feat(promptware): portable prompt-software compiler (verity promptware) - #5
Merged
Conversation
…le-5 review) Fable-5 code review of the ~10.3K lines written while Fable was unavailable (Jun 20–28) surfaced two unguarded input surfaces — both ironic for a safety harness: 1. repostream.materialize — path traversal / absolute-path escape. Wrote `dst / p` with `p` an UNTRUSTED GitHub tree path; pathlib makes `dst / "/abs"` == "/abs" and "../x" escapes dest. Now resolve()+relative_to() anchors every write inside dest; an escape is skipped and flips truncated=True (honest: never assert "safe" on a scan we couldn't complete). 2. websearch.fetch — SSRF / local-file read. urllib honors file://, ftp://, gopher://, and the URL can come from search results or a prompt-injectable model choice. fetch() is now http(s)-only; other schemes are refused. +2 offline regression tests (path-escape rejection, non-http refusal). Full suite: 101 passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…xist (DRY/Rule-17 enforcement) A PreToolUse (Write|Edit) hook that HARD-BLOCKS creating a new tool/script/daemon until the agent has demonstrably searched for an existing one (prior-art evidence in the recent transcript). Docs/memory don't stop agents from rebuilding existing tools — an execution-time gate does. - Portable + env-configurable (REUSE_GATE_GLOBS / REUSE_GATE_EVIDENCE / CLAUDE_PROJECTS_DIR). - Guards only NEW files matching guarded globs; editing existing files always allowed; fail-open. - +12 deterministic offline tests (block paths, allow paths, edge cases: subdirs, spaces, malformed payload, non-Write tools, empty path). Validated 56/56 across repeated runs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…y-discipline) Packages the three discipline gates as a one-install product: - reuse-first-gate (PreToolUse hook) — block rebuilding tools that exist - verity-discipline (skill) — search-before-concluding + safe-install playbook - /verity-scan (command) + verity_scan.py — ingest/repo prompt-injection scanner Adds .claude-plugin/marketplace.json so it installs via: /plugin marketplace add FutronPrime/verity-harness /plugin install verity-discipline Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…, deploy configs - billing.py: Stripe metered bridge (MeterEvents + usage-record fallback, never raises into request path) - landing/index.html: brand-matched landing (teal/magenta, Arial Narrow) - Dockerfile + fly.toml + render.yaml + requirements.txt: one-command deploy to any of 3 targets - DEPLOY.md: the 3 DJ-only inputs (Stripe key, target, domain) documented - Verified: /health, admin key-issue, /v1/scan UNSAFE detection, usage metering all pass Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- verity/cli_ensemble.py: council members from different labs (Claude/Codex/Gemini/Grok CLIs) — less-correlated blind spots than same-family tiers; degrades to whatever CLIs are installed - verity/council.py: --ensemble flag routes the 3-stage blind council over the cross-lab legs - cloud/app.py: /v1/council premium gate (10 units), verified running a real 3-member council - Wires the Fable-Council (Mixture-of-Agents) into VERITY's existing council + the metered API Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Resolved 21 curated X posts to concrete repos (syndication API + WebSearch + GitHub API), streamed every README (zero cloning), registered 13 net-new repos as monitored sources (20->33) - Adopted Karpathy 4 anti-pitfall principles as VERITY discipline (Think-Before-Coding, Simplicity- First, Surgical-Changes, Goal-Driven) — reinforces PRIME DIRECTIVE - Documented that @ziwenxu_ (OpenRouter Fusion) + rmux independently validate the cross-lab council --ensemble MoA gate shipped this session - Mapped auth0 auth-for-agents -> R61 human-gate model; claude-obsidian hybrid-retrieval -> memory Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Reachable-not-resident: catalog repos/skills, mount one on demand, gate it through 'verity vet', lease with a TTL, auto-release + reclaim disk. Reads stream (zero clone); only skills/executables materialize, ephemerally, after the vet clears. Portable (env-configured paths, no external deps). - verity/broker.py: add/find/show/use/active/release/sweep/stats - verity/__main__.py: wire 'broker'|'capability'|'jit' subcommand - docs/BROKER.md: pattern + usage + launchd auto-sweep example - Verified: full lifecycle mount→vet→lease→release; vet BLOCKs hostile instruction-surfaces Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… point - Top callout: 'reachable, not resident' — vet-gated on-demand capability mounting - New capability bullet in the autonomy section + docs link to BROKER.md - Positions the broker as solving 'install everything vs capability-starved' without supply-chain risk Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…pplies - verity/regression_ledger.py + 'verity fixed' subcommand: record a fixed bug, gate any plan/diff against it (exit 2 on regression risk) so solved bugs can't be silently reintroduced (Kochel technique) - docs/FABLE5-TECHNIQUES.md: 34 techniques from 3 practitioner videos mapped to VERITY; 1 refused (safety-refusal-neutralizer — out of scope for a discipline harness) - Verified: record -> check-clean(0) -> check-regression(2) catches a real Metal-GPU-crash reintroduction Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Every skill's name+description is always-on catalog tax. This audits a skills dir: static token cost + near-duplicate clusters (fast), real invocation scan (--with-usage → CUT list + reclaim estimate), and A/B lift (--ab: run a task with vs without a skill, report output divergence). Portable (VERITY_SKILLS_DIR / VERITY_TRANSCRIPTS_DIR). Applied from the Fable-5 'delete skills aggressively, keep only what lifts' technique. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… stacking loop: run_goal() now seeds six-source research (reddit/x/youtube/github/ stackoverflow/hn + web) on the goal and resolves `research: <q>` actions via deep_research instead of the shell — `verity loop` defaults to it (--no-web opts out). Closes the gap where the loop was the naive no-research baseline while the six-source engine only fed `verity deliberate`. autostart: add an atomic mkdir mutex + pgrep guard around the mascot launch. The SessionStart hook fires per agent session; concurrent runs raced Electron's single-instance lock and stacked 2-3 mascots (memory bloat -> OOM). Now one launch per herd; stale lock reclaimed after 2min. voice: listen() gets a process-level singleton guard — a second `verity voice listen` refuses to start (two listeners = double mic + overlapping TTS, the "voice going haywire" symptom; the mascot's per-instance flag couldn't see it). All three verified: injected-fake loop test, 3-way parallel autostart -> 1 instance, and a live second-listener refusal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Compiles a bounded, model-agnostic operating envelope + capability manifest for any LLM/agent host. Separates identity/discipline from real tool seams; DISCOVER->PLAN->EXECUTE->VERIFY->PERSIST loop. Completes the uncommitted WIP; render() + CLI subcommand already wired, tests pass (125/125 suite green). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ral voice - model_profiles.py: per-LLM structure/quirks registry + parse_answer/scaled_timeout/ codex_last_assistant so the harness handles reasoning-splits (Kimi K3/GLM/DeepSeek), Codex's payload envelope, persona-dominance, and large-input timeouts correctly. - FINN_LOOP.md: human-gated spec->build->review loop (contract with AC + non-goals, fresh reviewer, verdict taxonomy, "humans merge" law). Pairs with FABLE5_METHODOLOGY.md. - voice.py: _say_juniper engine (expressive edge-tts base + RVC overlay via VERITY_RVC_URL, portable) preferred for the AVANI/standard style; ORION added as the public default persona. - youtube.py: fetch_transcript() — full-text, yt-dlp auto-subs with a Gemini fallback (no more 429-brittleness or truncated previews). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…errides persona.py resolves the effective persona layer WITHOUT clobbering a user's presets: - If the user already has a persona (env/file/mascot.json), it stays PRIMARY; VERITY only APPENDS its discipline gates (research-before-concluding, never-quit, humans-merge, omission-over-fabrication) — behavior discipline, not identity, safe to add to anyone's. - If the user has no persona (most setups), ORION becomes the default primary (evolves with the user). VERITY never replaces or edits a user's persona. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…odels When a model's output can't be parsed/handled, handle_model_failure() emits the 5-block report (What/Why-root-cause/Impact/Fix/Prevention) with a "did WE cause this?" self-check, RESEARCHES the model's structure if unprofiled (agent-reach/assimilatrix, pluggable), proposes an adaptive profile, persists it via learn() to learned_model_profiles.json (profile() applies learned adjustments first), and journals to memory_journal.md. Result: VERITY adapts to a new/weird model and keeps using it instead of failing — verified: empty-content+reasoning → learned → parse_answer recovers the answer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…rcement test, TABFM advisory) Pre-existing Codex-authored changes on this branch, reviewed and verified free of secrets/private data before publishing: server.py + autostart.py updates, a codex-enforcement test, and the TABFM advisory doc + requirements. Kept public-clean (no keys, no personal paths, no private intel). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…LLM connection error_protocol.py makes structured error handling universal (not just model-parsing): a `protocol` context manager, `guard` decorator, and `handle_error()` produce the 5-block report (What / Why-root- cause via 5-whys / Impact / Fix / Prevention) with the⚠️ banner and a "did WE cause this?" self-check, journal every failure to memory_journal.md, and support a pluggable researcher for self-healing. Honors /prefs why + postmortem via env. Public/ORION build; FUTRON/AVANI mirrors it as futron-error-protocol. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Third member of the discipline set alongside FABLE5_METHODOLOGY (how you think) and FINN_LOOP (how you ship). OVS governs grading. Six rules: grade in a fresh context (structural, not a promise) · two independent detectors always (unclear != pass, fail closed) · check at intervals not only at the end · escalate don't front-load · on failure find the STRUCTURAL cause and emit a corrected instruction block · one lesson, one file. Rule 2 is measured, not asserted: given a deliverable using eval() against an explicit prohibition, with no docstring/type hints/code fence, a 1B auditor model returned VERDICT: NOMINAL. It passed broken code. A small model is never the gate. Guardrails: completion boundaries only (SubagentStop/TaskCompleted/ PostToolUseFailure/StopFailure), never PreToolUse; OVS grades, never authors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…raph-as-connected-loops Distilled from a 49-resource review (2026-07-25). Codifies: - verifier-first as a BLOCKING gate + 6-tier verifier strength ladder - loop = trigger + task + success criteria (all three, always) - graph engineering = connected loops, every node a complete loop - the 3 graph triggers (context rot / independent review / timing), default NO - cost-tiered roles with a READ-ONLY verifier so workers cannot self-certify - seam auditing (per-node checks are blind to the joins) - SAILL named workflows Sources: loop-architect, SAILL, precheck-guardian, context-compressor, something-else, goalloop, chat2goal, MindMap, Chase AI + Alex Finn talks. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
llama.cpp llama-server on :11501, OpenAI-compatible, schema-constrained. Three bugs found and fixed getting here — none were the model: - ollama CLI leaks ANSI cursor codes into stdout - ollama CLI does TTY wrap-redraw, duplicating wrapped text - the model routes reasoning to reasoning_content and burns the whole budget there unless enable_thinking=false (900/900 tokens, empty content) llama.cpp GBNF/json-schema makes malformed output structurally impossible. 2.3s per plan with thinking off. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…rompt tuning 6 planning tasks, local MiniCPM-1B distill (llama.cpp+GBNF) vs hosted gemma-4-31b:free, scored only on mechanically-verifiable structure. Headline: bounding the steps array (minItems:3/maxItems:8) moved the 1B model from 32.3 padded steps / 0.018 checkable / 0.833 valid JSON to 8.0 steps / 0.271 checkable / 1.000 valid JSON. Constraining the output space beat instructing the model. Bounded local then BEATS hosted on checkable steps (0.271 vs 0.208), ties on valid JSON, and runs offline with no rate limit. Caveat documented: this scores structure, not insight. Both planners sit near check tier 1.9, which is why the verifier-first gate still rejects most of their steps. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…e lapse The stop-guard catches acts of COMMISSION: a claim the agent had not earned. The inverse error emits nothing — the agent notices something, stays quiet, the run ends clean, every response-inspecting gate passes. Silence is indistinguishable from correctness, so no hook can ever fire on it. Evidence (2026-07-26): futron-sets-review, the brand screen, requested model claude-opus-4-8 from an endpoint that only ever served gpt-5.5, got 502, fell back to a cynicism-anchored heuristic, and printed a confident score with exit 1 — the code meaning "content FAILED screening". Nothing had been screened. The heuristic is max(1,10-cynicism)+2, so a low-cynicism panel would have fabricated a PASS instead. It had been failing open for an unknown period and nothing could notice, because a gate that is quietly wrong emits exactly what a working gate emits. - PROACTIVITY_PROTOCOL.md — grade on Missed-Needed, not interruptions. Deterministic detectors only (a model may write the proposal, never BE the gate); a detector that cannot decide emits `unclear`, never an empty list; every suppressed signal is logged as mn_risk so the invisible error becomes countable. Sources: THUNLP ProactiveAgent (4-cell reward model, F1 0.918), Anthropic Routines (trigger/context/steerability), Skills-Coach, ACE. - DETERMINISM_PROTOCOL.md — temperature=0 is NOT deterministic (1,000 samples at temp 0 -> 80 distinct outputs, diverging at token 103; cause is missing batch invariance in RMSNorm/matmul/attention, fixable only if you own the server). So dependability is architectural: Tier 1 true determinism where reachable, Tier 2 heuristics where not, never reported in one number. - verity/proactive.py — portable gate: register(), gate(), record(), miss(), calibrate(). calibrate() returns recall=None on purpose; it cannot know one, and a dashboard that invents it rebuilds the blindness. - tests/test_proactive.py — 26 adversarial checks, all passing. - `verity proactive gate|calibrate|miss|accept|reject|ignore` Both protocols land on one rule: a fallback must change the SHAPE of its output, not add a warning above an otherwise identical verdict. Hence 0=passed 1=failed 2=COULD NOT RUN, and callers must honour 2 as unscreened. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… itself Daisy Hollman (Anthropic): 'You're not supposed to prompt Claude. You're supposed to build a system that prompts itself.' That is the target; this protocol is the part that gets skipped on the way there — a self-prompting system needs a way to be WRONG about when to speak and a way to find out. Her four named failure modes map onto the protocol directly: no memory file -> the ledger; no sub-agent split -> decomposition; no stop condition -> the threshold; token bloat -> store strategies not transcripts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…rine
Four rules, each from a measured lapse this session, wired into BOTH public
injection surfaces (the generated shell gates and the CLAUDE.md _GATES_MD block):
R11 a degraded path must change the SHAPE of its output. 0=passed 1=failed
2=COULD NOT RUN. Callers honour 2 as unscreened.
R12 report the MISS. Never "no issues found" — "these checks found nothing they
can see". Name unrunnable checks UNMONITORED.
R13 never read HISTORY as STATE. launchctl STATUS is last-exit not health; a
cached snapshot without an mtime check is a stale reading shaped like a live
one; "last N lines" is position not time; rows written != artifact rendered.
A false alarm is a bug report against the DETECTOR, not noise to tune out.
(Four instances in one session, three inside the module written to catch it.)
R14 query before claiming blocked; fix the LANE not the instance. Two Reddit
threads were declared unreachable after .json 403'd — untried: the capability
search naming a purpose-built CLI, and the logged-in browser on CDP :9222
which read both in seconds. Fixed at the lane, with the four dead paths
documented so nobody re-derives them. "Out of scope"/"pre-existing"/"not
mine" are not boundaries. Uncommitted work in a repo is UNBACKED work.
Also rescues finished doctrine that had been sitting dirty and uncommitted from a
prior session — Rule -1 (open the media, with the 438-image corpus measurement),
and the Chrome-Web-Store-as-solution-registry insight. Leaving it as "not mine"
kept real work one `git checkout` from gone; R14 exists so that stops happening.
Protocol updates from sources read this session: vLLM `batch_invariance` and
SGLang deterministic inference named as the concrete Tier-1 batch-invariant
implementations; ai-care credited for independently arriving at the same
sensors/detectors split.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
# Conflicts: # tests/test_codex_enforcement.py # verity/autostart.py # verity/server.py # verity/youtube.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the uncommitted
verity promptwareWIP on this branch: a portable, model-agnostic prompt-software compiler that emits a bounded operating envelope + capability manifest (DISCOVER→PLAN→EXECUTE→VERIFY→PERSIST loop).render()+ thepromptwareCLI subcommand were already wired; this commits the module + tests + README. Full suite 125/125 green.Note: branch name implies additional py314 preflight work — reconcile before merge if there's more here.
🤖 Generated with Claude Code