Bug-hunt loop state

[REPPL]

State tracking for the autonomous bug-hunt loop. Each round posts one comment here: findings counts, nitpicks-only flag, and PR outcome. Rounds continue the existing bughunt-N numbering (bughunt-7 merged as PR #23; the first loop round is 8).

[REPPL]

Round 8 — findings: 10 substantive, 11 nitpick, 5 refuted; nitpicks-only: no; PR #25 merged.

Headlines: transcribe resolved the audio offset before the conversion mutates the session (a refused external run no longer destroys a record-origin audio.wav or strands converted audio without its sidecar); install.sh installed v0.4.0 with a release-time gate on the pin; usage errors uniformly exit 2; docs corrected against the code (installer prompts and verification claims, endpoint caps and 413, offset provenance strings, session file inventory including screen.mp4, AGENTS.md current state); the docs-lint config repaired so the link/tense release gate runs again. Recorded, not fixed: the /dev/null TTY-gate nitpick (a true isatty check needs a platform ioctl or a dependency). Upstream, not fixable here: the dangling brief link inside the abcd-managed AGENTS.md fence. Merge gate: CI green ×3 rounds; correctness review MERGE; docs-accuracy review BLOCK → fixes → MERGE.

[REPPL]

Round 9 — findings: 11 substantive, 16 nitpick, 3 refuted; nitpicks-only: no; PR #26 merged.

Headlines: stray positional arguments no longer silently swallow every flag after them (all commands, exit 2); the capture endpoint refuses with 400 any interaction record merge's reader would refuse, via a validator shared with merge, and every refused capture write is logged to stderr; the audio offset sidecar persists before the rename that replaces audio.wav (bounded prior capture, three-state rollback), closing the residual gap in round 8's resolve-before-convert invariant; an unauthenticated or attestation-incapable gh falls back to the verified checksum instead of a false provenance refusal; optional-dependency failures skip their installer step instead of aborting the run; the CHANGELOG regains its [Unreleased] section (rounds 8 and 9); reference pages corrected against the code (endpoint preconditions, evidence cap, sessionEnd bound, ffmpeg's real consumers, the demo page's CDN fetch disclosed on the privacy page). Refuted: the CI race-leg claim (no race-conditional code exists; -race runs a strict superset), the tutorial next-commands timing, and the re-ingest caveat. Recorded, not fixed: the /dev/null TTY-gate (per round 8) and vendoring rrweb for offline capture (needs a dependency decision). Merge gate: CI green ×3 runs; both adversarial reviews initially BLOCK (unbounded sidecar rollback read, double diagnosis on early recorder exit, silent 400 refusals, version/help accepting stray args, stale attestation wording) → all fixed → both MERGE.

Note for the record: this round first ran in a session whose git access was read-only (receive-pack 403; the GitHub App refused all writes), so the fixes were briefly preserved as an out-of-band patch series before access was restored and the normal PR path completed. If a future round reports the same wall, repository access for the routine's environment is the place to look.

Assisted-by: Claude:claude-fable-5

---

Generated by Claude Code

[REPPL]

Round 10 — findings: 3 substantive, 22 nitpick, 3 refuted; nitpicks-only: no; PR #27 merged.

Headlines: the timeline's id and src contracts are now enforced where they can mislead — analyze refuses duplicate entry ids (its id-keyed quote validator paired a verbatim quote with the wrong moment, both directions reproduced), merge refuses a transcript whose utterance ids repeat or collide with the synthesised ev-NNN namespace (naming the file the operator can repair), and report and analyze refuse unknown-src entries that previously vanished from the rendered timeline while their time set the header duration and their id stayed citable. The recorder permissions headline fires only on a device-failure signature — ffmpeg's ordinary avfoundation banner had made the non-permissions diagnosis branch unreachable, sending a full disk to the System Settings pane. The offset sidecar writes atomically (random-suffix temp plus rename, exact mode preservation). The CI and release pipeline smoke now gates the event half (all prior assertions were satisfiable with interactions.jsonl deleted); the release workflow asserts a published binary reports its tag; CI parses install.sh; the installer stages and verifies the binary inside the install directory before it replaces anything (a temp-dir probe would break noexec-/tmp hosts) and no longer prints success for an unrunnable binary. Docs corrected against the code across cli.md, session-directory.md, the how-tos, README (macOS capture caveat, diagram), and CHANGELOG; the demo seeds Bob so the tutorial's Alice interaction stays real. Refuted: the cli.md -audio wording (page defines its shorthand), the mode-default claim, and the line-wrap premise. Recorded, not fixed: the VERSION-pin window before a tag exists (process), docs-lint gates absent from CI (tooling), doubled CI runs on PR branches (trigger set tied to the merge queue), dead exported API (timeline.EventsNear documented as deliberate, analyze.Validate uncalled), and the /dev/null TTY gate (per round 8). Merge gate: CI green on every push; both adversarial reviews (correctness; docs accuracy) initially BLOCK — the reviews themselves caught two regressions in this round's own fixes (the noexec-TMPDIR install probe and the merge-never-emits-duplicates overclaim) — all findings fixed across two further rounds, both final verdicts MERGE.

---

Generated by Claude Code

[REPPL]

Round 11 — findings: 1 substantive, 2 nitpick, 1 refuted; nitpicks-only: no; PR #28 merged.

Headlines: the explicit transcribe -offset flag was the one unbounded offset entry point — the derived and sidecar paths refuse a non-finite or over-magnitude offset where the bad value enters, but the flag passed straight through, spending the conversion or the whole engine run before a bare json: unsupported value error at exit 1 (the CLI reference promises invalid flag values exit 2), or writing a transcript at exit 0 that merge refuses one command later naming transcript.jsonl rather than the flag, while an external run persisted a sidecar transcribe's own reader refuses on the next bare run. transcribe.CheckOffset (the CheckEngine/CheckAddr pattern) now refuses it at the CLI, exit 2, before any work. Nitpicks fixed: a demo whose well-formed address fails to bind (port already taken) no longer creates a stray session directory first (the malformed-addr sibling of the class fixed in round 9), and the changelog's claim that the demo seed "uses the Alice persona" corrected — the seed is Bob, deliberately, so the tutorial's rename to Alice is a real interaction. Refuted: documenting the capture endpoints' 500 on a failed persist (the enumerated codes are the request-refusal contract; the stderr signal is documented). Also considered and rejected during the hunt: finite-but-absurd -window values (docs promise finiteness only), unbounded engine segment times (trusted local tools), the non-darwin screen-capture skip message, and record -addr without -demo.

Merge gate: CI green on every push; both adversarial reviews (correctness; docs accuracy) initially BLOCK — the reviews caught two defects in this round's own diff (a test doc comment misattached by the new test's insertion point, and a path-dependent overclaim in the offset narrative) — both fixed, both final verdicts MERGE.

Note for the record: the subagent model (claude-opus-5) was persistently overloaded server-side for the whole round (twelve hunter attempts and two refuter attempts across four waves, all 529); the round ran its hunts, refutations, and merge-gate reviews sequentially in one session per the routine's sequential fallback. If a future round sees the same, the backoff-then-fallback path used here worked.

---

Generated by Claude Code

[REPPL]

Round 12 — findings: 3 substantive, 6 nitpick, 2 refuted; nitpicks-only: no; PR #29 merged.

Note: this round resumed an open PR left by a previous round (per the loop's "PR still open → skip hunt, resume at merge gate" rule) rather than running a fresh hunt.

Headlines: demo's capture-write guard now enforces a loopback RemoteAddr in addition to the loopback Host/Origin/Content-Type checks, closing a forged-Host-from-a-LAN-peer gap on a deliberately wide -addr bind; analyze's timeline reader now sorts timeline.jsonl by t before emitting the analysis request, matching report.Render's existing sort of the same untrusted file; record's live-session banner and "grant the microphone permission" suggestion are now gated on whether capture actually ran or is possible on the platform, instead of firing unconditionally. Nitpicks: cli.md and session-directory.md corrected against the code (manifest requirement, exit-1 branches, event ordering example); the how-to's click listener gained the isTrusted guard the demo app already carries; a stale CI comment about the save-btn grep corrected; release.yml now parses install.sh the same way ci.yml does. Refuted: a claimed JSONL-fusion risk in demo.appendRecords (already rollback-protected) and a claimed silent fallthrough on whitespace-only -finding/-verdict flags (behaves identically to the documented default).

Merge gate: CI green on every push; two adversarial reviews (correctness; docs accuracy) — correctness MERGE outright; docs accuracy initially BLOCK on two defects in the round's own late fix commit (a dropped conjunction left an ungrammatical sentence in cli.md's endpoint-guard paragraph, and release.yml's reflowed comment still carried the stray short line its commit message claimed to have rejoined) — both fixed, gates re-run green, merged.

---

Generated by Claude Code

[REPPL]

Round 12 — findings: 3 substantive, 6 nitpick, 2 refuted; nitpicks-only: no; PR #29 merged.

Headlines: the demo capture write guard now checks the request's actual RemoteAddr, not only its Host header — on a deliberately wider bind, a non-browser LAN client could previously forge a loopback Host and inject fabricated interactions with 204, despite the operator warning and a doc comment both claiming loopback-only writes; analyze now orders a hand-edited or exchanged timeline by time before emitting it (matching report), closing the last untreated case of the round-10/11 hand-edited-timeline threat model; record no longer banners a live session for a run about to exit immediately on a platform with no capture, and its no-audio guidance only suggests granting a microphone permission where one exists to grant. Nitpicks: record/transcribe's CLI reference entries corrected against their actual exit-1 branches and manifest requirement; a timeline example reordered to match its own "stably sorted by t" claim; the instrument-your-own-app snippet gained the demo's isTrusted guard; a misleading CI comment corrected; the release workflow gained the installer syntax check ci.yml already runs. Refuted: a claimed newline-fusion risk in the demo's append writer (the existing truncate-on-failure rollback already covers the ordinary case, and cross-run fusion is structurally impossible) and a claimed silent-fallthrough in review's flag parsing (whitespace-only -finding behaves identically to omitting the flag).

Merge gate: CI green on every push. Both adversarial reviews (correctness; docs accuracy) initially BLOCK on the same finding — the new RemoteAddr check changed the write endpoints' documented contract, and two reference pages plus one CHANGELOG line still described the old one — fixed and pushed. The repository owner then pushed one further small polish commit directly to the branch (a dropped conjunction and an inconsistent comment reflow left by that fix) and merged; this session did not get to re-run the second adversarial pass on the final commit before the merge landed, so that last commit's correctness rests on the maintainer's own review and the green CI run at merge time, not a fresh loop verdict.

---

Generated by Claude Code

[REPPL]

Note for the record: the two comments immediately above are both "Round 12", posted ~90 seconds apart, against the same PR #29. This looks like a concurrent-session collision — a second run of this routine appears to have started while this one already had PR #29 open, treated it as "a previous round's PR still open" (per the loop's resume rule), skipped straight to the merge gate, and reached green/MERGE/merged before this session's own second adversarial pass (queued after this session's fix push) could run. Both sessions' fixes landed in the same merged PR and CI was green at merge time, so the round's output is sound, but the round-numbering counter did not increment between the two reports. Next round is 13. If this recurs, it likely means the schedule is firing this routine more than once per interval, or a manual fire overlapped a scheduled one — worth checking the routine's trigger configuration.

---

Generated by Claude Code

[REPPL]

Round 13 — findings: 7 substantive, 9 nitpick, 1 refuted; nitpicks-only: no; PR #30 merged.

Note: this round resumed an open PR left by a previous round (per the loop's "PR still open → skip hunt, resume at merge gate" rule) rather than running a fresh hunt.

Merge gate: CI green on every push (gofmt, build, vet, go test ./..., go test -race ./..., pipeline smoke). Two adversarial reviews — correctness and docs accuracy — each independently verified the diff (mutation-testing the behavioural changes by reverting each fix and confirming a test catches it; empirically reproducing the docs claims against the built binary and CI/release YAML) and both returned MERGE outright, no fixes needed this round. Merged via squash; branch auto-deleted on merge.

Findings are detailed in PR #30's description (timeline entry integrity against a hand-edited timeline.jsonl, record -demo's bind-before-create ordering, review's missing-vs-un-ingested session distinction, plus docs corrections across the CI/release/install/report/CLI reference pages). The round's .abcd/work/DECISIONS.md entry landed in the merged PR.

---

Generated by Claude Code

[REPPL]

Round 13 — findings: 7 substantive, 9 nitpick, 1 refuted; nitpicks-only: no; PR #30 merged.

Headlines: timeline.SpeechEnd now clamps an inverted t1 to t instead of inverting EventsNear's join window, mirroring the clamp checkedUtterances already applies at merge time; a new timeline.ReadEntries (pointer-typed rawEntry) refuses a timeline.jsonl entry missing t instead of silently reading it as t=0 and placing it at the session's start; record -demo now binds the demo port through the new demo.Bind before creating the session directory or starting recorders, closing a stray-session gap round 11's bind-first fix to demo.Run didn't extend to record's own call path; demo.Run removes the session directory if serveOn fails after session.Create succeeds; review now distinguishes a nonexistent -session directory from a real, un-ingested one; two stale CI claims in the verification brief (the dropped macOS matrix leg, and which smoke-test assertion actually guards the merge→report join) corrected against ci.yml; the release workflow's version-stamp check now also runs pre-publish against the local dist/ tarball, not only after the tag is public. Nine nitpicks: record's non-macOS -demo exit behaviour and review's character-device TTY gate corrected in the CLI reference; a report.md quote-style mismatch, a per-endpoint JSONL-record overclaim, and a startup-timing overclaim corrected across three docs pages; the Quickstart's git clone prerequisite and install.sh's $TESTIMONY_INSTALL_DIR flag summary noted; two unrecorded CI decision reversals logged in DECISIONS.md. Refuted: a claimed gap between AGENTS.md's local command menu and the gates CI actually runs (the menu lists a single-test go test -run invocation no one would expect CI to run; go test -race ./... already covers the suite).

Merge gate: CI green on every push. Correctness review: MERGE outright (two non-blocking nits: a stale doc comment, and Serve losing its only non-test caller — neither a defect). Docs-accuracy review: initially BLOCK — it caught a real error in this round's own review-TTY-gate fix (the doc claimed piping /dev/null into review enters the interactive walk; only redirecting stdin from /dev/null does, since a pipe reading it is not itself a character device) — fixed and independently reproduced (cat /dev/null | review skips the walk; review < /dev/null enters it), along with the reviewers' other nits, and pushed.

Note for the record: the repo owner merged the PR directly after that fix push, once CI on the final commit (905fb74) was green — this session did not get to re-run a fresh adversarial pass on that last commit before the merge landed, so its correctness rests on the maintainer's own review and the green CI run at merge time, not a second loop verdict. Same situation round 12 recorded.

---

Generated by Claude Code

[REPPL]

Round 14 — findings: 13 substantive, 9 nitpick, 4 refuted; nitpicks-only: no; PR #31 merged.

Note: this round resumed an open PR left by a previous round (per the loop's "PR still open → skip hunt, resume at merge gate" rule) rather than running a fresh hunt.

Findings are detailed in PR #31's description (manifest write-size cap, transcribe's zero-utterance overwrite guard, the pipeline-smoke join assertion, release.yml's supply-chain gate on tagged commits, install.sh actually executed in CI, plus brief/docs corrections against the shipped v0.4.0 CLI).

Merge gate: CI green on every push. Two adversarial reviews — correctness and docs accuracy. Correctness returned MERGE outright (two non-blocking notes: a pre-existing "refusing to overwrite" wording pattern shared with analyze.Ingest, and two intermediate commits in the round's own history that are momentarily bisect-hostile, harmless under squash-merge). Docs accuracy initially BLOCK on three defects the round's own fixes left behind — 07-review.md and review.go still described interactive review as "TTY-gated: not a terminal" after the same PR corrected that framing elsewhere in cli.md/cli.go to "character device" (true for /dev/null too); 01-demo.md still claimed the write guard requires a "same-origin" Origin where the code accepts any loopback host regardless of port; 02-schemas.md had a one-space comment-misalignment regression — all three fixed, pushed, and independently re-verified (MERGE).

Note for the record: while this round's fix was being verified, one further commit (c5e825b, a 01-packages.md clarification that report's inlined join test, not timeline.EventsNear itself, is position-keyed) landed on the branch under the same pinned identity — consistent with the concurrent-session collision round 12 recorded. Verified directly against timeline.go/report.go before merging rather than only noting it unreviewed.

---

Round summary, no separate DECISIONS.md commit needed — the round's entry landed in PR #31 itself.

---

Generated by Claude Code