feat: pin-to-contract from the per-call view — the console closes the loop#44
Merged
Conversation
… loop (Wave A PR-3) R9: POST /calls/<id>/pin, serve's first and only write route. Delegates to the existing fleet machinery (ingest_recording -> discover -> contract_from_candidate): human label + sealed .hotato bundle + registry registration in one atomic step; refusals mirror the CLI (4xx with reason, no artifact) for NOT_SCORABLE/ERROR calls, bad candidate refs, stale evidence_sha256 bindings, changed recordings (re-scan must reproduce the onset), and trust-preflight refusals. Auth = the same bearer/cookie check as every view; CSRF fence = SameSite=Strict cookie + same-origin Origin/Referer check on cookie-authenticated POSTs (bearer needs none); every attempt lands one append-only audit line. Per-call pin forms are plain HTML POST (work without JS; fetch enhancement shows results inline); the /calls feed header shows 'N contracts protecting this agent' counted from the fleet registry's contracts table. R10: 'Production health' -> 'Suite health' everywhere it surfaces (title, heading, nav, docs, JSON view id suite_health); /health + /production routes unchanged. Nav reads Calls · Suite health · Failure clusters · Failure records · Release readiness; scenario matrix becomes a Release readiness drill-in. R11: a finalized (COMPLETE/DEGRADED) session's per-call view surfaces the exact 'hotato production export-regression' command for that session. Docs (WORKSPACE/SELF-HOST/THREAT-MODEL/llms) updated + llms-full rebuilt; CHANGELOG additive; 14 new tests in tests/test_serve_pin.py.
The fleet API reconciles a re-pin of the same candidate by reusing its sealed bundle; pin.py echoed the REQUESTED decision, so a re-pin with a different decision returned 200 confirming a write that never happened. Read back the sealed decision and refuse the mismatch loudly. Found by the fresh adversarial verifier beyond the shipped test coverage. Claude-Session: https://claude.ai/code/session_015njkxtoAKioqTPT2k14xFr
hotato turn-taking eval8 of 8 scenarios pass. 0 fail. No regression.
RegressionsNone. Reproducible timing measured locally from call audio. Swap the bundled self-test step for your own captured recordings to gate on your agent. github.com/attenlabs/hotato |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave A PR-3, completing the console program: every scored candidate moment in the per-call view can mint the portable regression contract.
POST /calls/<subject>/pin— serve's one write action, delegating to the existing fleet machinery (ingest → discover → contract_from_candidate); no contract-minting logic lives in the server. Trust preflight, mint refusals, and registry writes keep their CLI semantics: any refusal is a 4xx with reason and never a partial artifact.Independently verified by a fresh reviewer with its own fixtures and a live curl-driven server: happy path re-verified through
contract verify(signed, PASS), unauthenticated/CSRF-forged/injected/oversized requests all refused with zero artifacts (dir snapshots), duplicate-pin idempotency, audit entries for both outcomes, loopback + read-only GETs unchanged, full suite green except the two known machine-environmental failures. The verifier's one adversarial find (changed-decision re-pin returned a false confirmation) is fixed in the second commit with its regression test.Spec: hotato-growth/research/CONSOLE-WAVE-A-SPEC.md (R9–R11)
https://claude.ai/code/session_015njkxtoAKioqTPT2k14xFr