feat(evals): a scenario replay runs as the evaluation's owner - #451
Merged
Conversation
The scenario runner handed Agent#test_execute no caller, so every tool a replay called ran unattributed and a host scope answered empty — the suite graded an agent that never saw a row. When agents are owned per user, a replay now runs as the user who owns the evaluation, as a run over MCP runs as the key's owner. A multi-tenant install still replays unattributed (an account is who is billed, not who is allowed) unless a host adapter runs the suite itself. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XMSRnSxYS9mRx1hSjytB9Z
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while checking what
maingives a host for 1.5.3: after #443 a dashboard run and an MCP call carry a caller, but a scenario evaluation replay still calledAgent#test_executewith noactor:. Every tool a replay called ran unattributed, a host scope written correctly against Pundit answered empty, and the suite graded an agent that never saw a row — the same failure #443 closed for the other two surfaces.Change
ScenarioEvaluationRunner#replaypassesactor: replay_actor: the evaluation's owner (the user who owns the agent) when the install owns agents per user — the same rule the MCP facade applies to a key's owner. A multi-tenant install replays unattributed, because an account is who is billed, not who is allowed (Api::BaseController#agent_actormakes the same call); a host that wants per-user replays there already hasActionAgent.scenario_evaluation_adapter_resolver.Testing
actionagent/test/scenario_evaluation_runner_test.rb(+2): the replay's actor is the owning user; unattributed when the install has no owner model.bin/test actionagent/test/scenario_evaluation_runner_test.rb actionagent/test/scenario_evaluation_adapter_test.rb actionagent/test/evaluation_runner_service_test.rb actionagent/test/agent_authorization_test.rb— green.bin/rubocopclean on the changed files. Docs: one paragraph indocs/framework/dashboard.md.🤖 Generated with Claude Code
https://claude.ai/code/session_01XMSRnSxYS9mRx1hSjytB9Z