feat!: ship-check Gate 5 re-executes via the oracle; remove self-grantable override#21
Merged
Merged
Conversation
…osed) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…grantable override Gate 5 was a FAKABLE deterministic grep over .atlas-ai/evidence/ that SILENTLY PASSED when no evidence existed, and was bypassable via the self-grantable --override SHIP_CHECK_OVERRIDE_ADMIN token. Both are removed. skel/ship-check.py (standalone, stdlib-only — shells `atlas oracle grade`): - Delete OVERRIDE_TOKEN, log_override, --override arg, override_active, and the [OVERRIDE] suffix. run_all_gates loses the override_active param. - Replace gate_exit_codes with gate_oracle(repo_root, tasks, head_commit): for every DONE task, re-grade its CDD card via the oracle CLI. FAIL-CLOSED on a missing card, a card with no grading block, a CLI crash, unparseable output, or any verdict != "PASS". Add _head_commit() (git rev-parse HEAD; fail-closed to "UNKNOWN"). - Gates 1-4 and --dry-run/--cwd unchanged. Stdout contract unchanged: exactly "SHIP_CHECK_OK" on success, nothing on failure. tests/core/test_ship_check_oracle.py (new): oracle PASS ships; oracle FAIL blocks; non-JSON fail-closed; missing-card fail-closed; override token removed; Gates 1-4 regression. tests/core/test_ship_check.py (updated to new contract): green-tree CDD cards carry a grading block + a fake ATLAS_ORACLE_CMD; the old Gate-5 grep + override test replaced with an oracle-FAIL-blocks + override-is-gone test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ps, reward-hack blocked) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
….py + render panel OVERRIDE_TOKEN, log_override, override_active param, override kwarg, and [OVERRIDE] suffix rendering are all gone. shipcheck.py is now a non-binding display heuristic only; skel/ship-check.py (oracle-backed) is the binding gate.
… drop hardcoded local paths
This was referenced Jun 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ship-check Gate 5 → unfakable oracle; remove self-grantable override
SHIP_CHECK_OVERRIDE_ADMINoverride.Background (the hole this closes)
skel/ship-check.pyGate 5 previously grepped the submitter's own.atlas-ai/evidence/files forExit status N, silently passed when that dir was absent, and had a self-grantable static override token. It never re-executed anything — an agent passed the "hard gate" by simply not writing a failing log.Changes
skel/ship-check.py(standalone, stdlib-only):gate_exit_codes→gate_oracle, which shellsatlas oracle gradeper done task and is fail-closed (missing card / no grading block / CLI crash / unparseable output / non-PASS all block; only a real oraclePASSships).OVERRIDE_TOKEN/--override/log_overridedeleted. Gates 1–4 unchanged.prd_taskmaster/oracle_bridge.py(new): in-process CDD-card →atlas oracle gradebridge, fail-closed (the binding gate is the inlinegate_oracle; this is the in-process path).prd_taskmaster/shipcheck.py+render.py: removed the override from the importable (display-only) module and the[OVERRIDE]status panel — so the override exists nowhere.tests/core/test_oracle_dogfood.py): real cross-repo e2e — genuine pass ships, reward-hack blocked, ledger verifies. Portable: readsATLAS_ORACLE_CMDfrom the environment, skips when unset.Integration
The gate shells the
atlas oracleCLI from the atlas-protocol spine (companion PR). PointATLAS_ORACLE_CMDat the built CLI; default isatlason PATH.Tests
python3 -m pytest -q→ 349 passing (incl. the 3 real-podman dogfood tests whenATLAS_ORACLE_CMDis set; they skip cleanly otherwise).Note
The spine's
gradeSubmissiondoes not yet re-verifycard.contentHashagainst the card body; cards are operator-authored today, so this is fine for now — must land before cards are submitter/network-sourced.🤖 Generated with Claude Code