V0.9.2/one prompt eval - #41
Conversation
Adds guidance for optional one-shot external handoff when user explicitly requests evaluation with yolo/auto modifier. Clarifies the boundary between preparation (deterministic) and execution (external handoff). Updates roles for preparer and executor, specifying when explicit eval requests authorize automatic handoff versus manual handoff. Normalizes harness naming and improves model discovery guidance.
Introduces eval-request.ps1 helper script that provides deterministic, model-free eval request workflow for agents. Handles decision logic between manual handoff (preparation-only) and external handoff (with explicit yolo/auto authorization). Includes comprehensive test coverage exercising all runner/model normalization paths and handoff state transitions. Adds PassThru parameter to prepare-skill-evals.ps1 for returning prepared prompt paths. Adds runner normalization to handle user-facing names (GitHub Copilot, Copilot CLI). Integrates validator coverage for eval request workflow in validate-skill-templates.ps1.
Updates repository README to document the eval request workflow and optional one-shot external handoff feature. Clarifies when and how explicit yolo/auto modifiers authorize automatic delegation to external Eval Orchestrators. Reflects the deterministic preparation model and handoff boundaries for agents preparing skill evaluation packages.
| if ($Preparation.ContainsKey('CollectResults')) { throw 'An eval request prepares packages; CollectResults is a separate forensic workflow.' } | ||
| $arguments = $Preparation.Clone() | ||
| $arguments.PassThru = $true | ||
| $paths = @(& (Join-Path $PSScriptRoot 'prepare-skill-evals.ps1') @arguments) |
There was a problem hiding this comment.
Forced Retry Erases Reservation
When Invoke-EvalRequest is retried with the same Iteration and Force preparation options, it reruns preparation before checking the handoff reservation. Because Force deletes and recreates the iteration directory containing .external-handoff-started, Get-EvalHandoff returns external_handoff again for the same path. After a timeout or interrupted launch, this can delete active execution state and dispatch a second model-backed evaluation despite the one-shot guarantee.
Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/eval-request.ps1
Line: 68
Comment:
**Forced Retry Erases Reservation**
When `Invoke-EvalRequest` is retried with the same `Iteration` and `Force` preparation options, it reruns preparation before checking the handoff reservation. Because `Force` deletes and recreates the iteration directory containing `.external-handoff-started`, `Get-EvalHandoff` returns `external_handoff` again for the same path. After a timeout or interrupted launch, this can delete active execution state and dispatch a second model-backed evaluation despite the one-shot guarantee.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Add safeguards to prevent -Force from replacing eval packages that have already started handoff or execution. This protects the one-shot eval workflow from accidental data loss. New tests validate that the guard works correctly and that packages remain unchanged when Force is rejected.
Rename ExternalOrchestratorAvailable to CanDelegateFreshOrchestrator for semantic clarity about what capability is being tested. Add compatibility alias to preserve existing call sites. Formally document GitHub Copilot CLI task + general-purpose agent delegation as a valid external-orchestrator capability. Add guard to prevent Copilot from replacing the repository-defined default model with a subjective stronger choice. Update all tests and validators to match the new naming and expectations.
Add comprehensive authentication validation and fail-closed behavior to the GitHub Copilot runner. The runner now detects when supported non-interactive authentication sources are unavailable (explicit tokens or trusted GitHub CLI fallback) and terminates evaluation preemptively rather than attempting execution without required auth. New test scenarios cover fresh-context environments and missing auth states. Updated handoff prompt generation documents that authentication incompatibility is terminal for the package iteration, preventing suggestions for runner switching or Phase 1 retries.
Update eval-runners README to explain Copilot authentication requirements and fail-closed behavior. Documents the fresh-context authentication testing strategy, the GitHub CLI token fallback mechanism, and the fail-closed incompatibility policy that prevents evaluation execution when required non-interactive authentication sources are unavailable.
Update repository documentation with eval infrastructure details, workspace git scenario support, Copilot eval worker projection requirements, and grading contract specifications. These changes reflect improvements to the portable eval handoff and runner integrity requirements.
Implement boundary violation detection for Copilot eval workers with physical projection outside package ancestry. Add isolation.ps1 support, enhance grading contract to enforce source-backed assertion evidence, update eval schema with new requirements, and fix git environment variable preservation in eval workspace initialization. Add eval-git-workspace.ps1 to support declarative git scenario setup for evaluations with staged commits and repository history.
Add comprehensive eval cases for dotnet-change-impact skill including test fixtures for API compatibility analysis, breaking change detection, and version impact assessment. Evaluation cases cover .NET library scenarios with fixture files demonstrating package changes and dependency impacts.
Test deterministic package preparation for dotnet-change-impact eval 9 with real git repository staging. Validates paired git history consistency, feature branch setup, default branch fallback resolution, meaningful API diffs, and safety checks for declarative git scenarios including path-traversal rejection.
Enhanced git-visual-commits to fully document scope rules for tracked, staged, unstaged, deleted, renamed, and non-ignored untracked files including contents of new directories. Extracted detailed grouping examples and release-adjacent splitting guidance to a new references/grouping-examples.md for better maintainability. Added three new test cases (26–28) covering untracked file discovery, path reconciliation with hidden status, and explicit scope narrowing.
Updated validate-skill-templates.ps1 to check for the new references/grouping-examples.md file and verify its content contains the release-adjacent splitting rules and repo-aligned grouping examples that were extracted from SKILL.md.
Updated README.md to document new git-visual-commits capabilities: full inventory of tracked, staged, unstaged, and non-ignored untracked files; individual file enumeration inside new directories; exact path reconciliation before staging; and final remaining-change verification. Updated skill table description to reflect these improvements.
| Invoke-ScenarioGit -Arguments @('branch', '-m', [string]$Scenario.base_branch) | ||
| # Local tracking refs and symbolic HEAD exercise default resolution | ||
| # without a network remote or paths back to the package. | ||
| Invoke-ScenarioGit -Arguments @('update-ref', "refs/remotes/origin/$($Scenario.base_branch)", 'HEAD') | ||
| Invoke-ScenarioGit -Arguments @('symbolic-ref', 'refs/remotes/origin/HEAD', "refs/remotes/origin/$($Scenario.base_branch)") | ||
| Invoke-ScenarioGit -Arguments @('checkout', '-b', [string]$Scenario.feature_branch, '--quiet') | ||
| foreach ($commit in $Scenario.commits) { | ||
| foreach ($file in $commit.files.PSObject.Properties) { | ||
| $path = [IO.Path]::GetFullPath((Join-Path $RepoDirectory $file.Name)) | ||
| if (-not $path.StartsWith([IO.Path]::GetFullPath($RepoDirectory) + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { throw 'Git scenario path escaped repo.' } | ||
| if ($null -eq $file.Value) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force } } | ||
| else { [void][IO.Directory]::CreateDirectory((Split-Path -Parent $path)); [IO.File]::WriteAllText($path, $file.Value, [Text.UTF8Encoding]::new($false)) } | ||
| } | ||
| Invoke-ScenarioGit -Arguments @('add', '-A') | ||
| Invoke-ScenarioGit -Arguments @('commit', '--quiet', '-m', [string]$commit.message) |
There was a problem hiding this comment.
Prohibited Temporary Git History
This helper renames a branch, checks out a temporary feature branch, stages changes, and creates throwaway commits. The repository directive explicitly forbids temporary Git repositories, test branches, and throwaway commits. This repository requirement must be satisfied before merging, either by representing the fixture without this prohibited workflow or by intentionally narrowing the directive.
Context Used: AGENTS.md (source)
Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/eval-git-workspace.ps1
Line: 35-49
Comment:
**Prohibited Temporary Git History**
This helper renames a branch, checks out a temporary feature branch, stages changes, and creates throwaway commits. The repository directive explicitly forbids temporary Git repositories, test branches, and throwaway commits. This repository requirement must be satisfied before merging, either by representing the fixture without this prohibited workflow or by intentionally narrowing the directive.
**Context Used:** AGENTS.md ([source](https://github.com/codebeltnet/agentic/blob/main/AGENTS.md))
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Add proper handling for Unix-style temporary directories and environment variables. Runner now respects RunPath property for projected inputs that use /tmp directly. Tests isolate TMPDIR alongside TEMP/TMP, and GitHub CLI config path is now platform-aware to handle Unix vs Windows conventions correctly.
Make explicit GH_CONFIG_DIR authoritative during trusted GitHub CLI token resolution for Copilot runs. If that selected configuration cannot resolve a token, preflight now fails closed instead of silently probing other config roots or ambient identity. Add deterministic regressions that prove explicit GH_CONFIG_DIR success, explicit GH_CONFIG_DIR fail-closed behavior, no fallback probing to alternate configs, and no token value leakage in evidence or output. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Clarify that temporary Git repos, branches, and throwaway commits are forbidden in the real source working tree while deterministic synthetic Git history remains allowed only inside isolated disposable eval fixtures under approved workspace roots. Keep the rule narrow by preserving the existing anti-pollution guardrails and adding deterministic wording checks so this distinction remains explicit across AGENTS, README, and validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This pull request updates the
AGENTS.mddocumentation to clarify and refine the rules around evaluation package execution, especially regarding explicit user-directed evals using theyoloorautomodifiers. The changes introduce a narrowly-scoped, one-shot external Eval Orchestrator handoff flow, and tighten the requirements for model/harness selection and agent roles during eval preparation and execution. The documentation now more clearly distinguishes between routine/manual and explicitly authorized automated eval handoffs, and details the technical and policy boundaries for each.Explicit Eval Handoff Flow:
yoloorauto, detailing when and how this handoff is allowed, and the technical steps for invoking it usingscripts/eval-request.ps1andInvoke-EvalRequest.Eval Preparation and Execution Rules:
yolo/autorequests authorize the one-shot external handoff. Updated the preparation and execution sections to reflect this distinction and to specify that only the explicit modifier can trigger automatic handoff. [1] [2] [3]Model/Harness Selection and Discovery:
Skill-Creator Integration:
skill-creatorsection to reflect the new explicit handoff flow, clarifying that repository-side validation remains deterministic, and only the explicitly user-directed external executor performs model-backed evaluation and reporting.