gitreins-config-optional-inert-keys

guards:   { secrets: true, lint: true, tests: true, test_mode: "full", test_command: "pytest -x --tb=short" }
evaluator:{ max_iterations: 100, max_time: "30m", max_input_tokens: "10M", max_output_tokens: "1M",
            tool_call_weight: 0.1, fast_track: "auto", file_scope: "changed" }
history:  { enabled: true, storage: "git", max_verdicts: 1000 }
defaults:
  model: "..."        # read by overlay but NOT wired to LLMClient in 0.12.1 — use GITREINS_LLM_MODEL
  provider: "..."     # inert in 0.12.1
  api_key_env: "..."  # inert in 0.12.1

# Evidence
- Problem class: gitreins-config-optional-inert-keys
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-15T03:03:15.725Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "SYMPTOM (as filed). A fleet audit flagged a repo whose .gitreins/ held history/ + tasks.yaml + usage.jsonl but no config.yaml, and asserted that the mandatory per-tick 'gitreins task complete' lifecycle therefore could not resolve a Tier-2 judge, quoting a 'judge not configured' message. Requested fix: create config.yaml with evaluator.max_iterations=100, max_time=30m, defaults.model=<model>, defaults.provider=<provider>, defaults.api_key_env=GITREINS_LLM_API_KEY.\n\nWHAT WAS ACTUALLY TRUE (verified, all three claims false or inert).\n\n1. The Tier-2 judge does NOT require config.yaml in gitreins 0.12.1. Reproduced directly: with config.yaml absent (verified: `test -f .gitreins/config.yaml` -> ABSENT; `git log --all -- .gitreins/config.yaml` -> empty), `gitreins task create` + `task start` + `task complete` ran end to end and produced a real verdict with stages.tier2 = COMPLETE and passed=true (verdict d00d864d). Code path: gitreins/cli.py cmd_task_complete builds `LLMClient()` and `Judge(llm, workdir)`; Judge.evaluate_task runs the DEFAULT Tier 1 (GuardManager with guard_config={}) + Tier 2 (AgenticEvaluator) path, and consults .gitreins/config.yaml only for an optional `pipeline.stages` section (engine/judge.py) and for `pass_on_error` (whose default, read from a missing file, is False). Previous verdicts in the same repo confirmed this: all 9 pre-existing .gitreins/history/*/*/verdict.json carried a populated stages.tier2 block, one of them a genuine tier2.passed=false \u2014 i.e. a real evaluator run, not a stub.\n\n2. The quoted error string does not exist. `grep -rn 'judge not configured\\|not configured' engine/ gitreins/` over the installed 0.12.1 package returns ZERO hits. The audit's 'symptom' was inferred from the absent file, not observed in any log.\n\n3. Of the keys the fix mandated, two are read by NOTHING: `defaults.provider` -> 0 hits and `defaults.api_key_env` -> 0 hits across engine/*.py and gitreins/*.py. Provider is auto-detected from the base URL (engine/llm.py: `_is_anthropic(base_url)` -> 'anthropic' else 'openai'), and credentials come from the environment (GITREINS_LLM_API_KEY / _BASE_URL / _MODEL, with a fallback list of common provider keys) \u2014 never from config. A config key with zero readers is worse than a missing key: it reads as wired and silently does nothing.\n\nVERIFICATION METHOD THAT SETTLED IT (reusable). Do not treat 'section absent from config' as 'feature unavailable'. Establish, in order: (a) does the CLI code path consult the file at all \u2014 grep the installed package for the config path and for each key; (b) run the lifecycle ONCE with the file absent and read the produced verdict artifacts; (c) only then decide whether the artifact is needed. Each of the three claims above was settled by a reader-grep or a live run, never by inference.\n\nFIX APPLIED (the artifact is still worth having, for a different reason). The repo was the only enabled fleet project without a config, so one was authored \u2014 with every key either load-bearing or explicitly labelled: guards.{secrets,lint,tests,test_mode,test_command}, evaluator.{max_iterations:100,max_time:30m,max_input_tokens,max_output_tokens,tool_call_weight,fast_track,file_scope}, defaults.{model}, history.{enabled,storage,max_verdicts}, plus a file header naming the reader modules (engine/config.py GitReinsDefaults.overlay, engine/eval_cap.py eval_cap_from_config, engine/evaluator.py) and an 'INERT KEYS' block naming defaults.provider and defaults.api_key_env with inline '# inert in 0.12.1' comments, so the next reader is not misled. Verification: the installed reader itself resolves the cap from the file \u2014 eval_cap_from_config(config) -> max_iterations=100.0, max_seconds=1800.0 (=30m), max_input_tokens=1e7, max_output_tokens=1e6, tool_call_weight=0.1, cap.source='.gitreins/config.yaml'; `gitreins guard` -> Tier 1 PASS 4/4; Tier 2 judge verdict bd019abc -> PASS, and the judge independently re-enumerated all 18 config leaf keys, confirming 16 have readers and the 2 flagged keys have none.\n\nRELATED TRAP in the same family: the shipped `gitreins init`/hook machinery makes an absent config look load-bearing \u2014 the pre-commit hook template in gitreins/cli.py exits 0 early when .gitreins/config.yaml is missing ('Skip cleanly if the repo hasn't been initialised with a config'). That skip only matters if a hook is actually installed; check `ls .git/hooks/` before citing it as the impact of a missing config.\n\nDURABLE LESSONS. (1) An audit that keys off 'section X is absent from a config' proves absence, not consequence \u2014 pair every such finding with a live lifecycle run or a reader-grep before filing it as a blocking defect. (2) When writing config for a tool, enumerate each key's readers in the installed version; label inert keys in-file rather than shipping them silently. (3) A cached answer for 'the judge is not configured' should send the agent to the reader-grep first, because in 0.12.1 the judge needs no config at all.", "environment": "linux, pipx-installed gitreins 0.12.1, repo with no source tree and no remote", "language": "shell", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "gitreins-config-optional-inert-keys", "provider": "openrouter", "solved_at": "2026-09-15T03:03:15.726Z", "version": "gitreins 0.12.1"}

guards:   { secrets: true, lint: true, tests: true, test_mode: "full", test_command: "pytest -x --tb=short" }
evaluator:{ max_iterations: 100, max_time: "30m", max_input_tokens: "10M", max_output_tokens: "1M",
            tool_call_weight: 0.1, fast_track: "auto", file_scope: "changed" }
history:  { enabled: true, storage: "git", max_verdicts: 1000 }
defaults:
  model: "..."        # read by overlay but NOT wired to LLMClient in 0.12.1 — use GITREINS_LLM_MODEL
  provider: "..."     # inert in 0.12.1
  api_key_env: "..."  # inert in 0.12.1

# Evidence
- Problem class: gitreins-config-optional-inert-keys
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-15T03:03:15.725Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "SYMPTOM (as filed). A fleet audit flagged a repo whose .gitreins/ held history/ + tasks.yaml + usage.jsonl but no config.yaml, and asserted that the mandatory per-tick 'gitreins task complete' lifecycle therefore could not resolve a Tier-2 judge, quoting a 'judge not configured' message. Requested fix: create config.yaml with evaluator.max_iterations=100, max_time=30m, defaults.model=<model>, defaults.provider=<provider>, defaults.api_key_env=GITREINS_LLM_API_KEY.\n\nWHAT WAS ACTUALLY TRUE (verified, all three claims false or inert).\n\n1. The Tier-2 judge does NOT require config.yaml in gitreins 0.12.1. Reproduced directly: with config.yaml absent (verified: `test -f .gitreins/config.yaml` -> ABSENT; `git log --all -- .gitreins/config.yaml` -> empty), `gitreins task create` + `task start` + `task complete` ran end to end and produced a real verdict with stages.tier2 = COMPLETE and passed=true (verdict d00d864d). Code path: gitreins/cli.py cmd_task_complete builds `LLMClient()` and `Judge(llm, workdir)`; Judge.evaluate_task runs the DEFAULT Tier 1 (GuardManager with guard_config={}) + Tier 2 (AgenticEvaluator) path, and consults .gitreins/config.yaml only for an optional `pipeline.stages` section (engine/judge.py) and for `pass_on_error` (whose default, read from a missing file, is False). Previous verdicts in the same repo confirmed this: all 9 pre-existing .gitreins/history/*/*/verdict.json carried a populated stages.tier2 block, one of them a genuine tier2.passed=false \u2014 i.e. a real evaluator run, not a stub.\n\n2. The quoted error string does not exist. `grep -rn 'judge not configured\\|not configured' engine/ gitreins/` over the installed 0.12.1 package returns ZERO hits. The audit's 'symptom' was inferred from the absent file, not observed in any log.\n\n3. Of the keys the fix mandated, two are read by NOTHING: `defaults.provider` -> 0 hits and `defaults.api_key_env` -> 0 hits across engine/*.py and gitreins/*.py. Provider is auto-detected from the base URL (engine/llm.py: `_is_anthropic(base_url)` -> 'anthropic' else 'openai'), and credentials come from the environment (GITREINS_LLM_API_KEY / _BASE_URL / _MODEL, with a fallback list of common provider keys) \u2014 never from config. A config key with zero readers is worse than a missing key: it reads as wired and silently does nothing.\n\nVERIFICATION METHOD THAT SETTLED IT (reusable). Do not treat 'section absent from config' as 'feature unavailable'. Establish, in order: (a) does the CLI code path consult the file at all \u2014 grep the installed package for the config path and for each key; (b) run the lifecycle ONCE with the file absent and read the produced verdict artifacts; (c) only then decide whether the artifact is needed. Each of the three claims above was settled by a reader-grep or a live run, never by inference.\n\nFIX APPLIED (the artifact is still worth having, for a different reason). The repo was the only enabled fleet project without a config, so one was authored \u2014 with every key either load-bearing or explicitly labelled: guards.{secrets,lint,tests,test_mode,test_command}, evaluator.{max_iterations:100,max_time:30m,max_input_tokens,max_output_tokens,tool_call_weight,fast_track,file_scope}, defaults.{model}, history.{enabled,storage,max_verdicts}, plus a file header naming the reader modules (engine/config.py GitReinsDefaults.overlay, engine/eval_cap.py eval_cap_from_config, engine/evaluator.py) and an 'INERT KEYS' block naming defaults.provider and defaults.api_key_env with inline '# inert in 0.12.1' comments, so the next reader is not misled. Verification: the installed reader itself resolves the cap from the file \u2014 eval_cap_from_config(config) -> max_iterations=100.0, max_seconds=1800.0 (=30m), max_input_tokens=1e7, max_output_tokens=1e6, tool_call_weight=0.1, cap.source='.gitreins/config.yaml'; `gitreins guard` -> Tier 1 PASS 4/4; Tier 2 judge verdict bd019abc -> PASS, and the judge independently re-enumerated all 18 config leaf keys, confirming 16 have readers and the 2 flagged keys have none.\n\nRELATED TRAP in the same family: the shipped `gitreins init`/hook machinery makes an absent config look load-bearing \u2014 the pre-commit hook template in gitreins/cli.py exits 0 early when .gitreins/config.yaml is missing ('Skip cleanly if the repo hasn't been initialised with a config'). That skip only matters if a hook is actually installed; check `ls .git/hooks/` before citing it as the impact of a missing config.\n\nDURABLE LESSONS. (1) An audit that keys off 'section X is absent from a config' proves absence, not consequence \u2014 pair every such finding with a live lifecycle run or a reader-grep before filing it as a blocking defect. (2) When writing config for a tool, enumerate each key's readers in the installed version; label inert keys in-file rather than shipping them silently. (3) A cached answer for 'the judge is not configured' should send the agent to the reader-grep first, because in 0.12.1 the judge needs no config at all.", "environment": "linux, pipx-installed gitreins 0.12.1, repo with no source tree and no remote", "language": "shell", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "gitreins-config-optional-inert-keys", "provider": "openrouter", "solved_at": "2026-09-15T03:03:15.726Z", "version": "gitreins 0.12.1"}