Skip to content

fix(sleep): four evidence-integrity fixes from #310 - #392

Merged
Yifan Yang (Yif-Yang) merged 5 commits into
mainfrom
maintenance/pr310-evidence-fixes
Nov 10, 2026
Merged

Yifan Yang (Yif-Yang) merged 5 commits into
mainfrom
maintenance/pr310-evidence-fixes

Conversation

@Yif-Yang

Copy link
Copy Markdown
Contributor

Splits the four evidence-integrity fixes out of #310 by Bogdan (Dan) Baciu (@bogdanbaciu21) so they can land now. The fifth change in #310, the harvest marker that also drops ordinary sessions quoting the grader prompt, stays in #310 for follow-up.

The four commits are cherry-picked unchanged from #310 (-x records each origin) and keep Dan as the author:

  1. Recall cannot bring a held-out task's content twin into training. Recall blocked held-out tasks by id only. Ids hash project and intent, and the archive is shared across projects, so another project's copy of tonight's val task could be recalled into training.
  2. A measured tool route no longer credits a self-reported TOOL_CALL: marker. When the tool loop measured no call, the rule judge fell back to a regex over the response text and passed anyway.
  3. Judge scores outside 0..1 fail closed. NaN, Infinity and other-scale replies are rejected instead of moving the gate.
  4. Learned items survive apply_edits round-trips.

One maintainer commit on top:

  • Since fix(sleep): refuse uncontrolled Claude OAuth replays #336, a Claude replay without ANTHROPIC_API_KEY probes the CLI for --safe-mode; otherwise it refuses. The tool-route regression test now sets a test key, so it exercises the measured tool route rather than the isolation guard.
  • Adds the CHANGELOG entry.

Verification on current main (ccfdcdf7ab50):

  • New tests fail on main: 4 failures in the tool-evidence tests, 7 in the judge-contract tests and 5 in the round-trip tests; the recall-twin test cannot import on main.
  • Full suite here: 2127 passed, 13 skipped, 4 xfailed, 8 warnings, 381 subtests passed in 52.68s.
  • Docs and lint: strict docs pass, and ruff finds nothing new in the touched files.

Refs #310.

recall_similar blocked tonight's held-out tasks by id only. Ids hash the
project with the intent and the recall archive is shared across projects,
so another project's copy of tonight's val task was recalled into training
under a different id. The leak check in _split was id-based too, so the
gate certified the result: in a two-project cycle the verdict flipped from
reject to accept_new_best with holdout_leaked=False.

- task_content_key(): normalized intent plus context excerpt
- recall_similar(exclude_tasks=...) blocks archived tasks whose content key
  matches a held-out task; dream_consolidate passes tonight's val/test tasks
- _split treats a val task with a content twin in train as leaked, so the
  existing reject_unverified abstention applies on any route

Follows up the content-hash hardening listed as a non-goal in #235.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 745807c)
…l route

Tool-loop backends detect real calls (for example from the search shim's
call log) and return an empty tools_called when the agent never ran the
tool. The rule judge then fell back to a TOOL_CALL marker regex over the
response text and passed the check anyway, undoing the verification one
step later: a Claude replay whose shim log was empty scored 1.0.

- _check / score_rule_judge(_with_feedback) take verified_tools; when set,
  only measured calls satisfy tool_called
- replay_one sets it for tool tasks, which always go through
  attempt_with_tools; the inherited marker fallback still converts markers
  into calls there, so single-shot backends are unchanged
- optimizer feedback for a self-reported call asks for a real call
- unmeasured single-shot judging keeps the documented marker approximation

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit c1164b5)
The judge prompt asks for a 0..1 score, but CliBackend.judge accepted any
float, including NaN and Infinity (json.loads parses both) and replies on
another scale. On the default mixed gate metric, one out-of-range soft score
let a candidate with flat hard accuracy and a 1.0 -> 0.0 regression read as
0.625 -> 0.750 and be accepted.

Scores must now be finite and within [0, 1]; anything else fails closed as
judge-score-out-of-range with the raw value in the rationale. Clamping was
rejected because it would turn an 8/10 reply into a perfect 1.0. Boolean
scores fall through to judge-parse-failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 6de589a)
The learned block is read back one "- " bullet per item, but set_learned
wrote items verbatim. A multi-line item lost every continuation line the
next time any edit was applied; a "- X" add slipped past the duplicate check
for an existing "X"; and lstrip('- ') removed leading dashes such as
"--force". Losing adopted text changes what the gate scores: a helpful edit
was rejected (0.5 vs 0.5) because applying it silently deleted an adopted
rule held on a continuation line.

- _learned_item(): one item is one line (whitespace collapsed) with exactly
  one leading bullet marker removed; used for add, replace and set_learned
- current_learned_lines joins continuation lines of blocks written by
  earlier versions onto their item instead of dropping them

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit e3c5c56)
…n CHANGELOG

Since #336, a Claude replay without ANTHROPIC_API_KEY probes the CLI for --safe-mode and otherwise refuses. Set a test key so the self-reported marker test exercises the measured tool route instead of the isolation guard. Add the CHANGELOG entry for the four #310 fixes.
@Yif-Yang
Yifan Yang (Yif-Yang) merged commit 3ae30a4 into main Nov 10, 2026
13 checks passed
@bogdanbaciu21

Copy link
Copy Markdown
Contributor

Thanks so much. Appreciate it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants