kairos-chain 3.40.0 → 3.42.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2285b28e2f2954ca10f6da869b7446b4d18fdc0f9174451f20ec8f523142b322
-  data.tar.gz: 9a14c47fd141de6ff7eaec10d6e56c44f01e96b1cb0b9ab962eedb4baccc8e4b
+  metadata.gz: 07f782a3ef998bf91435a2e35cde051338c6f1c2fa8f2e037fbba4427c400ccf
+  data.tar.gz: 8cd549860f69e91fa94bf50a41121cb3b7625686f2438c2c665c83192f081f27
 SHA512:
-  metadata.gz: 89a5a8a47b38f8f703283c58d9e402efeab1a2124fa1ad2195c0820edd985301ce68b22dd40012614499d09f9b34410905e473ca33ccad97e8d32d804ba46eb1
-  data.tar.gz: df15f0d5f6cdb22039840cf780b235cba8194e77da2738478b37dbeb446c25814609887083566388bae2abeb2f067e0aa2ecb24d16b4ca626b75644818d794eb
+  metadata.gz: e1ec23c12c08cff2ce324b34715d8eedd0277863a4e561b439c7161bd6e1b08eb10936c36db603ba621544e424953fe24247fe553917d3d4fcb6e844867d7f42
+  data.tar.gz: 738519ef9bc54544c058f59661d08288b22d60904527dbfb7f99f501f89b35d1a80c095b2b5090750f9aff69d592acc46357fe4069064302db344659b68b5642

data/CHANGELOG.md

@@ -4,6 +4,89 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.42.0] - 2026-07-14
+
+### Fixed / Improved — agent SkillSet self-drive on long document sections
+
+Surfaced while running the governed agent OODA loop on a long Japanese
+naturalisation task. Four independent limitations:
+
+- **`document_authoring` context truncation (root cause).** `write_section`
+  handed the assembler a 4000-char `max_chars_per_source` cap, so long
+  `context_sources` were silently cut before generation. Raised the default to
+  500 000 (total 1 000 000); `SectionWriter` now bounds output size itself.
+- **`SectionWriter` output completeness.** `llm_call` was invoked without
+  `max_tokens`, so API providers truncated long sections at the ~4096 default —
+  now sized from context length. Providers without an output-length knob (e.g.
+  the `claude_code` CLI) are handled by **auto-chunking** the context at
+  paragraph boundaries (`section_chunk_target_chars`, default 3000) with a
+  bounded per-chunk instruction. `word_count` is now language-aware (character
+  count for JA/ZH/KO); a `char_count` field was added.
+- **Non-deterministic risk gate.** `Autonomos::Mandate.risk_exceeds_budget?`
+  used the DECIDE model's self-assigned per-step `risk`, so identical read-only
+  work gated inconsistently. Added a deterministic tool→risk map (`TOOL_RISK`),
+  authoritative for known tools (read-only ⇒ low, shell/destructive ⇒ high).
+- **DECIDE instruction drift & file reads.** The DECIDE prompt now (1) steers
+  disk reads to `safe_file_read` instead of `resource_read` with a `file://`
+  URI, and (2) requires verbatim pass-through of caller-supplied instructions
+  to sub-tools (no paraphrasing / re-scoping).
+
+Existing installs: run `system_upgrade` to pull the `external_tools` SkillSet
+(ships `safe_file_read`) into the runtime.
+
+## [3.41.1] - 2026-07-13
+
+### Fixed — Meeting Place Caddy healthcheck false-negative (deployment)
+
+The production `docker-compose.prod.yml` Caddy healthcheck probed
+`http://localhost:2019/config/`. Inside the `caddy:2-alpine` container
+`localhost` resolves to IPv6 `::1` first (both `127.0.0.1 localhost` and
+`::1 localhost` are in `/etc/hosts`), but the Caddy admin API binds IPv4
+`127.0.0.1` only — so the probe got connection-refused and the container was
+perpetually reported `unhealthy` while actually serving fine. Pinned the probe
+to `http://127.0.0.1:2019/config/`. Deployment-only change; no gem code affected.
+
+## [3.41.0] - 2026-07-11
+
+### Added — Agent SkillSet guard track Slice 2: native executor body (selectable-off)
+
+A native, instance-authored executor substrate for the agent SkillSet's
+delegated act route, discharging AGT-8 of the guard track. It coexists with the
+current Claude Code CLI substrate behind one dispatch contract (boundary-owned
+selection); it ships **selectable-off** (`agent_execute.substrate: cli`, and the
+guard itself defaults off in the gem template) and carries no act until its
+acceptance probes are green in an attended run. Substrate substitution only —
+no parent invariant (AGT-1..7) is added, weakened, or re-interpreted.
+
+- **`Agent::Staging` (NB-2)** — stages the whole executable closure (body + the
+  eligible direct-HTTP adapters + vendored `faraday`) into a read-only region
+  outside the work area, pinned by one content address and re-verified before
+  launch. A symlink in the staged tree, or a load resolving outside the pinned
+  region (RubyGems disabled + restricted load path), halts fail-closed.
+- **`Agent::Mediator` (NB-4)** — a boundary-side loopback forward proxy that
+  scopes egress by destination hostname and re-decides on every hop; the SBPL
+  profile denies all network except the mediator port, making it the sole
+  egress path. Excluded transports (subprocess-CLI adapters, bedrock) are not
+  staged, so they cannot load.
+- **`Agent::NativeBody::{Main,ToolLayer,ModelClient,SpendMeter}` (NB-1/3/5)** —
+  a separate confined process: value-only stdin intake, a load-bearing tool
+  layer over the granted surface (work-area-confined), staged HTTP-transport
+  model access with the provider credential env-windowed to the adapter call
+  only, and fail-closed ceilings — the per-call spend bound pre-estimates on the
+  prompt's **byte** length (a sound upper bound for byte-level BPE) across input
+  and output, and missing usage halts.
+- **`Confinement` / `AgentExecute`** — `native_body_profile` (egress-scoped) with
+  a self-sound `egress_scoped?` predicate; `execute_confined_native` reuses the
+  Slice 1 scratch geometry, manifest, and verdict-gated merge; the per-cycle
+  record now persists which executable carried the act (closure digest beside
+  the spec hash).
+
+Reviewed via a 3-round execution-grounded multi-LLM implementation review
+(R1 found 7 genuine defects, R2 found 2, R3 found 1 — all fixed; the byte-based
+spend bound independently confirmed with a real tokenizer). 97/97 native-body
+probes plus the full Slice 1 guard suite pass. Guard and native substrate both
+remain off by default.
+
 ## [3.40.0] - 2026-07-06
 
 ### Added — Optional built-in TLS/HTTPS for the HTTP transport

data/bin/kairos-chain

@@ -456,11 +456,14 @@ when 'mode'
                              KAIROS_PROJECT_ROOT env, then cwd if it contains a
                              recognizable project marker (CLAUDE.md, .git/,
                              .claude/, or prior projection manifest).
-        --host HOST          Target host: claude (default) | codex | opencode.
-                             claude writes CLAUDE.md with an @-import pointer;
-                             codex/opencode write AGENTS.md with the mode body
-                             inlined (they do not resolve @-import). Each host
+        --host HOST          Target host key (default: claude, the bundled host).
+                             Additional hosts (e.g. codex, opencode) are contributed
+                             by add-on SkillSets installed under .kairos/skillsets/
+                             and discovered from the host-profile registry. Each host
                              uses a separate manifest slot, so hosts can coexist.
+                             claude writes CLAUDE.md with an @-import pointer; hosts
+                             that do not resolve @-import receive the mode body
+                             inlined into their context file (e.g. AGENTS.md).
 
       Notes:
         - data_dir and consumer project root are decoupled (design v0.2,
@@ -495,13 +498,14 @@ when 'mode'
     ARGV.delete_at(idx)
   end
 
-  # 2026-07-02: target host for projection (claude | codex | opencode). Default claude.
-  # codex/opencode write AGENTS.md with the mode body inlined (they do not resolve @-import).
+  # 2026-07-02 (redesigned 2026-07-10): target host for projection. The bundled
+  # default is claude; additional hosts come from add-on SkillSets via the
+  # host-profile registry (design v0.3 FROZEN).
   mode_host = 'claude'
   if (idx = ARGV.index('--host'))
     mode_host = ARGV[idx + 1]
     if mode_host.nil? || mode_host.start_with?('--')
-      warn "ERROR: --host requires a value (claude, codex, or opencode)."
+      warn 'ERROR: --host requires a value (a registered host key, e.g. claude).'
       exit 1
     end
     ARGV.delete_at(idx + 1)
@@ -530,8 +534,8 @@ when 'mode'
     warn "  Use --project-root <path> to designate a directory distinct from the data directory."
     exit 1
   rescue ArgumentError => e
+    # The registry error already lists the registered hosts and the add-on hint.
     warn "ERROR: #{e.message}"
-    warn "  Valid --host values: claude, codex, opencode."
     exit 1
   end
 

data/bin/kairos-plugin-project

@@ -15,16 +15,32 @@ require_relative '../lib/kairos_mcp'
 require_relative '../lib/kairos_mcp/plugin_projector'
 require_relative '../lib/kairos_mcp/skillset_manager'
 
+# Honor --data-dir before resolving anything: add-on host discovery reads the
+# data dir, so a decoupled data_dir must reach the projector on this path too
+# (INV-H3 — all access paths share one registry).
+if (idx = ARGV.index('--data-dir'))
+  val = ARGV[idx + 1]
+  if val.nil? || val.start_with?('--')
+    warn 'ERROR: --data-dir requires a path value.'
+    exit 1
+  end
+  KairosMcp.data_dir = File.expand_path(val)
+  ARGV.delete_at(idx + 1)
+  ARGV.delete_at(idx)
+end
+
 project_root = KairosMcp.project_root
 mode = KairosMcp.projection_mode
 
-# 2026-07-02: target host for projection (claude | codex | opencode). Default claude.
+# 2026-07-02 (redesigned 2026-07-10): target host for projection. The bundled
+# default is claude; additional hosts are contributed by add-on SkillSets and
+# discovered from the host-profile registry (design v0.3 FROZEN).
 # Used both for manual invocation and by projected re-projection hooks (--host <host>).
 host = 'claude'
 if (idx = ARGV.index('--host'))
   host = ARGV[idx + 1]
   if host.nil? || host.start_with?('--')
-    warn "ERROR: --host requires a value (claude, codex, or opencode)."
+    warn 'ERROR: --host requires a value (a registered host key, e.g. claude).'
     exit 1
   end
   ARGV.delete_at(idx + 1)
@@ -32,10 +48,13 @@ if (idx = ARGV.index('--host'))
 end
 
 begin
-  projector = KairosMcp::PluginProjector.new(project_root, mode: mode, host: host)
-rescue ArgumentError => e
+  # Pass data_dir explicitly so add-on discovery + manifest location match the
+  # other access paths (MCP tool, `kairos-chain mode`) under decoupled data dirs.
+  projector = KairosMcp::PluginProjector.new(project_root, mode: mode,
+                                             data_dir: KairosMcp.data_dir, host: host)
+rescue ArgumentError, KairosMcp::PluginProjector::DependencyUnsatisfied => e
+  # The registry error already lists the registered hosts and the add-on hint.
   warn "ERROR: #{e.message}"
-  warn "  Valid --host values: claude, codex, opencode."
   exit 1
 end
 
@@ -57,21 +76,27 @@ enabled = manager.enabled_skillsets
 knowledge_entries = KairosMcp.collect_knowledge_entries
 
 json_mode = ARGV.include?('--json')
+# Host-specific reload hint carried as profile data, not a host-name branch (INV-H1).
+reload_hint = projector.host.reload_hint || ''
 
 if ARGV.include?('--if-changed')
   changed = projector.project_if_changed!(enabled, knowledge_entries: knowledge_entries)
   if changed
+    msg = "Plugin projection updated.#{reload_hint}"
     if json_mode
-      puts '{"additionalContext": "Plugin projection updated. Run /reload-plugins to activate new skills."}'
+      require 'json'
+      puts JSON.generate('additionalContext' => msg)
     else
-      $stderr.puts "Plugin projection updated. Run /reload-plugins to activate new skills."
+      $stderr.puts msg
     end
   end
 else
   projector.project!(enabled, knowledge_entries: knowledge_entries)
+  msg = "Plugin projection complete.#{reload_hint}"
   if json_mode
-    puts '{"additionalContext": "Plugin projection complete. Run /reload-plugins to activate."}'
+    require 'json'
+    puts JSON.generate('additionalContext' => msg)
   else
-    $stderr.puts "Plugin projection complete."
+    $stderr.puts msg
   end
 end