Skip to content

Commit 06a7e92

Browse files
chubes4chubes4
authored
Advance Docs Agent to WP Codebox v0.12.29 (#165)
1 parent 972ceb8 commit 06a7e92

7 files changed

Lines changed: 20 additions & 18 deletions

‎.github/workflows/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ The reusable workflow declares the expected typed review artifacts for Docs Agen
1616

1717
The target repository grants `contents: write`, `pull-requests: write`, and `issues: write`. Docs Agent forwards the caller-scoped `${{ github.token }}` to WP Codebox for same-repository publication, so consumers do not configure `ACCESS_TOKEN`. `OPENAI_API_KEY` is an optional workflow secret and is required only for a live OpenAI run; skipped and dry-run calls do not require it. `EXTERNAL_PACKAGE_SOURCE_POLICY` remains a separate required v1 JSON secret. Migrate its value to the exact one-line JSON in the root README: it authorizes the selected Docs Agent package, the pinned Agents API component, the pinned PHP AI Client overlay, and the checksum-pinned OpenAI provider artifact. Both secrets are forwarded to WP Codebox without serialization into the task descriptor.
1818

19-
Docs Agent consumes the released [WP Codebox v0.12.28](https://github.com/Automattic/wp-codebox/releases/tag/v0.12.28) workflow and passes the matching `wp_codebox_release_ref: v0.12.28` input. The release tag resolves to immutable revision `6457dcae4cb8cf8e76cd174377de8cbee3ee12cb`, which is distinct from the fixed Docs Agent package revision. WP Codebox validates the paired tags, materializes the declared native runtime closure, executes the selected package, applies bounded workspace changes, runs verification, and publishes approved host changes. Its published assets are `01-wp-codebox.zip` and `02-wp-codebox-workspace-0.12.28.tgz`; the private package-recovery manifest is intentionally not a reviewer asset.
19+
Docs Agent consumes the released [WP Codebox v0.12.29](https://github.com/Automattic/wp-codebox/releases/tag/v0.12.29) workflow and passes the matching `wp_codebox_release_ref: v0.12.29` input. The release tag resolves to immutable revision `bc982947ec33c78160125026e16d357b7ece3ea1`, which is distinct from the fixed Docs Agent package revision. WP Codebox validates the paired tags, materializes the declared native runtime closure, executes the selected package, applies bounded workspace changes, runs verification, and publishes approved host changes. Its published assets are `01-wp-codebox.zip` and `02-wp-codebox-workspace-0.12.29.tgz`; the private package-recovery manifest is intentionally not a reviewer asset.
2020

2121
Provider artifacts retain only allowlisted review artifacts, controlled workflow envelopes, and canonical runtime-source and seed provenance. WP Codebox v0.12.24 uploads a reviewer-safe workflow-result projection: public control, verification, publication, output-projection, access, failure, artifact-declaration, and canonical transcript-provenance fields remain, while raw `runtime_result`, `outputs.engine_data`, model/provider/tool payloads, source content, private paths, and secrets are excluded. Before persistence or upload, it sanitizes private runtime paths from nested values, object keys, diagnostics, and command arguments. WP Codebox captures one trusted canonical `codebox-transcript` through a pre-sanitization reviewer-evidence descriptor, validates its artifact-root containment, schema, digest, and size, then emits the compact reviewer transcript as a `wp-codebox/reviewer-agent-transcript/v1` projection. Before apply-back, it compares the seed identity with the host workspace identity; rejected patches preserve the expected and actual identities plus patch and changed-file evidence for upload. Its pre-redaction trusted apply input preserves machine-applicable patch bytes in a private channel that is removed before durable artifact sanitization, as fixed in [WP Codebox #1842](https://github.com/Automattic/wp-codebox/pull/1842). The canonical transcript remains the bounded tool-observability surface. Lifecycle and downstream failures retain runtime evidence in their internal normalized failed result even when artifact preparation cannot complete. Diagnostic messages that name runtime classes remain reviewable, while PHP-shaped runtime source remains blocked. See [WP Codebox #1767](https://github.com/Automattic/wp-codebox/issues/1767), [WP Codebox #1814](https://github.com/Automattic/wp-codebox/issues/1814), [WP Codebox #1815](https://github.com/Automattic/wp-codebox/pull/1815), and [WP Codebox #1823](https://github.com/Automattic/wp-codebox/pull/1823). Successful canonical reviewer-evidence reference: [run `29350690551`](https://github.com/Automattic/build-with-wordpress/actions/runs/29350690551). The [hosted failure `29468956857`](https://github.com/Automattic/agents-api/actions/runs/29468956857) executed WP Codebox v0.12.20, published [Agents API #430](https://github.com/Automattic/agents-api/pull/430), then failed during upload preparation; it motivated #1814/#1815 and is not a successful v0.12.24 reviewer-safe workflow-result run.
2222

@@ -28,6 +28,8 @@ WP Codebox v0.12.27 reports bounded added, modified, and deleted paths when post
2828

2929
WP Codebox v0.12.28 validates canonical GitHub repository identity case-insensitively while preserving strict pull-request URL, pull number, target binding, and API resolution checks; see [WP Codebox #1875](https://github.com/Automattic/wp-codebox/pull/1875).
3030

31+
WP Codebox v0.12.29 returns `{ valid: true }` without a failure-only `error` when canonical pull-request verification succeeds, while repository mismatches retain their exact diagnostic; see [WP Codebox #1885](https://github.com/Automattic/wp-codebox/pull/1885).
32+
3133
## Docs Agent Runner Recipe
3234

3335
Docs Agent workflow call sites prepare a portable recipe instead of calling a concrete runner. Docs Agent owns the native package, lane, artifact, prompt, and workspace mapping. Consumers depend on Docs Agent inputs and review artifacts, not runner internals.

‎.github/workflows/maintain-docs.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -259,9 +259,9 @@ jobs:
259259
contents: write
260260
pull-requests: write
261261
issues: write
262-
uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@v0.12.28
262+
uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@v0.12.29
263263
with:
264-
wp_codebox_release_ref: v0.12.28
264+
wp_codebox_release_ref: v0.12.29
265265
external_package_source: ${{ needs.prepare.outputs.external_package_source }}
266266
runtime_sources: ${{ needs.prepare.outputs.runtime_sources }}
267267
workload_id: docs-agent-${{ inputs.audience }}-${{ inputs.run_kind }}

‎.github/workflows/validate.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
uses: actions/checkout@v4
1818
with:
1919
repository: Automattic/wp-codebox
20-
ref: v0.12.28
20+
ref: v0.12.29
2121
path: .wp-codebox
2222
- name: Validate Docs Agent
2323
env:

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ Docs Agent declares the review artifacts it expects the runner to materialize as
112112

113113
`maintain-docs.yml` writes `expected_artifacts` and `artifact_declarations` into a portable Docs Agent recipe and exposes the same declaration objects as `declared_artifacts_json`.
114114

115-
WP Codebox v0.12.28 at `6457dcae4cb8cf8e76cd174377de8cbee3ee12cb` uploads a reviewer-safe workflow-result projection with public control and publication fields plus canonical transcript provenance. This released workflow revision remains distinct from the fixed Docs Agent package revision. It excludes raw `runtime_result`, `outputs.engine_data`, model/provider/tool payloads, source content, private paths, secrets, Git-ignored verification artifacts such as pnpm's symlinked `node_modules` tree, and mutable `.codebox` runtime control files. Tracked or otherwise publishable symlinks remain rejected. Integrity failures retain bounded added, modified, and deleted path evidence, and non-Git workspaces retain a bounded filesystem snapshot fallback. Canonical GitHub repository identity is compared case-insensitively while pull-request URL syntax, pull number, target binding, and API resolution remain strict. The canonical `codebox-transcript` remains the bounded tool-observability surface: its pre-sanitization reviewer-evidence descriptor records the trusted artifact-relative path, schema, verified source digest, and size, which the uploader revalidates before producing the `wp-codebox/reviewer-agent-transcript/v1` projection. Before apply-back, it validates that the runner seed and host workspace identities match; rejected patches retain identity, patch, and changed-file evidence for review. The pre-redaction trusted apply input fixed by [WP Codebox #1842](https://github.com/Automattic/wp-codebox/pull/1842) retains machine-applicable patch bytes privately, then removes them before durable artifact sanitization. The publication snapshot fixes are tracked in [WP Codebox #1845](https://github.com/Automattic/wp-codebox/pull/1845), [WP Codebox #1848](https://github.com/Automattic/wp-codebox/pull/1848), [WP Codebox #1852](https://github.com/Automattic/wp-codebox/pull/1852), and [WP Codebox #1875](https://github.com/Automattic/wp-codebox/pull/1875). The published release assets are `01-wp-codebox.zip` and `02-wp-codebox-workspace-0.12.28.tgz`; its private package-recovery manifest is intentionally not a reviewer asset.
115+
WP Codebox v0.12.29 at `bc982947ec33c78160125026e16d357b7ece3ea1` uploads a reviewer-safe workflow-result projection with public control and publication fields plus canonical transcript provenance. This released workflow revision remains distinct from the fixed Docs Agent package revision. It excludes raw `runtime_result`, `outputs.engine_data`, model/provider/tool payloads, source content, private paths, secrets, Git-ignored verification artifacts such as pnpm's symlinked `node_modules` tree, and mutable `.codebox` runtime control files. Tracked or otherwise publishable symlinks remain rejected. Integrity failures retain bounded added, modified, and deleted path evidence, and non-Git workspaces retain a bounded filesystem snapshot fallback. Canonical GitHub repository identity is compared case-insensitively while pull-request URL syntax, pull number, target binding, and API resolution remain strict. Successful publication verification returns `{ valid: true }` without a failure-only `error`, while repository mismatches retain their exact diagnostic as fixed by [WP Codebox #1885](https://github.com/Automattic/wp-codebox/pull/1885). The canonical `codebox-transcript` remains the bounded tool-observability surface: its pre-sanitization reviewer-evidence descriptor records the trusted artifact-relative path, schema, verified source digest, and size, which the uploader revalidates before producing the `wp-codebox/reviewer-agent-transcript/v1` projection. Before apply-back, it validates that the runner seed and host workspace identities match; rejected patches retain identity, patch, and changed-file evidence for review. The pre-redaction trusted apply input fixed by [WP Codebox #1842](https://github.com/Automattic/wp-codebox/pull/1842) retains machine-applicable patch bytes privately, then removes them before durable artifact sanitization. The publication snapshot fixes are tracked in [WP Codebox #1845](https://github.com/Automattic/wp-codebox/pull/1845), [WP Codebox #1848](https://github.com/Automattic/wp-codebox/pull/1848), [WP Codebox #1852](https://github.com/Automattic/wp-codebox/pull/1852), [WP Codebox #1875](https://github.com/Automattic/wp-codebox/pull/1875), and [WP Codebox #1885](https://github.com/Automattic/wp-codebox/pull/1885). The published release assets are `01-wp-codebox.zip` and `02-wp-codebox-workspace-0.12.29.tgz`; its private package-recovery manifest is intentionally not a reviewer asset.
116116

117117
Docs Agent owns native package selection, lane, artifact, prompt, and workspace mapping. Execution, credentials, AI provider selection, sandboxing, and publication are runner-owned concerns outside this repository.
118118

‎tests/validate-docs-agent-packages.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,9 @@
7070
$assert( str_contains( $maintain_docs_workflow, 'artifact_declarations<<EOF' ), 'maintain-docs.yml must prepare typed artifact declarations without caller-specific projections.' );
7171
$assert( str_contains( $maintain_docs_workflow, 'artifact_declarations<<EOF' ), 'maintain-docs.yml must expose artifact declarations through workflow outputs.' );
7272

73-
$generic_codebox_agent_task_workflow = 'uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@v0.12.28';
73+
$generic_codebox_agent_task_workflow = 'uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@v0.12.29';
7474
$assert( str_contains( $maintain_docs_workflow, $generic_codebox_agent_task_workflow ), 'maintain-docs.yml must call the generic Codebox agent-task workflow.' );
75-
$assert( str_contains( $maintain_docs_workflow, 'wp_codebox_release_ref: v0.12.28' ), 'maintain-docs.yml must pass the matching WP Codebox release tag.' );
75+
$assert( str_contains( $maintain_docs_workflow, 'wp_codebox_release_ref: v0.12.29' ), 'maintain-docs.yml must pass the matching WP Codebox release tag.' );
7676

7777
$assert( str_contains( $maintain_docs_workflow, '--arg writablePaths "$INPUT_WRITABLE_PATHS"' ), 'maintain-docs.yml must include writable paths in the portable recipe.' );
7878
$assert( str_contains( $maintain_docs_workflow, 'output_projections:' ), 'maintain-docs.yml must project the bounded runner publication result.' );
@@ -85,7 +85,7 @@
8585
foreach ( array( 'Docs Agent Runner Recipe', 'portable recipe', 'Docs Agent owns the native package' ) as $migration_note_text ) {
8686
$assert( str_contains( $workflow_readme, $migration_note_text ), "Workflow README missing agent runtime note: {$migration_note_text}" );
8787
}
88-
$assert( str_contains( $workflow_readme, 'v0.12.28' ), 'Workflow README must record the WP Codebox release tag.' );
88+
$assert( str_contains( $workflow_readme, 'v0.12.29' ), 'Workflow README must record the WP Codebox release tag.' );
8989
$assert( str_contains( $workflow_readme, 'Diagnostic messages that name runtime classes remain reviewable' ), 'Workflow README must document diagnostic-versus-source detection.' );
9090
$assert( str_contains( $workflow_readme, 'allowlisted review artifacts' ), 'Workflow README must document the WP Codebox upload allowlist.' );
9191
$assert( str_contains( $workflow_readme, 'normalized failed result' ), 'Workflow README must document normalized WP Codebox failures.' );

‎tests/validate-wp-codebox-run-agent-task-contract.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,9 @@
5656
$published_assets = $release['published_assets'] ?? null;
5757
$assert( is_array( $published_assets ), 'WP Codebox release fixture must record published release assets.' );
5858
$assert( array(
59-
'01-wp-codebox.zip' => 'sha256:9a77c7f0117c29cf1c0a98859608013a70afada8a1314c278e0d5e25eb7a00e8',
60-
'02-wp-codebox-workspace-0.12.28.tgz' => 'sha256:98117c40bb42b3d6790af38a2104259b12a6ca820f21df881024c7711bf9569e',
61-
) === $published_assets, 'WP Codebox release fixture must retain the published v0.12.28 asset digests.' );
59+
'01-wp-codebox.zip' => 'sha256:a239c72ae79c5b24fe7bed9ccfd375c0b70892ca66406d98140a51d219cfaaee',
60+
'02-wp-codebox-workspace-0.12.29.tgz' => 'sha256:d332924b3b91ef8e47b5ebca7063b2964734d3ac081dd62fa18ec9417fefdcd5',
61+
) === $published_assets, 'WP Codebox release fixture must retain the published v0.12.29 asset digests.' );
6262
$run = $release['run'] ?? null;
6363
$assert( is_string( $run ) && preg_match( '/^\d+$/', $run ) === 1, 'WP Codebox release fixture must retain the regression run reference.' );
6464
$diagnostic_regression_run = $release['diagnostic_regression_run'] ?? null;
@@ -308,7 +308,7 @@
308308
$assert( in_array( '.codebox/agent-task-request.json', $producer_upload_regression['observed']['uploaded'] ?? array(), true ), 'WP Codebox upload regression fixture must retain the controlled request upload.' );
309309
$assert( ! array_intersect( array( 'MODEL_PROVIDER_SECRET_1', 'MODEL_PROVIDER_SECRET_2', 'MODEL_PROVIDER_SECRET_3', 'MODEL_PROVIDER_SECRET_4', 'MODEL_PROVIDER_SECRET_5' ), array_keys( $caller_secrets ) ), 'Docs Agent must forward only the OPENAI_API_KEY provider secret name.' );
310310

311-
$assert( str_contains( $workflow, 'output_projections="$(jq -cn --arg path \'metadata.runner_workspace_publication.pull_request.url\' --argjson required "$success_requires_pr" \'{docs_agent_publication:{path:$path,required:$required}}\')"' ), 'Docs Agent must define the v0.12.28 publication projection descriptor.' );
311+
$assert( str_contains( $workflow, 'output_projections="$(jq -cn --arg path \'metadata.runner_workspace_publication.pull_request.url\' --argjson required "$success_requires_pr" \'{docs_agent_publication:{path:$path,required:$required}}\')"' ), 'Docs Agent must define the v0.12.29 publication projection descriptor.' );
312312
$docs_projections = array(
313313
'docs_agent_publication' => array(
314314
'path' => 'metadata.runner_workspace_publication.pull_request.url',
@@ -318,7 +318,7 @@
318318
$publication_descriptor = $docs_projections['docs_agent_publication'] ?? null;
319319
$assert( is_array( $publication_descriptor ), 'Docs Agent must define the docs_agent_publication projection descriptor.' );
320320
$publication_path = $publication_descriptor['path'] ?? null;
321-
$assert( 'metadata.runner_workspace_publication.pull_request.url' === $publication_path, 'Docs Agent publication projection must use the v0.12.28 runner workspace publication pull request URL path.' );
321+
$assert( 'metadata.runner_workspace_publication.pull_request.url' === $publication_path, 'Docs Agent publication projection must use the v0.12.29 runner workspace publication pull request URL path.' );
322322

323323
$assert( 'string' === ( $contract['inputs']['output_projections']['type'] ?? null ), 'WP Codebox must accept Docs Agent custom output projections.' );
324324

‎tests/wp-codebox-release.fixture.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
{
2-
"tag": "v0.12.28",
3-
"revision": "6457dcae4cb8cf8e76cd174377de8cbee3ee12cb",
4-
"package_version": "0.12.28",
2+
"tag": "v0.12.29",
3+
"revision": "bc982947ec33c78160125026e16d357b7ece3ea1",
4+
"package_version": "0.12.29",
55
"published_assets": {
6-
"01-wp-codebox.zip": "sha256:9a77c7f0117c29cf1c0a98859608013a70afada8a1314c278e0d5e25eb7a00e8",
7-
"02-wp-codebox-workspace-0.12.28.tgz": "sha256:98117c40bb42b3d6790af38a2104259b12a6ca820f21df881024c7711bf9569e"
6+
"01-wp-codebox.zip": "sha256:a239c72ae79c5b24fe7bed9ccfd375c0b70892ca66406d98140a51d219cfaaee",
7+
"02-wp-codebox-workspace-0.12.29.tgz": "sha256:d332924b3b91ef8e47b5ebca7063b2964734d3ac081dd62fa18ec9417fefdcd5"
88
},
99
"run": "29350690551",
1010
"diagnostic_regression_run": "29307978522",

0 commit comments

Comments
 (0)