docs(plans): meta-harness survey; lead decision 47

Filbert's survey of Pi, Claude Code and Codex hooks as a record. No hook is a hard block alone; credential scope, verbs, tool ceiling and a container are. Two DEFERRED items. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-04 14:26:50 -05:00
parent bb7e37dda2
commit df9e036214
4 changed files with 966 additions and 0 deletions
@@ -469,3 +469,5 @@ are never rewritten or removed; corrections are new entries.
 2026-10-04T19:12:27Z | Filbert (T3 Claude Code, thread 9cb9731e) | meta-harness survey started (slice 1 step 8, Sage ASSIGNMENT) | research only in agents/filbert/work/; no commits; row 5 round 2 takes priority
 2026-10-04T19:12:38Z | Sage (T3 Claude Code, thread 1ef1e4f8) | PRDY round 1, seat launches (decision 45) | PRD draft 0.1 at docs/prd/mosaic-stack.md; launched Researcher (T3 Sonnet 5.5, thread 9bac0794) for the Vikunja and Pocket ID report; assigned Darkwing the slice 1 data model note and Filbert the meta-harness survey (both T3 Opus 5.5, existing threads); Dewey on the row 5 rework; running under the new limits: Opus 3 of 4 (dewey, darkwing, filbert), Sonnet 1 of 4 (researcher)
 2026-10-04T19:19:14Z | Sage (T3 Claude Code, thread 1ef1e4f8) | slice 1 data model received | Darkwing's note (948b94ce) and prototype committed as records; lead decision 46 accepts 6.1-6.5, 6.7, 6.8 and sends 6.6 (PM launching sessions) to Jason in PRDY round 3
+2026-10-04T19:26:12Z | Filbert (T3 Claude Code, thread 9cb9731e) | meta-harness survey done (slice 1 step 8) | agents/filbert/work/meta-harness-survey-2026-10-04.md sha256 05f83807…0989; Pi tool_call is the only fail-closed hook of the three, so hard lines are credential scope, verbs, tool ceiling and container; no commits
+2026-10-04T19:26:50Z | Sage (T3 Claude Code, thread 1ef1e4f8) | meta-harness survey received | Filbert's survey (05f83807) committed as a record; lead decision 47 rules on its section 8; two DEFERRED items (host-seat --approve, worker provider-key exposure)
@@ -729,3 +729,27 @@ which stay with him. Each item names who decided it and what happened.
    enough: `INSERT OR REPLACE` overwrote a row in the prototype despite
    UPDATE and DELETE triggers. Each table also needs a BEFORE INSERT
    guard, which the prototype verified.
+47. **Sage's rulings on the meta-harness survey (2026-10-04).** Source:
+    Filbert's `agents/filbert/work/meta-harness-survey-2026-10-04.md`
+    (sha256 05f83807…), section 8. The survey's finding: no harness's hook
+    is a hard block on its own. Pi's `tool_call` hook fails closed. Claude
+    Code's command hooks and Codex's hooks fail open. Nothing was run
+    against a live harness. The survey's section 9 has a probe matrix that
+    must pass before any build brief relies on a block.
+    1. Pi gate extension: accepted. It enters through the CHAT-06 path
+       (decision 31) as one digest-checked file. Until then Pi role seats
+       get no hook.
+    2. Brief wording: accepted. The hard layers are credential scope, the
+       verbs refusing without a resolved decision, the tool ceiling and a
+       container. Hooks are early refusal plus logging.
+    3. No machine-wide `/etc` locks in slice 1. They would govern Jason's
+       own sessions, which makes them a gated policy change.
+    4. Host-seat `--approve`: the generator emits `--no-approve` and
+       `--system-prompt`. A bounded follow-up for
+       `scripts/agent-host-dev.sh` goes in DEFERRED.
+    5. Claude credentials for isolated seats: a per-role setup token or an
+       API key. Both are gated, so this goes to Jason at slice 1 step 7.
+    6. Role credentials stay in the broker and never enter an agent's
+       environment or files. The existing exposure of worker provider keys
+       goes in DEFERRED.
+    7. Build order: Pi, then Claude Code, then Codex.
@@ -174,6 +174,17 @@ at every gate. Started 2026-09-12 during the control board MVP.
  #1507 (comment 26685). Fix: have `record` check the comment's issue and author the way
  `resolve` does, or refuse a comment id it can't verify. Found by
  Filbert. (2026-10-04, #1508)
+- **Host seats launch Pi with `--approve`.** A future `.pi/SYSTEM.md` or
+  `.pi/settings.json` in the checkout would load in every host seat. This
+  is latent, since neither file exists today. Fix in
+  `scripts/agent-host-dev.sh`: pass `--no-approve` and an explicit system
+  prompt. Filbert, meta-harness survey section 8.4. (2026-10-04)
+- **Workers can read provider keys.** The worker container passes
+  `ZAI_API_KEY` and `ANTHROPIC_API_KEY` in the environment, which Pi's
+  `bash` inherits, and Pi's `read` can open the mounted `auth.json`.
+  Slice 1 role tokens stay in the broker (lead decision 47). The workers'
+  own exposure needs a separate piece. Filbert, survey section 8.6.
+  (2026-10-04)

 ## Queue