Repository navigation
fix(runtime-artifacts): enforce cross-command artifact closeout - #175
Merged
Merged
Conversation
added 2 commits
November 7, 2026 14:19
Update the global rules to classify artifacts by lifetime and require task closeout for temporary paths. Extend the mechanical gate to cover apply_patch targets, shell redirection, tee, copy/move destinations, and output flags. Remove the redundant English-layer rule copy. Inner mirror: 06be413220dcf4e14f5a951d129536534688c3ec.
Advance the offline package and registry acceptance pins to the companion governance commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The global runtime-artifact rule allowed conflicting readings, and the mechanical gate only understood a small set of Node file-write APIs. It missed the failure mode where an agent creates a script with
apply_patchin/tmpand reuses it from later commands. It also missed shell redirection,tee, copy/move destinations, and--outputarguments.Change
deleted,promoted, orowned_by_live_process.check-runtime-artifact-locationto detect host patch targets, shell redirection,tee,cp,mv,Copy-Item,Move-Item,Out-File, and output flags..agent._sharedand remove the redundant English-layer copy.Companion governance rule: https://github.com/Kucell/cortex-agent-agent/pull/42
Inner mirror:
06be413220dcf4e14f5a951d129536534688c3ec.Validation
node --test tests/distribution/*.test.js: 83 passed, 0 failed.node --test tests/init/init-mode-general.test.js tests/template/*.test.js: 53 passed, 0 failed, 1 expected skip.pnpm check:parity: passed.pnpm check:l1-distribution: passed with 0 violations.pnpm check:runtime-artifact-location: 1,196 files, 0 violations.pnpm check:portable-paths: 0 violations.pnpm check:template-dedup: 0 duplicates.upgrade --dry-run --report json: 0 proposed additions, 0 blockers.Upgrade
Existing projects receive the rule through the shared L1 template and the updated general-mode overlay. The checker remains a framework CI command and now catches the portable source/document patterns that previously bypassed it. Runtime-only host sessions still require the documented closeout inventory when the host has no blocking Stop hook.