fix(bench): inject OPENAI_API_KEY into sandbox box env — opencode BYOK auth by tangletools · Pull Request #134 · tangle-network/agent-runtime

tangletools · 2026-06-03T15:33:28Z

Sandbox-research worker: pass router creds via box-level env so opencode's provider finds the key. In @tangle-network/sandbox@0.4.0 the BYOK backend.model.apiKey isn't wired into opencode's provider auth → in-box ProviderAuthError → empty answers. Verified a probe stops emitting the auth error with this env. e2e still gated downstream by a deployed-gateway SSE-replay 404 (version skew, separate platform fix); this closes the auth layer. tsc clean.

… BYOK auth @tangle-network/sandbox 0.4.0 does not wire backend.model.apiKey into opencode's provider auth, so the in-box agent dies with ProviderAuthError ("OPENAI_API_KEY env var missing") and every round returns an empty answer (0 tokens). Pass the router creds via the box-level `env` (CreateSandboxOptions.env) so opencode's OpenAI-compatible provider points at the router with the key. Verified: a box-create + streamPrompt probe with this env stops emitting the ProviderAuthError (the prompt reaches the model). NOTE: a full e2e run is still blocked downstream by a separate deployed-gateway issue — the gateway 404s on the SSE replay endpoint SDK 0.4.0 calls, dropping the stream before a terminal event (gateway<->SDK version skew; needs a gateway redeploy or a sandbox-dep bump). This fix closes the auth layer regardless.

…hase 2) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker).

…hase 2) (#135) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker). Co-authored-by: Drew Stone <drewstone329@gmail.com>

tangletools · 2026-06-03T15:33:28Z

Sandbox-research worker: pass router creds via box-level env so opencode's provider finds the key. In @tangle-network/sandbox@0.4.0 the BYOK backend.model.apiKey isn't wired into opencode's provider auth → in-box ProviderAuthError → empty answers. Verified a probe stops emitting the auth error with this env. e2e still gated downstream by a deployed-gateway SSE-replay 404 (version skew, separate platform fix); this closes the auth layer. tsc clean.

… BYOK auth @tangle-network/sandbox 0.4.0 does not wire backend.model.apiKey into opencode's provider auth, so the in-box agent dies with ProviderAuthError ("OPENAI_API_KEY env var missing") and every round returns an empty answer (0 tokens). Pass the router creds via the box-level `env` (CreateSandboxOptions.env) so opencode's OpenAI-compatible provider points at the router with the key. Verified: a box-create + streamPrompt probe with this env stops emitting the ProviderAuthError (the prompt reaches the model). NOTE: a full e2e run is still blocked downstream by a separate deployed-gateway issue — the gateway 404s on the SSE replay endpoint SDK 0.4.0 calls, dropping the stream before a terminal event (gateway<->SDK version skew; needs a gateway redeploy or a sandbox-dep bump). This fix closes the auth layer regardless.

…hase 2) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker).

…hase 2) (#135) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker). Co-authored-by: Drew Stone <drewstone329@gmail.com>

tangletools · 2026-06-03T15:33:28Z

Sandbox-research worker: pass router creds via box-level env so opencode's provider finds the key. In @tangle-network/sandbox@0.4.0 the BYOK backend.model.apiKey isn't wired into opencode's provider auth → in-box ProviderAuthError → empty answers. Verified a probe stops emitting the auth error with this env. e2e still gated downstream by a deployed-gateway SSE-replay 404 (version skew, separate platform fix); this closes the auth layer. tsc clean.

… BYOK auth @tangle-network/sandbox 0.4.0 does not wire backend.model.apiKey into opencode's provider auth, so the in-box agent dies with ProviderAuthError ("OPENAI_API_KEY env var missing") and every round returns an empty answer (0 tokens). Pass the router creds via the box-level `env` (CreateSandboxOptions.env) so opencode's OpenAI-compatible provider points at the router with the key. Verified: a box-create + streamPrompt probe with this env stops emitting the ProviderAuthError (the prompt reaches the model). NOTE: a full e2e run is still blocked downstream by a separate deployed-gateway issue — the gateway 404s on the SSE replay endpoint SDK 0.4.0 calls, dropping the stream before a terminal event (gateway<->SDK version skew; needs a gateway redeploy or a sandbox-dep bump). This fix closes the auth layer regardless.

…hase 2) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker).

…hase 2) (#135) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker). Co-authored-by: Drew Stone <drewstone329@gmail.com>

tangletools · 2026-06-03T15:33:28Z

Sandbox-research worker: pass router creds via box-level env so opencode's provider finds the key. In @tangle-network/sandbox@0.4.0 the BYOK backend.model.apiKey isn't wired into opencode's provider auth → in-box ProviderAuthError → empty answers. Verified a probe stops emitting the auth error with this env. e2e still gated downstream by a deployed-gateway SSE-replay 404 (version skew, separate platform fix); this closes the auth layer. tsc clean.

… BYOK auth @tangle-network/sandbox 0.4.0 does not wire backend.model.apiKey into opencode's provider auth, so the in-box agent dies with ProviderAuthError ("OPENAI_API_KEY env var missing") and every round returns an empty answer (0 tokens). Pass the router creds via the box-level `env` (CreateSandboxOptions.env) so opencode's OpenAI-compatible provider points at the router with the key. Verified: a box-create + streamPrompt probe with this env stops emitting the ProviderAuthError (the prompt reaches the model). NOTE: a full e2e run is still blocked downstream by a separate deployed-gateway issue — the gateway 404s on the SSE replay endpoint SDK 0.4.0 calls, dropping the stream before a terminal event (gateway<->SDK version skew; needs a gateway redeploy or a sandbox-dep bump). This fix closes the auth layer regardless.

…hase 2) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker).

…hase 2) (#135) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker). Co-authored-by: Drew Stone <drewstone329@gmail.com>

tangletools · 2026-06-03T15:33:28Z

Sandbox-research worker: pass router creds via box-level env so opencode's provider finds the key. In @tangle-network/sandbox@0.4.0 the BYOK backend.model.apiKey isn't wired into opencode's provider auth → in-box ProviderAuthError → empty answers. Verified a probe stops emitting the auth error with this env. e2e still gated downstream by a deployed-gateway SSE-replay 404 (version skew, separate platform fix); this closes the auth layer. tsc clean.

… BYOK auth @tangle-network/sandbox 0.4.0 does not wire backend.model.apiKey into opencode's provider auth, so the in-box agent dies with ProviderAuthError ("OPENAI_API_KEY env var missing") and every round returns an empty answer (0 tokens). Pass the router creds via the box-level `env` (CreateSandboxOptions.env) so opencode's OpenAI-compatible provider points at the router with the key. Verified: a box-create + streamPrompt probe with this env stops emitting the ProviderAuthError (the prompt reaches the model). NOTE: a full e2e run is still blocked downstream by a separate deployed-gateway issue — the gateway 404s on the SSE replay endpoint SDK 0.4.0 calls, dropping the stream before a terminal event (gateway<->SDK version skew; needs a gateway redeploy or a sandbox-dep bump). This fix closes the auth layer regardless.

…hase 2) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker).

…hase 2) (#135) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker). Co-authored-by: Drew Stone <drewstone329@gmail.com>

tangletools · 2026-06-03T15:33:28Z

Sandbox-research worker: pass router creds via box-level env so opencode's provider finds the key. In @tangle-network/sandbox@0.4.0 the BYOK backend.model.apiKey isn't wired into opencode's provider auth → in-box ProviderAuthError → empty answers. Verified a probe stops emitting the auth error with this env. e2e still gated downstream by a deployed-gateway SSE-replay 404 (version skew, separate platform fix); this closes the auth layer. tsc clean.

… BYOK auth @tangle-network/sandbox 0.4.0 does not wire backend.model.apiKey into opencode's provider auth, so the in-box agent dies with ProviderAuthError ("OPENAI_API_KEY env var missing") and every round returns an empty answer (0 tokens). Pass the router creds via the box-level `env` (CreateSandboxOptions.env) so opencode's OpenAI-compatible provider points at the router with the key. Verified: a box-create + streamPrompt probe with this env stops emitting the ProviderAuthError (the prompt reaches the model). NOTE: a full e2e run is still blocked downstream by a separate deployed-gateway issue — the gateway 404s on the SSE replay endpoint SDK 0.4.0 calls, dropping the stream before a terminal event (gateway<->SDK version skew; needs a gateway redeploy or a sandbox-dep bump). This fix closes the auth layer regardless.

…hase 2) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker).

…hase 2) (#135) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker). Co-authored-by: Drew Stone <drewstone329@gmail.com>

tangletools · 2026-06-03T15:33:28Z

Sandbox-research worker: pass router creds via box-level env so opencode's provider finds the key. In @tangle-network/sandbox@0.4.0 the BYOK backend.model.apiKey isn't wired into opencode's provider auth → in-box ProviderAuthError → empty answers. Verified a probe stops emitting the auth error with this env. e2e still gated downstream by a deployed-gateway SSE-replay 404 (version skew, separate platform fix); this closes the auth layer. tsc clean.

… BYOK auth @tangle-network/sandbox 0.4.0 does not wire backend.model.apiKey into opencode's provider auth, so the in-box agent dies with ProviderAuthError ("OPENAI_API_KEY env var missing") and every round returns an empty answer (0 tokens). Pass the router creds via the box-level `env` (CreateSandboxOptions.env) so opencode's OpenAI-compatible provider points at the router with the key. Verified: a box-create + streamPrompt probe with this env stops emitting the ProviderAuthError (the prompt reaches the model). NOTE: a full e2e run is still blocked downstream by a separate deployed-gateway issue — the gateway 404s on the SSE replay endpoint SDK 0.4.0 calls, dropping the stream before a terminal event (gateway<->SDK version skew; needs a gateway redeploy or a sandbox-dep bump). This fix closes the auth layer regardless.

…hase 2) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker).

…hase 2) (#135) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker). Co-authored-by: Drew Stone <drewstone329@gmail.com>

tangletools · 2026-06-03T15:33:28Z

Sandbox-research worker: pass router creds via box-level env so opencode's provider finds the key. In @tangle-network/sandbox@0.4.0 the BYOK backend.model.apiKey isn't wired into opencode's provider auth → in-box ProviderAuthError → empty answers. Verified a probe stops emitting the auth error with this env. e2e still gated downstream by a deployed-gateway SSE-replay 404 (version skew, separate platform fix); this closes the auth layer. tsc clean.

… BYOK auth @tangle-network/sandbox 0.4.0 does not wire backend.model.apiKey into opencode's provider auth, so the in-box agent dies with ProviderAuthError ("OPENAI_API_KEY env var missing") and every round returns an empty answer (0 tokens). Pass the router creds via the box-level `env` (CreateSandboxOptions.env) so opencode's OpenAI-compatible provider points at the router with the key. Verified: a box-create + streamPrompt probe with this env stops emitting the ProviderAuthError (the prompt reaches the model). NOTE: a full e2e run is still blocked downstream by a separate deployed-gateway issue — the gateway 404s on the SSE replay endpoint SDK 0.4.0 calls, dropping the stream before a terminal event (gateway<->SDK version skew; needs a gateway redeploy or a sandbox-dep bump). This fix closes the auth layer regardless.

…hase 2) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker).

…hase 2) (#135) Closes the load-bearing gap from docs/architecture-interpretations.md: the driver decided topology from the verdict score alone because PlannerContext had no channel for analyst findings. Now it decides from the diagnosis. - PlannerContext.analyses?: ReadonlyArray<AnalystFinding> (imported from agent-eval — the substrate type, not redefined). - createDynamicDriver gains an optional `analyze` hook (AnalyzeInput -> findings). plan() calls it each round AFTER the first (a trace must exist) and BEFORE the planner, validates the return (fail-loud on non-array — no silent empty), and passes the findings to the planner via ctx.analyses. The hook is the caller's seam to runAnalystLoop, kept on the driver so run-loop stays analyst-free (the layering rule). - renderAnalyses() formats findings (severity/area/claim/recommended_action/confidence); the canonical sandbox-planner prompt renders them so the LLM planner steers from the diagnosis. Barrel re-exports AnalyzeInput + renderAnalyses. - tests/loops/dynamic.test.ts extended (+4): the hook feeds the planner (skipping round 0), the diagnosis renders into the live planner prompt, fail-loud on non-array, renderAnalyses formatting. 70/70 loops tests green; tsc clean. This is the CODE wire (the missing organ). Feeding it from a real analyst on a benchmark + the Phase-2 gate measurement (refine@k-with-findings vs random@k) remain — the latter gated on the sandbox infra (see fix#134 + the gateway replay blocker). Co-authored-by: Drew Stone <drewstone329@gmail.com>

tangletools mentioned this pull request Jun 3, 2026
feat(loops): wire analyses → driver — the adaptive-driver channel (Phase 2) #135
Merged