Repository-wide agent-system architecture, goals, and skills
Repository agent system
This project owns the repository-wide agent-system contract, its durable
improvement goals, and reusable cross-repository skills. It does not centralize
component facts or runtime state: each fact remains canonical at its natural
owner, and system-wide views are derived projections.
The current-state document describes supported entry points and their evidence
boundaries. Dated audits remain in the goal records. The architecture defines
the intended composition contract; the roadmap does not claim that proposed
interfaces already exist.
Ownership boundaries
docs/ owns the cross-layer system model and plan, not duplicated component
configuration.
goals/ owns durable repository-agent work records and evidence.
skills/ owns reusable repository-wide agent procedures and their
development-time evaluations.
Product-specific skills remain with their project at
projects/<project>/skills/<name>.
Repository-internal executors and build integrations may live under
tools/; their behavior remains owned and documented there.
Skill packaging and discovery
Every canonical skill is packaged as a skill_library in its owning
directory.
The repository discovery directory .agents/skills/ contains one relative
symlink per skill. Each link points directly to its canonical project-owned
directory. Bazel ignores the discovery directory and builds only canonical
targets, preventing duplicate packages while allowing skills from more than
one owning project.
Skill evaluation data is not part of the runtime skill_library unless a
skill explicitly declares otherwise. Every new or updated skill includes an
offline Promptfoo configuration-validation target. That target checks the eval
harness, not answer correctness. Live behavioral evaluations are manual,
networked tests and must not be included in ordinary wildcard test runs; they
may be omitted when representative coverage requires tool calls or external
state that cannot be provided safely and reproducibly, with the gap documented
beside the eval configuration.
1.1 - Repository agent goals
Durable goals, attempts, and evidence for the repository agent system
Repository agent goals
Each child directory is an owner-local durable goal record. Canonical resource
files and attempt artifacts are created and validated through the repository
goal workflow; do not edit generated records or projections directly.
Goal evidence may contain source and operational analysis, including
non-secret live or generated facts. It must never contain credentials, other
secrets, or personal information. Inspect raw artifacts before promoting their
content.
Structured task artifacts such as FrictionRecord and LearningProposal JSON
files are task scratch: keep them under out/<task>/ and cite them from goal
evidence Markdown rather than committing them into evidence/, which accepts
only .md files.
Discover current open work through the goal catalog and its bounded resume
view; status is owned by each goal record. The
agent-system-phase-six-ergonomics/ goal records a completed friction-reduction
attempt, with the original evidence and its limitations preserved.
The current-state document describes supported
interfaces and current evidence boundaries. Closed attempts remain historical
records; later implementation reviews may narrow claims they made without
rewriting those immutable records.
1.2 - Repository agent system current state
Supported agent entry points, evidence boundaries, and limitations
Repository agent system current state
This is the maintained guide to the checked-in interfaces. Source links below
identify their owners; runtime availability must be observed in the current
session. Historical audits and acceptance claims remain in the immutable
goal records. Their dates and evidence tiers limit what they prove.
Start with the affected path
Read applicable AGENTS.md instructions and the nearest owner README. Use
the available Cordis repository-context handlers for bounded reads and
searches, or the native tools when Cordis is unavailable. Cordis availability
does not determine whether offline repository work is possible.
The offline context command provides a bounded advisory view:
bazel_agent bazel run //tools/agents/cmd/agent_system -- \
--workspace-root "$PWD" --path projects/goal
Its owner documentation describes the
supported flags and limitations. Catalog declarations identify source facts;
they do not establish live provider health, action authorization, successful
validation, or a task’s association with a goal. Missing observations remain
explicit. A source digest proves identity, not freshness against a live system.
Use the owning interface
Need
Entry point
Boundary
Policy and layout
Applicable AGENTS.md, owner README, BUILD and MODULE files
The user request owns intended outcome and authorization.
Procedure
Canonical skill selected from .agents/skills
Load only the procedure needed for the task.
Build or test
bazel_agent bazel <command>
Start with the affected package and avoid redundant compatible invocations.
Context
//tools/agents/cmd/agent_system
Offline, advisory source projection.
Stored runtime status
//tools/agents/cmd/control_status
Stored package observations do not prove present runtime health.
Durable work
//projects/goal/cmd/goal
Use workspace records for task coordination and owner-local project records when maintained history is needed.
Delivery
//tools/repo_delivery
Prepare, establish applicable validation, then explicitly publish the exact candidate.
The Bazel runner also supports cached control-tool
execution in current builds. If an installed runner lacks that subcommand,
the supported bazel run targets remain available. Updating a shared host
installation is a separate operation from changing repository source.
Keep routine work small
Simple tasks need no durable goal. For work that needs a resume point, the
goal checkpoint accepts a short summary, the current candidate,
evidence references, and the next action. The store maintains the record’s
identity and digests; show includes the active continuation. Detailed attempt
review remains available for repeated failures and maintained project history.
Local progress checkpoints do not trigger publication. Deliver at a meaningful
review boundary or final handoff, with explicit remote backups when needed.
Delivery can execute a caller-selected Bazel
validation plan and retain its results against the prepared candidate. Its
continue command reports the next state; continue --publish explicitly
requests publication using those results. The tool carries the candidate and
receipt between steps. It does not decide task ownership, semantic sufficiency,
or whether representative output satisfies the request. Changed candidates and
rebases require fresh validation; uncertain publication outcomes require
inspection before another mutation. Follow the owning README’s launcher
instructions when validation itself invokes Bazel.
Supported guarantees
Skill packaging validates canonical artifacts and
discovery links. Evaluation payloads are separate from runtime skill bodies.
Goal storage validates resource revisions and artifact
digests, provides bounded continuation information, and supports recovery
from interrupted publication. These checks establish record integrity;
criterion verdicts still require appropriate evidence.
Delivery binds the prepared candidate,
scope, remote expectations, and pull-request identity. Exact leases and
state checks protect publication. The caller selects and establishes the
required validation; a preparation receipt is not a test result.
Cordis provides bounded repository tools and supervised
subprocess cleanup. Its package code is trusted. The documented process
boundary is not a security sandbox.
Evidence and implementation limits
The coverage projection
inventories configured cases. It does not measure successful routing or task
completion. Offline configuration checks are useful hygiene; stronger claims
require actual result artifacts identifying the source, fixture, execution,
and judge where applicable.
The shared control contracts include admission and
runtime-control libraries with unit tests. Their existence does not establish
enforcement by production providers. Earlier phase acceptance records describe
broader gateway and runtime guarantees than those unit tests demonstrate.
Treat provider integration, process isolation, and runtime fault containment
as unverified until a concrete consumer and corresponding integration evidence
establish them. The roadmap retains that future work.
Stored control snapshots contain package observations. Their age, missing
writer identity, and lack of a live heartbeat limit their interpretation.
The status reader preserves those limitations and does not create a runtime
or its storage directories merely to inspect them.
Improve from task outcomes
Measure representative questions, edits, recovery, and delivery tasks before
claiming an instruction or workflow is faster or more reliable. Compare task
success, unauthorized actions, context bytes, commands, duration, and resume
steps against the prior behavior. Keep model and fixture identities with
observations; do not infer measured improvement from configuration checks or
the presence of a new schema.
The local comparison fixtures provide four bounded
scenarios and an observer protocol. They cover question answering, a local
prose edit, recovery after a changed postcondition, and a delivery validation
decision. Their simulated observations do not exercise real publication.
Unobservable routing, command, context, or token metrics remain unavailable;
available instruction bytes are not the same as consumed context. Results
belong with the exact task candidate, not in the configured coverage inventory.
Preserve useful safeguards while reducing repeated consumer instructions.
Retire obsolete workarounds and completed tracking when justified. Clean runs
after a fix are not a reason to remove useful diagnostics or regression tests.
Historical proposals suggesting otherwise do not define current policy.
The architecture describes composition responsibilities.
It does not replace these implementation boundaries or authorize new work.
1.3 - Repository agent-system architecture
Canonical composition contract for repository-wide agent work, evidence, delivery, and learning
Repository agent-system architecture
Status and purpose
This document defines the target composition contract for the repository as
one agent-driven system. It is normative about boundaries, invariants, and
ownership. A named interface or record is not a current capability merely
because it appears here. The current-state snapshot
describes implemented behavior; the roadmap orders the work
needed to reach this design.
The objective is to let an agent form an accurate situation model, choose the
least costly safe action, prove the exact result, and make later work cheaper.
The design must remain useful with no daemon, network, credential, runtime
extension, or active durable goal.
System thesis
The repository should have one composition protocol, not one mutable brain.
Each fact stays at its narrow natural owner. Typed, versioned references join
facts across owners. Deterministic bounded projections make those joins cheap
to read. An execution gateway enforces effects at the point where they occur.
No catalog, agent, skill, plan, or receipt may silently become an independent
authority.
This yields four structural rules:
One mutation authority per fact. A fact changes only at its owner.
Many derived views. Human maps, JSON catalogs, context capsules, and
status views are replaceable projections with provenance.
Typed transitions. Cross-layer claims carry stable identities,
versions or digests, completeness, and limitations.
Effects are admitted at execution. Selection and planning advise;
explicit authority plus an executable contract controls mutation.
Physical co-location is not required for logical cohesion. Repository-agent
documents and goals belong under projects/agents. A future
repository-internal controller or executor may belong under tools/agents.
Component declarations remain with their component.
Mutation authorities
Fact
Mutation authority
System projection
Requested outcome and granted authority
Current user/task interaction
Task authority envelope
Applicable agent policy
Nearest AGENTS.md chain
Policy slice with source digests
Component purpose and local boundary
Nearest owner README.md
Topology record
Review accountability
CODEOWNERS
Effective reviewer record
Workspace and dependency structure
MODULE.bazel, BUILD, and owning macros
Workspace and action catalogs
Reusable procedure and routing intent
Canonical project-owned skill
Capability record
Durable outcome, criteria, and attempts
Owner-local goal resources
Goal catalog and resume packet
Task-local scratch and worker ownership
Task manifest below ignored out/<task>/
Bounded task-status record
Desired runtime configuration
Owning checked-in or task-local config
Desired-state reference
Observed runtime state
Live provider instance
Provider-health observation
Source candidate
Git plus an explicit dirty-input declaration
Subject reference
Check execution
Executing provider
Action receipt
Acceptance judgment
Goal criterion or task acceptance policy
Evidence assertion
Feature publication and review
Git, forge, and repository delivery
Delivery and review receipts
Version and release identity
Versioning and release owners
Release identity and manifest
Durable adopted learning
Destination owner through normal review
Updated contract and regression
The architecture owns only this composition model. It must not restate mutable
component values. If two authorities conflict, a projection reports the
conflict and its sources; it does not choose a winner. A relevant unresolved
conflict blocks effectful admission.
Common artifact envelope
Cross-layer artifacts should share a small logical envelope. The roadmap owns
the eventual schema and migration; payloads remain subsystem-specific.
Observation or expiry times belong on live observations. Deterministic
catalog content must not contain nondeterministic generation timestamps.
Artifacts never contain credentials, secret-value hashes, personal
information, environment dumps, absolute checkout paths, unreviewed raw logs,
or full transcripts.
An authority reference is optional and repeatable. A deterministic catalog or
ordinary observation does not gain authority merely by using this envelope.
The artifact digest covers canonical schema-defined bytes without recursively
including its own digest field.
A SubjectRef identifies the thing a claim is about. Depending on the claim,
it can bind repository identity, base/commit/tree OIDs, the explicit
task-owned dirty input set, relevant configuration and toolchain digests, an
environment or remote resource selector, and a timed remote observation.
Claims must not use a weaker subject merely because it is easier to obtain.
The abstraction tower
Each layer consumes contracts from the layer above, adds one kind of fact, and
produces a bounded contract for the layer below.
0. Intent, outcome, and authority
Owner: the user interaction; durable acceptance belongs to the goal when
one exists.
Input: the request, explicit constraints, and prior accepted context.
Output: an outcome, acceptance questions, scope, authority envelope, and
resource limits.
Invariant: a question, skill selection, plan, prior permission, or tool
availability never widens authority. Conditional authority is usable only
after its condition is evidenced. Missing authority is unknown, not
permission.
Repository policy may define an explicit implementation request to include
ordinary feature-branch commit, publication, and review through the delivery
workflow. That default must be visible in the authority envelope and never
extends to tags, releases, deployments, infrastructure changes, or
destruction.
Simple bounded tasks may keep this state in the active interaction. Iterative,
delegated, or resumable work uses a durable goal and attempt.
Input: workspace identity plus affected paths or labels.
Output: component and workspace identity, applicable policy sources,
review accountability, dependency role, and classification axes.
Invariant: keep these axes independent:
checked-in source disclosure;
log and evidence handling;
Bazel target visibility;
allowed build consumers;
artifact and documentation publication; and
secret or personal-information presence and live-environment association.
Checked-in content in this public repository is public information unless it
contains an accidental secret or personal information. Operational facts do
not become confidential merely because they are generated or live, but raw
artifacts require inspection because they can contain prohibited content.
Public information status does not make a target eligible for production
consumption or artifact publication.
2. Policy and action admission
Owners: applicable AGENTS.md, owner-local policy, and the executable
provider or owning build macro.
Input: authority envelope, topology slice, and requested operation.
Output: an admission decision with stable reason codes, required
preconditions, and an exact allowed effect set.
Invariant: every runnable operation declares atomic effects such as:
The executable/provider owns effects; a skill references them rather than
copying them. Unknown effects fail closed. Known read-only discovery may
degrade visibly. Remote writes and destruction require exact resource,
environment, candidate, pre-state, authority, and expiry bindings.
history.write is distinct from source.write: commits, local ref moves,
tags, and rewrites alter history even when worktree bytes do not change.
Operation scopes such as edit, commit, feature publication, review mutation,
release-ref publication, deployment, and destruction map to additive atomic
effects rather than substituting for them.
Review accountability, component ownership, task path/hunk or commit
ownership, goal-storage ownership, remote-ref ownership, external-resource
ownership, and user authority are separate relations. Unknown ownership fails
closed for history rewrite, credential expansion, publication, remote
mutation, and destruction.
3. Capability and provider selection
Owners: canonical skills for routing and procedure; executable and runtime
providers for actual capability contracts.
Input: intent, policy slice, available providers, effects, evidence
maturity, and cost.
Output: the smallest sufficient capability set, ordering, exclusions,
fallbacks, and an explanation of every choice.
Invariant: selection is advisory and never grants authority. Required
dependencies are acyclic. Conflicts, unavailable providers, unsupported
platforms, and unverified behavior are explicit. Full instructions and schemas
load only after compact metadata selects them.
4. Durable work and planning
Owner: the current task coordinator and, for durable work, owner-local goal
resources.
Output: a WorkPacket or goal attempt plus CapabilityPlan and
ActionPlan, with exact inputs, affected criteria, hypotheses where needed,
checks, omissions, fallbacks, fixed regressions, budgets, stop conditions, and
a strategy-reset condition.
Invariant: a plan does not authorize and does not prove. Delegated workers
receive immutable bindings and disjoint output ownership; only the coordinator
mutates canonical goal state. A repeated stable defect changes strategy rather
than accumulating indistinguishable retries.
5. Execution providers
Owners: Bazel and bazel_agent, native repository tools, Cordis or another
runtime provider, and explicit external adapters.
Input: admitted operation, exact subject and inputs, task/run identity,
deadline, quotas, and cancellation contract.
Output: immutable ActionReceipt records plus bounded task-local raw-log
pointers.
Invariant: executors remain thin and signal-transparent. Scratch is
isolated by workspace, task, run, and worker; generated execution receives
only declared filesystem, environment, process, network, and credential
capabilities. Desired and observed state remain separate. A control kernel
must stay responsive when optional data-plane extensions fail.
6. Observation, evidence, and acceptance
Owners: providers own observations; the task or goal acceptance policy owns
semantic sufficiency.
Input: receipts, subject, validation profile, declared policy, known
limitations, and—only for semantic judgment—a criterion revision.
Output: three distinct records:
EvidenceEvaluation derives applicable, stale, insufficient,
unavailable, or unverifiable with stable reasons;
execution-owned, criterion-neutral ValidationSet aggregates exact candidate,
plan/check identities, sanitized invocations, provider/configuration
provenance, results, coverage, and limitations; and
goal/task-owned EvidenceAssertion applies evidence to an exact criterion
and subject with satisfied, not_satisfied, or unknown.
Invariant: receipts prove what ran and what was observed; they do not prove
that selected checks were semantically sufficient. One immutable validation
set may support non-goal delivery and multiple criterion assertions. Partial,
truncated, skipped, or unknown evidence cannot support complete coverage.
Reuse requires matching relevant input, policy, contract, configuration,
toolchain, and subject-class digests.
7. Delivery, review, version, and release
Owners: Git and the forge own remote facts; repository delivery owns
feature publication and review operations; versioning and release keep their
separate identities.
Input: exact candidate, authority, an applicable criterion-neutral
ValidationSet, expected remote state, and operation-specific policy.
Output: delivery, synchronization, review, version, release, and deployment
receipts linked by exact subject references.
Delivery validates candidate-bound evidence but does not select semantic
checks. Feature publication does not imply tag or deployment authority.
Version identity and release snapshot identity are joined by a typed handoff,
not by assuming that any Git tag has the same meaning.
8. Reviewed learning and accretion
Owner: the component that will adopt the lesson through ordinary review
and delivery.
Output: a LearningProposal, then—only after acceptance—an owner-local
document, contract, check, evaluation, skill, or global invariant.
Invariant: learning is never automatic mutation. It is minimized, public,
reviewed, regression-backed, measurable, reversible, and given a retirement
path. Runtime promotion creates a normal candidate; it does not write project
source or goal state directly.
ContextCapsule says what was known, applicable, authorized, available,
stale, and omitted before planning.
WorkPacket says what outcome and criteria a bounded unit will pursue.
CapabilityPlan and ActionPlan say what was selected, omitted, ordered,
budgeted, and expected to prove the result.
AuthorityBinding and AdmissionDecision say which exact effects, subject,
environment, policy, pre-state, and expiry were checked before execution.
ActionReceipt says what provider executed or observed against which exact
inputs and with what result and resource use.
ValidationSet records criterion-neutral check execution and coverage;
EvidenceAssertion makes the separate criterion judgment.
Delivery, review, release-ref, manifest, and deployment receipts say which
external transition occurred and which postcondition was observed.
GoalOutcome records durable acceptance or the honest terminal state.
LearningProposal requests owner review; LearningAdoption identifies the
exact accepted change, regression, delivery, and measured effect.
Plans do not authorize. Receipts do not judge semantic sufficiency. Delivery
receipts do not prove that validation selection was complete. Learning
proposals do not edit policy.
Every edge binds the relevant subject and catalog-slice, policy, contract, and
input digests.
Temporal work loop
The tower defines composition; this loop defines control over time:
Orient -> Bind -> Plan -> Admit -> Act -> Prove -> Decide
|-> replan
|-> deliver -> verify -> close
|-> wait or escalate
`-> stop
|
Learn
Orientation obtains the smallest context capable of exposing uncertainty.
Binding freezes the intended outcome, exact subject, authority, criteria, and
budgets. Planning names omissions, fallback, stop conditions, and the cheapest
evidence capable of falsifying the current hypothesis. Admission checks the
exact plan against current policy and pre-state. Decision either accepts,
changes strategy, waits for named external state, escalates authority, or
stops honestly.
A declared transient failure permits at most one same-input retry. A
deterministic recurrence requires a changed hypothesis or strategy. A remote
operation with unknown postcondition is observed and reconciled before any
second write.
Bounded context capsule
The target zero-context interface is one read-only, bounded projection. It may
be a repository tool and optionally an MCP surface, but it cannot require MCP
to function. It contains:
repository, workspace, worktree, revision, and dirty-input identity;
task/session, coordinator, worker, and run identity;
requested outcome, authority, budgets, and durable goal binding if any;
applicable instruction and owner-document paths with digests;
component, workspace, review owner, and classification slice;
candidate capabilities with effects, cost, dependencies, providers, and
evidence maturity;
provider boot/incarnation ID, catalog ETag, desired/observed revisions,
action-contract hashes, observation time, expiry, and unavailable reasons;
relevant checks and reusable evidence, not raw logs; and
provenance, observation time, freshness, completeness, truncation, and safe
next discovery actions.
The capsule is a join over owner-local catalogs and observations. It stores no
independent truth. A missing optional provider yields a structured unavailable
field; it does not make the whole capsule fail.
Resource economy
An agent climbs this cost ladder only when existing evidence cannot answer the
acceptance question:
checked, cached metadata and narrow source reads;
targeted static queries and reusable subject-bound receipts;
narrow local builds and tests;
broad or uncached validation;
external reads and stochastic/model-assisted evaluation; and
authorized remote mutation or destructive work.
Budgets inherit from repository defaults to task to plan to operation/worker.
A child may narrow but never silently expand a hard bound. Reserve capacity for
cancellation cleanup and final verification. Track context/input bytes,
compute and target/workspace scope, elapsed time, output/log/artifact bytes,
retention, retries, worker fan-out, concurrency, and cacheability. Use measured
p50/p95 workloads to set numeric defaults.
Credentials, network access, history or remote writes, and destruction are
non-fungible authority scopes, never spendable budget. Compatible Bazel work
is batched. Context loads summaries and digests first, then full bodies,
schemas, source, or logs only on demand. A global catalog change triggers
cheap applicability reevaluation, not automatic reruns of unrelated evidence.
Accretion protocol
sanitized bounded friction event
-> aggregation by stable signature and consequence
-> LearningProposal with destination owner
-> minimized regression or routing fixture
-> destination-owner review
-> one appropriate contract, policy, tool, test, or skill change
-> normal validation and delivery
-> LearningAdoption and regenerated evidence status
-> recurrence and resource measurement
Raw transcripts, credentials, unreviewed runtime values, secret-bearing logs,
personal information, and accidental local state never enter the promotion
path. Ignored task-private out/<task>/ may temporarily contain secret-bearing
material under restrictive access and cleanup, but that material is not
tracked or imported as durable evidence. A global invariant is an exceptional
owner-approved destination, not the automatic final rung of the sequence.
Failure and degradation semantics
unknown means the system lacks a fact; it is not false, safe, or allowed.
unavailable names a provider or source that could not be observed.
stale means a once-valid observation no longer matches its applicability
inputs.
partial and truncated bound what a result can prove.
Desired state and observed state are always separate fields.
Runtime observations identify boot/incarnation, catalog, desired and
observed revisions, action contract, observation time, and expiry.
Provider lifecycle is explicit: loading, ready, degraded, failed,
timed_out, draining, or disabled.
Shared mutable task, goal, and runtime state uses a cross-process lock or
lease plus expected version/digest; atomic rename alone is not concurrency
control.
Nested work uses one absolute deadline with cancellation and cleanup margin.
Failures carry phase, stable code/signature, subject, observed state, valid
partial result, retry class, cost spent, redacted artifact references, and
next safe action. Retry class is never, same-input-once,
after-state-change, or requires-human.
Read-only discovery returns the useful safe subset with explicit gaps.
Effectful admission fails closed on unknown effects, authority, environment,
subject, policy conflicts, or relevant stale state.
Secret-bearing raw output stays in task-private scratch and only a
bounded allowlisted summary may cross into ordinary evidence.
Measures
Optimization is evaluated with representative zero-context tasks, not by file
count or architectural novelty. Track at least:
task correctness and unsupported-claim rate;
unauthorized or incorrectly scoped mutation rate;
reads, tool calls, context bytes or tokens, and elapsed/resource cost before
the first correct action;
redundant checks and exact evidence reuse rate;
steps and missing facts required to resume durable work;
stale, partial, and conflict detection accuracy;
provider startup and degraded-status latency; and
the rate at which repeated defects gain a regression, owner, delivery
identity, and eventual retirement.
Non-goals
No hand-maintained central manifest duplicating owner-local facts.
No universal mega-skill or always-loaded copy of every procedure.
No mandatory daemon, database, vector store, or runtime extension for basic
orientation and safe degradation.
No raw transcript ingestion, secret promotion, or automatic doctrine edits.
No inference of authority from selection, planning, receipts, ownership, or
tool availability.
No durable goal requirement for a simple one-step task.
No broad //... validation or live model evaluation by default.
No physical repository reorganization merely to make the conceptual model
look centralized.
1.4 - Repository agent-system roadmap
Remaining work ordered by observed task friction and evidence
Repository agent-system roadmap
This document records intentional future work. The
current-state guide owns the supported interface summary;
component documentation and executable tests establish implementation details.
The architecture describes composition responsibilities.
Historical phase plans and acceptance records remain in the immutable
goals. A completed historical phase does not establish a current
runtime guarantee.
First: measure and simplify ordinary tasks
Use representative question, edit, recovery, and delivery scenarios to compare
the current workflow with a candidate. Keep source, instructions, fixture,
model, observation method, and execution identity with each result. Measure
task success, unauthorized actions, commands, context actually consumed,
duration, and resume steps where the observer can establish them. Record
unavailable measurements explicitly. Configuration validation and shorter
documents do not establish behavioral improvement.
Local simulated delivery scenarios can exercise candidate selection and
validation decisions without publishing anything. They do not prove forge
integration, remote concurrency, or successful real publication. Use the
owning delivery integration tests for their encoded cases, and distinguish
those tests from model behavior.
Reduce repeated common-path instructions and load exceptional procedures only
when their triggering condition occurs. Keep exact candidate, task ownership,
authority, leases, recovery, and review completion requirements. Improve
entrypoint capability detection and workspace-relative path handling before
introducing another execution interface.
Acceptance requires measured task outcomes with no new critical boundary
failures. A small exploratory comparison is useful evidence, not a universal
performance claim. Retain useful diagnostics and regressions after clean runs;
remove obsolete workarounds and completed tracking when their purpose expires.
Next: reduce manual discovery and validation work
Extend bounded offline context only with facts that have an identifiable
owner and observation method. Prefer observed Git state and direct routes to
applicable policy, owner documentation, build declarations, and explicit goal
records. Never infer authorization or task-to-goal association from proximity,
ownership, a catalog entry, or an available tool.
Check suggestions must explain their selection basis and uncovered scope.
Nearest-package selection is not dependency analysis. Root configuration,
build-graph changes, ignored paths, and nested workspaces can require explicit
checks beyond the returned labels. Avoid accidental broad builds while keeping
the mandatory repository quality and affected semantic checks.
Delivery preparation binds the candidate and publication expectations. The
caller selects applicable validation. The delivery tool can execute that plan,
record candidate-bound results, and carry them into explicitly requested
publication. The manual publication path also remains supported. Neither a
preparation receipt nor an asserted commit ID proves that tests ran. Broader
evidence imports must specify their trust boundary and preserve caller
responsibility for semantic sufficiency.
Reuse observations only while their relevant inputs remain unchanged. Reuse
test evidence across a message-only amendment only when tree, configuration,
toolchain, environment, and every other relevant input are stable. Rerun
commit-sensitive or uncertain checks. A receipt alone never establishes reuse.
Acceptance requires representative edits to select sufficient checks, explain
omissions, and invalidate evidence when a relevant input changes. Preserve
cheap read-only discovery when optional providers are unavailable.
Expand behavioral evidence when it answers a concrete question
The configured coverage inventory is not a successful-run ledger. Extend
routing scenarios across positive, adjacent-negative, inert-payload, exclusion,
conflict, and composition cases when the corresponding skill is changed or a
recurring failure demonstrates a gap.
Stronger aggregated evidence needs actual execution artifacts bound to the
source, fixture, model or provider, and judge where applicable. Keep live
stochastic evaluations manual or scheduled and separate from normal wildcard
tests. Use isolated writable fixtures for Git, Bazel, forge, infrastructure,
secret-handling, and runtime trajectories before making claims about them.
Never reuse shared authentication in a mode that requires exclusive access
while concurrent sessions are active.
Promote a repeated lesson only with an owner, minimized public reproducer,
regression, supported contract, fallback, measured cost, delivered revision,
and a reasoned retirement rule. A schema or proposal does not establish that
this learning loop runs automatically.
Runtime integration remains conditional work
Shared admission and control libraries have unit-test coverage. Production
provider enforcement, process isolation, and runtime fault containment remain
unverified. Build further runtime machinery only for an identified consumer
whose required behavior and failure modes justify it.
For that consumer, test bounded status during a stuck extension, package
deadlines, desired versus observed revision, cancellation and cleanup,
cross-task storage isolation, and the actual filesystem, process, network,
credential, and output boundaries. Trusted in-process code is not a security
sandbox. A source contract cannot substitute for consumer integration evidence.
Keep bounded native and offline fallbacks available. A missing optional
provider must produce an explicit unavailable result rather than preventing
ordinary repository work.
Constraints on further work
Facts remain at their owning sources; generated views carry provenance and
limits rather than becoming new mutation authorities.
Keep goals, delivery, release, review, and provider state separate. Add joins
through typed references only when a real workflow needs them.
Do not add a mandatory daemon, database, vector store, network call, or
central orchestrator for basic orientation.
Do not relocate components merely to match conceptual diagrams.
Keep reviewed evidence bounded and free of credentials and personal data.
Use workspace goals for temporary coordination and owner-local maintained
records only when durable project history is justified.
Choose the least costly check that answers acceptance; broad audits remain
separately scoped work.
2 - Al
Repository command runner and Bazel configuration rules
AL is a command runner that prepares credentials and environment variables
through plugins, runs your command, and cleans up afterward. Its Bazel rules
package commands with their configuration and required plugins.
al run starts selected plugins, passes their environment to a command, and
keeps plugin resources available until that command exits. On cancellation it
asks the command to terminate and waits up to ten seconds before killing it.
Plugin shutdown then drains requests, releases resources in reverse registration
order, and waits for plugin exit. Startup failure cancels sibling starts and
rolls back partially initialized resources. Cleanup errors fail the invocation.
The injector creates secret files with owner-only permissions and removes them
after consumers stop. Vault stores revoke AppRole tokens they issue; failed
AppRole login attempts destroy their unused single-use SecretID. The role’s
bootstrap policy must permit secret-id-accessor/destroy, as declared by
projects/tf_modules/vault_approle. The user’s existing token-helper credential
is never erased or revoked. Secret inputs and remote response bodies are omitted
from diagnostic messages. OIDC authorization uses the configured Vault HTTPS
origin and TLS transport, rejecting alternate origins and redirects.
Explicit config dumps still contain the requested configuration; file outputs
use owner-only permissions and truncate previous contents.
no_auth prevents AL’s Vault client from loading credentials. For environment
injection it clears inherited VAULT_TOKEN; it does not sandbox the command or
prevent a command from independently reading the user’s token helper. Plugins
and invoked commands remain trusted programs with the user’s filesystem access.
Cleanup is observable best effort, not secure erasure. Memory copies are not
zeroized. Forced termination, host failure, unresponsive cleanup code, or an
unavailable service can prevent deletion or revocation. Subprocess signaling
targets direct children, not arbitrary descendants. Credential expiry remains
a fallback; service-specific logout requirements are documented with each plugin.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Roll back partial plugin startup, drain requests before releasing resources,
and wait for plugin and command processes to exit. Stop independent plugins
concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify
Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login.
Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict
config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and
transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and
fix the existing blank-line formatting failure in the GitHub AL wrapper.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module
projects/rules_hugo and add a Go-based persistent Hugo worker with a
Dart Sass toolchain, then fix the worker’s empty-destination defect,
polish the rules, add per-project landing pages and DNS declarations,
and improve the site deploy.
rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules,
tests, and README; no root-workspace labels.
hugo_worker: persistent worker that resolves execroot-relative paths
through the work directory and probes DART_SASS_BINARY, so the site
destination is populated with HTML and Sass-compiled CSS.
sass: Dart Sass 1.103.1 toolchain wired into the site build.
alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font
Awesome 7.3.1, module mounts, and the site build switched to the worker.
Landing pages: content/projects/_index.md links every project to its
docs page; a Projects menu entry is added and the content filegroup is
wired.
DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new
subdomains) and is wired into infra/dns/dnsconfig.js.
Deploy: the genrule clones the pages branch that GitHub Pages serves,
clears the previous checkout, writes .nojekyll, stages deletions, skips
no-op deploys, and pushes HEAD:pages without a force push; the README
deploy section is updated.
Content: rename the reserved sites taxonomy to websites so the
alwaldend.com term renders, and fix main/bzl docs prefix collisions
across nested modules.
Review fixes: document the extension-based toolchain registration in
the rules_hugo README, sync the full-repo-check eval rubric to nine
nested workspaces and twenty commands, and drop the worker’s unsupported
outs attribute.
Validation: site build produces 3051 HTML pages and Sass CSS; worker,
terraform, buildifier, and nested rules_hugo tests pass; git diff
–check is clean.
LLM-disclaimer: This commit was generated by an LLM.
Close the registered agent-reachable universe with owner-local operation
declarations, a report-only completeness checker, shared task-run contracts,
task/run-isolated Cordis scratch, explicit Terraform mutations, and bounded
Bazel diagnostics. Record numeric resource ceilings and accepted durable-goal
evidence for the exact candidate.
Integrate the non-render agent tooling and Blender toolchain changes from PR
24 while retaining the old Blender data package whose move destination is
excluded. Direct repository agents to prefer Cordis over shell for supported
inspection and to consider bounded Cordis handlers for recurring gaps.
Verification:
affected Bazel build: 74 targets passed
affected Bazel tests: 23 of 23 passed
Phase 1 registered-universe report: valid
goal validation: valid
git diff –check HEAD: passed
LLM-disclaimer: This commit was generated by an LLM.
Make the repository legible as one coherent agent-operated system while
preserving one mutation authority per fact.
add revision-bound current state, target architecture, and phased roadmap
route root and agent entry points to the canonical model and durable goal
normalize repository-tree policy and the public-information boundary
clarify task-private secret scratch and non-obvious tool narration
correct question and secret skill contracts and stale operator examples
render source-compatible Markdown links correctly in the documentation site
retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the
full Hugo site, source and rendered link checks, exact label queries,
repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Introduce a Bazel-built Go tool that calculates the repository’s global
SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and
weekly release branches atomically, advances release patches by first-parent
commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable
versioning skill with offline Promptfoo validation. Cover ISO week boundaries,
SemVer formatting, branch and dirty-tree guards, release patch calculation,
tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches
the stamped Bazel command. Bind ref transactions to the inspected commit,
neutralize Git replace/graft/routing inputs, make dry runs validate namespace
collisions, validate every published patch tag against its exact first-parent
position, reject ambiguous or inconsistent tag states, and require explicit
context for detached release calculations. Route detached release-tag
selection through those same history-integrity checks. Keep development status
cache-safe by emitting Git identity as volatile data while making immutable
nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed
aggregate whitespace check identifies the offending path exactly once.
Verified with:
bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test
//:write_skill_links_test //:buildifier_test
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Roll back partial plugin startup, drain requests before releasing resources,
and wait for plugin and command processes to exit. Stop independent plugins
concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify
Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login.
Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict
config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and
transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and
fix the existing blank-line formatting failure in the GitHub AL wrapper.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module
projects/rules_hugo and add a Go-based persistent Hugo worker with a
Dart Sass toolchain, then fix the worker’s empty-destination defect,
polish the rules, add per-project landing pages and DNS declarations,
and improve the site deploy.
rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules,
tests, and README; no root-workspace labels.
hugo_worker: persistent worker that resolves execroot-relative paths
through the work directory and probes DART_SASS_BINARY, so the site
destination is populated with HTML and Sass-compiled CSS.
sass: Dart Sass 1.103.1 toolchain wired into the site build.
alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font
Awesome 7.3.1, module mounts, and the site build switched to the worker.
Landing pages: content/projects/_index.md links every project to its
docs page; a Projects menu entry is added and the content filegroup is
wired.
DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new
subdomains) and is wired into infra/dns/dnsconfig.js.
Deploy: the genrule clones the pages branch that GitHub Pages serves,
clears the previous checkout, writes .nojekyll, stages deletions, skips
no-op deploys, and pushes HEAD:pages without a force push; the README
deploy section is updated.
Content: rename the reserved sites taxonomy to websites so the
alwaldend.com term renders, and fix main/bzl docs prefix collisions
across nested modules.
Review fixes: document the extension-based toolchain registration in
the rules_hugo README, sync the full-repo-check eval rubric to nine
nested workspaces and twenty commands, and drop the worker’s unsupported
outs attribute.
Validation: site build produces 3051 HTML pages and Sass CSS; worker,
terraform, buildifier, and nested rules_hugo tests pass; git diff
–check is clean.
LLM-disclaimer: This commit was generated by an LLM.
Close the registered agent-reachable universe with owner-local operation
declarations, a report-only completeness checker, shared task-run contracts,
task/run-isolated Cordis scratch, explicit Terraform mutations, and bounded
Bazel diagnostics. Record numeric resource ceilings and accepted durable-goal
evidence for the exact candidate.
Integrate the non-render agent tooling and Blender toolchain changes from PR
24 while retaining the old Blender data package whose move destination is
excluded. Direct repository agents to prefer Cordis over shell for supported
inspection and to consider bounded Cordis handlers for recurring gaps.
Verification:
affected Bazel build: 74 targets passed
affected Bazel tests: 23 of 23 passed
Phase 1 registered-universe report: valid
goal validation: valid
git diff –check HEAD: passed
LLM-disclaimer: This commit was generated by an LLM.
Make the repository legible as one coherent agent-operated system while
preserving one mutation authority per fact.
add revision-bound current state, target architecture, and phased roadmap
route root and agent entry points to the canonical model and durable goal
normalize repository-tree policy and the public-information boundary
clarify task-private secret scratch and non-obvious tool narration
correct question and secret skill contracts and stale operator examples
render source-compatible Markdown links correctly in the documentation site
retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the
full Hugo site, source and rendered link checks, exact label queries,
repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Introduce a Bazel-built Go tool that calculates the repository’s global
SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and
weekly release branches atomically, advances release patches by first-parent
commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable
versioning skill with offline Promptfoo validation. Cover ISO week boundaries,
SemVer formatting, branch and dirty-tree guards, release patch calculation,
tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches
the stamped Bazel command. Bind ref transactions to the inspected commit,
neutralize Git replace/graft/routing inputs, make dry runs validate namespace
collisions, validate every published patch tag against its exact first-parent
position, reject ambiguous or inconsistent tag states, and require explicit
context for detached release calculations. Route detached release-tag
selection through those same history-integrity checks. Keep development status
cache-safe by emitting Git identity as volatile data while making immutable
nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed
aggregate whitespace check identifies the offending path exactly once.
Verified with:
bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test
//:write_skill_links_test //:buildifier_test
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
bazel_agent bazel build //projects/alwaldend.com:site
bazel_agent bazel test //projects/alwaldend.com:site_test \
//projects/alwaldend.com/test/site:site_test
bazel_agent bazel run //projects/alwaldend.com:site_serve
The preview serves the local build at http://127.0.0.1:1313. The generated-site
test checks internal links, image paths, fragment targets, duplicate IDs, and
selected page markup. It does not check external destination availability.
Documentation links
Markdown links and images resolve relative to their source directory.
README.md and _index.md links resolve to generated pages; packaged resources
use their published URLs, including when embedded in print pages. Link files
that exist only in the repository with explicit GitHub URLs. Unknown internal
destinations remain unchanged and are reported by the generated-site test;
they are not silently redirected to GitHub.
Print pages scope IDs and their fragment and control references to each source
document, keeping anchors distinct when documents are combined.
This project’s DNS declaration
owns the shared pages address. Each other project owns its landing CNAME
pointing directly to alwaldend.github.io.. Hostnames use hyphens while docs
paths keep underscores. The project directory links to all
sites. The apex and www records stay managed centrally.
Deploy to the Github Pages repo (the pages branch of
alwaldend/alwaldend.github.io, which GitHub Pages serves):
tools/versioning/cmd/versioning/versioning.sh bazel -- \
run --config=release //projects/alwaldend.com:deploy
The deploy script clones the pages branch, replaces its contents with the
built site, writes .nojekyll, and pushes only when the output changed.
Update PVE VMs
bazel run //projects/alwaldend.com/tf # Apply tfbazel run //projects/alwaldend.com/tf:update_pve_disk # Update the disk
Taxonomy
Taxonomy
Meaning
Categories
General category
Languages
Programming language
Sites
Sites
Statuses
Project status
Tags
Generic tags
Shortcodes
alwaldend/alert
{{< alwaldend/alert >}}
Alert body
{{< /alwaldend/alert >}}
alwaldend/label_link
Create a link using a bazel label
Usage:
{{% alwaldend/label_link "//tools/qt" %}}
alwaldend/links
Render common links
Usage:
{{% alwaldend/links %}}
alwaldend/svg_file
Render a packaged SVG using its published URL. Set alt to describe the image;
the page title is the fallback.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module
projects/rules_hugo and add a Go-based persistent Hugo worker with a
Dart Sass toolchain, then fix the worker’s empty-destination defect,
polish the rules, add per-project landing pages and DNS declarations,
and improve the site deploy.
rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules,
tests, and README; no root-workspace labels.
hugo_worker: persistent worker that resolves execroot-relative paths
through the work directory and probes DART_SASS_BINARY, so the site
destination is populated with HTML and Sass-compiled CSS.
sass: Dart Sass 1.103.1 toolchain wired into the site build.
alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font
Awesome 7.3.1, module mounts, and the site build switched to the worker.
Landing pages: content/projects/_index.md links every project to its
docs page; a Projects menu entry is added and the content filegroup is
wired.
DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new
subdomains) and is wired into infra/dns/dnsconfig.js.
Deploy: the genrule clones the pages branch that GitHub Pages serves,
clears the previous checkout, writes .nojekyll, stages deletions, skips
no-op deploys, and pushes HEAD:pages without a force push; the README
deploy section is updated.
Content: rename the reserved sites taxonomy to websites so the
alwaldend.com term renders, and fix main/bzl docs prefix collisions
across nested modules.
Review fixes: document the extension-based toolchain registration in
the rules_hugo README, sync the full-repo-check eval rubric to nine
nested workspaces and twenty commands, and drop the worker’s unsupported
outs attribute.
Validation: site build produces 3051 HTML pages and Sass CSS; worker,
terraform, buildifier, and nested rules_hugo tests pass; git diff
–check is clean.
LLM-disclaimer: This commit was generated by an LLM.
Make the repository legible as one coherent agent-operated system while
preserving one mutation authority per fact.
add revision-bound current state, target architecture, and phased roadmap
route root and agent entry points to the canonical model and durable goal
normalize repository-tree policy and the public-information boundary
clarify task-private secret scratch and non-obvious tool narration
correct question and secret skill contracts and stale operator examples
render source-compatible Markdown links correctly in the documentation site
retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the
full Hugo site, source and rendered link checks, exact label queries,
repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Introduce a Bazel-built Go tool that calculates the repository’s global
SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and
weekly release branches atomically, advances release patches by first-parent
commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable
versioning skill with offline Promptfoo validation. Cover ISO week boundaries,
SemVer formatting, branch and dirty-tree guards, release patch calculation,
tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches
the stamped Bazel command. Bind ref transactions to the inspected commit,
neutralize Git replace/graft/routing inputs, make dry runs validate namespace
collisions, validate every published patch tag against its exact first-parent
position, reject ambiguous or inconsistent tag states, and require explicit
context for detached release calculations. Route detached release-tag
selection through those same history-integrity checks. Keep development status
cache-safe by emitting Git identity as volatile data while making immutable
nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed
aggregate whitespace check identifies the offending path exactly once.
Verified with:
bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test
//:write_skill_links_test //:buildifier_test
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module
projects/rules_hugo and add a Go-based persistent Hugo worker with a
Dart Sass toolchain, then fix the worker’s empty-destination defect,
polish the rules, add per-project landing pages and DNS declarations,
and improve the site deploy.
rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules,
tests, and README; no root-workspace labels.
hugo_worker: persistent worker that resolves execroot-relative paths
through the work directory and probes DART_SASS_BINARY, so the site
destination is populated with HTML and Sass-compiled CSS.
sass: Dart Sass 1.103.1 toolchain wired into the site build.
alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font
Awesome 7.3.1, module mounts, and the site build switched to the worker.
Landing pages: content/projects/_index.md links every project to its
docs page; a Projects menu entry is added and the content filegroup is
wired.
DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new
subdomains) and is wired into infra/dns/dnsconfig.js.
Deploy: the genrule clones the pages branch that GitHub Pages serves,
clears the previous checkout, writes .nojekyll, stages deletions, skips
no-op deploys, and pushes HEAD:pages without a force push; the README
deploy section is updated.
Content: rename the reserved sites taxonomy to websites so the
alwaldend.com term renders, and fix main/bzl docs prefix collisions
across nested modules.
Review fixes: document the extension-based toolchain registration in
the rules_hugo README, sync the full-repo-check eval rubric to nine
nested workspaces and twenty commands, and drop the worker’s unsupported
outs attribute.
Validation: site build produces 3051 HTML pages and Sass CSS; worker,
terraform, buildifier, and nested rules_hugo tests pass; git diff
–check is clean.
LLM-disclaimer: This commit was generated by an LLM.
Make the repository legible as one coherent agent-operated system while
preserving one mutation authority per fact.
add revision-bound current state, target architecture, and phased roadmap
route root and agent entry points to the canonical model and durable goal
normalize repository-tree policy and the public-information boundary
clarify task-private secret scratch and non-obvious tool narration
correct question and secret skill contracts and stale operator examples
render source-compatible Markdown links correctly in the documentation site
retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the
full Hugo site, source and rendered link checks, exact label queries,
repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Introduce a Bazel-built Go tool that calculates the repository’s global
SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and
weekly release branches atomically, advances release patches by first-parent
commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable
versioning skill with offline Promptfoo validation. Cover ISO week boundaries,
SemVer formatting, branch and dirty-tree guards, release patch calculation,
tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches
the stamped Bazel command. Bind ref transactions to the inspected commit,
neutralize Git replace/graft/routing inputs, make dry runs validate namespace
collisions, validate every published patch tag against its exact first-parent
position, reject ambiguous or inconsistent tag states, and require explicit
context for detached release calculations. Route detached release-tag
selection through those same history-integrity checks. Keep development status
cache-safe by emitting Git identity as volatile data while making immutable
nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed
aggregate whitespace check identifies the offending path exactly once.
Verified with:
bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test
//:write_skill_links_test //:buildifier_test
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Set up repositories and packages for a development VM
The default task entry point configures package repositories and development
packages. It uses the same dev_vm_packages list with either the ordinary
package manager or RPM-OSTree layering. dev_vm_package_backend accepts
auto, package, or rpm_ostree; auto selects RPM-OSTree when
/run/ostree-booted exists. Set dev_vm_install_packages to false to skip
repository and package management entirely.
RPM-OSTree changes are staged for the next boot by default. The role reports a
pending deployment but does not reboot the host. Set
dev_vm_rpm_ostree_apply_live to true only when live application is known to
be safe for the selected packages.
The packaged Fedora mirror and Bazelisk tool currently make this role specific
to Linux x86-64 development hosts.
The packages task entry point exposes package management separately from
other role tasks. The bazel task entry point installs a caller-provided Bazel
rc, Bazelisk, and the repository’s bazel_agent runner for one developer
account.
Import the Bazel entry point with tasks_from: bazel and set:
dev_vm_bazel_user: owner of the installed files.
dev_vm_bazel_group: group of the installed files; defaults to the user.
dev_vm_bazel_home: absolute home directory for the developer account.
dev_vm_bazelrc_src: controller-side Bazel rc source; defaults to bazelrc.
dev_vm_bazelisk_src: controller-side Bazelisk source; defaults to
bazelisk.
dev_vm_bazel_agent_src: controller-side bazel_agent source; defaults to
bazel_agent.
The role packages its default Linux x86-64 Bazelisk and bazel_agent sources.
The calling playbook must package the Bazel rc, plus any overridden binary
sources, in an Ansible file search path. Cache storage and machine-specific
Bazel settings remain the caller’s responsibility.
lvg_volume_groups describes the complete desired physical-volume list for
each volume group. Extra physical volumes are not removed unless a caller sets
remove_extra_pvs: true.
Creating a volume group initializes every listed device as an LVM physical
volume. Callers must resolve stable device paths and verify that each device is
the intended, unused disk before applying this role; pvcreate may overwrite
an existing disk signature.
5.2.27.1 - Defaults
Defaults for lvg
lvg_volume_groups: []
5.2.28 - lvol
Setup LVM logical volumes
Each lvol_volumes entry can constrain allocation with pvs, pass creation
arguments with opts, and disable shrinking with shrink: false.
5.2.28.1 - Defaults
Defaults for lvol
lvol_volumes: []
5.2.29 - Mount
Setup posix mounts
Mount entries can set opts, dump, and passno; state: mounted keeps the
mount active and writes its persistent /etc/fstab entry.
Mouse-driven autoscroll CLI with reloadable configuration
Autoscroll is a Python and PyQt6 command-line application that turns mouse
movement into horizontal and vertical scrolling. It supports configurable
buttons, scroll speed, and configuration changes without restarting.
By default, the icon is disabled, to enable it pass --icon-enable
You can pass file contents as command line arguments using @path/to/the/file syntax.
Arguments in that case can be placed wherever - on one line, on several lines
If you want to dynamically pass runtime arguments (without restarting the process), you can use --config options for it
Once you press --buttons-start, you can scroll vertically or horizontally just by moving your mouse untill you press --buttons-end
If --buttons-hold is set, the srolling ends once you release --buttons-start
Once --buttons-start is pressed, the scroll thread starts looping
Every loop consists of sleeping for an interval, then scrolling for either 0, 1, or -1 pixels on both axis towards the starting point
Starting point is the point where --buttons-start was pressed
Sleep interval is recalculated on every mouse move as such:
If --scrolling-acceleration is not 0, the speed of scrolling will be faster
the farther away you are from the starting point
If --scrolling-acceleration is 0, the speed of scrolling will be constant
If config.txt is defined like this, its contents will be used as command line arguments - they will be loaded only once
Arguments can be placed wherever - on one line, on several lines
For example,
If config.txt is defined like this, the process will listen for changes in that
file and update itself
Arguments can be placed wherever - on one line, on several lines
The file is checked for changess every --config-interval
For example:
--buttons-start 1 --buttons-hold
--debug_click
--help output
usage: autoscroll [-h] [-ss SCROLLING_SPEED] [-sd SCROLLING_DEAD_AREA]
[-sa SCROLLING_ACCELERATION] [-bh] [-bs BUTTONS_START] [-be BUTTONS_END]
[-ce] [-cp CONFIG_PATH] [-ci CONFIG_INTERVAL] [-ie] [-ip ICON_PATH]
[-is ICON_SIZE] [-df] [-dc] [-ds] [-di]
...
options:
-h, --help show this help message and exit
scrolling:
-ss, --scrolling-speed int
constant part of the scrolling speed
[default: 300]
-sd, --scrolling-dead-area int
size of the square area aroung the starting point where scrolling will stop, in
pixels
[default: 50]
-sa, --scrolling-acceleration int
dynamic part of the scrolling speed, depends on the distance from the point
where the scrolling started, can be set to 0
[default: 10]
buttons:
-bh, --buttons-hold if set, the scrolling will end once you release --buttons-start
-bs, --buttons-start int
button that starts the scrolling
[default: 2]
-be, --buttons-end int
button that ends the scrolling
[default: --buttons-start]
config:
-ce, --config-enable if set, arguments from the configuration file on --config-path will be loaded
every --config-interval
-cp, --config-path str
path to the configuration file
[default: ~/.config/autoscroll/config.txt]
-ci, --config-interval int
how often the config file should be checked for changes, in seconds
[default: 5]
icon:
-ie, --icon-enable if set, the icon will be enabled
-ip, --icon-path str path to the icon
[default: resources/img/icon.svg]
-is, --icon-size int size of the icon, in pixels
[default: 30]
debug:
-df, --debug-file if set, every time the config file is parsed, information will be printed to
stdout
-dc, --debug-click if set, click info will be printed to stdout
-ds, --debug-scroll if set, scroll info will be printed to stdout
-di, --debug-initial if set, startup configuration will be printed to stdout
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
bazel_agent is the repository Bazel entry point for agents. It keeps the
Bazel invocation behind a validated subcommand while consistently applying the
agent configuration:
bazel_agent bazel test //path/to/package:all
->
bazel test --config=agent //path/to/package:all
bazel is the only Bazel entry point, and it is a validated subcommand. The
runner accepts a known Bazel command after the bazel keyword, rejects
arbitrary leading arguments, and places --config=agent after the command.
Targets, command options, and arguments after the -- separator of a
bazel run invocation pass through unchanged. Later options therefore retain
Bazel’s normal precedence and can override settings supplied by the agent
configuration. The runner resolves bazel from PATH and replaces itself
with that process, so signals and the final exit status are not mediated by
another wrapper process. Uses of the persistent Bazel server follow the host
Codex network policy; the host-bot profile allows loopback so the
client-server connection is not blocked.
The runner does not create or inject a host temporary directory. Bazel actions
use declared outputs and Bazel-managed temporary storage, and tests use their
test temporary-directory contract. Repository-updating host tools that need
scratch must accept or derive an explicit task/run path under out/<task>/
instead of relying on ambient TMPDIR, TMP, or TEMP values propagated to
the whole build.
Cached repository tools
Frequently used repository control tools can bypass Bazel analysis after one
exact build:
The runner hashes its own binary plus each tool’s declared source, dependency
locks, Bazel pins, repository rc files, optional user and host rc files, their
transitive imports, any BAZELRC environment files, and the platform. A cache
miss takes an exclusive per-key lock, builds the target with runfiles enabled,
and copies the complete runnable output into an atomically installed entry. A
hit executes that entry directly without starting a Bazel client or loading a
worktree graph. Concurrent misses for the same exact key share one build.
Inputs are hashed again under the lock and after the build; an in-flight source
change selects a new key instead of publishing stale output under the old one.
BAZEL_AGENT_TOOL_CACHE or --cache-root can select the cache. The default is
/var/cache/bazel/tool_cache when that managed directory exists, otherwise
the user’s cache directory. Because entries contain executable code, the cache
root must not be writable by group or others. Source changes select a new key,
so a dirty relevant source file cannot silently reuse an older executable.
bazel_agent doctor --workspace-root PATH --task-scratch out/<task>/<run> is
a read-only, bounded JSON diagnostic. It reports runner and built-source
identity, Bazelisk pins, platform, rc/profile composition, task scratch
classification, and stale host-install state without dumping the environment.
Installation
Bootstrap the host installation with the underlying Bazel command:
bazel run --config=agent //projects/bazel_agent:install
Once installed, update it with:
bazel_agent bazel run //projects/bazel_agent:install
The install target atomically replaces ~/.local/bin/bazel_agent. After every
code update to this project, rerun the install target; the installed binary is
not updated automatically. Repository launchers probe the installed runner’s
tool-cache support before using it, so an older host installation retains its
documented Bazel fallback during rollout.
8 - Ci platform
Abandoned CI platform with a Go backend and Vue frontend
An abandoned continuous integration platform with a Go backend and a Vue
single-page frontend. The source retains its job, pipeline, and project
management components.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Personal configuration files with installation and comparison commands
This project packages personal configuration files into an installable
archive. Make and Bazel entry points compare the packaged files with the
local system and install selected configurations.
Archive with dotfiles that can be installed using make
Bazel usage
bazel run //projects/dotfiles:help # Show helpbazel run //projects/dotfiles:diff # Show diffbazel run //projects/dotfiles:install # Install files
Archive usage
oras pull --output "${PWD}" docker.io/alwaldend/src:projects_dotfiles_dotfiles_tar_head
cd releases/projects/dotfiles/head/files
tar -xf dotfiles.tar
cd dotfiles
make help # Show helpmake diff # Check diff between system files and those from the archivemake diff/nvim # Check diff for all nvim filesmake diff/nvim/.config/nvim/lazy-lock.json # Diff specific filemake install # Install all files from the archivemake install/nvim # Install nvim filesmake install/nvim/.config/nvim/lazy-lock.json # Install a specific file
Help
help: Show help
install: Install files from the archive
diff: Show diff between archive files and system files
install/bin: Install bin files
diff/bin: Diff bin files
install/home: Install home files
diff/home: Diff home files
install/nvim: Install nvim files
diff/nvim: Diff nvim files
make: Nothing to be done for 'help'.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Versioned goal resources, local storage, and agent workflow
This project owns the goal execution skill and the deterministic local store
that supports it. Ordinary tasks use init for the objective and acceptance,
checkpoint --summary --subject --next-action for local progress, and show
for bounded continuation. The store derives IDs and digests while retaining
explicit resource-version checks. Detailed attempt plans and histories remain
available for maintained goals, repeated failures, and complex coordination.
projects/goal/
api/v1alpha1/ Portable resource types and domain validation
cmd/goal/ Cobra command wiring and command tests
docs/ Current architecture and generated diagrams
internal/fsstore/ Local persistence, per-goal locking, and store tests
skills/goal/ Model-facing execution protocol and evaluations
Go dependencies flow from cmd/goal to internal/fsstore to
api/v1alpha1. The API package has no filesystem or command dependency.
The Go toolchain is Bazel’s @rules_go//go; run the package targets below
rather than a host-installed go.
The command stores Kubernetes-inspired goals.alwaldend.com/v1alpha1 YAML
resources and canonical, digest-bound attempt Markdown in ordinary repository
files. Each attempt.yaml binds plan.md, result.md, and evidence/*.md by
SHA-256. Goal.status.plans records durable plans with one active plan at a
time and states active, accepted, rejected, or superseded; attempts can
bind to a plan with spec.planID. Each goal record’s README.md is a generated, bounded,
replaceable projection. The portable API treats resource versions as opaque
and excludes local ownership paths from desired state. The filesystem backend
supplies one cooperative lock per goal, local numeric resource versions,
atomic file replacement by sibling temporary-file rename, session bindings,
promotion, non-destructive unversioned-record import, and recoverable
multi-file publication. Before a multi-file mutation, the backend stages exact
after-images and installs a .goal-publication.yaml intent in the goal
record; goal doctor classifies the publication state and goal recover
replays or discards a pending intent. It is a local file editor with atomic
per-file replacement; it does not claim cross-file transaction semantics
without the publication intent.
These files are not installed CRDs. A future Kubernetes adapter can convert
the API types after adding Kubernetes metadata types, structural schemas,
status-subresource behavior, generated runtime methods, and reconciliation of
API-server-owned metadata.
Run the command through Bazel:
bazel_agent bazel run //projects/goal/cmd/goal -- --help
Diagnose and finish an interrupted publication:
bazel_agent bazel run //projects/goal/cmd/goal -- doctor --goal-dir $GOAL_DIR
bazel_agent bazel run //projects/goal/cmd/goal -- recover --goal-dir $GOAL_DIR
The canonical skill lives at skills/goal; .agents/skills/goal is only its
repository discovery symlink.
10.1 -
Goal graph organization
Use this reference when one objective may need related goals, parallel work,
or dependency-aware resumption. The graph is a view over ordinary local Goal
resources. The execution harness remains responsible for scheduling and
permissions.
Decide whether to decompose
Keep ordinary ordered steps in one attempt plan. Create a separate goal only
when the subgoal benefits from at least one independent property:
lifecycle or resumption;
acceptance criteria and evidence;
ownership or retention;
substantial parallel execution; or
reuse by more than one objective.
The coordination cost of another goal and edge must be lower than the value of
making that boundary explicit.
Use typed relationships
Goal.spec.relationships supports three same-catalog references:
parentGoalRef expresses hierarchy, not execution order;
dependsOnGoalRefs names prerequisites; and
supersedesGoalRefs records lineage.
A parent is not a Kubernetes owner reference and never implies garbage
collection. Supersession does not redirect dependencies or authorize mutation
of the older goal. Only an achieved prerequisite satisfies a dependency;
an open prerequisite waits, while an abandoned or superseded prerequisite
blocks until the relationship is explicitly revised.
Keep each relationship kind acyclic independently. Do not test the union of
different edge kinds as one directed acyclic graph. Missing targets make a
catalog view unknown, rather than making one otherwise well-formed Goal
resource invalid.
Change structure deliberately
Treat inferred relationships as proposals, never facts. Bind a proposal to
its source evidence and the goal generation it inspected. A coordinator must
review it, analyze the complete catalog for cycles, and publish it through the
normal resource-version compare-and-swap path. A worker must not rewrite
canonical relationships.
Relationship publication completely replaces the dependency and supersession
lists. Omitting the parent preserves it; clearing the parent is an explicit
operation. Close an active attempt before changing relationships: each attempt
is bound to the goal generation and portable goal-state digest that existed
when work began. An accepted relationship request advances generation and
resource version even when normalization makes it a semantic no-op.
Per-goal locks do not make a catalog transaction. Cycle prevention checks a
snapshot assembled by reading each goal under its own lock. Concurrent writes
to different goals can both pass against older snapshots and jointly create a
cycle. The single coordinator must avoid those conflicting writes; always run
the deterministic graph projection again after parallel structural changes and
repair any reported cycle.
Dispatch only goals whose prerequisites are satisfied. Agent selection,
capability discovery, delegation, communication topology, and runtime
scheduling belong to the execution harness.
Use the complete deterministic graph analysis for inspection. A catalog with
unresolved references is Unknown; a cyclic catalog is Invalid. Graph
analysis does not truncate its input, so report a catalog read or validation
failure instead of inferring readiness from a partial view.
Attempt input bindings, criteria and goal-state digests, structured reviews,
and artifact digests form the provenance graph for evidence.
10.2 -
Attempt lifecycle and evidence
Use this reference for maintained goals, repeated failures, and complex
coordination. Ordinary progress uses the compact checkpoint workflow in the
skill entry point.
Plan before work
One attempt is a bounded work unit with one reviewable outcome. Establish before implementation:
the observed Goal resource version as the next checkpoint’s
compare-and-swap token; the store derives generation, lifecycle, criteria,
and digest bindings rather than requiring manual transcription;
the uncertainty or stable defect being targeted;
work type and hypothesis when the work tests one;
the smallest high-leverage module or question, its stop condition, and the
minimum whole-result context needed to detect interface or integration harm;
the plan, inputs, parameters, intended result identity, and review packet;
affected criteria and the fixed regression checks; and
parent checkpoint or prior attempt when one exists.
Preflight deterministic geometry, numeric gates, controlling references,
paths, APIs, tools, permissions, and whether the proposed artifact can satisfy
its own acceptance gate. Preserve material preflight evidence without turning
discarded prose drafts into fake attempts.
Prefer a bounded module whose result can change the next decision. Do not
polish it in isolation: retain enough surrounding context to judge composition,
interfaces, and fixed regressions. If a cheap check decisively falsifies the
module, interface, or approach, stop work and close the attempt with that
evidence rather than completing the original plan mechanically.
Bind evidence to what was tested
A criterion verdict is one of pass, fail, or unverified. Evidence must
identify its criterion revision and the exact tested subject:
content: a digest or immutable version;
source change: source revision and relevant configuration;
research or decision: source set, retrieval date where relevant, analysis
artifact, and review method.
A later change that can affect a verdict invalidates it until rerun. Never
combine visual evidence from one candidate with technical evidence from
another. Command success alone is not evidence of the desired postcondition.
For a monolithic shared artifact without stable mergeable interfaces, derive
each candidate from an exact immutable baseline and keep it isolated. Use an
approved baseline when the task requires approval. Compare the candidate in
the minimum whole-result context needed to detect integration regressions.
Bind acceptance or approval evidence to its exact identity; the canonical
writer may promote it only with existing mutation authority and when the
task’s acceptance and approval policy permits. Do not manufacture a permanent
file split solely to make concurrent editing possible.
Review and close
Inspect likely failure views and edge cases, not only the best output. For
subjective work, use consistent comparisons and independent review when
available. Judge absolute quality against the target rather than improvement
from a weak predecessor.
Close the attempt with:
work actually performed;
artifacts and raw verification evidence;
a verdict for every affected criterion and regression check;
the dominant remaining failure;
the decision to accept, refine, or reset; and
a process audit covering measurable movement and feedback bottlenecks.
Publish the close only if the goal resource version and lifecycle generation
still match. A stale attempt remains useful evidence, but it cannot silently
become canonical or reopen a closed lifecycle.
Retry and finish
When a required criterion fails or remains unverified, keep the outcome open,
update the stable failure count, and choose the highest-leverage next attempt.
After the same defect survives twice, materially change strategy.
At least every three closed attempts, and immediately on a stalled trend,
examine the complete attempt history and the end-to-end process, not only the
latest failure. Identify systemic delays, repeated assumptions, weak evidence,
poor decomposition, and unhelpful tooling. Process changes are justified only
when they improve the speed or reliability of producing the requested result.
Record the review and the last attempt it covers in attempt evidence or the
attempt result so its cadence survives a session change.
For final acceptance, freeze one exact result, run every required criterion
and the complete regression set, deliver or export it, and verify that delivery
did not change its identity. If delivery changes the tested subject, rerun the
full evidence plan.
10.3 -
Promotion and migration
Use this reference only when promoting a workspace goal or importing an
unversioned record.
Promote workspace to project
Promotion changes storage and retention, not goal identity. It must:
require an explicit maintained-project decision and an owning project root;
lock the source and destination paths in canonical order, then validate the
source at an expected resource version;
preserve the goal ID and closed attempt history;
record source scope and promotion provenance;
require repository-relative or stable external links;
retain, copy, or make reproducible every acceptance-critical artifact;
scan for absolute local paths, credentials, private environment details,
and ignored evidence that would become broken; and
validate and render the destination before making it canonical.
Do not promote caches or routine coordination logs. Refuse a destination that
would shadow another goal with the same ID or that cannot retain critical
evidence. Leave the workspace source intact until the destination is verified.
Migrate an unversioned record
A README-only goal has no claimed schema version. Migration is intentionally
conservative and is always a non-destructive import. Supply a distinct legacy
source directory and destination goals root; the command never converts the
source in place.
keep every source byte and source directory entry unchanged;
derive the stable goal ID from the source directory name and publish only to
<destination-goals-root>/<goal-id>;
reject canonical source/target equality or ancestry overlap, then lock both
paths in canonical sorted order;
preserve the original prose as an immutable legacy snapshot;
import only fields that are unambiguous;
mark imported criteria unverified in the closed migration attempt and begin
a new structured lifecycle at the migration checkpoint;
build a complete <goal-id> directory in hidden staging under the
destination root and run the normal record validator there;
re-read and digest the source immediately before publishing the staged
directory with one rename;
make rerunning the same provenance and options idempotent; and
refuse an existing target with different provenance, options, ownership, or
invalid content.
Do not pretend a prose history can be losslessly normalized. The snapshot is
evidence of what was recorded; new structured attempts begin from the migration
checkpoint.
10.4 -
Goal resource format v1alpha1
Use this reference for checkpoint payloads, criteria changes, record semantics,
or validation errors. Ordinary resume uses the CLI’s bounded view. The files
use Kubernetes-style resource envelopes for familiar versioning and evolution;
they are portable local records, not Kubernetes objects or CRDs.
Workspace records normally live at out/<task>/goals/<goal-id>/. The
recommended direct-initialization layout for project records is
<owner-root>/goals/<goal-id>/. This is guidance rather than a CLI constraint;
direct initialization, promotion, and migration accept other safe in-workspace
roots. A goal ID is stable across promotion and must not be reused.
Resource envelope
Every canonical YAML resource uses the Kubernetes-style envelope. For example,
a newly initialized local Goal has this shape:
The allowed kinds are Goal, GoalCriteria, GoalAttempt, and
GoalSessionBinding. metadata.name is a DNS-compatible stable resource
identity. Use only standard Kubernetes ObjectMeta field names. In the local
store, metadata.resourceVersion emulates an API-server optimistic-concurrency
token: carry it literally and do not perform arithmetic on it.
The local CLI advances metadata.generation for spec changes and for every
accepted relationship replacement, including a normalized no-op. Lifecycle
generation is separate because criteria replacements and outcome or execution
changes can invalidate in-flight work without changing desired relationships.
Authority and projections
goal.yaml, criteria.yaml, immutable criteria-revisions/<revision>.yaml
snapshots, each attempt.yaml, and the exact plan.md, result.md, and
evidence/*.md bytes bound by its artifact manifest are canonical. Validation
checks those Markdown sidecars against their SHA-256 digests. README.md is
generated, bounded, and replaceable. It is never canonical input; regenerate
it from the canonical record instead of editing it by hand.
Use the repository tool for canonical operations when it is available:
bazel_agent bazel run //projects/goal/cmd/goal -- <command> --help
The command owns IDs, resource validation, per-goal locking,
resource-version checks, atomic file replacement, path normalization, and
rendering. Do not emulate those mechanics with direct YAML edits. If the tool
is unavailable, keep exactly one writer and state that revision and
concurrency safety were not verified.
The local adapter keeps a deterministic, persistent per-goal lock file under
$XDG_RUNTIME_DIR/alwaldend/goal/locks/. It is outside the workspace and
cannot be committed. While held, it contains the current process PID for
diagnostics; clean release clears it, while a crash can leave a stale PID.
flock, never the PID text, is authoritative, and the tool never unlinks a
lock based on that text. The lock is not a resource or part of the portable
record format. A mutation writes a sibling temporary file, closes it, and
renames it over the destination while holding that goal’s lock. Each file
replacement is atomic; a command that changes several files does not claim a
cross-file transaction.
Goal
Goal.spec owns the requested configuration: title, workspace or project
scope, retention policy, and stable parentGoalRef, dependsOnGoalRefs, and
supersedesGoalRefs relationships. The workspace-relative owner root is
local adapter metadata in the goals.alwaldend.com/local-owner-root
annotation. The filesystem backend requires it, but portable goal-state
digests exclude it.
Each local goal reference is an object containing name, rather than a path or
bare ID. Relations do not grant permission to change related goals or imply a
scheduler in v1alpha1.
Goal.status owns observed state: outcome, execution, active and accepted
attempt IDs, accepted result digest, current criteria revision, lifecycle
generation, promotion or migration provenance, and update time. Criteria
replacement and accepted outcome or execution changes advance lifecycle
generation. Starting, updating, or closing an attempt without such a transition
changes goal state but does not advance lifecycle generation.
Criteria
GoalCriteria.spec identifies its goal by a {name: ...} reference and a
revision. Each item has a stable criterion ID, its own revision, a required
flag, statement, and evidence method. Every accepted complete criteria
replacement advances the criteria resource version, generation, and spec
revision. An item’s revision advances only when its meaning changes. Evidence
proves exactly one item revision; an earlier pass becomes historical rather
than current.
Keep a fixed regression set in the criteria resource. Run it after every
attempt that can affect it and against the frozen final result.
Attempts
GoalAttempt.spec binds the work to a {name: ...} goal reference, goal and
lifecycle generations, criteria revision, portable criteria and goal-state
digests, optional planID, and work type. It does not store a Goal resource version: that value
is the checkpoint caller’s mutation-time compare-and-swap token, not a durable
attempt input. Attempt status records whether it is open or closed, relevant
timestamps, the SHA-256 artifact manifest, and the structured close review.
Review evidence references may name only the manifest’s plan, result, or
evidence paths. The digest-bound Markdown bytes live beside the resource.
An attempt may carry optional structured resume fields so a fresh agent can
resume an open goal without free-form archaeology:
stableDefect: the reproducible problem under investigation.
hypothesis: the candidate explanation being tested.
subject: the exact system, artifact, or reference under test.
affectedCriteria: criterion IDs this attempt exercises; unique and sorted.
regressionRefs: reviewed regression set or fixtures; unique and sorted.
priorAttemptID: an earlier attempt this one resumes or corrects.
dominantFailure: the single most useful failure signal observed.
measurableDelta: the measured difference this attempt produces.
nextAction: the deterministic next step for a resuming agent.
blocker: an external condition preventing progress, if any.
resumeCondition: what must hold before a resuming agent resumes this
attempt.
Plans
Goal.status.plans stores durable plan summaries. Each entry has a portable
planID, a bounded strategy, and a state of active, accepted,
rejected, or superseded. A rejected plan carries a bounded
rejectionReason. At most one plan is active. Create or transition a plan
with goal checkpoint --plan-id ... --plan-strategy ... or
--plan-state ... --plan-only; a new plan supersedes the previous active plan.
An attempt may bind to one of these summaries with spec.planID; the plan is
input context and the attempt review remains the acceptance evidence.
These fields are advisory input, not acceptance evidence: a closed attempt may
omit them entirely. Prose fields must be trimmed, bounded, and free of NUL;
identifiers must be portable record IDs; lists must be unique, sorted, and
bounded. The generated README projection surfaces stableDefect,
dominantFailure, nextAction, blocker, and resumeCondition for open
attempts so an agent can resume directly from the goal record.
For the registered repository goals root, use the goal command’s catalog-backed
resume view instead of scanning goal directories:
The output is a bounded GoalResumePacket decoded from the checked,
digest-verified goal catalog. It contains only open goals with a resumable
open attempt and their exact candidate paths and continuation fields.
--catalog is required and resolves relative to --goals-root; a task-specific
root needs its own generated catalog. The command validates catalog structure
and its stored digest, not freshness against owning goal records. Revalidate
the selected record before acting on its continuation fields.
Goal.status.acceptedResultDigest is the accepted attempt’s result.md
SHA-256, not automatically the identity of an external deliverable. Record an
external subject’s exact identity in the result or evidence when acceptance
depends on it.
Allowed work types are investigation, candidate, change, integration,
validation, and decision. Not every work unit has a file
candidate or hypothesis. Stateful work should identify source revision, target
and environment/config revision, plus an operation receipt.
An open attempt may receive isolated evidence. Closing it publishes its final
resource, plan, result, and evidence set. After close, treat its directory as
immutable; a correction or additional evidence is a new attempt that refers to
the old one.
Close review
checkpoint --close-attempt --review-file <path> takes plain YAML with
exactly two keys, decision and criteria; do not add resource-envelope
headers. Use the actual IDs and revisions returned by show:
Decisions are accept, refine, or reset. Verdicts are pass, fail, or
unverified; passing or failing requires a reference to plan.md,
result.md, or an imported evidence/*.md artifact. Sort criteria by ID and
keep evidence references unique and sorted. Evidence must describe the exact
tested candidate and actual observations. To mark the goal achieved, add
--outcome achieved only when this accepting close passes every current
required criterion. Ordinary summaries do not supply these verdicts.
Bounds and paths
List, goal-detail, and README views have explicit item or byte limits and
report truncation. Graph analysis instead consumes the complete accepted
catalog or fails. Prefer useful recent entries in bounded views over failing
because history is large. Canonical and migrated Markdown files must be
bounded regular files containing valid UTF-8 and no NUL bytes. Store links
relative to the workspace or owner root, or as stable external URLs. Never
place local absolute paths, credentials, or private environment values in a
project goal.
Kubernetes compatibility boundary
The resources deliberately follow Kubernetes API conventions, but the local
files are not directly managed by a Kubernetes API server. The filesystem
adapter supplies resourceVersion, generation, and local annotations. A
future Kubernetes adapter must let the API server populate its read-only
metadata, install structural OpenAPI schemas, enable the status subresource,
and reconcile or strip local-only annotations during import and export.
Keep portable identity and desired state in the resource. Store a session’s
workspace-relative goal path only in the namespaced annotation
goals.alwaldend.com/local-goal-ref; GoalSessionBinding.spec.goalRef remains
a normal {name: ...} object. Digest-bound plan, result, and evidence sidecars
are a local storage representation; a cluster adapter must map their bytes to
cluster-accessible objects or artifact references.
This boundary lets a future CRD/controller reuse the API types. Do not claim
that a local record can be passed to kubectl apply without that adapter and
the CRDs.
When implementing that adapter, verify the current Kubernetes
custom-resource
and ObjectMeta
contracts rather than copying the local store’s metadata behavior blindly.
10.5 -
Sessions and concurrency
Use this reference when resuming, switching goals, delegating, or reconciling
a stale update.
Many records, one focus
A goal is identified by its stable goal ID and scope, not by a chat thread. A
GoalSessionBinding is a replaceable pointer to the current goal. Its
attachment-time generation, revision, and digest fields only detect whether
that pointer’s view has become stale. List and inspect stored goals before
attaching when identity is uncertain. Starting a new session must not create a
duplicate merely because the old thread is unavailable.
Attaching does not mutate the goal. Detaching or switching focus does not
pause, close, or delete it. Verify the goal resource version and current
attempt after every fresh attach or context recovery.
Canonical writer protocol
Use one coordinator for canonical state. For an attempt or lifecycle
checkpoint mutation within one existing goal record, the goal tool:
acquires the selected goal’s cooperative cross-process file lock;
rereads canonical state under the lock;
checks the caller’s expected resource version; when publishing an existing
attempt, it also verifies its goal reference, lifecycle generation, and
digest-bound criteria snapshot;
validates the complete prospective state and fully stages a new attempt in
a hidden sibling directory when needed;
advances goal.yaml as the optimistic-concurrency commit point;
publishes the staged directory with one rename, or replaces existing
attempt files through sibling temporary-file renames;
finalizes an immediately closed new attempt in goal.yaml at the same
resource version; and
writes the derived projection last and releases the lock.
The intermediate Goal for an immediately closed new attempt keeps an active
pointer until that attempt exists. An interruption before attempt publication
or Goal finalization therefore fails validation rather than silently dropping
the attempt. After the commit point, an error returns the committed Goal
reference and names its advanced resource version. Validate before resuming;
never retry with the caller’s stale token.
A checkpoint --criteria-file update uses the same goal lock and expected
resource version. It installs the immutable criteria snapshot, replaces the
current criteria, advances goal.yaml, and writes the projection last.
Atomic rename prevents torn files; it does not prevent lost updates by itself.
The lock and expected resource version are both required for this
compare-and-swap path. A process that ignores the lock is outside this
cooperative trust boundary.
The lock is keyed by the canonical goal path under
$XDG_RUNTIME_DIR/alwaldend/goal/locks/, so it is never tracked and work on
one goal does not block an unrelated sibling goal. If a process exits between
two file renames, validate the record before resuming instead of inferring
state from temporary files or generated Markdown.
The lock file contains the current holder PID for diagnostics. Clean release
truncates the PID while still holding flock; a crash releases the kernel
lock automatically and leaves the PID for diagnosis. The next holder
overwrites a stale PID. flock, not PID existence or process liveness, is the
authority. Never unlink and recreate a lock path based on PID metadata while
other processes may be waiting on its existing inode.
The key uses the full canonical absolute goal path rather than only its ID.
Same-named goals in parallel workspaces are independent; symlink aliases of
one path share a lock.
Other commands use locks according to the paths they coordinate. Promotion and
migration acquire distinct source and destination locks in canonical-path
order. Attachment reads the goal under its goal lock, then writes the session
binding under a separate path lock.
This is cooperative same-user coordination, not a hostile-process sandbox.
The runtime lock inode is checked without following a final symlink, but the
workspace and goal pathnames must remain stable for the duration of a command.
A process with the same user identity that races workspace renames or symlink
replacement is outside the tool’s trust boundary.
When an error reports goal publication is incomplete, run goal doctor on
the goal directory to classify the pending intent, then goal recover to
replay or discard it. Doctor states: stable,
committed-projection-stale (a README-only refresh), discardable-intent
(nothing canonical changed; recover removes it), staged-intent or
partial-intent (recover replays the after-images), and conflict (refused).
Never retry a mutation over a pending intent and never delete the intent or
staging directory by hand.
On a stale update, retain the isolated attempt output, reread the new canonical
state, and decide whether to rebase the evidence into a new attempt, revise the
plan, or discard publication. Never retry blindly with a newly read version.
Workers
Workers receive immutable inputs: goal ID, resource version, lifecycle
generation, criteria revision, attempt ID, bounded task, and an isolated
scratch/output location. They do not write into the canonical goal directory.
The coordinator reviews their output and imports selected Markdown evidence
through the canonical checkpoint.
For a long-running goal, the coordinator explicitly lists ready independent
workstreams at start, resume, and before each attempt. If at least two can
produce useful reviewable outputs without racing canonical state, delegate
them concurrently. Remaining sequential requires a concrete reason recorded
with the attempt, such as an unresolved dependency, unsafe shared mutation, or
an integration queue that would erase the latency benefit. Recheck when an
attempt closes, stalls, changes strategy, or exposes another independent
workstream.
For a monolithic artifact with no stable mergeable interfaces, give each
worker an isolated copy of the same exact frozen baseline instead of splitting
the canonical artifact; use an approved baseline when the task requires
approval. Bound each copy to one falsifiable change and enough whole-result
context to expose integration regressions. The coordinator may promote a
candidate only when the task already authorizes the mutation and the task’s
acceptance and approval policy permits it; workers never merge competing
copies directly. Copy only data permitted for that worker boundary and
minimize unrelated context.
Before publication, recheck that the goal remains open, the execution state
permits publication, and all versions still match. This prevents a late worker
from publishing after pause, completion, abandonment, or supersession.
Parallelize only independent work with disjoint output locations. Allocate
workers and compute to critical-path uncertainty, and cap work in progress at
the coordinator’s review and integration capacity. Idle slots are not a
failure when no additional useful workstream is ready. Suitable work includes
bounded candidate variants, research, disjoint modules, blind review,
verification, and artifact preparation. Bound fanout and depth; do not split
trivial operations merely to fill slots, and require a separate benefit for
recursive delegation. Stop workers whose output can no longer affect the next
decision or required acceptance and delivery evidence.
Registered goal discovery
For registered repository goals, use the explicit checked catalog:
--catalog is required and resolves relative to --goals-root. The bounded
view selects open goals with resumable attempts and verifies the catalog’s
stored digest, not freshness against current records. Use show --goal-dir
for a selected local record or workspace goal before continuing its next
action.
10.6 -
Persist resumable research or implementation work with local checkpoints and evidence. Use when work benefits from state that survives interruption; skip simple tasks and one-response questions.
Goal
Keep the objective, acceptance check, current candidate, evidence, and next
action inspectable. The CLI owns record identity, revisions, digests, locking,
and interrupted-write recovery. Use it instead of editing canonical YAML or
generated README projections.
Ordinary tasks
Use an ignored workspace goal under out/<task>/goals/<goal-id>/. A project
goal under <owner-root>/goals/<goal-id>/ is appropriate only when the user
requests, or the project establishes, maintained history. Length alone does
not justify committed records. A question grants no new mutation authority.
Select an existing goal by stable ID and path before initializing another.
When identity is uncertain, use list --goals-root <root>. Initialize once:
For routine progress, supply a short summary, the exact candidate identity,
and the next action. Mark missing checks and inferred criteria honestly:
bazel_agent bazel run //projects/goal/cmd/goal -- checkpoint \
--goal-dir "<record>" --expected-resource-version "<observed-version>"\
--subject "<exact candidate>"\
--summary "<work performed, evidence, and checks still needed>"\
--next-action "<next concrete step>"bazel_agent bazel run //projects/goal/cmd/goal -- show --goal-dir "<record>"
--summary accepts up to 8192 bytes of inline Markdown and creates ordinary
plan/result artifacts internally. Optional --evidence <file.md> imports
immutable evidence. Later checkpoints replace the open attempt’s result and
update its candidate and next action. The initial plan and imported evidence
remain intact. Routine progress needs no separate plan ID, payload file,
process audit, or new attempt.
show returns objective, criteria, current resource version, and active
attempt progress with a bounded result preview, source paths, and digests.
Inspect the referenced result when truncated. Candidate and prose fields are
caller declarations, not live observations or proof of acceptance. Revalidate
only mutable inputs required by the recorded next action after interruption.
Carry the literal observed --expected-resource-version into each write.
If stale, reread and reconcile the intervening changes; never blindly replace
it with the latest version. Keep one coordinator for canonical goal writes.
A changed candidate needs a new summary or result; old evidence applies only
to the candidate it tested. Neither a checkpoint nor a successful command
establishes acceptance.
Finish or continue
Keep outcome (open, achieved, abandoned, superseded) separate from
execution (active, paused, waiting, blocked). Questions and scheduling
interruptions do not silently pause a goal or expand its authority. Honor
explicit pause or cancellation and resume authorized work after incidental
interruptions. Difficulty alone is not a blocker.
At acceptance, verify the exact result against every required criterion and
applicable regression. Close the attempt with checkpoint --close-attempt --review-file <review.yaml> and the final result/evidence; use --outcome achieved only when all required criteria pass. The review records criterion
IDs, revisions, verdicts, and evidence references. Read the
close review format when preparing it.
Closed attempts are immutable; corrections use a new attempt.
Checkpoint locally when work needs a reliable continuation point. A
conversational yield does not require committing, pushing, or running the
full delivery workflow. Use repo-delivery at a meaningful review-ready
milestone or final implementation handoff, and for an explicitly requested
remote backup. Deliver all legitimate source changes before final handoff;
keep scratch and workspace records ignored. Report a blocked or incomplete
publication honestly and distinguish a local checkpoint from a verified
remote copy.
Detailed and conditional workflows
For maintained project goals, repeated failures, or complex coordination,
read lifecycle and evidence for bounded
plans, attempt histories, review, and strategy changes. After the same defect
survives two attempts, change the approach and preserve its failure evidence.
Process reviews support that work; they are not routine checkpoint fields.
For checkpoint payloads, criteria changes, or validation errors, read
record format.
For registered goals, catalog-backed resume, session switching, or worker
coordination, read
sessions and concurrency.
For related goals and dependency-aware dispatch, read
graph organization.
Local storage, locking, formats, and graph boundaries
Goal architecture
The goal tool is a local CLI for one coordinator working on a goal at a time.
It edits ordinary files inside the workspace. It does not require a service,
daemon, database, controller, or network connection.
The tool release is 0.0.1. The independent resource-schema version is
goals.alwaldend.com/v1alpha1; v1alpha1 describes schema stability and does
not imply a stable tool release.
Goal pursuit loop
The pursuit loop belongs to the goal skill and its coordinator. The CLI does
not schedule or perform the work; it validates and checkpoints the state
transitions chosen by the coordinator.
Structured resources use Kubernetes-style YAML envelopes. Attempt plans,
results, and evidence are canonical, digest-bound Markdown artifacts;
README.md is a generated Markdown projection. A publication intent is
backend recovery metadata written before each multi-file mutation. A catalog
has this shape:
Lock files live under $XDG_RUNTIME_DIR/alwaldend/goal/locks/, outside the
workspace. They are local adapter state, not Kubernetes resources, and can
never be added to version control.
Update model
The orchestrator assigns one coordinator to a goal. The CLI independently
prevents overlapping cooperating processes. An attempt or lifecycle mutation
through checkpoint, a criteria update, or a relationship update follows this
path:
Resolve the canonical goal path, hash it into a lock path under
$XDG_RUNTIME_DIR/alwaldend/goal/locks/, and take an exclusive flock for
that goal.
Refuse to run while a publication intent is pending; read and validate the
current resources under the lock.
Reject a stale expected resourceVersion.
Build and validate the proposed resource values in memory.
Stage the exact after-images under .goal-publication-stage/ and install a
.goal-publication.yaml intent recording each path and its before/after
digest. The new-attempt directory is staged as one directory tree.
Publish goal.yaml with the advanced resource version as the optimistic-
concurrency commit point.
Publish the staged attempt directory with one rename when a new attempt
exists, or replace existing attempt files through sibling temporary-file
renames.
For a newly created attempt closed by the same checkpoint, finalize
goal.yaml at the same resource version.
Write the replaceable README.md projection last, remove the intent and
staging directory, and release the lock.
The first goal write for an immediately closed new attempt deliberately keeps
an active-attempt pointer until the attempt directory exists. The intent
remains on disk until the projection writes; after the commit point, an error
returns the committed Goal reference, names its advanced resource version, and
leaves the intent pending for recovery. A failure before the first goal.yaml
rename discards the intent and preserves the exact prior record.
goal doctor is a read-only classification command. With a pending intent it
reports the per-target state: stable, discardable-intent, staged-intent,
partial-intent, or conflict. Without one it reports stable, a
committed-projection-stale README-only issue, or a validation failure.
goal recover replays every remaining after-image for a staged or partial
intent, refuses a conflict, or discards a discardable intent to restore the
prior record. Normal mutations fail closed with a
goal publication is incomplete error while an intent is pending, so the
coordinator must run goal doctor then goal recover before continuing.
Reads and mutations use the same exclusive per-goal lock, matching the
single-coordinator ownership model and leaving one unambiguous holder PID.
Different canonical goal paths have different lock files and therefore do not
block one another. Lock files are never deleted as part of normal operation;
deleting a lock pathname while a process holds its inode would allow a second,
unrelated lock to be created.
The holder writes its PID into the lock file after acquiring flock for
diagnostics. The kernel lock, not PID-file existence, remains authoritative;
a clean release truncates the PID while still holding flock, while a crash
releases the kernel lock and leaves the last PID for diagnosis. The next
holder overwrites that stale PID. A PID is never authority to unlink or
recreate the persistent lock path because another waiter may already have its
inode open.
The operating system may clear XDG_RUNTIME_DIR after all processes have
stopped; no canonical state lives there. The command fails clearly when a
usable XDG_RUNTIME_DIR is unavailable.
The key includes the full canonical absolute path, not only the goal ID. Two
parallel workspaces can therefore operate on same-named goals independently,
while two symlink spellings of the same goal still coordinate through one
lock.
Legacy migration is a non-destructive two-path operation. It rejects equal or
overlapping canonical source and target paths, acquires their locks in sorted
order, and never writes into the source. The command builds a complete
<goal-id> below a hidden staging directory in the destination goals root,
runs the normal record validator there, rechecks that the target is absent,
and re-digests the source. It then publishes the staged goal with one directory
rename. A matching existing target is an idempotent result; any other existing
target is refused.
Promotion likewise acquires the distinct source and destination goal locks in
canonical-path order before it validates and publishes the destination.
The runtime directory is private to the current user. Each lock path is opened
without following a final symlink, then checked to be a regular, same-user,
single-link inode before use. The workspace side remains a cooperative
pathname boundary: the workspace and goal path must remain stable during a
command. The CLI rejects path escapes and observed symlinks, but it is not a
sandbox against another process running as the same user that races pathname
replacement.
Atomic rename prevents a reader from seeing a partially written file. A
command that replaces multiple files publishes them in a defined order; if it
is interrupted between renames, the pending publication intent records exactly
which after-images remain. Canonical state consists of validated YAML
resources and the exact plan.md, result.md, and evidence/*.md bytes whose
SHA-256 digests are stored in each attempt.yaml. Recognized temporary-file
residue is removed before validation; the generated README.md projection is
replaceable and non-canonical, and .goal-publication.yaml plus
.goal-publication-stage/ are transitive recovery state that must never be
committed to version control.
Graph model
Goal relationships are typed references in Goal.spec: parent, dependency,
and supersession. Catalog graph analysis is a pure, deterministic projection
of fully validated goal records, including their digest-bound Markdown
artifacts. Each edge kind is checked separately for cycles; missing references
remain unknown instead of being invented or silently accepted as resolved.
set-relationships replaces the dependency and supersession lists completely;
omitting the parent flag preserves the parent, while --clear-parent removes
it. Every accepted request advances metadata.generation and
metadata.resourceVersion, even when the requested normalized relationships
equal the current values. The command fully validates the target record under
its goal lock and rejects relationship changes while an attempt is active,
because attempts are bound to the goal generation and portable state digest.
It writes the authoritative goal.yaml first and refreshes the replaceable
README projection last.
Relationship updates reject a newly introduced cycle or an expansion of an
existing cycle for the affected edge kind. Existing unrelated cycles do not
block a repair, and shrinking the target’s existing cycle is allowed.
Cycle prevention is deliberately snapshot-scoped. The command assembles a
catalog view by reading each member under that member’s per-goal lock, then
validates and writes the target under its lock; it does not take a catalog-wide
lock. Two coordinators that concurrently change different goals can therefore
each validate before the other write and jointly create a cycle. This is the
accepted consequence of independent per-goal locking and the single-
coordinator ownership model, not a serializable graph transaction. After the
writers settle, a subsequent graph call reports the cycle deterministically
so a coordinator can revise one edge.
Task scheduling, live agent topology, messages, and runtime state remain
responsibilities of the agent harness. The local tool stores durable goal
relationships and evidence provenance as ordinary resources.
Kubernetes boundary
The YAML resources follow Kubernetes API conventions so a future adapter can
map them to CRDs. Local files are not directly applicable cluster objects.
Cluster use would still require structural CRDs, API-server-owned metadata,
status-subresource behavior, and a controller or client that maps Markdown
artifacts and local annotations.
That adapter would replace the filesystem lock and rename mechanism with
API-server concurrency. It must not carry the local lock files or emulate the
filesystem backend inside Kubernetes.
10.8 - Goal command
CLI for versioned local goal records
goal is the command surface for the repository goal skill. Portable resource
types and domain validation live in api/v1alpha1; deterministic local
persistence lives in internal/fsstore. The command keeps authoritative
Kubernetes-inspired YAML envelopes and digest-bound attempt Markdown separate
from the bounded generated README.md projection, uses the same record format
for workspace and project goals, and stores session focus separately under
ignored workspace scratch.
<owner-root>/goals/<goal-id>/ is the preferred project placement, not a CLI
constraint. Direct initialization, promotion, and migration also accept other
safe in-workspace goals roots while recording the explicit owner root.
The YAML objects use apiVersion: goals.alwaldend.com/v1alpha1 and the kinds
Goal, GoalCriteria, GoalAttempt, and GoalSessionBinding. Their
envelopes validate Kubernetes-compatible qualified metadata keys and label
values and use object-shaped local goal references. The shared API treats
resourceVersion as opaque. The filesystem backend allocates canonical local
numeric versions and requires complete persisted metadata. The files are not
raw kubectl input, and this project supplies neither CRDs nor a controller.
Run it through Bazel:
bazel_agent bazel run //projects/goal/cmd/goal -- init \
--goals-root out/example/goals \
--goal-id verify-the-release \
--title "Verify the release"\
--criterion "All affected tests pass"
Use a task-specific binding directory when changing session focus:
bazel_agent bazel run //projects/goal/cmd/goal -- attach \
--session-root out/example/goal-sessions \
--session-id current \
--goal-dir out/example/goals/verify-the-release
GoalSessionBinding.spec.goalRef contains the stable object name. The
namespaced annotation goals.alwaldend.com/local-goal-ref contains the
workspace-relative storage path. Session bindings never create a repository-
global catalog.
Goal.metadata.annotations[goals.alwaldend.com/local-owner-root] contains the
workspace-relative owner used only by the local adapter. It is deliberately
absent from portable Goal.spec and portable digests.
Commands are init, list, resume, show, attach, checkpoint,
learning-proposal, graph, set-relationships, validate, promote,
render, and migrate.
set-relationships replaces the complete dependency and supersession lists;
the parent is preserved unless explicitly set or cleared. It requires no
active attempt, advances Goal generation and resource version on every accepted
request, and refreshes the bounded README projection. Its cycle check is a
per-goal-locked catalog snapshot rather than a catalog-wide transaction, so a
graph call after concurrent writes settle is authoritative.
resume requires --catalog, resolved relative to --goals-root, and prints
a bounded GoalResumePacket containing only open goals with a resumable
attempt. The packet carries candidate paths and structured continuation
fields; it never mutates records or opens goal plans, results, or evidence.
The strict decoder validates catalog structure and its stored digest, not
freshness against current goal records. Use show --goal-dir for current
local state.
learning-proposal validates one Phase 5 proposal. Repeated friction references
are required, but the command never promotes the proposal or edits source; the
owning project adopts it through ordinary review and delivery.
checkpoint starts or publishes an attempt, changes execution/outcome state,
or applies a complete desired criteria-items file with --criteria-file.
For ordinary work, initialize the objective and acceptance once with init --title ... --criterion ..., then use an inline checkpoint:
bazel_agent bazel run //projects/goal/cmd/goal -- checkpoint \
--goal-dir out/example/goals/fix-parser \
--expected-resource-version 1\
--subject "candidate digest or source revision"\
--summary "Parser repaired; focused checks remain unverified."\
--next-action "Run the parser acceptance check."bazel_agent bazel run //projects/goal/cmd/goal -- show \
--goal-dir out/example/goals/fix-parser
--summary is nonblank UTF-8 Markdown, limited to 8192 bytes, and requires
--subject and --next-action. It cannot combine with --plan-file or
--result-file. The store generates the initial plan from the objective,
criteria, and next action, then writes progress into the existing canonical
result.md. Later checkpoints reuse the open attempt, preserve its initial
plan and imported evidence, and update the declared subject and next action.
Changing an existing subject requires a replacement summary or result;
retained evidence applies only to the candidate identified in that evidence.
A next-action-only checkpoint is also supported.
show includes activeAttempt with current continuation fields, an 8192-byte
UTF-8 result preview, complete result byte count/digest, evidence digests,
observation time, and source paths relative to the goal directory. Its
resultTruncated field indicates when the canonical result needs a separate
read. Subject and progress are caller declarations, not live Git observations
or criterion verdicts. Initialization, summary checkpoints, and bounded views
use the same store and recovery protocol as detailed attempts; there is no
separate compact record format. Closing still requires an explicit
--close-attempt --review-file with criterion verdicts and evidence; a
summary does not imply acceptance.
Detailed attempts can provide separate plan, result, and review payloads.
Plans are durable summaries in Goal.status.plans. Create one with
--plan-id ... --plan-strategy ... --plan-only; transition the active plan
with --plan-id ... --plan-state accepted|rejected|superseded --plan-only,
adding --plan-rejection-reason for a rejection. A newly created active plan
supersedes the prior active plan. Attempts may bind to a plan with
--plan-id when starting or by using the active plan of an existing attempt.
Criteria updates require paused execution and use ordinary atomic file
replacement. Immutable criteria snapshots retain the exact canonical criteria
revision for historical attempts; portable, domain-separated criteria and
goal-state digests avoid binding durable records to local resource-version
tokens. Closing an attempt requires --review-file with an accept, refine,
or reset decision and per-criterion verdicts linked to frozen plan, result,
or evidence artifacts.
The review file is plain YAML with exactly two keys. Criteria entries must be
sorted by criterionID, and evidenceRefs must be unique, sorted, and name
only frozen artifacts (plan.md, result.md, or files under evidence/).
Verdicts are pass, fail, or unverified; a non-unverified verdict
requires at least one evidence reference. Do not add apiVersion or kind
headers:
An achieved outcome must close an accepting attempt whose exact passes cover
every current required criterion. Structured verdicts are kept in
attempt.yaml; richer narrative stays in result.md.
For attempt and lifecycle checkpoints, a new attempt is fully staged before
goal.yaml advances its resource version. That goal write is the optimistic-
concurrency commit point; canonical attempt content follows, and README.md
is last. An immediately closed new attempt uses an intermediate active pointer
until its directory is published and the Goal is finalized at the same
resource version, so interruption at either gap fails validation. The store
returns the committed Goal reference after any post-commit failure, and the CLI
error identifies that resource version.
Promotion also requires a paused workspace goal and preserves the goal name,
portable input bindings, immutable criteria history, and content-digest
provenance. It rejects known absolute workspace/file links in promoted attempt
artifacts; callers remain responsible for semantic privacy and credential
review.
Migration is a non-destructive import, not an in-place conversion. The legacy
source remains unchanged, while a complete validated record is published at
<destination-goals-root>/<goal-id> with one final directory rename. Repeating
the same import is idempotent only while source provenance and import options
match the existing target.
Mutations to an existing Goal’s canonical state take an exact expected local
resource version. Cooperating processes serialize them with an advisory lock
keyed to the canonical goal path under
$XDG_RUNTIME_DIR/alwaldend/goal/locks/, reread the manifest while holding the
lock, and replace individual files by renaming sibling temporary files. Lock
files are outside the workspace and cannot enter version control. Different
goals do not share a lock. Local owner and session-link annotations are
workspace-relative normalized paths; absolute host paths are never written to
manifests or command output.
Each individual file replacement is atomic; commands that update several files
do not claim cross-file transaction semantics. README.md is a derived
projection and is written last. Plan, result, and evidence Markdown is instead
canonical through the SHA-256 artifact manifest in attempt.yaml. Direct file
writers are outside this cooperative trust boundary, and digest validation
makes later edits detectable. Execution and outcome transitions advance
status.lifecycleGeneration, invalidating in-flight attempt input bindings.
This experimental v1alpha1 format is a local file protocol. One coordinator
should own a goal record. Delegated workers write only to isolated scratch;
the coordinator imports selected artifacts through checkpoint.
10.9 - Goal evaluations
Goal evaluations
This suite records the semantic contract for persistent, evidence-backed goal
pursuit. The required offline Bazel target validates the Promptfoo
configuration, referenced cases, and staged skill without making a model call.
The cases cover research routing, workspace-versus-project ownership, explicit
session focus, stale-update reconciliation, honest acceptance,
result-prioritized modular work, isolated candidate promotion, and
critical-path delegation, compact local checkpoints, meaningful publication
milestones, and explicitly requested remote backup. Concurrency cases require active delegation when a
long-running goal exposes multiple independently reviewable workstreams,
require a recorded reason for sequential execution, and reject fanout whose
only purpose is occupying available slots. The interruption case distinguishes
turn priority from lifecycle state: questions and additional tasks do not
silently stop an already-authorized active goal or expand its authority.
A live target is omitted because representative behavior spans multiple turns
and requires filesystem tools, safe writable fixtures, and fresh-session
resume. A tool-free single response cannot verify those longitudinal
postconditions. Promptfoo validation therefore proves only that these assets
load. Deterministic store behavior is covered by
//projects/goal/internal/fsstore:go_test; a future
model eval still needs an isolated multi-turn workspace fixture.
The static storage case covers the ordinary one-goal boundary: one path-keyed
goal lock plus atomic per-file rename. Promotion and migration use a separate
two-path protocol that acquires distinct source and destination locks in
canonical-path order.
11 - Hugo Landing
Reusable Hugo landing site for project pages
hugo_landing packages a reusable Hugo landing site. al_hugo_landing
combines the shared source with one project README and emits a Hugo-ready
source archive.
al_hugo_landing_site also builds the rendered site.
Usage
al_hugo_landing(
name ="landing_site",
docs ="//projects/goal:docs",
project ="goal",
title ="Goal",
docs_url ="https://alwaldend.com/docs/projects/goal/",
repository_url ="https://github.com/alwaldend/src",
)
al_hugo_landing_site(
name ="site",
docs ="//projects/goal/docs:docs",
project ="goal",
title ="Goal",
docs_url ="https://alwaldend.com/docs/projects/goal/",
repository_url ="https://github.com/alwaldend/src",
)
Site collection
Each project owns its rendered landing target at
//projects/<project>/landing:site. The shared macro remains in
hugo_landing so the visual shell and README-to-site transformation stay
reusable.
projects/projects.bzl lists the dedicated project sites; the
project directory links to each site. The existing
alwaldend.com apex site covers that project. Nested rules modules use
//projects/hugo_landing/landing:<project> targets in the root workspace.
README-relative links lead to their source files on GitHub, and relative images
load from the matching source directory. Literal template examples are preserved;
Hugo shortcodes requiring the full documentation site are omitted.
Publish project sites
Build and validate all sites from the repository root:
bazel_agent bazel test //projects:landings //infra/dns:config_test
The authenticated deployment command uses the operator’s Git executable and
GitHub authentication. It intentionally accesses GitHub at runtime; builds do
not deploy. Supply an absolute, task-owned scratch directory:
bazel_agent bazel run //projects:deploy_landings -- --scratch /absolute/worktree/out/site-rollout/git
Each site is pushed to alwaldend/<project-slug>-landing on the pages branch
with CNAME and .nojekyll. Existing branch history is preserved, unchanged
sites produce no commit, and empty repositories can be bootstrapped. Use
--dry-run to stage and compare without pushing. The deployment tool validates
every input before publishing and stops on the first failed project.
Add --project <project_id> to publish only one registered site.
Repository creation and Pages settings belong to
GitHub Terraform. DNS records belong to
projects/<project>/dnsconfig.json and are applied through
DNSControl. Review each plan or preview and apply
only the authorized project-site changes. Verify the published commit, Pages
build, DNS, and HTTPS response before calling a rollout complete.
12 - Infinitime
InfiniTime firmware fork with a text watchface and Pomodoro app
This InfiniTime firmware fork adds a text watchface and a Pomodoro app. The
repository packages the pinned firmware source and its build dependencies.
The root workspace declares the pinned firmware with use_repo_rule in
include.MODULE.bazel, preserving recursive Git submodules and the CMake
toolchain patch. Firmware source is fetched when referenced, rather than
during module resolution. Its Python/npm lockfiles and SDK archives retain
the upstream pins; Python and Node runtimes use the root workspace toolchains.
The project re-exports pip and npm with separate extension identities so
unrelated Python/npm targets do not fetch firmware to read those lockfiles.
The isolated pip extension declares the Linux x86_64 host platform used by
the pinned ARM compiler archive.
bazel mod deps deliberately evaluates all extensions and can still fetch it.
Validate the firmware with bazel test //projects/infinitime:build_test.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
LeetCode submission export and documentation tools
This project exports LeetCode submissions and generates documentation from
submission files using a CLI and Bazel rules. A Tampermonkey script provides
a browser-based download path; direct CLI downloads are currently blocked by
LeetCode bot protection.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Make Harbor-backed OCI targets opt-in through –config=harbor while retaining default documentation and non-image tests. Regenerate the Python Gazelle manifest and Bazelrc preset.\n\nThis commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Make Harbor-backed OCI targets opt-in through –config=harbor while retaining default documentation and non-image tests. Regenerate the Python Gazelle manifest and Bazelrc preset.\n\nThis commit was generated by an LLM.
Workspace-local runtime packages behind a stable MCP server
mcp_cordis is a standalone stdio MCP server that mounts runtime JavaScript
packages through Cordis.
It is intentionally an MCP server, not a Codex plugin bundle.
Reusable definitions are ordinary ESM files in
projects/mcp_cordis/plugins, listed by projects/mcp_cordis/cordis.yaml.
Disposable definitions use the same layout under
out/<task>/mcp_cordis/runs/<run>/. Each run writes a bounded manifest with
explicit task, run, worker, information, budget, retention, lock, and cleanup
fields. AGENT_TASK_ID, AGENT_RUN_ID, and AGENT_WORKER_ID may provide
stable identities; the launcher otherwise creates process-scoped identities.
Every
package is addressed by both scope and name, so a scratch package never
silently shadows a reusable package.
Run
The repository’s .codex/config.toml registers mcp_cordis as a
project-scoped stdio server. Codex loads that file for a trusted workspace and
finds the active Git worktree before starting the server. Separate clones and
worktrees therefore use their own source, projects/mcp_cordis packages, and
task/run-namespaced scratch packages. Trusting the repository’s root checkout
also covers its linked worktrees; a glob trust entry is neither needed nor
supported. A new Codex session is needed after the MCP registration itself is
first added; package changes after that do not require another session.
The registration calls cmd/mcp_cordis/launch.sh. With a current installed
bazel_agent, the launcher selects a content-addressed runtime from the
per-user tool cache and executes it directly. The first exact source version
is built and atomically installed under a per-key lock; subsequent worktrees
with the same inputs do not start Bazel or load a configured graph. An older
runner falls back to asking Bazel for a launch script under the task’s ignored
out directory. Either path releases Bazel’s output-base lock before the
long-lived stdio server starts, so builds and tests can run normally while
Codex remains connected.
The cached artifact contains the stable server runtime and pinned JavaScript
dependencies, but not cordis.yaml or reusable plugins. It always reads those
from the explicit active workspace, so editing a package changes live behavior
without repackaging the runtime or selecting a new cache key.
The same project configuration starts an optional asynchronous SessionStart
hook that starts the worktree’s Bazel server and warms repo_delivery. It
produces no session context, ignores failure, and never queries the whole
workspace graph. Cordis itself is already warmed by its MCP launch path, so the
hook does not start a duplicate Cordis build.
To build and run the server directly from the repository root:
The workspace root is mandatory unless BUILD_WORKSPACE_DIRECTORY is
present. The checked-in launcher resolves the current Git worktree explicitly
and supplies that path to the server.
The fixed cordis_* tools define, start, inspect, invoke, update, stop,
remove, and promote packages without reconnecting the MCP client. Package
handlers are called through cordis_invoke; this remains reliable even when
an MCP client caches its initial tool list.
Cordis configuration and plugin format
cordis.yaml uses the standard Cordis Include entry-list format:
- id: helloname: ./plugins/hello.mjs
The referenced file is a normal ESM Cordis plugin:
Cordis normalizes an object plugin to its apply callback. Attaching the
optional package description to that callback exposes it through
cordis_list and cordis_inspect; tool descriptions remain part of each
ctx.tool() definition.
The server mounts the official Cordis Loader, Include, and HMR services.
cordis_define syntax-checks and atomically persists the ordinary module.
Creating or enabling an entry refreshes any cached module through Cordis HMR,
then uses the public Include refresh API and waits for activation. Updating an
already-running entry returns activation: "pending"; poll cordis_invoke or
cordis_list_tools until the new behavior is visible.
The reproducibly pinned HMR package carries a focused pnpm patch that
serializes module reloads and drains source changes arriving during an
in-flight reload, so the latest persisted source is not lost.
Syntax errors are rejected before the file changes. Evaluation and apply()
failures follow native Cordis HMR behavior; the wrapper does not add a second
activation transaction around them. It also does not inject source markers,
inspect Loader caches, correlate watcher events, or maintain its own source
rollback/version store. Reusable history is normal Git history. Manual edits
to watched plugin files are also picked up by Cordis HMR.
Runtime modules use normal Cordis semantics, including static imports,
top-level await, and asynchronous apply(ctx, config). Package code is
trusted: a never-settling module evaluation or activation can therefore stall
Cordis lifecycle work. The stdio launcher reserves its protocol stream and
redirects package stdout to stderr, keeping accidental console.log() calls
off the JSON-RPC wire.
The package context exposes ctx.workspaceRoot, ctx.resolveWorkspace(),
ctx.readText(), and structured ctx.exec() in addition to ctx.tool().
ctx.exec() returns code, signal, stdout, stderr, truncated, and
outputLimitExceeded; maxBytes is a combined stdout/stderr budget. By
default, exceeding that budget or producing invalid UTF-8 rejects with
EXEC_OUTPUT_LIMIT or EXEC_INVALID_UTF8. Packages that explicitly set
allowTruncatedOutput: true instead receive the valid retained prefix with
truncated set; outputLimitExceeded distinguishes the byte cap from UTF-8
loss. A Fiber-owned supervisor admits each launch atomically, and results
settle only after the direct child and every live member of its original Linux
process group have stopped. Limits, timeouts, and plugin disposal use the same
cleanup path. A process that deliberately creates a new session escapes that
group and is outside this trusted-package contract. ctx.exec() therefore
fails closed with EXEC_UNSUPPORTED_PLATFORM away from Linux. Package code
also has normal Node built-ins; this host is a reliability boundary, not a
security sandbox.
cordis_invoke.timeout_ms bounds how long the gateway waits for a result; it
does not cancel an already admitted JavaScript handler. The handler keeps its
Fiber lease until it finishes, so stop, remove, and shutdown wait for it.
Cordis HMR waits for a retired Fiber to finish draining before it activates
and publishes the replacement, so a live invocation can delay a reload. Any
ctx.exec() launched by a timed-out invocation is cancelled and its process
group is confirmed stopped before the timeout response settles.
Included packages
repo_context: bounded repository reads and searches.
git_worktree: read-only branch, status, log, and comparison snapshots.
network_probe: DNS, TCP/TLS, and HTTP diagnostics.
These were selected from aggregate recurring task categories in recent local
sessions. No transcript content, credentials, or private outputs are included.
Durable goal
Future runtime-extension work should resume from the maintained
runtime extensions goal, which records acceptance
criteria, decisions, failed attempts, and supporting evidence.
Dependency notices
The runtime directly uses @deepseek-ai/cordis, its official Loader, Include,
HMR, and Timer plugins, and the Model Context Protocol TypeScript SDK. Their
license texts are retained in the resolved package artifacts by the pinned
pnpm/Bazel dependency graph.
15.1 -
MCP Cordis goal
This is a durable project goal. Future work should resume from the current
attempt and preserve accepted evidence and strategy changes here.
Goal
Deliver a standalone, workspace-local MCP server at projects/mcp_cordis
that reuses Cordis for hot runtime packages, persists reusable packages in
the project, stores disposable packages under out/mcp_cordis, and ships
useful non-sensitive starter packages derived from recurring past-session
work.
Status
Complete: the delivered MCP is a thin wrapper around official Cordis Loader,
Include, HMR, and Timer packages. Reusable modules use project-local
cordis.yaml; disposable modules use ignored workspace output. The final
hosted review corrections bind repository reads, searches, directory
inspection, and Git commands to verified file or directory handles, bound
permanent process-inspection failures, and remove a process-start timing
assumption from cleanup coverage.
Complete: correct all three valid review findings with regression tests.
Complete: independently review Attempt 4; verdict was refine.
Complete: correct the independent-review gaps in Attempt 5 and pass the
focused, integrated, build, validation-aspect, and Buildifier gates.
Complete: obtain independent review; verdict was refine.
Complete: implement Attempt 6’s lifecycle, compatibility, package,
and skill-policy corrections, including the second-review strategy reset.
Complete: reject the custom package-manager architecture after the
user’s standard-solution review and freeze Attempt 7.
Complete: implement official Cordis Loader, Include, HMR, normal
modules, and standard cordis.yaml storage.
Complete: rerun every invalidated focused and integrated validation
gate and obtain fresh independent review. Review accepted c05bd45a with
no actionable findings.
Complete: rebase, validate the exact aggregate commit, republish PR 32,
resolve its review threads, and verify the remote candidate. The remote
head matched the accepted local candidate after publication.
Complete: correct the hosted review’s recursive fallback, byte-offset,
and UTF-8 preview findings; pass focused regressions and the complete MCP
test/build/Buildifier packet.
Complete: correct the follow-up review’s Unicode case-fold, explicit
file/glob, and partial-startup listing findings; rerun the same gates.
Complete: correct unavailable-scope and bounded-read endpoint findings;
use fresh diff scrutiny to fix repeated-startup error loss and natural-body
UTF-8 handling; update repo-delivery to require correctness revalidation
after code changes.
Complete: replace the rejected transactional source-HMR protocol with
atomic persistence plus Cordis HMR and reproduce the remaining native HMR
overlap race independently.
Complete: serialize and drain HMR reload work in the reproducibly
pinned dependency, retain the fallback corrections, and rerun every
invalidated local delivery gate.
Complete: consolidate the exact owned range, reconcile the advanced
base’s skill-discovery and goal layout, validate the literal rebased
candidate, publish it, and reconcile hosted review.
projects/mcp_cordis is a documented, Bazel-built standalone MCP stdio
server and is not coupled to a Codex plugin manifest.
The server demonstrably uses Cordis lifecycle primitives rather than a
separately invented plugin framework.
One connected MCP client can define, start, inspect, invoke, update, stop,
and remove a runtime package without restarting the server.
MCP source writes are syntax-checked and atomically persisted. Existing
running entries are handed to Cordis HMR without a private
acknowledgement protocol. The MCP does not promise synchronous activation,
broad activation rollback, or restoration of prior on-disk bytes. Native
Cordis failure behavior remains intact. The pinned HMR dependency serializes
reload work and drains later observed writes so an in-flight replacement
cannot discard the latest persisted source. Git owns reusable source
history; the runtime does not invent a second version store.
Reusable package source is stored beneath
projects/mcp_cordis/plugins; disposable source and configuration resolve
beneath the current workspace’s out/mcp_cordis.
Reusable packages reload after an MCP server restart. Disposable packages
have an explicit promotion path into the reusable library.
At least three useful, non-sensitive starter packages are justified by
recurring prior-session tasks and have executable tests.
Stable gateway tools allow immediate invocation even if a particular MCP
client does not refresh dynamically registered schemas.
Focused tests, builds, repository formatting checks, and an end-to-end MCP
transcript pass for the exact delivered candidate.
On Linux, ctx.exec() results, execution timeouts, and plugin disposal
settle only after the direct child and live members of its original process
group stop. A trusted package that deliberately creates a new session is
explicitly outside that guarantee; unsupported platforms fail closed.
cordis_invoke.timeout_ms is a response deadline, not handler cancellation;
the admitted handler retains its Fiber lease until completion.
Trusted Codex sessions discover the MCP from the checked-in
.codex/config.toml in the active clone or linked worktree. Server startup
releases Bazel’s output-base lock before serving stdio, and source plus
disposable state remain scoped to that worktree.
Evidence plan
Unit tests cover validation, standard Cordis entries, lifecycle disposal,
persistence roots, eventual reload, and promotion.
An MCP integration test drives initialize/list/define/run/invoke/update/stop
over stdio without restarting the process.
A restart test proves reusable package recovery.
Package tests execute every starter package through the same runtime path.
Process regressions cover normal results, output limits, valid UTF-8 prefix
retention, timeout, disposal, and rejection of launches after disposal.
HMR regressions write a second generation during slow top-level evaluation
and slow asynchronous activation, then require convergence to the latest
persisted generation.
Pinned HMR patch: standard pnpm patch that
serializes the package’s module reload task and drains newly stashed URLs.
Review verdict: exact-package apply check and focused regressions pass.
Attempt 9 plan: atomic persistence plus official Cordis
Include/HMR, with the custom source-marker and acknowledgement transaction
removed. Review verdict: refine after reproducing an HMR overlap race.
Published candidate review reset, 2026-08-30
Attempt 8 review corrections: fail-closed recursive
fallback, UTF-8 byte offsets, and valid-prefix HTTP previews. Review verdict:
accepted locally with focused and complete package evidence.
Attempt 7 current record: official Loader, Include, and
HMR architecture using cordis.yaml and normal ESM modules. Review verdict:
active replacement candidate; exact delivery gates remain open.
Attempt 6 historical record: rejected worker/version-store
architecture, its package hashes, and focused evidence. Review verdict:
superseded by the standard Cordis architecture in Attempt 7.
Attempt 5 candidate and validation packet: exact
implementation, immutable hashes, and current test/build results. Review
verdict: rejected by the completed independent review.
Attempt 5 plan: exact response to independent review’s
semantic and evidence gaps. Review verdict: proceed.
Current MCP Cordis README: documents standard Cordis config,
ordinary reusable modules, disposable out modules, HMR, and the bounded
ctx.exec() contract. Review verdict: current working-tree interface.
Imported decision-review skill:
immutable PR 24 instruction payload, now packaged with current offline
validation. Review verdict: Bazel validation passes.
Attempt 3 commit:
immutable published candidate. Review verdict: rejected as final after
review.
PR 32: evolving delivery vehicle
for the runtime-extension goal.
PR 24: provenance for the newly
requested projects/agents subtree. Review verdict: import its four scoped
changes only, merged against the current base.
Attempt 4 plan: frozen hypotheses, boundaries, and gates
for the import and initial review corrections. Review verdict: rejected as a
final candidate by independent source review.
Final local candidate, 2026-08-30
Attempt 3 evidence: OIDs, direct rebase
parent, forced test/build/format results, and the historical delivery state.
Review verdict at the time: accepted locally, then superseded after
publication by three valid review findings.
Attempt 3 record: preserved implementation and
user-facing interface evidence for that historical local candidate. Review
verdict: accepted at the time, then superseded by review findings.
Rebased Attempt 2, 2026-08-30
Attempt 2 evidence: exact task-only rebase
evidence for commit e3e74cb1 onto 7ad2704c. Review verdict: accepted as
rebase evidence, not as the final candidate because integrated lifecycle
evidence was nondeterministic.
Attempt 2 record: preserved documentation and evidence
for the rebased server and runtime interface. Review verdict: implementation
retained for Attempt 3; final validation was pending.
Attempt 1
Attempt 1 record: preserved runtime/interface artifact.
Review verdict: rejected as a final candidate because one included package
had an undeclared runtime dependency.
Attempt 11: consolidate the owned range, reconcile the advanced
base, validate and publish the exact rebased candidate, then incorporate and
reconcile the final hosted review. Complete.
Attempt 10: keep the thin wrapper and patch pinned Cordis HMR to
serialize reloads and drain writes arriving during an in-flight reload.
Complete locally and carried into Attempt 11.
Attempt 9: simplify source updates to validated atomic persistence
plus Cordis HMR, deleting the private acknowledgement transaction. Refined
after independent review reproduced a lost overlapping update.
Attempt 8: correct the final hosted review’s fallback filtering,
byte-offset, and UTF-8 body-preview findings. Complete locally.
Attempt 7: replace the custom manifest/version store and worker
generations with official Cordis Loader, Include, HMR, standard
cordis.yaml, and normal modules. Delivered, then refined by Attempt 8.
Attempt 6: make bounded execution backward-compatible, close
process/lifecycle admission races, publish exact package completeness, and
replace worker-side spawning after independent review. Rejected because its
package persistence model was custom rather than standard Cordis.
Attempt 5: make every output-loss signal and bounded Git result
exact, then cover the imported skill behaviors. Refine after independent
review found lifecycle, compatibility, and policy defects.
Attempt 4: import PR 24’s scoped agent guidance, then correct the
three valid PR 32 review findings. Refine after independent review.
Attempt 3: replace a lifecycle test’s elapsed-time inference with
a deterministic started/release handshake. Published, then superseded by
review findings.
Attempt 2: retained the proven runtime and added a bounded search
fallback for hermetic portability. Starter packages pass; refine because
the integrated lifecycle evidence was timing-dependent.
Attempt 1: direct Cordis runtime with MCP v2, worker-isolated
generations, two-tier immutable persistence, and three starter packages.
Rejected because one starter package required an unavailable executable.
A small adapter around @deepseek-ai/cordis@4.0.1 can provide durable,
transactional runtime packages behind a fixed MCP stdio surface without
embedding DeepSeek Harness or restarting the MCP connection.
Exact inputs
Parent checkpoint: task-start state of branch
t3code/runtime-modifiable-plugin
Cordis: @deepseek-ai/cordis@4.0.1
MCP server/client: @modelcontextprotocol/server@2.0.0 and
@modelcontextprotocol/client@2.0.0
Node: repository-pinned Node 24.13.0
Package source contract: one import-free JavaScript expression returning a
Cordis plugin with apply(ctx)
Candidate plan
Add an ordinary Bazel package with a dedicated exact pnpm lock.
Persist definitions as content-addressed immutable source plus atomic
manifests under explicit project and scratch roots.
Evaluate each generation in a worker, mount it through a real Cordis
Context and Fiber, and register handlers through Cordis effects.
Activate transactionally: prove the candidate ready, swap the active
pointer, drain in-flight calls, then dispose the prior Fiber exactly once.
Expose fixed MCP tools for list, inspect, define, run/reload, invoke, stop,
remove, and promote; never rely on dynamic MCP schema refresh.
Seed and execute repo_context, git_worktree, and network_probe through
the same runtime path.
Added project and scratch scopes, promotion, recovery, and three starter
package definitions.
Added lifecycle, in-memory MCP, subprocess stdio, and package execution
tests.
Verification evidence
bazel_agent bazel query //projects/mcp_cordis:all: pass after the pnpm v10
declaration and starter catalog were present.
bazel_agent bazel test //projects/mcp_cordis:runtime_test: pass. This covers
real Cordis contexts/effects, immutable versions, rollback, drain, scopes,
promotion, restart, removal, isolation, and fixed MCP invocation.
bazel_agent bazel test //projects/mcp_cordis:stdio_test: pass. One stdio client
hot-updated v1 to v2 without a process change; a new server process recovered
the project package.
bazel_agent bazel test //projects/mcp_cordis:starter_packages_test: fail because
repo_context_search received spawn rg ENOENT in the hermetic test PATH.
Acceptance results
Pass: documented standalone stdio server built and exercised by Bazel.
Pass: source and runtime tests use Cordis Context, Fiber await/dispose,
and effect cleanup.
Pass for implemented lifecycle operations; fixed MCP use is proven on one
connection.
Pass: content hashes, failed syntax/startup rollback, and v1/v2/v3 behavior
are exercised.
Pass: roots and exact scope identity are exercised in isolated workspaces.
Pass: promotion and server-only project recovery are exercised.
Fail: the Git and network package paths were not reached after the
repository search package required an unavailable rg executable.
Pass: in-memory and real stdio tests invoke new handlers through the stable
gateway without reconnecting.
Unverified: the full integrated fixed regression set has not run.
Progress, approach, and process audit
Criteria 1–6 and 8 improved from unverified to measured passes. Criterion 7
is an absolute portability failure, not merely a weaker result.
Passing lifecycle and stdio tests support retaining the direct Cordis,
worker, storage, and fixed-gateway representation.
The highest-leverage problem is removing the starter package’s undeclared
executable assumption while retaining ripgrep as a fast path.
Continue the architecture but revise repo_context_search; no evidence
supports discarding the runtime foundation.
The largest avoidable delay was 144 seconds in a failed test whose worker was
not registered for unconditional teardown. node:test cleanup now registers
before assertions, reducing the next failure cycle to under a second.
The next feedback loop starts with the single starter target and only then
returns to the integrated regression set.
Attempt 1’s repo_context_search cannot execute when ripgrep is unavailable
from the runtime PATH, preventing all starter packages from passing their
portable Bazel execution test.
Hypothesis
Keeping ripgrep as the preferred engine but falling back on a bounded Node
filesystem search will preserve normal-machine speed and make the reusable
package functional in hermetic or minimal environments.
Preserve all runtime, storage, MCP, and other starter-package code.
Add a bounded fallback with workspace path checks, file/byte/result limits,
fixed or regex matching, context lines, and basic glob filtering.
Store it as a new immutable repo_context version; retain Attempt 1’s source
version in its manifest history.
Rerun the starter test first, then the complete focused package checks.
Planned review packet
Search succeeds without rg in Bazel’s test PATH.
Traversal outside the workspace remains rejected.
All eight starter tools execute through loaded Cordis Fibers.
Previously passing lifecycle and real stdio checks remain green.
Verdict
Refine. The rebased candidate commit
e3e74cb1e573867825347292bf17220a5b9a4a0c fixes criterion 7, but its final
integrated regression failed because the lifecycle test used elapsed time to
infer that an invocation remained in flight.
Work performed
Added a bounded pure-JavaScript fallback as immutable repo_context
version
fd10633b1569665764e9a526f2cfaf38d1847ee9842934258cefc25f08ea9050
while preserving ripgrep as the preferred engine and retaining the original
version in manifest history.
Rebased the complete task commit onto fetched remote master7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d with no conflicts. The resulting
tree is 079a0c27b86527c6950cc75b0c8b9dbf572d3e4b.
Verification evidence
Pre-rebase
bazel_agent bazel test //projects/mcp_cordis:starter_packages_test: pass. All
eight tools executed, including search without rg.
Post-rebase bazel_agent bazel test //projects/mcp_cordis:all: three of four test
targets pass. runtime_test fails at its drain-count assertion with actual
0, expected 1.
The test starts a 150 ms invocation, waits only 20 ms, and then starts a new
worker before swapping generations. Candidate startup has no upper bound
below the old invocation’s delay, so the test does not prove the invocation
is still active at the swap.
Acceptance results
Pass in the integrated build test.
Unverified for final acceptance because the lifecycle regression did not
complete.
Unverified for final acceptance for the same reason.
Unverified for final acceptance for the same reason.
Pass in the previously focused storage/lifecycle evidence; final rerun is
still required.
Pass in the subprocess stdio target; final rerun is still required.
Pass on the exact rebased candidate through the starter-package target.
Pass on the exact rebased candidate through the stdio target.
Fail: the complete fixed regression set is not green.
Progress, approach, and process audit
Criterion 7 measurably improved from fail to pass; no starter package now
assumes ripgrep is installed.
The runtime representation did not regress. The failing value demonstrates
that the old request finished before the atomic swap, which is permitted;
the test’s elapsed-time setup failed to establish its own precondition.
The highest-leverage issue is evidence quality, not another runtime rewrite.
Attempt 3 should preserve all delivered runtime bytes and replace only the
drain test’s wall-clock inference with a deterministic cross-worker latch.
The requested rebase and adapter compilation dominated this cycle’s wall
time. Focused query feedback fell to under two seconds once caches were warm.
The integrated lifecycle test assumes that a 150 ms invocation remains active
after a new worker has started. Under parallel Bazel execution, the candidate
can become ready only after that invocation has completed, making the expected
drain count nondeterministic.
Hypothesis
A file-backed started/release handshake in the test package will establish the
in-flight precondition independently of worker startup speed and prove that a
generation swap reports and drains exactly one old invocation.
Base commit: 7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d
Preserve all product runtime, storage, MCP, package, and build files.
Extend only the lifecycle test fixture with optional started/release paths.
Wait for the started marker before activation, keep the old handler blocked
until after the drain count is observed, and release it in finally so a
failed assertion cannot strand teardown.
Rerun the focused lifecycle target first, then the entire recorded regression
set on one amended candidate.
Planned review packet
The test contains no fixed request duration or startup race.
Replacement reports exactly one draining call.
The old call returns v2 and the next call returns v3.
Cordis cleanup still runs exactly once.
All project, buildifier, and diff checks pass on the same commit tree.
Verdict
Accept as the final local candidate. Commit
7cfef0719075ad372c3bb257ad216b35770356b2 and tree
34153eca0f582af5c641f81bf8c7209b0045ab9a pass the entire evidence plan.
Remote delivery is pending separate authorization.
Work performed
Replaced the 150 ms elapsed-time assumption with workspace-local started and
release markers in the lifecycle test fixture.
Proved the new v3 generation serves calls while the old v2 invocation remains
blocked, then released v2 and proved its Cordis effect disposes exactly once.
Applied Buildifier’s mechanical label ordering to the runtime test data.
Amended the sole feature commit through the delivery adapter without changing
its direct base parent.
Verification evidence
git diff --check HEAD^..HEAD: pass on the prepared commit.
Pass: lifecycle tests exercise real Cordis contexts, Fibers, and effects.
Pass: one runtime and one stdio connection exercise the complete mutable
package lifecycle.
Pass: immutable versions, rollback, deterministic drain, and exact cleanup
are exercised.
Pass: isolated project and scratch roots are exercised.
Pass: promotion and subprocess restart recovery are exercised.
Pass: three justified starter packages and all eight tools execute.
Pass: fixed discovery/invocation gateways work without reconnecting.
Pass locally: all recorded checks and the real stdio transcript pass on the
exact candidate tree. Remote repository handoff remains pending authority.
Progress, approach, and process audit
Criterion 9 improved from a nondeterministic failure to a forced, exact-tree
pass; no technical criterion regressed.
The explicit gate improves evidence in absolute terms: candidate startup can
take arbitrarily longer than the old call without changing the assertion.
Independent code review and the measured zero drain count both supported
retaining transactional start-before-swap behavior.
No defect survived two attempts. The elapsed-time test and Buildifier order
are resolved in their first corrective cycle.
Adapter and root Buildifier startup dominated wall time; warmed focused tests
remained under ten seconds. Further local optimization would not change the
delivery critical path.
The only remaining action is remote publication, which cannot proceed from a
rebase-only authorization.
PR 32 commit 7cfef071 is remotely reproducible but is not a final candidate:
three review findings are valid. The user also requires the four
projects/agents changes from PR 24, whose missing decision-review package
explains the current base’s dangling instruction reference.
Hypotheses
Applying PR 24’s changes three-way will preserve newer goal guidance while
importing its result-first additions, Bazel batching guidance, and
decision-review package.
Treating command overflow as bounded success will preserve useful prefixes
for search and diff consumers without leaking child processes or invalid
UTF-8.
Enforcing max_changes before every porcelain status record will bound all
record kinds uniformly.
Closing admission, draining registered package locks, then disposing active
workers will make shutdown linearizable with concurrent run/reload.
Exact inputs and boundaries
Current and published task commit: 7cfef0719075ad372c3bb257ad216b35770356b2.
Current base/direct parent: 7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d.
Import boundary: only paths beneath projects/agents changed by PR 24.
Review boundary: the three existing PR 32 threads and directly required
regression coverage; no unrelated runtime redesign.
Preserve all immutable package versions already referenced by manifests.
Candidate plan
Merge the PR 24 bazel-agent and goal hunks into current files; add
decision-review plus the offline eval structure required today.
Add black-box execution overflow coverage and implement bounded UTF-8-safe
truncation while preserving timeout/spawn errors.
Add table-driven status-limit coverage and publish a new immutable
git_worktree version with the limit check before record parsing.
Add a deterministic concurrent activation/shutdown gate and memoized
shutdown sequence that waits for admitted locks before disposal.
Run focused tests first, then both affected packages, Buildifier, exact diff
checks, delivery preparation, exact-candidate validation, publication, and
review-thread replies/resolution.
Planned acceptance packet
PR 24 provenance maps exactly to the imported agent changes; newer main
guidance remains present.
decision-review validates and its Promptfoo configuration loads offline.
Output at and beyond the cap is bounded, UTF-8 valid, truncation-marked, and
stopped; under-cap and timeout behavior remain correct.
Every porcelain-v2 record kind obeys max_changes.
Shutdown cannot resolve before an already-admitted activation is owned and
disposed, and later calls reject runtime_closed.
All previous MCP lifecycle, restart, package, and stdio regressions remain
green on the exact delivered commit.
Progress, approach, and process audit
Remote publication improved delivery evidence but exposed three absolute
correctness failures; validation success alone was insufficient.
The PR 24 request resolves an upstream packaging inconsistency and is
independent enough to integrate before runtime corrections.
The current representation remains viable: every defect has a narrow
controlling mechanism and deterministic test. No evidence supports replacing
Cordis, the worker boundary, or content-addressed persistence.
Work performed
Imported all four PR 24 agent-tree changes three-way and added the offline
validation files required by current repository policy.
Changed ctx.exec() overflow from an output-limit rejection to a bounded,
UTF-8-valid success result with explicit process-group cleanup and a
truncation flag.
Published the corrected Git parser as new immutable version de978... while
retaining 70d8... as permanent rollback history.
Made shutdown join admitted activation locks before its final active-worker
snapshot and added closure checks around initialization storage awaits.
Added direct regressions plus an actual git_compare cap integration case.
Verification evidence
Four focused Bazel tests: pass.
Complete MCP package plus three skill eval-config targets: ten of ten pass.
Complete MCP package build plus three skill libraries: pass; all skill
validation aspects pass.
Root //:buildifier_test: pass.
JavaScript syntax, exact new version SHA-256, quick skill validation, and
git diff --check: pass.
Final verdict
Refine. The product and packaging gates were green, but independent review
found silent output-loss and exact-limit semantics that those gates did not
exercise. Preserve the architectural changes; Attempt 5 changes the affected
contracts and tests rather than discarding the worker/runtime design.
Attempt 4 passed every recorded command but independent review disproved four
completeness claims: malformed UTF-8 loss was unmarked, built-in consumers
silently accepted partial host output, Git status truncation was inferred from
capacity rather than omission and missed newline paths, and imported skill
evals did not cover their added behavior.
Hypotheses and plan
Have UTF-8 decoding report whether it dropped any retained bytes and OR
that fact into truncated; cover malformed output below and above the cap.
Publish new immutable versions for each reusable package whose result fields
need host-truncation propagation. Preserve every previously tracked version
byte-for-byte and make partial fields explicit rather than hiding signal
termination as ordinary success.
Parse status records before deciding whether an additional logical change
was omitted, capture NUL-delimited paths with newline-safe expressions, and
cover exact-one, max-two, max-one-of-two, copy, and newline cases.
Add offline cases that exercise compatible multi-target Bazel batching,
immutable exact-hash candidate promotion/regression, and durable task-owned
push behavior that excludes disposable output and reports blockers.
Track disposal of an activation removed by #handleUnavailable() as a
retirement so shutdown cannot return before its worker teardown completes.
Rerun each focused target, all affected package/skill tests and builds,
Buildifier, and another independent review before freezing a commit.
Boundaries
Retain the Cordis/worker/storage architecture and the shutdown correction.
Do not modify historical hash-named version bytes.
Do not import any PR 24 path outside projects/agents.
Do not add live, billable eval targets; these cases extend the existing
offline-validated behavioral configurations.
Do not prepare, commit, or publish until the new review is clean.
Planned acceptance packet
Every discarded output byte makes truncated true.
Each Git/context field that can be partial exposes that fact; bounded diff
and search remain successful.
Shutdown joins teardown for generations that become unavailable immediately
before shutdown, not only those still present in the active map.
Exactly maximum status changes reports complete, while an actual additional
parseable change reports truncated; valid newline paths round-trip.
Eval configs validate with cases for every material imported behavior.
A second independent read-only review reports no remaining actionable issue.
Working-tree result
ctx.exec() now retains a combined bounded prefix, marks byte overflow and
malformed UTF-8 loss as truncated, and stops the child before resolving.
repo_context activates immutable version abd0db3e...; root, HEAD,
status, and ripgrep results propagate host truncation explicitly.
git_worktree retains original version 70d8f28d... unchanged and activates
sole new version 8853aa20.... The rejected intermediate de978... file is
absent. Exact-limit status, newline paths, incomplete NUL records, revision
discovery, history, name-status, diff, and aggregate flags are covered.
Runtime shutdown is memoized, closes admission, joins admitted package
operations, and tracks disposal after an unavailable activation leaves the
active map.
PR 24’s projects/agents subtree is integrated as bazel-agent, goal, and
packaged decision-review changes only. Newer goal-record and delegation
policy is preserved; added eval cases exercise every material imported rule.
Validation evidence
Focused Bazel regression/eval batch: 8 of 8 tests pass.
Entire affected MCP package plus skill evals: 12 of 12 tests pass.
Entire MCP package and all three skill libraries build; every skill
validation aspect passes.
Root //:buildifier_test: 1 of 1 passes.
git diff --check, JavaScript syntax checks, and every retained/new reusable
package content hash pass.
Progress, approach, and process audit
Attempt 5 materially closes every falsified completeness claim from Attempt 4
without replacing the accepted architecture. New versions are confined to
the two reusable packages whose public result contract changed; historical
bytes remain intact. The test packet now observes semantic completeness rather
than only byte caps or array lengths. The remaining critical path is review
and exact-candidate delivery, not additional implementation.
Verdict: proceed to independent review. Do not freeze or publish the candidate
until that review is clean.
Independent-review correction 1
The agent-skill review found that PR 24’s absolute “commit and push every
turn” wording contradicted the preserved throwaway-record policy when a
rejected attempt leaves no durable tracked change. The merged skill now makes
delivery conditional on authorized, nonempty durable tracked progress and
explicitly forbids empty/cosmetic commits or promoting disposable out/
evidence merely to manufacture a checkpoint. A new offline case covers the
no-durable-output rejection. This changes the candidate and invalidates the
prior goal eval result; rerun the affected skill and integrated gates after
the remaining reviewers report.
The follow-up review also found that the durable-progress eval incorrectly
required preparation while remote-ref ownership was unknown. Its oracle now
requires exact inspection followed by a safe stop before preparation, rewrite,
or publication until ownership is established.
The review then found that decision-review’s self-contained case could run
meaningfully with the available provider, so offline validation alone did not
satisfy current skill-package policy. A manual, credentialed promptfoo_test
target now complements the ordinary offline validation target; it is declared
but will not be executed as part of normal or delivery validation.
The generic goal skill also carried Blender-specific scene, topology,
datablock, and linked-library mechanics from PR 24. Those details could
misroute domain policy into software and documentation goals. The merged text
now retains only the cross-domain invariant: immutable candidate copies, one
writer per candidate, exact or deterministic component promotion, and
post-promotion regression. Its eval uses a generic protected deliverable. The
bazel-agent eval documentation now correctly describes its plural cases.
The generalized component-promotion rule initially tried to compare a
component-merged aggregate with a whole-candidate hash, which is impossible.
It now distinguishes exact whole-candidate promotion from independently
hashed component promotion and always reruns affected aggregate gates.
The first manual decision-review target reused credentials without isolating
subject and judge state. Its config now uses separate runner-provided Codex
homes and workspaces, an explicit executable override, and isolated proxy
inheritance; its README documents the required absolute-path invocation.
Attempt 5 passed every repository gate, but the required second independent
review found release-blocking lifecycle and compatibility defects: worker
termination could orphan detached ctx.exec() children, promotion was outside
shutdown admission, unavailable candidates could cross the persistence/swap
boundary, and the new always-partial output contract made retained package
versions lie about completeness. The same review found narrower package and
imported-skill correctness gaps. The candidate is rejected despite green
tests.
Strategy reset
Preserve backward compatibility by making partial output an explicit
ctx.exec() option. Existing package versions retain rejection on overflow;
new versions opt in and receive an explicit output-limit reason alongside
truncated.
Close worker disposal admission before spawning, clean child process groups
both before and after admitted handlers settle, and replace immediate parent
termination with graceful disposal followed by the existing bounded forced
fallback.
Track complete promotion operations in the runtime admission barrier and
stage candidate availability across persistence so a failed candidate cannot
replace or persist over the working generation.
Publish sole new immutable starter versions after correcting unexpected
signal/error handling, exact-boundary flags, omitted-record flags, Git
read-only behavior, robust history framing, and containment checks. Delete
every rejected untracked hash candidate rather than retaining it as history.
Pin LF checkout semantics for hash-addressed source and test retained-version
compatibility, exact output boundaries, outer timeouts, settlement-after-
group-confirmed settlement, late-spawn disposal, promotion shutdown, and
candidate failure.
Finish the PR 24 merge by keeping generic goal invariants generic and making
the manual decision-review eval isolate subject and judge state.
Boundaries
Do not change any previously tracked hash-named source bytes.
Do not add PR 24 paths outside projects/agents.
Do not run the credentialed manual Promptfoo target.
Linux is the supported supervised-execution platform for this repository
target. The guarantee covers the direct child and live descendants that stay
in its original process group; deliberate new sessions are excluded.
Keep one writer per runtime source group and one writer for all active
content-addressed package candidates/manifests.
Acceptance packet
No live member of a supervised original process group survives inner timeout,
outer invocation timeout, disposal, shutdown, or successful truncation
settlement.
Shutdown waits for every admitted mutation, including promotion, and never
publishes a candidate observed unavailable during persistence.
Historical package versions reject overflow under their original contract;
only explicit opt-in versions return a marked partial prefix.
Every result field distinguishes complete, locally clipped, host-limited,
failed, and unexpectedly signaled outcomes.
Exact limits are complete until one additional logical record is observed.
All content hashes, LF attributes, skill validation, offline eval configs,
focused regressions, integrated tests/build, and Buildifier pass.
A fresh review of the final Attempt 6 diff reports no release-blocking issue.
Work performed
Restored the historical ctx.exec() contract: overflow and invalid UTF-8
reject by default, while new packages opt into a bounded marked prefix.
Moved process launch and output accounting from the disposable worker into a
parent-owned Linux supervisor. Launch admission is atomic in the parent’s
event loop, direct exit terminates the original process group before inherited
pipes can hold settlement open, and timeout/disposal results wait for group
non-liveness.
Narrowed the documented contract honestly: a package that deliberately calls
setsid() or otherwise creates a new session is outside the trusted original-
group guarantee; non-Linux execution fails closed.
Made shutdown actively dispose both active and draining retired generations,
and staged candidate persistence so an unavailable candidate rolls back
without displacing the working generation.
Published one current source candidate per starter package. The hashes are
04b06a7d6277c4a6e8513d970f549ad980a780b68755f28d7b402fe8be26c279
for git_worktree and
94131e058f82328f091613dc68d2717484378066a9c64940d99522c14b48b4d7
for repo_context; historical source bytes remain unchanged.
Made ripgrep byte-valued JSON fields explicitly incomplete rather than
returning empty text under a false completeness claim.
Imported PR 24’s agent skills, added current validation/eval packaging,
generalized goal policy, and moved this complete goal directory into the
reusable project docs hierarchy.
Verification so far
Static syntax, manifest/hash, LF-attribute, local-link, and git diff --check
checks pass on the corrected working tree.
Focused process, unavailable-shutdown, and retired-generation tests pass 3/3
in Bazel invocation 9b1b2d34-8490-474a-b12c-e2052bf2d90b.
Process, package-byte-field, and retired-generation tests pass 3/3 in Bazel
invocation 7c680be8-e2a6-4b5b-9b45-4a0390f39a5a.
The earlier 14/14 integrated packet, complete affected build, validation
aspects, and Buildifier passed before the supervisor and final package-byte
corrections. Those results are preserved as progress evidence but are
invalidated for final acceptance and must be rerun.
Independent-review result
The first final review rejected the candidate despite green tests. It found
that outer timeouts settled before cleanup, a signal was mislabeled as reaping,
the shared PID publication window made disposal unbounded, inherited pipes
could delay successful commands, retired generations were not actively
disposed by shutdown, ripgrep byte fields could masquerade as text, and the
durable records were stale. The strategy changed from worker-side process
ownership to parent-owned supervision; every other finding has a direct source
or regression correction. Fresh review of that new strategy is pending.
Acceptance status
Criteria 1-8: pass on implementation and existing executable evidence.
Criterion 9: unverified after the latest source changes; full exact-candidate
validation and delivery remain.
Criterion 10: focused regressions pass; fresh adversarial source review is
still pending.
Progress, approach, and process audit
Attempt 6 improved compatibility, package completeness, promotion admission,
and teardown coverage in absolute terms. The repeated late lifecycle findings
showed that PID publication inside a terminable worker was the wrong ownership
boundary, not merely an under-tested implementation. Moving execution to the
parent removes that race and makes cleanup ordering directly observable. The
highest-leverage remaining work is review and full validation of this new
boundary, not more feature expansion. The attempt remains open until that
review accepts one frozen candidate and delivery verifies the same bytes.
Decision
Refine within Attempt 6: the review changed an implementation strategy without
changing the recorded goal or acceptance contract. Do not freeze or deliver
until fresh review and the complete invalidated regression set pass.
The user correctly identified that each package’s manifest.json,
content-addressed versions/ directory, and active/latest pointers were a
custom package manager rather than an MCP or Cordis standard. That mechanism
made reusable source look temporary, duplicated Cordis loader responsibilities,
and drove much of the worker-generation complexity. Green tests cannot justify
shipping the wrong extension model.
Decision review
Verdict: revise and proceed. The published DeepSeek Cordis packages provide
the missing standard mechanisms directly:
@deepseek-ai/cordis-plugin-loader owns runtime entries and lifecycle;
@deepseek-ai/cordis-plugin-include persists entries in cordis.yaml and
transactionally refreshes them with rollback; and
@deepseek-ai/cordis-plugin-hmr watches normal modules, imports changed code
before replacement, and restores the prior runtime when reload fails.
The strongest objection is that HMR is event-driven and failed source reloads
are logged rather than returned to the file writer. MCP-driven updates must
therefore retain prior bytes, wait for a correlated reload result, and restore
the prior source on failure or timeout. Manual external edits retain Cordis
HMR’s normal behavior and diagnostics.
Frozen plan
Pin the exact released Loader, Include, HMR, Timer, and required peer
dependencies through the project-owned npm lock.
Replace package manifests and hash-named versions with normal ESM modules:
reusable modules under projects/mcp_cordis/plugins/, disposable modules
under out/mcp_cordis/plugins/.
Make projects/mcp_cordis/cordis.yaml and
out/mcp_cordis/cordis.yaml the authoritative standard entry lists.
Mount the official Cordis Loader, two Include trees, Timer, and HMR in the
stdio server. Keep the stable MCP gateway, workspace helpers, bounded
process execution, and tool-registration effects as host services.
Implement MCP define, update, start, stop, remove, and promotion as atomic
source/config changes followed by Cordis lifecycle acknowledgement and
rollback. Use Git for reusable history; do not create a second version
database.
Replace version-store tests with standard-config, restart, HMR rollback,
manual-edit reload, and project/scratch promotion tests.
Run the complete affected test/build/Buildifier packet, obtain a fresh
independent review of the standard design, then rebase and deliver PR 32.
Boundaries
Do not add an MCP Registry server.json unless the server is actually being
prepared for registry publication; it describes the whole server, not its
internal Cordis entries.
Do not retain committed hash-named source snapshots or custom package
manifests.
Keep reusable source and config in the project and all disposable modules,
atomic-write scratch, state, and logs under out/mcp_cordis.
Keep one normal module per package and one stable entry id per scope.
Preserve PR 24’s scoped projects/agents import and the accepted process
execution corrections that remain relevant to the in-process host.
Acceptance status
Implementation and working-tree validation are complete; exact post-rebase
delivery gates remain open. The final architecture adds four narrow host
guards around the official Cordis services: synchronous activation admission
to prevent a never-settling apply(), source-token HMR correlation, a private
stdio protocol stream, and Fiber/invocation-owned Linux process supervision.
The real stdio regression covers define, inspect, run, invoke, update, failed
update rollback, stop, remove, logging isolation, and restart recovery.
Bazel invocation 39711671-375a-413f-8a72-e6f9ff892bd3 passes all 11 affected
tests on the rebased implementation after the import-boundary review
corrections, including Buildifier and all three imported skill configurations.
Invocation 153467fd-e62d-4eab-b260-6754d17fe8e2 builds all 26 affected
targets. Those receipts bind implementation commit 0a93e487; the following
amendments change only this durable goal record, with proportional diff and
format validation required before publication. Fresh independent review
accepted durable-record commit c05bd45a with no actionable findings.
PR 32 was republished at the verified rebased head, its obsolete description
was replaced, and all three prior review threads were resolved.
The fresh hosted review of the delivered standard-Cordis candidate found three
valid starter-package defects: the JavaScript search fallback recursively read
ignored and hidden files when ripgrep was absent, fallback submatch offsets
used UTF-16 code units instead of ripgrep-compatible UTF-8 bytes, and a bounded
textual HTTP body could end with a replacement character when the byte limit
split a multibyte sequence.
Corrections
The JavaScript fallback now fails closed for directory searches and supports
only explicitly selected files. This preserves hermetic single-file fallback
without silently weakening ripgrep’s hidden and ignore filtering.
Fixed-string and regular-expression fallback matches calculate start and
end from UTF-8 byte lengths.
Textual HTTP previews discard only an incomplete trailing UTF-8 sequence;
the raw retained-byte count and truncation signal remain exact.
Follow-up review found that case-insensitive fixed matching could still use a
length-changing lowercased index, explicit files did not override globs as
they do in ripgrep, and unfiltered listing reparsed a malformed scope instead
of returning the healthy scope with an error.
Case-insensitive fixed fallback now matches against the original line with a
Unicode regular expression, explicit files bypass fallback glob filtering,
and unfiltered listing returns per-scope errors alongside healthy packages.
Explicitly listing a malformed scope continues to fail directly.
Final hosted review showed that a valid config with an unavailable module
still bypassed the malformed-config catch, and bounded reads reported the
requested range end instead of the last retained line. Unfiltered listing
now skips every scope whose Include failed to mount, and bounded reads derive
endLine from retained content.
Fresh diff-focused correctness scrutiny then found that repeated
initialize() calls lost the original partial-startup errors. The runtime
now preserves and clones those errors across idempotent initialization.
The same scrutiny found that incomplete UTF-8 suffix removal also ran for a
naturally completed malformed textual body. It now runs only when the local
byte cap truncates the response; naturally malformed bytes retain the prior
replacement-character preview.
The repository’s repo-delivery skill now invalidates prior correctness
verdicts after behavior-changing edits and requires proportional adversarial
scrutiny in addition to test reruns.
Exact-thread reconciliation after the final hosted review exposed one older
unresolved finding and one new finding: the explicit-file regex fallback
matched UTF-16 surrogate halves, and cordis_define plus cordis_promote
advertised overwriting operations as non-destructive. Regex fallback now
uses Unicode scalar mode, and both source-overwriting tools carry the
destructive MCP hint.
The next exact-commit review found two more fallback-boundary defects:
adjacent matches were also emitted as context, and a retained empty line was
reported like a request past EOF. Fallback search now plans a single ordered
event stream from all matching lines, and bounded reads track range existence
independently from textual content.
Evidence
Focused invocation b73ce3b4-bfb6-4081-b84f-29c3f763b3a4 passes both
corrected starter-package test targets.
Complete MCP test invocation 93845f08-cd10-4dfb-88c5-034497dea58a
passes all 7 tests; build invocation
d7716a48-9509-44fe-9e37-b5c44904fffd builds all 16 targets.
Regression cases prove directory fallback fails closed while an explicitly
selected hidden file remains available, both fallback engines report byte
offsets for éneedle, and a one-byte preview of é returns an empty valid
UTF-8 prefix rather than U+FFFD.
Follow-up focused invocation c07704be-cdf8-4045-a0c0-4626ebc0d1e7
passes both affected targets. Complete test invocation
3fbaa4e1-8ea1-4b3f-a533-51e1ad01f87b passes all 7 tests, build invocation
f87e45b6-765e-49c8-a618-cd2eb1efa1ad builds all 16 targets, and Buildifier
invocation 8542838d-92ae-4999-b1e8-fac631629f6f passes.
Final-cycle focused invocation 99866999-c31d-457f-b64b-c7a15073e7a2
passes both affected MCP tests. Combined affected invocation
e86a5d1c-cadf-4ff6-9647-3e1050e461e6 passes all 8 MCP and skill tests;
083fbf55-851e-4db4-b8e5-e5871c874faa builds all 19 affected targets.
Skill quick validation and Buildifier both pass.
Focused starter invocation e80439df-bddd-4a76-b9e1-be6c7f1ed649
distinguishes a cap-split multibyte prefix from a naturally completed
malformed textual body.
Exact aggregate validation exposed timing-sensitive evidence: a wall-clock
admission bound failed under load, and the expected invocation timeout could
reject before its assertion was attached. The test now asserts the wrapped
synchronous-admission semantics and attaches the expected rejection before
waiting for its PID fixture. Invocation
e7d69598-b843-4da4-833b-e024d406b8ca passes three consecutive runs.
A later loaded aggregate run exposed a real HMR rollback race. Cordis restores
the prior module cache after a failed import without emitting a reload event;
the host unnecessarily waited for a second filesystem reload that could be
absent. Rollback now accepts the already-restored prior source marker and
waits for HMR only when the failed candidate actually reached the cache.
Invocation 5f9b49e0-d3d3-4f9e-84ec-602dfbe38c77 passes three runs.
Focused invocation 132e2f33-837c-40b2-83b5-4b06ceadfd0f passes the
Unicode fallback and real-stdio MCP annotation regressions.
Complete affected invocation b19d303e-0aca-4097-a191-e81015dc2982
passes all 8 MCP and skill tests; build invocation
1c8aa274-dd72-4e6f-9491-de5e283b2c5c builds all 19 targets, and
Buildifier invocation 34f6f5c7-7f44-478b-b939-63ac03c3bbb1 passes.
Focused invocation 2528b6ee-7d82-48c9-a607-298a4cef0b9b proves adjacent
matches remain ordered match events and empty retained lines report their
actual endpoint while a request past EOF reports null.
Verdict
Accept locally. Publish the exact follow-up correction commit, resolve the
hosted review threads, and verify the remote head before final handoff.
The user rejected the growing HMR race-handling layer and explicitly requested
the simplest robust way for an MCP server to load DeepSeek/Cordis plugins. The
published parent is bc4e5ae97ef9ea968c01b1b2a55403ae032a6a8d. An
unpublished polling experiment is rejected rather than promoted.
Hypothesis
Atomic persistence plus the official Cordis Include and HMR services is the
smallest reliable boundary. If MCP source mutations stop claiming synchronous
activation or transactional on-disk rollback, the runtime can delete its
source-marker protocol and every dependency on Loader internals while still
loading, invoking, and eventually hot-reloading normal Cordis plugins without
restarting the MCP connection.
Frozen plan
Keep standard cordis.yaml, ordinary plugins/*.mjs, and the two project
and out/mcp_cordis scopes.
Keep the fixed MCP list/invoke gateway and the existing package context API.
Validate module syntax before an MCP write and use atomic file replacement.
For an existing running module, return after persistence with
persisted: true, sourceChanged: true, and activation: "pending";
official Cordis HMR owns eventual activation. Do not claim that every
evaluation or apply() failure restores the prior live entry.
Keep public Include refresh for entry-list changes, because it is the
official transactional API for starting, stopping, adding, and removing
entries.
Update documentation and tests so success means persisted/configured, while
live update is verified by bounded eventual observation.
Retain and validate the two pending repo_context review corrections for
ordered context events and empty-line endpoints.
Register the server in the trusted workspace’s .codex/config.toml. Use a
worktree-resolving launcher and Bazel’s run --script_path handoff so the
long-lived MCP does not retain the Bazel output-base lock.
Rebase onto d29f9d471ea467e8dfc75db4eedeedbbae43dc2d, preserve its
projects/goal redesign, and discard the superseded in-place goal-skill
edits rather than replaying them.
Planned review packet
Focused runtime, stdio, and repo_context tests.
Complete //projects/mcp_cordis:all tests and build.
repo-delivery skill tests and root Buildifier.
Fresh diff-focused scrutiny of update failure, disabled-entry, promotion,
restart, shutdown, and watcher timing paths.
Independent review and exact PR 32 thread reconciliation before delivery.
Current verdict
Refine. Removing wrapper-side acknowledgement machinery was correct, but an
independent reproduction proved that unmodified HMR 1.0.16 can lose a source
change arriving during an in-flight reload. Attempt 10 keeps the thin wrapper
and moves serialization into a focused, reproducibly pinned dependency patch.
The separate delivery-adapter refusal still prevents the history rewrite.
Independent review of Attempt 9 reproduced a lost update in pinned
@deepseek-ai/cordis-plugin-hmr 1.0.16. A slow top-level-await replacement
followed by a second source write left the latest bytes on disk while the
earlier generation remained live. The public HMR surface has no module-failure
event, so a wrapper-side single-flight gate cannot be both safe and
recoverable.
Hypothesis
The narrowest robust correction belongs in HMR’s own reload scheduler. A
standard pnpm dependency patch can serialize partialReload() calls, snapshot
each observed change set, and drain changes arriving during an in-flight
reload. mcp_cordis then remains a thin persistence and invocation gateway
without source markers, Loader-cache inspection, polling, or acknowledgement
state.
Frozen plan
Keep the standard Cordis Loader, Include, Timer, and HMR services and normal
cordis.yaml plus ESM plugin files.
Patch the exact HMR 1.0.16 artifact through pnpm patchedDependencies.
Track one module-refresh task, snapshot its stashed URLs before each reload,
and drain any URLs observed while that reload is running.
Patch both the published JavaScript and TypeScript source shipped in the
package; bind the patch through the generated lockfile and Bazel module
extension data.
Add explicit release-gated overlapping-update regressions for slow
top-level module evaluation and slow asynchronous apply() activation.
Refresh a disabled entry’s exact cached module through HMR before enabling
it, so activation returns only after the latest persisted source is live.
Adopt the fetched base’s role-based layout: command files under
cmd/mcp_cordis, private implementation under internal, and the separate
suite under test.
Preserve the two accepted repo_context review corrections and the
worktree-local launcher.
Stop before Git history mutation until the delivery adapter has an
authorized, guarded path for the nine-commit feature range.
Current evidence
The package registry and upstream repository both expose 1.0.16 as the
latest official HMR release; its source still invokes untracked concurrent
partialReload() work and clears the shared stash after one successful run.
git apply --check accepts patches/hmr@1.0.16.patch against the exact
resolved package bytes. Its SHA-256 and lockfile patch hash are both
ec800d86298faacc86c7717ffa1dce7c28116ab1393b8abc198be6ac02c38489.
The patch serializes module reloads through complete Cordis Fiber cleanup
and activation, drains newly stashed URLs, preserves and retries changes
after unexpected scheduler failures, and declares its public refresh API in
the shipped TypeScript declarations.
Bazel invocation ac79a8e4-f5d9-4dd7-a821-29bce3d8ece6 passes the focused
runtime suite with explicit top-level-evaluation and asynchronous-apply
overlap gates, failed-apply rollback and recovery, manual-edit, and disabled
activation regressions.
Bazel invocation 65c1932a-896b-470d-9462-086dd93beaff passes ten runs each
of runtime_test and starter_packages_test.
Bazel invocations 6490dd57-49e0-4558-b280-f5625db07208,
218e5797-b2d7-44bc-aded-f5df8139ca1c, and
09d4ec2c-aac1-4509-8579-5ef8c5eebe39 pass the complete project tests,
complete project build, and root Buildifier check respectively.
Final independent HMR review accepts the patch identity, stashed-change
draining, complete Fiber cleanup join, public declarations, causal overlap
tests, rollback and recovery, and disabled-entry activation behavior. Its
sole remaining finding was the corrected README publication-order wording.
The checked-in workspace launcher completed MCP initialization and returned
all ten gateway tools while concurrent Bazel query invocation
7739c14e-1b22-40c7-94af-b81143e84d4a completed successfully; SIGINT then
produced a clean server shutdown.
Preliminary current-tree Bazel invocations
95d37231-63f9-44f6-9eee-3f0fe8fb4107,
d70f61a2-57e5-4ce9-b8fd-27b06bd02a6d, and
1e186c82-3bcd-4048-a534-fe747e1cf79c pass the complete affected test
packet (10/10), affected build packet, and root Buildifier check.
Guarded delivery inspection found local and remote feature OID
bc4e5ae97ef9ea968c01b1b2a55403ae032a6a8d, base OID
d29f9d471ea467e8dfc75db4eedeedbbae43dc2d, same-repository PR 32, SSH
transport, and nine linear commits all authored and committed by the task
bot. Its sole refusal is version 1’s unconditional multi-commit range
refusal; the fetched base contains the same limitation and no explicit
consolidation authorization.
The user then explicitly authorized extending the adapter. The new
prepare --consolidate <exact-head> path retains every other refusal and
requires a single-parent chain, identical author and committer identities,
the oldest commit’s ownership marker, unchanged pull-request projection,
and signature preservation. It creates one aggregate commit while binding
the original remote head into the normal publication receipt.
Bazel invocations 574dadd5-51b1-443e-b8c2-50ca5d257eb2 and
030a8bb4-2a22-4ece-b632-b3c75572bcee pass the complete adapter suite once,
then its Go, skill-validation, and root Buildifier targets three times.
Independent adapter review found that the first implementation required an
extra staged edit and therefore could not consolidate an already-clean
range. The corrected gate permits an unchanged index only after exact
consolidation evidence; parent-to-tree scope validation still rejects an
empty aggregate. A clean --path integration case proves tree preservation
and one final commit. Bazel invocation
0d715375-6a8d-4269-ad3e-f8a002888808 passes the corrected suite, and the
independent re-review accepts it with no remaining findings.
Upstream incorporation review preserves the new projects/goal project,
drops the deleted predecessor skill under projects/agents, adopts the
role-based MCP layout, and adds root-consumer visibility to the branch-owned
decision-review skill. The root discovery-link entry must be added after
the new base is applied.
After that visibility correction, Bazel invocations
6099d90d-0ade-43b2-b50b-8f7050c26c32 and
7f4b37a4-b970-46ea-bc76-b4a60aeeab59 pass the focused skill validation and
root Buildifier check; git diff --check also passes.
Current verdict
Proceed. The dependency-layer correction addresses the reproduced race and
failure recovery at Cordis’s owning lifecycle boundary while the MCP wrapper
remains a thin persistence and invocation gateway. The complete local project
packet and focused independent review pass. Exact-candidate validation,
rebase, publication, and hosted-thread reconciliation remain open.
Replace the nine task-owned feature commits with one aggregate commit, rebase
that exact candidate onto the current remote base, preserve the incoming goal
and skill-discovery layouts, and establish publish-ready evidence without
bypassing repo_delivery.
Reconciliation
The fetched base advanced to
63e7b9f0be1e054373415914ff3d2ea2282aa3da and added the reusable
projects/goal project, per-skill discovery links, decision-review, and
exact-head remote-review waiting rules.
The old agent-local goal skill remains deleted. The durable MCP goal stays
under projects/mcp_cordis/goals/runtime_extensions.
The branch keeps the upstream root discovery target, including
decision-review and projects/goal/skills/goal, and combines the incoming
review-waiting policy with the branch’s correctness-revalidation policy.
Delivery adapter corrections
The authorized consolidation path exposed four fail-closed edge cases during
the real rebase:
Existing PR text must match the requested aggregate projection, rather
than the obsolete first commit’s projection.
Explicit staging must handle deleted paths, partial directory deletions,
and a tracked symlink replaced by a directory.
Patch files need the standard repository-wide whitespace exceptions for
structural context prefixes.
A rebased aggregate path may disappear only when the prior candidate and
new base contain the exact same Git tree entry. The receipt then records
the reduced path set; added paths, non-identical loss, and an empty
aggregate remain refusals.
Each case has focused integration coverage. Every failed preparation restored
the original branch, index, and worktree before the next correction.
Exact candidate evidence
repo_delivery prepare --consolidate produced one commit on the fetched
base. The first exact code candidate before the final adapter-and-record
update was
f1c313b0920cb92f2d643dcb5c7d79ab364df058.
Bazel query invocation 5ad9400e-f7b8-4688-9b8c-e962f3de8e66 discovered
the affected MCP, delivery, and skill targets.
Bazel test invocation 13588b19-1f8a-43a7-8006-f9d5d4652670 passed all
12 affected tests, including Buildifier and discovery-link validation.
Bazel build invocation 5863ac24-3bb2-47be-99fb-50141e933018 passed all
29 affected targets.
The real launcher initialized, listed all ten gateway tools, and remained
live while Bazel query invocation
4637f187-d05e-4905-8153-18fca8644ea1 completed. SIGINT then terminated
the server as expected.
git diff --check passed and the worktree remained clean after validation.
Verdict
The aggregate was published as a single commit on PR 32 and its delivery
receipt verified the local tree, remote feature ref, current base ancestry,
and PR projection. The exact-head hosted review found three additional issues:
repository reads reopened a checked symlink through its lexical alias;
permanent /proc inspection failures could prevent shutdown from settling;
the process-tree timeout regression assumed Node could start within 100 ms.
The final correction reads through a canonical, no-follow file handle and
verifies that handle through /proc/self/fd before consuming bytes, turns
repeated process-inspection failures into a bounded EXEC_CLEANUP result, and
uses a startup-safe timeout in the process-tree regression. The full MCP test
and build packets pass, and both focused targets pass three repeated runs.
The review threads are reconciled through the receipt-bound delivery adapter.
The follow-up exact-head review found the same replaceable-path class in
git_worktree: discovery verified one repository directory, but later Git
commands reopened its lexical path. Git discovery and every subsequent
command now use /proc/<pid>/fd/<fd> paths backed by verified open directory
handles, while the subprocess working directory remains workspace-local.
Focused mock coverage checks every Git -C path and the real Cordis starter
package integration passes. The next pass found the same class in
repo_context’s ripgrep and Git metadata branches; both now use verified
descriptor paths for the complete subprocess lifetime, and directory listing
uses the selected directory handle as well. Attempt 11 is accepted and the
goal is complete. The terminal exact-head review then identified that the
JavaScript regular-expression fallback could both block the MCP event loop on
pathological backtracking and disagree with ripgrep’s Unicode semantics. The
fallback now fails closed for regex requests when ripgrep is unavailable;
bounded fixed-string search remains available. Focused and complete MCP test
and build packets pass after that correction. The next exact-head pass found
that replacement decoding of invalid UTF-8 also changed fixed-search raw byte
offsets. The fallback now fails closed for such files as well, leaving raw-byte
search semantics to ripgrep; the focused, complete test, and build packets
again pass.
Recursive JavaScript fallback fails closed when ripgrep is unavailable;
explicitly selected files remain supported.
Fallback fixed and regular-expression submatches use UTF-8 byte offsets.
Bounded textual HTTP previews omit an incomplete UTF-8 suffix.
Focused tests pass 2/2 in invocation
b73ce3b4-bfb6-4081-b84f-29c3f763b3a4; the complete MCP package passes 7/7
tests in 93845f08-cd10-4dfb-88c5-034497dea58a and builds all 16 targets in
d7716a48-9509-44fe-9e37-b5c44904fffd.
Buildifier passes in invocation 1fb561cc-d336-49db-813f-de26b7fedbe4.
Follow-up review corrections preserve original-line indexes for Unicode
case-insensitive matching, make explicit fallback files override globs, and
return healthy scopes plus structured errors from unfiltered listing after
partial startup.
Follow-up focused tests pass 2/2 in
c07704be-cdf8-4045-a0c0-4626ebc0d1e7; complete MCP tests pass 7/7 in
3fbaa4e1-8ea1-4b3f-a533-51e1ad01f87b, all 16 targets build in
f87e45b6-765e-49c8-a618-cd2eb1efa1ad, and Buildifier passes in
8542838d-92ae-4999-b1e8-fac631629f6f.
Final review corrections skip every unavailable Include scope and report only
retained line endpoints. Fresh correctness scrutiny also preserves startup
errors across repeated initialization and limits UTF-8 suffix removal to
locally truncated HTTP bodies.
Focused tests pass 2/2 in 99866999-c31d-457f-b64b-c7a15073e7a2.
Combined MCP and repo-delivery tests pass 8/8 in
e86a5d1c-cadf-4ff6-9647-3e1050e461e6; all 19 affected targets build in
083fbf55-851e-4db4-b8e5-e5871c874faa. Skill quick validation and
Buildifier pass.
Focused HTTP evidence passes in
e80439df-bddd-4a76-b9e1-be6c7f1ed649.
Runtime evidence uses semantic admission assertions and eagerly attaches the
expected timeout rejection; three consecutive runs pass in
e7d69598-b843-4da4-833b-e024d406b8ca.
HMR rollback accepts an already-restored prior cache marker after failed
import; otherwise it still waits for an exact correlated reload. Three
runtime runs pass in 5f9b49e0-d3d3-4f9e-84ec-602dfbe38c77.
Regex fallback uses Unicode scalar mode, so . reports one four-byte match
for 😀, and the real MCP tool catalog marks cordis_define and
cordis_promote as potentially destructive. Both focused regressions pass
in 132e2f33-837c-40b2-83b5-4b06ceadfd0f.
The complete affected packet passes 8/8 tests in
b19d303e-0aca-4097-a191-e81015dc2982, builds all 19 targets in
1c8aa274-dd72-4e6f-9491-de5e283b2c5c, and passes Buildifier in
34f6f5c7-7f44-478b-b939-63ac03c3bbb1.
Fallback context is emitted once in line order and never reclassifies a
matching line as context. Bounded reads distinguish a retained empty line
from EOF. Focused invocation 2528b6ee-7d82-48c9-a607-298a4cef0b9b
passes both regressions.
Attempt 7 working-tree evidence
The custom manifest.json, hash-named versions/, storage layer, activation
worker, and package worker have been removed.
Official @deepseek-ai/cordis-plugin-loader, -include, -hmr, and
-timer packages are pinned. Bazel launches Node with the HMR package’s
documented --expose-internals requirement.
Project entries use projects/mcp_cordis/cordis.yaml and ordinary modules
under plugins/; scratch entries use the same layout under
out/mcp_cordis.
Runtime integration proves create, live HMR update, failed activation with
on-disk/live rollback, stop, run, promotion, removal, and restart recovery.
Direct starter-module tests and the complete starter runtime test pass. A
real stdio client proves the complete lifecycle, failed-update rollback,
package-log isolation, and restart recovery without replacing the MCP
process during an update.
Runtime regressions prove exact source-limit round-trip, invalid-timeout
side-effect exclusion, never-settling activation rejection, handler-lease
draining, and direct/descendant process-group non-liveness at settlement.
Affected test and Buildifier invocation
39711671-375a-413f-8a72-e6f9ff892bd3 passed 11/11 on the rebased
implementation after the final import-boundary corrections. Affected build
invocation 153467fd-e62d-4eab-b260-6754d17fe8e2 passed all 26 targets.
These full receipts bind implementation commit 0a93e487. Later amendments
are confined to the durable goal record and require proportional diff and
formatting validation before publication.
Fresh independent review accepted durable-record commit c05bd45a with no
actionable findings.
PR 32 was republished at the verified rebased head. Its description now
records the standard Cordis architecture, and all three obsolete review
threads are resolved.
Preflight evidence
Official OpenAI documentation confirms local Codex clients can connect
directly to stdio MCP servers and read server instructions.
Official DeepSeek documentation states that its dynamic Cordis definitions
are process-local and memory-only, establishing the need for the requested
persistence layer.
Cordis 4.0.1 exposes the required Context, plugin, Fiber.await,
Fiber.dispose, and effect-scoped cleanup primitives without depending on
DeepSeek Harness’s agent/session/browser packages.
MCP SDK v2 provides a stable stdio server and fixed tool registration. Codex
does not reliably refresh dynamically added tool schemas, so the accepted
design keeps a fixed list/invoke gateway.
Repository review selected an ordinary root-workspace Bazel package with a
project-owned pnpm lock and Bzlmod dependency fragment.
Safe aggregate analysis of 40 top-level recent sessions selected
repo_context, git_worktree, and network_probe as the initial reusable
packages. No transcript or secret-bearing content will be copied.
Attempt 1 verdict
Architecture: one worker and Cordis root/fiber per active package generation.
Storage: immutable content-addressed source and atomic manifests in explicit
project or scratch scopes.
Update rule: start and validate a candidate, atomically swap the active
generation, then drain and dispose the previous generation.
MCP rule: stdout is protocol-only; package output is redirected to stderr and
out/mcp_cordis/logs.
Fetched base and direct parent:
7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d.
The delivery preparation receipt confirms an exact, conflict-free rebase,
task-only path scope, and absence of a remote feature ref or pull request.
Focused post-rebase query passes.
Integrated post-rebase result: three of four tests pass. Starter packages,
stdio, and build coverage pass; lifecycle evidence fails at an elapsed-time
drain precondition with actual 0, expected 1.
Verdict: refine the test evidence in Attempt 3; do not change the runtime
architecture based on this measurement.
Attempt 3 verdict
Final local commit:
7cfef0719075ad372c3bb257ad216b35770356b2.
Final local tree: 34153eca0f582af5c641f81bf8c7209b0045ab9a.
Direct parent and fetched base:
7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d.
Forced project tests: four of four pass on the exact commit.
Complete project build: nine of nine targets pass.
Forced root Buildifier and exact commit diff check: pass.
Review verdict: accept as the final local candidate. Publication was stopped
before execution because a rebase-only request does not authorize remote
push/PR mutation.
Attempt 4 preflight
PR 32 was published at exact commit 7cfef071; remote branch and PR tree
matched the local receipt.
Current remote master is 7ad2704c, the direct parent of the published
task commit; repository inspection reports needs_rebase: false.
PR 24 head is da2085f1, based on ada3ed90. Its projects/agents diff is
exactly four files: one bazel-agent update, one goal update, and two new
decision-review files.
Three PR 32 review threads were independently diagnosed as valid. Their
controlling fixes are bounded-success execution, pre-record change limits,
and shutdown admission closure followed by lock draining.
Verdict: reject 7cfef071 as final; proceed with the scoped three-way import
and three behavior-changing corrections in Attempt 4.
Attempt 4 working-tree evidence
PR 24 import: bazel-agent batching guidance, result-first goal guidance,
and the exact decision-review instruction blob are present. Newer
throwaway-record and bounded-delegation guidance remains intact.
Execution overflow now retains a combined arrival-order byte prefix, returns
only valid UTF-8, stops live process-group members, and reports truncated
rather than rejecting. Timeout and spawn errors retain rejection semantics.
git_worktree keeps 70d8... as immutable history and activates new exact
content hash de978...; its record limit is checked before every porcelain
record matcher.
Shutdown closes admission, joins the exact admitted package-lock snapshot,
then disposes the final active set and awaits retirements through one
memoized promise. Initialization rechecks closure after awaited storage
boundaries.
Four focused Bazel tests pass, including all new regression targets and
decision-review offline validation.
Integrated Bazel test invocation passes ten of ten tests: the whole MCP
package plus all three imported/updated skill configurations.
Full affected build passes and validates bazel-agent, goal, and
decision-review; root Buildifier passes.
Verdict: behaviorally acceptable as a working-tree candidate. Independent
diff review and exact commit-bound validation are still required.
Attempt 4 independent-review verdict
Max-change review proved the bound placement but rejected the completeness
flag when exactly maximum records exist, the missing second-record test,
and newline-unsafe pathname capture.
Execution review accepted byte bounding, process-group cleanup, and runfiles,
but
rejected silent invalid-UTF-8 loss and incomplete propagation of host
truncation through reusable package result fields.
PR 24 provenance review accepted the three-way import and packaging, but
found no eval cases for compatible Bazel batching, immutable candidate
promotion, or durable-versus-throwaway push behavior.
Verdict: refine; passing Attempt 4 checks do not qualify it for commit.
Attempt 5 working-tree evidence
Execution tests cover ASCII overflow, multi-byte boundary overflow,
malformed UTF-8 both below and above the byte cap, combined stdout/stderr
budgeting, timeout rejection, normal nonzero exit, and process-group
non-liveness at settlement.
git_worktree active hash is
8853aa20665778aeec43e03f2fe975445002d56ed33ea1cf38bef3946381f60d;
its manifest retains only that version and unchanged historical hash
70d8f28dc947d19410b8e79bad90cb416303107243d72d062dd70e30f97a2c3b.
repo_context active hash is
abd0db3e26ec970dcf5cc3ec21b9f2b2c452f9302edc0e10c5231a140b92fbc0;
all three manifest version hashes match their exact source bytes.
Focused MCP regressions and three skill eval configurations pass 8/8.
Full affected test packet passes 12/12; full affected build and three
rules_skill validation aspects pass; root Buildifier passes 1/1.
Exact commit and post-rebase evidence remain pending, so this is a green
working-tree candidate rather than a delivered checkpoint.
Attempt 6 working-tree evidence
Current immutable starter hashes are
04b06a7d6277c4a6e8513d970f549ad980a780b68755f28d7b402fe8be26c279
for git_worktree and
94131e058f82328f091613dc68d2717484378066a9c64940d99522c14b48b4d7
for repo_context; line wrapping does not introduce whitespace into the
first identifier.
Historical version bytes retain their exact filename hashes. The checkout
enforces LF for every hash-addressed JavaScript source.
The parent activation now owns every ctx.exec() child handle. Focused tests
prove immediate live-process absence after inner timeout, outer timeout,
startup timeout, output overflow, normal completion with a background child,
and a background child inheriting output pipes.
Runtime regressions prove shutdown admits complete promotion, rolls back a
candidate that fails during active-version persistence, and actively disposes
a retired generation whose admitted handler remains gated.
Bazel invocation 9b1b2d34-8490-474a-b12c-e2052bf2d90b passes the current
process, unavailable-shutdown, and runtime-admission targets 3/3.
Bazel invocation 7c680be8-e2a6-4b5b-9b45-4a0390f39a5a passes the current
process, ripgrep-byte-field, and runtime-admission targets 3/3.
Fresh whole-diff and adversarial supervisor reviews are running. Full
integrated, build, skill-aspect, Buildifier, exact-commit, rebase, and remote
verification remain unverified after the latest changes.
Attempt 10 focused HMR evidence
Subject: dirty Attempt 10 tree using
@deepseek-ai/cordis-plugin-hmr 1.0.16 with pnpm patch hash
ec800d86298faacc86c7717ffa1dce7c28116ab1393b8abc198be6ac02c38489.
Primary dependency evidence: the npm registry lists 1.0.16 as the latest
release, and current upstream vendor/hmr/src/index.ts retains the same
untracked debounced partialReload() plus shared-stash reset behavior.
Independent reproduction: a slow top-level-await generation followed by a
second write reached {live: "slow", diskLatest: true} with the unpatched
package.
Patch applicability: git apply --check accepts
patches/hmr@1.0.16.patch against the exact resolved 1.0.16 package files.
Lock generation: Bazel-managed pnpm invocation
a1c50484-20c6-4935-8832-92029d0de3c6 completed successfully with no
unrelated dependency resolution changes.
Causal runtime regressions: Bazel invocation
ac79a8e4-f5d9-4dd7-a821-29bce3d8ece6 passed explicit release-gated
top-level evaluation and asynchronous activation overlaps, failed apply
rollback and recovery, manual editing, and deterministic disabled activation.
Repetition: Bazel invocation 65c1932a-896b-470d-9462-086dd93beaff
passed ten runs each of runtime_test and starter_packages_test.
Complete project packet: invocations
6490dd57-49e0-4558-b280-f5625db07208,
218e5797-b2d7-44bc-aded-f5df8139ca1c, and
09d4ec2c-aac1-4509-8579-5ef8c5eebe39 passed all project tests, all project
builds, and root Buildifier respectively.
Project-layout adaptation: Bazel invocation
ea2c6c6e-b2e1-425d-bedb-2ac9679de6c5 passed runtime_test after moving
the command, internal implementation, launcher, and test suite to their
role-based directories.
Independent final HMR review accepted patch identity, stashed-change
draining, complete Fiber cleanup join, declarations, causal overlap tests,
rollback and recovery, and disabled-entry activation. Its only finding was
a README sentence describing the superseded publication order; that contract
text is corrected in the current tree.
The real cmd/mcp_cordis/launch.sh completed MCP initialization and listed
all ten tools. While that stdio server remained live, Bazel query invocation
7739c14e-1b22-40c7-94af-b81143e84d4a completed successfully, proving the
launcher releases the workspace Bazel lock before serving; SIGINT shut the
server down cleanly.
Preliminary current-tree Bazel invocations
95d37231-63f9-44f6-9eee-3f0fe8fb4107,
d70f61a2-57e5-4ce9-b8fd-27b06bd02a6d, and
1e186c82-3bcd-4048-a534-fe747e1cf79c pass the complete affected test
packet (10/10), affected build packet, and root Buildifier check.
Guarded delivery inspection bound same-repository PR 32 to local and remote
feature OID bc4e5ae97ef9ea968c01b1b2a55403ae032a6a8d, fetched base OID
d29f9d471ea467e8dfc75db4eedeedbbae43dc2d, and SSH transport. All nine
linear feature commits have the task-bot author and committer identity; the
only refusal is version 1’s unconditional multi-commit consolidation guard,
which is unchanged on the fetched base.
The user explicitly authorized the narrow adapter extension. Its exact-head
consolidation path verifies linearity, identity, oldest ownership marker,
pull-request metadata matching the requested aggregate projection,
signature requirements, and every other inspection refusal before creating
one aggregate commit. Integration
coverage proves that the pre-consolidation remote head remains the
receipt-bound publication lease.
Bazel invocations 574dadd5-51b1-443e-b8c2-50ca5d257eb2 and
030a8bb4-2a22-4ece-b632-b3c75572bcee pass the complete adapter suite once,
then its Go, skill-validation, and root Buildifier targets three times.
Independent adapter review rejected the first implementation because clean
ranges had no staged delta. The correction permits an unchanged index only
behind validated exact consolidation evidence, while parent-to-tree scope
validation continues to reject an empty aggregate. A clean --path
regression proves tree preservation and one final commit; Bazel invocation
0d715375-6a8d-4269-ad3e-f8a002888808 passes, and independent re-review
accepts the corrected adapter with no remaining findings.
After adding upstream-compatible root-consumer visibility to the
branch-owned decision-review skill, Bazel invocations
6099d90d-0ade-43b2-b50b-8f7050c26c32 and
7f4b37a4-b970-46ea-bc76-b4a60aeeab59 pass its focused validation and the
root Buildifier check; git diff --check also passes.
Guarded consolidation and rebase produced one candidate commit on fetched
base 63e7b9f0be1e054373415914ff3d2ea2282aa3da. The adapter now stages
deletions and symlink-to-directory changes and permits a rebased path to
vanish only when the old candidate and new base have the exact same Git tree
entry.
Exact code-candidate Bazel invocations
13588b19-1f8a-43a7-8006-f9d5d4652670 and
5863ac24-3bb2-47be-99fb-50141e933018 passed all 12 affected tests and all
29 affected builds, including Buildifier and discovery-link validation.
Live launcher initialization listed all ten gateway tools while concurrent
query invocation 4637f187-d05e-4905-8153-18fca8644ea1 passed.
Verdict: the focused race, recovery, layout, repeated-run, project-wide,
consolidation, and exact code-candidate evidence pass. The final
adapter-and-record rewrite, remote publication, hosted review
reconciliation, and final
receipt verification remain open.
Attempt 11 final review evidence
Guarded publication and receipt verification established a clean,
single-commit feature branch on base
63e7b9f0be1e054373415914ff3d2ea2282aa3da, with the local and remote tree
identical and PR 32 synchronized.
The exact-head hosted review completed against the published aggregate and
reported three actionable findings: lexical symlink reopening, unbounded
/proc inspection retries, and a 100 ms process-start assumption.
Repository reads now open the canonical target with O_NOFOLLOW, validate
the opened descriptor through /proc/self/fd, inspect and read through that
same handle, and retain the existing byte bound. A regression proves an
internal symlink read never reopens the lexical alias through ctx.readText.
Process-group verification now skips inaccessible per-PID entries and turns
three consecutive inspection failures into EXEC_CLEANUP; a direct
regression proves the retry bound. The timeout cleanup fixture now allows a
five-second startup window before exercising forced group cleanup.
Bazel invocation d32cccf7-b5b9-427c-93a1-6b612e32a0aa passed all seven MCP
tests. Invocation 9d11ce11-1f79-4077-b61a-efa95a5fc3de built all 16 MCP
targets. Invocation aadcc7f6-e2b3-4480-8b76-0607b2017415 passed three runs
each of the process-supervisor and repository-context regression targets.
Final publication, exact-head review completion, thread reconciliation, and
receipt verification are performed by the guarded delivery workflow; the
ignored receipt is the authoritative mutable delivery record.
Follow-up exact-head review identified lexical reopening in git_worktree.
Repository selection and discovered-root use now retain verified directory
handles for the complete tool call, and all Git -C arguments address those
handles through /proc/<pid>/fd. The focused command-contract test and real
Cordis starter-package integration pass together in Bazel invocation
4c3eba8d-32c9-47e9-a257-f8af92ef0c19; invocation
6c638120-90cb-446c-b76e-6d39df3640e5 repeats both targets three times.
Invocations ef83ec38-84ed-466e-abbd-ffd6cef892c1 and
16e0c322-adc7-4763-8ff4-11d5f38a4172 pass the complete seven-test and
sixteen-target MCP packets.
The next exact-head pass identified the same lexical reopening in
repo_context’s ripgrep and Git metadata branches. Selected search paths and
repository directories now remain open while subprocesses address them
through /proc/<pid>/fd; reported ripgrep paths are mapped back to stable
workspace-relative names. Directory kind and entry inspection also use the
selected handle. Bazel invocation
a3f4ed56-a44b-46d6-8717-c38ecc7f05eb passes the focused context contract
and real ripgrep/Git starter integration together. Invocation
e7af6e8f-823e-40ef-a833-dcb0a704f46f repeats both three times, while
invocations 9fd4d465-957a-424f-9bb8-f6e10eb93009 and
4a464ddd-f646-4b9a-aaab-a411bf930ee0 pass the complete seven-test and
sixteen-target MCP packets.
The terminal exact-head review found that the JavaScript regex fallback
could monopolize the MCP event loop through backtracking and could not match
ripgrep’s Unicode regex semantics. Regex search now requires ripgrep when
the executable is unavailable, while the bounded fixed-string fallback is
preserved. Bazel invocation b98534c0-1667-462b-81d5-ee393fca343b
passes the focused context and real starter integration targets;
invocations 4689e7cb-9600-4b35-ad7a-97e02cd6730c and
557f322c-4fad-4358-bf5f-98ad9b8972b0 pass the complete seven-test and
sixteen-target MCP packets.
The next exact-head pass found that invalid UTF-8 replacement decoding
changed fixed-search byte offsets when ripgrep was unavailable. The fallback
now verifies that decoded text round-trips to the original bytes and fails
closed otherwise. Bazel invocation
449ea2c4-4d52-44d2-b7d1-b1e9745359bd passes the focused context and real
starter integration targets; invocations
77bae252-af20-4242-89d8-7d6bc242b64f and
3a0bd136-a327-416a-8128-aaaec171bd9c pass the complete seven-test and
sixteen-target MCP packets.
Attempt 8 hosted review finds starter fallback and encoding gaps
Candidate: published standard-Cordis commit deaa2dcd.
Result: hosted review found three valid defects after the earlier local
whole-diff review had accepted the runtime architecture.
Causes: the no-ripgrep fallback recursively traversed ignored and hidden
files, JavaScript string indexes were exposed as byte offsets, and a bounded
textual HTTP body decoded an incomplete trailing UTF-8 sequence.
Strategy delta: fail closed for directory fallback, retain explicit-file
fallback with true UTF-8 offsets, and decode only a complete UTF-8 prefix.
Regression guard: explicit hidden-file versus directory cases, fixed and
regex non-ASCII offsets, and a one-byte multibyte HTTP preview must pass with
the complete MCP test/build packet.
Follow-up causes: lowercasing a line could change UTF-16 length before offset
projection, fallback glob filtering contradicted ripgrep’s explicit-path
precedence, and unfiltered listing did not preserve a healthy scope after
partial startup.
Follow-up guard: length-changing İx, explicit file plus excluding glob, and
malformed-project/healthy-scratch listing cases pass with the complete MCP
packet.
Final-review causes: config parsing alone did not identify a scope whose
Include never mounted, and bounded reads reused the requested endpoint after
clipping content.
Fresh-scrutiny cause: idempotent initialization returned an empty error list
after partial startup because only the first call retained local failures.
Additional fresh-scrutiny cause: UTF-8 suffix trimming did not distinguish a
byte-cap split from a naturally completed malformed response body.
Final guard: missing-module and malformed-config scopes are both skipped by
unfiltered listing, clipped reads report retained endpoints, and repeated
initialization preserves structured scope errors. Textual bodies trim an
incomplete suffix only when locally truncated. repo-delivery now makes this
correctness scrutiny an explicit post-edit gate.
Exact aggregate runtime evidence was timing-sensitive
Result: the complete packet failed only when system load delayed a
wall-clock <400 ms assertion and allowed an expected 300 ms rejection to
occur before its assertion was attached.
Cause: the test inferred synchronous admission from elapsed time and created
a temporary unhandled-rejection window while waiting for a PID file.
Strategy delta: assert the wrapped synchronous-admission error semantics and
attach the expected rejection before awaiting the fixture handshake.
Regression guard: the complete runtime target passes three consecutive
concurrent runs without loosening production deadlines.
Failed-import rollback waited for an event Cordis does not emit
Candidate: loaded exact aggregate validation after the evidence correction.
Result: a failed source update occasionally reported
reload_rollback_failed even though Cordis had already restored the prior
module cache.
Cause: failed HMR import restores its cache and returns without emitting
hmr/reload; the host always required a second reload event after restoring
prior bytes.
Strategy delta: after restoring bytes, accept the exact prior cache marker
immediately; retain correlated HMR waiting when the failed candidate marker
actually reached the cache.
Regression guard: three concurrent runtime runs prove failed-update rollback,
source restoration, and subsequent healthy invocation.
Result: npm translation succeeded; target loading stopped because the
deliberately non-empty starter-package glob had not yet been populated.
Cause: implementation was queried while the parallel starter-package draft
was still outstanding.
Strategy delta: retain the non-empty invariant and add the three accepted
packages before rerunning the same query.
Regression guard: the starter_packages target must contain real files and
the focused query must succeed.
Attempt 1, check 3: runtime test process did not terminate
Command: bazel_agent bazel test //projects/mcp_cordis:runtime_test
Result: both test bodies completed in under 400 ms, one failed, but a worker
retained by the failing test kept the process alive until the run was
interrupted at 144 seconds.
Cause: the test registered cleanup only along its success path, so the first
assertion failure leaked its runtime and obscured the underlying defect.
Strategy delta: register unconditional node:test teardown before the first
assertion, then rerun to expose the real behavioral failure promptly.
Regression guard: the target must terminate normally on both passing and
failing assertions.
Command: focused runtime test after unconditional teardown.
Result: target terminated in 0.8 seconds; the MCP gateway test passed and
the lifecycle test stopped at its syntax-rollback assertion.
Cause: the runtime correctly exposed activation_failed as the error’s
machine-readable code, while the test searched only its human message.
Strategy delta: assert the stable code and separately check the underlying
syntax diagnostic.
Regression guard: failed activation retains the working v2 generation and
reports both the stable wrapper code and candidate cause.
Starter search depends on undeclared ripgrep (occurrence 1)
Command: bazel_agent bazel test //projects/mcp_cordis:starter_packages_test.
Result: failed in 0.4 seconds with spawn rg ENOENT.
Cause: repo_context_search invoked the preferred ripgrep engine without a
fallback, while the Bazel test PATH intentionally does not expose the host
installation.
Attempted strategy: none before this measurement.
Strategy delta: Attempt 2 adds a bounded in-process fallback while retaining
ripgrep when available.
Regression guard: the unchanged hermetic starter test must exercise a
successful search and all remaining package handlers.
Latest result: resolved in Attempt 2. The unchanged hermetic test passes with
the new bounded JavaScript fallback and executes all eight tools.
Lifecycle drain test uses an elapsed-time race (occurrence 1)
Command: bazel_agent bazel test //projects/mcp_cordis:all on rebased commit
e3e74cb1e573867825347292bf17220a5b9a4a0c.
Result: three test targets pass; runtime_test reports actual drain count
0, expected 1.
Cause: the test delays the old request for 150 ms but must start and validate
a replacement worker before retirement. Nothing guarantees the swap occurs
before the fixed request delay expires.
Attempted strategy: a 20 ms sleep before starting replacement; this proves
that the old request started, not that it remains active at the later swap.
Strategy delta: Attempt 3 uses an explicit started marker and release latch.
Regression guard: run the focused lifecycle test and complete suite with no
wall-clock assumption controlling the drain-count assertion.
BUILD data labels not in Buildifier order (occurrence 1)
Command: bazel_agent bazel test //:buildifier_test during Attempt 3.
Result: failed with an exact three-line ordering diff in
projects/mcp_cordis/BUILD.bazel.
Cause: the external-style :node_modules/... label followed the two shorter
local labels in runtime_test.data.
Strategy delta: apply Buildifier’s exact lexical ordering and rerun the same
repository formatter target.
Regression guard: //:buildifier_test must pass on the frozen candidate.
Latest result: resolved. The forced Buildifier test passes on commit
7cfef071.
Intended command: repository delivery publish using the exact preparation
receipt and validated head 7cfef071.
Result: the approval gate rejected execution before any push or pull request
mutation.
Cause: the latest user instruction explicitly requested a rebase and did not
authorize the separate consequential remote publication operation.
Safe attempts: preparation, exact-tree validation, and local commit are
complete; no workaround or indirect mutation was attempted.
Exact unblocker: explicit user authorization to push this branch and create
or update its pull request.
Latest result: resolved. The user explicitly requested push and continued
goal execution; PR 32 was published at 7cfef071 and remains the authorized
delivery vehicle for the corrected candidate.
Published candidate has three valid review defects (occurrence 1)
Result: automated review found three independently reproducible defects.
Causes: output overflow rejects instead of returning bounded data with a
truncation marker; branch records bypass max_changes; shutdown snapshots
active workers before an admitted activation finishes.
Strategy delta: Attempt 4 changes each controlling mechanism and adds a
black-box regression for each, rather than suppressing or merely replying to
the review.
Regression guard: republish only when all focused tests, the full MCP Cordis
package, imported skill validation, and Buildifier pass on one exact commit.
Latest result: resolved in the Attempt 4 working tree. Four focused tests,
all ten integrated tests, the complete package build, three skill-validation
aspects, and root Buildifier pass. Exact-commit rerun remains required.
Candidate: uncommitted Attempt 4 working tree after all recorded tests
passed.
Result: four directly related semantic and evidence gaps survived.
Causes: invalid UTF-8 loss did not set truncated; several starter fields
ignored host truncation; Git status inferred truncation from result length
instead of actual omission and used newline-unsafe path regexes; imported
skill eval cases did not exercise their new contracts.
Strategy delta: Attempt 5 makes loss explicit, propagates truncation by
field, parses one-record lookahead semantics, adds newline/exact-limit tests,
and expands offline eval cases before another integrated run.
Regression guard: independent review must find no correctness issue before
delivery preparation; a green test suite alone is insufficient.
Evidence: independent shutdown review of Attempt 4.
Cause: #handleUnavailable() removes the activation from #active, while
its worker termination is asynchronous and was not added to #retirements.
Strategy delta: track the activation’s idempotent dispose() promise as a
retirement at the same moment it is removed.
Regression guard: a deterministic unavailable-then-shutdown scenario must
prove shutdown does not finish before the teardown promise.
Main references an absent decision-review skill (occurrence 1)
Evidence: current base 7ad2704c mentions decision-review in AGENTS.md,
but the referenced package is absent from that tree.
Cause: the skill exists in open PR 24, not in the rebased master commit.
Strategy delta: import only PR 24’s four projects/agents changes, merged
against current guidance, and supply validation assets required by current
repository policy.
Regression guard: build and validate the imported skill through its Bazel
skill_library and offline Promptfoo target.
Latest result: resolved in the working tree. decision-review matches PR
24’s instruction blob and passes quick validation, offline Promptfoo loading,
and the repository skill-validation aspect.
Attempt 5 independent review rejects lifecycle and compatibility
Candidate: green uncommitted Attempt 5 working tree.
Result: focused tests passed 8/8, integrated tests passed 12/12, the affected
build and skill aspects passed, and Buildifier passed; independent review
nevertheless found release-blocking defects.
Causes: immediate Worker.terminate() can bypass detached-child cleanup;
already-admitted handlers can spawn after one-shot disposal cleanup;
promotion is outside the shutdown lock snapshot; an unavailable candidate’s
one-shot notification can be ignored during persistence; and always-success
output truncation silently changes retained package-version semantics.
Additional gaps: command signals/failures, exact-bound search and omitted
records, Git optional writes/history framing, LF hash portability, weak
integration assertions, and contradictory or domain-specific imported-skill
rules.
Strategy delta: Attempt 6 versions partial-output behavior explicitly,
closes process and runtime admission, creates sole final package candidates,
and binds every completeness claim to a direct regression.
Regression guard: no delivery preparation until a fresh review accepts the
new candidate after all invalidated gates pass.
Attempt 6 first final review rejects worker-side process ownership
Candidate: green Attempt 6 working tree before parent-owned supervision.
Result: focused tests, the 14/14 integrated packet, build, skill validation,
and Buildifier passed; independent reviews still rejected release.
Causes: outer timeouts settled before cleanup; signaling a process group was
called reaping; the worker’s native-spawn/PID-publication window could not be
both bounded and orphan-safe; direct exit could leave inherited pipes open;
shutdown awaited but did not dispose retired generations; ripgrep byte fields
could be returned as empty complete text; and durable records were stale.
Strategy delta: the parent activation now owns process spawning and group
cleanup, runtime tracks retired activations rather than only their promises,
byte fields set explicit truncation, and the durable goal records every
verdict and invalidated gate.
Regression guard: immediate non-liveness assertions, inherited-pipe cleanup,
fatal cleanup ordering, retired-generation shutdown, byte-field cases, and a
fresh adversarial review must pass before final integrated validation.
Custom manifests and hash versions are the wrong extension model
Candidate: published PR 32 checkpoint 7cfef071 and its Attempt 6
descendants.
Result: the user rejected the per-package manifest.json, immutable
versions/, and active-pointer design as nonstandard and temporary-looking.
Cause: the runtime had grown a second package manager instead of using
Cordis Loader entries, Include-backed configuration, HMR, and Git history.
Strategy delta: Attempt 7 deletes the custom store and workers, pins the
official services, and uses cordis.yaml plus ordinary ESM modules.
Regression guard: no package manifest, hash-named source snapshot, custom
storage layer, or version-file .gitattributes rule may remain.
In-process standard Cordis needs reliability admission guards
Candidate: independently reviewed Attempt 7 working tree.
Result: review found that accidental stdout writes could corrupt stdio,
Promise/async-iterator activation or top-level await could wedge lifecycle
mutation, filename-only HMR events could acknowledge the wrong write, and
response timeout could leave invocation-owned children running.
Strategy delta: reserve a private protocol stream, use Node’s ESM parser to
reject top-level await, require synchronous object activation, correlate
managed source with a named-export token, and use an invocation-scoped
supervisor that cancels and joins ctx.exec().
Regression guard: real stdio logging, hung activation, source round-trip,
invalid/expired invocation, and descendant non-liveness tests all pass.
Official HMR requires Node internal-module access
Command: first Attempt 7 runtime_test initialization.
Result: HMR rejected startup with
--expose-internals is required for HMR service.
Cause: the optional native fallback peer was not reliably visible through
Bazel’s strict pnpm layout.
Strategy delta: every runtime-bearing Bazel launcher passes the official
package’s supported --expose-internals Node flag. Automatic peer install is
disabled because all required peers are pinned explicitly and the optional
native fallback is unnecessary.
Regression guard: the complete project build and all runtime tests must boot
through the Bazel launchers.
Root Fiber uid zero skips watcher disposal
Command: runtime and starter tests without Node’s force-exit option.
Result: both test bodies passed but timed out with live FSEventWrap
resources after runtime.shutdown().
Cause: shutdown guarded root.fiber.dispose() with root.fiber.uid;
Cordis assigns the root Fiber uid 0, so the truthiness check skipped every
root-owned cleanup effect, including HMR watchers.
Strategy delta: dispose whenever the root Fiber exists, independent of its
numeric uid. Remove force-exit workarounds from tests and keep stdio shutdown
graceful.
Regression guard: runtime, starter, and real stdio tests must exit normally
without --test-force-exit or process.exit().
Review completion is not thread reconciliation
Candidate: published commit cfab0fb5 after a completed hosted review.
Result: the review summary completed, but GraphQL thread inspection exposed
one unresolved older regex-parity finding and one new annotation finding.
Strategy delta: enable Unicode scalar matching, mark both potentially
overwriting tools destructive, and treat the review-thread graph—not the
summary state—as the authoritative review ledger.
Regression guard: an astral . fallback match must be one UTF-8 span, and
real stdio tool discovery must expose both destructive annotations.
Fallback event and empty-range boundaries diverge
Candidate: published review correction bc4e5ae9.
Result: the next hosted review found duplicate, out-of-order fallback context
around adjacent matches and a null endpoint for an existing empty line.
Cause: context filtering knew only the current matching line, while bounded
reads inferred range existence from non-empty selected text.
Strategy delta: precompute match classifications, emit the union of match and
context lines once in source order, and track whether the requested range
exists separately from its content.
Regression guard: adjacent matches followed by context must emit
match/match/context in line order; a selected empty line reports its line
number while a start past EOF reports null.
Delivery adapter refuses the multi-commit feature range
Candidate: local Attempt 9 changes above published head bc4e5ae9, with
fetched base d29f9d47.
Result: read-only delivery inspection reports nine feature commits and
refuses preparation; version 1 will not infer consolidation ownership.
Cause: only the first commit carries the adapter’s ownership disclaimer,
while the adapter supports preparation of at most one feature commit.
Rejected workaround: direct rebase, reset, cherry-pick, or a replacement
branch would bypass the GitHub adapter’s explicit safety refusal.
Required strategy delta: obtain scope to add a guarded exact-head,
merge-base-aware consolidation path to repo_delivery, or have that support
land separately before resuming the rebase.
Resolution: the user explicitly authorized a guarded adapter extension.
repo_delivery prepare --consolidate <exact-inspected-head> now verifies a
merge-free linear range, identical author and committer identities, the
oldest commit’s ownership marker, unchanged pull-request projection,
signature preservation, and every unrelated refusal before replacing the
range. Its integration test also proves the prior remote tip remains the
receipt-bound publication lease.
Cordis HMR loses a write during an in-flight reload
Candidate: Attempt 9 with unmodified
@deepseek-ai/cordis-plugin-hmr 1.0.16.
Result: a deterministic slow top-level-await replacement followed by a
second write left the latest source on disk but the first replacement live.
Cause: debounced partialReload() work was not serialized; each successful
run reset one shared stash even when a later change arrived during import.
Rejected wrapper workaround: public HMR emits neither import-failure nor
settled-activation events, so a wrapper gate would either reopen unsafely on
a timeout or wedge permanently after failure.
Strategy delta: Attempt 10 uses standard pnpm patching to serialize the
owning HMR task, snapshot each change set, and drain changes observed while
it runs.
Regression guard: overlapping writes during both slow module evaluation and
slow asynchronous activation must converge to the latest persisted source.
The project is named mcp_cordis and lives under projects/.
Reuse Cordis itself rather than reimplementing its lifecycle architecture.
Keep reusable runtime code under the project for later reuse.
Keep disposable runtime code under out.
Seed the project with packages based on recurring past-session needs.
Security hardening is not the priority on this dedicated LLM machine.
Codex must load the MCP from project-scoped configuration so different
clones and linked worktrees use their own source and disposable state.
Repository constraints
Use bazel_agent for every Bazel command.
Pin external dependencies reproducibly and retain required notices.
Keep disposable task scratch under out/mcp_cordis; maintain this explicitly
requested reusable goal under projects/mcp_cordis/goals.
Preserve unrelated working-tree changes.
Prefer a narrowly scoped project and focused validation.
Assumptions
“Based on past sessions” means extracting generic recurring workflows, not
copying private conversation text, credentials, or secret-bearing data.
Host-only JavaScript packages are the initial scope; browser UI packages are
not required for the first working server.
A stable gateway invocation tool is required because MCP clients differ in
when they consume tool-list change notifications.
Requirement changes
2026-08-30: project name changed from agent_extension_host to
codex_cordis, then finally to the client-neutral mcp_cordis.
2026-08-30: storage clarified as two-tier: reusable project packages and
disposable out packages.
2026-08-30: the user promoted the runtime-extension goal directory from
disposable out coordination to durable project documentation for future
reuse.
2026-08-30: remote master advanced and the user explicitly requested a
rebase before implementation continued. The task commit was rebased from
775f44d3b56146005e44980f3cf948785f963ba0 onto
7ad2704cd27757355ab36ec8eb1bb27ef9e1d91d; all prior checks were treated as
invalid until rerun.
2026-08-30: after publication, the user explicitly expanded the delivery to
include only the projects/agents subtree changes from PR 24. PR 24 changes
four files there: bazel-agent, goal, and the new decision-review
package. Import those changes three-way against current master; do not
import its unrelated render or infrastructure content.
2026-08-30: the user rejected the custom per-package manifests and requested
standard solutions. Runtime persistence must use official Cordis loader
entries and cordis.yaml; normal reusable files and Git replace committed
content-addressed source history.
2026-08-30: after review-driven fixes exposed additional correctness gaps,
the user required repo-delivery to invalidate prior correctness verdicts
after code changes and require fresh diff-focused scrutiny beyond green
tests.
2026-08-30: the user rejected the HMR race-handling complexity and explicitly
required the simplest robust MCP wrapper for loading DeepSeek/Cordis plugins.
Source-tool success therefore means validated atomic persistence and an
official Cordis load/reload request, not a custom synchronous activation
transaction or on-disk rollback protocol.
2026-08-30: the user required per-workspace Codex loading. The checked-in
.codex/config.toml must resolve the active linked worktree; the launcher
must release Bazel’s output-base lock before the MCP begins serving stdio.
2026-08-30: remote master advanced again to
d29f9d471ea467e8dfc75db4eedeedbbae43dc2d. The user requested another
rebase and incorporation review. Preserve the new projects/goal redesign
and do not resurrect its deleted predecessor under projects/agents.
2026-08-30: after the delivery adapter refused the exact nine-commit task
range, the user explicitly authorized extending repo_delivery with a
guarded exact-head consolidation operation and then repeated the request to
rebase, review, and incorporate the upstream changes.
16 - Nexus security plugin
Security plugin for Sonatype Nexus 3
This plugin allows you to perform a check every time an artifact is requested from a repository
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Repository-owned render assets and their acceptance evidence
This project owns reusable Blender assets, their controlling references, and
compact goal records that bind acceptance evidence to exact candidate bytes.
The Reimu Fumo work lives under assets/reimu_fumo/. Its
reusable asset target will be added only after a candidate passes the visual,
structural, animation, and exact-byte delivery gates in
goals/reimu-fumo-finish/.
Working candidates and intermediate renders belong under the repository-root
out/reimu_fumo_finish/ directory. They are not accepted or durable merely
because they exist there. A historical packet may move into the source tree
only when exact bytes and provenance are verified and it is labeled with its
actual rejected or accepted state.
18 - Rules binary toolchain
Bazel toolchains for packaged executable binaries
rules_binary_toolchain creates Bazel toolchains and runnable targets for
packaged executable binaries. Archive entries can include runtime files,
which the generated binary targets expose through Bazel runfiles.
18.1 - Bzl
Bazel code
Archive binaries
Each archive binaries entry requires a name and path. It can also set
runtime_files to a list of Bazel glob patterns relative to the unpacked
archive. The generated <name>_native_binary exposes matching files as
runfiles; <name>_filegroup exposes the binary and those same files.
Omit runtime_files when the binary needs no extra runtime files.
19 - Rules Dnscontrol
Bazel-aware DNSControl configuration packaging
rules_dnscontrol packages a DNSControl JavaScript entrypoint together with
its record configuration files and emits a generated requires.json manifest
of relative paths matching the Bazel runfiles tree. Record symlinks retain a
.json suffix so DNSControl parses them as JSON. Load the manifest with
require() and load each listed path with another require() call;
DNSControl’s JavaScript loader does not implement CommonJS module.exports.
20 - Rules docs
Bazel documentation packaging rules
rules_docs packages Markdown documentation under a common archive prefix.
Documentation rule
Add the module dependency:
bazel_dep(name ="rules_docs", version ="<VERSION>")
Then declare the package documentation. srcs defaults to
glob(["*.md"]); visibility is optional.
load("@rules_docs//docs:defs.bzl", "docs_filegroup")
docs_filegroup(
name ="docs",
deps = ["child"],
)
Relative dependency names without a colon are normalized to the child
package’s docs target. prefix defaults to the current package beneath
content/docs/.
Gazelle extension
Generation support is packaged separately so consumers of the documentation
rule do not inherit Gazelle and Go dependencies. Add it as a development-only
module dependency:
bazel_dep(
name ="rules_docs_gazelle",
version ="<VERSION>",
dev_dependency =True,
)
Add the public language target to the repository’s custom Gazelle binary:
load("@gazelle//:def.bzl", "gazelle_binary")
gazelle_binary(
name ="gazelle_binary",
languages = [
"@rules_docs_gazelle//gazelle",
],
)
The extension only operates in directories where both a BUILD file and a
README.md already exist. Newly generated rules use glob(["*.md"]) and are
visible only to their nearest ancestor Bazel package. Existing srcs, deps,
visibility, and prefix attributes are preserved.
The public @rules_docs_gazelle//gazelle:gazelle_docs binary contains only
this extension and can update a nested workspace without initializing
unrelated language plugins from its parent repository.
21 - Rules docs Gazelle
Gazelle extension for Bazel documentation packaging rules
rules_docs_gazelle adds a docs_filegroup to existing Bazel packages that
contain a README.md. The generated rule loads its macro from rules_docs.
Add rules_docs as a normal dependency and this generator as a development
dependency:
bazel_dep(name ="rules_docs", version ="<VERSION>")
bazel_dep(
name ="rules_docs_gazelle",
version ="<VERSION>",
dev_dependency =True,
)
Add the public language target to the repository’s custom Gazelle binary:
load("@gazelle//:def.bzl", "gazelle_binary")
gazelle_binary(
name ="gazelle_binary",
languages = [
"@rules_docs_gazelle//gazelle",
],
)
The extension only operates in directories where both a BUILD file and a
README.md already exist. Newly generated rules use glob(["*.md"]) and are
visible only to their nearest ancestor Bazel package. Existing srcs, deps,
visibility, and prefix attributes are preserved.
The public @rules_docs_gazelle//gazelle:gazelle_docs binary contains only
this extension and can update a nested workspace without initializing
unrelated language plugins from its parent repository.
22 - Rules Hugo
Bazel rules for Hugo sites
rules_hugo builds Hugo sites with a registered Hugo toolchain. It keeps the
site archive in the target configuration and the Hugo binary in the execution
configuration so site sources are not rebuilt for the execution platform.
al_hugo_site wraps a site source archive and its PostCSS tooling.
al_hugo_run_binary builds the site with the registered Hugo toolchain and
al_hugo_binary exposes a runnable Hugo command for a site. The optional
al_hugo_worker rule runs the build through a persistent worker.
Module setup
bazel_dep(name ="rules_hugo", version ="<VERSION>")
The Hugo toolchain is generated by the al_hugo_extension module
extension, not declared in @rules_hugo//pkg/bzl. Declare the extension
in the root module, request the toolchain archives for the Hugo version,
and register the generated toolchain repository:
al_hugo_extension = use_extension(
"@rules_hugo//pkg/bzl:al_hugo_extension.bzl",
"al_hugo_extension",
)
al_hugo_extension.toolchains(
name ="my_hugo_toolchain",
version ="0.165.0",
)
use_repo(
al_hugo_extension,
"my_hugo_toolchain_os_linux_cpu_x86_64",
)
register_toolchains("@my_hugo_toolchain_os_linux_cpu_x86_64")
The generated repository name is "<name>_<os>_<cpu>" for each platform
in the requested version’s archive set. See
projects/alwaldend.com/include.MODULE.bazel for a complete example that
also wires the Hugo lock file and remote themes.
23 - Rules Promptfoo
A pinned Bazel runner for Promptfoo skill evaluations
rules_promptfoo runs repository skills through a pinned Promptfoo CLI. It
keeps dependency resolution reproducible in Bazel while deliberately running
model calls only at test runtime.
Setup
Add the module and its skill-provider dependency:
bazel_dep(name ="rules_promptfoo", version ="<VERSION>")
bazel_dep(name ="rules_skill", version ="<VERSION>")
The development checkout uses sibling local_path_override declarations.
Published releases must replace those local overrides with registry versions.
The runner physically copies each selected SkillInfo.files_by_path bundle
to an isolated Bazel test-temporary
workspace/.agents/skills/<name>/ tree. Point the Codex SDK provider at the
exported workspace and, when using a compatible host Codex executable, at the
exported executable path:
Live eval targets are tagged manual, requires-network, no-cache,
no-remote, and local. They also pass --no-cache, --no-write, and
--no-share to Promptfoo; local prevents sandboxed or remote execution when
the caller opts into host Codex credentials. The runner exports a separate
empty PROMPTFOO_JUDGE_WORKSPACE so a model judge need not discover the skill
it grades. Explicit results are preserved as the Bazel undeclared output
results.json; Promptfoo configuration, cache, isolated workspaces, and
subprocess temporary files stay in a mode-0700 directory below Bazel’s
absolute TEST_TMPDIR and are removed on exit. Bazel owns and cleans that
private parent directory as a second cleanup boundary. Callers that must
redirect test scratch can use Bazel’s --test_tmpdir option.
The runner deliberately uses Bazel-managed temporary storage instead of a
source-checkout out/ directory. Putting a no-skill control below the source
tree would expose the checkout’s .agents directory through an ancestor and
invalidate the isolation that the control is meant to measure. This is the
repository policy’s operating-system-temporary exception for a tool that
cannot safely use task-local source storage; the runner still removes its
randomized child directory on normal exit and handled signals. The runner
rejects a TEST_TMPDIR below any ancestor containing .agents, so do not
redirect --test_tmpdir into a source checkout or another agent tree.
results.json contains the evaluated prompts and model outputs. CI may collect
undeclared outputs when a manual eval is explicitly run, so treat the artifact
as potentially sensitive even though the target is no-cache and no-remote.
Run a live target explicitly and pass the absolute path to an existing Codex
login and a compatible host Codex executable through the test environment,
never credential contents through env or a checked-in config. Set the
provider’s codex_path_override from CODEX_PATH_OVERRIDE:
bazel_agent bazel test //path/to:answer_question_eval \
--test_env=CODEX_HOME=/absolute/path/to/.codex \
--test_env=CODEX_PATH_OVERRIDE=/absolute/path/to/codex \
--test_output=errors
If that Codex installation reaches OpenAI through host proxy variables, pass
only the needed names as well (for example, --test_env=HTTPS_PROXY and
--test_env=NO_PROXY) and declare the same names in the rule’s env_inherit.
Do not put proxy values in checked-in files.
With reuse_codex_login = True, the runner links only the writable
CODEX_HOME/auth.json into distinct, otherwise empty subject and judge Codex
homes inside its mode-0700 state directory. Provider configs can select them
through PROMPTFOO_SUBJECT_CODEX_HOME and PROMPTFOO_JUDGE_CODEX_HOME. The
runner holds an exclusive advisory lock on the stable login directory for the
complete test, serializing repository eval targets that use the same login.
With a compatible Codex executable, an automatic refresh writes through either
link to the persistent host file, while the host’s config.toml, skills,
plugins, memories, and MCP configuration remain unstaged and cannot contaminate
the subject, no-skill control, or judge. This reuses the caller’s existing
login state; it does not mint or export a token. An API-key-backed target may
instead inherit OPENAI_API_KEY without enabling login reuse.
For this purpose, compatible means that file-backed auth updates open and
truncate $CODEX_HOME/auth.json, preserving the symlink. The bundled Codex
0.144.0 implementation and the tested host Codex 0.150.1 do this. Do not
override the executable with an implementation that atomically replaces the
isolated auth.json path: that would replace the symlink, split subject and
judge state, and fail to persist a rotated refresh token. See the corresponding
OpenAI Codex file-storage implementations for
0.144.0
and
0.150.1.
Login reuse also forces Promptfoo’s CLI, assertion-worker, and prompt-suggestion
concurrency to one, overriding higher configuration values so subject and judge
Codex processes cannot race the same single-use refresh token within one test.
Do not run another Codex process against the same auth.json concurrently;
unrelated processes do not honor the runner’s advisory lock. ChatGPT-managed
auth can rotate its refresh token, so the refreshed file must remain persistent
and have a single serialized user. The local-login mode is unsuitable for
shared or untrusted CI; use an API key or supported workload identity there.
In this public repository it is strictly a manual, trusted-developer workflow;
never seed or persist ChatGPT-managed auth in repository CI or artifacts.
See OpenAI’s
managed-auth guidance for the
refresh and serialization requirements.
Run credentialed live targets only from a reviewed, trusted revision. The
isolated working directory and read-only provider setting reduce accidental
writes, but Codex still has whatever host read access its enforced sandbox
policy permits and can send prompt context to the configured service.
Files in data are placed in the test runfiles. args are passed literally;
they do not expand Bazel location expressions. Prefer keeping checked-in
Promptfoo prompt and dataset files beside the config and list them in data
so Promptfoo’s own config-relative path resolution remains portable.
The env and env_inherit attributes cannot override Bazel’s test temporary
directories or the runner-owned TMPDIR, TMP, and TEMP values.
Validate without a model call
load(
"@rules_promptfoo//promptfoo:defs.bzl",
"promptfoo_validate_test",
)
promptfoo_validate_test(
name ="promptfoo_config_test",
config ="promptfooconfig.yaml",
)
Validation is an ordinary offline Bazel test and does not receive the live
eval tags. It rejects env_inherit so validation cannot accidentally receive
host credentials.
Dependency boundary
The module pins Promptfoo and the Codex SDK with a dedicated pnpm lock. npm
lifecycle hooks and optional dependencies are disabled. The Codex executable
and Promptfoo’s libSQL binding are promoted to explicit Linux x86-64
dependencies. AJV is also promoted because ajv-formats declares its runtime
peer as optional, which would otherwise be removed by no_optional. The
bundled real CLI target is intentionally compatible only with glibc-based
Linux x86-64. Bazel enforces the OS and CPU constraints, but this repository
does not currently expose a libc constraint. Other Promptfoo providers that
rely on omitted optional packages or install scripts must be reviewed and
promoted explicitly before use.
The pinned Promptfoo distribution is patched so
PROMPTFOO_DISABLE_TELEMETRY=1 also suppresses its best-effort request to
r.promptfoo.app. The upstream 0.122.2 telemetry implementation otherwise
records a “telemetry disabled” event through that separate endpoint. The same
patch makes Promptfoo’s otherwise hard-coded prompt-suggestion concurrency
honor the runner’s serialization setting.
24 - Rules Promptfoo Gazelle
Gazelle extension for offline Promptfoo validation tests
rules_promptfoo_gazelle generates required, offline
promptfoo_validate_test targets for Promptfoo configurations below an
evals/ directory. It never creates an evals subpackage and never generates
live promptfoo_test targets.
Add rules_promptfoo as a normal dependency and this generator as a
development dependency:
bazel_dep(name ="rules_promptfoo", version ="<VERSION>")
bazel_dep(
name ="rules_promptfoo_gazelle",
version ="<VERSION>",
dev_dependency =True,
)
For one-pass skill package creation, also add rules_skill as a normal
dependency and rules_skill_gazelle as a development dependency:
bazel_dep(name ="rules_skill", version ="<VERSION>")
bazel_dep(
name ="rules_skill_gazelle",
version ="<VERSION>",
dev_dependency =True,
)
Add both public language targets to the repository’s custom Gazelle binary:
load("@gazelle//:def.bzl", "gazelle_binary")
gazelle_binary(
name ="gazelle_binary",
languages = [
"@rules_promptfoo_gazelle//gazelle",
"@rules_skill_gazelle//gazelle",
],
)
With both extensions installed, a fresh directory containing SKILL.md and a
conventional Promptfoo configuration receives both skill_library and
promptfoo_validate_test targets in one Gazelle run; it does not need an
existing BUILD file.
The extension recognizes these conventional configuration paths:
The default file produces eval_config_test; a variant produces
eval_<sanitized_variant>_config_test. Variants are lowercased, and runs of
characters other than ASCII letters and digits become underscores. Colliding
sanitized names receive a stable path-derived __<8 lowercase hex digits>
suffix. The double underscore cannot be produced by the sanitizer, so a
variant cannot claim a collision target’s namespace.
When a non-root containing package has a SKILL.md, each ordinary validation
target stages that package’s conventional :skill target. Repository-root
skills are unsupported by rules_skill, so a root-package SKILL.md does not
infer that label. The exact no_skill variant omits skills so it remains a
control. A generic Promptfoo package without SKILL.md receives no inferred
skill label. Every non-configuration regular file under evals/, including
README.md and test cases, is added to data in sorted order. Directories
containing BUILD, BUILD.bazel, or an additional filename configured as
valid in Gazelle are package boundaries and are not traversed.
The extension reconciles config, data, and skills when a discovered
configuration matches a conventionally named validation target. Adding or
editing eval files therefore updates those attributes on the next run.
Removing or renaming a configuration does not delete the old target: a name
shape is not reliable proof that Gazelle created a rule, so stale targets must
be removed explicitly. Gazelle’s # keep semantics remain available at the
rule, attribute, and individual list-item levels for intentional overrides.
Other attributes, including args, env, tags, and visibility, remain
manual and are preserved while the generated target exists. Existing manual
or live promptfoo_test rules are also left intact.
The extension does not follow a symlink used as the package’s evals
directory, because it could escape the repository. Such a symlink, or another
unexpected filesystem scan error including an error while checking a candidate
package boundary, is a non-destructive no-op rather than a signal to remove
targets. Before scanning, it also resolves the repository root and package
directory and refuses a package whose resolved path escapes the workspace,
including a package reached through Gazelle’s symlink-following support. The
extension manages the shared load for both Promptfoo rule symbols and uses
Bzlmod’s apparent repository name.
The public @rules_promptfoo_gazelle//gazelle:gazelle_promptfoo binary
contains only this extension and can update a nested workspace without
initializing unrelated language plugins from its parent repository.
25 - Rules skill
Bazel rules and validation for Codex skills
rules_skill packages all files belonging to a Codex skill and validates its
instructions and optional OpenAI metadata with a hermetic Bazel aspect.
Getting started
Add the module and register the validation aspect:
bazel_dep(name ="rules_skill", version ="<VERSION>")
The package’s final path segment is the skill name, so a skill_library
cannot be declared in a repository root package. Move a root-level skill into
a named subpackage before declaring it.
Building the library materializes the skill_validation output group. The
aspect checks SKILL.md, verifies that the frontmatter name matches its
package directory, and validates agents/openai.yaml when it is present.
Consuming a skill
Rules that install or evaluate skills can require the public SkillInfo
provider:
name is the logical skill name derived from the final segment of root.
The validation aspect verifies that the SKILL.md frontmatter uses the same
name.
root is the owning Bazel package path within the skill’s repository, such
as projects/agents/skills/answer-question. It has no repository,
execution-path, or runfiles prefix. It is always non-empty because
repository root packages are unsupported.
files_by_path maps slash-separated paths relative to root to Bazel
File values. It includes SKILL.md, preserves nested paths such as
agents/openai.yaml, and has the same shape for source and generated files.
files remains the depset of all skill files. skill is the distinguished
SKILL.md file, and openai_yaml is the optional distinguished
agents/openai.yaml file.
Consumers should use files_by_path when staging a bundle instead of parsing
File.path or File.short_path. Every source must belong to the skill’s Bazel
package, and duplicate logical paths are rejected during analysis.
Maintaining source-tree discovery links
Use skill_discovery_links when a repository exposes canonical skill
directories through a local discovery index such as .agents/skills. Pass
the skill_library labels directly; the BUILD declaration is the complete
source of truth, so there is no separate link manifest or configuration file.
The macro also declares //:write_skill_links_test. That local, uncached test
reads the source checkout and requires the discovery directory to contain
exactly the skill names passed in BUILD, each as a direct relative symlink to
its canonical SkillInfo.root. It rejects missing, stale, extra, absolute, or
indirect links. Run the updater before the test after changing the label list:
bazel test //:write_skill_links_test
Both targets intentionally accept only source SKILL.md files from the same
repository. The exact-state test is a pinned-local checkout check rather than
a hermetic or remotely executable test: it resolves a source runfile back to
the workspace and then inspects the local symlinks. The generated programs
require Bash and POSIX symlink support and work on ordinary Linux and macOS
checkouts; native Windows checkouts are not supported.
The updater holds a sibling <discovery_dir>.lock directory while it changes
links, so concurrent declarations cannot produce a mixed set. A process killed
without running its exit trap can leave that lock behind; after confirming no
updater is active, remove the empty lock directory and rerun the updater. The
exact-state test detects any interrupted partial reconciliation.
26 - Rules skill Gazelle
Gazelle extension for Bazel skill libraries
rules_skill_gazelle adds a skill_library(name = "skill") to each named
subpackage that contains a SKILL.md. The generated rule loads its macro from
the apparent rules_skill repository, so Bzlmod repository mappings are
respected.
Add rules_skill as a normal dependency and this generator as a development
dependency:
bazel_dep(name ="rules_skill", version ="<VERSION>")
bazel_dep(
name ="rules_skill_gazelle",
version ="<VERSION>",
dev_dependency =True,
)
Add the public language target to the repository’s custom Gazelle binary:
load("@gazelle//:def.bzl", "gazelle_binary")
gazelle_binary(
name ="gazelle_binary",
languages = [
"@rules_skill_gazelle//gazelle",
],
)
The generator always excludes BUILD.bazel and BUILD, plus every custom
BUILD filename configured in Gazelle. Duplicate configured names are removed.
SKILL.md is sufficient for Gazelle to create a new BUILD file below the
repository root. A root-level SKILL.md is ignored because rules_skill
requires a named package from which it can derive the skill name. Existing
attributes on a manually maintained skill_library(name = "skill") are
preserved, and a missing SKILL.md does not delete a manual rule.
The public @rules_skill_gazelle//gazelle:gazelle_skills binary contains only
this extension and can update a nested workspace without initializing
unrelated language plugins from its parent repository.
27 - Rules template
Bazel rules and a Go command for rendering template files
rules_template provides Bazel rules and a Go command for rendering template
files. A registered toolchain supplies the templating executable to build
actions.
Getting started
MODULE.bazel:
bazel_dep(name ="rules_template", version ="<VERSION>")
register_toolchains("@rules_template//main/bzl:all")
BUILD.bazel:
27.1 - Bzl
Bazel code
28 - rules_iso
ISO image download and flash rules
Module extension that downloads ISO images with http_file and adds a
runnable iso_flash target next to each image.
29 - Sri
Command-line Subresource Integrity calculator using OpenSSL
sri calculates Subresource Integrity hashes for files using OpenSSL. Its
command-line interface accepts an input file and a digest algorithm, such as
SHA-256.
Usage: sri [OPTION...]
Generate sri of a file
Example:
bazel run //projects/sri -- --digest sha256 --file ${PWD}/README.md
-d, --digest=String Digest type (sha256, for example)
-f, --file=Path Path to the file to parse
-?, --help Give this help list
--usage Give a short usage message
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Reusable Terraform modules for Vault, virtual machines, and storage
This project contains reusable Terraform modules for Vault configuration,
Proxmox virtual machines, backup storage, and related infrastructure. The
module collection is still in progress.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Roll back partial plugin startup, drain requests before releasing resources,
and wait for plugin and command processes to exit. Stop independent plugins
concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify
Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login.
Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict
config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and
transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and
fix the existing blank-line formatting failure in the GitHub AL wrapper.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Roll back partial plugin startup, drain requests before releasing resources,
and wait for plugin and command processes to exit. Stop independent plugins
concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify
Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login.
Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict
config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and
transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and
fix the existing blank-line formatting failure in the GitHub AL wrapper.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Useless QT GUI is a desktop application built with C++ and Qt. Its Bazel build
uses a pinned Qt distribution without requiring a system Qt installation.
The Bazel build downloads a SHA-256-pinned Qt 6.8.3 distribution through
rules_qt; a system Qt installation is not required. The project previously
targeted Qt 6.9.0. Using 6.8.3 is a deliberate downgrade to the LTS version
supported and tested by the pinned rules_qt release.
