tmpl/multi-agent-mux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(o3): implement Invocation-Aware Scoped Guard for orchestrator role scoping (100% PASS)

Browse Source
This commit is contained in:
Godopu
2026-08-07 10:09:14 +09:00
parent 5ab76874e4
commit 1f8622e077
13 changed files with 428 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.agents/MULTI_AGENT_RULES.md
+10
View File
@@ -150,6 +150,16 @@ To ensure that agents running in TMUX environments do not lose debug logs or pre
- *Versioned promotions*: Any final design plans, review verdicts, or security audit reports that require version control must be explicitly copied to tracked directory paths (specifically under `.agents/reports/<tmux_session_name>/` or `docs/reports/`).
- **Cleanup & Retention Contract**: Files under `.mam/jobs/<job_id>/` and `.mam/reports/` are transient audit-trail artifacts. While durable outcomes are committed to version control under `.agents/reports/`, ephemeral directory trees can be cleaned up manually as needed; `stop_session.sh` does not automatically purge these report trees during session exit.
### 3.2 Invocation-Aware Scoped Guard (O-3)
| Mode | Orchestrator Action | Tool Access |
|---|---|---|
| **Normal Mode** | Main Creator (Direct implementation) | All tools allowed |
| **Loop Active Mode (`/multi-agent-mux-loop`)** | Orchestrator (Delegates to `run_loop.sh`) | `file_change`, `edit_notebook`, `write_blob` **hard-blocked** via `.agents/hooks.json` |
- **Fail-Open Policy**: Any hook internal error or parse error evaluates to `allow`.
- **Identity Verification**: The guard validates process liveness via `pid` + `lstart` to prevent livelocks on PID rollover.
### ⏱️ Timeout Configuration & Alignment Rules
- **Job Execution Limits (`timeout_sec` & `idle_timeout_sec`)**: Each job independently manages its overall execution timeout (`timeout_sec`, default 3600s) and idle timeout without receiving messages (`idle_timeout_sec`, default 120s).
- **Monitor Idle Waiting (`SUB_IDLE_TIMEOUT`)**: The idle timeout for the monitor script (`reconcile.sh`), `SUB_IDLE_TIMEOUT`, must always be set generously to `3600s` (1 hour) or more to align with the maximum job budget. This prevents the monitor from terminating early due to idle detection, which would lose control over background tasks before they finish.