rc: 0.3.0 Trusted Effects candidate (do not publish) - #122
Merged
Conversation
Compile closed EffectIR with transitive label checks, route declared writes through the existing resource authority, recover failed and crashed transactions, and expose ledger-backed why-effect evidence.
Do not inherit shared OS temp or home .pi dirs while walking ancestors for project flow discovery (hostile CI/tmp). Canonicalize paths via realpath; compare case-insensitively on win32. Wire store boundary tests into CI; keep marketplace/README/website skill counts aligned with the 20-tool MCP roster.
Source for GitHub PR description; not a publish request. Head rc/0.3.0-trusted-effects, base main. Explicit no npm until human v0.3.0.
Add the effects[] DSL surface (fs.write PathRef shape, labels, payload mapping, example pointer), the model-proposes/resources-commit authority one-liner, the MCP-only taskflow_why_effect audit, and explicit honesty non-claims (no FileBroker sandbox, undeclared paths, SecretRef/ServiceRef type-only fail-closed). Regenerated the five host SKILL.md files via scripts/build-skills.mjs; skills-build test stays green.
Align the 0.3 GA scoreboard with the built Codex MCP 16/16 TE fixture (codex-mcp-full.log: fs.write committed through resources + ledger-backed why-effect). Set L4 honestly as PASS (built-MCP fixture) at evidence SHA 6071fb2 per the build-info stamp, keep the live-Codex-CLI leg and exact-SHA remote CI open, and keep L5/L6 FAIL (no tag/publish). Note that the branch is now pushed to origin via worker-mac SSH relay while CI has no run for 96a32e8 (workflow triggers only on PR->main / push main). Update the release-plan L4 row + human checklist and the agent-goal branch name to rc/0.3.0-trusted-effects.
Update Base/Head to the real tip d532f69 (10 commits ahead of main), refresh the evidence table to match the scoreboard (L4 PASS built-MCP fixture), and note this PR itself is the exact-SHA remote CI gate.
added 17 commits
August 11, 2026 12:57
The process-boundary tests (M1 concurrent saveRun, L1 stale-steal, L1 live-owner, detached-runner e2e) embed an ESM import of store.ts built with path.resolve(), which yields a backslash path (D:\a\...) on Windows. ESM treats that as a bare package specifier and the child dies at startup, so saveRun/lock code was never exercised on windows-latest. Use pathToFileURL(...).href (already the repo convention in resource-leases.test.ts) so the specifier is a portable file:// URL. fix-5 also read ../src/store.ts via new URL(import.meta.url).pathname, which win32 path.join re-prefixes as D:\D:\a\... (ENOENT). Switch to fileURLToPath(import.meta.url). Local: store 69/69, detached 8/8, store-extended 23/23, full pnpm test 2198 pass / 0 fail, typecheck clean.
Claim-vs-evidence audit of scoreboard/PR body/CHANGELOG/skills/host baseline vs exact-SHA CI + local test run at tip d3b2878. 0 Blocker / 0 High / 5 Low (docs-currency only): stale tip/head citations (31460495091 @ d3b2878 not cited), live PR #122 description lagging head, AGENTS.md MCP roster 19->20, audit-evidence phrasing. Ready=HOLD.
Hold Ready: High verifier walk RCE surface + static flow{use} over-taint;
resources MVP holds; honesty ledger clean. No merge/tag/npm.
Elevate concurrent commit race, stage effectId path, and commit-path symlink TOCTOU after source spot-check. HOLD Ready strengthened.
… path Address ADV High findings before Ready: - Shared discovery-boundary for project .pi walks (home/temp stop, canonicalize, reject .pi symlink escape) used by store, verifiers, agents - file-transaction: busy lock against concurrent commit/reject - sanitize effectId for stage blob paths - re-check containment + refuse intermediate symlinks at commit - mkdir parents without following symlinks - swallow onDeferredLeaseRelease throws after terminal so ok:true sticks Tests: adv-high-fix (7) + resource-file-transaction + store + verifier-discover
…-H2)
Static gates (validateTaskflow / verifyTaskflow / FlowIR translate+compile)
run without a flow store, so every flow{use: <saved>} child degraded to the
unknown-boundary summary and rejected legal saved-subflow + downstream write
compositions that the runtime (with loadFlow) executes successfully.
- validateComposedEffectFlow gains downgradeUnresolvedUse: unresolved
flow{use} boundaries now report advisory warnings (unresolved-flow-use /
unresolved-flow-use-taint) instead of hard confidentiality taint; dynamic
inline flow{def} boundaries stay hard-tainted.
- Static gates accept an optional resolveFlow: pi run + MCP taskflow_run
inject the store-backed loader so saved children are checked with real
effects (real violations still hard-fail); runtime admission remains the
authoritative fail-closed gate.
- New test effects-static-use-downgrade (4): benign use + write accepted
statically and at runtime; real violation advisory without loader but
hard-fails with resolver and at runtime; dynamic def stays tainted;
loader-miss is advisory statically and fails closed at runtime.
Clawdy handoff after orch residual crash. Focused 110/110, CI 31465576937 green. Sync scoreboard/PR body tip. No merge/tag/npm.
worker-mac dogfood closes live-host L4 leg. Evidence under docs/internal/evidence/. No merge/tag/npm.
Bound Windows atomic rename contention, keep background waits honest until authenticated workers quiesce, and relax a test-only startup deadline under CI load.
Owner
Author
|
Reopening immediately to retrigger the missing pull_request CI event for head b5beb8e; the synchronize push produced no check suite. |
Owner
Author
CI lifecycle/filesystem hardening deliveredCurrent head: Root causes fixed independently:
Verification:
|
Owner
Author
Final review-blocker resolution —
|
added 10 commits
August 12, 2026 16:50
# Conflicts: # packages/codex-taskflow/test/e2e-mcp-comprehensive.mts # packages/codex-taskflow/test/mcp-server.test.ts # packages/taskflow-core/src/store.ts # packages/taskflow-mcp-core/src/mcp/server.ts
…s + ControlHost 0.3-C S2: create the taskflow-control package from the frozen wire plan (docs/internal/wire-freeze.md + P1-P16 ADRs; no archive implementation). - TypeBox wire schemas with closed contracts + schemaVersion covering wire-freeze 3.2-3.9 (~33 new types), TE REUSE mirrors (resources/* shapes not exported by taskflow-core) and read-only TE imports (effects/schema, flowir/canonical-hash). - ControlHost auto/coordinated/standalone mode contracts (P13 D5): fresh-install defaults to auto; coordinated fails closed; no silent auto->standalone fallback. - User singleton lock/endpoint/fencing (D32): hard-link create, stale endpoint recovery, identity-bound reclaim, compare-and-delete release, fencing epoch enforcement (TF_AUTHORITY_REVOKED). - hello-before-RPC negotiation gate (P4): TF_PROTOCOL_INCOMPATIBLE / TF_SCHEMA_UNSUPPORTED / TF_FEATURE_REQUIRED. - TE resources as the only execution authority (P8): te-provider adapter with accepted|rejected|ambiguous DTOs; ControlHost refuses non-TE providers. - Unit tests: modes, singleton fencing/stale recovery, te-provider delegation, hello gate, schema contracts, ControlHost integration. - Workspace wiring: pnpm-workspace, root build/devDeps; wire-freeze.md backfilled with actual file paths. 10-package 0.2.10 surface unchanged (typecheck, full test suite 2353 pass, packed smoke 10 packages).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rc: 0.3.0 Trusted Effects candidate (do not publish)
Base / Head
main@f605813— release: taskflow 0.2.9 + Hermes host (#125)rc/0.3.0-trusted-effects@1bc54d6(30 commits ahead of main)b5beb8elifecycle/filesystem CI hardening;004c3ecsyncsmain@0.2.9;1bc54d6preserves resume agent scope/global thinking and Hermes Trusted Effects skill parityThis PR supersedes the historical Draft PR #117 (
head: codex/0.3.0-trusted-effects-candidate). Therc/0.3.0-trusted-effectsbranch is the canonical candidate branch; current head is1bc54d6(PR #122).Summary
packages/taskflow-core/src/effects/):EFFECT_KINDS), PathRef reuse, SecretRef/ServiceRef (type-only fail-closed)CommitorRestore+Rejecteffects/runtime-apply.ts; no second changeset/gateway authoritywhyAuthorized/whyContext/whyEffecteffects[]; FlowIR translate/compile/hash include effectsdetectEffectsIssues(categoryeffects) +effectsLintVerifierfs.writethrough the resource transaction; event-kernel-enabled runs use the same safe imperative pathconformance/workspace/host-support-baseline.jsondocs/internal/0.3.0-trusted-effects-mvp.md,0.3.0-agent-goal.md,0.3.0-ga-scoreboard.mdexamples/trusted-effects-write.jsontest/effects*.test.ts,test/verify-effects.test.ts.pidiscovery hardened against tmp and home roots (96a32e8)pathToFileURL/fileURLToPath(e7c5e31; test-harness only, no product change) — windows-latest store/process-supervisor jobs genuinely exercise saveRun/lock semanticsFixed
ctx_spawnchildren can no longer be skipped by parent cache or resume reuse.effectsfail admission/compile, andwhy-effectfollows DAG dependencies.Scope boundary
This candidate guarantees admitted declared filesystem write targets. It does not claim a full FileBroker/native OS sandbox and cannot prevent or roll back writes to undeclared paths under resolve-only execution. SecretRef/ServiceRef have no vault/network backends in this cut (fail-closed, unsupported). Historical Control Plane (
feat/0.3.0) is not this release definition.Evidence (honest)
Current-head CI: PASS at
1bc54d6— run 31504434346. Node 22/24, Windows/macOS/Ubuntu process supervisor, build, packed consumer, website, all host MCP e2e, workflow CodeQL, and Advanced Security CodeQL are green.e7c5e31: monorepo typecheck PASS (local + CI node 22/24);pnpm audit --prodclean (RC pipeline at6071fb2— CI does not run audit)git diff --checkpass at1bc54d6fs.writecommitted through resources + ledger-backed why-effect — against the built dist bin (codex-mcp-full.log; evidence SHA6071fb2per build-info stamp; CI e2e job re-runstest:e2e-codex-mcp-fullat exact SHAe7c5e31). NOT a live Codex CLI run:test:e2e-codexNOT rerun on the current tip (prior-candidate A→B→C historical only)Exact-SHA remote CI is GREEN: GitHub Actions run 31460133496 on this PR's head
e7c5e31passed the full matrix (test node 22/24, e2e codex MCP network-free incl. built-dist comprehensive, build dist, packed consumer 9 pkgs + CharterArc, website export, process supervisor ubuntu/macos/windows, CodeQL JS/TS). A prior red run 31456747148 on0f9cf16(windows store tests) was fixed by the test-harness portability change ine7c5e31. Historical Draft PR #117 run31167592775passed all jobs on1478510f(earlier candidate SHA).Commits (rc/0.3.0-trusted-effects vs main, newest first)
Release state
## [0.3.0] — Unreleased (Trusted Effects candidate)— still Unreleased.v0.3.0.