Repository navigation
An unreadable profile stops default Factory stages and task children from running calls unchecked - #2325
Merged
Conversation
Factory stage allow bypassed the profile read, and task constructors replaced parent policies with fresh allowances that dropped ProfileReadError. Check the profile before stage allow and retain the existing failed-read signal when building worker, repair and auditor policies. Readable profiles keep their existing allowance behavior. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep filesystem failures distinct from readable parse errors, carry the current failed-read signal through child gates and standalone run workers, and retain terminal config-file refusals in job results. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The daily-limit refusal discarded the config read error before a stage could start. Keep that error in the existing refusal without changing admission or accounting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When a profile's
config.jsoncannot be read, saved approval rules are unknown. Several kinds of work could still run calls those rules might deny:Now each of these needs a person, and with nobody to ask the call is refused with an error naming the file. A refused job keeps that reason, including when the daily-limit check refuses the first turn before any model request.
A readable
config.jsonbehaves as before, and that includes a readable but malformed profile in a default stage. What is counted or charged does not change.Stacked on #2291. This needs the failed-read signal that #2291 brings. It is retargeted to app/v3 after #2291 merges, and it lands only after that.
Limit that remains
With a readable
config.json, a default Factory stage still runs on its own allow posture and does not apply the person's saved rules. This PR does not change that.Evidence
Each fault failed a test first on real mode-000 files, then passed:
TestStageUnreadableProfileRequiresPerson,TestStageProfileReadFailureWinsOverProjectParseError,TestTaskChildrenKeepUnreadableProfileApproval, plus the child, bash-belt and job-reason tests in this diff.Two review rounds reproduced faults against this PR; all are fixed. Whole
cmd/codeafandinternal/sessionadd one new failure,TestL4HostedTakeBackNeverBranchesBookkeepingOnlyTurns/auxiliary_usage, which also fails on runs without this PR. It is unexplained and under separate diagnosis. The full gate runs after retargeting.🤖 Generated with Claude Code