feat: CORE-SUPER-UPDATE — OSS harvest (Waves 0–F required scope) - #801
Merged
Conversation
Introduce .grok/ integration with token-efficient agent profiles, slash skills, roles, personas, and compact rules. Add regenerable sync script (npm run sync:skills:grok) so Grok stays aligned with .source agents under .aiox-core/development/agents/.
Clarify the generator module purpose so entity-registry extraction no longer picks an unrelated CodeRabbit comment string.
Make Claude subagent governance validate the core aiox-* set instead of exact directory equality, and guard dev-context-loader cacheHits when status/shape is incomplete.
CI Install Manifest Validation failed because data/entity-registry.yaml hash no longer matched install-manifest.yaml after IDS updates.
Escape YAML/TOML scalars, constrain generated write paths under .grok/, block git push for squad-creator, label markdown fences, and keep the cacheHits > 0 assertion in dev-context-loader.
Keep install-manifest hash aligned with entity-registry so CI Install Manifest Validation stays green.
Branch off PR #800 (Grok). Captures P0–P2 waves for SDC skills, runtime hygiene, orchestration merge, IDE parity, and selective constitution updates without importing Sinkra product or enterprise IP. Note: docs/stories is gitignored; force-add for this framework epic only.
MVP cut (A+B), hard A3 merge gates, B0 lean spike, denylist CI story, deferred D5/E4/F3, semver ship train, tightened A1 ACs. Full finding resolution table embedded in epic (100% resolved).
…first) Address architect-first findings: public versionable path (no force-add gitignored docs/stories), drop stale stories index, ARCH-A slice, A2 as #797 residual investigation (unref already present), permissions metric clarified (extend not replace), Wave B–E blocked until per-wave ARCH, hard ban on workspace/ in OSS, hub XI/XII numbering locked for constitution.
…s/docs Engine already resolves AIOX_SYNAPSE_PIPELINE_TIMEOUT_MS > core-config synapse.pipelineTimeoutMs > 100ms default with clamp and timeout warn. Add unit coverage for precedence/invalid values/soft-fail path and document knobs in config-override-guide. Closes #798 when merged.
…config Export resolvePipelineTimeoutMs (env > config > 100ms default, clamp 1-30000), soft-fail remaining layers with console.warn. Config key synapse.pipelineTimeoutMs. Completes CORE-SU.A1 implementation.
unref() alone still allows post-teardown callbacks. Skip setInterval when JEST_WORKER_ID is set; keep production timer + unref; gate logs on AIOX_DEBUG; export disposeConfigCacheTimers. Applies to core and infrastructure copies. CORE-SU.A2 YOLO.
Extend core/permissions without replacing PermissionMode/OperationGuard. OSS path deny list excludes product workspace/ trees. Unit tests for traversal, injection patterns, private/metadata SSRF. Wave A P0.
Add scan for hub/enterprise leakage (workspace product paths, sinkra_*, mux-adapter, coolify, machine paths). npm run validate:port-denylist; doctor check port-denylist. Completes Wave A.
Ship OSS lean SDC skill wrappers (validate → develop → review → apply-qa-fixes → close + full-sdc orchestrator) with tasks as SOT. Wire grok-skills-sync to copy development/skills → .grok/skills/aiox-*. Sequence Lock: only close-story sets Done. No product harvest trees.
Add lean SDC/wave engines under .aiox-core/core/sdc with aiox sdc and aiox wave CLI for plan/next/verify/progress. Upgrade full-sdc skill to EXECUTE loop; add wave-execute that dispatches full-sdc children via DAG + file-ownership batches. Grok skills synced; unit tests included.
Close CORE-SU.A1 with hook-runtime synapse config wiring and QA PASS. Add ARCH-C and wave-run advance/mark/cascade/report CLI. Normalize A2–A4 to Done; package scripts sdc/wave; unit tests for wave-run.
Scan .claude surfaces; fail closed on unreadable paths; doctor wraps scan errors. Apply lint formatting to sdc/wave-run modules.
Execute CORE-SU-C wave: dispatch-adapter (parallel/sequential pool), epic-glue + aiox wave from-epic, tests (23). Stories C2–C4 Done; wave report completed. Skills updated for from-epic flow.
Add install-time hint, doctor windows-npx-install check (17 total), and docs for cold-cache lock timeout. ARCH-D/E drafts unlock stretch planning. Wave CORE-SU-F completed via full-sdc.
Remove pm.sh echo-stub: invoke CLAUDE_CMD/claude or fail closed. Port OSS-safe Articles XI (Squad-First) and XII (Model Governance). Add ide-sync-contract (D1) and closeout stories for wave-execute.
Official policy: docs/framework/epics/ for versioned framework OSS work; docs/stories/ remains project L4 (gitignored template). Align AGENTS.md, CLAUDE.md, story-lifecycle paths, and Grok sync prompts. Gitignore .codex/ until absolute paths / force-push wording are hardened for OSS.
Add npm run diff:framework-3way (peer discovery via env/flags), doctor advisory framework-3way-diff (18 checks), and ANALYSIS-3WAY-CORRECTIONS from verified OSS×hub×enterprise facts. Prefer enterprise lean full-sdc as skill enrichment base; never blind-merge OSS-wins modules.
Cold/warm timeouts, processSessionDigest + debounced reinforce worker, OSS global-heuristic-hints.yaml, and heuristics unit tests. Does not replace hook-runtime wholesale. Graceful when MIS absent.
github-actions
Bot
added
area: synapse
Keep feature-branch Grok sync + dual-path story policy; regenerate entity-registry, install-manifest, and .grok skills after merge.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📊 Coverage ReportCoverage report not available
Generated by PR Automation (Story 6.1) |
Avoid lastVerified thrash on no-op processChanges; covers pre-push noise from IDS hooks.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…orcement path-guard.js and ssrf-guard.js (CORE-SU.A3) are exported from permissions/index.js but are not called by OperationGuard.guard() and are not registered as a PreToolUse hook. No write path or outbound request is validated by these guards automatically today. Add the same standalone-library notice prompt-guard.js already carries so callers don't assume runtime enforcement is active. No logic changed. Epic: docs/framework/epics/core-super-update/EPIC-CORE-SUPER-UPDATE.md
Pedrovaleriolopez
force-pushed
the
feat/core-super-update-epic
branch
from
July 9, 2026 23:16
0017e8b to
3110863
Compare
Pedrovaleriolopez
approved these changes
Jul 9, 2026
Pedrovaleriolopez
left a comment
Pedrovaleriolopez
left a comment
Contributor
There was a problem hiding this comment.
Aprovado (code-owner). Revisão @devops: conteúdo de alta qualidade com governança formal do epic CORE-SUPER-UPDATE (roundtable + gate architect-first). Bloqueantes resolvidos: (1) Compatibility Parity Gate corrigido upstream (allowlist dos SDC skills); (2) guards path/ssrf documentados como standalone/não-wired; (3) manifesto realinhado. CI 100% verde no HEAD 3110863. Correções de segurança dos commits verificadas como aplicadas.
This was referenced Jul 10, 2026
Pedrovaleriolopez
added a commit
that referenced
this pull request
Jul 11, 2026
…haining (#804) Every semantic-release run was blocked at the prepublishOnly safety gate: validate-publish.js (Check 5) requires .aiox-core/package.json to match the root version, but semantic-release only bumps the root manifest. Fixes: - scripts/sync-version-lockstep.js: syncs .aiox-core/package.json and compat/aiox-core/package.json (version + @aiox-squads/core dependency pin) to the target version. Idempotent, standalone-usable. - .releaserc.json: @semantic-release/exec prepare step runs the sync with ${nextRelease.version} — the gate now passes inside the release run. - semantic-release.yml: after a non-dry-run release, explicitly dispatch npm-publish.yml (stable, all) via gh workflow run — the GITHUB_TOKEN tag/ release events do not chain workflows (anti-recursion); workflow_dispatch is the documented exception (same pattern as release.yml trigger-npm-publish). Requires the new actions:write permission. - Version bump 5.2.9 -> 5.3.0 committed across the three manifests (repo convention: chore(release) bump PRs), so the chained npm-publish.yml can publish the legacy aiox-core wrapper at 5.3.0 from the committed tree. Context: docs/handoffs (aiox-cockpit) 2026-07-11-env-normalization- consolidation.md, Fase 4. The orphan v5.3.0 tag from the failed attempt was deleted; baseline tag for semantic-release remains v5.2.8 (next: 5.3.0, minor, driven by the feat commits in #800/#801). Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
🎉 This PR is included in version 5.3.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Super-update do @aiox-squads/core a partir do que o lab/hub e o enterprise ensinaram ao framework — sem carregar produto premium (workspace multi-BU, services, full-sdc hub ~2k, tribunal, sinkra runtime).
Headline: instalar o core → SDC lean (validate → develop → review → close) + higiene de runtime + denylist anti-produto.
Ships (required scope)
npm run diff:framework-3way+ doctor advisory (anti-drift 3-way)aiox sdc+ Grok syncaiox wave(plan/from-epic/advance/mark/report) + dispatch adapterpm.shreal CLI (não stub); memory-bridge heuristics; dual-pathdocs/framework/epicsvsdocs/storiesExplicitly NOT in this PR (premium / product)
workspace/multi-BU, L0/L1 identity product trees.codex/(gitignored until path hardening)OSS-wins preserved:
core/errors,external-executors,resilience,pro/— never blind-overwritten.Test plan
npm run lintnpm run typechecknpm test(8865+ passed; known Jest worker teardown warning)npm run validate:port-denylistnpm run validate:manifestnpm run validate:registry-determinism.aiox-core/core→ fixes → 0 findings re-reviewDocs
docs/framework/epics/core-super-update/docs/framework/story-locations.mdANALYSIS-3WAY-CORRECTIONS.mdRelated issues
Closes #798 (when merged)
Closes #797 (when merged)
Closes #773 (when merged)
Notes for reviewers
Summary by CodeRabbit
New Features
aiox sdcandaiox waveworkflows for planning, advancing, marking progress, and generating reports (with optional JSON output).Bug Fixes
Documentation