PYR0D-401: Validation intent: stop workers passing --intent through a shared temp file #46

Merged

john merged 6 commits from fm/fm-nm-intent-file-fix into main 2026-10-19 04:38:30 +00:00

Conversation 0 Commits 6 Files changed 6 +79 -13

john commented 2026-10-14 17:20:31 +00:00

Owner

Copy link

Story: PYR0D-401 - Validation intent: stop workers passing --intent through a shared temp file
Author: airouter-ch/Qwen3.8 via omp

What was wrong. Investigation fm-nm-wrong-intent (report: /home/john/code/firstmate/data/fm-nm-wrong-intent/report.md) traced a forms validation run (FORMS-31) that was validated against Flow PR 153's intent: workers wrote their intent to the host-global /tmp/nm-intent.txt and ran with --intent "$(cat /tmp/nm-intent.txt)"; when one task's write was rejected by the harness, the file still held another task's text, and the run used it. The no-mistakes daemon stored and used exactly what it was given; the defect is the worker-side transport, not the tool.

What changed. The no-mistakes driving contract in bin/fm-dod-lib.sh now:

• carries the intent inline, or through a file named by absolute path inside the task's own data directory (fm_dod_block takes an optional data-dir argument; fm-brief.sh and fm-promote.sh pass it, so normal and promoted briefs agree). No PID suffix, because each agent shell call gets a new PID and a later cat would silently read nothing;
• requires the write and the read-back to happen in one step, with the read-back matching the exact --intent string composed under the existing rules before no-mistakes axi run fires;
• repeats the same rule in fm_brief_intent_overlay, the contract fm-spawn.sh re-renders at every spawn and relaunch, so relaunched and legacy-briefed tasks get the transport rule too;
• removes the file once the run has started.

The transport text lives in one helper (fm_nm_intent_transport_block) shared by the driving block and the overlay; the one-owner rule is preserved.

Follow-up (out of scope here). Defence-in-depth for the no-mistakes tool itself: no-mistakes axi run --intent could warn when the supplied intent names a different repo/branch/PR than the run's own repo+branch. The report's section 6 records the rationale; file with no-mistakes as hardening.

Verification. tests/fm-brief.test.sh (new regression asserts the concrete file name, the one-step read-back, the composed-string target, and the cleanup line), tests/fm-dod-lib.test.sh, tests/fm-task-delivery.test.sh all pass; shellcheck clean; the regression was proven to fail against the pre-fix lib and against a mutation dropping the read-back sentence.

**Story:** PYR0D-401 - Validation intent: stop workers passing --intent through a shared temp file **Author:** airouter-ch/Qwen3.8 via omp **What was wrong.** Investigation fm-nm-wrong-intent (report: /home/john/code/firstmate/data/fm-nm-wrong-intent/report.md) traced a forms validation run (FORMS-31) that was validated against Flow PR 153's intent: workers wrote their intent to the host-global /tmp/nm-intent.txt and ran with --intent "$(cat /tmp/nm-intent.txt)"; when one task's write was rejected by the harness, the file still held another task's text, and the run used it. The no-mistakes daemon stored and used exactly what it was given; the defect is the worker-side transport, not the tool. **What changed.** The no-mistakes driving contract in bin/fm-dod-lib.sh now: - carries the intent inline, or through a file named by absolute path inside the task's own data directory (fm_dod_block takes an optional data-dir argument; fm-brief.sh and fm-promote.sh pass it, so normal and promoted briefs agree). No $$ PID suffix, because each agent shell call gets a new PID and a later cat would silently read nothing; - requires the write and the read-back to happen in one step, with the read-back matching the exact --intent string composed under the existing rules before no-mistakes axi run fires; - repeats the same rule in fm_brief_intent_overlay, the contract fm-spawn.sh re-renders at every spawn and relaunch, so relaunched and legacy-briefed tasks get the transport rule too; - removes the file once the run has started. The transport text lives in one helper (fm_nm_intent_transport_block) shared by the driving block and the overlay; the one-owner rule is preserved. **Follow-up (out of scope here).** Defence-in-depth for the no-mistakes tool itself: no-mistakes axi run --intent could warn when the supplied intent names a different repo/branch/PR than the run's own repo+branch. The report's section 6 records the rationale; file with no-mistakes as hardening. **Verification.** tests/fm-brief.test.sh (new regression asserts the concrete file name, the one-step read-back, the composed-string target, and the cleanup line), tests/fm-dod-lib.test.sh, tests/fm-task-delivery.test.sh all pass; shellcheck clean; the regression was proven to fail against the pre-fix lib and against a mutation dropping the read-back sentence.

john added 4 commits 2026-10-14 17:20:31 +00:00

PYR0D-401: keep the no-mistakes --intent inside a task-unique verified file ... 899a21e9e0

Workers have catted a host-global /tmp/nm-intent.txt into --intent; when a
write was rejected, a later run read another task's intent out of that file
(2026-10-13 forms-vs-flow incident, PYR0D-401). The driving contract now
pins the transport to a file unique to this task inside this task's own
data directory, requires a read-back against the brief's intent before the
run fires, and names the incident as the reason. tests/fm-brief.test.sh
regression fails on both the pre-fix lib and a verify-step drop.

no-mistakes(review): Name the task's intent file by absolute path, no PID suffix 8939ad449f

no-mistakes(review): Add intent transport rule to launch overlay; fix read-back target 10327526b2

no-mistakes(document): Point intent-transport comment at its regression test 2645dd0974

john added 1 commit 2026-10-15 12:45:49 +00:00

Merge remote-tracking branch 'origin/main' into fm/fm-nm-intent-file-fix 1c812aefe9

john added 1 commit 2026-10-17 09:39:17 +00:00

ci: re-trigger after 2026-10-15 hosted-runner cancellation 8751e3f2bd

john merged commit 885069dad7 into main 2026-10-19 04:38:30 +00:00

john referenced this pull request from a commit 2026-10-19 04:38:31 +00:00

PYR0D-401: Validation intent: stop workers passing --intent through a shared temp file (#46)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

john/firstmate!46

No description provided.