Repository navigation
Hotfix: /do planning robustness (maxTurns capability, typed refusal, fenced JSON) and S6 ${{ }} false positive - #94
Merged
Conversation
…sal on the proposal path; fenced JSON; S6 reads ${{ }} as a reference
The owner's live /do test on 2026-10-16 failed three ways. Owner: "Şimdi hotfix".
- QUERY_UNEXPECTED_FAILURE: Brain set workInput.maxTurns for a Codex worker (no turn-limit capability). compileNativeCodingWorkInput threw untyped in classifyConfiguredRunSpending (budget.ts); creation (create.ts) already mapped it.
- Now each Brain context kind carries turnLimit ('supported' | 'unsupported', from the CLI registry capability).
- The draft schema shown to the model omits maxTurns when no supplied kind supports it. The draft contract still accepts it, so stored proposals keep parsing.
- The proposal path maps the error to WORK_INPUT_TURN_LIMIT_UNSUPPORTED. Without the fix the new test fails.
- No Brain template change: live config pins template v2.
- BRAIN_OUTPUT_INVALID stage json: a reply that is exactly one ```json/``` fence around the object is read as its body. Any other wrapping still fails at the json stage.
- S6 config-secret false positive on `GITHUB_TOKEN: ${{ github.token }}` (.github/workflows/platform-verification.yml since alpha.40). This refused every live /do worker tree of this repository; live has a temporary exclusion.
- The assignment expression now captures `${{ … }}` whole.
- The placeholder table accepts it when it holds no quote or brace, the same shape as the existing {{ }} rule.
- A quoted literal inside `${{ '…' }}` is still a value and is refused (tested).
- The worker redactor copy is re-synced.
Targeted: 248 redaction/brain/proposal/native-coding/worker-tree/budget test files pass: 3077 passed, 2 failed. Of the 2 failures, the brain-plan kinds expectation is now updated; the other is the known-env installation-apply-adoption.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…le scalar (Astra 2584)
The bare `${{ … }}` alternative stopped at the first `}}` without checking the rest of the scalar. As a result `API_TOKEN: ${{ secrets.PREFIX }}<literal>` was accepted as a placeholder. The alternative now matches only when the expression ends the value: whitespace, comma, semicolon, comment, bracket, quote or end of line must follow. Otherwise the older `${…}` alternative captures a non-placeholder value and the line is refused, as before. The worker-tree-gate test covers a glued literal (refused), two adjacent expressions (refused), and an expression followed by a comment or in quotes (clean). The worker redactor copy is re-synced.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…he line end or a flow delimiter (Astra 2586)
A YAML plain scalar continues after spaces, so '${{ x }} literal', '${{ x }};literal' and '${{ x }} ${{ '\''literal'\'' }}'
were still accepted on the first reference. The lookahead now allows only optional spaces then a # comment or the line end,
or a closing quote, comma or bracket; anything else falls back to the older ${…} capture and is refused. Tests cover the three
negatives plus the clean reference, commented reference and quoted reference.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…e (Astra 2588)
Instead of adding delimiter exceptions, only one shape is a placeholder: the expression ends the line, optionally followed by
spaces and a space-separated # comment, and the next non-empty line does not continue the plain scalar (it is not indented deeper
than the key's line). The comma/bracket branch and the zero-space # case are gone, so '${{ x }},literal', '${{ x }}#literal'
and an indented continuation line are refused (fail closed). Sibling keys and real comments after a reference stay clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…ions placeholder names a GitHub context (Astra 2590)
- continuesScalar found the assignment's line start by LF only but split the following lines by CRLF/CR/LF, so a lone-CR
line before the assignment gave a wrong indent and could miss a continuation. The line start, the following lines and the
value-end lookahead now all use CRLF | CR | LF (YAML 1.2.2 §5.4).
- The placeholder accepts only a GitHub context reference (github|secrets|env|vars|inputs|steps|needs|matrix|runner|job|strategy
followed by a dotted path). A bare unquoted literal such as ${{ 12345678901234567890 }} or ${{ hunter2hunter2 }} is a value.
Tests: the mixed-CR continuation, the numeric and word literals refused; CRLF/CR-terminated context references clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
AlbSar
added a commit
that referenced
this pull request
Oct 16, 2026
…ther; run inspection builds its policy authorization once Owner 2026-10-16: policy v12 (PR #95) goes live with TESLIM-KUYRUGU as one release. CHANGELOG: alpha.42 is marked live (7ea6299, PR #93 + #94, ledger v56) and README/README.tr/SECURITY name it as the current pre-release; the POLICY-V12 text moves to the alpha.43 line with the delivery queue. After rebasing onto 49e0ddf the composition package measured 7206 lines (budget 7200, not raised). Run inspection built the same DispatchPolicyAuthorization three times; it now builds it once, and the queue observation that only inspection uses moves from queue-view.ts into inspect.ts. Behaviour is unchanged (run-query, delivery-queue-e2e and the terminal delivery PTY proof pass). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner live /do test 2026-10-16 failed three ways (proof/DO-TEST-2026-10-16/FINDINGS.md); owner: "Şimdi hotfix".
turnLimit; the draft schema omitsworkInput.maxTurnswhen no kind's worker supports it. The proposal-path spending classification refuses the error typed (WORK_INPUT_TURN_LIMIT_UNSUPPORTED); previously it surfaced as QUERY_UNEXPECTED_FAILURE.${{ … }}GitHub expressions without quoted literals are references, not secrets. Previously every live /do on this repository was refused since alpha.40.On top of main 680e726 (alpha.42 candidate incl. PR #93).
🤖 Generated with Claude Code
https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP