Repository navigation
Conversation
Add BenchSpec.pinned_policy. The policy is injected at the head of the staged always-on file at materialise time and read back by hash before the run, so Propose-Probe-Compose cannot trim or delete it. It is mixed into the run fingerprint, charged to the always-on cap, and a no-op when unset. LAB and WorkBuddy base runs refuse to run with a policy until they can inject it.
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
gngsn
force-pushed
the
feat/pinned-policy-staging
branch
from
October 29, 2026 14:28
01d322e to
28889c6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A deployer can now set
BenchSpec.pinned_policyto keep fixed policy text outside the editable harness tree and deliver it to both base and candidate runs. Propose–Probe–Compose can edit the surrounding harness without trimming or deleting the policy.Addresses #94, following the staging approach discussed in #94 (comment).
Implementation
Installmetadata. Inject it after template rendering or workspace installation, then verify the final execution input before launching the model. This preserves literal Jinja/template syntax and HTML comments that renderers would otherwise interpret or remove.AGENTS.mdin WorkBuddy Codex base runs.docs/PINNED_POLICY.md; update runner provenance checksums.Validation
python3 -m unittest discover -s tests: 28 tests pass.ruff check harness2 testsandruff format --check harness2 tests: pass.bash -nfor the JobBench Codex runner, andgit diff --check: pass.python3 scripts/check_provenance.py: all 47 asset checksums pass.Regression coverage includes literal policy preservation after rendering, final-file tampering blocking launch, base/candidate delivery, character and byte limits, policy-change/removal invalidation, summary isolation, and stale runner rejection. WorkBuddy Codex installation commands are exercised locally with process/model interfaces stubbed. No model-backed benchmark or Docker end-to-end run was performed.
This guarantees policy text preservation and delivery before launch, not model compliance or enforcement against hooks/plugins during execution. Policy is configured through the Python adapter API; no new CLI flag is introduced.