arcodangeandClaude Opus 5
1cba032512
Migration applied to production, in the only order that does not break the promote flow: 1. Created `ai_agent_prod_prod_write` (id=5) with the narrow `prod-write` scope — invoices, payments, and document submission (needed by builddoc to regenerate a modified invoice's PDF). Verified functionally: reads pass, DELETE on an invoice returns 403. 2. Repointed the promote pipeline at that user's key. It no longer borrows the read skills' credential; if the key is absent it dies with the provisioning command rather than silently falling back. 3. Revoked 12 write/delete rights from `ai_agent` (id=3), the credential every read skill holds: create/modify on customer AND supplier invoices, thirdparties, contacts, thirdparty payment details, proposals, exports, accounting links — and delete on proposals, events, and GED documents. Verified after: invoices, thirdparties, contacts, products, proposals, supplier invoices and bank accounts all still read; creating an invoice returns `403 Forbidden: Insuffisant rights`. The documented posture and the real one finally agree. scopes.ts corrected against the live instance: 262 is NOT "créer/modifier les produits" as the first catalogue guessed but the `voir_tous` ACL extension — a READ right the skills depend on (without it, list endpoints return empty arrays instead of 403). Revoking it would have silently blinded every read skill. This is why the audit reads labels off /user/perms.php rather than trusting ids in code. The READ_ONLY baseline is now the audited read surface (35 rights), not a guess. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01VRShc4QhLLU73FLHx9vskh
fleet/harness/promote/ — the gated pipeline
Rehearse on the sandbox → an independent agent judges → a human decides → production → a second agent verifies what actually landed.
Why this exists as code
The discipline was already written down — ADR-0003,
the operating rules in AGENTS.md, the promote flow — and it
still depended on whoever was driving choosing to follow it. On 2026-07-25 an
agent session wrote five documents into the production ledger through direct API
calls, bypassing the promote flow entirely. Nothing was wrong with the result;
everything was wrong with the path. A rule an operator can skip is a
recommendation.
So the stages here are chained by artefacts, not by good intentions. Each stage refuses to run until the previous one has produced its file, and the file has to say what the stage needs to hear:
| Stage | Produces | Refuses unless |
|---|---|---|
1 rehearse |
01-rehearsal.json |
the target is the sandbox (host-guarded) |
2 judge --pre |
02-pre-verdict.json |
a rehearsal exists and its writes succeeded |
3 gate |
03-gate.json |
a pre-verdict exists; a human types the decision |
4 apply |
04-applied.json |
the gate says approved, by a named human, for this manifest |
5 judge --post |
05-post-verdict.json |
production was applied |
The gate binds to a manifest digest: approving a change-set approves that change-set. Edit one amount afterwards and stage 4 refuses — the approval no longer matches what is about to be written.
The two judges
Both are context-free: they receive the manifest and the evidence, never the
conversation that produced them. Per the PRD
cross-family rule,
a judge SHOULD be a different model family than whoever built the change-set —
the admitted runtimes are Mistral (vibe -p) and Ornith 35B (hermes MLX), both
proven at verdict parity in erp#63.
- Pre-gate — prompted to refuse: find why this change-set is not safe to
promote. It reads the rehearsal evidence, not a description of it. Its verdict
goes to the human as an opinion, not a veto: a
BLOCKstill lets the operator approve, and the override is recorded in the gate file. - Post-gate — prompted to doubt the success: compare what production now holds against what the sandbox rehearsal predicted, and report drift. It runs after the writes, so it cannot prevent them — it exists so a silent discrepancy becomes a recorded finding instead of a surprise months later.
Judges are advisory by design. The blocking authority is the human gate and the host guards; an LLM verdict never silently stops or starts a production write.
Usage
P=fleet/harness/promote/pipeline.py
python3 $P rehearse --manifest changeset.json --run-dir runs/2026-07-24-m3-deferred
python3 $P judge --run-dir runs/... --stage pre --runtime mistral
python3 $P gate --run-dir runs/... # interactive; records who and when
python3 $P apply --run-dir runs/... # needs ARCO_PROD_CONFIRM
python3 $P judge --run-dir runs/... --stage post --runtime ornith
Every stage appends to journal.jsonl. The run directory is the evidence pack:
it is what you keep, and what an auditor reads.
What this does not do
It does not replace the host guards (dol-write.sh refusing non-sandbox hosts,
guard.ts requiring an explicit production opt-in, the chronology guard in
invoice-create.sh). Those are structural and stay underneath. This pipeline
adds sequence and evidence on top of them.