feat(bin): add opt-in per-project external contract mode - #3490
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains. Reviews (3): Last reviewed commit: "feat: add per-project external contract ..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ffd739ad7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| {TASK} | ||
|
|
||
| $HERDR_SECTION | ||
| $PROJECT_CONTRACT_SECTION$HERDR_SECTION |
There was a problem hiding this comment.
Captain, when a marked scout is promoted in place, its original scaffold contains the contract snapshot but not the # External project knowledge section, while fm-promote.sh adds only generic ship instructions and the definition of done. The resulting ship worker is never told not to modify AGENTS.md, CLAUDE.md, or agent skills, nor to return durable agent knowledge through firstmate, so this supported lifecycle can commit exactly the files external-contract mode is intended to prevent. Include these rules in the marked scout scaffold so they survive promotion, or add them during promotion.
AGENTS.md reference: AGENTS.md:L522-L524
Useful? React with 👍 / 👎.
| if [ ! -f "$EXTERNAL_CONTRACT_PATH" ] || [ ! -r "$EXTERNAL_CONTRACT_PATH" ] || [ ! -s "$EXTERNAL_CONTRACT_PATH" ]; then | ||
| refuse_external_contract |
There was a problem hiding this comment.
Captain, when a local or remote secondmate is provisioned with a marked project, fm-home-seed.sh and fm-remote-home-seed.sh copy the registry row—including +external-contract—but never copy or validate data/project-contracts/<project>.md. This lookup therefore resolves a nonexistent destination-home path, and the new preflight rejects every ship and scout brief in an otherwise successfully provisioned home. Copy or explicitly provision and validate the contract atomically with the marked registry row.
AGENTS.md reference: AGENTS.md:L262-L264
Useful? React with 👍 / 👎.
|
Speaking as Kun's firstmate: first look on HEAD Contract-class: opt-in (verified). Unconfigured / unmarked projects stay on the ordinary path: Attestation: MISSING. PR body has no bound raise SHA. Require no-mistakes failed on this HEAD ( CI this pass: first-time fork workflows approved for this HEAD — CI Mergeable: CONFLICTING vs current main ( Residuals to clear before merge (author):
Waiting on author — not a captain hold. Greptile's earlier NUL-truncation finding looks addressed on this HEAD (byte-count + NUL refuse). |
7f9c46a to
b47a5da
Compare
2 participants
Summary
Add an opt-in per-project external-contract mode while preserving byte-identical brief output for every ordinary project.
A marked project's complete private operating contract is embedded inline in every ship and scout brief.
Brief generation refuses rather than proceeding when that contract is absent, empty, unreadable, or cannot be read completely.
Behavior
bin/fm-project-mode.shresolves the independent+external-contractannotation without changing delivery posture.bin/fm-ensure-agents-md.shrefuses in-repository agent-file creation for marked projects with a generic project-facing policy message.Accepted guarantees
<firstmate-home>/data/project-contracts/<marked-project>.md, and write no brief.AGENTS.mdnorCLAUDE.mdfor a marked project.# Project memorynor an instruction to invoke the agent-file helper.Publication verification
The rewritten branch contains one feature commit on current base
77ee3c82f86ea9db4cbcfa39d226361dfa7868e8.Every commit diff that would be published was scanned, not only the final file tree.
No would-be-published commit carries the private project identifier, private origin identifier, private registry row, client identifier, or an absolute path under the operator's home.
The reconstructed commit tree is byte-identical to the accepted rebased result.
Verification
Passed locally:
The external-contract remote-seeding, fail-closed transfer, rollback, and delisting cases also pass in
tests/fm-remote-secondmate-lifecycle-e2e.test.sh.That full suite later fails at
first inheritance transaction never reached its blocked writeon both this branch and unchanged base77ee3c82f86ea9db4cbcfa39d226361dfa7868e8.The identical base failure is pre-existing and tracked separately; this change does not skip, disable, quarantine, or mark the case as expected to fail.
Risk
Medium because the opt-in contract now travels with marked project records during local and remote home seeding.
The transfer uses the existing private transport, validates complete bytes and destination containment, and rolls back both marker and contract together on failure.
Ordinary projects remain on the committed byte-identical baseline path.
Delivery
This updates pull request 3490 and its existing branch in place.
The upstream maintainer retains merge authority.