clawmates

839 Commits 5 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Omar SobhandClaude Opus 5	769e002bb3	feat(skills): deliver on every tier, record what agents receive, let them self-author Three phases of the approved plan, plus a correction to what the last one claimed. CORRECTION: skills reached ONE tier, not all of them The previous commit said "skills can now reach a mission agent". That was true only for the container/ZeroClaw tier — the fall-through that queues a topology_runs row for topology_worker, which drives the executor that was patched. compose_turn_prompt/pinned_skills_text had exactly one production caller, and phase_runner's three other paths (composed microVM, solo microVM, direct session) never called it. CAPABILITY-REVIEW.md said the broad thing too; both are corrected. Those three tiers share one task string and have no per-turn alias, so their skills resolve per PHASE from the mission's crew and are appended there. The container tier deliberately still injects per turn, with the running node's own role — appending in both places would put every crew member's skills in every turn twice. The behavioural tests prove phase_skills_text and compose_turn_prompt work. They cannot prove the three launch_* calls pass the composed string, and that substitution is a one-word edit that would silently return all three tiers to delivering nothing with every test still green. So there is also a source-level assertion on the call sites, following the precedent in mission_events::the_cap_is_enforced_in_one_statement. Its negative control names the exact tier. PROVENANCE: what an agent received, and what it said it did Both were unanswerable. The prompt was never stored anywhere on any tier — re-deriving it later re-runs the skill lookup against a catalogue that has since changed, and once agents author their own skills it certainly will have. The reasoning rows were durably write-only: pushed live once, then never read from the database again by anything except the GC that deletes them. - prompt.composed records the exact bytes, on all four tiers - the session tier writes its checkpoint record and a reasoning row, instead of eprintln! and nothing — the same defect the solo microVM path was fixed for, in the last tier that still had it - narrative_for_mission reads both back Found while doing it: the 400-event per-phase cap counted EVERY kind, so a busy phase could push out its own phase.completed and its own provenance. The cap now counts only the two unbounded kinds it was written for. Negative control confirms the old behaviour dropped the prompt. Retention is now a per-mission hold (0080) rather than a raised global — with a test asserting unheld missions are still reaped, because an exemption that applies to everything is not an exemption. SELF-AUTHORING: agents apply their own skill drafts, no human click By operator decision. level_up has generated complete drafts from a model since it shipped; only a checkbox stood between propose and apply. What replaces the gate is not another gate but four properties, each held by a test: - workspace-scoped, so a hand-authored skill can never be modified - a draft cannot take a hand-authored skill's name. Ids are scoped and bindings resolve by skill_id, so it could not overwrite or shadow one anyway — but two procedures under one name means nobody reading a transcript can tell which the agent followed, and that ambiguity is fatal in a system where the skill is the standard being graded against - every revision appends a skill_versions row, so it can be reverted and a past run can be read against the text it was actually judged under - approved_by = NULL. An agent's decision is never attributed to a person who did not make it Only skill_candidate applies autonomously. identity_refinement and brain_consolidation still wait for a human: they change what an agent IS rather than adding a procedure it can consult. State is announced at boot, because a safety gate that changes silently is one nobody notices changed. CLAWMATES_SKILL_SELF_AUTHORING=0 restores it. Also: the test Postgres ran out of /dev/shm mid-suite (Docker's 64MB default) and surfaced it during MIGRATIONS, which reads like a schema fault and is not one. --shm-size=1g, and a pointer to the `clean` subcommand that already existed for the 779 leaked test databases. Full workspace suite green: 106 binaries, no failures. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-08-19 10:24:35 -07:00
Omar SobhandClaude Opus 5	9e61e3ba35	feat(viz): what the agents actually did, as structured events The World could draw a mission's shape but nothing about the work. The detail existed only as prose in checkpoint.log and model output, where a tool name is indistinguishable from an agent talking about a tool — so it was never parsed, deliberately. `mission_events` is the structured channel that replaces it. Three taps, one table: - Container tier: the `_ => {}` at the end of topology_exec's typed frame stream now matches `tool_call` and reads the tool's JSON ARGUMENTS for a path. Never the prose summary — a path scraped from a sentence would put files on the map that no agent opened, and the test proves a Grep whose summary says "src/main.rs" produces no file touch. The frame name itself is unverified, so the same commit ships an unmatched-frame-type histogram: a tap that matches nothing looks exactly like a mission that used no tools, and this is how one gw-04 run names the real frame. - microVM tier: a `PostToolUse` hook, the seam vm_stop_gate already proved fires under `claude -p`. It copies stdin to /root/tap and exits 0 unconditionally — a non-zero PostToolUse hook talks back to the model, which would turn the observer into a participant. Drained before collect, since the VM is destroyed moments later. - Phase transitions: five identical copies of the pending→running UPDATE became one `mark_phase_running`, and `close_finished_phases` grew RETURNING. Its CASE decides each phase's status inside SQL from rows the statement does not change, so it cannot be re-derived afterwards without writing that CASE twice — without RETURNING it emits zero phase.completed and reports success. The settings.json hazard the plan called out: the stop gate wrote the WHOLE document, so a second hook writer would have silently erased it and a coding phase would then complete having written nothing — the exact failure the gate exists to catch. There is now one composer, `vm_tool_tap::guest_settings`, one writer, and a source-walk test that fails if anything else writes a settings document. `mission_events.run_id` carries no FK on purpose: phase_runner DELETEs topology_runs on retry, and a cascade would erase a phase's whole history the moment it retried — silently, since a cascade is not an error. world.rs streams it with a cursor that separates backfill from motion. Everything already in the table when a subscriber arrives is drawn as settled history; only what lands afterwards animates. Otherwise opening a finished mission replays an hour of tool calls as a burst storm. Bounded twice: 400 events per phase (enforced inside the INSERT, since two concurrent taps would each read a count below the cap) and a 7-day retention sweep in mission_gc. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-08-11 09:16:50 -07:00
Omar SobhandClaude Opus 5	1f6108f769	feat(gc): reclaim the mission tree on the gateway `cleanup_sweeper` prunes ROWS. Deleting a row has never deleted a directory, and `teardown_container` only runs while a mission still exists to tear down — so a mission removed by any path that skipped teardown left its tree behind permanently, on the smallest disk in the fleet (150 GB, shared with postgres and every checkout). 106 mission directories are sitting there now. Filesystem-first, deliberately: the DB is the PREDICATE, never the enumerator. Enumerating from the database is exactly how these became invisible — a directory whose row is gone is the one a row-driven sweep cannot see. Three reapers, one deletion path. Orphan mission dirs (no row, past a 2h grace), scratch trees (_bench/_gate/_verify/_merge past 6h — all four have leaked before), and _outputs past 90d, whose artifact rows are marked only AFTER the files are gone, because the other order claims artifacts are reaped while they are still on disk. The single removal path escalates: the server is uid 65532 and cannot delete what the per-mission daemon leaves as root, so PermissionDenied falls back to `root_copy::purge` and shouts if the tree survives even that. A GC that cannot collect is the thing being fixed, so failures are counted and reported, never swallowed. Guards worth naming: `_cargo` is a SHARED cache every mission writes to and lives under the same root, so an underscore-prefixed sibling treated as an orphan mission would delete it out from under running work and look like a slow cargo build. Only a well-formed mission id is ever a candidate — a directory whose name is not an id can have no row by construction, so without that gate every unrecognised directory looks orphaned. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-08-09 15:02:25 -07:00

Author

SHA1

Message

Date

Omar SobhandClaude Opus 5

769e002bb3

feat(skills): deliver on every tier, record what agents receive, let them self-author

Three phases of the approved plan, plus a correction to what the last one
claimed.

CORRECTION: skills reached ONE tier, not all of them

The previous commit said "skills can now reach a mission agent". That was
true only for the container/ZeroClaw tier — the fall-through that queues a
topology_runs row for topology_worker, which drives the executor that was
patched. compose_turn_prompt/pinned_skills_text had exactly one production
caller, and phase_runner's three other paths (composed microVM, solo
microVM, direct session) never called it. CAPABILITY-REVIEW.md said the
broad thing too; both are corrected.

Those three tiers share one task string and have no per-turn alias, so
their skills resolve per PHASE from the mission's crew and are appended
there. The container tier deliberately still injects per turn, with the
running node's own role — appending in both places would put every crew
member's skills in every turn twice.

The behavioural tests prove phase_skills_text and compose_turn_prompt work.
They cannot prove the three launch_* calls pass the composed string, and
that substitution is a one-word edit that would silently return all three
tiers to delivering nothing with every test still green. So there is also a
source-level assertion on the call sites, following the precedent in
mission_events::the_cap_is_enforced_in_one_statement. Its negative control
names the exact tier.

PROVENANCE: what an agent received, and what it said it did

Both were unanswerable. The prompt was never stored anywhere on any tier —
re-deriving it later re-runs the skill lookup against a catalogue that has
since changed, and once agents author their own skills it certainly will
have. The reasoning rows were durably write-only: pushed live once, then
never read from the database again by anything except the GC that deletes
them.

  - prompt.composed records the exact bytes, on all four tiers
  - the session tier writes its checkpoint record and a reasoning row,
    instead of eprintln! and nothing — the same defect the solo microVM
    path was fixed for, in the last tier that still had it
  - narrative_for_mission reads both back

Found while doing it: the 400-event per-phase cap counted EVERY kind, so a
busy phase could push out its own phase.completed and its own provenance.
The cap now counts only the two unbounded kinds it was written for.
Negative control confirms the old behaviour dropped the prompt.

Retention is now a per-mission hold (0080) rather than a raised global —
with a test asserting unheld missions are still reaped, because an
exemption that applies to everything is not an exemption.

SELF-AUTHORING: agents apply their own skill drafts, no human click

By operator decision. level_up has generated complete drafts from a model
since it shipped; only a checkbox stood between propose and apply.

What replaces the gate is not another gate but four properties, each held
by a test:

  - workspace-scoped, so a hand-authored skill can never be modified
  - a draft cannot take a hand-authored skill's name. Ids are scoped and
    bindings resolve by skill_id, so it could not overwrite or shadow one
    anyway — but two procedures under one name means nobody reading a
    transcript can tell which the agent followed, and that ambiguity is
    fatal in a system where the skill is the standard being graded against
  - every revision appends a skill_versions row, so it can be reverted and
    a past run can be read against the text it was actually judged under
  - approved_by = NULL. An agent's decision is never attributed to a person
    who did not make it

Only skill_candidate applies autonomously. identity_refinement and
brain_consolidation still wait for a human: they change what an agent IS
rather than adding a procedure it can consult. State is announced at boot,
because a safety gate that changes silently is one nobody notices changed.
CLAWMATES_SKILL_SELF_AUTHORING=0 restores it.

Also: the test Postgres ran out of /dev/shm mid-suite (Docker's 64MB
default) and surfaced it during MIGRATIONS, which reads like a schema fault
and is not one. --shm-size=1g, and a pointer to the `clean` subcommand that
already existed for the 779 leaked test databases.

Full workspace suite green: 106 binaries, no failures.

Co-Authored-By: Claude Opus 5 <[email protected]>

2026-08-19 10:24:35 -07:00

Omar SobhandClaude Opus 5

9e61e3ba35

feat(viz): what the agents actually did, as structured events

The World could draw a mission's shape but nothing about the work. The
detail existed only as prose in checkpoint.log and model output, where a
tool name is indistinguishable from an agent *talking about* a tool — so
it was never parsed, deliberately. `mission_events` is the structured
channel that replaces it.

Three taps, one table:

- Container tier: the `_ => {}` at the end of topology_exec's typed frame
  stream now matches `tool_call` and reads the tool's JSON ARGUMENTS for a
  path. Never the prose summary — a path scraped from a sentence would put
  files on the map that no agent opened, and the test proves a Grep whose
  summary says "src/main.rs" produces no file touch. The frame name itself
  is unverified, so the same commit ships an unmatched-frame-type
  histogram: a tap that matches nothing looks exactly like a mission that
  used no tools, and this is how one gw-04 run names the real frame.

- microVM tier: a `PostToolUse` hook, the seam vm_stop_gate already proved
  fires under `claude -p`. It copies stdin to /root/tap and exits 0
  unconditionally — a non-zero PostToolUse hook talks back to the model,
  which would turn the observer into a participant. Drained before collect,
  since the VM is destroyed moments later.

- Phase transitions: five identical copies of the pending→running UPDATE
  became one `mark_phase_running`, and `close_finished_phases` grew
  RETURNING. Its CASE decides each phase's status inside SQL from rows the
  statement does not change, so it cannot be re-derived afterwards without
  writing that CASE twice — without RETURNING it emits zero phase.completed
  and reports success.

The settings.json hazard the plan called out: the stop gate wrote the
WHOLE document, so a second hook writer would have silently erased it and
a coding phase would then complete having written nothing — the exact
failure the gate exists to catch. There is now one composer,
`vm_tool_tap::guest_settings`, one writer, and a source-walk test that
fails if anything else writes a settings document.

`mission_events.run_id` carries no FK on purpose: phase_runner DELETEs
topology_runs on retry, and a cascade would erase a phase's whole history
the moment it retried — silently, since a cascade is not an error.

world.rs streams it with a cursor that separates backfill from motion.
Everything already in the table when a subscriber arrives is drawn as
settled history; only what lands afterwards animates. Otherwise opening a
finished mission replays an hour of tool calls as a burst storm.

Bounded twice: 400 events per phase (enforced inside the INSERT, since
two concurrent taps would each read a count below the cap) and a 7-day
retention sweep in mission_gc.

Co-Authored-By: Claude Opus 5 <[email protected]>

2026-08-11 09:16:50 -07:00

Omar SobhandClaude Opus 5

1f6108f769

feat(gc): reclaim the mission tree on the gateway

`cleanup_sweeper` prunes ROWS. Deleting a row has never deleted a directory,
and `teardown_container` only runs while a mission still exists to tear down —
so a mission removed by any path that skipped teardown left its tree behind
permanently, on the smallest disk in the fleet (150 GB, shared with postgres and
every checkout). 106 mission directories are sitting there now.

Filesystem-first, deliberately: the DB is the PREDICATE, never the enumerator.
Enumerating from the database is exactly how these became invisible — a
directory whose row is gone is the one a row-driven sweep cannot see.

Three reapers, one deletion path. Orphan mission dirs (no row, past a 2h grace),
scratch trees (_bench/_gate/_verify/_merge past 6h — all four have leaked
before), and _outputs past 90d, whose artifact rows are marked only AFTER the
files are gone, because the other order claims artifacts are reaped while they
are still on disk.

The single removal path escalates: the server is uid 65532 and cannot delete
what the per-mission daemon leaves as root, so PermissionDenied falls back to
`root_copy::purge` and shouts if the tree survives even that. A GC that cannot
collect is the thing being fixed, so failures are counted and reported, never
swallowed.

Guards worth naming: `_cargo` is a SHARED cache every mission writes to and
lives under the same root, so an underscore-prefixed sibling treated as an
orphan mission would delete it out from under running work and look like a slow
cargo build. Only a well-formed mission id is ever a candidate — a directory
whose name is not an id can have no row by construction, so without that gate
every unrecognised directory looks orphaned.

Co-Authored-By: Claude Opus 5 <[email protected]>

2026-08-09 15:02:25 -07:00