spec shell_allowlist was correctly bypassing the executor-level policy
check but the command then routed through TOOL_REGISTRY → ShellTool
which has its own independent policy check that fired again and denied.
Added third condition to use_direct_dispatch: when _skip_policy_shell
is True the executor already validated the command, so force direct
dispatch to skip the tool-level re-check entirely.
BLK-CM-DUALPASS-001: dual-pass outcome recording with three-factor SNN learning
WorkerEcosystem proxy in worker_ng.py implements record_outcome() using
on_message() (STDP eligibility traces, factors 1+2) + inject_reward()
(factor 3) — first activation of three_factor_enabled=True.
record_tool_outcome() wired into spec_executor.py after each step
validation result. Silent on failure. Law 7 compliant.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
work_block_schema.py: _FAILURE_HANDLER now uses oneOf — accepts both string
shorthands ("abort", "skip", "continue", etc.) and the full object form
{"action": "abort_block"}. Easier spec authoring without breaking existing specs.
spec_executor.py: _handle_failure normalizes string shorthands to dict at
entry so execution works regardless of which form the spec uses.
spec_executor.py: edit_file in _direct_filesystem_op now returns new file
content instead of a confirmation string, enabling contains/not_contains
validation checks on the result of an edit.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- spec_executor.py: resolve relative paths against workspace (not CWD),
strip leading env var assignments before binary check (e.g. PYTHONPATH=/)
- policy_engine.py: direct dispatch tool set (read/write/edit/shell_execute/
notebook_add), shell_execute now validates non-empty command before dispatch
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Gap 1: Spec-declared workspace now bypasses tool-level path checks for
filesystem ops. Direct filesystem operations when workspace differs from
default, executor's own PolicyEngine check is sufficient.
Gap 2: shell_allowlist in spec constraints extends PolicyEngine's base
allowlist per-spec. Specs can allow additional commands without weakening
global security.
Gap 3: New edit_file tool — targeted find-and-replace. Reads file, verifies
old_text exists exactly once, replaces with new_text. Safer than full
overwrite for cross-repo work. Wired through PolicyEngine, TOOL_REGISTRY,
facade, and spec schema.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add structured work block spec executor for QB → Codemine handoff
New files:
- work_block_schema.py: JSON Schema for WorkBlockSpec with mandatory
validation blocks on every action step and on_failure handlers
- spec_executor.py: Deterministic execution engine — no LLM in the loop,
mechanical step execution using existing TOOL_REGISTRY and PolicyEngine
Five step types: action, gate, condition, loop, group
Variable bindings ($var) for passing results between steps
Constraint enforcement: tool allowlist, max iterations, timeout
Structured execution reports for QB consumption
Also:
- New Spec tab in Gradio UI for executing specs
- Audit trail logged to data/audit/blocks.jsonl
- jsonschema added to requirements
- Dockerfile updated with new files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
