From 4ee25984b9bacfab80034b6c743a6432d0409e63 Mon Sep 17 00:00:00 2001 From: SikongJueluo Date: Mon, 17 Aug 2026 22:28:43 +0800 Subject: [PATCH] docs: acceptance checklist against PIEXTENSIO-3 contract - record baseline, module map, category status, and pinned canonical revisions - list owned residual gaps: upstream enrollment and human-decision seams, lifecycle ordering enumerations, negative v24 fixture --- docs/adr/piextensio-12-acceptance.md | 94 ++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 docs/adr/piextensio-12-acceptance.md diff --git a/docs/adr/piextensio-12-acceptance.md b/docs/adr/piextensio-12-acceptance.md new file mode 100644 index 0000000..0cd3208 --- /dev/null +++ b/docs/adr/piextensio-12-acceptance.md @@ -0,0 +1,94 @@ +# PIEXTENSIO-12 v0.1 acceptance checklist + +Status of the Shadow-first AI Bash Authorization Judge v0.1 against the +PIEXTENSIO-3 implementation acceptance contract (canonical resolution +984df7a2), recorded after slice 5. This file tracks what is satisfied, +what is intentionally out of scope, and the residual gaps with their +owning decision. + +## Repaired baseline (I1–I4) + +- I1 `@types/node` present; `pnpm -r check` exits 0 in every package. **PASS** +- I2 test matrix discovered and executed: 9 files / 85 tests (ai-judge), + 3 files / 48 tests (inner-cmd); zero failed/skipped/todo/only. **PASS** +- I3 gate runner: clean env (`env -i`, no credentials, fakes only) — + `pnpm -r check` + `pnpm -r test` green from the working lockfile. **PASS** +- I4 version identity: workspace and global runtime both resolve + `@gotgenes/pi-permission-system` 25.4.0. **PASS** + +## Module map (PIEXTENSIO-5 seven root modules) + +| Module | File | Deterministic tests | Status | +|---|---|---|---| +| index | `src/index.ts` | `test/lifecycle.test.ts` | present | +| config | `src/config.ts` | `test/config.test.ts` | present | +| evidence | `src/evidence.ts`, `src/conversation.ts` | `test/evidence.test.ts`, `test/conversation.test.ts` | present | +| prompt | `src/prompt.ts` | `test/prompt.test.ts` | present | +| model | `src/model.ts` | `test/model.test.ts` | present | +| review | `src/review.ts` | `test/review.test.ts` | present | +| judge | `src/judge.ts` | `test/judge.test.ts` | present | +| analyzer (separate governance consumer) | `src/analyzer/` | `test/analyzer/analyze.test.ts` | present | + +No eighth live module was invented. + +## Category-by-category + +1. **Pure builders** — evidence whitelist/exclusions, 16-item/12,000-char + caps, latest-user preservation, head truncation, compaction flagging; + versioned prompt snapshot with authority rules and quoted untrusted + rendering; review key set at the sink with the privacy denylist. **PASS** +2. **Mocked model** — one completion, zero retries, no prose fallback, + stable codes across capability shapes; 256/257 output boundary; usage + legitimacy (missing/implausible → model_error). **PASS** +3. **Lifecycle** — one root registration; headless child never registers; + session-id mismatch defers; per-request model capture (between-request + switch changes the next call); shutdown aborts in-flight work. **PASS** + (partial: ready/start ordering permutations and fake-timer teardown + assertions are not yet enumerated — see Residual gaps.) +4. **Failure path / truth table** — every gate independently forces defer + with a distinct reason; v0.1 production state never grants authority + for any mode × telemetry combination. **PASS** +5. **Review trail** — metadata-only events keyed by requestId; result + written before return; leak sentinel asserts neither command text nor + conversation text reaches review rows. **PASS** (reconstructed join — + ADR 0005; enrollment and human-decided events are upstream gaps.) +6. **Permission-system integration** — registerAuthorizer seam consumed + end-to-end (live smoke: rounds 1–3, forwarded preflight rows). + **PARTIAL**: the negative v24 Enforce fixture and the two-track + floor tests are not mechanized; live E2E evidence substitutes. +7. **Manual Shadow** — human-governed; three fixed-window replay rounds + archived under `docs/research/rounds/` with the comparison matrix, + false-allow denominator, and blind-deny protocol. **PASS as diagnostic** + (promotion floor deliberately unreachable — no 100-row cohort, by + design, until upstream seams close). + +## Pinned safety contracts (M6) + +| Contract | Canonical revision | +|---|---| +| PIEXTENSIO-4 prompt boundary | 3cc3af7f-ad8d-4764-be52-ebff04982a50 | +| PIEXTENSIO-5 module map | 6931027b-d191-4357-8c26-3c3bbe29cd8a | +| PIEXTENSIO-9 review trail | de571cfe-6ff2-412a-b7f5-157250014d49 | +| PIEXTENSIO-10 promotion | 0eb13dc2-bfed-42bb-82c1-e642cbf55c52 | +| PIEXTENSIO-11 budgets | c0b0028d-8321-4d8b-895e-8fecd9c36a8e | + +The timeout defaults/range and reason bound in code match PIEXTENSIO-11's +normative values (15,000 ms default, 5,000–30,000 ms accepted, 240 code +points, 256 output tokens). + +## Residual gaps (owned, not silently dropped) + +- Upstream seams (PIEXTENSIO-9): `authorizer_link.invoked` enrollment and + `permission_request.human_decided` do not exist in permission-system + 25.4; the analyzer reconstructs both (ADR 0005) and the truth table + treats `reviewAcknowledged` as structurally false. Promotion remains + mechanically impossible — the designed v0.1 posture. +- Lifecycle ordering permutations and fake-timer teardown assertions + (PIEXTENSIO-3 cat.3 enumerations) are thinner than the contract's full + list; current coverage exercises the load-bearing paths (registration, + mismatch, model switch, shutdown abort). +- The negative v24 fixture (cat.6) is satisfied by construction — the + truth table cannot grant authority against any host surface — but not + by a dedicated CI fixture against a real v24 package. +- Live cohort identity changed with slice 4 (prompt v2 + conversation + evidence); rounds 1–3 are diagnostic data for the v1 candidate only.