mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-17 23:52:36 +00:00
a522a4fbc2
PINNED_GITNEXUS_VERSION did not select a runtime — the sandbox already mounts gitnexus/dist built from the checkout by the workflow's own `npm run build`, so the benchmark has always run main, not a release. The constant only asserted that the checkout's package.json said "1.6.9" and raised SandboxError otherwise. That makes it a tripwire aimed at the wrong thing. main is 1.6.9 today, so it passes; the next release bumps it and every skill-evolution run hard-fails until someone edits this line — discovered on a Saturday, on a lane that runs unattended once a week, after the box has already been started and the proposer session paid for. What the constant was guarding is still guarded, and better: the sandbox canary now checks the version reported from inside the sandbox against the checkout's own package.json, so it still proves the mounted runtime is the one this checkout built, without a literal that has to be maintained in lockstep with releases. The digest bindings in promotion.json (sandbox_dependency_content_digest, graph and oracle digests) remain what actually pins the substrate a candidate was measured against. The remaining check keeps package.json readable and versioned, so a malformed runtime still fails closed. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| conftest.py | ||
| test_ce_plugin_runtime.py | ||
| test_errors.py | ||
| test_evolve.py | ||
| test_mcp_bridge.py | ||
| test_oracle_assets.py | ||
| test_parse_run_id.py | ||
| test_process_control.py | ||
| test_promotion_apply.py | ||
| test_property_based.py | ||
| test_proposer_sandbox.py | ||
| test_runner_hardening.py | ||
| test_sanitized_graph.py | ||
| test_task_assets.py | ||
| test_tool_scripts.py | ||
| test_workflow_bench.py | ||
| test_workflow_bench_evolution.py | ||
| test_workflow_bench_sessions.py | ||