Adopt the six-tool lowercase surface, keep To-do state out of repeated provider prompts, and store Codex-style compaction checkpoints in ordinary history. Preserve provider-specific reasoning continuity, typed image tool results, role capability boundaries, ACP tool turns, and exact regression coverage across the runtime.
Three v0.9.5 benchmark tasks could not launch Codewhale at all:
mteb-leaderboard, mteb-retrieve, and pytorch-model-recovery run older ARM64
images, and the aarch64-unknown-linux-gnu artifact built on ubuntu-24.04-arm
requires GLIBC_2.39.
Release and nightly now build aarch64-unknown-linux-musl on the native ARM
runner, alongside the x64 musl build that has shipped since v0.8.65. Both
gain a static check (no ELF INTERP) plus a launch smoke on the matching
native runner, so a dynamically linked or non-starting binary fails the
build rather than the user's install. docs/INSTALL.md drops the arm64 glibc
floor section and describes the v0.9.6 matrix.
Also reconciles the copy the earlier commits invalidated: setup ratification
text and all 15 locales stop attributing execution doctrine to "mode
prompts", docs/MODES.md states Auto-Review's actual deterministic
allow/deny behavior, and the source-structure, dead-code, and
runtime-contract budgets are re-measured — the last locking down 25
decreased ceilings and the new mode-agnostic prompt-stage digests.
Harvested from PR #5077 by @Hmbown
Progressive fresh-context disclosure: the constitution ships as a minimal
kernel (Ground truth / User intent and scope / Truthful completion / Put
guarantees in mechanism / Whose word wins) with procedural playbooks
disclosed on demand; project context pack is opt-in
(project_context_pack_enabled) and counted in context reports;
load_skill gains name="list" catalogue discovery.
Conflict resolutions:
- prompts/text.rs: took the PR's kernel rewrite (its mechanism and tests
key on the new section names); main's Playful overlay / legacy-prompt
removals kept.
- prompts.rs: two main-side tests pinned the superseded 'Verify before you
claim' text; updated to pin the kernel's Truthful completion contract.
- tools/skill.rs: PR's name="list" discovery wording + main's current
File action tool naming.
- skills/mod.rs: PR's USAGE trailer + hard prompt-budget assert.
- skills/system.rs: kept main's external tests file; transplanted the PR's
procedural_skill_homes_remain_bundled_and_lazy test. Dropped the PR's two
uninstall tests — main's dead-code audit (849010b03) deliberately removed
uninstall_system_skills.
- context_report.rs: env block lives once in base_source_entries (AlwaysOn,
PR's design); main's native_prompt_block memory path kept; the PR's
moraine_fallback test dropped (field removed from main); both project-pack
tests kept.
- tui/ui.rs: PR's apply_workspace_runtime_state line transplanted into
ui/apply.rs (function moved by the ui split).
- budgets: runtime-contract regenerated from measurement (28 metrics
shrank ~40%, 5 grew, 17 identity changes — all from the feature); source
aggregate folded +76 lines to 671740.
Both tripwires fired on purpose and both raises are explicit maintainer
decisions, per DECISION-runtime-contract-ceiling-0.9.4.md:
- runtime-contract-budget.json: the twelve tool-catalog bytes/tokens_est
ceilings move to the measured values at this tip (plan full 40937->42539,
plan active 16203->17388, act/operate full 66794->68792, act/operate
active 21482->23033, tokens_est accordingly). The growth is the 0.9.4
correction of tool descriptions that previously lied to the model, plus
the File parameter-alias hardening — surface that must stay. The diff
touches ONLY bytes/tokens_est: identity_sha256 and tool_names are
unchanged, i.e. no model-facing tool was added or renamed. (Edited by
hand: --update only tightens and refuses increases; the LAUNCH doc's
--update instruction is wrong.)
- source-structure-budget.json: aggregate owned Rust 659633 -> 661672
(+2039), measured after the work-bar regression fix landed so the count
is final for the train. The _todo note now records that v0.9.4 overspent
and v0.9.5 pays it down by deletion/dedup; test code was deliberately NOT
shuffled into tests.rs files to duck the count.
Verified: both checkers PASS at this tip (runtime contract: all 55 metrics
exactly at budget; source structure: 20 packages, 3 binaries, 661672 owned
lines). Authored with agent assistance (Claude).
- source-structure: reviewed add of the codewhale-telemetry package
- runtime-contract: full tool catalogs now include send_later on Plan/
Act/Operate; ceilings and representative-context identities locked
to the measured provider-free receipt after the agent write-scope
schema text update
Keep authority, current user intent, authorization gates, truthfulness, verified completion, mechanism, and exact precedence eager. Move procedural detail to mode/action/skill boundaries, lock first-turn invariants and skill homes with tests, document measured Pi parity, and surface warning-only skill discovery.
Start the action-local relay template at the required artifact title and keep the acceptance contract focused on user-visible structure.
Refresh the provider-free runtime receipt for the intentional first-turn load_skill activation while locking in the smaller prompt measurements.
Make interactive Auto-Review reachable, keep permission posture live across mid-turn changes, and preserve fail-closed authorization receipts.
Repair path-included test harness compilation and make the real-PTY policy matrix assert that destructive work is held under Auto-Review while Ask and Full Access retain their documented behavior.
All substantive GitHub Actions and Buildkite #735 passed on the exact head. The lone red Claude review check was unavailable infrastructure with no findings.
Remove stale duplicated turn metadata and keep the runtime state authoritative. All substantive CI and Buildkite gates passed; the only failed check was the unavailable Claude review infrastructure.
Delete the default model-facing SlopLedger machinery and its storage-oriented product language while preserving ordinary output previews and expansion.
Validated by 9,474 local TUI tests and fresh macOS, Windows, lint, mobile, CodeQL, OHOS, Buildkite, link, DCO, web, and Ubuntu checks. The Claude review job failed in its known service-infrastructure path without a code finding.
The representative runtime contract intentionally includes the shipped Codewhale version. Rebaseline the seven stage digests for the 0.9.2 to 0.9.3 release bump; byte counts, deltas, tool catalogs, and all numeric ceilings are unchanged.
Signed-off-by: Hmbown <101357273+Hmbown@users.noreply.github.com>
The representative-context fixture normalizes workspace/home paths and
pins SHELL, but render_environment_block also embeds the host OS as
'- platform: {os}'. The normalized stage identities therefore differed
per host OS, and PR #4993's ubuntu Lint job failed with 'identity
changed for representative base stage identity digest' once the
earlier-ordered tool-catalog identity (image_ocr) was fixed and
unmasked it. Production prompts keep truthfully reporting the host; the
contract fixture now pins '- platform: <PLATFORM>' alongside the
existing path/shell pins.
Stage identities hand-re-baselined from the corrected receipt (bytes
unchanged; digests only). Verified: checker PASS 55/55 exact;
skill_discovery/representative tests 5/5; checker unit tests OK; fmt
and diff clean.
The ToolSurfacePolicy integration (b155681fb) intentionally changed mode
prompt prose (Act -3B, Operate -818B, Plan +55B: static tool claims
became catalog-conditional) and deleted 152 production lines. Tool
surfaces are unchanged (51 tools; the image_ocr host-capability
exclusion is preserved), prompts still render byte-identically across
repeated builds, and the base-head change is one-time and deterministic
per the prefix-cache invariant.
- runtime-contract budget: representative stage identities/bytes and
per-mode prompt metrics hand-re-baselined from the combined-tree
receipt (identity edits stay manual by ratchet design)
- source-structure budget: ceiling tightened 645,755 -> 645,603
Verified on the combined tree: contract PASS 55/55 exact; source PASS;
dead-code PASS 482; checker unit tests OK; focused tests 27/27; prompts
suite 139/139; warnings-denied TUI clippy PASS; fmt/diff clean.
The runtime-contract measurement pins PATH to a nonexistent root so
interpreter-backed tools probe absent on every host, but image_ocr's
macOS registration also depends on the Vision framework probe, which
ignores PATH. The canonical profile therefore contained image_ocr on
macOS and lacked it on Linux, and PR #4993's Lint job failed with
'identity changed for Act full tool names (removed=[image_ocr])'.
ocr_available() now honors CODEWHALE_LOCAL_OCR_UNAVAILABLE, which the
measurement sets so every host presents no local OCR capability;
production registration behavior is unchanged. The budget's act/full
and operate/full surfaces are re-baselined from the corrected receipt
(52 to 51 tools; identity changes are hand-edited deliberately because
--update only tightens numeric ceilings). Production line count is
net-zero to hold the 645,755 source ceiling.
Verified: checker PASS 55/55 exact; source-structure PASS at 645,755;
dead-code PASS at 482; checker unit tests 17/17; image_ocr 3/3;
tool_catalog 18/18; fmt and diff clean.
Transcript visibility was leaking into the model contract: hiding thinking explicitly forced reasoning_content to English and removed locale reinforcement. That became the default path when fresh installs began hiding thinking by default.\n\nKeep show_thinking exclusively in transcript rendering, always preserve the latest-user language contract, and reassert that contract across compaction summaries. Remove the obsolete engine and prompt plumbing, then tighten the runtime-contract and source-structure ratchets to the smaller surface.
Measure the provider-free model-facing contract through production-owned seams. Keep deterministic minimal prompts by visible mode, build each Plan/Act/Operate tool surface through the canonical turn registry and request planner with inert wiring, and record full and active catalog counts, bytes, token estimates, sorted names, and stable identities.
Add a hermetic representative prompt fixture that cumulatively introduces project authority, configured instructions, one workspace skill, memory, goal, and handoff. Normalize temporary roots before hashing every stage, require stable repeated identities, prove each prior marker appears exactly once while future markers remain absent, and ratchet adjacent stage deltas plus the final envelope.
Enforce 55 one-way numeric ceilings and exact structural identities, while retaining the observable repeated skill-discovery baseline and future cached-zero payload. Reject equal-size tool substitutions, removals, missing identity, cross-mode swaps, and representative-stage substitutions; keep atomic permission-preserving budget updates and the locked offline heavy-lint gate.
CodeWhale Bot