53e382d8 ai_runs logging, redaction and retention (PR #60)
8f533721 Concurrency guards: single-flight, semaphore and timeouts (PR #61)
Acceptance criteria (feature)
With the Fake provider: valid output passes; invalid-then-valid succeeds via the repair turn; invalid twice returns ErrBadOutput; the output contract is always the last system layer regardless of admin persona text (golden test); context trimming keeps the newest history; dedupe matches "Easy Chicken Tikka Masala" to "chicken tikka masala"; a second concurrent run for the same scope joins the first; every run writes an ai_runs row and no API key or webhook URL ever appears in it.
Guardrails
Business invariants in Go, never trusted from the model; no silent fallback output (D-017); concrete skills live with their product features (10, 13, 14, 17, 18) - this feature ships the framework plus a trivial test skill only.
Feature 09 - AI Harness and Skills Framework. All six tasks done and independently reviewed:
- 38e7bf98 Skill interface and run pipeline with repair retry (PR #53)
- bceca7a8 Layered prompt rendering from embedded templates (PR #55)
- 2f54cec9 Household context builder with token budget (PR #57)
- f046ec6c Name normalization and dedupe (PR #59)
- 53e382d8 ai_runs logging, redaction and retention (PR #60)
- 8f533721 Concurrency guards: single-flight, semaphore and timeouts (PR #61)
## Acceptance criteria (feature)
With the Fake provider: valid output passes; invalid-then-valid succeeds via the repair turn; invalid twice returns ErrBadOutput; the output contract is always the last system layer regardless of admin persona text (golden test); context trimming keeps the newest history; dedupe matches "Easy Chicken Tikka Masala" to "chicken tikka masala"; a second concurrent run for the same scope joins the first; every run writes an ai_runs row and no API key or webhook URL ever appears in it.
## Guardrails
Business invariants in Go, never trusted from the model; no silent fallback output (D-017); concrete skills live with their product features (10, 13, 14, 17, 18) - this feature ships the framework plus a trivial test skill only.
Feature branch head: a8b0c7894fa432997fabd6ba21797d3802df3ada, based on dev 8adbd2d7c2a5763698b18582018aa03c65936587.
- runOnce no longer saves with an unbounded context.WithoutCancel. Work
that ended in time must write its row before the skill deadline; if the
writer is not free by then the run fails with llm.ErrTimeout and its
row records the timeout. A failed run's row is written within
runSaveTimeout (5s); if that write fails too, the run returns both
errors and no row is stored. A stored row's status now always matches
what the caller received. The row ID is fixed per run, so a second
save attempt can never add a second row.
- skill, provider and model are redacted with the same redactor as the
bodies; TestRunRowsHoldNoSecrets seeds the API key and a webhook URL
into the model value.
- guard_test: "row saved late" now expects a provider_error timeout row;
new "writer blocked" case proves Run returns ErrTimeout within the
bound and stores no row.
- Purge doc and ARCHITECTURE: the daily purge is owned by Feature 20's
scheduler, which must call harness.Purge.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run whose work ended after the skill deadline with an error kept its
earlier status, so a slow PostProcess that failed stored a bad_output row
while the caller received a timeout. Any run past the deadline now stores
provider_error, with the error text still wrapping the underlying error.
Adds a test for the late-failure path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Feature 09 - AI Harness and Skills Framework. All six tasks done and independently reviewed:
Acceptance criteria (feature)
With the Fake provider: valid output passes; invalid-then-valid succeeds via the repair turn; invalid twice returns ErrBadOutput; the output contract is always the last system layer regardless of admin persona text (golden test); context trimming keeps the newest history; dedupe matches "Easy Chicken Tikka Masala" to "chicken tikka masala"; a second concurrent run for the same scope joins the first; every run writes an ai_runs row and no API key or webhook URL ever appears in it.
Guardrails
Business invariants in Go, never trusted from the model; no silent fallback output (D-017); concrete skills live with their product features (10, 13, 14, 17, 18) - this feature ships the framework plus a trivial test skill only.
Feature branch head:
a8b0c7894f, based on dev8adbd2d7c2.Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
Independent Codex gpt-6-sol review: APPROVED for this exact commit.