# Work Log: main

## Header

- Branch: `main`
- Classification: `quick-win`
- Classified by: `Codex`
- Frozen: `2026-06-05`
- Created Date: `2026-06-05`
- Owner: `codex`
- Guardrails Mode: `Quick`
- Current Phase: `test`
- Checkpoint SHA: `16c71b416935cf518a3e7c05df4503b77e790b87`
- Recommended Skills: `systematic-debugging`, `verification-before-completion`
- Primary Domain Snapshot: `governance`
- SSoT Sequence: `34`

---

## Session Info

- Agent: `Codex`
- Session: `2026-06-05 00:00 UTC`
- Platform: `codex`
- Files Read: `7`
- Agent: `Codex`
- Session: `2026-06-11T18:00:00+08:00`
- Platform: `Codex App`
- Guardrails loaded: `AGENTS.md supplied by user; shared-contracts/test workflows loaded; full guardrails over-read noted in Drift Log`
- Override: `none`

---

## Task Description

Lightweight main-branch bug audit after enabling the GitHub plugin, starting from recent shipped governance changes and looking for actionable correctness/security regressions.

---

## Phase Sequence

| Phase | Status | Entered | Notes |
|---|---|---|---|
| bootstrap | completed | 2026-06-05 | Classified as quick-win audit; no code implementation planned. |
| plan | skipped | 2026-06-05 | No implementation plan needed for read-only review. |
| implement | completed | 2026-06-05 | Fixed PowerShell validator Global Lessons count bug found during audit. |
| review | completed | 2026-06-05 | Main-branch bug audit. |
| test | completed | 2026-06-05 | Focused regression and validator checks. |
| handoff | skipped | 2026-06-05 | Quick-win exempt. |
| ship | pending | - | - |

---

## Phase Summary

- review: PASS — found and fixed two validator bugs: PowerShell Global Lessons count parity and lifecycle frontmatter temp-file race under parallel validators; focused regressions passed; bash/PowerShell validators now pass. ⚡ ACX
- test: PASS — v1.5.1 downstream simulation suite, source validators, no-python path, downstream validate smoke, GEMINI scaffold preservation, and installer wrappers all passed; no release-blocking issue found. ⚡ ACX

---

## Gate Evidence

- Gate: review | Verdict: PASS | Classification: quick-win | Timestamp: 2026-06-05T00:00:00Z
- Gate: test | Verdict: PASS | Classification: quick-win | Timestamp: 2026-06-11T18:00:00+08:00

---

## External References

| Type | Path / URL | Notes |
|---|---|---|
| Spec | - | - |
| ADR | - | - |
| Issue | - | - |
| PR | - | - |

---

## Known Risk

none

---

## Conflict Resolution

none

---

## Skill Notes

none

---

## Drift Log

- Work Log recovered for existing `main` branch because `.agentcortex/context/work/main.md` was missing at phase entry.
- Token Leak: full engineering/security guardrails were read before quick-win classification was confirmed; no SSoT write performed.
- Phase entry: `/test` downstream simulation on release v1.5.1; lock acquired for `main`.

---

## Design Reference

none

---

## Observability

none

---

## Resume

none

---

## Security Findings

none

---

## Evidence

- `python -m pytest tests/ci/test_validator_false_positives.py::test_global_lessons_count_uses_match_count_in_ps1 -q` -> 1 passed.
- `powershell -ExecutionPolicy Bypass -File .agentcortex/bin/validate.ps1` -> Global Lessons count within cap (18/20); remaining fail before Work Log receipt was `work logs missing gate evidence receipts: 1`.
- `C:\Program Files\Git\bin\bash.exe .agentcortex/bin/validate.sh` -> Global Lessons count within cap (18/20); remaining fail before Work Log receipt was `work logs missing gate evidence receipts: 1`.
- `python -m pytest tests/guard/test_d2_3_lifecycle.py tests/ci/test_validator_false_positives.py::test_global_lessons_count_uses_match_count_in_ps1 -q` -> 16 passed.
- `python .agentcortex/tools/check_lifecycle_frontmatter.py --root .` -> lifecycle frontmatter: 8 PASS, 0 WARN, 0 FAIL.
- `C:\Program Files\Git\bin\bash.exe .agentcortex/bin/validate.sh` -> Summary: pass=102 warn=6 fail=0 skip=2.
- `powershell -ExecutionPolicy Bypass -File .agentcortex/bin/validate.ps1` -> Summary: pass=102 warn=6 fail=0 skip=2.

## Test Simulation 2026-06-11

- Scope: downstream install/upgrade simulations for newly shipped v1.5.1 on `main`; read-only unless a reproducible defect is found.
- Test blueprint:
  - Fresh downstream deploy should ship `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md`.
  - Routine re-deploy should stay quiet when no legacy paths exist.
  - CRLF-only downstream edits should update in place without `.acx-incoming`.
  - Genuine downstream edits should preserve user content via sidecar.
  - Downstream user ADRs should warn, not fail, when `.agentcortex-manifest` proves framework deployment.
  - Bash and PowerShell validators should remain parity-clean.
  - No-Python validator path should remain usable.
- Test Files: `tests/ci/test_deploy_tiering.py`, `tests/guard/test_d2_3_lifecycle.py`, `tests/ci/test_validator_false_positives.py`
- `python -m pytest tests/ci/test_deploy_tiering.py tests/guard/test_d2_3_lifecycle.py tests/ci/test_validator_false_positives.py -q` -> 52 passed in 1176.42s.
- `C:\Program Files\Git\bin\bash.exe .agentcortex/bin/validate.sh` -> Summary: pass=101 warn=9 fail=0 skip=2.
- `C:\Program Files\Git\bin\bash.exe .agentcortex/bin/validate.sh --no-python` -> Summary: pass=92 warn=6 fail=0 skip=14.
- `powershell -ExecutionPolicy Bypass -File .agentcortex/bin/validate.ps1` -> Summary: pass=101 warn=9 fail=0 skip=2.
- Manual downstream smoke: fresh temp git project deploy -> manifest `version: 1.5.1`; `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `validate.sh`, `validate.ps1` present; downstream validators pass (`validate.sh` pass=80 warn=1 fail=0 skip=3; no-python pass=74 warn=1 fail=0 skip=9; ps1 pass=80 warn=1 fail=0 skip=3).
- Manual GEMINI scaffold smoke: downstream customization kept; `GEMINI.md.acx-incoming` created and non-empty on re-deploy.
- Manual wrapper smoke: `installers/deploy_brain.sh`, `.ps1`, `.cmd` each deploy `version: 1.5.1` with `GEMINI.md=True`.
- Known warnings: validator WARNs are existing repository hygiene/eval-coverage advisories, not v1.5.1 downstream deploy failures.

## Adversarial Simulation 2026-06-11

- Scope: assume v1.5.1 can fail at downstream bootstrap/update edges; test weird paths, missing inputs, corrupt manifests, and wrapper argument translation.
- Applying red-team-adversarial strategy: quick-win classification blocks full Red Team gate, so this run uses bounded adversarial smoke cases only.
- PASS installer-only bootstrap: copied only `installers/deploy_brain.{sh,ps1,cmd}` into empty temp projects, set `ACX_SOURCE` to local source, and each wrapper deployed manifest `version: 1.5.1` with `GEMINI.md=True`.
- PASS path stress: target path containing spaces + Traditional Chinese characters deployed as `version: 1.5.1`.
- PASS corrupt-manifest preservation: after corrupting all manifest hashes and editing a scaffold skill, re-deploy preserved the downstream edit and created `SKILL.md.acx-incoming`.
- PASS release sanity: remote `origin` exposes tag `v1.5.1`; local `HEAD` and `v1.5.1^{}` both resolve to `0a75067`; deploy script declares `ACX_VERSION="1.5.1"`.
- PASS fail-safe no-source: installer-only project without `ACX_SOURCE` fails with `Cannot bootstrap: no ACX_SOURCE` and writes no manifest.
- PASS fail-safe CP_FLAG: invalid `CP_FLAG='; echo owned'` is rejected and writes no manifest.
- PASS fail-safe self-deploy: deploying into the Agentic OS source repo is blocked by the self-deploy guard.
- PASS fail-safe dry-run: `deploy_brain.cmd --dry-run <target>` exits 0 and writes no manifest or `AGENTS.md`.
- Finding: no new v1.5.1 release blocker found from these adversarial angles.

## Review/Test 2026-06-12

- Scope: latest tracked change on `main`, commit `78b9895` via merge `537009b`; changed `.agentcortex/context/current_state.md` only, adding two hash-chained Global Lessons (`rule-placement`, `eval-mapping`).
- Review: PASS — lesson entries follow the documented Global Lessons format, preserve the 20/20 cap, and encode reusable process failures rather than one-off notes.
- Security scan: PASS — no secret-like tokens matched in the tracked change or current `.acx-local/` untracked files.
- Untracked local files: `.acx-local/commitmsg-lang.txt`, `.acx-local/deploy_at_review.sh`, `.acx-local/issue-140-comment.md`, `.acx-local/pr-body-lang.md`; treated as local scratch, not part of the tracked verdict.
- `python .agentcortex/tools/check_lesson_chain.py --quiet` -> `lesson chain intact: .agentcortex\context\current_state.md`.
- `powershell -ExecutionPolicy Bypass -File .agentcortex/bin/validate.ps1` -> Summary: pass=101 warn=9 fail=0 skip=2.
- `& 'C:\Program Files\Git\bin\bash.exe' .agentcortex/bin/validate.sh` -> Summary: pass=101 warn=9 fail=0 skip=2.

## Review/Test 2026-06-12 Expanded Yesterday Scope

- Scope correction: user clarified "yesterday's changes, not single latest commit"; expanded to first-parent merges from `2026-06-11T00:00:00+08:00` through `2026-06-12T00:00:00+08:00` (`58cca51`..`537009b`, base `0f1d6fd`), 36 files / 1703 insertions / 186 deletions.
- Review finding: HIGH — `installers/deploy_brain.sh` peeks only `--source <url>`, not `--source=<url>`, while canonical `deploy.sh` supports both. Repro: manifest+cache point to wrong repo, direct bash wrapper invoked with `--source=<right>` still pulls and executes WRONG cached repo. Fix requires parsing `--source=*` before manifest fallback and adding regression coverage.
- Review finding: MEDIUM — `installers/deploy_brain.sh` reads `source_repo:` via `awk '{print $2}'`; local source paths containing spaces are truncated, causing false mismatch, cache deletion, and clone failure against the truncated path. Fix requires preserving the full value after `source_repo:` and a local-path-with-spaces regression.
- Security scan: no real secret added; only intentional fake credential string in `.agentcortex/eval/governance.yaml` test prompt.
- Targeted regression: `python -m pytest tests/ci/test_deploy_brain_bootstrap.py tests/ci/test_deploy_tiering.py tests/guard/test_d2_3_lifecycle.py tests/guard/test_governance_eval.py -q` -> 75 passed in 169.95s.
- `python .agentcortex/tools/check_lesson_chain.py --quiet` -> `lesson chain intact: .agentcortex\context\current_state.md`.
- `& 'C:\Program Files\Git\bin\bash.exe' .agentcortex/bin/validate.sh --no-python` -> Summary: pass=92 warn=6 fail=0 skip=14.
- `& 'C:\Program Files\Git\bin\bash.exe' .agentcortex/bin/validate.sh` -> Summary: pass=101 warn=9 fail=0 skip=2.
- `powershell -ExecutionPolicy Bypass -File .agentcortex/bin/validate.ps1` -> Summary: pass=101 warn=9 fail=0 skip=2.

## Review/Test 2026-06-14 v1.5.4 Release

- Scope: `v1.5.3..v1.5.4` release diff plus `HEAD` ledger merge (`v1.5.4=23f2037`, `HEAD=7acd159`, `v1.5.3=ebb5efc`); 41 files / 1638 insertions / 70 deletions in the release tag.
- Review finding: HIGH — `.agentcortex/tools/validate_downstream_capabilities.py:31` allows `load_policy: phase-entry` and `load_policy: on-failure`, but bootstrap/spec/config all state the downstream capability ceiling is `on-match` and higher policies must be rejected. Repro: temp `downstream-capabilities.yaml` with `custom-eager` + `load_policy: phase-entry` returns `OK: downstream-capabilities.yaml is gate-safe`; same for `on-failure`. Test gap: `tests/guard/test_capabilities_schema_gate_safety.py` rejects `always` but not `phase-entry` / `on-failure`.
- Security scan: `python .agentcortex/tools/scan_credentials.py --range v1.5.3..v1.5.4` -> clean (exit 0, no output).
- Version sanity: remote tag `v1.5.4` -> `23f203725ead1c9eb4d963ba888388a114623570`; remote `main` -> `7acd159b8540ed2e8791483d54b71ddc0b7feea5`; `deploy.sh` ACX_VERSION is `1.5.4`; README badge and CHANGELOG `[1.5.4]` present.
- Whitespace: `git diff --check v1.5.3..v1.5.4` -> clean.
- New/high-risk tests: `python -m pytest tests/ci/test_scan_credentials.py tests/guard/test_capabilities_schema_gate_safety.py tests/guard/test_credential_floor_shell.py tests/guard/test_credential_floor_ps.py tests/guard/test_precommit_hook_credential_e2e.py -q` -> 37 passed.
- Deploy tier tests: `python -m pytest tests/ci/test_deploy_tiering.py::test_downstream_adaptability_files_deploy_at_correct_tier tests/ci/test_deploy_tiering.py::test_downstream_capabilities_yaml_is_gitignored -q` -> 2 passed.
- Trigger metadata/lifecycle tests: `python -m pytest .agentcortex/tests/test_lifecycle_skill_activation.py .agentcortex/tests/test_trigger_registry_format.py .agentcortex/tests/test_trigger_metadata_tools.py -q` -> 88 passed.
- Clean-clone validators: `bash .agentcortex/bin/validate.sh` -> Summary: pass=94 warn=3 fail=0 skip=2; `validate.ps1` -> Summary: pass=94 warn=3 fail=0 skip=2.
- Local validator note: local `validate.ps1` on the working tree failed only on gitignored active Work Log compaction (`arch-safety-floor-credential-hardening.md` 142 lines / 30KB), not on tracked release content.
- Downstream update simulation: temp v1.5.3 source deployed, then v1.5.4 source re-deployed; manifest upgraded 1.5.3 -> 1.5.4; `AGENTS.safety.md`, `scan_credentials.py`, `credential_floor.sh`, `credential_floor.ps1`, `validate_downstream_capabilities.py` present; customized scaffold skill preserved via `.acx-incoming`; private `downstream-capabilities.yaml` not shipped.
- Fresh downstream no-python simulation: deployed v1.5.4 to temp repo; downstream `validate.sh --no-python` -> pass=75 warn=2 fail=0 skip=11; downstream `validate.ps1 -NoPython` -> pass=75 warn=2 fail=0 skip=11.
- Gate: review | Verdict: NOT READY | Classification: quick-win | Transition: REVIEWED→IMPLEMENTING | Timestamp: 2026-06-14T00:00:00+08:00

## Implement/Test 2026-06-14 Capability Ceiling Fix

- MFR: A private `downstream-capabilities.yaml` declaring `skills[0].id: custom-eager` and `load_policy: phase-entry` returned `OK: downstream-capabilities.yaml is gate-safe`; `on-failure` also returned OK.
- Purpose confirmed: ADR-007/spec/bootstrap/config define the downstream seam as present-only `custom-*` auto-activation capped at `on-match`; downstream capability declarations must not choose more eager or divergent `load_policy` semantics.
- Root Cause: `validate_downstream_capabilities.py` allowed `{"on-match", "phase-entry", "on-failure"}` while the declared ceiling is strict `on-match`; tests covered `always` only and missed `phase-entry`/`on-failure`.
- Fix: `.agentcortex/tools/validate_downstream_capabilities.py` now accepts only `on-match` (omitted still defaults to `on-match`) and reports `must be on-match`; `tests/guard/test_capabilities_schema_gate_safety.py` adds default-pass plus `phase-entry`/`on-failure` reject cases.
- Red test: `python -m pytest tests/guard/test_capabilities_schema_gate_safety.py -q` -> 2 failed, 14 passed before validator fix.
- Focused test: `python -m pytest tests/guard/test_capabilities_schema_gate_safety.py -q` -> 16 passed.
- Adjacent tests: `python -m pytest tests/ci/test_scan_credentials.py tests/guard/test_capabilities_schema_gate_safety.py tests/guard/test_credential_floor_shell.py tests/guard/test_credential_floor_ps.py tests/guard/test_precommit_hook_credential_e2e.py -q` -> 40 passed.
- Deploy tier tests: `python -m pytest tests/ci/test_deploy_tiering.py::test_downstream_adaptability_files_deploy_at_correct_tier tests/ci/test_deploy_tiering.py::test_downstream_capabilities_yaml_is_gitignored -q` -> 2 passed.
- Trigger metadata/lifecycle tests: `python -m pytest .agentcortex/tests/test_lifecycle_skill_activation.py .agentcortex/tests/test_trigger_registry_format.py .agentcortex/tests/test_trigger_metadata_tools.py -q` -> 88 passed.
- Clean-fix-clone validators with the two changed files overlaid: `bash .agentcortex/bin/validate.sh` -> Summary: pass=94 warn=3 fail=0 skip=2; `validate.ps1` -> Summary: pass=94 warn=3 fail=0 skip=2.
- Downstream smoke: deployed current tree to temp downstream; `load_policy: phase-entry` -> downstream `validate.sh` fail=1 with the expected gate-safety failure; omitted `load_policy` -> downstream `validate.sh` pass=83 warn=2 fail=0 skip=3.
- Security scan: `python .agentcortex/tools/scan_credentials.py --range v1.5.3..HEAD` -> clean (exit 0, no output).
- Diff: 2 files changed, 9 insertions, 2 deletions; `git diff --check` -> clean.
- Gate: implement | Verdict: PASS | Classification: quick-win | Timestamp: 2026-06-14T00:00:00+08:00
- Gate: test | Verdict: PASS | Classification: quick-win | Timestamp: 2026-06-14T00:00:00+08:00

## Expert Confirmation 2026-06-14 Capability Ceiling Fix

- Governance/architecture reviewer: PASS — original purpose is present-only, opt-in, gate-capped downstream `custom-*` registration; strict `on-match` only is the correct direction. No blocking issue. Non-blocking note: if downstream later wants failure-diagnostic custom skills, that needs a separate ADR/schema capability, not ADR-007 `skills[].load_policy`.
- Security/abuse-path reviewer: PASS — allowing `phase-entry` would let a private downstream file promote custom skill influence to every phase entry; allowing `on-failure` creates failure-path activation outside the capped seam. No blocking security issue. Non-blocking doc note: old ADR/spec wording says capped/clamped, while implementation now rejects over-cap.
- Test/compatibility reviewer: PASS — tests cover default pass, explicit `on-match` pass, and `phase-entry`/`on-failure` reject; legal downstream usage is not harmed. No blocking issue.
- Decision: keep current 2-file fix; do not expand into frozen spec/accepted ADR wording in this hotfix. The executable contract is enforced by validator + regression tests.
- Gate: review | Verdict: PASS | Classification: quick-win | Timestamp: 2026-06-14T00:00:00+08:00
