v0.9.7 — methodology reframe: swarm-over-Workflows, maturity-led README, skill self-scan - #20
Merged
Conversation
Wave 3 bounded items (the non-overlapping, low-risk ones). D3 Phase 2 — dogfood the injection defense. scripts/self-scan-skills.py runs ADD's own distributed injection patterns (core/security/patterns.json) against ADD's shipped artifacts (skills/rules/templates/knowledge/references/lib), using the SAME engine as the runtime hook (grep -E for ERE patterns, byte-mode regex for the Unicode tag-channel pattern). Fails on any critical/high match outside a small allowlist of files that legitimately document patterns. Verified: clean on all ~60 artifacts today, exit 1 when a poisoned artifact is introduced. Wired as the `skill-self-scan` guardrail job; documented as a trust signal in SECURITY.md. A2 scaffold — establish runtimes/claude/workflows/ as the home for native Claude Workflow lifecycle scripts, with a README documenting the planned scripts and the policy->mechanism mapping, plus specs/workflow-lifecycle-scripts.md (Draft). Deliberately inert: no script implemented, nothing wired to a skill, nothing compiled — compile --check stays clean, zero behavior change. self-scan clean; compile --check clean; all 15 suites pass.
Wave 3, dependency-first item. Adds a Format Contract subsection to swarm-protocol.md's Swarm State Coordination: entry delimiter (H2 blocks), agent-role/timestamp conventions, a required/optional field table, the status enum, and a forward-compatible parsing rule (unknown keys ignored; field meanings stable without a version bump). This is the stable interface the A1 policy/mechanism reframe and any native-Workflow journaled state build on. compile --check clean; self-scan clean; all 15 suites pass.
Independent verification of the v0.9.7 self-scan found it had the exact bug it
exists to prevent: a check that silently doesn't check.
- (?m)-prefixed patterns (new-instructions-heading [HIGH — the most common
documented skill-marketplace payload] and system-heading) were handed to
grep -E verbatim, which rejects inline (?m) as invalid (rc=2). file_matches
treated rc=2 the same as "no match", so both patterns silently never gated.
Fix: strip leading (?i)/(?m) in any order, mirroring the hook's
normalize_regex(); validate every ERE pattern once at startup and WARN loudly
(not silently skip) if grep rejects it; treat rc>=2 as an error.
- Allowlist was over-broad: 3 of 5 whole-file exemptions trapped files that trip
nothing (pure blind spots), and the 2 real ones hid ALL patterns including a
critical one planted in auto-loaded behavioral content. Replace with precise
per-(file,pattern) waivers, derived from a no-waiver scan: threat-model.md
waives {system-tag,instruction-tag,new-instructions-heading};
injection-defense.md waives {system-tag,instruction-tag}. Coverage 60 -> 64
artifacts; the previously-exempt files are now actually scanned.
- Add --root so the gate is testable, and tests/security/test-self-scan.sh:
mutation-proves each engine path (ERE + (?m) + byte-mode) catches a planted
payload and that no pattern is silently disabled. Reverting the (?m) fix turns
it red. Registered in the guardrail matrix.
self-scan clean (0 un-waived); compile --check clean; all 16 suites pass.
…approval Maintainer decision (2026-06-14) overriding roadmap D7. The fixed 60-day calendar gate is replaced by Anthropic marketplace approval (criterion #5) + the substantive criteria (#1-#4, #6) as the binding constraint. The marketplace review provides a real-world stabilization window; the install-smoke and beta-evidence-bundle criteria remain the regression safeguard. Recorded in v1.0-roadmap.md D7 and milestones/v1.0-ga.md.
…ME with maturity ladder (D4)
Wave 3 strategic items, maintainer-greenlit.
A1 — swarm-protocol.md + agent-coordination.md reframed: ADD owns the POLICY
(concurrency/WIP, conflict assessment, role briefs, merge ordering,
trust-but-verify, swarm-state); the orchestration MECHANISM (parallel dispatch,
worktree isolation, step schemas, budgets) is delegated to the runtime — native
Claude Dynamic Workflows / Codex TOML sub-agents — with the manual recipes
retained as the fallback. Positioning shift: "ADD coordinates swarms" -> "ADD is
the methodology layer that configures native orchestration" (answers the
native-absorption risk E1/E8). Per maintainer scope: docs/positioning reframe
now; actual Workflow-descriptor emission deferred to the A2 pilot (v1.1). WIP
semantics (poc=1..ga=5) and trust-but-verify are invariant.
D4 — README now leads with the maturity ladder as the hero moat ("One dial
scales the rigor"; trust-gradient framing), with the "chaos" line kept as
secondary and a maturity-led principle ahead of the existing six. The deeper
maturity section stays for full detail.
Drafts preserved in docs/wave3-drafts/ (A1, D4 applied; C4 launch plan tracked
for the /add:announce + GA-launch work, not yet applied).
compile --check clean; self-scan clean; all 16 suites pass.
The self-scan had the exact 'check that doesn't check' bug it guards against; whole-file security allowlists are blind spots; per-wave independent verification catches what implementer self-testing structurally misses.
…A-gate decision recorded
VERSION 0.9.6 -> 0.9.7; .add/config.json; README badge; migrations.json plugin_version + 0.9.6->0.9.7 hop; CHANGELOG [0.9.7] section authored from the Wave 3 work. Recompiled: plugin.json + all [ADD vX.Y.Z]/heading substitutions read v0.9.7. compile --check clean; validators pass; self-scan clean; 16/16.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 3 of the v1.0 GA plan (v0.9.7 methodology stream). Bounded items built solo; strategic items (A1, D4) maintainer-greenlit from review drafts. Each item: independent verifier + agent-to-agent retro; learnings L-047…L-049.
Items
swarm-protocol.md(the stable interface A1/Workflow state build on).scripts/self-scan-skills.py) runs ADD's injection patterns against ADD's own shipped artifacts on every CI run (skill-self-scanjob), using the same engine as the runtime hook. Verification caught a real hole — a(?m)pattern was handed togrep -Eas invalid and silently never gated (the most common documented payload). Fixed: strip(?m)/(?i), validate every pattern is live + WARN loudly, precise per-(file,pattern) waivers. Mutation-guarded bytests/security/test-self-scan.sh.runtimes/claude/workflows/scaffold +specs/workflow-lifecycle-scripts.md(Draft). Deliberately inert — zero behavior change, nothing compiled.swarm-protocol.md+agent-coordination.mdreframed as policy over native Workflows: ADD owns policy (WIP/concurrency, conflict assessment, role briefs, merge ordering, trust-but-verify, swarm-state); orchestration mechanism delegated to Claude Dynamic Workflows / Codex sub-agents; manual recipes retained as fallback. WIP semantics (poc=1…ga=5) and trust-but-verify invariant. Descriptor emission deferred to v1.1.All 16 fixture suites pass;
compile --checkclean; self-scan clean. Version bump to v0.9.7 lands in a follow-up commit on this branch.🤖 Generated with Claude Code