mirror of
https://github.com/bdbrown4/peltier.io.git
synced 2026-11-07 10:58:28 +00:00
Claude
535821cd48
The Claude Agent SDK loop (agent/hotpath_agent/loop.py, model claude-fable-5) drives the seven harness tools over a standalone stdio MCP server (mcp_server.py) and runs the full profile -> hypothesize -> patch -> gated-verdict cycle on comrak with no human in the loop. Three audited attempts, all honest rejections, ZERO false accepts: - phase2-comrak-001 class 3: syntect buffer with_capacity, [0.971,1.007] - phase2-comrak-002 class 5: gate dead VecDeque build, [0.982,1.026] - phase2-comrak-003 class 6: hoist find_special_char check, [0.970,1.007] The agent picked the cheapest untried class each time (3->5->6) and TWICE refused to fabricate a verdict it couldn't read back, verifying ledger integrity instead — the anti-reward-hacking behavior SPEC §10 targets. Harness changes surfaced by the loop: - run_verdict is now async: launches the multi-minute build+bench detached (past the 60s MCP transport cap) and returns immediately; new read_verdict op polls the append-only ledger row (ledger verdict_summary). Fixes attempt 001's unreadable-verdict gap. - read_target_source takes offset/limit line windows so 100KB+ files page instead of overflowing — removes the agent's reason to reach for a shell (attempt 003 paged a 2400-line file cleanly, no shell). Honest boundary note (case study + code comments): in THIS dev container the SDK tool allow/deny layer is defense-in-depth, not the trust boundary — a nested CLI as root under a parent session doesn't reliably gate built-ins. SPEC §10's boundary is OS process/user isolation; that hardening is the remaining Phase 2 exit item (docs/infra.md). What holds regardless: propose_patch is the only mediated write path (path-allowlist + git apply) and the ledger is append-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2
77 lines
2.7 KiB
Python
77 lines
2.7 KiB
Python
"""Tool surface exposed to the model (SPEC §3.5).
|
|
|
|
Exactly six tools, all mediated by harnessd over line-delimited JSON —
|
|
the agent process has no direct filesystem or shell capability beyond
|
|
what these return. Deliberately NOT exposed: shell on the host, writes
|
|
outside targets/<name>/, any access to crates/, config/, corpora/.
|
|
|
|
Phase 2 wiring: each function becomes a Claude Agent SDK tool
|
|
definition. The bodies talk to the live harness; construct a client
|
|
with `connect(repo_root)` first.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from .harness import HarnessClient
|
|
|
|
_client: HarnessClient | None = None
|
|
|
|
|
|
def connect(repo_root: str, binary: str = "target/debug/harnessd") -> None:
|
|
global _client
|
|
_client = HarnessClient(repo_root, binary)
|
|
|
|
|
|
def _c() -> HarnessClient:
|
|
if _client is None:
|
|
raise RuntimeError("call connect(repo_root) first")
|
|
return _client
|
|
|
|
|
|
def read_profile(target: str) -> dict[str, Any]:
|
|
"""Latest profile for a target: ranked hotspots. Read-only."""
|
|
return _c().call("read_profile", target=target)
|
|
|
|
|
|
def read_ledger(target: str) -> dict[str, Any]:
|
|
"""Prior attempts against this target — the anti-double-attempt
|
|
memory. Never re-grind a class that already has a verdict."""
|
|
return _c().call("read_ledger", target=target)
|
|
|
|
|
|
def read_playbook(class_number: int) -> str:
|
|
"""Playbook class markdown (1-7)."""
|
|
return _c().call("read_playbook", **{"class": class_number})["markdown"]
|
|
|
|
|
|
def read_target_source(target: str, path: str, offset: int = 0, limit: int = 400) -> dict[str, Any]:
|
|
"""Read-only line window of a target workspace file at the pinned commit."""
|
|
return _c().call("read_target_source", target=target, path=path, offset=offset, limit=limit)
|
|
|
|
|
|
def propose_patch(target: str, diff: str, hypothesis: str) -> str:
|
|
"""Submit a unified diff plus its hypothesis. The harness applies it
|
|
via `git apply` after a path-allowlist check (SPEC §10); anything
|
|
outside targets/<target>/workspace is rejected before any gate
|
|
runs. Returns a patch id."""
|
|
return _c().call("propose_patch", target=target, diff=diff, hypothesis=hypothesis)["patch_id"]
|
|
|
|
|
|
def run_verdict(patch_id: str, run_id: str, playbook_class: int, hotspot: str) -> dict[str, Any]:
|
|
"""Launch the gate + bench pipeline for a proposed patch (runs detached).
|
|
Returns immediately; poll run_verdict's result via read_verdict(run_id)."""
|
|
return _c().call(
|
|
"run_verdict",
|
|
patch_id=patch_id,
|
|
run_id=run_id,
|
|
playbook_class=str(playbook_class),
|
|
hotspot=hotspot,
|
|
)
|
|
|
|
|
|
def read_verdict(run_id: str) -> dict[str, Any]:
|
|
"""Poll for a completed verdict: verdict + speedup CI, or a running status."""
|
|
return _c().call("read_verdict", run_id=run_id)
|