hermes/cto
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Approve OpenAI Codex provider decision

Browse Source
This commit is contained in:
Svrnty
2026-05-31 21:34:00 -04:00
parent 19e7766c1a
commit 03c87d437b
7 changed files with 114 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/validate_cto_child.py
+45 -20
View File
@@ -403,7 +403,7 @@ REQUIRED_MODEL_PROVIDER_ADMISSION_PRD_PHRASES = [
"`CTO-WORK-020` remains blocked because no real provider/model has been approved and no real Case Stage 2 pass report exists.",
"Decision Record Template For CTO-WORK-020",
"`decision_status`: `not_decided`, `external_provider_approved`, or `local_provider_required`.",
"`provider_class`: `external_anthropic` or `local_case_compatible`.",
"`provider_class`: `external_anthropic`, `external_openai_codex`, or `local_case_compatible`.",
"`provider`: exact provider string, or empty while blocked.",
"`model`: exact model string, or empty while blocked.",
"`approval_source`: JP approval reference or governed Core route reference.",
@@ -445,7 +445,7 @@ REQUIRED_MODEL_PROVIDER_ADMISSION_ISSUE_PHRASES = [
"CTO-WORK-020 Decision Record Template",
"This template belongs to `CTO-WORK-020`; it is not a new provider approval.",
"`decision_status`: `not_decided`, `external_provider_approved`, or `local_provider_required`.",
"`provider_class`: `external_anthropic` or `local_case_compatible`.",
"`provider_class`: `external_anthropic`, `external_openai_codex`, or `local_case_compatible`.",
"`provider`: exact provider string, or empty while blocked.",
"`model`: exact model string, or empty while blocked.",
"`approval_source`: JP approval reference or governed Core route reference.",
@@ -491,7 +491,6 @@ REQUIRED_LOCAL_PROVIDER_ROUTE_ISSUE_IDS = [
REQUIRED_LOCAL_PROVIDER_ROUTE_ISSUE_PHRASES = [
"Status: validated.",
"Status: blocked.",
"`decision_status=local_provider_required`",
"local_case_compatible",
"Uses `CTO-WORK-020` admission JSON gate as authority instead of redefining admission.",
@@ -528,6 +527,10 @@ REQUIRED_PROVIDER_DECISION_PACKET_PRD_PHRASES = [
"real Case Stage 2 blocked unless a provider/model is admitted and a pass report exists through the Harness Evidence Interface",
"no Target Repository path may be inspected or copied",
"`provider_class`: `external_anthropic`",
"`provider_class`: `external_anthropic` or `external_openai_codex`.",
"`openai-codex` with model `gpt-5.5` may be recorded as the primary approved external provider only when the approval source, credential source class, allowed network class, review trigger, and admission JSON are recorded.",
"`vllm` with model `qwen3.6-35b-a3b` may be recorded as an explicit fallback only when fallback use is represented in admission evidence and does not hide provider/model switching.",
"Packet permits provider class `external_openai_codex` only as a decision branch, not as admission or Stage 2 proof.",
"`provider_class`: `local_case_compatible`",
"No external fallback to `anthropic` or `claude-sonnet-4-6` is allowed.",
"Missing local adapter config blocks before `case_process_started`.",
@@ -538,11 +541,11 @@ REQUIRED_PROVIDER_DECISION_PACKET_ISSUE_IDS = [
"CTO-WORK-023",
"CTO-WORK-024",
"CTO-WORK-025",
"CTO-WORK-026",
]
REQUIRED_PROVIDER_DECISION_PACKET_ISSUE_PHRASES = [
"Status: validated.",
"Status: blocked.",
"`not_decided` is current safe state",
"`external_provider_approved`",
"`local_provider_required`",
@@ -575,32 +578,53 @@ REQUIRED_PROVIDER_DECISION_PACKET_ISSUE_PHRASES = [
"Record keeps `CTO-WORK-024` blocked while `decision_status=not_decided`.",
"Record keeps `CTO-WORK-022` blocked unless `decision_status=local_provider_required`.",
"Record keeps real Case Stage 2 blocked until admitted provider/model and Harness Evidence Interface pass report exist.",
"Status: validated.",
"Record JP approval of the external provider decision branch for the current Hermes model stack.",
"Decision record has `decision_status`: `external_provider_approved`.",
"Decision record has `provider_class`: `external_openai_codex`.",
"Decision record has `provider`: `openai-codex`.",
"Decision record has `model`: `gpt-5.5`.",
"Decision record has `fallback_provider`: `vllm`.",
"Decision record has `fallback_model`: `qwen3.6-35b-a3b`.",
"Decision record has `credential_source_class`: `hermes-openai-codex-oauth-and-local-vllm-config`; no secret value.",
"Decision record has `allowed_network_class`: `codex-oauth-hosted-model-plus-local-vllm-fallback`.",
"Decision record references Hermes model policy and local Hermes config as evidence sources without copying secrets.",
"Record says `CTO-WORK-024` is resolved by selecting `external_provider_approved`.",
"Record keeps `CTO-WORK-020` blocked until admission JSON and real Stage 2 pass evidence exist.",
"Record keeps `CTO-WORK-022` blocked because `decision_status=external_provider_approved`, not `local_provider_required`.",
"Record requires fallback to `vllm` with `qwen3.6-35b-a3b` to be explicit in admission evidence before it may count as a Case provider/model path.",
]
REQUIRED_PROVIDER_DECISION_RECORD_PHRASES = [
"Local planning SOT only. Not a Core Protocol. Not active Core authority.",
"`decision_status`: `not_decided`.",
"`provider_class`: empty while blocked.",
"`provider`: empty while blocked.",
"`model`: empty while blocked.",
"`approval_source`: empty while blocked.",
"`credential_source_class`: empty while blocked; no secret value.",
"`allowed_network_class`: empty while blocked.",
"`review_trigger`: empty while blocked.",
"`decision_status`: `external_provider_approved`.",
"`provider_class`: `external_openai_codex`.",
"`provider`: `openai-codex`.",
"`model`: `gpt-5.5`.",
"`fallback_provider`: `vllm`.",
"`fallback_model`: `qwen3.6-35b-a3b`.",
"`approval_source`: JP chat approval on 2026-05-31.",
"`credential_source_class`: `hermes-openai-codex-oauth-and-local-vllm-config`; no secret value.",
"`allowed_network_class`: `codex-oauth-hosted-model-plus-local-vllm-fallback`.",
"`review_trigger`: before real Case Stage 2 admission JSON is written, before any credential source change, and before any default/fallback model change.",
"/home/svrnty/workspaces/hermes/scripts/apply-hermes-model-policy.py",
"/home/svrnty/.hermes/config.yaml",
"`effect`: `CTO-WORK-020 remains blocked until admitted provider/model and real Stage 2 pass report exist`.",
"`external_provider_approved` means JP approved the provider decision branch for the existing Hermes model stack: `openai-codex` with model `gpt-5.5` as primary, and `vllm` with model `qwen3.6-35b-a3b` as fallback.",
"This record is not provider/model admission and is not Stage 2 pass evidence.",
"`CTO-WORK-024` is resolved by this record selecting `external_provider_approved`.",
"Previous state:",
"`decision_status`: `not_decided`.",
"`not_decided` means no provider/model may run.",
"not provider/model admission, not Stage 2 pass evidence, and not approval for external or local provider use",
"`CTO-WORK-024` remains blocked because this record does not select `external_provider_approved` or `local_provider_required`.",
"Only JP or a governed Core route may change this record away from `not_decided`.",
"`external_provider_approved`.",
"`local_provider_required`.",
"Only JP or a governed Core route may change this record away from `external_provider_approved`.",
"Allowed future values remain `external_provider_approved` or `local_provider_required`.",
"No secret value may appear in SOT, task file, argv, report, trace, backend logs, generated config, or commit.",
"No Target Repository path may be inspected or copied.",
"`CTO-WORK-020` remains provider/model admission authority.",
"`CTO_HARNESS_CASE_MODEL_ADMISSION_FILE` remains execution admission gate.",
"`CTO-WORK-024` remains blocked while `decision_status=not_decided`.",
"`CTO-WORK-022` remains blocked unless `decision_status=local_provider_required`.",
"`CTO-WORK-022` remains blocked because `decision_status=external_provider_approved`, not `local_provider_required`.",
"Real Case Stage 2 remains blocked until admitted provider/model and Harness Evidence Interface pass report exist.",
"Fallback to `vllm` with `qwen3.6-35b-a3b` must be explicit in admission evidence before it may count as a Case provider/model path.",
"Existing evidence paths and commits are referenced only; runtime evidence is not copied into this record.",
]
@@ -941,8 +965,9 @@ def main() -> int:
"CTO-WORK-021": "validated",
"CTO-WORK-022": "blocked",
"CTO-WORK-023": "validated",
"CTO-WORK-024": "blocked",
"CTO-WORK-024": "validated",
"CTO-WORK-025": "validated",
"CTO-WORK-026": "validated",
}
for issue_id, expected in expected_statuses.items():
checked.append(f"workboard_status:{issue_id}:{expected}")