fix(court-remand): five bounded conditions from the #76 qe-court verdict - #86
Merged
Merged
Conversation
…t verdict The cross-vendor court on 6347d1a returned REMAND with eight conditions; this is the bounded subset. (B3 dependency-output threading, B4/B5 runner-lifecycle bounds, and B7 generalized escalation are architectural and intentionally left to the maintainer's in-flight work.) - B1 routing.mjs: a host-only --route override no longer inherits the previous host's default model ('implementation:claude' stopped handing codex's model to the claude CLI); cross-host leaves the model to the adapter default. The codified 'unset falls back to default' behavior being replaced is re-pinned as same-host-only. - B8 run.mjs: the human status line is gated behind !flags.json — one parseable document out of `ak run --json` again. - B6 subprocess.mjs: provider/providerProvenance are recorded as unknown on the claude/codex subprocess path (exit codes don't prove billing identity — ADR-0018's invariant), never fabricated from the host id. - A2 runner.mjs: validateWorkerResult now covers the timeout interpret() branch, so a malformed adapter result becomes a bounded protocol_error instead of shipping raw. - A3 registries.mjs: validateRegistries (duplicate ids, dangling projection/observability refs, canDriveSession->routing capabilities, billing/credential consistency) now runs AT module construction — a violating host edit throws at import instead of loading silently. Regression tests for each, incl. a fresh-process import pin for A3 and a document-purity test for B8 via a new run() executePlan test seam. pnpm run check exit 0 (1055 kit + cjs), pnpm run test:surface exit 0 (25).
15 tasks
…rm tests finding) The B8 document-purity tests called run() which read the real kit.json via loadKitConfig() — a machine with an unroutable stale host could flip the exit code. run() gains a cfg seam (mirrors the executePlan seam); the tests pass their own. No behavior change for callers.
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The cross-vendor qe-court on the #76 final head (
6347d1a) returned REMAND with eight bounded conditions (record + rationale). This PR is the bounded subset:routing.mjs— a host-only--routeoverride no longer inherits the previous host's default model (implementation:claudestopped handing codex's model to the claude CLI — reproduced live in the smoke). Cross-host leaves the model to the adapter's own default. The codified "unset falls back to default" behavior it replaces is re-pinned as same-host-only.run.mjs— the human status line is gated behind!flags.json:ak run --jsonemits exactly one parseable document again.subprocess.mjs—provider/providerProvenancerecorded asunknownon the claude/codex subprocess path (exit codes don't prove billing identity — ADR-0018's own invariant), never fabricated from the host id.runner.mjs—validateWorkerResultnow covers the timeoutinterpret()branch: a malformed adapter result becomes a boundedprotocol_errorinstead of shipping raw.registries.mjs—validateRegistries(duplicate ids, dangling projection/observability refs,canDriveSession→routing capabilities, billing/credential consistency) now runs at module construction — a violating host edit throws at import instead of loading silently.Deliberately not in this PR
The three remaining conditions are architectural and belong to the maintainer's in-flight work: B3 (threading dependency outputs into dependent prompts vs. documenting the shared-cwd contract), B4/B5 (runner lifecycle bounds: timeout coverage of readiness/prepare/launch +
terminate()close-wait/SIGKILL), and B7 (generalized--escalateinak run— punch-list item 1 on #76).Verification
run()executePlantest seam; B6 unknown-provenance on both subprocess adapters; A2 malformed-timeout-interpret bounded; A3 fresh-process import pin.pnpm run checkexit 0 (1055 kit + cjs),pnpm run test:surfaceexit 0 (25).Refs #76. Stacks independently of #85 (adapter protocol fix).