feat: populate the solution-simplicity and code-simplicity strata - #73
Merged
Conversation
…cases Batch 3 of #58's corpus population. Populates `s2-solution-simplicity-lens` with the four case classes #58 requires, minimized from adjudicated review disposition in the public `shaug/atelier`. ## The four cases Two whole-solution over-engineering escapes: - `setup-service-path-gateway` — a pure, single-implementation path-resolution function is wrapped in a gateway class and a dependency bag purely to make the caller injectable, while a sibling service in the same package achieves the same testability by monkeypatching the concrete function directly. atelier PR 160, accepted in `fcbf469`, which removed the gateway indirection entirely. - `registry-client-layering` — a third client class re-threads the same root and working directory through every method that a sibling client in the same file is already bound to at construction, repeating exactly the binding problem the first client exists to avoid. atelier PR 410, accepted in `f631cb0`, which converged all three onto one bound client. Two requirement-justified near-miss controls: - `reconciliation-outcome-type` — a boolean reconciliation result becomes a typed outcome so an intentional ambiguity block is never logged as a generic failure; the packet states the caller genuinely needs the distinction and a boolean cannot express it. atelier PR 417, comment 2870710594, which records its own acceptance. - `record-status-transition-guard` — a two-step create-then-transition sequence gains a retry and a fail-closed auto-close so a newly created record, runnable by default and picked up by a scheduler within seconds, can never be left unexpectedly runnable when the transition fails. atelier PR 277, accepted in reply 2861868165 naming commit `79703c5`. ## Adjudication: no oracle exists for this subject Unlike the correctness stratum, "over-engineered" and "requirement-justified" have no runnable form — they are design judgements, not properties a program can check. Every case therefore records `adjudication.second: owner_required`, each with a concrete recommended disposition and the specific counter-argument that could overturn it, so the owner is confirming or correcting a stated argument rather than starting from a bare case description. None of the four is settled by this batch. ## Populated, not scored `scored: false`, and every expectation `calibrated: false`. The owner has since settled the grading method for exactly this situation: score every case matched, missed, or referred for adjudication, and never calibrate a scored case on its own prose first. This stratum is built to that method from the start — no case has been run through any runtime, and none may be until the owner adjudicates it. ## Two sources reused across strata under different questions `atelier` PR 417 comment 2870710594 was assessed once for `s1` as a candidate clean-correctness control and dropped there, because the owner's clean-control standard needs an adjudicated-rejected finding and this comment records an accepted fix. It is sourced again here as a solution-simplicity near-miss control, where the relevant question is not "was a finding rejected" but "is the added machinery justified by a stated requirement" — a question the same accepted change answers on its own terms. Recorded as a deliberate reuse, not an oversight. One case id needed renaming during audit: `deferred-status-fail-closed-retry` triggered the outcome-revealing-token check twice (`defer`, `fail`); a second attempt, `changeset-status-transition-guard`, still matched on `changes` as a substring of `changeset`. It shipped as `record-status-transition-guard`. ## Diff validity, corrected on generation The batch-2 diff-header fix caught the same class of defect here before it ever shipped: all four packet diffs are recomputed from their own bodies and verified to parse as `git apply` patches, alongside the other seventeen packets across every corpus.
…method - Record the four delivered cases in `SOURCING.md` with their source dispositions and recommended adjudications, and record the deliberate cross-stratum reuse of one source PR under two different questions. - Rewrite limitation 14 as **settled**: the owner chose to score every case matched, missed, or referred for adjudication, never calibrating a scored case on its own prose first, and to record post-hoc transfer-versus-referral comparison as deferred evidence for #59 rather than something this ticket builds. - Record limitations 19 and 20: the solution-simplicity stratum has no oracle at all, and two sources were deliberately reused across strata under different questions. - Record the four per-case adjudication recommendations and residual risks in `ADJUDICATION-PLAN.md`, explicit that they are recommendations rather than adjudications. - Update `frozen-configuration.json`: the grading method joins the ceiling and the clean-control standard as resolved owner inputs; the remaining blocker is named precisely. Batch 1 found that an uncalibrated expectation reports a number about itself: recall 0.0 against a reviewer correct on every attempt, because grader matching is containment and the formulations had never met real prose. Calibrating fixes it, but calibrating a scored case means observing its prose first, which is fitting the grader to the answer. The owner's resolution reuses machinery this ticket already built rather than adding new machinery or shrinking the corpus: a grader miss is scored `referred`, using the `adjudication_required` output the grading interface has carried since batch 1, rather than silently becoming a false reviewer-miss. This stratum, like `s1`, ships `scored: false` and every expectation `calibrated: false` under that method from the start. `s2-solution-simplicity-lens` has no executable oracle for the same reason `s1` has one: correctness is a statement about behaviour and can be run; over-engineering and requirement-justification are design judgements and cannot. Every case therefore records `adjudication.second: owner_required` rather than `oracle`, with a concrete recommended disposition and residual risk per case so the owner is judging a stated argument rather than starting from nothing. None of the four cases is adjudicated by this batch.
… leakage
Closes the blocking finding from the first review cycle: all four `s2` cases
falsely claimed "no source identifier, path, symbol, prose, or diff was copied,"
and the claim did not hold.
- `setup-service-path-gateway` kept the real function name `project_dir_for_enlistment`
verbatim, in both the diff and the packet's context data.
- `registry-client-layering` kept the real classes' naming skeleton
(`_BeadsRuntimeClient`, `_BeadsIssueMutationsClient`, `_BeadsQueueMessagesClient`
→ `_Registry*Client`, only the product prefix swapped), and its expectation's
equivalent formulations were the real reviewer's own sentences ("duplicates
client concepts", "converge on one bound client", "remove this adapter stack")
rather than independent paraphrases.
- `reconciliation-outcome-type` kept the real enum member strings (`unchanged`,
`blocked_ambiguous`, `failed`) and the real function-name skeleton, dropping
only the product-specific token.
- `record-status-transition-guard` kept the real product's own vocabulary
outright: `beads.run_bd_command`, "changeset bead", `bd_calls` — the actual
ticket-subsystem noun and CLI name, not a renamed derivative of them.
None of this is business logic, a domain identifier, customer context, a
credential, or hidden reasoning — the checklist the sanitization rule already
names. It is narrower: retaining the source's own names and words while believing
the case had been rewritten from scratch. A case can carry zero proprietary logic
and still leak this way, because what leaks is naming, not substance.
It matters even though `shaug/atelier` is public, for two reasons. A retained
identifier is potentially traceable back to the source PR, a disclosure question
independent of the source's visibility. And a reviewer model trained on public
code may have this real text memorized, so a packet that echoes it verbatim risks
being answered by pattern-matching a remembered PR rather than by reasoning from
the packet — which would corrupt the exact measurement this corpus exists to
take.
All four cases rewritten: product-specific CLI names and nouns replaced with
fictional equivalents (`beads`/`bd` → `tracker`, "changeset" → "task record",
"export" → "publish") rather than lightly renamed; the real function name and
enum member strings replaced with fictional ones; every equivalent-formulation
phrase rewritten as an independent paraphrase rather than the source reviewer's
sentence. Every diff re-verified to parse as a patch after rewriting, and the
already-merged `s1-correctness-orchestrator` cases were checked against the same
leak class and found clean of it.
Limitation 21: minimization must replace the source's own identifiers, not only
its business logic. `SOURCING.md`'s sanitization claim for this batch now states
plainly that a first draft failed it and was corrected before merge, rather than
presenting the corrected state as though it were the only state that ever
existed.
…n rename Closes two of the three blocking findings from the second review cycle. The third finding was reviewed and determined not to be a defect; both outcomes are recorded below. ## Two real defects, both introduced by the previous fix commit The sanitization rewrite (`8e8a1fb`) renamed symbols inside each packet's diff but did not sweep the rename across the rest of the packet, and it never checked whether the diff it was editing was internally coherent to begin with. - `reconciliation-outcome-type`'s `context.data` still named `_update_runtime_metadata_database`, the pre-rename function, which the diff no longer defines after the rewrite renamed it to `_apply_runtime_database_sync`. Fixed by sweeping the rename into context as well. - `registry-client-layering`'s diff was never coherent, independent of naming: its `client.py` hunk introduced three classes as brand-new code, while its `worker.py` hunk imported two of them under public names that implied they already existed and were merely being renamed private. Rebuilt from scratch as a purely additive diff — one new class added next to two explicitly pre-existing, untouched classes named only in `context.data` — which is both internally consistent and the more faithful shape for the case: the escape is that the new class repeats a pattern two untouched siblings already established, not that three classes appear together for the first time. Both are recorded as limitation 22: a rename inside a diff must be swept across the whole packet, and a packet's diff must be checked for internal consistency independent of whatever prompted editing it. ## One finding reviewed and determined not to be a defect The same cycle flagged the real source class name `BeadsClient` appearing in `registry-client-layering`'s `retention_authority` and `adjudication.first` fields. Those two fields are private, structurally separated from every reviewer-visible artifact, and every provenance record in this corpus already cites real PR numbers, comment ids, and commit SHAs for exactly the same reason: that is what retention authority and adjudication provenance are for. The sanitization rule governs what reaches a reviewer-visible artifact or a grader formulation, never a private record's own description of its real source. Recorded as limitation 23 so the distinction is explicit rather than re-litigated on a future case. ## Validation Every packet diff across all six corpora re-verified to parse as a patch (21 of 21), and every context reference in the four affected cases checked against its own diff.
… the diff
Closes the two blocking findings from the third and final scheduled review cycle.
## Two more leak sites the earlier sanitization pass missed
The earlier fixes swept the diff and the grader's `equivalent_formulations`. Two
other reviewer-visible fields still carried real source material:
- `sources.repository_instructions[].summary` in two packets reused the real
reviewer's own sentences almost verbatim ("abstract away the calls it needs to
make", "deferred-by-default semantics"). Both rewritten as independent
paraphrases.
- `setup-service-path-gateway`'s `change_contract` kept the real source's domain
noun (`enlistment`) across its acceptance criteria, non-goals, and preserved
behaviours, even though its diff had already been renamed to `workspace_id`.
All three fields corrected to match.
## A no-op diff line that made the case's before-state impossible
The same packet's diff also carried an identical `-`/`+` line pair, present since
the very first draft rather than introduced by any sanitization commit: the
pre-image called a zero-argument constructor while the same hunk's next line
already referenced a dependency that constructor could not have held. Rebuilt so
the constructor change and the dependency reference are introduced together and
the before-state is actually reachable.
## Recorded
Limitation 24: a minimization or a rename must be swept across every prose field
in a packet, not only the diff and whichever field the grader reads. It took
three independent review cycles on one four-case stratum to find every instance
of this, which is itself the evidence that curation discipline alone is not a
durable defense.
## Validation
Every s2 packet re-scanned for the full set of real phrases and terms found
across all three cycles; none remain. All packet diffs re-verified to parse as
patches.
Batch 4 of #58's corpus population, folded into this same branch and PR per the coordinator's process change: both remaining strata (no executable oracle for either subject) ship together as one delivery rather than two full review/CI/merge cycles. Populates `s3-code-simplicity-lens` with the four case classes #58 requires, minimized from adjudicated review disposition in the public `shaug/atelier` and this repository's own delivery history, applying every sanitization lesson learned the hard way while populating `s2` in this same branch. ## The four cases Two local code-complexity or reuse escapes: - `watcher-check-policy-duplication` — a shared failed-check policy predicate has one remaining inline copy at a third call site, after a real history of the same duplication class causing two prior incidents where one copy drifted from another and produced a self-contradictory result. This repository's own commit `9351619`, where the code-simplicity lens under evaluation itself found and this fix resolved the duplication. - `metrics-label-formatting-duplication` — two new exporter functions each re-derive a label-formatting expression inline instead of calling the shared helper that already produces it, compounding a pre-existing copy rather than fixing it. atelier PR 410, comment 2870262209, accepted in `f631cb0`, read at the local-implementation level. Two near-miss controls, both adjudicated-rejected per the owner's settled standard: - `compat-accessor-boundary-duplication` — two compatibility accessor functions with identical bodies are kept apart because they serve two independently scheduled, untouched callers at the true migration boundary. atelier PR 630, accepted resolution of the concern raised in comment 2906745973. - `env-inventory-bullet-format` — per-item bullet blocks are chosen over a compact table because the table previously produced malformed rows under the repository's line-wrap formatter. atelier PR 443, accepted resolution of an earlier formatting concern. ## Adjudication: no oracle exists for this subject either Same reason as `s2`: "this is a duplication defect" and "this apparent duplication is justified" are design judgements, not properties a program can check. Every case records `adjudication.second: owner_required`, each with a concrete recommended disposition and residual risk, enforced by the same test that already holds `s2` to this contract. ## One source reused a third time, deliberately `atelier` PR 410 comment 2870262209 now grounds an escape in both `s2` (`registry-client-layering`, the whole-solution reading) and `s3` (`metrics-label-formatting-duplication`, the local-implementation reading of the same comment). Built against deliberately different fictional subjects — a registry client and a metrics exporter — so the two cases do not read as one scenario duplicated across strata. Recorded plainly rather than left for a reader to notice and wonder about. ## Sanitization applied from the start, not discovered after the fact `s2` needed three review cycles to find every leak class: real product terminology in the diff, real symbol names, verbatim reviewer phrasing in `equivalent_formulations`, and the same phrasing in `sources.repository_instructions[].summary`, plus a domain noun left in `change_contract` fields the earlier passes never touched. Every one of those classes was checked against all four `s3` cases before this record was written: no real product term, no real symbol, no verbatim reviewer sentence, in any reviewer-visible field. The one case sourced from this repository's own history is fictionalized against a `watch-tools` subject specifically so it cannot be recognised as this suite's own PR-watching code. ## Corpus minima now met across all three declared strata `s1-correctness-orchestrator`, `s2-solution-simplicity-lens`, and `s3-code-simplicity-lens` are all `populated_not_scored`. No stratum remains `declared_unpopulated`. That is a necessary condition for a scored baseline, not a sufficient one: independent adjudication for 8 cases across `s2` and `s3` needs the owner directly, and the frozen-baseline freeze itself remains outstanding regardless of corpus completeness.
…tion - Record the four delivered `s3` cases in `SOURCING.md` with their source dispositions and recommended adjudications, and record the deliberate cross-stratum reuse of `atelier` PR 410 for a second escape case. - Record limitations 25-27: `s3` has no oracle either, one source now grounds an escape in two strata read at two levels, and corpus minima are met across all three declared strata while scoring remains gated on the owner's adjudication and the frozen-baseline freeze. - Record the four `s3` per-case adjudication recommendations and residual risks in `ADJUDICATION-PLAN.md`. - Update `frozen-configuration.json`: all three strata move to `populated_not_scored`; the remaining blocker is stated precisely as 8 owner-required adjudications plus the freeze itself, not corpus completeness. This is the last corpus-population batch: every stratum #58 declares now has its minimum case set, sourced from real adjudicated review rather than invented, with every case's first adjudication recorded and its second either an executable oracle (`s1`, all 7 cases) or a recorded recommendation awaiting the owner (`s2` and `s3`, 8 cases total). It does not close scoring. Populating every stratum is necessary for a frozen baseline, not sufficient: the owner's adjudication of the 8 `owner_required` cases and the freeze protocol itself both remain outstanding, and no case in any stratum has been run through any runtime.
Closes all four findings from the first full review of the combined s2+s3
candidate.
- **Changelog gap.** Commit `3fb600c` ("docs: record the solution-simplicity
delivery and settle the grading method") had no entry; it was the only
commit in this range missing one. Added with its SHA backfilled.
- **Miscounted reuse.** `SOURCING.md` said `atelier` PR 410 was "reused a
third time across strata." It is used in exactly two cases
(`registry-client-layering` in s2, `metrics-label-formatting-duplication` in
s3); `LIMITATIONS.md` item 26 already said "second time" correctly.
Reconciled.
- **Stale limitation.** Item 7 still asserted all three scored strata were
`declared_unpopulated`, contradicting the frozen configuration's actual
`populated_not_scored` state and this same delivery's own item 27. Rewritten
to state the current, accurate boundary: corpus completeness is necessary for
a scored baseline, not sufficient.
`env-inventory-bullet-format`, the non-material near-miss control for
`s3-code-simplicity-lens`, is a pure Markdown-formatting diff, and
`review-code-simplicity`'s own rubric instructs a reviewer to omit formatting
concerns unconditionally. A compliant reviewer therefore returns clean
regardless of whether the specific formatting choice is justified, so the case
mostly tests rubric compliance rather than the near-miss judgement it was built
to demonstrate - both a reasoning reviewer and a reflexively-formatting-blind one
land on the same verdict.
A broader search of `atelier` for a code-level (non-Markdown) substitute did not
turn up a clean candidate quickly enough to hold up this delivery. Recorded as
limitation 28 with a concrete recommendation for the owner - keep it and read its
clean verdict as validating the omission rule rather than a discrimination test,
or substitute a code-level case in a future batch - rather than silently
accepted or silently dropped.
…rder Closes the blocking and strong-recommendation findings from the second review cycle on the combined s2+s3 candidate. `watcher-check-policy-duplication` is minimized from this repository's own commit `9351619`. Only its two function names were renamed (`has_failed_pr_checks`→`has_gating_failure`, `is_github_candidate_clear`→ `build_is_mergeable`); every local variable name, every dict key (`checks_summary`, `failed_runs`, `failed_jobs`, `new_review_items`, `all_terminal`, `pending_count`, `failed_count`, `cancelled_count`), and the removed code comment were copied verbatim from the real source. This is exactly the "lightly renamed rather than replaced" defect limitation 21 already found and fixed for all four `s2` cases, recurring in `s3` three batches later. It matters more here than it did for the cross-repository `atelier` cases: the real precedent is this very repository's own git history, discoverable with `git log`/`git show` inside the exact repository the corpus lives in, with no cross-repository step required. A repository-history case needs the rewrite discipline at least as much as a cross-repository one. Fixed: every local variable, dict key, and the comment are now independently authored. Recorded as limitation 29, which states plainly that limitation 21's rule was evidently not sufficient on its own to prevent a repeat instance, and that a mechanical check remains the more durable fix and remains undone. The prior fix added the missing entry for `3fb600c` but left the section internally wrong: no entry existed for head commit `4a6319e` (in the sense of appearing above the entries it authored - a `feat`-shaped correction was needed since this fix commit isn't yet in the log it describes, which is expected and resolved on the next commit); `8fc442b`'s entry carried no SHA even though it was no longer the newest commit; and `df55335`/`3fb600c` were in the wrong order (oldest-first instead of newest-first). Rebuilt the whole 2026-07-27 section in correct newest-first order with every commit's SHA backfilled except the current head's, per `AGENTS.md`'s rule. Every reviewer-visible field across all 8 new cases re-scanned against the full set of real identifiers from all four source PRs and the one repository-history commit; none remain. All packet diffs re-verified to parse as patches.
… resolved Closes the blocking and strong-recommendation findings from the third and final scheduled review cycle on the combined s2+s3 candidate. ## The earlier "fix" relocated an incoherence instead of resolving it `setup-service-path-gateway`'s before-state was still impossible after the commit that claimed to fix it (limitation 24). That commit removed a no-op diff line, but left `SetupService.run`'s before-image calling `self._path_gateway.project_dir(workspace_id)` while `commands/setup.py`'s before-image constructed the service with a bare function (`SetupService(resolve_workspace_root)`) - a function has no `.project_dir` method, so the packet's own pre-image still could not execute. The defect had moved, not resolved. Fixed by making the before-image's `run` call the injected gateway directly as a callable (`self._path_gateway(workspace_id)`, which a bare function argument genuinely supports), and introducing the `.project_dir` wrapper method only in the after-image alongside the new gateway class. The before and after states are now both independently executable. ## One verbatim real term survived three prior review cycles `record-status-transition-guard` still carried `allow_failure=True`, the identical keyword argument name and value from the real `atelier` source commit (`79703c5`), even though every other identifier in the case had already been independently renamed across three prior cycles. Renamed to `raise_on_failure=False`. ## Recorded Limitation 24 is corrected: its "now fixed" language was premature and is now qualified rather than left standing as an overclaim. Limitation 30 records both defects plainly, including that a fix for an incoherent diff must be checked by asking whether the whole before-state can execute, not whether the one flagged line changed, and that a mechanical diff-against-real-source check - which does not exist today - would have caught both defects on the first pass instead of the fifth. ## Validation Both packet diffs re-verified to parse as patches. A comprehensive re-scan of every reviewer-visible field across all 8 new cases against every real identifier from all sources (four `atelier` PRs and this repository's own history) found nothing further; the only remaining real-source mentions are in private provenance `retention_authority` fields, which is the established, legitimate pattern (limitation 23).
…rted case Closes the correctness findings from the fifth review cycle - the first entirely on the rebased head, with no case content changed since the fourth. ## Two stale references from earlier fixes - `reconciliation-outcome-type`'s accepted non-finding still named the pre-rename enum members `BLOCKED_AMBIGUOUS`/`FAILED`, after the sanitization pass (item 21) had already renamed them to `AMBIGUOUS_HOLD`/`WRITE_FAILED` everywhere else in the case. - `registry-client-layering`'s focused validation entry still cited `pytest tests/test_worker.py`, left over from before the case was rebuilt as a purely additive diff (item 20's fix) touching only `tests/test_client.py`. The cited evidence didn't test the change the packet actually shows. ## A case whose own diff contradicted its own declared verdict `watcher-check-policy-duplication`'s diff showed the real fix - removing the last inline duplicate of a shared policy - which is what a clean diff looks like, while the case declared `expected_verdict: changes_required` and a root cause arguing the diff itself was the correction. A contract-faithful reviewer given this packet would correctly say `clean`, and the case would have scored that correct answer as a miss. This was a design error present since the case was first authored, not a wording slip: three full review cycles and one rebase-focused cycle each checked identifiers, terms, and diff coherence in isolation, and none of them asked whether the packet's own diagnosis of itself matched the diff shown. Rebuilt so the diff instead adds a new call site (`build_is_archivable`) that duplicates the shared predicate's check inline rather than calling it - the failure shape the source commit's own drift history actually warns against - which is both internally consistent and a better fit for what a local code-complexity escape case needs to demonstrate. Expectation and provenance updated to match. ## Recorded Limitation 31: sweeping a rename or fix across every field is necessary but not sufficient. Each case also needs a pass that asks, independent of wording, whether reading only the diff would produce the verdict the case declares. Nothing mechanical checks this today, and five review cycles across two strata each finding a real defect is recorded as evidence that curation discipline alone does not converge. ## Validation Both stale references corrected. The redesigned case's diff re-verified to parse as a patch. A full leak re-scan across the stratum found nothing further.
21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #58. This PR does not complete #58, and deliberately carries no closing
syntax. Batches 3 and 4 combined: populates the two remaining strata. All corpus
minima are now met across all three declared strata, but independent adjudication
and the frozen-baseline freeze remain outstanding — see "Still open" below.
TL;DR
Populates
s2-solution-simplicity-lens(4 cases) ands3-code-simplicity-lens(4 cases), folded into one delivery since neither stratum has an executable
oracle and both need the same thing from the owner. This is the last
corpus-population batch for #58.
The eight cases
s2-solution-simplicity-lens— two whole-solution over-engineering escapes andtwo requirement-justified near-miss controls, all from public
shaug/atelierreview disposition:
setup-service-path-gateway— a pure, single-implementation function wrappedin a gateway class and dependency bag purely to make it injectable, while a
sibling service achieves the same testability by monkeypatching directly.
PR 160, accepted in
fcbf469.registry-client-layering— a new client class re-threads the same root andworking directory an existing sibling class in the same module is already
bound to at construction. PR 410, accepted in
f631cb0.reconciliation-outcome-type— a boolean result becomes a typed outcome so anintentional block is never logged as a generic failure; the caller genuinely
needs the distinction. PR 417, accepted.
record-status-transition-guard— retry plus fail-closed auto-close so arecord runnable-by-default and picked up within seconds can never be left
unexpectedly runnable. PR 277, accepted in reply
2861868165.s3-code-simplicity-lens— two local code-complexity/reuse escapes and twonear-miss controls, one behaviour-clarifying and one non-material:
watcher-check-policy-duplication— a new call site re-derives a gatingquestion inline instead of calling the shared predicate a sibling already
uses, reintroducing a duplication class with a real history of causing drift.
This repository's own commit
9351619.metrics-label-formatting-duplication— two new exporters re-derive aformatting expression inline instead of calling the shared helper that
already produces it. PR 410 (a second, local-implementation reading of the
same comment
registry-client-layeringreads at the whole-solution level).compat-accessor-boundary-duplication— two identical-bodied compatibilityaccessors are kept apart because they serve two independently scheduled,
untouched callers at the true migration boundary. PR 630.
env-inventory-bullet-format— per-item bullet blocks are chosen over atable because the table previously produced malformed rows under the
repository's own line-wrap formatter. PR 443.
Adjudication: no oracle exists for either stratum
Unlike the already-merged
s1-correctness-orchestrator, where a correctnessrequirement can be run and every case is oracle-settled, "over-engineered" and
"a duplication is justified" are design judgements with no executable form.
Every one of these 8 cases therefore records
adjudication.second: owner_required, each with a concrete recommended disposition and itsstrongest counter-argument, so the owner is confirming or correcting a stated
position rather than starting from a bare case description. None of the 8 is
settled by this delivery. Full table in
SOURCING.mdandADJUDICATION-PLAN.md.What review found and fixed — reported in full, not summarized away
This candidate went through an unusually long review history, and it is worth
being direct about why: five review cycles each found and fixed a real
defect, spanning sanitization leaks, internally impossible diff before-states,
stale references, and one case whose diff actually contradicted its own
declared verdict. That is not padding — every one of these was a genuine defect
that would have shipped if the review gate had not caught it, and the pattern
itself is recorded as a limitation (item 31) rather than smoothed over: no
mechanical check today verifies that a packet's own diff produces the verdict
it declares, and that gap is what let the last defect survive four prior
passes.
Fixed across the history: real product terms/symbol names/verbatim reviewer
phrasing copied from
atelierand from this repository's own git history(caught three separate times, in three different fields each time — the diff,
the grader formulations, and
repository_instructions.summary/change_contract); packet diffs whose before-state could not actually execute(twice, including one where an earlier "fix" only relocated the impossible
state rather than resolving it); a stale enum reference and a stale
validation-test filename left behind by earlier renames; and one case
(
watcher-check-policy-duplication) whose diff showed the real fix rather thana defect a reviewer should flag, rebuilt so it now introduces the duplication
instead of removing it.
The branch was also rebased twice onto a moving
origin/main(batch 2's ownmerge, then an unrelated PR #67), which required manually reconciling
CHANGELOG.mdacross 10+ commits — two ordering/SHA mistakes from that manualreconciliation were themselves caught and fixed by the next review cycle.
The final review cycle, bound to this exact head, returned aggregate clean
across all three lenses with zero gating findings — full lens sequence
completed (nothing skipped), independent re-verification of every one of the
five prior fixes, and a fresh sanitization sweep against all real sources.
Still open
strata is
calibrated: falseand has never touched a runtime, per theowner-settled three-way grading method: score matched, missed, or referred,
never calibrating a scored case on its own prose first.
s2ands3) needs theowner directly. No oracle exists for either subject.
last population batch — but that is a necessary condition for a frozen
baseline, not a sufficient one.
Sanitization
All 8 cases are
minimized_reproductionorrepository_history, rewrittenfrom scratch against fictional subjects, retaining only the failure shape: no
business logic, domain identifier, customer context, credential, or hidden
reasoning, and no copied source text — verified by a fresh sanitization sweep
against all real sources in the final review cycle. All sources are public.
Retention authority recorded per case in
SOURCING.md. No content from anyprivate repository reached any artifact; the excluded connector-bearing
repository stays unnamed and untouched.
Preserved behaviour
Review behaviour and the v1 packet/result contracts are unchanged. No file
under
skills/is modified.just sync-contractsleaves bundled mirrorsbyte-identical.
just eval-review-suiteremains the only command that mayspend money and remains unreachable from
test,lint,check.Validation
At head
c7a80c0, basea3597c25(currentorigin/main):just format—All checks passed!,90 files left unchangedjust lint— passjust test— pass,Ran 208 testsjust test-review-suite— pass,Ran 208 testsjust audit-review-corpus—corpus audit passed for 7 corpus(es)just sync-contractsthengit status— cleanruff==0.15.22run explicitly, all cleanReview
review-code-changereturned aggregate clean bound to headc7a80c0/base
a3597c25, all three lenses run fresh with zero gating findings. Nofindings preserved as deferred from this final cycle.
Merge
Merge is authorized once CI is green. No closing syntax anywhere in this PR
body or in any commit message. #58 must remain OPEN.