization": f"Bearer {token}",
|
|
"Content-Type": "application/json",
|
|
"Idempotency-Key": str(uuid.uuid4()),
|
|
})
|
|
with urllib.request.urlopen(req, timeout=30) as resp:
|
|
print(resp.status, resp.read().decode())
|
|
PY
|
|
```
|
|
|
|
Replace `VERDICT` with your actual verdict before running. This is
|
|
the ONLY code you may run outside the investigation itself — do
|
|
not use this credential for anything else.
|
|
6. Call task_complete only after the PATCH above returns 200.
|