Q2: Refuse oversized final briefs without dropping mandatory input #796

Merged

toasterson merged 6 commits from fix/q2-final-brief-budget-20261019 into main

2026-10-19 16:07:49 +00:00

toasterson commented

2026-10-19 08:20:56 +00:00

Owner

Q2 — Bound the complete rendered assignment without losing requirements

The old pseudo-split dropped an oversized intent with no file references and amplified it when references existed, then concatenated every chunk into one assignment. Late supplemental text/contracts and legacy reviewer diffs escaped the budget. This change preserves mandatory content and returns a typed brief_oversized refusal when the final rendered input cannot fit.

The shared check runs after central contract/capability rendering, before legacy reviewer claim, and before prompt upload. Legacy implementation now keeps provisional allocation/recovery consumption transactional until final validation; refusal rolls back ownership and preserves pending supplemental text. Legacy stored review patches stay complete and can be refused, rather than silently clipped. Below-budget intent/requirements remain unchanged.

The default 400,000-byte limit is an explicit application policy, not a universal model window. Optional declared context limits reserve system/tool/output space and use a conservative UTF-8-byte token upper bound; invalid declared limits refuse dispatch. See docs/ai/contracts/rendered-brief-budget.md. This first PR uses refusal; durable authorized evidence references belong to S2.

Validation:

cargo test -p anima-ai -p anima-server --lib --locked: 59 AI tests and 558 server tests passed (6 environment-dependent server tests ignored).
Disposable local PostgreSQL 18: legacy implementation regression verifies no assignment/session/attempt/prompt publication and complete pending-context retention after refusal; passed.
Full central staging PostgreSQL/Git/S3 fixture: oversized intent/supplemental/reviewer constraints create no upload or owner and retain full source; passed.
Regression fixtures cover the exact 400,001-byte/no-reference/two-reference reproduction, complete legacy diff tail, Unicode, late appends, exact byte boundary and declared output/system-tool reserves.
Scoped formatting, git diff --check, shell syntax; nightly groups include central staging and the dedicated ignored legacy-library regression.

Dependencies: no Akh merge/deployment required. Runtime A3's separate final provider-envelope budget complements this producer check. Q1 #795 contains identical staging-binary nightly wiring; preserve it once if both PRs are accepted. No partial assignment, live recovery, lifecycle/hold/budget reset, merge or deployment is authorized.

Solstice exact-head CI and independent AI review pending at creation. Local code/test evidence is not deployment or runtime acceptance. Do not merge: operator human gate.

Fable follow-up: Seshat network retrieval moved before the allocation transaction. Final claim/eligibility and pending supplemental reads remain locked. Regression uses an actual HTTP service and a second PostgreSQL connection to acquire project, WI, allocation and Q1 provider locks during retrieval and verify zero provisional sessions. Test passed against dependency Q1#795 head465f8fe9f (ordinary merge commit, no history rewrite). Follow-up full unit suite:59AI+561server passed/7ignored. Experimental declared-context byte admission is explicitly documented; final-source refusal remains lossless.

Dependency: merge Q1#795 first; this branch includes its commits through an ordinary dependency merge, as requested for lock-scope review. No PR merge/deployment performed.

Deployment precondition: before deploying to any small-context legacy reviewer lane, set ANIMA_BRIEF_CONTEXT_TOKENS with ANIMA_BRIEF_OUTPUT_TOKENS and ANIMA_BRIEF_SYSTEM_TOOL_TOKENS reserves. The old reviewer-diff truncation is removed; a brief fitting400000bytes alone does not prove it fits that model. Declared-context mode is a conservative experimental opt-in, not measured tokenization. The branch includes current Q1 cancellation follow-up through an ordinary merge; no PR merge or history rewrite.

Integration refresh (2026-10-19): normal main/dependency merge commits, no force push. Main is 8d3eb5855f. This head also includes refreshed #795 so the agreed merge order cannot repeat the same insertion conflict; its diff narrows as predecessors land. Shell/Rust syntax, diff and predecessor-ancestry checks pass. No fresh local cargo check: available disk headroom above the 31.25 GiB floor was smaller than the last measured owned compile target. Exact new-head CI is the gate; prior receipts remain prior-head evidence.

## Q2 — Bound the complete rendered assignment without losing requirements The old pseudo-split dropped an oversized intent with no file references and amplified it when references existed, then concatenated every chunk into one assignment. Late supplemental text/contracts and legacy reviewer diffs escaped the budget. This change preserves mandatory content and returns a typed `brief_oversized` refusal when the final rendered input cannot fit. The shared check runs after central contract/capability rendering, before legacy reviewer claim, and before prompt upload. Legacy implementation now keeps provisional allocation/recovery consumption transactional until final validation; refusal rolls back ownership and preserves pending supplemental text. Legacy stored review patches stay complete and can be refused, rather than silently clipped. Below-budget intent/requirements remain unchanged. The default 400,000-byte limit is an explicit application policy, not a universal model window. Optional declared context limits reserve system/tool/output space and use a conservative UTF-8-byte token upper bound; invalid declared limits refuse dispatch. See `docs/ai/contracts/rendered-brief-budget.md`. This first PR uses refusal; durable authorized evidence references belong to S2. Validation: - `cargo test -p anima-ai -p anima-server --lib --locked`: 59 AI tests and 558 server tests passed (6 environment-dependent server tests ignored). - Disposable local PostgreSQL 18: legacy implementation regression verifies no assignment/session/attempt/prompt publication and complete pending-context retention after refusal; passed. - Full central staging PostgreSQL/Git/S3 fixture: oversized intent/supplemental/reviewer constraints create no upload or owner and retain full source; passed. - Regression fixtures cover the exact 400,001-byte/no-reference/two-reference reproduction, complete legacy diff tail, Unicode, late appends, exact byte boundary and declared output/system-tool reserves. - Scoped formatting, `git diff --check`, shell syntax; nightly groups include central staging and the dedicated ignored legacy-library regression. Dependencies: no Akh merge/deployment required. Runtime A3's separate final provider-envelope budget complements this producer check. Q1 #795 contains identical staging-binary nightly wiring; preserve it once if both PRs are accepted. No partial assignment, live recovery, lifecycle/hold/budget reset, merge or deployment is authorized. Solstice exact-head CI and independent AI review pending at creation. Local code/test evidence is not deployment or runtime acceptance. **Do not merge: operator human gate.** Fable follow-up: Seshat network retrieval moved before the allocation transaction. Final claim/eligibility and pending supplemental reads remain locked. Regression uses an actual HTTP service and a second PostgreSQL connection to acquire project, WI, allocation and Q1 provider locks during retrieval and verify zero provisional sessions. Test passed against dependency Q1#795 head465f8fe9f (ordinary merge commit, no history rewrite). Follow-up full unit suite:59AI+561server passed/7ignored. Experimental declared-context byte admission is explicitly documented; final-source refusal remains lossless. Dependency: merge Q1#795 first; this branch includes its commits through an ordinary dependency merge, as requested for lock-scope review. No PR merge/deployment performed. Deployment precondition: before deploying to any small-context legacy reviewer lane, set ANIMA_BRIEF_CONTEXT_TOKENS with ANIMA_BRIEF_OUTPUT_TOKENS and ANIMA_BRIEF_SYSTEM_TOOL_TOKENS reserves. The old reviewer-diff truncation is removed; a brief fitting400000bytes alone does not prove it fits that model. Declared-context mode is a conservative experimental opt-in, not measured tokenization. The branch includes current Q1 cancellation follow-up through an ordinary merge; no PR merge or history rewrite.  Integration refresh (2026-10-19): normal main/dependency merge commits, no force push. Main is 8d3eb5855f74c616d176b788e2ca881d2f933e3f. This head also includes refreshed #795 so the agreed merge order cannot repeat the same insertion conflict; its diff narrows as predecessors land. Shell/Rust syntax, diff and predecessor-ancestry checks pass. No fresh local cargo check: available disk headroom above the 31.25 GiB floor was smaller than the last measured owned compile target. Exact new-head CI is the gate; prior receipts remain prior-head evidence.

toasterson added 1 commit

2026-10-19 08:20:58 +00:00