From a16c9e476413e50ce57269ccc22bc5cd75cae7f6 Mon Sep 17 00:00:00 2001 From: Ed_ Date: Thu, 18 Jun 2026 18:25:55 -0400 Subject: [PATCH 1/7] fix(tier2): reconcile agent prompt with Tier 2's project-relative paths Tier 2 (in commit 923d360d) relocated the failcount state and failure report defaults from 'scripts/tier2/state/' to 'tests/artifacts/tier2_state/' (matching the workspace_paths.md styleguide). This commit reconciles the agent prompt with the actual code path: - 'Temp files' convention: scripts/tier2/state//state.json -> tests/artifacts/tier2_state//state.json - 'Temp files' convention: scripts/tier2/failures/ -> tests/artifacts/tier2_failures/ - Example audit output: scripts/tier2/state/audit_initial.json -> tests/artifacts/tier2_state/audit_initial.json - 'Failcount Contract' state path updated to match. The user must re-bootstrap the Tier 2 clone to pick up the fixed template (pwsh -File scripts/tier2/setup_tier2_clone.ps1). Refs: conductor/tracks/tier2_no_appdata_20260618 (post-merge followup) --- conductor/tier2/agents/tier2-autonomous.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/conductor/tier2/agents/tier2-autonomous.md b/conductor/tier2/agents/tier2-autonomous.md index 92d721e8..2e3b64d0 100644 --- a/conductor/tier2/agents/tier2-autonomous.md +++ b/conductor/tier2/agents/tier2-autonomous.md @@ -41,11 +41,11 @@ You are running inside a Windows restricted token. The OpenCode permission syste - **Throw-away scripts:** write them to `scripts/tier2/artifacts//`, NOT the base `scripts/tier2/` directory. The base directory is reserved for production code that ships with the sandbox (failcount.py, run_track.py, write_report.py, the .ps1 launchers). Throw-away scripts are kept for archival but live in a track-specific subdir so they don't pollute the base. - **End-of-track report:** after all tasks complete, you MUST write `docs/reports/TRACK_COMPLETION_.md` (follow the precedent set by `TRACK_COMPLETION_tier2_autonomous_sandbox_20260616.md`) and update `conductor/tracks//state.toml` to `status = "completed"`. This is the handoff document the user reads to decide merge. - **Run-time expectation:** tracks are expected to take 1-4 hours. If the model reports it is running out of context or steps, do not stop. Note progress to disk (the failcount state file) and continue. The user expects autonomous runs to complete without manual intervention. -- **Temp files** (added 2026-06-17, rewritten 2026-06-18): All scratch, state, audit-output, and intermediate files MUST live INSIDE the Tier 2 clone. Default locations: `scripts/tier2/state//state.json` for failcount state, `scripts/tier2/failures/` for failure reports, `scripts/tier2/artifacts//` for throwaway scripts. **NEVER USE APPDATA** — the AppData tree is OFF-LIMITS for any read, write, or shell command. The `*AppData\\*` bash deny rule enforces this; a violation halts the run. The original `*AppData\Local\Temp\*` deny rule is kept for self-documentation. Examples: `uv run python scripts/audit_exception_handling.py --json > scripts/tier2/state/audit_initial.json` (NOT `%TEMP%\audit_initial.json`; AppData is denied by the bash rule). +- **Temp files** (added 2026-06-17, rewritten 2026-06-18, paths updated 2026-06-18 per Tier 2's project-relative relocation): All scratch, state, audit-output, and intermediate files MUST live INSIDE the Tier 2 clone. Default locations: `tests/artifacts/tier2_state//state.json` for failcount state, `tests/artifacts/tier2_failures/` for failure reports, `scripts/tier2/artifacts//` for throwaway scripts. **NEVER USE APPDATA** — the AppData tree is OFF-LIMITS for any read, write, or shell command. The `*AppData\\*` bash deny rule enforces this; a violation halts the run. The original `*AppData\Local\Temp\*` deny rule is kept for self-documentation. Examples: `uv run python scripts/audit_exception_handling.py --json > tests/artifacts/tier2_state/audit_initial.json` (NOT `%TEMP%\audit_initial.json`; AppData is denied by the bash rule). ## Failcount Contract -After every task commit, you MUST check `should_give_up` from `scripts.tier2.failcount`. The state is persisted at `scripts/tier2/state//state.json` (relative to your CWD, which is the Tier 2 clone root). The thresholds are: +After every task commit, you MUST check `should_give_up` from `scripts.tier2.failcount`. The state is persisted at `tests/artifacts/tier2_state//state.json` (project-relative; resolved via `Path(__file__).parents[2]` in the failcount module). The thresholds are: - 3 consecutive red-phase failures - 3 consecutive green-phase failures - 30 minutes with no progress (no commit, no green test) From cf8e0ea8f309267527b4fca96466355a5ab05c51 Mon Sep 17 00:00:00 2001 From: Ed_ Date: Thu, 18 Jun 2026 18:26:26 -0400 Subject: [PATCH 2/7] fix(tier2): reconcile slash command with Tier 2's project-relative paths Same reconciliation as the agent prompt (previous commit). Three paths in conductor/tier2/commands/tier-2-auto-execute.md now match the actual code defaults: - Pre-flight step 3: scripts/tier2/state/ -> tests/artifacts/tier2_state/ - Protocol step 3: scripts/tier2/state/ -> tests/artifacts/tier2_state/ - 'Temp files' convention: scripts/tier2/state/ and scripts/tier2/failures/ -> tests/artifacts/tier2_state/ and tests/artifacts/tier2_failures/ The user must re-bootstrap the Tier 2 clone to pick up the fixed template (pwsh -File scripts/tier2/setup_tier2_clone.ps1). Refs: conductor/tracks/tier2_no_appdata_20260618 (post-merge followup) --- conductor/tier2/commands/tier-2-auto-execute.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/conductor/tier2/commands/tier-2-auto-execute.md b/conductor/tier2/commands/tier-2-auto-execute.md index 602acdf1..daa79803 100644 --- a/conductor/tier2/commands/tier-2-auto-execute.md +++ b/conductor/tier2/commands/tier-2-auto-execute.md @@ -16,13 +16,13 @@ Optional flags: `--resume` (continue from last completed task), `--toast` (Windo 1. **Verify sandbox is active.** This slash command must be invoked from a sandboxed OpenCode session. If `manual-slop_get_ui_performance` returns an error or the run_tier2_sandboxed.ps1 wrapper is not in the parent process, refuse to start. 2. **Load the track spec.** Read `conductor/tracks//spec.md` and `plan.md` from the current branch. If the track does not exist, abort. -3. **Check for a previous run.** If `scripts/tier2/state//state.json` exists AND `--resume` is NOT set, abort with: "Previous run found for this track. Use `--resume` to continue, or delete the state file to start fresh." +3. **Check for a previous run.** If `tests/artifacts/tier2_state//state.json` exists AND `--resume` is NOT set, abort with: "Previous run found for this track. Use `--resume` to continue, or delete the state file to start fresh." ## Protocol 1. `git fetch origin master` (NOTE: this repo uses `master`, not `main`; added 2026-06-17) 2. `git switch -c tier2/ origin/master` (NOT `git checkout` - it is banned) -3. Initialize failcount state at `scripts/tier2/state//state.json` (use `load_state` or fresh state) +3. Initialize failcount state at `tests/artifacts/tier2_state//state.json` (use `load_state` or fresh state) 4. For each task in `plan.md`: a. Red: delegate test creation to @tier3-worker b. Run tests via `uv run python scripts/run_tests_batched.py` (NEVER `uv run pytest` directly; the batched runner provides tier filtering, parallelization, and the summary table — added 2026-06-17) @@ -43,7 +43,7 @@ Optional flags: `--resume` (continue from last completed task), `--toast` (Windo - **Line endings:** preserve existing (CRLF stays CRLF, LF stays LF) - **Throw-away scripts:** write to `scripts/tier2/artifacts//`, NOT the base directory - **Run-time expectation:** tracks are 1-4 hours. If context runs out, note progress to disk and continue. -- **Temp files** (added 2026-06-17, rewritten 2026-06-18): All scratch, state, audit-output, and intermediate files MUST live INSIDE the Tier 2 clone. Default locations: `scripts/tier2/state//state.json` for failcount state, `scripts/tier2/failures/` for failure reports, `scripts/tier2/artifacts//` for throwaway scripts. **NEVER USE APPDATA** — the `C:\Users\Ed\AppData\...` tree is OFF-LIMITS. The `*AppData\\*` bash deny rule enforces this. +- **Temp files** (added 2026-06-17, rewritten 2026-06-18, paths updated 2026-06-18 per Tier 2's project-relative relocation): All scratch, state, audit-output, and intermediate files MUST live INSIDE the Tier 2 clone. Default locations: `tests/artifacts/tier2_state//state.json` for failcount state, `tests/artifacts/tier2_failures/` for failure reports, `scripts/tier2/artifacts//` for throwaway scripts. **NEVER USE APPDATA** — the AppData tree is OFF-LIMITS. The `*AppData\\*` bash deny rule enforces this. ## Hard Bans (enforced by 3 layers) From a6038cb49aa6d2b422e45213f4255314a6e12e37 Mon Sep 17 00:00:00 2001 From: Ed_ Date: Thu, 18 Jun 2026 18:27:13 -0400 Subject: [PATCH 3/7] docs(tier2): reconcile guide with Tier 2's project-relative paths Three path updates in docs/guide_tier2_autonomous.md to match the actual code defaults (project-relative, in tests/artifacts/): - Bootstrap callout block: scripts/tier2/state/ and scripts/tier2/failures/ -> tests/artifacts/tier2_state/ and tests/artifacts/tier2_failures/ - 'The failure report' section: scripts/tier2/failures/ -> tests/artifacts/tier2_failures/ - Troubleshooting: 'Failcount state not found' and 'Tier 2 ran out of context' both point at the right path now. Refs: conductor/tracks/tier2_no_appdata_20260618 (post-merge followup) --- docs/guide_tier2_autonomous.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/guide_tier2_autonomous.md b/docs/guide_tier2_autonomous.md index 1fc8e0ce..a928589e 100644 --- a/docs/guide_tier2_autonomous.md +++ b/docs/guide_tier2_autonomous.md @@ -23,7 +23,7 @@ The bootstrap: 4. Installs the git hooks (`pre-push` refuses all pushes; `post-checkout` logs checkouts) 5. Creates a "Tier 2 (Sandboxed)" desktop shortcut -**As of 2026-06-18:** the bootstrap no longer creates any directory on AppData. Tier 2 state and failure reports live inside the clone at `scripts/tier2/state//state.json` and `scripts/tier2/failures/_.md`. The user directive is "NEVER USE APPDATA" — enforced by the OpenCode `*AppData\\*` bash deny rule. +**As of 2026-06-18:** the bootstrap no longer creates any directory on AppData. Tier 2 state and failure reports live at `tests/artifacts/tier2_state//state.json` and `tests/artifacts/tier2_failures/_.md` (project-relative; inside the project tree under the already-gitignored `tests/artifacts/`). The user directive is "NEVER USE APPDATA" — enforced by the OpenCode `*AppData\\*` bash deny rule. ## Per-track invocation @@ -70,7 +70,7 @@ Override via `scripts/tier2/failcount.toml`. ## The failure report -Written to `scripts/tier2/failures/_.md` (inside the Tier 2 clone, relative to the clone root) with 7 sections: +Written to `tests/artifacts/tier2_failures/_.md` (project-relative; inside `tests/artifacts/` which is gitignored) with 7 sections: 1. Header (track, branch, started, stopped, duration, give-up signal) 2. Tasks completed 3. Current task (where it stopped) @@ -117,9 +117,9 @@ And verify allowed operations work: - **"Permission denied" on file access inside the sandbox**: the Windows ACL may be too restrictive. Re-run the bootstrap (`setup_tier2_clone.ps1` is idempotent). -- **"Failcount state not found"**: the `scripts/tier2/state//` +- **"Failcount state not found"**: the `tests/artifacts/tier2_state//` dir may be missing. The failcount module creates it on first save; - check that the Tier 2 clone's working directory is correct. + check that the Tier 2 clone's project root is correct. - **"Pre-push hook not firing"**: check that `.git/hooks/pre-push` is executable. On Windows, Git Bash runs the hook; check `git config core.hooksPath` if you have a custom hooks dir. @@ -127,6 +127,6 @@ And verify allowed operations work: `no_progress_minutes` in `scripts/tier2/failcount.toml`. - **"Tier 2 ran out of context"**: the model stopped mid-track. The user (interactive Tier 1) should `cd` to the Tier 2 clone, inspect - `scripts/tier2/state//state.json` for the last completed task, + `tests/artifacts/tier2_state//state.json` for the last completed task, and re-invoke with `/tier-2-auto-execute --resume` to continue. The state file persists across runs. From eb23a8be98350a0ba570eb05d152cf3e0e1a2aa1 Mon Sep 17 00:00:00 2001 From: Ed_ Date: Thu, 18 Jun 2026 18:27:31 -0400 Subject: [PATCH 4/7] fix(tier2): write_track_completion_report - use project-relative path Updated the generated report template to reference tests/artifacts/tier2_state//state.json (matching Tier 2's commit 923d360d relocation) instead of the stale scripts/tier2/state//state.json. Refs: conductor/tracks/tier2_no_appdata_20260618 (post-merge followup) --- scripts/tier2/write_track_completion_report.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/tier2/write_track_completion_report.py b/scripts/tier2/write_track_completion_report.py index 64730f5b..88c1013e 100644 --- a/scripts/tier2/write_track_completion_report.py +++ b/scripts/tier2/write_track_completion_report.py @@ -261,7 +261,7 @@ where they also fail. | `git reset*` ban | HELD (never invoked) | | Filesystem boundary (Tier 2 clone only; AppData denied) | HELD | | Per-task commits | HELD (24 atomic commits, each with a clear single concern) | -| Failcount monitored | HELD (state persisted to `scripts/tier2/state/send_result_to_send_20260616/state.json`) | +| Failcount monitored | HELD (state persisted to `tests/artifacts/tier2_state/send_result_to_send_20260616/state.json`) | | Report writer on standby | HELD (not triggered; track completed on success path) | ## User handoff From e1e1a6609e2d313c022330b9ff9e34f761961dc1 Mon Sep 17 00:00:00 2001 From: Ed_ Date: Thu, 18 Jun 2026 18:28:37 -0400 Subject: [PATCH 5/7] test(tier2): slash_command_spec - assert project-relative paths Updated two test assertions to match Tier 2's project-relative relocation (commit 923d360d): - test_command_prompt_no_appdata: 'scripts/tier2/state' -> 'tests/artifacts/tier2_state' (and same for failures) - test_agent_denies_temp_writes: same swap The tests now assert the slash command and agent prompts reference the actual code defaults (tests/artifacts/tier2_state/ and tests/artifacts/tier2_failures/) rather than the stale scripts/tier2/ paths. Refs: conductor/tracks/tier2_no_appdata_20260618 (post-merge followup) --- tests/test_tier2_slash_command_spec.py | 27 +++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/tests/test_tier2_slash_command_spec.py b/tests/test_tier2_slash_command_spec.py index 81d5ba72..555984df 100644 --- a/tests/test_tier2_slash_command_spec.py +++ b/tests/test_tier2_slash_command_spec.py @@ -17,13 +17,16 @@ def test_command_file_exists() -> None: def test_command_prompt_no_appdata() -> None: - """Regression test (2026-06-18): the slash command prompt must NOT - reference AppData paths. The user directed 'NEVER USE APPDATA'. - Default locations for state and failure reports must be inside the - Tier 2 clone (scripts/tier2/state/, scripts/tier2/failures/).""" + """Regression test (2026-06-18, updated 2026-06-18 after Tier 2's + project-relative relocation): the slash command prompt must NOT + reference AppData paths and must point at the actual code defaults. + + The user directed 'NEVER USE APPDATA'. The Tier 2 failcount state + and failure reports live at tests/artifacts/tier2_state/ and + tests/artifacts/tier2_failures/ (project-relative; inside the + already-gitignored tests/artifacts/).""" content = COMMAND_PATH.read_text(encoding="utf-8") - assert "scripts/tier2/state" in content, "command prompt must point at scripts/tier2/state// for failcount state" - assert "scripts/tier2/failures" in content or True, "command prompt mentions scripts/tier2/state (state path); failures dir is implicit" + assert "tests/artifacts/tier2_state" in content, "command prompt must point at tests/artifacts/tier2_state// for failcount state (Tier 2's project-relative default)" assert "" not in content, "command prompt must NOT reference (2026-06-18 NEVER USE APPDATA)" assert "AppData\\Local\\manual_slop\\tier2" not in content, "command prompt must NOT reference the AppData tier2 dir" @@ -92,7 +95,8 @@ def test_agent_denies_destructive_git() -> None: def test_agent_denies_temp_writes() -> None: - """Regression test (2026-06-17, rewritten 2026-06-18): + """Regression test (2026-06-17, rewritten 2026-06-18, paths updated + 2026-06-18 after Tier 2's project-relative relocation): 2026-06-17: the agent wrote an audit JSON to C:\\Users\\Ed\\AppData\\Local\\Temp\\, which is outside the sandbox @@ -105,14 +109,15 @@ def test_agent_denies_temp_writes() -> None: must: - include the broader *AppData\\* bash deny rule (catches Local, LocalLow, Roaming, etc., not just Temp) - - point at scripts/tier2/state//state.json for failcount state - - point at scripts/tier2/failures/ for failure reports + - point at tests/artifacts/tier2_state//state.json for + failcount state (Tier 2's project-relative default) + - point at tests/artifacts/tier2_failures/ for failure reports - NOT reference AppData\\Local\\manual_slop\\tier2 (the old path)""" content = AGENT_PATH.read_text(encoding="utf-8") assert 'AppData\\Local\\Temp' in content, "agent prompt must include Temp deny rule in frontmatter bash (kept for self-documentation)" assert "*AppData\\\\*" in content, "agent prompt must include the broader *AppData\\* deny rule (added 2026-06-18)" - assert "scripts/tier2/state" in content, "agent prompt must point agent at scripts/tier2/state// for failcount state" - assert "scripts/tier2/failures" in content, "agent prompt must point agent at scripts/tier2/failures/ for failure reports" + assert "tests/artifacts/tier2_state" in content, "agent prompt must point agent at tests/artifacts/tier2_state// for failcount state (Tier 2's project-relative default)" + assert "tests/artifacts/tier2_failures" in content, "agent prompt must point agent at tests/artifacts/tier2_failures/ for failure reports" assert "AppData\\Local\\manual_slop\\tier2" not in content, "agent prompt must NOT reference the AppData tier2 dir (2026-06-18 NEVER USE APPDATA)" From e041918c4e594bdbad59f5dac55ae5ade84dfdb5 Mon Sep 17 00:00:00 2001 From: Ed_ Date: Thu, 18 Jun 2026 18:28:56 -0400 Subject: [PATCH 6/7] chore(tier2): drop unused gitignore entries The scripts/tier2/state/ and scripts/tier2/failures/ entries were added when those were the default locations. After Tier 2's project-relative relocation (commit 923d360d), the actual defaults are tests/artifacts/tier2_state/ and tests/artifacts/tier2_failures/, which are already covered by the existing tests/artifacts/ entry. The scripts/tier2/state/ and scripts/tier2/failures/ dirs are no longer created by anything, so the gitignore entries were dead config. Refs: conductor/tracks/tier2_no_appdata_20260618 (post-merge followup) --- .gitignore | 2 -- 1 file changed, 2 deletions(-) diff --git a/.gitignore b/.gitignore index a9e9e658..7bced9d6 100644 --- a/.gitignore +++ b/.gitignore @@ -9,8 +9,6 @@ credentials.toml uv.lock md_gen scripts/generated -scripts/tier2/state/ -scripts/tier2/failures/ logs logs/sessions/ logs/agents/ From 5153f9f738b95edf7a87080750f2ed25ed0d11fb Mon Sep 17 00:00:00 2001 From: Ed_ Date: Thu, 18 Jun 2026 18:30:11 -0400 Subject: [PATCH 7/7] docs(reports): addendum for tier2_no_appdata - post-merge path reconciliation Adds an 'Addendum (2026-06-18, post-merge)' section to docs/reports/TRACK_COMPLETION_tier2_no_appdata_20260618.md that documents the 6-commit reconciliation done after the merge of tier2/live_gui_test_fixes_20260618 brought in commit 923d360d (the project-relative path relocation). The addendum is for the historical record; the code is unchanged. Refs: conductor/tracks/tier2_no_appdata_20260618 (post-merge followup) --- ...CK_COMPLETION_tier2_no_appdata_20260618.md | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/docs/reports/TRACK_COMPLETION_tier2_no_appdata_20260618.md b/docs/reports/TRACK_COMPLETION_tier2_no_appdata_20260618.md index 10b90fac..b90a8b8b 100644 --- a/docs/reports/TRACK_COMPLETION_tier2_no_appdata_20260618.md +++ b/docs/reports/TRACK_COMPLETION_tier2_no_appdata_20260618.md @@ -129,6 +129,31 @@ The next Tier 2 run (any track) will use the new conventions automatically: - The agent prompt and slash command both say "NEVER USE APPDATA". - The OpenCode `*AppData\\*` bash deny rule blocks any AppData command. +## Addendum (2026-06-18, post-merge) + +The merge of `tier2/live_gui_test_fixes_20260618` brought in commit +`923d360d chore(scripts): relocate Tier 2 state paths to project-relative`, +which moved the actual code defaults from `scripts/tier2/state/` to +`tests/artifacts/tier2_state/` (and same for failures) — a more +workspace-paths.md-conformant location. The templates in this track +were not updated to match, so a follow-up reconciliation was needed +before the next Tier 2 run: + +- 6 follow-up commits (a16c9e47..e041918c) updated the agent prompt, + slash command, guide, completion report template, and + slash-command-spec test assertions to reference the actual code + defaults (`tests/artifacts/tier2_state/`, `tests/artifacts/tier2_failures/`). +- The dead `scripts/tier2/state/` and `scripts/tier2/failures/` + .gitignore entries were removed. +- After the user re-bootstraps the Tier 2 clone, the new templates + are in `.opencode/agents/tier2-autonomous.md` and + `.opencode/commands/tier-2-auto-execute.md`. Future Tier 2 runs + will look for state at the correct project-relative path. + +The actual defaults in the code (commit `923d360d`) are unchanged +from this report's "What changed" section — only the prompts/docs +were reconciled. + ## Files NOT modified (per the "edit the source of truth, not the historical record" pattern) - `conductor/tracks/tier2_autonomous_sandbox_20260616/spec.md` and `plan.md` — historical track artifacts. They document the design decision at the time that track shipped. The new track is the current source of truth.