@miller-tech/uap 1.158.0 → 1.160.0

package/src/policies/enforcers/enforcement_infra_protect.py

@@ -7,11 +7,25 @@ proxy), `kill $(lsof -t -i:8080)` (killed llama-server), and then
 `python3 -m http.server 8080` (stole the inference port, putting llama-server
 into a systemd bind-failure crash loop and 529-ing its own session).
 
+Observed again (2026-07-16, octopus_invaders_v3): a deliver cleanup loop ran
+`pkill -9 -f "uap"` — a BROAD -f pattern that never names llama-server, yet
+matched it anyway because the server's own argv carries the token via
+`--slot-save-path ~/.cache/uap/llama-slots`. That killed llama-server 5x in
+4 minutes (systemd restart counter 3->6) until the model narrowed the pattern.
+Rule 6 closes that gap: any -f/--full kill whose pattern is a substring of the
+inference stack's argv (uap/llama/qwen/mmproj/nomic/anthropic) is refused.
+Note the stack that a bare interpreter can hit is the PROXY only (python3);
+llama-server and embeddings are native binaries, so `node.*` globs are inert
+against infra and are left to loop-protection, not this enforcer.
+
 Scope (Bash/bash/run_bash commands only):
   - pkill/killall with a bare-interpreter pattern (matches EVERY python/node).
   - kill/pkill/killall aimed at llama-server / anthropic_proxy / nomic by name.
   - kill-by-port or fuser -k on the infra ports (8080 llama, 4000 proxy,
     8081 embeddings).
+  - broad `-f`/`--full` kill whose pattern is a substring of the stack's argv
+    (uap/llama/qwen/mmproj/nomic/anthropic) or a glob over the python
+    interpreter that runs the proxy.
   - systemctl stop/restart/kill/disable of the inference services.
   - Starting a server that BINDS an infra port (http.server 8080 etc.) —
     this is how the port got stolen even with kills blocked (the model
@@ -54,6 +68,25 @@ RULES = (
         r"\b(serve|live-server|http-server|vite|webpack-dev-server|next\s+dev|python3?\s+-m\s+flask\s+run)"
         r"\b[^|;&\n]*(--port[= ]|-p[= ]?|:)" + INFRA_PORTS + r"\b"
     ),
+    # 6) Broad kill by FULL-cmdline match (-f/--full/-e) whose pattern is a
+    #    substring of the inference stack's own argv. The stack carries these
+    #    tokens (e.g. --slot-save-path ~/.cache/uap/llama-slots, model 'qwen',
+    #    'mmproj', anthropic_proxy). `pkill -9 -f uap` killed llama-server 5x on
+    #    2026-07-16 via the 'uap' in its slot path — this is NOT a specific
+    #    pattern even though it never names the server.
+    re.compile(
+        r"\b(pkill|kill|killall)\b[^|;&\n]*"
+        r"(\s-(?:-full|[A-Za-z0-9]*f)\b|\s-e\b)"
+        r"[^|;&\n]*\b(uap|llama|anthropic|nomic|mmproj|qwen[0-9.]*|llama-slots|slots?[_-]?save)\b"
+    ),
+    # 7) Same, but a GLOB/regex over the python interpreter that runs the proxy
+    #    (`python3 .../anthropic_proxy.py`): `pkill -f "python.*"` sweeps it even
+    #    without an explicit infra token. Bare `pkill -f python3` -> rule 1.
+    re.compile(
+        r"\b(pkill|kill|killall)\b[^|;&\n]*"
+        r"(\s-(?:-full|[A-Za-z0-9]*f)\b)"
+        r"[^|;&\n]*[\"']?python[0-9.]*[.*\[\]\\]"
+    ),
 )
 
 REASON = (

package/src/policies/schemas/policies/commitment-reserve.md

@@ -0,0 +1,67 @@
+# commitment-reserve
+
+**Category**: safety
+**Level**: REQUIRED
+**Enforcement Stage**: pre-exec
+**Tags**: safety, reversibility, backup, restraint, never-go-full
+
+## Rule
+
+An **all-in move with no way back** is blocked until a reserve exists. Commit
+hard to an approach — but never commit everything ("never go full": the ones
+who hold something back are the ones who can still recover).
+
+Matching is segment-anchored and quote-aware: a rule fires only when the
+segment's leading verb is `git`/`rm`, so a `grep`, an `echo`, or a commit
+message that merely *mentions* a destructive pattern never trips the gate.
+
+Blocked without a reserve (`Bash`/`run_bash`):
+
+- `git reset --hard` — reserve: `git stash` first (an inline
+  `git stash && …` in the same command also counts).
+- Forced push (`--force`, `-f`, `+refspec`) — `--force-with-lease` is allowed
+  by this gate; if the project's git-safety hook blocks that too, the
+  sanctioned fallback is a merge commit, not a bigger hammer.
+- `git clean -f…` / `--force` — reserve: `git stash -u` first. Dry runs
+  (`-n` / `--dry-run`) stay allowed.
+- `git checkout`/`restore` wholesale discards — final arg `.`/`*`, including
+  `checkout HEAD -- .`, `restore --worktree .`, and bare `checkout -f`.
+- Recursive **and** forced delete (`rm -rf` and flag-order variants) of a
+  protected source root (`src`, `test`, `tests`, `lib`, `tools`, `scripts`,
+  the policy-definition dir), of the whole tree (`.`, `*`, `/`), or of a
+  parent/home escape (`..`, `~`). Scratch/derived dirs stay allowed at any
+  depth (`node_modules`, `dist`, `src/__pycache__`, `src/generated`, …) —
+  they are reconstructible; source is not.
+
+Blocked stub overwrites (`Write`):
+
+- Overwriting an existing source file ≥ 4 KiB with content under 20% of its
+  size — the signature of a real implementation being gutted into a stub.
+  Reserve: back the file up to `.uap-backups/<today>/` first. The backup is
+  **verified**: a real regular file (not a symlink) of at least half the
+  original's size — an empty or unrelated same-named file does not count.
+  Incremental `Edit` operations are never touched.
+
+Unlocks:
+
+- An inline reserve-**creating** stash (`git stash`, `git stash push`,
+  `-u`/`--include-untracked`). Reserve-destroying or inert stash subcommands
+  (`drop`, `clear`, `pop`, `list`, `show`, `apply`, `branch`) do **not**
+  unlock.
+- `UAP_RESERVE_OK=1` **only as a leading env assignment of the destructive
+  segment itself** (set it only after creating the backup/stash). A mention
+  elsewhere in the command does not count.
+- A verified same-day `.uap-backups/` backup, for stub overwrites.
+
+Operator overrides: `UAP_RESERVE_OK=1` / `UAP_COMMITMENT_RESERVE_OFF=1` in
+the environment; `DELIVER_ACTIVE=1` sessions are exempt (the deliver harness
+keeps its own snapshot reserve).
+
+## Why
+
+Every catastrophic agent incident on this project was a full-commitment
+failure: real implementation files deleted into stubs to satisfy gates,
+destructive resets that vaporized uncommitted work, force-pushes with nothing
+held back. The rule is not "never do destructive things" — it is "destructive
+moves are allowed only once something is held in reserve", so the recovery
+path always stays open.

package/src/policies/schemas/policies/proportional-commitment.md

@@ -0,0 +1,39 @@
+# proportional-commitment
+
+**Category**: custom
+**Level**: RECOMMENDED
+**Enforcement Stage**: pre-exec
+**Tags**: judgment, proportionality, restraint
+
+## Rule
+
+Effort and blast radius must scale with the task. Commit hard to an approach,
+but never commit **everything** -- always hold a reserve of judgment and a way
+back:
+
+1. **Smallest viable intervention first.** Do not rewrite a whole file when an
+   edit suffices; do not restructure a module to fix a line; do not regenerate
+   what can be patched.
+2. **No orchestration for small work.** Do not spawn subagents, decompose into
+   epics, or fan out parallel workers for a task whose diff is small. The
+   overhead must be justified by the work, not by enthusiasm.
+3. **No destructive reset as a first resort.** `git reset --hard`, `rm -rf`,
+   force-push, and wholesale overwrites are last resorts taken only after the
+   incremental path has demonstrably failed -- and only with a backup or branch
+   point held in reserve.
+4. **Keep one alternative alive.** Before committing to any expensive path
+   (long build, large refactor, multi-agent run), be able to state the fallback
+   you will use if it fails. If there is no fallback, the commitment is too big.
+5. **Stop doubling down.** If the same approach has failed twice, the third
+   attempt must be a different approach, not a louder version of the same one.
+
+## Why
+
+Total commitment is a trap: an agent that goes all-in on one approach, one
+rewrite, or one orchestration pattern surrenders the judgment needed to step
+back out ("hold something back" -- the Tropic Thunder rule). Every major
+incident in this project's history is a full-commitment failure: thousands of
+identical subagent spawns, real implementation files deleted into stubs,
+monolithic sessions overflowing their context window, gates saturated until
+the remedy for a blocked action was itself blocked. Proportional commitment
+keeps the recovery path open.

package/templates/hooks/deliver_autoroute.py

@@ -6,10 +6,16 @@ The policy-gate hook pipes a blocked enforcer's JSON output to this helper. When
 the block carries route == "deliver", the helper:
   1. Logs the blocked intent to the project's .uap pending-deliver log (so the
      intent is never lost).
-  2. If UAP_DELIVER_AUTOROUTE is on, spawns `uap deliver "<hint>"` detached in
-     the background (deduped per file so a retrying model does not fan out
+  2. If the intent is REPLAYABLE (plan D1 recorded the blocked edit's exact
+     content) and UAP_DELIVER_PENDING_REPLAY is on (default), spawns
+     `uap deliver --pending <file>` detached — a DETERMINISTIC replay that
+     writes the content to disk (no model) and runs the gates once. This is what
+     actually lands the blocked write; without it the recorded intent is never
+     applied and the model re-emits it forever (0 files change).
+  3. Else, if UAP_DELIVER_AUTOROUTE is on, spawns `uap deliver "<hint>"` detached
+     in the background (deduped per file so a retrying model does not fan out
      dozens of runs), and annotates the message.
-  3. Prints the (possibly annotated) block message on stdout for the hook to
+  4. Prints the (possibly annotated) block message on stdout for the hook to
      surface to the agent.
 
 Autoroute is ON by default (UAP_DELIVER_AUTOROUTE=0 to disable): the blocked
@@ -27,6 +33,30 @@ from pathlib import Path
 PENDING_LOG = "pending-deliver.jsonl"
 SEEN_FILE = "autoroute-seen"
 UAP_DIR = ".uap"
+BASH_TOOLS = {"bash", "run_bash", "shell", "execute_command"}
+
+# `cat > FILE << DELIM\n...body...\nDELIM` — the heredoc source-write a model
+# reaches for when its Write tool is gated. Captures path + body so the write is
+# REPLAYABLE (applied deterministically) rather than dead-ending. Overwrite form
+# only; append (`>>`) and non-heredoc writers fall through to the model-spawn
+# autoroute. Tolerates a leading env-prefix / `bash -c '...'` wrapper and a
+# quoted or unquoted path/delimiter.
+_BASH_WRITE_RE = re.compile(
+    r"cat\s*>\s*(?P<pq>['\"]?)(?P<path>[^\s'\";|&>]+)(?P=pq)\s*"
+    r"<<-?\s*(?P<dq>['\"]?)(?P<delim>\w+)(?P=dq)\s*\n"
+    r"(?P<body>.*?)\n(?P=delim)\b",
+    re.DOTALL,
+)
+
+
+def _parse_bash_write(command: str):
+    """Recover (path, content) from a heredoc file write, else (None, None)."""
+    if not command or "cat" not in command:
+        return None, None
+    m = _BASH_WRITE_RE.search(command)
+    if not m:
+        return None, None
+    return m.group("path"), m.group("body")
 
 
 def _autoroute_enabled() -> bool:
@@ -41,7 +71,8 @@ def _autoroute_enabled() -> bool:
     return v in {"1", "on", "true", "yes"}
 
 
-def decide(out: dict, tool: str, args: dict, autoroute_on: bool, seen_files: set) -> dict:
+def decide(out: dict, tool: str, args: dict, autoroute_on: bool, seen_files: set,
+           replay_on: bool = True) -> dict:
     """Pure decision: what message to show, whether to spawn, and the intent."""
     reason = out.get("reason", "")
     route = out.get("route")
@@ -61,9 +92,20 @@ def decide(out: dict, tool: str, args: dict, autoroute_on: bool, seen_files: set
         args.get("file_path") or args.get("filePath") or args.get("path")
         or args.get("target") or args.get("filename") or args.get("file") or ""
     )
+    # A bash-routed source write carries its path AND content inside the command
+    # (`cat > FILE << EOF`), not as tool args — recover both so the write becomes
+    # REPLAYABLE instead of dead-ending. Without this the model's `cat >` rewrites
+    # are blocked forever (octopus_invaders_v3, 2026-07-16: 35 min of blocked
+    # heredoc rewrites, 0 landed).
+    bash_content = None
+    if not file_path and tool.lower() in BASH_TOOLS:
+        bp, bc = _parse_bash_write(str(args.get("command") or ""))
+        if bp and bc is not None:
+            file_path = bp
+            bash_content = bc
 
     if route != "deliver":
-        return {"message": reason, "route": route, "spawn": False,
+        return {"message": reason, "route": route, "spawn": False, "replay": False,
                 "file_path": file_path, "hint": hint, "dedup_key": "", "intent": None}
 
     intent = {"ts": int(time.time()), "tool": tool, "file_path": file_path, "hint": hint}
@@ -85,20 +127,46 @@ def decide(out: dict, tool: str, args: dict, autoroute_on: bool, seen_files: set
         )
         if isinstance(v, str)
     }
+    # Recovered heredoc body overwrites the whole file — exactly what the blocked
+    # `cat > FILE` would have done — so record it as a content-intent.
+    if not edit_intent and bash_content is not None:
+        edit_intent = {"content": bash_content}
     if edit_intent:
         intent["edit"] = edit_intent
-    spawn = bool(autoroute_on and hint and dedup_key and dedup_key not in seen_files)
+    # A REPLAYABLE intent (plan D1) carries the blocked edit's exact content, so
+    # it can be applied to disk DETERMINISTICALLY via `uap deliver --pending`
+    # (writeFileSync of the captured content — no model, no blind fan-out). This
+    # is what actually LANDS the blocked write. Without it the intent is recorded
+    # but never applied: the model re-emits the same write forever, the gate
+    # re-blocks it every time, and 0 files change (observed 2026-07-16,
+    # octopus_invaders_v3 — every deliver run frozen at phase 0 with an empty
+    # project). Prefer replay over the model-spawn autoroute whenever available.
+    replayable = bool(
+        file_path
+        and edit_intent
+        and (isinstance(edit_intent.get("content"), str)
+             or isinstance(edit_intent.get("old_string"), str))
+    )
+    # Deduped like a spawn (per change), so a retrying model does not re-run
+    # `uap deliver --pending` for an identical edit — the lock only guards
+    # CONCURRENT runs, the seen-set guards repeats. `replay_on` lets an operator
+    # fall back to the model-spawn autoroute (UAP_DELIVER_PENDING_REPLAY=off).
+    unseen = bool(dedup_key and dedup_key not in seen_files)
+    replay = bool(replayable and replay_on and unseen)
+    spawn = bool(autoroute_on and not replay and hint and unseen)
     message = reason
-    if spawn:
+    if replay:
+        message = reason + " [intent recorded to .uap/pending-deliver.jsonl — auto-applying to disk via deterministic `uap deliver --pending` replay]"
+    elif spawn:
         message = reason + " [auto-routed to `uap deliver` — running in the background]"
-    elif autoroute_on and dedup_key and dedup_key in seen_files:
-        message = reason + " [already auto-routed to `uap deliver` for this change — see .uap/autoroute.log / pending-deliver.jsonl]"
+    elif dedup_key and dedup_key in seen_files and (replayable or autoroute_on):
+        message = reason + " [already auto-routed/applied for this change — see .uap/autoroute.log / pending-deliver.jsonl]"
     elif file_path:
         message = reason + (
             " [intent recorded to .uap/pending-deliver.jsonl — apply it yourself by running"
             " `uap deliver` with the exact intended change as the instruction]"
         )
-    return {"message": message, "route": route, "spawn": spawn,
+    return {"message": message, "route": route, "spawn": spawn, "replay": replay,
             "file_path": file_path, "hint": hint, "dedup_key": dedup_key, "intent": intent}
 
 
@@ -115,6 +183,29 @@ def _load_seen(root: Path) -> set:
 
 LOCK_FILE = "autoroute.lock"
 LOG_FILE = "autoroute.log"
+COHERENT_LOCK = "coherent-mission.lock"
+
+
+def _coherent_enabled() -> bool:
+    # PHASE 1 (coherent-mission routing): route the WHOLE mission to ONE agentic
+    # `uap deliver --epics` run (contracts -> scaffold -> fill, writes in-band)
+    # instead of landing files one at a time via the per-file replay/model-spawn
+    # side-channel — which produces syntactically-valid but NON-integrating output
+    # (index.html loading 2 of 9 scripts, mismatched module APIs; octopus, 07-16).
+    # Default OFF until epic-run phase-0 convergence is hardened; enable with
+    # UAP_DELIVER_COHERENT_MISSION=1/on/true/yes.
+    v = os.environ.get("UAP_DELIVER_COHERENT_MISSION", "off").lower()
+    return v in {"1", "on", "true", "yes"}
+
+
+def coherent_route(coherent_on: bool, route: str, has_write_intent: bool,
+                   mission: str, inflight: bool) -> str:
+    """Whether to route the whole mission to one coherent epic run. Returns
+    'spawn' (start it), 'wait' (one already in flight — suppress the per-file
+    side-channel), or '' (not applicable; fall through to replay/spawn)."""
+    if not (coherent_on and route == "deliver" and has_write_intent and mission):
+        return ""
+    return "wait" if inflight else "spawn"
 
 
 def _pid_alive(pid: int) -> bool:
@@ -176,6 +267,111 @@ def _spawn_deliver(root: Path, hint: str) -> None:
         pass
 
 
+def _replay_enabled() -> bool:
+    # Deterministic pending-intent replay is safe — it writes the recorded
+    # content to disk and runs the gate ladder once, with no model and no blind
+    # background fan-out (the exact hazard that keeps model autoroute OFF by
+    # default). ON by default; UAP_DELIVER_PENDING_REPLAY=0/off/false to disable.
+    v = os.environ.get("UAP_DELIVER_PENDING_REPLAY", "on").lower()
+    return v in {"1", "on", "true", "yes"}
+
+
+def _spawn_pending_replay(root: Path, file_arg: str) -> None:
+    """Spawn `uap deliver --pending <file>` detached: DETERMINISTICALLY replay
+    the recorded edit intent(s) for this file to disk (writeFileSync of the
+    captured content — no model), then run the required gates once. This is the
+    plan-D1 path that actually lands the blocked write. Serialized behind the
+    same one-in-flight lock as _spawn_deliver so concurrent blocked writes do
+    not pile up runs; the model's retry of any still-unwritten file re-triggers
+    a replay once the lock frees. Best-effort; never raises."""
+    import subprocess
+    if not file_arg or file_arg.startswith("-"):
+        return  # need a path, and never let one be parsed as a flag
+    if not _acquire_slot(root):
+        return  # a replay/deliver is already converging in this repo
+    try:
+        log = (root / UAP_DIR / LOG_FILE).open("a")
+    except Exception:
+        log = subprocess.DEVNULL
+    try:
+        proc = subprocess.Popen(
+            ["uap", "deliver", "--pending", file_arg],
+            cwd=str(root),
+            stdout=log, stderr=log, stdin=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+        try:
+            (root / UAP_DIR / LOCK_FILE).write_text(str(proc.pid))
+        except Exception:
+            pass
+    except Exception:
+        pass
+
+
+def _recover_mission(root: Path) -> str:
+    """Best-available mission text for a coherent epic run: the completion
+    ledger's `mission`, else the newest deliver run's `instruction`. '' if none
+    (then coherent routing is skipped and the per-file paths handle the write)."""
+    try:
+        p = root / UAP_DIR / "completion-ledger.json"
+        if p.exists():
+            m = json.loads(p.read_text()).get("mission")
+            if isinstance(m, str) and m.strip():
+                return m.strip()
+    except Exception:
+        pass
+    try:
+        runs = sorted((root / UAP_DIR / "deliver-runs").glob("run-*"),
+                      key=lambda x: x.stat().st_mtime, reverse=True)
+        for r in runs:
+            try:
+                m = json.loads((r / "state.json").read_text()).get("instruction")
+                if isinstance(m, str) and m.strip():
+                    return m.strip()
+            except Exception:
+                continue
+    except Exception:
+        pass
+    return ""
+
+
+def _coherent_inflight(root: Path) -> bool:
+    """One coherent epic run per repo; a live lock pid means one is building."""
+    lock = root / UAP_DIR / COHERENT_LOCK
+    try:
+        if lock.exists():
+            pid = int(lock.read_text().strip() or "0")
+            return bool(pid and _pid_alive(pid))
+    except Exception:
+        pass
+    return False
+
+
+def _spawn_coherent_epic(root: Path, mission: str) -> None:
+    """Spawn ONE `uap deliver --epics -- "<mission>"` (agentic, in-process) that
+    builds the whole mission COHERENTLY through the phase flow. Detached, one per
+    repo. Best-effort; never raises."""
+    import subprocess
+    if not mission or mission.startswith("-") or _coherent_inflight(root):
+        return
+    try:
+        log = (root / UAP_DIR / LOG_FILE).open("a")
+    except Exception:
+        log = subprocess.DEVNULL
+    try:
+        proc = subprocess.Popen(
+            ["uap", "deliver", "--epics", "--", mission],
+            cwd=str(root), stdout=log, stderr=log, stdin=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+        try:
+            (root / UAP_DIR / COHERENT_LOCK).write_text(str(proc.pid))
+        except Exception:
+            pass
+    except Exception:
+        pass
+
+
 def main() -> None:
     ap = argparse.ArgumentParser()
     ap.add_argument("--tool", default="")
@@ -194,7 +390,7 @@ def main() -> None:
         args = {}
 
     root = Path(ns.root)
-    d = decide(out, ns.tool, args, _autoroute_enabled(), _load_seen(root))
+    d = decide(out, ns.tool, args, _autoroute_enabled(), _load_seen(root), _replay_enabled())
 
     if d["intent"] is not None:
         try:
@@ -205,20 +401,43 @@ def main() -> None:
         except Exception:
             pass
 
-    if d["spawn"]:
+    # PHASE 1 (opt-in): route the whole mission to ONE coherent agentic epic run
+    # instead of the per-file side-channel. When it takes over, the single
+    # `uap deliver --epics` run owns the build, so we do NOT also fire per-file
+    # replay/spawn for this write (that is what produced non-integrating output).
+    coherent = ""
+    message = d["message"]
+    if _coherent_enabled() and d["route"] == "deliver" and d["file_path"]:
+        mission = _recover_mission(root)
+        coherent = coherent_route(True, d["route"], True, mission, _coherent_inflight(root))
+        if coherent == "spawn":
+            _spawn_coherent_epic(root, mission)
+            message = d["message"] + " [routed to a single coherent `uap deliver --epics` run — building the whole mission in-band]"
+        elif coherent == "wait":
+            message = d["message"] + " [a coherent `uap deliver --epics` run is already building this mission — intent recorded, not re-routed]"
+
+    if not coherent and (d["replay"] or d["spawn"]):
         try:
             # Dedup on the SAME key `decide` gated on (file when present, else the
             # hint) — writing file_path here would record "" for a bash-routed
-            # intent and never dedup it.
+            # intent and never dedup it. Both paths (deterministic replay and the
+            # model-spawn autoroute) mark the change seen so a retry does not
+            # double-run.
             key = d.get("dedup_key") or d["file_path"] or d["hint"]
             with _seen_path(root).open("a") as f:
                 f.write(key.replace("\n", " ").replace("\r", " ") + "\n")
         except Exception:
             pass
-        _spawn_deliver(root, d["hint"])
+        if d["replay"]:
+            # Deterministic path: the blocked write's content is recorded, so
+            # replay it to disk exactly (no model). This is what makes the block
+            # productive instead of an infinite record-and-re-block loop.
+            _spawn_pending_replay(root, d["file_path"])
+        else:
+            _spawn_deliver(root, d["hint"])
 
     prefix = ("[UAP policy blocked: " + ns.policy + "] ") if ns.policy else ""
-    sys.stdout.write(prefix + d["message"])
+    sys.stdout.write(prefix + message)
 
 
 if __name__ == "__main__":