recover #298 Phase 3 trust tier enforcement (runner push failed at 23:33) #300

Merged

Mark merged 3 commits from recover/mesh-seed-298 into master

2026-09-18 01:16:41 +00:00

Mark commented

2026-09-17 21:12:23 +00:00

Owner

Recovered from orphaned reflog on runner push-failure at 23:33. 3 commits cherry-picked from /home/b/Projects/mesh-seed reflog (5d3405d feat, 0e2155a tests, 6a419e6 model changes) onto fresh branch off origin/master. See kanban t_7d3d3d70 for full recovery context.

Recovered from orphaned reflog on runner push-failure at 23:33. 3 commits cherry-picked from /home/b/Projects/mesh-seed reflog (5d3405d feat, 0e2155a tests, 6a419e6 model changes) onto fresh branch off origin/master. See kanban t_7d3d3d70 for full recovery context.

Mark added 3 commits

2026-09-17 21:12:23 +00:00

feat(#298 ): enforce trust tiers in capability registration and routing 516fba2975

- PrimitiveRecord carries trust_tier (defaults TrustTier.LOW); strict
  validation via TrustTierManager.resolve_tier_strict.
- Capability + intent schemas accept trust_tier / required_trust_tier.
- TrustTierManager.intent_minimum_tier reads required_trust_tier (and the
  min_trust_tier alias) alongside the existing fields.
- _route_standard, _route_gpu, and _route_via_planner gate candidates via
  calculate_required_tier + find_execution_tier and surface
  trust_level_unavailable. Missing capability trust_tier is treated as
  LOW (fail-closed default; router never silently assumes HIGH).
- Tie-breaking: highest declared trust_tier wins when scores tie.
- pathway_manager records required_trust_tier with a defensive
  ALTER TABLE migration for existing databases.
- docs/reference/TRUST_TIERS.md extended with capability/intent conventions
  and the routing eligibility + tie-break rule.
- Single-node only; no federation policy in this slice.

test(#299 ): add trust-tier registry + router enforcement tests ad29873483

The Phase 3 trust-tier slices (#298 plan) referenced these test files in
its verification checklist but they were never created, causing the
Verify gate to fail with 'file or directory not found' for both
pytest and ruff.

Adds tests/unit/test_capability_registry_trust.py covering the
trust_tier field on PrimitiveRecord (template loading, alias
canonicalization, strict validation, register() guard, to_dict/from_dict
round-trip, default value).

Adds tests/unit/test_router_trust_enforcement.py covering
intent_minimum_tier field precedence, calculate_required_tier composition,
_route_standard trust-block behavior, and route_with_instance_check
trust interaction.

Apply changes from kilo-gsd.py run for Mark/mesh-seed#298

CI / Lint and Format (pull_request) Failing after 1m57s

Details

CI / Type Check (pull_request) Successful in 2m6s

Details

CI / Code Quality Checks (pull_request) Successful in 10s

Details

CI / Unit Tests (pull_request) Failing after 1m45s

Details

CI / Full Test Suite (pull_request) Has been skipped

Details

CI / Security Check (pull_request) Failing after 2m34s