Default prod-ops reviewers to Claude Sonnet 5 with live-evidence prompts - #13
Merged
areshand merged 1 commit intoAug 21, 2026
Conversation
Two changes to reduce correlated-failure risk in the safety-reviewer/ operations-reviewer pre-filter for mutating production operations (k8s.restart-deployment, service.deploy-release): - The two named reviewer roles now default to a deliberately-chosen backend/model (claude/claude-sonnet-5) via new PROD_OPS_REVIEWER_CLI/ PROD_OPS_REVIEWER_MODEL env vars, instead of silently inheriting whatever the generic VERIFIER_CLI convention resolves to. This is enforced at the Rust spawn choke point (spawn_backend_for_name), not left to the orchestrator prompt's SUBAGENT_CLI convention, so it can't be defeated by a missed env var. Required threading an optional model override through AgentRequest/ClaudeBackend (--model flag), LaunchAuthorization, and the register-launch/renew-launch/restore path so it survives UID-sandboxed production launches and restores. - Dedicated prompts/roles/safety-reviewer.md and operations-reviewer.md (previously these fell through to the generic prompts/verifier.md) instruct each reviewer to independently gather live evidence via their own already-available read-only tool access, rather than trusting only the runbookContextSha256/historySha256 bundle the proposing agent supplied — that bundle's content is chosen by the same agent proposing the mutation and could be stale, incomplete, or adversarially curated. Both prompts require the exact same sealed prod-ops-review marker prod_ops.rs already checks; the contract is unchanged, only the review process feeding it is strengthened. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
areshand
changed the base branch from
codex/control-plane-simplification
to
main
August 20, 2026 20:16
areshand
changed the base branch from
main
to
codex/control-plane-simplification
August 20, 2026 22:43
areshand
marked this pull request as ready for review
August 21, 2026 07:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to
#12(now merged intocodex/control-plane-simplification), addressing one more gap from the same design review: thesafety-reviewer/operations-reviewerpre-filter for mutating production operations had no deliberate model/backend choice and no instruction to independently verify anything beyond the proposer-supplied context bundle.safety-reviewer,operations-reviewer) now default to a deliberately-chosen backend/model —claude/claude-sonnet-5— via newPROD_OPS_REVIEWER_CLI/PROD_OPS_REVIEWER_MODELenv vars, instead of silently inheriting whatever the genericVERIFIER_CLIconvention resolves to. This is enforced at the Rust spawn choke point (spawn_backend_for_name), not left to the orchestrator prompt'sSUBAGENT_CLIconvention, so it can't be defeated by a missed env var.prompts/roles/safety-reviewer.mdandprompts/roles/operations-reviewer.md(previously these fell through to the genericprompts/verifier.md) instruct each reviewer to independently gather live evidence via their own already-available read-only tool access, rather than trusting only therunbookContextSha256/historySha256bundle the proposing agent supplied — that bundle's content is chosen by the same agent proposing the mutation and could be stale, incomplete, or adversarially curated. Both prompts require the exact same sealedprod-ops-review:markerprod_ops.rsalready checks; the enforcement contract is unchanged, only the review process feeding it is strengthened.Why this doesn't fully solve reviewer independence
Agent-role review remains a pre-filter, not the authority boundary, for
k8s.restart-deployment/service.deploy-release: the human-committed-decision requirement added in#12(decision commit --owner-type user --bound-action-sha256 ...) is what actually gates signing. This change only makes the pre-filter itself less prone to a single correlated model failure.Validation
cargo fmt --checkcargo build --locked --all-featurescargo test --locked— 58 testsbash tests/run.sh