openhands 149211c78d chore: gardener housekeeping 2026-03-23

- dev/AGENTS.md: document two-tier priority queue (priority+backlog first,
  then plain backlog); note do_merge() HTTP 405 already-merged detection
- gardener/AGENTS.md: document merge-through protocol (stay alive through
  CI/review/merge); note session kill on PHASE:escalate
- lib/AGENTS.md: add ensure_priority_label() to ci-helpers.sh entry;
  document optional CALLBACK param in run_formula_and_monitor()
- predictor/AGENTS.md: update watermark (content already current from v2 PR)
- Update watermarks for action, planner, review, supervisor, vault, root

Grooming actions:
- #574: added ## Affected files section (lib/parse-deps.sh) to meet quality gate
- #568: escalated — needs human decision on guard/merge architecture
- #466: escalated — dep #393 closed; needs decision on external vs in-repo example

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-23 00:23:02 +00:00

2.1 KiB

Raw Blame History

Vault Agent

Role: Dual-purpose gate — action safety classification and resource procurement.

Pipeline A — Action Gating (*.json): Actions enter a pending queue and are classified by Claude via vault-agent.sh, which can auto-approve (call vault-fire.sh directly), auto-reject (call vault-reject.sh), or escalate to a human by writing PHASE:escalate to a phase file and sending a Matrix message — using the same unified escalation path as dev/action agents.

Pipeline B — Procurement (*.md): The planner files resource requests as markdown files in vault/pending/. vault-poll.sh notifies the human via Matrix. The human fulfills the request (creates accounts, provisions infra, adds secrets to .env) and moves the file to vault/approved/. vault-fire.sh then extracts the proposed entry and appends it to RESOURCES.md.

Trigger: vault-poll.sh runs every 30 min via cron.

Key files:

vault/vault-poll.sh — Processes pending items: retry approved, auto-reject after 48h timeout, invoke vault-agent for JSON actions, notify human for procurement requests
vault/vault-agent.sh — Classifies and routes pending JSON actions via claude -p: auto-approve, auto-reject, or escalate to human
vault/PROMPT.md — System prompt for the vault agent's Claude invocation
vault/vault-fire.sh — Executes an approved action (JSON) or writes RESOURCES.md entry (procurement MD)
vault/vault-reject.sh — Marks a JSON action as rejected

Procurement flow:

Planner drops vault/pending/<name>.md with what/why/proposed RESOURCES.md entry
vault-poll.sh notifies human via Matrix
Human fulfills: creates account, adds secrets to .env, moves file to vault/approved/
vault-fire.sh extracts proposed entry, appends to RESOURCES.md, moves to vault/fired/
Next planner run reads RESOURCES.md → new capability available → unblocks prerequisite tree

Environment variables consumed:

All from lib/env.sh
MATRIX_TOKEN, MATRIX_ROOM_ID, MATRIX_HOMESERVER — Escalation channel

2.1 KiB Raw Blame History

Vault Agent

2.1 KiB

Raw Blame History