Parfii-bot
e6ed7f8b8e
feat(w9a): bulk-tag 25 primitives with taxonomy facets
...
8 capabilities (output/quality/safety/scope/tools) + 12 manifests +
5 roles. Consistent classification per W9-A rules.
Deprecated-alias stubs (tools::cargo-only-bash, tools::read-only)
skipped — no [gate]/[verify] sections.
facet-query results:
kingdom=capability → 11 hits (was 3)
kingdom=capability gate → 6 hits (was 2)
kingdom=manifest → 12 hits (was 0)
Roles tagged but not reachable by current facet_query (walker scans
_capabilities + _manifests). Forward-compat for walker extension.
cargo test -p kei-atom-discovery: 16/16 preserved.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-23 13:34:16 +08:00
Parfii-bot
329d7e2a4d
feat(agent-substrate/phase-5): migrate 5 kit agents to role+task-spec — substrate v1 FULL
...
Final phase of agent substrate v1. 5 shipped agents now declare role at
manifest level; assembler expands role's capability text fragments into
the generated .md at a new `# AGENT SUBSTRATE — role <name>` section.
Non-migrated agents byte-identical (golden snapshots green).
Migrated agents:
- kei-code-implementer → edit-local (8 caps: no-git-ops + scope/* +
quality/* + safety::no-dep-bump + report-format)
- kei-critic → read-only (tools::read-only + output::report-format +
output::severity-grade)
- kei-architect → read-only
- kei-security-auditor → read-only
- kei-validator → read-only
_assembler/ extensions:
- manifest.rs: substrate_role: Option<String>
- assembler.rs: write_substrate() before blocks (backward-compat; no
role = no substrate section)
- substrate.rs (new, 102 LOC): loads _roles/<name>.toml, iterates
capabilities.required, reads _capabilities/<cat>/<slug>/text.md,
joins with \n\n---\n\n separator
- validator.rs: substrate role existence + cap-text presence check
- tests/substrate_role.rs (4 tests): happy path, unknown role, missing
capability text, byte-parity on non-migrated
- tests/regenerate_migrated.rs (ignored by default): regeneration gate
_templates/task-examples/ — 5 example task.toml per migrated agent
showing orchestrator the valid invocation shape.
docs/AGENT-SUBSTRATE-SCHEMA.md: Phase 5 row ticked ✓ + Migrated agents
subsection listing 5 agents with roles + pointer to examples.
tests/substrate_integration.sh: +8 Phase-5 assertions
- All 5 migrated .md files contain "# AGENT SUBSTRATE — role"
- kei-code-implementer.md contains "MUST NOT invoke git" (policy::no-git-ops)
- Every _templates/task-examples/*.toml parses as valid TOML
- cargo check --workspace still passes post-migration
- kei-agent-runtime compose works on edit-local-forge.toml example
Tests: assembler 40/40 (was 30, +4 substrate_role + +1 ignored regen),
kei-agent-runtime + kei-capability 37/37 preserved.
Deferred: remaining 7 non-core agents (cost-guardian, modal-runner,
fal-ai-runner, infra/ml-implementer, ml-researcher, researcher) migrate
in v0.24 wave.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-23 03:07:18 +08:00
Parfii-bot
f77c1b7fdc
fix(v0.15.1): RED-1 CVE + typed-handoff + schema minItems
...
Security hotfix — v0.15.1 Wave 1 fixes from 4-parallel audit.
RED-1 (CVE): KEI_DISABLED_HOOKS tokenized match — was `*all*`
substring-glob (trivially bypassable via "install", "wall-clock", etc.),
now exact-token split on comma/space. Patched in all 9 hooks:
no-hand-edit-agents, assemble-agents, assemble-validate, tomd-preread,
agent-fork-logger, site-wysiwyd-check, error-spike-detector,
milestone-commit-hook, session-end-dump.
RED-2 (observability): minimal profile whitelist now includes
agent-fork-logger and session-end-dump (ledger + trace paths) so
observability is not silently lost on minimal installs.
HIGH: review.json schema minItems:1 on findings — rejects empty
reviews; new Rust test review_schema_rejects_empty_findings.
HIGH: typed-handoff wire-up — produces_artifact declared at top
level on 5 manifests (kei-security-auditor, kei-validator,
kei-architect, kei-code-implementer, kei-critic); duplicate
per-handoff declarations removed.
MED: kei-artifact validate.rs gains warn_unsupported_keywords —
non-fatal stderr warning when schema uses keywords outside the
hand-rolled 2020-12 subset.
LOW: CI Node matrix dropped 18, now ['20','22'].
Doc drift: skills/hooks-control/SKILL.md reflects tokenized-match
semantics and updated minimal-profile hook list.
Tests: 191 Rust workspace + 30 assembler (both pass). RED-1
reproducer 10/10 (4 former-CVE vectors blocked, 5 legit vectors
accepted, empty passes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 15:08:51 +08:00
Parfii-bot
537589e6a7
feat(primitives): kei-artifact typed handoff pipeline (BMAD-style doc passthrough)
...
- kei-artifact Rust crate (25th): schema registry + artifact store + SHA-256 id + chain walker
- 5 schemas (JSON Schema 2020-12 strict): spec / plan / patch / review / research
- Manifest extension: optional produces_artifact + expects_artifact per handoff (non-breaking)
- Validator extension: KNOWN_ARTIFACT_SCHEMAS whitelist check + 4 new tests
- 3 kei-* manifests updated with typed handoff (architect→code-implementer→critic chain)
- compose-solution phase-5 cross-ref to kei-artifact
Tests: 189 Rust workspace (was 167, +22 artifact tests) + 24 assembler (was 20, +4 validator tests)
2026-04-22 14:10:08 +08:00
Parfii-bot
3039adab3f
refactor(manifests): prefix all 14 kit agents with kei-
...
- Rename _manifests/{architect,code-implementer,cost-guardian,critic,
fal-ai-runner,infra-implementer,ml-implementer,ml-researcher,modal-runner,
patent-compliance,patent-researcher,researcher,security-auditor,validator}.toml
to kei-<name>.toml (git mv — history preserved).
- Update every `name = "..."` field to the new kei- name.
- Update every handoff `target = "..."` cross-reference (62 occurrences across
14 manifests) to point at the kei-prefixed counterpart.
- Update backticked prose cross-refs in role/forbidden_domain/description
strings: `code-implementer` -> `kei-code-implementer`, etc.
- Update SSoT header comments: "SSoT for <name>." -> "SSoT for kei-<name>.".
- Fix 3 bare-word prose refs missed by quoted/backticked patterns:
kei-code-implementer.toml (validator enforces), kei-security-auditor.toml
(description Hands fixes off to ..., forbidden_domain separate critic pass).
Noun-phrase mentions left intact (not agent refs): "senior software
architect", "ruthless code critic", "patent prior-art researcher",
"architectural claim", "critical findings", etc.
Verify:
cd _assembler && cargo build --release
AGENT_ROOT=$(pwd)/.. target/release/assemble --validate
-> 14 OK
Namespace motivation: kit-shipped agents live in a reserved "kei-*"
namespace so downstream installs can drop in custom, same-name agents
without collision (e.g. user's own `validator` or `critic`).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 13:35:03 +08:00
