[US-479] refactor: delivery workflow TO BE — coordinator + phase skills, one squash with the 2026-09-08 hardening - #480
Conversation
…y, domain map, preflight, P3 carry-forward Squash of the fifteen direct-to-main hardening commits of the pair-implement-batch engine (2026-09-01 … 2026-09-08: front-load review contract coverage; prove external boundaries; the review severity floor defaults to Minor; prove claims and collisions; preflight review fixes; lock red contracts before fixes; seal RED contracts in Git; bind RED fixtures to tests; escalate history before seal; harden sealed fix loop; carry P3 evidence forward; guard sealed custody; repair one RED contract; map RED domains; retain grammar tokens), kept as the shipped state of fact: engine, tests, the pair-red-*/pair-fix-*/pair-custody-verifier agents, their dataset mirrors, batch-engine.mdx and apps/pair-cli/config.json. The adoption records the 2026-09-03…09-08 commits carried (11 decision-log entries, four Review Convergence bullets in way-of-working.md) are NOT part of this squash: the maintainer declared that process no longer valid on 2026-09-08 and they never enter this history; the engine keeps DEFAULT_SEVERITY_FLOOR with its rationale in the code comment. The three records that remain valid (2026-08-31-review-baseline-and-provisioned-artifact-contract, 2026-09-01-review-contract-inventory- prevents-serial-findings, 2026-09-01-external-boundary-proof-prevents-false-equivalence) and their three Review Convergence bullets ARE part of it. The code stays as the product's current behaviour. Refs: #219 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ract names every status it emits pair-loop matched halted cards on `escalate` / `failed*`. The engine also returns `seal-invalidated` and `stale-history-decision`: those cards were neither halted nor parked, so they were re-selected and re-driven on every iteration up to max-iterations. Rule inverted to a deny-list of one — only `ready-for-merge` may advance — and the audit-resume prompt reads the same rule. implement-batch's CONTRACT block now lists every status the code emits and states that a caller must halt on any status it does not recognise. Dataset mirrors synced. Test: pair-loop.test.mjs "ANY non-ready status halts the card" (red before, green after). Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ever repaired Removed from pair-implement-batch: the custody probe (pair-custody-verifier agent, Custody phase, CUSTODY_SCHEMA), card-level `custodyReset` and `historyDecision`, the `supersedes` seal field, `applyHistoryDecision` / `textualHistorySubjects`, the `history-subject` finding kind, and statuses failed-custody / failed-custody-reset / seal-invalidated / stale-history-decision. −246 lines of engine, 14 tests retired, 3 added. Rule that replaces it (TO BE §3.4/§7.5): an in-flight attempt whose base moved fails closed where it is measured — sealer refuses a HEAD ≠ base, preflight refuses a non-ancestor snapshot — and a resumed run starts a fresh review on the current head; older snapshots are historical evidence. A history-only finding stays a typed human escalation (`humanDecisionKind: history-rewrite`) taken before RED/seal/GREEN; nothing in the engine can accept or waive it. pair-reviewer.md: history clause reduced to the escalation. batch-engine.mdx: custody agent row and the two custody sections replaced by "History rewrites and rebases". Dataset mirrors synced. Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…GREEN/P3 dispatched by name; Git custody in red-snapshot.mjs
Six skills in a new `workflow/` category (installed as pair-workflow-*): remediation-plan (D0),
red-spec (D1, domain map folded in), red-verify (D2), red-seal (D3), green-fix (D4), p3-verify
(D5). Each declares arguments, one mutation boundary and a handoff JSON under
.pair/working/runs/<runId>/<story>/. pair-implement-batch.js now names the skill and passes
typed args ($run $story $pr $phase $base $worktree $branch + phase JSON); the fase-D prompt
constants, the mapper agent and its schema are gone. One frozen plan per round; groups run
sequentially, each on the previous group's verified head; a plan that drops/duplicates/invents
a finding index is failed-plan. `args.runId`, `models.planner` (replaces redMapper),
`pipeline.skills.{remediationPlan,redSpec,redVerify,redSeal,greenFix,p3Verify}`.
red-snapshot.mjs: deterministic `seal` (HEAD == base, sha256 per artifact, tree dirty only at
the contract, one --no-verify commit with the Pair-RED-Snapshot trailer, idempotent) and
`verify` (one snapshot by trailer, parent == base, tree == manifest+artifacts, sealed blobs
byte-identical at HEAD, no unlisted test change, fixScope respected, no module added under a
behavioral scope). 12 tests on throwaway repos. Sealer (sonnet) and P3 agents run it.
Conformance checker learns the `workflow` category (four-part breakdown); KB/docs counts 44 → 50;
skills-catalog, skills-guide, next catalog gain a Workflow section; batch-engine.mdx rewritten
for the phase flow. ADR-024 records the decisions (storage authority, repair budget 1, local
snapshot commit, rebase never repaired, agent budget as AC). Dataset mirrors synced.
Tests: 375 workflow (dry-run harness + red-snapshot), 4900 knowledge-hub.
Refs: #479
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…k tier) and cycle-comments (probe / flush / synthesize) pair-workflow-review-phase owns the independent review: it reads the PR's risk:* label and declares its passes before running (general via the configured review skill on green; + security and boundary lenses on yellow; + architecture and an adversarial second pass on red), unions and deduplicates to one finding set with the template vocabulary, and carries the rules the engine used to spell in a 5 KB prompt — pacing, blindness, finding shape and acceptance plan, evidence ledger / boundary proof / lossless diagnostics, no-new-issues, nonActionable + disposition, history-rewrite escalation, TEXT SHAPE — plus the three modes (first posts with the hidden marker; re-review inspects only the fix delta, silent; fresh is a full silent pass). pair-workflow-cycle-comments owns the PR-comment policy: probe (log present? marker on the PR?), flush (escalation, superseding any prior flush, log kept), synthesize (ONE remediation table across every run, intermediates minimized, log deleted). pair-implement-batch.js dispatches both by configured name with typed args ($mode, $marker, $template, $severities, $verdicts, $reviewSkill, $writeIssue, $priorFindings, $priorHead, $hasLog, $accepted); the reviewer prompt, probe prompt, both flush prompts, the synthesis prompt, CONTRACT_INVENTORY, revWtClause and the flush helpers are gone from the workflow. pair-reviewer agent thinned to a skill executor. Counts 50 → 52; catalogs, batch-engine.mdx and ADR-024 updated. Dataset mirrors synced. Tests: 375 workflow, 4902 knowledge-hub, 177 website. Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…phase, pr-phase; the workflow dispatches no free-form prompt
pair-workflow-contract-phase (ensure-contract.mjs check/write, severityRanks from meaning not
order), pair-workflow-implement-phase (worktree isolation incl. stacked stories, implement process
test-first, finite-state / evidence / collision / lossless / boundary disciplines, tier gate,
decisions, checkpoint) and pair-workflow-pr-phase (resume from checkpoint, publish through the
configured publish-pr skill, TEXT SHAPE, review-dispatch-required signal). The coordinator passes
$run $story $branch $worktree $base $stacked + the configured skill names + $notes; wtClause,
revWtClauseBase, TEXT_SHAPE, FINITE_STATE_COMPLETENESS and their sub-constants are gone. One run
directory per story for every phase (args.runId, default story-<id>); every invocation names its
story ("for story #<id>"). p3-verify owns its detached-worktree isolation. pair-implementer and
pair-contract-generator thinned to skill executors. Counts 52 → 55; catalogs, batch-engine.mdx,
ADR-024 updated. Dataset mirrors synced.
Tests: 375 workflow, 4905 knowledge-hub, 177 website.
Refs: #479
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…istory — workflowVersion, zero-prompt / zero-shell AC pair-implement-batch.js: 56 changelog-style comment blocks (issue numbers, "measured", round-by- round defect narration — 614 lines) compacted into behavioural comments; the defect history is recorded once as an appendix of ADR-024. 1929 → 1671 lines (2222 at the start of US-479). WORKFLOW_VERSION is returned with every result and handed to every phase skill as $workflowVersion, so each handoff records the coordinator that produced it. Acceptance criteria as tests: every agent dispatch is a skill invocation (`Invoke **<configured skill>** for story #<id> with <typed args>`), no dispatched prompt carries a git/gh/node command, none of the retired prompt rules survive in code, and the version reaches every skill on every run. Tests: 378 workflow, 4905 knowledge-hub, 177 website. Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…skills run on every harness red-snapshot.mjs and ensure-contract.mjs move from .claude/workflows/pair-contracts/ (a registry that installs only in Claude Code) to .pair/knowledge/assets/, the channel every harness installs (same as coverage-ratchet.cjs, ADR-023). red-seal, p3-verify and contract-phase invoke `node .pair/knowledge/assets/<script>`; the dry-run tests and the contract cache's .gitignore stay under pair-contracts/. Skill description examples no longer name this repo's PR (#480 → #42). Dataset mirrors synced; ADR-024 and batch-engine.mdx updated. Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
ensure-contract.mjs ships in contract-phase/scripts/; red-snapshot.mjs ships in red-seal/scripts/ (seal) and, byte-identical, in p3-verify/scripts/ (verify) — red-snapshot.test.mjs fails if the two copies (installed and dataset) drift. Each SKILL.md resolves its script from its own directory ($SKILL_DIR/scripts/…), never from a repository path, so a skill is portable as one folder on any harness. .pair/knowledge/assets/ no longer carries them. eslint ignores dataset/.skills/**/scripts/*.mjs on the same one-artifact rule as the workflows. Dry-run tests stay in .claude/workflows/pair-contracts/ and import the skill-local scripts. Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
rucka
left a comment
rucka
left a comment
There was a problem hiding this comment.
Verdict
risk:red · cost:green — CHANGES-REQUESTED — la trasformazione tecnica e i gate sono verdi, ma la story non ha AC verificabili e manca il canary end-to-end richiesto.
Open findings: 2.
PR: #480 · Author: rucka · Reviewer: rucka (self-review) · Date: 2026-09-09 · Story: US-479 · Type: refactor
Classification matrix — per dimension
| Dimension | Tier | Source | Note |
|---|---|---|---|
| Service/domain criticality | green | risk matrix | Touched deployables listed Low. |
| Change/diff risk | red | 90-file diff | Workflow/phase contract refactor. |
| Business impact | green | subdomain | Generic development tooling. |
| Security relevance | yellow | security review | Local config reaches shell boundaries; validation is security-adjacent. |
| Coupling balance | green | coupling review | Typed phase contracts and mirror/identity tests keep boundaries balanced. |
Tier is risk:red; cost is cost:green. Refinement floor unavailable because #479 is not refined.
Assessments
Security — Input validation
Verdict: yellow — workflow card/pipeline inputs reach shell-running agents; reject-path validation is present and tested.
Security — Output handling
Verdict: green — no web/API output surface added.
Security — Authentication
Verdict: green — no authentication surface changed.
Security — Authorization
Verdict: green — no authorization surface changed.
Security — Introduced vulnerabilities
Verdict: green — 0 introduced, 0 pre-existing findings.
Cost
Verdict: cost:green — no paid-provider, IaC, queue, scheduler, media, or LLM cost surface added.
Architecture (Coupling)
Verdict: green — phase handoffs are typed and skill-local scripts are identity-checked across their required copies.
Bug fix — Red test before fix
Verdict: not applicable — not a bug fix.
Details
Findings by severity
Critical
- None.
Major
- [Story #479 — Story Context] Acceptance criteria are explicitly “to be fixed during refinement”. Refine the story with measurable AC before merge; the review cannot validate the claimed workflow contract against an unrefined story.
- [PR #480 — Testing / Story #479 DoD] The required end-to-end canary is still unchecked. Run one story through the new engine to
ready-for-mergeand attach durable evidence (run/phase handoffs, one first review, final synthesis).
Minor
- None.
Questions
- None.
Positive feedback
- ADR-024 records the new phase-skill architecture.
- Script copies and dataset mirrors are guarded;
red-snapshotcopies are byte-identical. - No new dependencies; CI and local full quality gate pass on
da1eb9a.
Functionality & requirements
- FAIL — story AC absent; required canary not executed.
- The static workflow contract, phase dispatch, and mirror behavior are covered by the automated suite.
Testing & quality gates
- PASS —
pnpm quality-gatepassed locally on PR headda1eb9a; publishedformat,secret-scan,build,preview, andsmokechecks are successful.
Adoption compliance
- Level 1 — tech stack, architecture/ADR, security, coding standards, and infrastructure conformant. No unlisted dependency; ADR-024 is present.
Tech debt
- 0 introduced items flagged.
Documentation
- PASS — workflow documentation, skills catalog, and dataset mirrors updated.
Performance & deployment
- No runtime hot-path or deployment change; rollback is the normal PR revert/squash workflow.
|
Review finding 1 (Major — story AC) — resolved. #479 refined via Finding 2 (canary) — in progress: |
…typed refusals are answers, handoffs in the main checkout Canary run 1 (story #321, PR #481, runId canary-479): fases 0/A/B/C and the planner worked; the RED author refused group r1-g1 as `split-required` — a guard-strength finding (positional-blind assertion) with production already correct has no RED against unfixed production — and the engine re-dispatched the identical prompt once before ending the card as failed-red-contract (8 agents). - Third group mode `test`: allowedPaths [], RED proven against an injected regression, no GREEN, P3 verifies the sealed head; red-snapshot.mjs treats any production change under a test scope as `test-mode-production-change` (script test added; both copies synced). - A typed refusal (`stale`, `split-required`; planner `stale`) is routed by status and never retried with the same prompt; the result carries `redRefusal` and `splitReason`. - Handoff directory rule: `.pair/working/runs/<run>/<story>/` in the MAIN checkout the coordinator was started in, never a story/review worktree (the review's detached worktree took its handoff with it) — stated in every skill's $run row and in the dispatch text. ADR-024 amended (§8–10); batch-engine.mdx and the remediation-plan description updated. Tests: 382 workflow (+2 coordinator, +1 script), 4905 knowledge-hub, 177 website. Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
Canary run 1 ( Fixed in Canary run 2 ( |
|
Canary run 2 ( What c8 fixed is confirmed live: the probe recognised the existing first review (silent Where it stopped: group r1-g1 ( Reading: the engine behaved as designed; #321 is a poor canary for D1–D5 — every finding is a regex guard over SKILL.md prose, where a "discriminating RED" is genuinely hard and the verifier is right to refuse. Seal, GREEN and P3 have still not run live. Evidence: |
…low; way-of-working Review Convergence note Refs: #479 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…on, never a login literal — unresolvable ⇒ typed refusal (t9d-17)
- resolveMaintainer: code-host-assignee, else default-assignee from way-of-working.md found above --dir; --maintainer overrides (source flag); absent ⇒ maintainer-unresolved:* before any PR read, nothing written; result reports maintainer { login, source }
- apply-scope-decisions + discovery; header + batch-engine.mdx aligned; ADL; llms.txt regenerated
- tests: adoption names alice (rucka refused), code-host wins, unresolvable refusal, CLI override; run-dir fixtures seed adoption; source scan for literals; 10 copies synced
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
…review check and the pr-state label — merge stays outside the engine (t9d-24) - review-phase scripts/pr-state.mjs: conclude (status POST on the exact sha, label swap, read-back, idempotent, advisory when the token cannot post) / find; KB mapping of pr-state.sh; installed + dataset - review-phase Step 5.7 (last non-partial reviewer; a non-decision publishes nothing); "never label" narrowed; published.reviewCheck/prState in the handoff and VERIFY_SCHEMA; run log reports them - publish-pr Phase 5, pr-states.md "who does what", batch-engine.mdx aligned; ADL; ADR-024 amendment (w) records the giro-2 contract additions; llms.txt regenerated - tests: pr-state.test.mjs (7) + coordinator schema/log Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
…xit path; host recipe placement on the workflow path (t9d-28, t9d-1) - ADL: engine writes cards/PRs via gh only (GitHub as code host + PM tool, from Claude Code); typed refusal elsewhere; exit path = one cardTransport seam selected by adoption; to be promoted to a tech-debt issue by the maintainer - finalize ADL addendum: the sandbox has no shell — no hook in pair-loop.js; `pair run` is the host for the full recipe (follow-up); pair-loop SKILL note (both copies) - ADR-024 (w): both bullets + t9d-2 recorded as open with its design; batch-engine.mdx constraint; llms.txt regenerated Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
… --pr, quotePath-safe diff, comment body on stdin with a cap, flag aliases, status map, normalized scope identity (t9d-8/12/16/18/21/22/30)
- t9d-16: SHELL_METACHAR_RE / SHELL_UNSAFE reject control chars, redirects, `${}`, a leading flag, an interpreter prefix; closureAssertions[].command/testRef and reproducerRef checked by publisher AND coordinator
- t9d-18: manifestPathFor and the CLI require a numeric --pr
- t9d-21: `git -c core.quotePath=false diff --name-status` — a non-ASCII test path is unlisted-test-changed, never out-of-scope
- t9d-22: pr-comment sends the body via `--input -`; > 65536 chars is the typed error body-too-long before any write
- t9d-30: cycle-runtime accepts --repo|--repository everywhere; finalize --pr optional (publication not-applicable)
- t9d-12: coordinator maps failed-verify; conformance test pins the emitted reasons to the map
- t9d-8: scopeBaselineHashOf normalizes id/type (NFC, trim)
- tests in five suites; fakes accept --input -; copies synced
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
… note on where the contract tests run, supersession notes in ADR-024 (t9d-29/31/32/33) - green-fix + review-phase Arguments tables gain the `$regressionGuards` row (both copies) - every pair-contracts suite states it runs from .claude/workflows only (dataset copy is byte-identical, install-excluded, not executable in place) - pair-loop.js halt rationale cites current statuses; ADR-024 (w): §2 paths and §6 `failed-red-contract` superseded, `telemetry` / `observe --publish-pr` never shipped Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
… run directories, and a sibling-run scan that does not need a PR (t9d-11/19/20) - t9d-19: cycle-state, cycle-runtime, red-snapshot, pr-comment, pr-state refuse an unknown flag before anything runs (per-command FLAGS) - t9d-20: safeRunDir — `--dir`/`--legacy` with a `..` hop is path-escape, a real path outside `.pair/working/runs/` (symlink) is path-outside-runs; `--file/--journal/--usage/--transcripts/--out/--result` are `..`-free; publish() and resolve() refuse at the JS entry too - t9d-11: resolve scans sibling run directories by story, the PR narrowing only when known — a fresh-entry card adopts the existing cycle - tests in five suites; 10 copies synced Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
…spatch resolves the template contract (t9d-2, AC-06) - coordinator: CONTRACT state + `$contractSpec` on the first review; adoptTemplateContract recomputes the vocabulary constants (now `let`, recomputeVocabulary()) from `templateContract`; that one review is validated post hoc (verdict ∈ template options); VERIFY_SCHEMA declares templateContract; a caller floor the template cannot express fails the batch at adoption; `contracts[]` reports cache-hit | regenerated | fallback-loose | unresolved - review-phase SKILL: `$contractSpec` argument + Step 0 bullet + output field (both copies); contract-phase note; batch-engine.mdx; ADR-024 (w) closing bullet - tests: golden traces without the generator (cold 4, one fix 8, resumed 1), first review loose + second enum-locked, off-vocabulary verdict refused, stdDispatch rides templateContract on the first review Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
Review 5190603055 — dispositionsFindings not closed by code on this head, with their disposition:
All other Major and Minor findings of review 5190603055 are fixed across the 14 giro-2 commits, verified on head Generated by Claude Code |
Review 5190603055 — questionsDispositions for the 10 informational Questions, read against head q-1 — q-2 — q-3 — q-4 — q-5 — cohort files written without tmp+rename. Confirmed at q-6 — q-7 — marker match is q-8 — q-9 — q-10 — ADR-024 has no Summary. Accepted as designed: q-1, q-3 (code half), q-5, q-9. Out of scope / not ours: q-6, q-8. Deliberate with a stated rationale: q-2. Materially narrowed by Generated by Claude Code |
…t run (t9d-25) Records the maintainer's decision as an ADL, so the requirement no longer lives only in a chat comment (t9d-25) and the card's T-8 line has a source: - T-8's paired 2.0.0 vs 4.0.0 measurement will NOT be run: the full engine cycle already shows a clear improvement, and the 2.0.0 baseline cannot be measured from this environment (no session, token usage not observable) - evidence accepted in its place: canary v3 (done + APPROVED review) and canary v9 (first fully autonomous cycle on PR #481, APPROVED on b733e06) - DT-36 and the matched-cost half of AC-14 are unevidenced BY DECISION, not by omission; a paired baseline, if wanted, becomes a separate story - cross-references ADR-024 (h)/(i)-F4/(v) and story #479, PR #480 - .pair/llms.txt regenerated No engine, script or guideline behaviour changes. Refs: #T-8, #T-9 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
…an accepted risk with its exit path An author predicate is not resolvable from what the engine has: `GET /user` is 403 for an installation token and refused by the canary sandbox proxy, GraphQL `viewer` is blocked, `gh auth status` carries no identity, and the PR author is not the engine (#480: `rucka` vs `claude[bot]`). The publishing identity also VARIES per environment — #480 carries marker-bearing pair comments by both — so an own-author predicate would blind the engine to its own earlier publication, duplicate it, and then wedge on `marker-ambiguous` by itself. Recorded instead of guessed: - ADL 2026-09-13-pr-comment-marker-matching-stays-author-blind.md (risk, why accepted, exit path: an adoption-declared publishing identity resolved like the scope-decision principal). - The same note at the code site, byte-identical across the 4 `pr-comment.mjs` copies. - Characterization test pinning both accepted outcomes (a foreign carrier is PATCHed, two carriers refuse) and that authorship never reaches the engine — it MUST fail when the exit path is taken. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
…n, and the catalog's date is gated like its rows - ADR-024 `## Adoption Impact`: which way-of-working sections carry the rules a cycle obeys, the ADLs that hold the delegated decisions, and that tech-stack/architecture/infrastructure are deliberately untouched. - `skills-catalog.mdx` header: 2026-09-08 -> 2026-09-13. - The gate now compares that header against `git log -1` on the dataset skills tree (`checkCatalogFreshness`, Check 2d): every sibling check counted skills, so the stale date was invisible. Both degenerate cases (unparsable header, unresolvable source date) fail loudly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
|
q-7 and q-10 closed — the last two open items of the independent pass over review 5190603055. q-7 (residual security risk, q-10 (docs hygiene) — Verification: Generated by Claude Code |
Review 5190603055 — closing synthesisAll 33 findings of review 5190603055 are closed on head Update ( Findings
Questions (10) — one-line dispositionsRe-verified at
Current state of the head
Not verified — listed as open, not claimed closedClosed since this list was first written (both on
Generated by Claude Code |
…e publishes it, `scope-baseline` prints it, the prose names both (t9d-8) `apply-scope-decisions` refuses the maintainer's comment without `scopeBaselineHash` and refuses a wrong one, but no participant could produce the value: no CLI command printed it and `resolve`'s `awaiting-scope-decision` payload omitted it, while the review-phase SKILL told the reviewer to put it in the packet. - `resolve` carries `scopeBaselineHash` next to the `scopeChanges` it hashes - `cycle-state.mjs scope-baseline --dir <run dir>`: standalone producer, read-only, no `gh` - `pendingScopeOf`: one union for producer and consumer — the baseline cannot be computed two ways - Step 5.4b names both producers and forbids a hand-made hash - t9d-8 conformance: resolve's field, the CLI command + flags, the prose in both copies - ADL: the scope-baseline hash is published to the reviewer Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147cVywTQGNNvQBhcUPsmKU
claude
Bot
added
pr-state:ready-to-merge
Verdict
PR: #480 · Author: rucka · Reviewer: independent closing reviewer (final pass over review #5190603055) · Date: 2026-09-13 · Story: US-479 · Type: refactor (engine 4.0.0) Classification matrix — per dimension
Tier = max(assessed) = red, confirmed not lowered (review floor, D17) — held at AssessmentsSecurity — Input validationVerdict: green — resolved. Originally red: agent-returned Details
Security — Introduced vulnerabilitiesVerdict: green — 0 open (4 introduced, 4 fixed; 0 pre-existing raised). Details
No introduced red security finding remains open — the introduced-red-security rule does not fire. Source: closing synthesis. CostVerdict: Details
Architecture (Coupling)Verdict: yellow — structural note stands, no open finding. The 5×2 byte-pinned Bug fix — Red test before fixVerdict: not applicable — not a bug fix. PR type is refactor (US-479, engine 4.0.0); no bug/defect reference. Where remediation did add regression coverage for closed findings (e.g. t9d-6's fixture, t9d-16/18/19/20/21 characterization tests), it is cited per-finding above and in the closing synthesis, not required by this check. DetailsFindings by severity — all 33 closed (source: review 5190603055, dispositioned/closed in the dispositions comment and the closing synthesis)Critical — closed (0 raised)
Major — closed (15/15)
Minor — closed (18/18)
Questions — 10/10 dispositioned (informational, none blocking)
Positive feedback
Functionality & requirements (AC coverage)
Testing & quality gates
Adoption compliance
Tech debt
Documentation
Performance & deployment
Note on process, not verdictReview 5190603055's own tier requirements (🔴, quality-model §4) call for explicit non-author human approval, but flag it advisory only because For review type emphasis: this is the Refactoring case — behavior unchanged, coverage maintained (701/701 workflow tests + 8351 package tests, up from 652 at first review). Review conduct standards: see team standards. Draft final review — not posted. Evidence cited: review 5190603055, dispositions, questions, q-7/q-10 closure, closing synthesis (incl. its two residual-closure edits for t9d-6 and t9d-8). CI check-runs and combined status verified live against head |
2 participants
PR Information
PR Title: [US-479] refactor: delivery workflow TO BE — coordinator + phase skills, one squash with the 2026-09-08 hardening
Story/Epic: #479 (epic #212)
Type: Refactor
Priority: High
Assignee: @gcarucci
Labels: user story
Summary
What Changed
The branch starts at
7b559003(the squashed 2026-09-08 hardening, removed frommainon 2026-09-08 so that this PR's squash-merge brings it back together with the TO BE work). Commits land in this order, engine usable and tests green after each:5864b162pair-loop.jshalts on every status ≠ready-for-merge;implement-batchCONTRACT lists every emitted status54e9578acustody/history machinery removed; rebase ⇒stale36cf29b860429507fase D: planner D0, skillspair-workflow-red-spec/red-verify/green-fix/p3-verify, seal + blob-check as node scripts, one handoff JSON per phasee1886ea2fase C:pair-workflow-review-phase, declared review set per risk tiere2e9d9e8fasi A/B →pair-workflow-implement-phase/pr-phase7f4cbb5achangelog-comments → ADR;workflowVersion; zero prompt / zero shell inpair-implement-batch.jscontract-phase/scripts/ensure-contract.mjs,red-seal/scripts/red-snapshot.mjs, byte-identical copy inp3-verify/scripts/, drift-guarded by test) so a skill is portable as one folder on any harness; skill examples neutralizedWhy This Change
pair-implement-batch.js(2222 lines) carries phase policy in free-form prompts, orchestrator-side semantics, and a rebase-repair layer (custody/history) that a stale-head rule makes unnecessary. Reference design:.pair/working/reports/delivery-workflow-to-be.md, with the corrections recorded in #479.Story Context
User Story: see #479
Acceptance Criteria: to be fixed during refinement of #479
Changes Made
Files Changed
.claude/workflows/pair-implement-batch.js,pair-implement-batch.test.mjs,pair-loop.js,pair-loop.test.mjs,.claude/agents/*, dataset mirrors,batch-engine.mdx.claude/skills/pair-workflow-*/(11, three of them with ascripts/folder),.claude/agents/pair-remediation-planner.md, ADR-024.claude/agents/pair-custody-verifier.md,pair-red-domain-mapper.mdensure-contract.mjs→pair-workflow-contract-phase/scripts/Testing
Test Coverage
pnpm workflows:test, 378 tests incl. the two US-479 acceptance criteria), conformance/mirror suites (4905), website (177)red-snapshot.test.mjs— 12 scenarios on throwaway git repositories (seal idempotency, blob identity, unlisted test, out-of-scope, behavioral module add, rebase ⇒ snapshot-missing, CLI exit codes)ready-for-mergeon the new engine (canary) — proposed: this PR's own final review viapair-implement-batchinprNumbermodeQuality Assurance
Code Quality Checklist
Review Areas
pair-loop.js🤖 Generated with Claude Code
Review classification
risk:red · cost:green — review matrix (2026-09-09)
Classification matrix — per dimension
tech/risk-matrix.mdCost: green — no cost surface touched. Review classification has no refinement floor: #479 has not been refined.