Repository navigation
Block model-policy migration completion when preserved guidance still authorizes autonomous xhigh #174
Description
Problem
The updater correctly preserves customized policy surfaces, but it can still record the current model-policy schema as fully migrated while those preserved files contain autonomous xhigh guidance.
The #86 final review proved the false-attestation path:
- an AGENTS.md without trustworthy generated-file provenance is preserved byte-for-byte;
- customized START-SDLC.md / SDLC-LOOP.md / repo skill files can also be preserved;
- those files may still say
Baseline reasoning: xhighorUse xhigh reasoning by default for this repo.; - update nevertheless sets
manifest.model_profile.policy_schema_versionto the latest schema, removes the legacy field, and converges without revisiting the unresolved policy conflict.
Preserving user customization is required. Claiming migration completion while effective repo guidance still authorizes autonomous xhigh is not.
Acceptance criteria
- Detect unresolved autonomous-effort guidance in every customized or untracked policy surface skipped during model-policy migration.
- Preserve customized files byte-for-byte unless the user explicitly selects replacement.
- Do not record the latest model-policy schema as complete while any skipped policy surface still conflicts with the High-only contract.
- Emit an explicit, actionable, repeatable unresolved-conflict result naming each path; a second update must not silently report convergence.
- Continue applying unrelated safe repairs without falsely certifying the policy migration, or fail before mutation if atomicity requires it; choose and document one deterministic contract.
- Distinguish structured selected-profile configuration from arbitrary persisted prose and keep explicit mixed-profile preservation intact.
- Add RED/GREEN regressions for missing generated provenance, customized generated docs, fully customized policy surfaces, and clean non-conflicting customization.
- Prove PowerShell parity: document/test that install.ps1
schema_version = 2belongs to the model-profile file rather than manifest model-policy schema, and that PowerShell emits no legacyescalation_reasoningauthority. - Keep the fix(review): stop tool-free cross-model reviews when Claude invokes advisor #158 one-time exception consumed; require normal Sol High + Fable High review with no exception.
- Synchronize ROADMAP and the authoritative 1.0 milestone in this slice.
Evidence source
#86 final candidate 7cfa28ec0add78c706cd24f28b15a9e9e99d023b passed canonical 11/11, then the required reviewers converged after one reconciliation on a P1: schema migration completion is false when preserved policy still authorizes autonomous xhigh. The receipt is non-certifying and no retry is recommended.
Non-goals
- Do not overwrite customized policy files automatically.
- Do not normalize or ignore reviewer verdicts.
- Do not add another Enforce Sol High implementation and High-only planning/review #86 correction round or review exception.
Activity
BaseInfinity commentedon Aug 23, 2026
Start checkpoint — decomposed current-main slice
Confidence: HIGH.
/Users/stefanayala/codex-sdlc-issue174fix/issue-174-truthful-policy-migrationorigin/mainatb7c8d4590a483afa0be61f1bb9ed4408d3b520cdNarrow contract
install.ps1model-profile schema v2 must not be confused with manifest policy schema.TDD plan
BaseInfinity commentedon Aug 23, 2026
TDD RED
Focused command:
Result: expected 0 pass / 1 fail.
The unchanged updater preserved specialized
AGENTS.mdbytes but still planned and applied:The new contract requires the old schema to remain, an
AGENTS.md: autonomous effort conflict -> manual resolution requiredplan entry, and the same actionable pending result on the second update. No production implementation changed before this RED.BaseInfinity commentedon Aug 23, 2026
Focused GREEN — truthful pending migration contract
Implementation now:
AGENTS.md,SDLC-LOOP.md,START-SDLC.md, reposdlcskill) during model-policy schema migration;mixedselection valid;schema_version = 2is themodel-profile.jsonpayload schema and emits neither manifestpolicy_schema_versionnor legacyescalation_reasoningauthority.TDD and focused proof:
git diff --check: GREEN.ROADMAP now matches the authoritative milestone: 9 open / 15 closed, with #174 -> #86 -> #109 first. #79 remains the exact-candidate real Windows Codex Desktop + CLI gate, and #88 remains public artifact verification across both hosts.
Next: freeze the candidate, run the one canonical stamped 11/11 proof, then normal Sol High + Fable High review with no exception.
BaseInfinity commentedon Aug 23, 2026
Canonical candidate proof — 11/11
Frozen candidate:
b7c8d4590a483afa0be61f1bb9ed4408d3b520cd2636c7da25fcd9a19735112f938e050981012a6c20b901eb0a8b066467d4c75ee6d3dc96a9333155c83d71062d37a1a4a9cd7618Canonical stamped command:
Result: 11/11 PASS.
The proof stamp is bound to this worktree fingerprint and expires at
2026-08-24T02:46:21.365Z. Next gate is the required normal Sol High + Fable High review over this unchanged candidate; no exception is available or requested.BaseInfinity commentedon Aug 23, 2026
Required dual review — non-certifying terminal outcome
The exact frozen candidate remained unchanged:
2636c7da25fcd9a19735112f938e050981012a6c20b901eb0a8b066467d4c75ee6d3dc96a9333155c83d71062d37a1a4a9cd7618Normal Sol High + Fable High review stopped after 125.9s with:
partialfalseINVALID_VERDICTinvalid_executionfalsefalsefalseNOT CERTIFIEDFable High used the required preferred Anthropic route and no tools, but returned only an interim statement that it would review and first look for the base repository. It did not emit the required final JSON object or exact verdict literal. This is invalid execution, not auth/quota/transport infrastructure, so it must not be retried or normalized.
Sol High was still running and was cancelled when the peer failed. It had not completed a valid verdict, so there is no completed peer result to preserve. The partial receipt and full private logs remain intact in Git metadata.
No commit, push, PR, delivery, or exception occurred. #174 remains frozen and non-certifying. The next action is a separate P0 blocker that makes the tool-free Fable prompt require an immediate final review from the complete supplied patch/context, without repository-inspection deferral; then #174 must resume from fresh current main with fresh proof and normal review.
BaseInfinity commentedon Aug 24, 2026
Resume checkpoint — fresh current-main candidate after #175
Confidence: HIGH.
Reconciliation onto current main:
Plan:
No review exception is available or requested.
BaseInfinity commentedon Aug 24, 2026
Fresh current-main candidate frozen for canonical proof
Candidate identity:
Current-main reconciliation/focused evidence:
Self-review added two bounded RED -> GREEN corrections:
The canonical updater now contains 43 cases. Next: one canonical stamped 11/11 proof on this exact candidate, then normal Sol High + Fable High review with no exception.
BaseInfinity commentedon Aug 24, 2026
Fresh current-main canonical proof — 11/11 PASS
Exact candidate:
Canonical stamped command:
Result: 11/11 PASS.
The proof receipt is fresh, reviewed, and bound to this worktree fingerprint. Next gate is fresh normal Sol High + Fable High review over this unchanged current-main candidate. The previous #174 receipt remains non-certifying evidence only; no retry or exception is being used.
BaseInfinity commentedon Aug 24, 2026
Fresh current-main required review — NOT CERTIFIED
The exact candidate remained unchanged:
Both required reviewers completed normally and reconciled once:
Agreed blockers:
Non-blocking review notes also identified the arbitrary-script test seam, EXIT-trap composition/naming, brittle PowerShell comment grep, and conservative negation behavior.
One bounded correction round now follows with tests first:
This receipt is preserved and will not be retried unchanged. Any corrected candidate requires fresh canonical proof and fresh normal dual review.
BaseInfinity commentedon Aug 24, 2026
Corrected current-main candidate checkpoint (normal gates; no exception):
1e9ce83e7e33142a1c6150ad18fd70eb0cf14362fix/issue-174-truthful-policy-migration-v2in/Users/stefanayala/codex-sdlc-issue174-v210df83dbaa7300e1d844beaefa5d44fe1a76046321950477e460b850c1d6c6d334535c89075f8cd1d9a0a3c8329a5b81f845abebOne bounded correction round resolved the reconciled P1s from the prior non-certifying receipt: legacy whole-slice/automatic autonomous xhigh authority is detected; untracked AGENTS/SDLC-LOOP/START guidance cannot bypass inspection; empty skipped-surface expansion is safe on stock macOS Bash; setup-failure restoration uses a bounded boolean test injection and propagates the real status without an EXIT-trap override. Legacy test fixture text is assembled at runtime so the repo-wide stale-model guard remains strict.
Focused/broad proof is green on the frozen bytes:
Next: fresh canonical 11/11 on this exact tree, then required Sol High + Fable High dual review. Certification and delivery remain forbidden unless both reviewers complete normally and verdict rules pass. The #158 exception remains consumed.
BaseInfinity commentedon Aug 24, 2026
Canonical candidate-bound proof passed on the unchanged frozen candidate.
10df83dbaa7300e1d844beaefa5d44fe1a76046321950477e460b850c1d6c6d334535c89075f8cd1d9a0a3c8329a5b81f845abebThe staged tree and patch hash were recomputed after proof and are unchanged. Starting required normal Sol High + Fable High dual review now; certification remains fail-closed unless both complete and reconciled verdict rules pass.
BaseInfinity commentedon Aug 24, 2026
Required dual review completed normally and is NOT CERTIFIED. No commit, push, PR, merge, exception, or retry.
10df83dbaa7300e1d844beaefa5d44fe1a76046321950477e460b850c1d6c6d334535c89075f8cd1d9a0a3c8329a5b81f845abebreviewer_verdictReconciled P1: the detector misses this repository’s own conditional autonomous-xhigh clauses (
Escalate the difficult slice to xhigh ... when high leaves unresolved risk, plus equivalent AGENTS/template wording). A preserved skipped surface can therefore still be falsely attested as migrated.Candidate-born P2s to include in the final bounded correction: restore the old schema after any failed regeneration while migration was pending, even when no prose conflict was detected; and do not treat benign
highguidance as conflicting merely because a structured mixed profile has medium baseline. P3s are non-blocking and will be handled only if narrow or filed separately.The SDLC contract permits one final (second) bounded corrective round. It will start with RED regressions against the exact base clauses and the no-conflict failure path. If P0/P1 remains after the next normal dual review, stop/decompose/escalate; do not waive or extend the loop. The #158 exception remains consumed.
BaseInfinity commentedon Aug 24, 2026
Final bounded correction checkpoint (second and last allowed round):
1e9ce83e7e33142a1c6150ad18fd70eb0cf143623e00a13fbdeca6530be88ac0bff245d1badaf9aa3e3b9e4c5d58bc639d697b510a24ee64136980d857758dc79a5cf4c46f3130f9RED reproduced the reconciled defects:
Escalate the difficult slice to xhigh ...clause produced no conflict;GREEN correction:
escalate ... xhighand generateduse xhigh ...authority now keep migration pending, including current SDLC-LOOP, START-SDLC, and generated AGENTS phrasings; explicit prohibitions remain non-conflicting;Affected proof: updater 44/44 PASS; standalone detector and both conflict/no-conflict failure paths PASS; syntax/diff checks PASS.
Next: one fresh canonical 11/11 on this exact tree, then one final normal Sol High + Fable High dual review. If P0/P1 remains, stop/decompose/escalate—no third correction, waiver, exception, or retry.
BaseInfinity commentedon Aug 24, 2026
Final candidate-bound canonical proof passed on unchanged bytes.
3e00a13fbdeca6530be88ac0bff245d1badaf9aa3e3b9e4c5d58bc639d697b510a24ee64136980d857758dc79a5cf4c46f3130f9Tree and patch hash were recomputed after proof and are unchanged. Starting the final allowed normal Sol High + Fable High review. No exception. If P0/P1 remains, the slice stops/decomposes/escalates rather than receiving another correction or waiver.
BaseInfinity commentedon Aug 24, 2026
Final allowed dual review completed normally and is NOT CERTIFIED. The two-correction cap is exhausted. No third correction, commit, push, PR, merge, waiver, exception, or retry.
3e00a13fbdeca6530be88ac0bff245d1badaf9aa3e3b9e4c5d58bc639d697b510a24ee64136980d857758dc79a5cf4c46f3130f9reviewer_verdict; infrastructure=false; transient=false; retry=falseSol P1s:
Autonomous coding runs at xhigh;Use high, not xhigh/Avoid xhighare falsely classified as authority.Joint P2s also show that the advertised
--force-allremediation does not deterministically resolve/attest untracked policy conflicts in one run, and the untracked repo skill sweep is asymmetric.Required stop/decomposition: abandon regex-based arbitrary-language attestation. A safer bounded contract is structural: after removing exact reviewer identifiers, any remaining
xhightoken in skipped prose is unattested (not semantically labeled authority); content without xhigh can complete;--force-allmust replace every conflicting managed/untracked policy surface and record the schema in one run. This removes cross-line/negation semantics and makes arbitrary declarative wording fail closed.The current worktree/candidate remains frozen for evidence only. A new 1.0 P0 decomposition issue and fresh human-authorized plan/worktree are required before implementation resumes. #158 exception remains consumed.
BaseInfinity commentedon Aug 24, 2026
Decomposition issue created and added to the authoritative 1.0 milestone: #178. #174 remains open and blocked; its frozen candidates/receipts remain evidence only. Implementation of #178 requires explicit maintainer authorization of a fresh plan.