Implementation Plan: Surface a Structured crashed Result at Dispatch for Fix-Required Hooks#4070
Merged
Trecek merged 4 commits intoJun 11, 2026
Conversation
Add a dispatch-time gate in _check_backend_compat that refuses sessions when HOOK_REGISTRY contains any HookDef with codex_status=='fix-required' whose guard scripts are not in the backend's applicable_guards capability. The gate returns a SkillResult.crashed() JSON envelope listing the affected hook matchers. Claude-code sessions pass through because their applicable_guards includes skill_load_guard; codex sessions are blocked because theirs does not. The helper takes applicable_guards (a BackendCapabilities field) instead of a backend name to satisfy test_no_backend_name_bypass.py. Arch test rule updates: extend the server/tools allowed-imports set and cascade map entry to permit hook_registry imports from tools_execution.
…_matchers; guard empty scripts _has_* prefix conventionally signals a bool return in this file (_has_active_locks → bool). Rename to _get_fix_required_hook_matchers to match collection-returning helper convention. Also add `not h.scripts` guard before the issubset check: an empty frozenset is always a subset of any set, so a fix-required HookDef with scripts=[] would silently pass the coverage check and be omitted from matchers, allowing dispatch to proceed unchecked.
…ult') or '' Weak .get() fallback to empty string masks missing 'result' keys with an obscure string-contains failure. Direct dict access raises KeyError immediately, surfacing the real problem rather than a misleading assertion failure.
The `not h.scripts` guard added in _get_fix_required_hook_matchers treats a fix-required HookDef with scripts=[] as always-unenforced (dispatch blocked). No test covered this guard branch. Add test to verify the behavior explicitly.
Trecek
force-pushed
the
t5-p1-a4-wp1-surface-a-structured-crashed-result-at-dispatch/4001
branch
from
599ab5d to
86a965e
Compare
Trecek
deleted the
t5-p1-a4-wp1-surface-a-structured-crashed-result-at-dispatch/4001
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a dispatch-time gate in
_check_backend_compatthat refuses sessions whenHOOK_REGISTRYcontains anyHookDefwithcodex_status == "fix-required"whose guard scripts are not in the backend'sapplicable_guardscapability. The gate returns aSkillResult.crashed()JSON envelope listing the affected hook matchers. Claude-code sessions pass through because theirapplicable_guardsincludesskill_load_guard; codex sessions are blocked because theirs does not.Deviation from issue spec: The issue prescribes
_has_fix_required_hooks(backend_name: str)withif backend_name != AGENT_BACKEND_CODEX. This design violatestests/arch/test_no_backend_name_bypass.pywhich forbids backend-name comparisons in production code. Instead, the helper takesapplicable_guards: frozenset[str](aBackendCapabilitiesfield) and cross-references fix-required hooks' guard script names against the set. This achieves identical runtime behavior via capability fields — architecturally correct and future-proof for additional backends. Consequently,AGENT_BACKEND_CODEXis not imported intotools_execution.py(no consumer), andHookDefis only imported in the test file.Closes #4001
Implementation Plan
Plan file:
/home/talon/projects/autoskillit-runs/impl-20260611-091247-856621/.autoskillit/temp/make-plan/t5_p1_a4_wp1_fix_required_hook_dispatch_gate_plan_2026-06-11_091500.md🤖 Generated with Claude Code via AutoSkillit
Token Usage Summary
* Step used a non-Anthropic provider; caching behavior may differ.
Token Efficiency
Model Usage Breakdown