fix(stella-pipeline): bound the oracle trace at the verifier-prompt ingress (#1787) - #2002
Merged
Merged
Conversation
…an uncovered ModelCallRole main was red at 43402ae: stella-pipeline's lib test build failed with three compile errors, so every PR against it inherits a red gate. Two independent parallel-merge collisions, neither visible to the CI of the PR that caused it: 1. #1951 rewrote tests/verification_hardening.rs from a pre-#1945 base, deleting the PassingShell double, shell_call_result, and the configured-command witness, while leaving the 'mod flip_halt_arming;' #1945 had added — so the child module referenced two symbols that no longer existed. Restored into flip_halt_arming.rs itself rather than the parent: verification_hardening.rs is 1434 lines against a 1500 ceiling and cannot hold them, and the child is their only user. Both #1793 witnesses now sit in one module. 2. #1778 added ModelCallRole::Research; management_prompt/tests.rs holds a deliberately exhaustive match over the enum, which #1778's own CI never compiled against. Research runs as an engine sub-agent turn, so its system prompt rides its SubAgentSpec and it joins the never-dispatched-through-the-chokepoint arm — the same grouping, with the same reasoning, that raw_usage.rs already gives it. Added to ALL_ROLES too, since that array is 'every role the crate can dispatch'. No behavior change: test-only code plus one test-only match arm.
… the research stage Third break on main from the same round of parallel merges: #1778 added 'research: &[ResearchFinding]' to plan_stage, taking it to 8 arguments against clippy's limit of 7. The gate runs clippy at -D warnings, so stella-pipeline could not pass it. Fixed structurally, not with an #[allow]: budget and total are exactly the pair the crate's own Spend envelope bundles (stage_budget.rs), and they travel together everywhere else — verifier() already took this shape in #1951. plan_stage takes Spend, plan_with_review builds one before its re-plan loop and reborrows it per iteration, and neither uses the two for anything else. 8 arguments become 7 and the meaning is unchanged. No behavior change.
…ngress The trusted evidence summary rode into the verdict prompt with no length bound on its one growing channel: oracle_trace gains an observation per verification round, and the repair gate can keep granting rounds as long as a measured budget affords them — the diff has a token budget, the trusted zone had none (#1787's folded-in item). Bounded where the prompt value is constructed (the #1932 rule), to the newest 24 observations with the drop stated in-band, so a verifier reads 'earlier observations exist' rather than a trace that silently starts mid-run. The stored ladder snapshot keeps the full trace; provenance rendering is deliberately untouched. Refs #1787
…-bound # Conflicts: # crates/stella-pipeline/src/management_prompt/tests.rs # crates/stella-pipeline/src/pipeline/scope_stage.rs # crates/stella-pipeline/src/pipeline/tests/verification_hardening/flip_halt_arming.rs
…es this branch does not own The merge of main into this branch collided on three files that the closed base branch (unbreak-main-pipeline, PR #1975) had fixed independently of the unbreaks that actually landed (#1970, #1971). Git's auto-merge concatenated both sides, leaving duplicate PassingShell / shell_call_result definitions and a duplicate ModelCallRole::Research match arm — neither of which compiles. This branch owns only pipeline/evidence.rs (#1787's oracle-trace bound), so the other files take main's shipped, reviewed copies verbatim. The branch is now exactly main plus evidence.rs.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Sorry @macanderson, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Reviewer's GuideBounds the oracle trace rendered in verifier prompts, adds a helper to cap the number of observations shown while preserving the full stored trace, and introduces tests that ensure pathological traces are clipped with an in-band omission notice while normal traces remain unchanged. File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this PR exists
#1787's fix is not in
main. PR #1982 carried it, but its base was the topic branchunbreak-main-pipeline, whose own PR (#1975) was closed, not merged. #1982 then merged into that dead branch, so the oracle-trace bound landed nowheremaincan see, and nothing is carrying that branch forward.It also merged in a broken state. While the base was being reconciled with
main, git's auto-merge of the two independently-written unbreaks concatenated both sides, leaving:struct PassingShellandfn shell_call_resultdefined twiceasync fn a_revision_halts_at_the_step_where_the_tracked_test_flipsdefined twiceModelCallRole::Researchmatch arm (unreachable pattern)None of that compiles.
unbreak-main-pipelinecurrently holds it;mainis unaffected.This PR is the clean landing:
mainplusevidence.rs, and nothing else.What it does (#1787)
Bounds the oracle trace at the verifier-prompt ingress. The trace grows once per verification round and the repair gate can keep granting rounds while a measured budget affords them — so unlike the diff, which rides under a token budget, this channel had no ceiling at all.
MAX_ORACLE_TRACE_OBSERVATIONS = 24— sized far above a normal run (baseline plus a handful of rounds) so the bound only bites a pathological loop.bounded_oracle_tracekeeps the newest observations and states the drop in-band (…N earlier observation(s) omitted → …), so the verifier reads "earlier observations exist" rather than a trace that silently starts mid-run.Witnesses
a_pathological_oracle_trace_is_clipped_with_the_drop_stated— a 100-observation trace renders clipped to the newest 24 with the omission counted in-band.an_ordinary_oracle_trace_renders_unchanged— the bound does not touch a normal run, so this cannot ship as "always clip".Observations alternate pass/fail in the fixture so a clipped render is distinguishable from a repeated one.
Verification
cargo test -p stella-pipeline— 585 pass, 0 fail, including both witnesses abovecargo fmt --check -p stella-pipeline— cleanmainis exactly one file:crates/stella-pipeline/src/pipeline/evidence.rs(+74/−2)CI is red on
main's breaks, not this diffThis branch is merged up to current
main. Every failing step fails in a file this PR does not touch, and each already has a dedicated unbreak in flight:check-file-sizescripts/file-size-baseline.txt(parallel-merge skew)cargo fmt --checkspend/ unusedmutpipeline/scope_stage.rs:34— a dead local#1985left behindCompactionRewritestella-protocolThe clippy one is worth naming precisely, since it is
stella-pipeline:main'sscope_stage.rsbindslet mut spend = Spend { budget, total };and then never uses it — the loop constructs a freshSpendinline per iteration.spendoccurs exactly once in the file. That ismain's dead local, untouched by this PR.No competing unbreak is included here on purpose — six are already open against
main, and duplicating one is howmaingets re-broken.Note on the dead branch
unbreak-main-pipelinestill holds the duplicate-definition breakage and the only copy of #1982's merge. It is not reachable frommainand its PR is closed, so nothing needs to be reverted — but it should not be revived without first takingmain's copies offlip_halt_arming.rs,management_prompt/tests.rsandscope_stage.rs, which is what this PR does. Filed as #2001.Closes #1787