kairos-chain 3.75.0 → 3.77.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3491085c294fc09283689fa6a808362f088cd2d3287639c028959165928f4820
-  data.tar.gz: d974be22bf343153f28e3dff6146fcc931e72af34c138d5e3ada2330afcf08f8
+  metadata.gz: ca968a084e8868b9cbeaa3283850dd7e56095a503d661ce6e74158ec7555f0e3
+  data.tar.gz: 7a410b2edb98cd9bf02c8396f11d1d411e9b190456ea87402789d9a95aea5f16
 SHA512:
-  metadata.gz: 9072c0b407d3cd2a50490de0c93f954a4d32fb86d3342b5eb36c80940d21257e001edc1a3eba0b158c6f7f822638a7fb445a98093fa34fe73c84593e8b624771
-  data.tar.gz: 32afff4b989ba3b1a09a96d138250e6e536e68700be54f4f09887311406170439ffdb422f6ba21d49c204109758963181c2d5f199aa60f692c3c21a7c5ad609b
+  metadata.gz: 5cea432521cb70bcc7ed1f354bb0a4abe1165d16a25ed185d8b3c46af5db0d00d57c459737e3a52f290a356d29356033cce8e6ef4c56e7526438eb6f7eba30d3
+  data.tar.gz: cf536e54e866a943d95d0209741c1a6658e6df62421f9a5e0e082983e98025057aa4e4dfc04ad08a4f96e7acfd9a982e69bde253d6f3986302325d9dd7ab65f3

data/CHANGELOG.md

@@ -4,6 +4,137 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.77.0] - 2026-08-26
+
+### Added
+
+- **`operator_report` — the agent SkillSet's first tool for handing a
+  deliverable to a human.** Three runs produced documents no one could receive;
+  the loop concluded "there is no way to deliver this" and it was right. The
+  tool writes the report body to a file under `.kairos/log/agent_reports/` and
+  returns only the path, because the executor truncates tool output at 500
+  characters. It is registered `low` in the risk table — an unlisted tool would
+  be marked by norm (d) and the report itself would wait for human
+  confirmation. Two norms ship with it: (e) an irreversible step is marked and
+  deferred, not a reason to halt the plan; (f) a delivery tool exists — do not
+  conclude there is no way to hand the result over.
+
+- **`test_agent_human_mark_gate.rb`** — 39 tests, 87 assertions, covering the
+  deferred-mark path, halt-kind classification, and the cumulative cycle
+  ledger.
+
+### Changed
+
+- **Seven fixes surfaced by running the loop, not by reviewing it.** The goal
+  text never reached the DECIDE prompt — the loop was judging without its goal;
+  it is now included, truncated at 6,000 characters with the cut declared in
+  the text. Halt kinds were hardcoded to one kind, so tool errors were recorded
+  as "waiting for human"; the kind now reads from each step's own status, and
+  the seven-site refactor a prior design round estimated for this turned out
+  unnecessary. A plan halted at its first human-marked step; `human_mark_mode:
+  'defer'` sets marked steps and their dependents aside, runs the rest, and
+  returns the deferred list at the cycle's end (the default remains `halt`).
+  The completed-cycle count was per call; the ledger now accumulates across the
+  run. Norm (d) pulled read-only tools into confirmation waits; it now names
+  writing, recording, sending, and deleting tools only, and its counter is
+  renamed `unlisted_writing_tool_unmarked` with the old name's counts folded
+  in. Report titles doubled when the body already opened with a heading; they
+  no longer do.
+
+### Removed
+
+- **The 300-second wall clock and `max_cycles`.** The clock was shorter than
+  one measured cycle (823 seconds for a 13-step cycle); both caps are gone.
+  What still stops a run: the call budget (`max_total_llm_calls`, default 60 —
+  about 15 cycles at the measured 4 calls per cycle), two consecutive errors,
+  loop detection, self-declared completion at confidence ≥ 0.9, and the
+  `checkpoint_every` return, where continuing is decided by whether the
+  operator calls the next `agent_step`. The uncapped run that validated this
+  went three cycles: the first drafted a priority list, the second found and
+  corrected six errors in it, the third declined to write a third version,
+  declared the second canonical, and returned four open items — zero norm
+  violations, confidence never reaching the self-completion threshold. Mutation
+  testing covers the session's first half (11 mutants, 11 killed); the latter
+  eight fixes ship unmutated by operator decision — this release exists to find
+  their defects in use.
+
+## [3.76.0] - 2026-08-22
+
+### Changed
+
+- **L1 `multi_llm_review_workflow` 3.10.2 → 3.11.0 — three norms and one
+  recorded open question, for three failures the operator named and one request
+  he made.** The failures: an orchestrator issuing different criteria each
+  round, the APPROVE ratio operating as the close condition, and design reviews
+  descending into code. The request: bound mutation experiments. Four rules were
+  drafted, reviewed over three rounds, applied, reviewed once more as applied
+  text — one APPROVE of four seats, eighteen blocking findings — and revised
+  subtractively. What ships is narrower than what was drafted, which is the
+  point: this entry's own § Revision Discipline records that deletions drew zero
+  new P0s in every measured case and additions became the next round's
+  battleground.
+
+  **§ Prompt Generation Rules gains a recording duty on the round's
+  instrument** — what a seat is told to look for, how much of the artifact it is
+  given, and which seats answer. It bounds nothing: narrowing criteria, cutting
+  scope and convening a different panel are each a documented remedy for
+  something. It forbids moving the instrument and then reading the resulting
+  change in finding counts as a property of the artifact. It was drafted around
+  criteria alone, which left scope and panel composition — two channels that
+  move the count just as well — outside it.
+
+  **§ Review Types gains the phase rule as an invariant with no branches**: a
+  review answers at the phase of its target and does not descend. Design and
+  Document reviews read code only to refute a factual claim and write none;
+  implementation review is where fixes are written. Two enumerated sentences
+  drafted with it are not here. "An implementation-phase finding that reopens
+  the design belongs to the backlog" collided with this entry's own "any (a) or
+  (b) REJECT or FAIL = revise and re-review" over exactly the
+  design-implementation seam it calls the most valuable layer, and pre-answered
+  the operator question § Revision Discipline rule 1 requires. "Fix plan and
+  Final/convergence reviews inherit the phase of the artifact they check" gave
+  those two nothing to inherit, no phase being assigned to a fix plan anywhere.
+  The `<structured_output_contract>` line drops "consider improving" without
+  enumerating review types, because the enumerated form left this entry's own
+  knowledge/documentation-update review unassigned.
+
+  **The mutation norm is one sentence inside the phase rule and assigns no
+  party**: a green suite is not evidence until its tests have been shown to
+  fail, and a pass whose sites the code's author chose measures the author's
+  attention, not the suite. It was drafted as a seventh item in Step -1 carrying
+  the duty "whoever chooses the sites is not whoever wrote the code", and no
+  party in this entry can discharge that — before dispatch the only actor is the
+  orchestrator, which § Roles makes the same context as the implementer, and
+  review seats run sandboxed read-only and cannot execute anything. Stated as a
+  property of evidence rather than a duty on someone, it holds wherever a
+  mutation result is read. The bound the operator asked for is not here and the
+  omission is open, not settled: the recorded decision is to accumulate three
+  runs and then judge.
+
+  **Withdrawn in the same version: a rule making each seat label its own
+  findings new or carryover.** A seat sees only its own priors, so a finding one
+  seat raises after another raised it is new to that seat and carryover to the
+  round, and a seat added or returning mid-thread has no priors at all, making
+  every finding it raises new by construction — the machine-side signal "new
+  (a)+(b) P0 = 0" is then not computable from seat labels. § Convergence Rules
+  records that who makes the label is undecided and that the orchestrator makes
+  it meanwhile, which is the biased judge the withdrawn rule was written to
+  replace. Its paired edits revert with it, which also removes "the round number
+  is never written into a prompt" — that sentence contradicted § Output
+  Directive's MUST that the prompt carry `review{N}` in the output path, and an
+  orchestrator obeying it would have had round N+1 overwrite round N.
+
+  A fifth proposed rule, an exception for self-referential reviews, was dropped
+  before the version was written, after four reviewer contexts — occupying two
+  of that round's three counted seats — shot it on three independent grounds.
+
+  Across all four review rounds the thing most often refuted was not the rules
+  but the change's account of itself. The pre-flight falsifier for the applied
+  round refuted 8 of 22 checked claims, three of them inside the version entry;
+  the correction to those three introduced a fourth false claim, which the round
+  then refuted. Every such claim is a record summarised without its denominator
+  or its condition.
+
 ## [3.75.0] - 2026-08-21
 
 ### Added

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.75.0"
+  VERSION = "3.77.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/multi_llm_review_workflow/multi_llm_review_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: multi_llm_review_workflow
 description: "Multi-LLM review methodology and execution — workflow pattern, CLI tooling, consensus analysis, Persona Assembly. Applicable to design, implementation, documentation, or any artifact."
-version: "3.10.2"
+version: "3.11.0"
 tags:
   - workflow
   - review
@@ -53,7 +53,9 @@ write a review spec and declare it frozen for the round:
 3. **Cap fixes per round (≤5)** and write one line per fix: *what this fix
    newly claims* (values pinned, ranges narrowed, failure visibility
    changed). A fix that cannot state its new claims is doing more than the
-   finding asked.
+   finding asked. A round that moves its instrument records that it moved it
+   (§ Prompt Generation Rules). That is a recording duty; unlike the cap
+   above, it bounds nothing.
 4. **Pre-flight falsifier.** Before dispatch, one agent whose only job is to
    refute every factual claim in the spec and artifact — especially numbers
    and "X does not exist" claims. In this loop it caught real errors before
@@ -563,6 +565,13 @@ Rules:
 | Document review | Accuracy, completeness, consistency | Document text | Grant applications, papers |
 | Final/convergence review | All prior findings resolved, no new issues | Resolution matrix + revised artifact | Before merge |
 
+**A review answers at the phase of its target and does not descend.** Design
+review and Document review read code only to refute a factual claim the
+artifact makes about an existing system, and write none. Implementation review
+is where fixes are written, and is also where a green suite is not evidence
+until its tests have been shown to fail — a mutation pass whose sites the
+code's author chose measures the author's attention, not the suite.
+
 ## LLM Role Differentiation
 
 Without explicit instruction, different LLMs naturally focus on different verification layers:
@@ -601,9 +610,17 @@ numerator moved. Do not treat a reached ratio as sufficient on its own either:
 check what the approving replies actually said before counting them.
 
 **Count carryover and new (a)/(b) P0s separately; the machine-side signal of
-convergence is "new P0 = 0", not the APPROVE ratio.** Require each persona to
+convergence is "new P0 = 0", not the APPROVE ratio.** Require each **seat** to
 state a closure verdict on its own prior-round P0s — closed / open /
-half-closed, with grounds. This format is validated live (chain erasure
+half-closed, with grounds. **Who labels a finding new versus carryover is
+undecided.** The seat-side answer — each seat labelling against its own prior
+findings — was written into this section on 2026-08-22 and removed the same day:
+a seat sees only its own priors, so a finding one seat raises after another seat
+raised it is new to that seat and carryover to the round, and a seat added or
+returning mid-thread has no priors at all, making every finding it raises new by
+construction. Until this is answered, the orchestrator makes the call, knowing
+that it is the context whose artifact the call converges. This format is
+validated live (chain erasure
 R6–R8) and is what makes the carryover/new split computable. A round whose
 (a)+(b) findings are all carryover with closure verdicts, and whose revision
 drew zero new P0s (observed without exception when the revision was
@@ -1202,6 +1219,19 @@ Every review prompt MUST include these 7 items:
 
 All prompt content MUST be in **English** for consistent parsing across LLM tools.
 
+**A round that changes its instrument records the change.** The instrument is
+whatever bounds what the round can find: what a seat is told to look for, how
+much of the artifact it is given, and which seats answer. Some of a prompt
+varies by construction — the artifact itself, the prior findings a round asks a
+seat to verdict — and that is not the instrument. When a round moves the
+instrument, it says so on the record, in one line, naming what moved and why.
+
+This is a recording duty, not a prohibition. An orchestrator may narrow a
+seat's criteria mid-thread, cut the scope, or convene a different panel; each
+of those is a documented remedy for something. What it may not do is move the
+instrument and then read the resulting change in finding counts as a property
+of the artifact.
+
 ### Reviewer incentive rule
 
 **Never tell a reviewer — subprocess or persona — that its finding count is
@@ -1247,7 +1277,8 @@ For each finding:
 - **What can go wrong**: concrete failure scenario
 - **Why this is vulnerable**: code path or design gap
 - **Likely impact**: data loss, security breach, silent corruption, etc.
-- **Recommended fix**: specific change (not "consider improving")
+- **Recommended fix**: specific, never "consider improving" — the change where
+  this review writes changes, the claim that does not hold where it does not.
 </structured_output_contract>
 
 <grounding_rules>
@@ -1611,5 +1642,59 @@ Compression ratio: parallel agent raw → Assembly ≈ 2:1
   with zero new and one carryover (a) at 1 of 2 seats approving reports
   "GATE NOT PASSED" under the old rule and "FREEZE CANDIDATE" under this one.
 
+- Three norms, subtractively (v3.11.0, 2026-08-22): the operator named three
+  recurring failures — an orchestrator issuing different criteria each round,
+  the APPROVE ratio operating as the close condition, and design reviews
+  descending into code — and asked for mutation experiments to be bounded. Four
+  rules were written and reviewed; one was withdrawn in the same version and two
+  of the survivors are narrower than they were drafted, so what ships is three
+  norms and one recorded open question. **§ Prompt Generation Rules** gains a
+  recording duty on the round's instrument — what a seat is told to look for,
+  how much of the artifact it is given, and which seats answer. It bounds
+  nothing: narrowing criteria, cutting scope and convening a different panel are
+  each a documented remedy for something. What it forbids is moving the
+  instrument and then reading the resulting change in counts as a property of
+  the artifact. It was drafted around criteria alone, which left scope and panel
+  composition — two channels that move the count just as well — outside it.
+  **§ Review Types** gains the phase rule as an invariant with no branches: a
+  review answers at the phase of its target and does not descend. Two enumerated
+  sentences were drafted with it and are not here. "An implementation-phase
+  finding that reopens the design belongs to the backlog" collided with this
+  document's own "any (a) or (b) REJECT or FAIL = revise and re-review" over
+  exactly the design-implementation seam it calls the most valuable layer, and
+  pre-answered the operator question § Revision Discipline rule 1 requires. "Fix
+  plan and Final/convergence reviews inherit the phase of the artifact they
+  check" gave those two reviews nothing to inherit, since no phase is assigned to
+  a fix plan anywhere. The output contract at `<structured_output_contract>`
+  drops "consider improving" without enumerating review types, because the
+  enumerated form left this document's own knowledge/documentation-update review
+  unassigned. **The mutation norm** is one sentence inside the phase rule and
+  assigns no party: a green suite is not evidence until its tests have been shown
+  to fail, and a pass whose sites the code's author chose measures the author's
+  attention, not the suite. It was drafted as a seventh item in Step -1 with the
+  duty "whoever chooses the sites is not whoever wrote the code", and no party in
+  this document can discharge that — before dispatch the only actor is the
+  orchestrator, which § Roles makes the same context as the implementer, and the
+  seats are sandboxed read-only and cannot execute anything. Stated as a property
+  of evidence rather than a duty on someone, it holds wherever a mutation result
+  is read. The bound the operator asked for is not here and the omission is open,
+  not settled: the recorded decision is to accumulate three runs and then judge.
+  **Withdrawn in this version**: a rule making each seat label its own findings
+  new or carryover. A seat sees only its own priors, so a finding one seat raises
+  after another raised it is new to that seat and carryover to the round, and a
+  seat added or returning mid-thread has no priors at all. § Convergence Rules
+  now records that who makes the label is undecided and that the orchestrator
+  makes it meanwhile, which is the biased judge the withdrawn rule was written to
+  replace. A fifth proposed rule, an exception for self-referential reviews, was
+  dropped before this version was written, after four reviewer contexts —
+  occupying two of that round's three counted seats — shot it on three
+  independent grounds. Design history: three review rounds on the proposal
+  (closed by operator declaration, not convergence), then one round on the
+  applied text, which returned one APPROVE of four seats and eighteen blocking
+  findings — every rule above is narrower for it. What kept being shot across all
+  four rounds was the change's account of itself, not the rules it proposed.
+  Records: L2 `handoff_mlr_l1_norms_revision_three_rounds_and_switch_to_implementation_20260821`
+  and L2 `mlr_v3_11_0_applied_review_r1_and_subtractive_revision_20260822`
+
 **Key insight**: Design reviews and implementation reviews find
 **categorically different bugs**. Both phases are necessary.

data/templates/skillsets/agent/config/agent.yml

@@ -30,6 +30,10 @@ tool_blacklist:
   - "skills_rollback"
   - "skills_promote"
   - "instructions_update"
+  # The norms the agent is held to live in L1. A run with risk_budget: medium
+  # would otherwise reach knowledge_update (medium in TOOL_RISK) and let the
+  # constrained side rewrite what constrains it.
+  - "knowledge_update"
   - "token_manage"
   - "system_upgrade"
   - "chain_import"
@@ -82,8 +86,15 @@ orient_tools_extra: []
 
 # Autonomous mode limits
 autonomous:
-  max_total_llm_calls: 60        # across all cycles in one batch
-  max_duration_seconds: 300      # wall-clock timeout per batch (5 min)
+  # The cost bound, and the one that actually stops a runaway. At the ~4 calls
+  # per cycle measured on 2026-08-26 this is about 15 cycles.
+  max_total_llm_calls: 60
+  # Wall-clock bound, off. Blank or 0 means no bound: the loop runs until it is
+  # done rather than until the clock says so. It never interrupted a running
+  # cycle — it only refused to start the next — so at 300 against a measured
+  # 823-second cycle it just made max_cycles above 1 unreachable. Withdrawn
+  # 2026-08-26; put a number back only if a run is seen to go on too long.
+  max_duration_seconds:
   min_cycles_before_exit: 2      # confidence exit disabled for first N cycles
   confidence_exit_threshold: 0.9 # minimum confidence for early exit
 

data/templates/skillsets/agent/lib/agent/mandate_adapter.rb

@@ -6,13 +6,37 @@ module KairosMcp
       # Bridges agent structures to Autonomos::Mandate API shapes.
       # Input: string keys (from JSON.parse). Output: symbol keys (for Mandate API).
       module MandateAdapter
+        # Tools whose presence routes the whole plan to the agent_execute
+        # subcontractor instead of in-process autoexec.
+        #
+        # Defined here rather than in agent_step because the risk gate and the
+        # ACT router must agree on the route. If they disagree, a plan can be
+        # granted the human-mark exemption below and then run under the
+        # subcontractor, which formats steps as prose and never reads the mark
+        # — the marked step would be delegated rather than halted on.
+        FILE_TOOL_NAMES = %w[Edit Write Read Bash file_edit file_write file_read].freeze
+
+        def self.routes_to_subcontractor?(task_json)
+          steps = task_json && task_json['steps']
+          Array(steps).any? { |s| FILE_TOOL_NAMES.include?(s['tool_name']) }
+        end
+
         # Convert decision_payload to Mandate-compatible proposal
         # for Mandate.risk_exceeds_budget? and Mandate.loop_detected?
+        #
+        # enforce_human_marks declares that this caller halts before a marked
+        # step at execution time. It lives inside autoexec_task, beside the
+        # steps it qualifies, because risk_exceeds_budget? reads that hash and a
+        # declaration written elsewhere than it is read is the whole defect.
         def self.to_mandate_proposal(decision_payload)
+          task_json = decision_payload['task_json']
           {
             autoexec_task: {
-              steps: (decision_payload.dig('task_json', 'steps') || []).map { |s|
-                { risk: s['risk'] || 'low', tool_name: s['tool_name'] }
+              enforce_human_marks: !routes_to_subcontractor?(task_json),
+              steps: Array(task_json && task_json['steps']).map { |s|
+                { risk: s['risk'] || 'low',
+                  tool_name: s['tool_name'],
+                  requires_human_cognition: s['requires_human_cognition'] == true }
               }
             },
             selected_gap: {

data/templates/skillsets/agent/skillset.json

@@ -14,7 +14,8 @@
     "KairosMcp::SkillSets::Agent::Tools::AgentStep",
     "KairosMcp::SkillSets::Agent::Tools::AgentStatus",
     "KairosMcp::SkillSets::Agent::Tools::AgentStop",
-    "KairosMcp::SkillSets::Agent::Tools::AgentWait"
+    "KairosMcp::SkillSets::Agent::Tools::AgentWait",
+    "KairosMcp::SkillSets::Agent::Tools::OperatorReport"
   ],
   "config_files": ["config/agent.yml"],
   "knowledge_dirs": ["knowledge/agent_guide"],

data/templates/skillsets/agent/test/test_agent_complexity_review.rb

@@ -69,7 +69,7 @@ module Autonomos
   end
 end
 
-require File.expand_path('../../../../.kairos/skillsets/autonomos/lib/autonomos/mandate',
+require File.expand_path('../autonomos/lib/autonomos/mandate',
   File.dirname(__dir__))
 
 Session = KairosMcp::SkillSets::Agent::Session

data/templates/skillsets/agent/test/test_agent_halt_semantics.rb

@@ -67,10 +67,10 @@ module Autonomos
   end
 end
 
-require File.expand_path('../../../../.kairos/skillsets/autonomos/lib/autonomos/mandate',
+require File.expand_path('../autonomos/lib/autonomos/mandate',
                          File.dirname(__dir__))
 # The autonomous loop reaches Ooda for goal loading and COMPLEX_KEYWORDS.
-require File.expand_path('../../../../.kairos/skillsets/autonomos/lib/autonomos/ooda',
+require File.expand_path('../autonomos/lib/autonomos/ooda',
                          File.dirname(__dir__))
 
 Session = KairosMcp::SkillSets::Agent::Session