prime-agent kit: scripts/verify (pins + live assertions) #374

Activity

1. wz-gsa

   added

   enhancementNew feature or requestNew feature or request

   validationSchema, linting, tests, CI validationSchema, linting, tests, CI validation

   on Aug 24, 2026
2. wz-gsa commented on Oct 2, 2026

   

   wz-gsa

   on Oct 2, 2026

   ContributorAuthor

   More actions

   Note for whoever writes this verifier: there is now a shared verdict contract for scripts/verify, so prime-agent's should source it from the start rather than be converted later.

   integrations/isolation/acq-kits/verify-report.sh (added in #460) replaces the per-kit ok/bad pair and the [ "$fail" -eq 0 ] verdict, which reported success both when zero checks ran and when checks were silently skipped.

   . "$KIT_DIR/../verify-report.sh"
   verify_reset
   # ... ok / bad / unver / skip / warn ...
   verify_verdict "Pins gate"      # exit 0 clean, 1 failed, 3 could-not-check

   Five states, and the distinction that matters for this issue specifically: unver means could not check and degrades the verdict; skip means not applicable in this configuration and does not. This kit's verifier is two-mode (--pins offline vs live), and several of its live assertions depend on things that may be absent — prime-agent not on PATH, no CA bundle, no network for the in-guest USAi fetch. Those are unver, not skip, and definitely not silent.

   Concretely relevant to the checks named in the description:

   • --pins re-derives from live vendor endpoints. No network → unver, not a pass. A pins gate that could not reach the vendor has proven nothing about the pins.
   • CA-bundle present + in-guest node fetch USAi → 200. Two separate facts; the fetch failing for lack of egress is unver, whereas a 200 that returned the wrong body is bad.
   • negative-pin leaves the agent absent (fail-closed). This is the one to be careful with — a check that the agent is absent passes trivially when the sandbox never came up. Assert the sandbox exists first, or the absence is unmeasured rather than confirmed.

   scripts/tests/test_verify_contract.py enforces the contract statically (CI cannot run these scripts — they need a live sandbox). It has a CONVERTED / UNCONVERTED classification, and test_every_kit_is_classified fails on a kit in neither set, so adding prime-agent/scripts/verify without classifying it will turn the suite red. Add it to CONVERTED in the same PR.

   #463 tracks converting the six existing scripts still on the old pattern.

   ---

   AI-assisted (OpenCode), on operator instruction. Advisory.
3. mogul

   added a parent issue on Oct 5, 2026

   • Epic: prime-agent on the msb backend (recipe, ADR, tests) + the mawk kit-drop blocker #467
4. mogul

   removed a parent issue on Oct 5, 2026

   • Epic: prime-agent on the msb backend (recipe, ADR, tests) + the mawk kit-drop blocker #467
5. mogul

   added a parent issue on Oct 5, 2026

   • Epic: ship the canonical prime-agent acq-kit on GSA-TTS #368
6. wz-gsa commented on Oct 14, 2026

   

   wz-gsa

   on Oct 14, 2026

   ContributorAuthor

   More actions

   AI-assisted note (OpenCode), advisory. Adding a measurement rather than a new issue, since this is already the tracking issue for prime-agent's missing scripts/verify.

   The gap is also a documentation inaccuracy right now, which is worth fixing in the same pass.

   integrations/isolation/acq-kits/README.md:31-33 states unconditionally:

   Each kit is self-contained: a spec.yaml (hybrid/v1), any files/ payload, a
   scripts/verify host-side check, a README.md (with a backend parity note),
   a TROUBLESHOOTING.md, and docs/decisions/ records.

   Measured against origin/main:

     agentic-coding-playbook verify=Y troubleshooting=Y decisions=Y
     git-ssh-sign           verify=Y troubleshooting=Y decisions=Y
     oci-engine             verify=Y troubleshooting=- decisions=Y
     openchamber            verify=Y troubleshooting=Y decisions=Y
     opencode               verify=Y troubleshooting=Y decisions=Y
     paseo                  verify=Y troubleshooting=Y decisions=Y
     pi-coding-agent        verify=Y troubleshooting=Y decisions=Y
     prime-agent            verify=- troubleshooting=- decisions=-
     usai-provider          verify=Y troubleshooting=Y decisions=Y
     zscaler-ca-certificate verify=Y troubleshooting=Y decisions=Y
   

   So prime-agent is missing all three claimed artifacts, and oci-engine is missing TROUBLESHOOTING.md. The "each kit is self-contained" sentence reads as a description of the current state but is actually an aspiration — which means a contributor copying an existing kit has no way to tell the list is unmet, and a reader auditing coverage would conclude prime-agent has a verify script that just failed to run.

   Suggestion: whichever change adds prime-agent/scripts/verify should either also add the oci-engine TROUBLESHOOTING.md, or soften the README sentence to describe the target shape explicitly (e.g. "Kits are expected to be self-contained: ... Not every kit is complete yet — see the registry") so the prose cannot drift from the tree again.

   Not a blocker on anything; just a cheap correctness fix adjacent to the work already tracked here.