mirror of
https://github.com/affaan-m/ECC.git
synced 2026-09-09 03:07:57 +02:00
754b8dd76c
* fix: make the installer runtime pass strict supply-chain vetting
Remediate the four enterprise supply-chain vetting blockers from
affaan-m/ECC#2502 so the installer runtime (package.json + manifests +
scripts/lib/**) passes strict exact-pin evidence policy:
1. Remove the package.json `postinstall` lifecycle script (it only echoed a
post-install banner) and move that banner to an explicit opt-in
`npm run welcome` command. No install-time lifecycle script remains.
2. Exact-pin every dependency in package.json (dependencies + devDependencies)
to the versions already resolved in package-lock.json; no ^/~ ranges.
3. Replace non-ASCII characters on the installer runtime script/config surface:
em-dashes (U+2014) in scripts/lib/{path-safety,install-executor,
install/link-rewrite}.js comments and the two "Itô" (U+00F4) occurrences in
manifests/{install-components,install-modules}.json descriptions become
ASCII, so strict-surface Unicode scanners are clean.
4. Drop the bare `require("ajv")` from scripts/lib/install-state.js; the file
already carries a complete hand-rolled validator enforcing the same
schemas/install-state.schema.json (ecc.install.v1) constraints, so the
installer closure is dependency-free (zero non-builtin bare requires).
Refs affaan-m/ECC#2502
* fix: avoid unpinned welcome invocations
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: validate translated skill frontmatter
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: repair skill frontmatter YAML
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: add MIT license to core skill manifests; pin verification-loop tsc invocation
* fix: preserve tsc/pyright exit status in verification-loop type-check (set -o pipefail)
* chore(deps): sync lockfiles with exact-pinned package.json
Regenerate package-lock.json and yarn.lock so the pinned dependency
specs are reflected in both lockfiles. npm ci and Yarn's --immutable
install now pass the sync check. The resolution tree is unchanged
(231 yarn resolutions, byte-identical set; zero npm transitive drift);
only the root descriptor strings move from ranges to the versions
already resolved in the committed lockfiles.
Addresses the Codex P1 on #2503.
---------
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
Co-authored-by: Samarjeet Singh Tomar <samartomar@gmail.com>
2.5 KiB
2.5 KiB
name, description, license, metadata, tools
| name | description | license | metadata | tools | ||
|---|---|---|---|---|---|---|
| recursive-decision-ledger | Use when the user asks for repeated rollouts, marked decision processes, high-dimensional search, stochastic optimization, local-optima exploration, ensemble comparison, or recursive reasoning with a visible evidence trail. | MIT |
|
Read, Write, Edit, Bash, Grep, Glob |
Recursive Decision Ledger
Use this skill when the user is trying to force deeper computation through repeated rollouts or "Prime Gauss" style recursive prompting. Preserve the useful part: repeated trials, prior memory, fresh information, and explicit marks. Remove the unsafe part: pretending the loop proves certainty.
Ledger Contract
Every rollout should record:
- rollout id and timestamp;
- prior accepted winner and prior watchlist;
- fresh information ingested;
- search space size;
- model families or heuristics used;
- trial count and effective trial count;
- top candidates;
- decision marks;
- coherence marks against the prior ledger;
- promotion gate result.
Prefer JSONL for append-only ledgers and Markdown for human summaries.
Rollout Loop
- Load the prior ledger.
- Capture new information at time-step zero.
- Run the bounded search.
- Mark each candidate: accept, watch, reject, decay watch, or needs replay.
- Compare winners against prior winners and latest marked rollout.
- Downgrade candidates when drift, tail risk, stale data, or failed replay invalidates the previous mark.
- Append artifacts before summarizing.
Coherence Mark
Include a compact coherence mark:
Ensemble matches prior winner: true
Recursive matches prior winner: false
Latest rollout match: true
Live promotion allowed: false
Reason: replay and freshness gates not satisfied
Promotion Rules
For trading, capital allocation, production deploys, migrations, or destructive ops, recursive confidence is not approval.
Default to paper, dry-run, read-only, preview, or staged mode unless the user explicitly approves the live action and the repo/service gate supports it.
Promote only when:
- the candidate beats the prior accepted winner on the chosen metric;
- correctness and replay checks pass;
- risk limits are explicit;
- the evidence is durable;
- the user has approved the live step when needed.
Summary Shape
Lead with the decision, not the drama:
Rollout 15 complete. The prior winner still holds, but edge deteriorated 17%.
Status: watch, not live. Next gate: 20 replay fills with fresh orderbook age
below threshold.