mirror of
https://github.com/bdbrown4/peltier.io.git
synced 2026-11-07 10:58:28 +00:00
Claude
19e83d878a
The agent's only door to the trust layer (SPEC 3.5, 10): harnessd serves read_profile, read_ledger, read_playbook, read_target_source, propose_patch, run_verdict over stdio JSON lines. propose_patch enforces the path allowlist (relative paths only, no parent components, no .git, target name validated) before git apply --check + apply rooted in the target workspace; run_verdict builds the candidate into an isolated dir and hands off to the verdict pipeline (pristine-rebuilt baseline included). Python client (agent/hotpath_agent/harness.py) + tools.py rewired from stubs to live calls. E2E evidence: escape attempts refused (bad target name, ../ paths, trust-layer diff touching config/accept.toml rejected before any apply); benign doc patch applied, candidate built, full verdict ran mechanically end to end -> +8.9% [1.079, 1.104] accepted (ship-tree patches ride along as the candidate), ledger row phase1-ipc-smoke-001. Phase 1 caveat recorded in the daemon header: same-uid filesystem read-only enforcement still needs the separate-user/container setup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2
29 lines
666 B
TOML
29 lines
666 B
TOML
[workspace]
|
|
resolver = "2"
|
|
# Vendored target checkouts are their own workspaces, never part of ours.
|
|
exclude = ["targets"]
|
|
members = [
|
|
"crates/bench-runner",
|
|
"crates/diff-test",
|
|
"crates/ledger",
|
|
"crates/report",
|
|
"crates/verdict",
|
|
"crates/harnessd",
|
|
]
|
|
|
|
[workspace.package]
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
license = "GPL-3.0-or-later"
|
|
repository = "https://github.com/bdbrown4/peltier.io"
|
|
|
|
[workspace.dependencies]
|
|
anyhow = "1"
|
|
clap = { version = "4", features = ["derive"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
sha2 = "0.10"
|
|
thiserror = "2"
|
|
toml = "0.8"
|
|
rusqlite = { version = "0.32", features = ["bundled"] }
|