feat: add admin Harness fleet protocol - #24
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
risk:agent-behavior
EvoZeus Labeler ReportPR type/risk labels were updated from changed files. Surfaces
Labels
Changed lines
|
EvoZeus Proof GateMode: dry-run Proof labels
Missing or weak fields
Next action
|
EvoZeus Auto ResponseMissing real behavior proofThis PR needs real behavior proof before review can continue. Add the command, environment, input, output after the patch, observed result, and what was not tested. |
EvoZeus Privacy ScanMode: dry-run Findings
Next action
|
github-actions
Bot
added
triage:dirty-pr
EvoZeus Dirty PR CheckMode: dry-run Surfaces
Reasons
Next action
|
EvoZeus Queue GuardMode: dry-run Author open PRs: 2 Branch family: codex/dev/20260729-skill-harness-upgrade-all Branch family open PRs: 1 Violations
Next action
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8a11307f7b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| channel: "development", | ||
| version: coevolveHarnessVersionAt(readiness.detected_path, operation), | ||
| root: readiness.detected_path |
There was a problem hiding this comment.
When channel-state.json has no Stable entry, this fallback labels the resolved environment or sibling checkout as development, and harnessUpgradeAll still passes --publish to it. Thus EVOZEUS_WRAPPER_ROOT can point at an arbitrary development tree and harness upgrade-all --publish will create fleet PRs from that tree, despite SKILL.md requiring every published update to come from installed, verified Stable and forbidding distribution of development files. Permit this fallback only for dry-run testing, and reject publication unless the source channel is Stable.
Useful? React with 👍 / 👎.
1 participant
Instruction surface changed
Root SKILL.md now declares EvoZeus Harness fleet maintenance as a first-class trigger and execution protocol. The product CLI adds read-only planning and explicit admin publication.
Why this change is needed
Historical Skills can keep outdated Harness copies, while users need one EvoZeus command to inspect and align all registered repositories without manually editing each Skill.
Agent behavior before / after
Before: root Skill only contained one routing sentence and did not define channel, permission, isolation, failure, or audit behavior.
After: root Skill requires read-only planning first, Stable-only Harness sources, live ADMIN checks, isolated worktrees, per-repo PRs, partial failure isolation, ledger output, and separate authorization for merge or release.
Safety boundary
Prompt injection risk
Target repository content cannot grant publication authority. GitHub viewerPermission and the current user request are authoritative.
Rollback plan
Revert the three focused commits and switch users back to Stable. Target PRs remain independently reviewable and are never auto-merged.
Versioning
Review State
Next action: review EvoZeus-CoEvolve PR #31, then this PR.
Open reviewer questions: none.
Supersedes closed PR #23 after correcting the branch naming contract.