Skip to content

V0.9.2/one prompt eval - #41

Open
gimlichael wants to merge 18 commits into
mainfrom
v0.9.2/one-prompt-eval
Open

V0.9.2/one prompt eval#41
gimlichael wants to merge 18 commits into
mainfrom
v0.9.2/one-prompt-eval

Conversation

@gimlichael

Copy link
Copy Markdown
Member

This pull request updates the AGENTS.md documentation to clarify and refine the rules around evaluation package execution, especially regarding explicit user-directed evals using the yolo or auto modifiers. The changes introduce a narrowly-scoped, one-shot external Eval Orchestrator handoff flow, and tighten the requirements for model/harness selection and agent roles during eval preparation and execution. The documentation now more clearly distinguishes between routine/manual and explicitly authorized automated eval handoffs, and details the technical and policy boundaries for each.

Explicit Eval Handoff Flow:

  • Added a new section describing an optional, explicitly authorized one-shot external Eval Orchestrator handoff for eval requests with yolo or auto, detailing when and how this handoff is allowed, and the technical steps for invoking it using scripts/eval-request.ps1 and Invoke-EvalRequest.

Eval Preparation and Execution Rules:

  • Clarified that normal eval requests result in package preparation and manual handoff, while explicit yolo/auto requests authorize the one-shot external handoff. Updated the preparation and execution sections to reflect this distinction and to specify that only the explicit modifier can trigger automatic handoff. [1] [2] [3]
  • Updated agent role definitions and restrictions to specify that the preparer context cannot execute its own package, but a fresh external Orchestrator authorized by the user may do so for that package only.

Model/Harness Selection and Discovery:

  • Tightened requirements for harness/model selection: discovery is only performed when the user has not supplied a harness, and never without an explicit runner. The documentation now prohibits reconfirmation of supplied runners and clarifies the handling of OpenCode selectors and repository defaults.

Skill-Creator Integration:

  • Updated the skill-creator section to reflect the new explicit handoff flow, clarifying that repository-side validation remains deterministic, and only the explicitly user-directed external executor performs model-backed evaluation and reporting.

aicia-bot and others added 4 commits September 7, 2026 21:04
Adds guidance for optional one-shot external handoff when user explicitly requests evaluation with yolo/auto modifier. Clarifies the boundary between preparation (deterministic) and execution (external handoff). Updates roles for preparer and executor, specifying when explicit eval requests authorize automatic handoff versus manual handoff. Normalizes harness naming and improves model discovery guidance.
Introduces eval-request.ps1 helper script that provides deterministic, model-free eval request workflow for agents. Handles decision logic between manual handoff (preparation-only) and external handoff (with explicit yolo/auto authorization). Includes comprehensive test coverage exercising all runner/model normalization paths and handoff state transitions. Adds PassThru parameter to prepare-skill-evals.ps1 for returning prepared prompt paths. Adds runner normalization to handle user-facing names (GitHub Copilot, Copilot CLI). Integrates validator coverage for eval request workflow in validate-skill-templates.ps1.
Updates repository README to document the eval request workflow and optional one-shot external handoff feature. Clarifies when and how explicit yolo/auto modifiers authorize automatic delegation to external Eval Orchestrators. Reflects the deterministic preparation model and handoff boundaries for agents preparing skill evaluation packages.
@gimlichael gimlichael self-assigned this Sep 7, 2026
@greptile-apps

greptile-apps Bot commented Sep 7, 2026

Copy link
Copy Markdown

RetriggerView in GreptileConfidence Score: 4/5

The PR is not yet safe to merge because a forced retry can still erase the handoff reservation and authorize a second external evaluation.

Summary

  • Introduces deterministic eval-request preparation and handoff reservation logic for explicit yolo/auto requests.
  • Adds declarative synthetic Git histories for isolated evaluation fixtures.
  • Tightens Copilot workspace projection, credential selection, execution evidence, grading, and finalization boundaries.
  • Expands validation and conformance coverage for the new workflows.
  • Updates repository documentation, release notes, and affected skill evaluations.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User requests an evaluation] --> B[Prepare and validate package]
    B --> C{Explicit yolo or auto?}
    C -- No --> D[Return absolute RUN-THIS.prompt.md path]
    C -- Yes --> E{Fresh external orchestrator available?}
    E -- No --> D
    E -- Yes --> F{Handoff already reserved or execution started?}
    F -- Yes --> G[Return already_started and observe existing execution]
    F -- No --> H[Create .external-handoff-started]
    H --> I[Delegate one fresh external orchestrator]
    I --> J[Execute package phases and return report]
Loading

Comment thread scripts/eval-request.ps1
if ($Preparation.ContainsKey('CollectResults')) { throw 'An eval request prepares packages; CollectResults is a separate forensic workflow.' }
$arguments = $Preparation.Clone()
$arguments.PassThru = $true
$paths = @(& (Join-Path $PSScriptRoot 'prepare-skill-evals.ps1') @arguments)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Forced Retry Erases Reservation

When Invoke-EvalRequest is retried with the same Iteration and Force preparation options, it reruns preparation before checking the handoff reservation. Because Force deletes and recreates the iteration directory containing .external-handoff-started, Get-EvalHandoff returns external_handoff again for the same path. After a timeout or interrupted launch, this can delete active execution state and dispatch a second model-backed evaluation despite the one-shot guarantee.

Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/eval-request.ps1
Line: 68

Comment:
**Forced Retry Erases Reservation**

When `Invoke-EvalRequest` is retried with the same `Iteration` and `Force` preparation options, it reruns preparation before checking the handoff reservation. Because `Force` deletes and recreates the iteration directory containing `.external-handoff-started`, `Get-EvalHandoff` returns `external_handoff` again for the same path. After a timeout or interrupted launch, this can delete active execution state and dispatch a second model-backed evaluation despite the one-shot guarantee.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Codex

Add safeguards to prevent -Force from replacing eval packages that have already started handoff or execution. This protects the one-shot eval workflow from accidental data loss. New tests validate that the guard works correctly and that packages remain unchanged when Force is rejected.
Rename ExternalOrchestratorAvailable to CanDelegateFreshOrchestrator for semantic clarity about what capability is being tested. Add compatibility alias to preserve existing call sites. Formally document GitHub Copilot CLI task + general-purpose agent delegation as a valid external-orchestrator capability. Add guard to prevent Copilot from replacing the repository-defined default model with a subjective stronger choice. Update all tests and validators to match the new naming and expectations.
Add comprehensive authentication validation and fail-closed behavior to the GitHub Copilot runner. The runner now detects when supported non-interactive authentication sources are unavailable (explicit tokens or trusted GitHub CLI fallback) and terminates evaluation preemptively rather than attempting execution without required auth. New test scenarios cover fresh-context environments and missing auth states. Updated handoff prompt generation documents that authentication incompatibility is terminal for the package iteration, preventing suggestions for runner switching or Phase 1 retries.
Update eval-runners README to explain Copilot authentication requirements and fail-closed behavior. Documents the fresh-context authentication testing strategy, the GitHub CLI token fallback mechanism, and the fail-closed incompatibility policy that prevents evaluation execution when required non-interactive authentication sources are unavailable.
Comment thread scripts/eval-runners/github-copilot/runner.ps1
Update repository documentation with eval infrastructure details, workspace git scenario support, Copilot eval worker projection requirements, and grading contract specifications. These changes reflect improvements to the portable eval handoff and runner integrity requirements.
Implement boundary violation detection for Copilot eval workers with physical projection outside package ancestry. Add isolation.ps1 support, enhance grading contract to enforce source-backed assertion evidence, update eval schema with new requirements, and fix git environment variable preservation in eval workspace initialization. Add eval-git-workspace.ps1 to support declarative git scenario setup for evaluations with staged commits and repository history.
Add comprehensive eval cases for dotnet-change-impact skill including test fixtures for API compatibility analysis, breaking change detection, and version impact assessment. Evaluation cases cover .NET library scenarios with fixture files demonstrating package changes and dependency impacts.
Test deterministic package preparation for dotnet-change-impact eval 9 with real git repository staging. Validates paired git history consistency, feature branch setup, default branch fallback resolution, meaningful API diffs, and safety checks for declarative git scenarios including path-traversal rejection.
Enhanced git-visual-commits to fully document scope rules for tracked, staged, unstaged, deleted, renamed, and non-ignored untracked files including contents of new directories. Extracted detailed grouping examples and release-adjacent splitting guidance to a new references/grouping-examples.md for better maintainability. Added three new test cases (26–28) covering untracked file discovery, path reconciliation with hidden status, and explicit scope narrowing.
Updated validate-skill-templates.ps1 to check for the new references/grouping-examples.md file and verify its content contains the release-adjacent splitting rules and repo-aligned grouping examples that were extracted from SKILL.md.
Updated README.md to document new git-visual-commits capabilities: full inventory of tracked, staged, unstaged, and non-ignored untracked files; individual file enumeration inside new directories; exact path reconciliation before staging; and final remaining-change verification. Updated skill table description to reflect these improvements.
Comment on lines +35 to +49
Invoke-ScenarioGit -Arguments @('branch', '-m', [string]$Scenario.base_branch)
# Local tracking refs and symbolic HEAD exercise default resolution
# without a network remote or paths back to the package.
Invoke-ScenarioGit -Arguments @('update-ref', "refs/remotes/origin/$($Scenario.base_branch)", 'HEAD')
Invoke-ScenarioGit -Arguments @('symbolic-ref', 'refs/remotes/origin/HEAD', "refs/remotes/origin/$($Scenario.base_branch)")
Invoke-ScenarioGit -Arguments @('checkout', '-b', [string]$Scenario.feature_branch, '--quiet')
foreach ($commit in $Scenario.commits) {
foreach ($file in $commit.files.PSObject.Properties) {
$path = [IO.Path]::GetFullPath((Join-Path $RepoDirectory $file.Name))
if (-not $path.StartsWith([IO.Path]::GetFullPath($RepoDirectory) + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { throw 'Git scenario path escaped repo.' }
if ($null -eq $file.Value) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force } }
else { [void][IO.Directory]::CreateDirectory((Split-Path -Parent $path)); [IO.File]::WriteAllText($path, $file.Value, [Text.UTF8Encoding]::new($false)) }
}
Invoke-ScenarioGit -Arguments @('add', '-A')
Invoke-ScenarioGit -Arguments @('commit', '--quiet', '-m', [string]$commit.message)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Prohibited Temporary Git History

This helper renames a branch, checks out a temporary feature branch, stages changes, and creates throwaway commits. The repository directive explicitly forbids temporary Git repositories, test branches, and throwaway commits. This repository requirement must be satisfied before merging, either by representing the fixture without this prohibited workflow or by intentionally narrowing the directive.

Context Used: AGENTS.md (source)

Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/eval-git-workspace.ps1
Line: 35-49

Comment:
**Prohibited Temporary Git History**

This helper renames a branch, checks out a temporary feature branch, stages changes, and creates throwaway commits. The repository directive explicitly forbids temporary Git repositories, test branches, and throwaway commits. This repository requirement must be satisfied before merging, either by representing the fixture without this prohibited workflow or by intentionally narrowing the directive.

**Context Used:** AGENTS.md ([source](https://github.com/codebeltnet/agentic/blob/main/AGENTS.md))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Fix in Codex

Add proper handling for Unix-style temporary directories and environment variables. Runner now respects RunPath property for projected inputs that use /tmp directly. Tests isolate TMPDIR alongside TEMP/TMP, and GitHub CLI config path is now platform-aware to handle Unix vs Windows conventions correctly.
Comment thread scripts/eval-runners/runner-common.ps1
gimlichael and others added 2 commits September 8, 2026 23:10
Make explicit GH_CONFIG_DIR authoritative during trusted GitHub CLI token resolution for Copilot runs. If that selected configuration cannot resolve a token, preflight now fails closed instead of silently probing other config roots or ambient identity.

Add deterministic regressions that prove explicit GH_CONFIG_DIR success, explicit GH_CONFIG_DIR fail-closed behavior, no fallback probing to alternate configs, and no token value leakage in evidence or output.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Clarify that temporary Git repos, branches, and throwaway commits are forbidden in the real source working tree while deterministic synthetic Git history remains allowed only inside isolated disposable eval fixtures under approved workspace roots.

Keep the rule narrow by preserving the existing anti-pollution guardrails and adding deterministic wording checks so this distinction remains explicit across AGENTS, README, and validation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants