kairos-chain 3.49.0 → 3.51.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69d783a71fb5c56c3b7bfc549695f337ad9099d2db5beaf0ae557b845f854a2f
-  data.tar.gz: 3f858ee398aa3ecbe24c664e5618653ab1bfd38f6a5a01c6779270cefc4d7e68
+  metadata.gz: fea78afc847b26db63d7355188444750fdb3cbbf84494cc489e63402bea3b630
+  data.tar.gz: b638968a01320bf5196d7f2b383b5c6dfa118a9432dc6feadf4ef04cbd4ee6b8
 SHA512:
-  metadata.gz: 16e67612af99d2dc86f85d9d128a3e5906f07f72677f7a8ff547685b9106e1c62b3dea2161ce776fcd68819676f7b665b8b8a9e127a2e69c6cc33831685aab60
-  data.tar.gz: b202b151145f3bb7c1f1383450129d8b3455f0eeb3d9fa7716b3dea173d9c3eb06a56d3fa90b3236b0e8585cb88a3e2276707512e8cd06c833f64efd6ad7915a
+  metadata.gz: 0be2e69efbd5eda0c8c839c627389def7dd68db5cda29a904072e762677238459ef6a2fad8373d612715f1eeeb928579a7a318bc97ffdd5fb6c38eb54991c522
+  data.tar.gz: 74fd8b7ba83ef25552130dbd7b86047ce96fda674b1d151b247813597adef09c60ec192c524507ad054d3af3c63154b497de71d912891f84cad8637e79bd1bdf

data/CHANGELOG.md

@@ -4,6 +4,97 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.51.0] - 2026-07-23
+
+### Agent SkillSet — interruption resilience A-1 + A-2
+
+Addresses the failure mode where the orchestrator's API stalling leaves an
+auto-mode agent loop waiting on input: the running MCP server is intact, but
+the driver stops, and auto-permission is orthogonal to driver liveness.
+Design v0.3.1 FROZEN (design-by-invariant, multi-LLM review 3R converged).
+
+- **A-1 — AdvanceGate** (`lib/agent/advance_gate.rb`): every state-advancing
+  `agent_step` call passes through a per-session serialized, atomic, anchored
+  gate. INV-A2 (serialized atomic advance via `advance.lock` + tmp-rename
+  commit), INV-A3 (anchored at-most-once with a `seq:state:cycle` anchor,
+  committed outcomes replay on retry, side-effect intent bracket with
+  no-silent-drop), INV-A4 (`next_move` derivable from persisted state),
+  INV-A5 (adjudication as a gated judgment). `adjudicate` action added.
+  Impl review 4R converged, 49 probes.
+- **A-2 — delegated step executor** (`lib/agent/step_delegation.rb`,
+  `bin/agent_step_worker.rb`): INV-A1 driver independence. `agent_step` with
+  `execution: "delegated"` returns a resumable handle while a detached
+  (setsid) worker re-enters the SAME gated `agent_step` under server-side
+  ownership — delegate → wait → collect, transplanted from the review
+  SkillSet. All correctness inherited from the A-1 gate; the delegation layer
+  is coordination/observability only. New `agent_wait` tool; `agent_status`
+  surfaces the handle. Impl review 6R converged, 81 probes total.
+- Attended real-worker run with a live LLM-bearing step validated
+  (2026-07-23, isolated harness): the detached worker bootstrapped the full
+  ToolRegistry and ran ORIENT+DECIDE via the claude CLI; liveness, collect,
+  and collector-owned teardown all held.
+- Native body path unchanged (selectable-off). All prior agent-suite tests
+  remain at the main baseline.
+
+## [3.50.0] - 2026-07-23
+
+### Chain Distillation SkillSet — slice 1 (CD-1..CD-6)
+
+New `chain_distillation` SkillSet implementing design v0.5 (review-converged
+5/6 APPROVE + persona unanimity): provenance-certified distillation of the
+instance chain into distributable SkillSets.
+
+- `cd_distill`: closed-world integer designation (genesis excluded,
+  decline-not-coerce), guard-judged distillate and certificate crossings
+  (separate, in order, single-encoded presentation), CD-6 constitutive
+  record before release (salted sdp-1-style commitments over the distillate
+  and the claim core excluding the record citation), content-independent
+  pre-assigned certificate identity, attestation-carrier seam
+  (`proof_id` = certificate identity), designation-overlap re-issuance
+  citation against then-revoked predecessors.
+- `cd_verify`: full-citation positive grounding (claim-core commitment
+  opening, identity, designation digest, guard policy sha, distillate
+  commitment, predecessors, citation block hash) plus chain-identity /
+  head-binding checks; pinned checkability-status table with
+  both-direction mislabeling fatal; closed claim-core vocabulary at every
+  depth; revocation folds into validity.
+- `cd_revoke`: identity-keyed chain-wide revocation, closed reason
+  vocabulary (`superseded|defective|withdrawn|other`).
+- Requires an active confidentiality-guard regime (CD-1: decline, never
+  degrade). 60 design-constraint tests incl. production-wiring and
+  real-Chain regressions (KAIROS_DATA_DIR-isolated).
+
+### Confidentiality Guard — slice-2 first increment (distillation crossing)
+
+- New `:distillation_outward` crossing class (`cd_release_distillate`,
+  `cd_release_certificate`): conjunctive per-destination verdict
+  (closed-world `distillation_crossings` profile designation AND content
+  classes), outward verdicts recorded pass or deny (CG-4); the general
+  outward class stays denied wholesale.
+- Certificate-crossing verdict records cite the certificate identity
+  (identifier-only, CG-4-compatible).
+- Template-layout require-path parity fix in `regime.rb` / `recorder.rb`.
+- Guard test suite: 75 design-constraint + regression tests.
+
+## [3.49.1] - 2026-07-22
+
+### CLI fix — `skillset upgrade` messaging for non-core new SkillSets
+
+`kairos-chain skillset upgrade --apply` always runs with `core_only: true`
+(the plain CLI form has no way to pass explicit `names`), so a new,
+non-core SkillSet (e.g. `confidentiality_guard`, `daemon_runtime`,
+`kairos_hook_projector`) was never installed by `--apply`, regardless of
+how many times it was run — but the check-mode display mislabeled these as
+"files changed" and told the user to run `--apply`, which silently did
+nothing for them.
+
+- Detected upgrades are now split into "applicable" (existing-installed
+  diffs + core new SkillSets, which `--apply` does handle) and "manual"
+  (non-core new SkillSets, which require explicit
+  `kairos-chain skillset install <name>`). Both the check-mode listing and
+  the post-`--apply` summary report each group accurately.
+- Added the missing `upgrade` line to `kairos-chain skillset -h`.
+
 ## [3.49.0] - 2026-07-22
 
 ### ZK aggregate reproducibility spike (AUD-L4, Phases 1+2) — KairosChain's first genuine zero-knowledge proof
@@ -65,7 +156,7 @@ resource-scheme reads are denied wholesale under the CG-1 coverage clause.
   records carry the designation id, not the raw path. `canon.rb`: shared
   canonical serialization faithful to false/nil and mixed string/symbol keys.
 - `tools/cg_status.rb`: read-only regime-state tool (CG-1).
-- 67 design-constraint + regression tests (`test/test_cg_guard.rb`).
+- 67 design-constraint + regression tests (`test/test_cg_guard.rb`); 75 as of the chain_distillation guard slice-2 first increment (distillation crossing).
 
 Core (minimal, guard-enabling): `tool_registry.rb` adds `FailClosedError`
 (re-raised by the loader, never swallowed), per-skillset isolated loading,

data/bin/kairos-chain

@@ -134,6 +134,12 @@ when 'skillset'
   when 'upgrade'
     apply = ARGV.delete('--apply')
     upgrades = manager.upgrade_check
+    # --apply always runs with core_only: true (no way to pass names from this
+    # CLI form), so a new, non-core SkillSet is NEVER installed by --apply,
+    # no matter how many times it is run. Split the two groups so the
+    # displayed guidance matches what --apply will actually do.
+    manual = upgrades.select { |u| u[:new_skillset] && !KairosMcp::SkillSetManager::CORE_SKILLSETS.include?(u[:name]) }
+    applicable = upgrades - manual
 
     if upgrades.empty?
       puts "All SkillSets are up to date."
@@ -144,6 +150,12 @@ when 'skillset'
       end
       puts "Done. #{results.size} SkillSet(s) upgraded."
 
+      if manual.any?
+        puts ""
+        puts "Not installed (optional, requires explicit approval):"
+        manual.each { |u| puts "  kairos-chain skillset install #{u[:name]}" }
+      end
+
       # Re-project plugin artifacts if any SkillSets changed
       if results.any?
         begin
@@ -162,15 +174,25 @@ when 'skillset'
         end
       end
     else
-      puts "SkillSet upgrades available:"
-      puts ""
-      upgrades.each do |u|
-        label = u[:version_bump] ? "v#{u[:installed_version]} -> v#{u[:available_version]}" : "files changed"
-        puts "  #{u[:name]}: #{label}"
-        u[:changed_files].each { |f| puts "    Modified: #{f}" }
+      if applicable.any?
+        puts "SkillSet upgrades available:"
+        puts ""
+        applicable.each do |u|
+          label = u[:version_bump] ? "v#{u[:installed_version]} -> v#{u[:available_version]}" : "files changed"
+          puts "  #{u[:name]}: #{label}"
+          u[:changed_files].each { |f| puts "    Modified: #{f}" }
+          puts ""
+        end
+        puts "Run 'kairos-chain skillset upgrade --apply' to apply updates."
+      end
+
+      if manual.any?
+        puts "" if applicable.any?
+        puts "Optional SkillSets available (not auto-installed; require explicit approval):"
+        manual.each { |u| puts "  #{u[:name]} v#{u[:available_version]} — #{u[:description]}" }
         puts ""
+        puts "Install with: kairos-chain skillset install <name>"
       end
-      puts "Run 'kairos-chain skillset upgrade --apply' to apply updates."
     end
 
   when 'remove'
@@ -258,6 +280,7 @@ when 'skillset'
     puts "  install <path> [--layer L0|L1|L2]  Install a SkillSet from path"
     puts "  enable <name>                      Enable a SkillSet"
     puts "  disable <name>                     Disable a SkillSet"
+    puts "  upgrade [--apply]                  Check for/apply SkillSet updates from gem templates"
     puts "  remove <name>                      Remove a SkillSet"
     puts "  info <name>                        Show SkillSet details"
     puts "  package <name>                     Package a knowledge-only SkillSet as JSON archive"

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.49.0"
+  VERSION = "3.51.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/bin/agent_step_worker.rb

@@ -0,0 +1,183 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+#
+# Interruption resilience Slice A-2 — detached agent step worker (INV-A1).
+#
+# Spawned by StepDelegation#spawn_worker after agent_step was called with
+# execution: "delegated". This worker is deliberately thin: it bootstraps a
+# ToolRegistry (the same construction the MCP server uses) and re-enters the
+# SAME gated agent_step path with the recorded arguments (the delegation-start
+# anchor is already injected into those arguments). Every correctness property
+# — per-session serialization, anchored at-most-once, side-effect intent
+# bracket — is enforced by the AdvanceGate inside that call (Slice A-1), not by
+# this script. If this worker dies, the driver re-issues the recorded call
+# safely; if it double-runs, the gate serializes and replays.
+#
+# argv: <session_id> <session_dir>
+# env:  KAIROS_PROJECT_ROOT (chdir target)
+#       KAIROS_SERVER_LIB   (lib dir to load kairos_mcp from)
+#       KAIROS_DATA_DIR     (the server's effective data dir; makes the
+#                            worker resolve the SAME .kairos)
+#
+# Exit codes: 0 success; 1 exception; 125 setsid failed; 130 signal.
+#
+# NB: bootstrap failures (LoadError/ScriptError from require) are caught too,
+# so the driver always sees a result rather than a silently hung handle.
+
+require 'json'
+require 'time'
+require 'fileutils'
+
+session_id  = ARGV[0] or abort 'usage: agent_step_worker.rb <session_id> <session_dir>'
+session_dir = ARGV[1] or abort 'usage: agent_step_worker.rb <session_id> <session_dir>'
+
+# Read the handle identity from the raw file first, so even a bootstrap
+# failure can tag its error result with the delegation it belongs to.
+def read_handle_identity(session_dir)
+  raw = JSON.parse(File.read(File.join(session_dir, 'delegation.json')))
+  { 'issue_anchor' => raw['issue_anchor'], 'action_key' => raw['action_key'],
+    'step_token' => raw['step_token'] }
+rescue StandardError
+  {}
+end
+
+def write_raw_result(session_dir, identity, outcome)
+  payload = identity.merge('outcome' => outcome)
+  tmp = File.join(session_dir, "delegation_result.json.tmp.#{Process.pid}")
+  File.write(tmp, JSON.generate(payload))
+  File.rename(tmp, File.join(session_dir, 'delegation_result.json'))
+rescue StandardError
+  # nothing more we can do
+end
+
+boot_identity = read_handle_identity(session_dir)
+
+$LOAD_PATH.unshift(File.expand_path('../lib', __dir__))
+begin
+  require 'agent/step_delegation'
+rescue ScriptError, StandardError => e
+  # The delegation lib is co-located with this script; if even it cannot load
+  # we tag a raw result with the handle identity so status can surface it as
+  # 'ready' (an error outcome) rather than the driver waiting out the grace.
+  write_raw_result(session_dir, boot_identity,
+                   { 'status' => 'error',
+                     'error' => "worker bootstrap failed: #{e.class}: #{e.message}" })
+  exit 1
+end
+
+delegation = KairosMcp::SkillSets::Agent::StepDelegation.new(session_dir)
+my_token = boot_identity['step_token']
+
+shutdown = { requested: false }
+%w[TERM INT HUP].each do |sig|
+  Signal.trap(sig) { shutdown[:requested] = true }
+end
+
+begin
+  Process.setsid
+rescue Errno::EPERM
+  # Already a session leader — acceptable; continue.
+rescue StandardError => e
+  delegation.write_result({ 'status' => 'error',
+                            'error' => "worker setsid failed: #{e.message}" },
+                          identity: boot_identity)
+  exit 125
+end
+
+heartbeat_thread = Thread.new do
+  loop do
+    begin
+      delegation.touch_heartbeat(my_token)
+    rescue StandardError
+      # A transient touch failure must not kill the heartbeat thread and
+      # make a live worker look crashed; retry on the next tick.
+    end
+    sleep KairosMcp::SkillSets::Agent::StepDelegation::HEARTBEAT_INTERVAL_SECONDS
+  end
+end
+
+# Self-timeout watchdog: a hung gated call would otherwise hold the advance
+# lock forever. Exiting the process releases its flock; the driver then sees
+# 'crashed' and re-issues safely. We deliberately write NO result here so the
+# collector takes the crash path — if the gated advance had already committed,
+# crashed_response recovers its outcome from the gate log; an error result
+# would instead mask that committed advance.
+timeout_s = KairosMcp::SkillSets::Agent::StepDelegation.worker_self_timeout_seconds
+watchdog = Thread.new do
+  sleep timeout_s
+  exit!(124)
+end
+
+begin
+  Dir.chdir(ENV['KAIROS_PROJECT_ROOT']) if ENV['KAIROS_PROJECT_ROOT'] &&
+                                           Dir.exist?(ENV['KAIROS_PROJECT_ROOT'])
+  $LOAD_PATH.unshift(ENV['KAIROS_SERVER_LIB']) if ENV['KAIROS_SERVER_LIB']
+  # KAIROS_DATA_DIR was set in the worker env by spawn_worker so ToolRegistry
+  # / Session resolve the server's effective .kairos even under --data-dir.
+  require 'kairos_mcp/tool_registry'
+
+  pending = delegation.pending
+  raise "no pending delegation in #{session_dir}" unless pending
+
+  # Supersession guard: run ONLY if the live handle is still ours. If a fresh
+  # open_handle replaced it while we were starting up (e.g. we were declared
+  # 'crashed' on a stale heartbeat and the driver re-delegated), or we could
+  # not read our own identity at boot (my_token nil), do NOT run: the new
+  # worker owns this delegation, and the gate would replay/serialize our stale
+  # call anyway. Exiting leaves the current handle to its rightful worker.
+  if my_token.nil? || pending['step_token'] != my_token
+    exit 0
+  end
+
+  # Past the guard, boot_identity is non-empty and is our own handle identity
+  # (also driving the per-token heartbeat); write_result tags with it.
+  identity = boot_identity
+
+  args = (pending['arguments'] || {}).merge('session_id' => session_id)
+  args.delete('execution') # never recurse into another delegation
+
+  exit 130 if shutdown[:requested]
+
+  registry = KairosMcp::ToolRegistry.new
+  raw = registry.call_tool('agent_step', args)
+
+  # Normalize the MCP content shape to the response hash the inline call
+  # would have returned.
+  text = if raw.is_a?(Array) && raw.first.is_a?(Hash)
+           raw.first[:text] || raw.first['text']
+         end
+  response = begin
+    text ? JSON.parse(text) : { 'status' => 'error', 'error' => 'unrecognized tool result shape' }
+  rescue JSON::ParserError
+    { 'status' => 'error', 'error' => 'unparseable tool result', 'raw' => text.to_s[0, 500] }
+  end
+
+  # Write the result (tagged with our OWN startup identity) and leave the
+  # pending handle in place: teardown is the collector's job (agent_wait#collect
+  # clears result+handle atomically under delegation.lock), so the worker never
+  # races a concurrently-opened fresh delegation by clearing state it may no
+  # longer own or by mislabeling its result as a newer delegation's.
+  delegation.write_result(response, identity: identity)
+  exit 0
+rescue SystemExit, SignalException
+  # A deliberate exit (including our own `exit 0`) or a signal is not a
+  # failure to report — let it propagate.
+  raise
+rescue Exception => e # rubocop:disable Lint/RescueException
+  # Catch Exception, not just StandardError: LoadError/ScriptError from the
+  # bootstrap require are exactly the failure class the driver must see as a
+  # result rather than a silently hung handle. Leave teardown to the collector.
+  # Tag with our OWN startup identity (boot_identity is always our handle;
+  # the in-block `identity` local may be unassigned if we failed early, and
+  # a re-read of pending could belong to a superseding delegation).
+  begin
+    delegation.write_result({ 'status' => 'error', 'error' => "worker: #{e.class}: #{e.message}" },
+                            identity: (boot_identity.empty? ? nil : boot_identity))
+  rescue StandardError
+    # best effort
+  end
+  exit 1
+ensure
+  watchdog&.kill
+  heartbeat_thread&.kill
+end