From 44148ee33c7444b516613c97430345aecbb7d8c4 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Tue, 21 Jul 2026 09:22:19 +0800 Subject: [PATCH 01/66] =?UTF-8?q?delegation-and-review=20=C2=A73:=20freeze?= =?UTF-8?q?=20the=20tree=20for=20a=20read-only=20review=20dispatch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- skills/delegation-and-review/SKILL.md | 31 +++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 9689451..527748f 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -83,6 +83,25 @@ reviewers that they silently absorb as implementers. verdicts name the point nearest failure or they are rubber stamps. - Critic verdicts carry evidence: REFUTED needs a counterexample; untested assumptions are listed. Verify critics too; stale or missing review is not approval. +- **Freeze the tree for a read-only review dispatch, or shard it disjointly** + (`unprobed` — private incident as shape; see Provenance). Editing a file a + fresh-context critic is still reading contaminates its verdict: one + read-only critic re-read a file the orchestrator had already fixed + mid-review and voted REFUTED on a bug already confirmed elsewhere. A + separate critic committed the very worktree it was reviewing, moving the + tree out from under the orchestrator's expected end-state. Neither is + §4's write-write clobber below (a subordinate overwriting concurrent + edits with no conflict signal): the first is a read verdict going stale + mid-read, the second a "read-only" reviewer writing anyway — nothing + overwritten, but the tree moved. Land or hold pending edits before + dispatching a read-only wave; if edits must continue, shard the review + over files disjoint from what you are touching (safe only if the + dispatch is enforced read-only — hence the check below), or re-dispatch + a fresh wave against the settled state rather than trust a verdict + formed on a moving tree. After any reviewer returns, confirm the tree + still matches what you expect before trusting its verdict. + ✅ "held my own edits until the critic's wave returned, then applied + them." ❌ "kept fixing files while the critic was still reading them." - Review against the packet contract, not line-by-line theater. New bug class caught → sweep the codebase: one catch, one class, one sweep. The worker's sweep report obeys operational-rigor §5 (the canonical copy, verbatim: @@ -301,5 +320,17 @@ enforcement or a defect in that sandbox is unestablished, so the rule prescribes only the defensive split. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. +The §3 settled-tree review bullet (2026-07-21) comes from a private +mining pass over two independent incidents in the same review-fan-out +harness: a refuter critic re-read a file the orchestrator had already +fixed mid-dispatch and voted REFUTED on an already-confirmed bug, and a +separate critic committed the reviewed worktree to a branch mid-review, +leaving the requested end-state unreachable. Both observed in a private +audit harness (contributor-verifiable, not linkable here); the fix +(freeze-or-shard, re-check on return) is the defensive split, not a +mechanism finding, mirroring how the §4 silent-clobber bullet above +handles its own single-sandbox observation. Private evidence, cited as +shape per the README covenant's second branch; no in-repo probe has +run — in-body `unprobed` marker. Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. From 2bf9314ccd808589b82957b1dd97a9a5398d3942 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Tue, 21 Jul 2026 22:12:29 +0800 Subject: [PATCH 02/66] =?UTF-8?q?operational-rigor=20=C2=A74:=20verify=20a?= =?UTF-8?q?=20scheduled=20process's=20side=20effects,=20not=20its=20self-r?= =?UTF-8?q?eport?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A recurring automation's own "completed" log proves the process ran, not that its outputs landed. Private incident: a weekly task reported success for ~3 months while its write step silently never executed (every output file's mtime frozen from the day the path broke); a second, independent output channel on the same task was separately dead the whole time on a stale hardcoded credential. Rule: supervised first run + per-channel artifact verification, a dated health line whose absence is itself the signal, pre-confirmed permission gates for headless runs, and mtime audits when reviewing an existing schedule. Ships unprobed per the README covenant — no long-running-schedule arm in this pack's private fixtures yet. --- skills/operational-rigor/SKILL.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 82300cc..9e2ee6d 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -302,6 +302,24 @@ When rigor conflicts with finishing sooner, rigor wins. (contract holds under adversarial input). Only correct permits "done". - Never fabricate observations or report outputs not produced. Report skipped verification as skipped. +- **A recurring scheduled process's own "completed" report is not evidence its + side effects landed.** A weekly task reported success for three months while + its write step silently never executed — every output file's mtime frozen at + the date the write path broke, caught only by an unrelated mtime audit; a + second, independent output channel on the same task was separately dead on a + stale hardcoded credential the whole time (`unprobed` — private incident as + shape; see Provenance). Arming or reviewing any recurring automation: run it + supervised once and verify each output channel by its actual artifact or + response body, not the runner's exit status; have the task write a dated + health line whose absence itself is the failure signal (an "OK" it can only + ever emit is not one); pre-confirm every permission-gated call it makes, + since a headless run cannot clear an interactive prompt; and when auditing an + existing schedule, check output mtimes before trusting its run history — a + green log proves the process executed, not that anything downstream received + what it produced. + ✅ "ran it once watched, confirmed a new file appeared with today's mtime and + the correct content, then armed the schedule." + ❌ "the log shows 200/exit-0 every week, so it's working." - **Data-path integrity — fail loud on *unspecified* ambiguity, never emit a silently-wrong value.** Honor an explicit, documented contract (a declared default, precedence, or freshness window); what is forbidden is *silently* @@ -538,6 +556,15 @@ the deployed path (contributor-reported shape; the private repo is verifiable by the contributor, not linkable here). It ships `unprobed` — the pack's private fixtures have no interactive arm to drive it (cf. the grill-pass note above); the marker records that debt, not an exemption. +The §4 scheduled-process rule (2026-07-21) generalizes a private production +incident: a weekly automation ran and reported completion for roughly three +months while its write step silently never executed, every output file's mtime +frozen from the date the path broke; a second, independent output channel on +the same task was separately dead the entire time on a stale hardcoded +credential (contributor-reported shape; the private repo is verifiable by the +contributor, not linkable here). It ships `unprobed` — the pack's private +fixtures have no long-running-schedule arm to drive it; the marker records +that debt, not an exemption. Stable behavioral rules; the environment-specific facts to re-verify now travel with the rules that cite them — the external-systems set in `references/external-systems.md`, plus §2's mount-check commands From 796378543fc7ce4f74ba830000b0d3e9af6b46a6 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Tue, 21 Jul 2026 22:13:06 +0800 Subject: [PATCH 03/66] =?UTF-8?q?delegation-and-review=20=C2=A72:=20scope?= =?UTF-8?q?=20a=20sweep=20by=20every=20generator,=20not=20one=20grep=20pat?= =?UTF-8?q?tern?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A find-and-fix-every-instance sweep needs the same rigor as any other owned-scope field. Private incident: a 53-file styling sweep, three review rounds, and a merged fix all missed the real defect — it lived in a shared global utility class the token grep pattern never touched — and each follow-up round's "still broken?" surfaced a different category (a color-tier band, a class-emitting helper function) the prior round's search structurally excluded. Rule: enumerate every generator (literals, shared/global definitions, class- emitting helpers) and the full value space before dispatching or accepting such a sweep, and gate acceptance on observing the effect rather than on the search returning zero. Ships unprobed per the README covenant. --- skills/delegation-and-review/SKILL.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 9689451..deeeb45 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -33,6 +33,19 @@ Every packet names: - **Goal + motivation** — what and why. - **Owned scope + explicit non-scope** — files/modules it may and may not touch. + For a find-and-fix-every-instance sweep, scope means every surface that can + generate the target pattern, not one search pattern: a 53-file styling sweep, + three review rounds, and a merged fix all missed the actual defect because it + lived in a shared utility class the token grep never matched, and each + follow-up round found a different category (a color-tier band, a + class-emitting helper function) the prior round's pattern structurally + excluded (`unprobed` — private incident as shape; see Provenance). Before + dispatching or accepting such a sweep, enumerate every generator (literals, + shared/global definitions, helper functions returning the pattern) and the + full value space (every tier/variant in the family, not a sample), and gate + acceptance on observing the effect (render it, run it) rather than on the + search returning zero — a clean grep proves one spelling is gone, not that + the defect is. - **Invariant** — property to close and properties to preserve. - **Proof gate** — concrete check that would fail under the broken behavior; worker-chosen "tests pass" is not a gate. @@ -301,5 +314,13 @@ enforcement or a defect in that sandbox is unestablished, so the rule prescribes only the defensive split. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. +The §2 sweep-scope bullet (2026-07-21) comes from a private incident: a +find-and-fix-every-instance styling sweep (53 files), three review rounds, and +a merged fix all missed the actual defect — it lived in a shared global +utility class the token grep pattern never touched, and each follow-up round's +"still broken?" surfaced a different category (a color-tier band, a +class-emitting helper function) the prior round's search structurally +excluded. Private evidence, cited as shape per the README covenant's second +branch; no in-repo probe has run — in-body `unprobed` marker. Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. From eabf5376dfcd61f07266ef6183266fb4dbf17da8 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 00:42:11 +0800 Subject: [PATCH 04/66] =?UTF-8?q?skill-authoring=20=C2=A75:=20keyword-grep?= =?UTF-8?q?=20absence=20is=20not=20absence=20=E2=80=94=20read=20the=20sect?= =?UTF-8?q?ion=20before=20concluding=20not-covered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three same-week incidents shared one shape: a keyword grep of a rules file returned nothing, 'not covered' was concluded, and the content existed under different phrasing — one of them a proposed addition whose substance was already in the target file, caught only by reading the section at drafting time. The no-duplicate-homes rule in §5 has no stated dup-check method; this supplies it: grep target + siblings for synonyms, read any near-topic section in full, and cite the section read (not the empty grep) in a not-covered verdict. Ships unprobed per the README covenant; Provenance records the probe shape as debt. --- skills/skill-authoring/SKILL.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index f9bc110..dc5f46f 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -150,6 +150,21 @@ artifact-producing step. - One skill, one topic; no duplicate homes for a fact — cross-reference the sibling instead. Each skill states **when NOT to use it** and which sibling to use. +- **Keyword-grep absence is not absence** (`unprobed` — private incidents as + shape; see Provenance). The no-duplicate-homes rule above needs a dup-check + before every addition, and a grep that returns nothing is not that check: + an existing rule phrased differently from the search term produced three + false "not covered" verdicts in one week — one a proposed addition whose + content already sat in the target file under other wording, caught only + when the section was actually read at drafting time. Before concluding a + fact has no home, grep the target file AND its siblings for the concept's + synonyms, and when any hit lands near the topic — or the fact plausibly + belongs to an existing section — read that section in full first. A + "not covered" verdict cites the section read, not the grep that found + nothing. + ✅ "grepped 'revert', hit §3's regression bullet, read §3 — the rule is + already there under 'restore'; no addition needed." + ❌ "grep returned nothing, so the file doesn't cover it." - **A cross-reference is not a load** (`unprobed` in-house; external evidence — see Provenance). On weak tiers, discovering that a sibling skill applies is a judgment act: fable-method published a smoke-grade @@ -397,4 +412,15 @@ marker per the README covenant: the external measurement is of one skill's one gate, and whether placement generalizes across gate types is exactly what an in-house probe would test — that probe has not been run; the marker records the debt. +The §5 keyword-grep-absence rule (2026-07-21) generalizes three private +incidents in one week, each the same shape: a keyword grep of a rules file +returned nothing, "not covered here" was concluded, and the content existed +under different phrasing — including one proposed upstream addition whose +substance was already in the target file, caught only by reading the +section during drafting (contributor-reported; the private repos are +verifiable by the contributor, not linkable here). It ships `unprobed` per +the README covenant's second branch — no in-repo probe has run; the +executable probe shape (seed a reworded twin of a rule, instruct a +weak-tier agent to dup-check an addition, observe grep-only vs read) is +noted here as the debt, not claimed as run. Stable method; no environment facts to re-verify. From 4a6c54be1aadb206a767437f5fc7ac9d7b3c6840 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 00:42:37 +0800 Subject: [PATCH 05/66] =?UTF-8?q?skill-authoring=20=C2=A76:=20name=20the?= =?UTF-8?q?=20deployment=20runtime=20before=20the=20review=20concludes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A skill reviewed and finalized against the author's local macOS was rebuilt wholesale the same week when its real target — a sandboxed Linux VM — surfaced after sign-off: host identity, launcher mechanism, and machine-local MCP tool-name assumptions all failed there. §6's lenses check the file against the author's world; none asks where it will run. This adds that question as a review input plus the sweep list for machine-bound assumptions (absolute paths, OS launchers, host identity, clock/timezone, hard-coded MCP tool prefixes). Ships unprobed per the README covenant; Provenance records the probe shape as debt. --- skills/skill-authoring/SKILL.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index f9bc110..3a22838 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -229,6 +229,22 @@ The sharpest usability probe is behavioral: give a fresh weaker-tier behavior down first, then patch the gaps the probe surfaces — not the ones you imagine. +**Name the deployment runtime before the review concludes** (`unprobed` — +private incident as shape; see Provenance). A skill or plugin verified only +on the author's machine can pass every lens above and still be wrong where +it will actually run: one reviewed-and-finalized skill was reworked +wholesale when its real target — a sandboxed Linux VM, not the author's +macOS — surfaced only after sign-off. Ask where it will run as a review +input, not a deploy-time discovery, then sweep the file for assumptions +that silently bind it to the author's machine: absolute paths (§2's rule), +OS-specific launchers and helpers (URL-scheme opens, clipboard or +notification tools), host identity, wall-clock and timezone, and +hard-coded MCP tool names — a connector's tool prefix can be unique to the +author's instance, so a distributable skill discovers its tools at runtime +instead of naming one machine's. Done when the review names the target +runtime(s) and each machine-bound assumption is either portable or labeled +with the runtime it requires. + Fix what blocks, then read back the final files to confirm they landed complete. When mining sessions or external material into skills, strip names/slogans first and keep a procedure only if it still has an apply-when, @@ -397,4 +413,14 @@ marker per the README covenant: the external measurement is of one skill's one gate, and whether placement generalizes across gate types is exactly what an in-house probe would test — that probe has not been run; the marker records the debt. +The §6 deployment-runtime rule (2026-07-21) comes from a private incident: +a skill was authored, reviewed through the lenses above, and finalized for +the author's local macOS environment, then rebuilt wholesale the same week +when the user mentioned it would run inside a sandboxed Linux VM — host +identity, launcher mechanism, and machine-local MCP tool-name assumptions +all failed on the real target (contributor-reported; the private repo is +verifiable by the contributor, not linkable here). Ships `unprobed` per the +README covenant's second branch: no in-repo probe has run; the probe shape +(give a weak-tier reviewer a machine-bound skill plus a named foreign +runtime, observe whether the sweep fires) is recorded as debt. Stable method; no environment facts to re-verify. From ed1cf71ac68c8d53a1cbe8e8518291ab33ea8b01 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 00:43:01 +0800 Subject: [PATCH 06/66] =?UTF-8?q?delegation-and-review=20=C2=A71:=20isolat?= =?UTF-8?q?ed=20worktrees=20do=20not=20isolate=20ports?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In a worktree fan-out, sibling sessions contend for the same configured dev-server port; after auto-port-fallback moves one session's server, a hardcoded localhost: proxy in the app config silently reaches a CONCURRENT sibling's server — blank app or wrong build with every request returning 200, indistinguishable from a bug in your own change (and stopping your own preview cannot stop the sibling's server). The §1 worktree sentence promises isolation the port namespace does not honor; this bullet names the trap and the check order: auto-port from the start, verify against the assigned port, and on all-green misbehavior check cross-port references before debugging your own code. Ships unprobed per the README covenant; Provenance records the fixture gap as debt. --- skills/delegation-and-review/SKILL.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 9689451..0bc7ed2 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -22,6 +22,18 @@ treat every returned result as a claim until verified. depends on the last, accept/reject the last wave before the next; independent slices only need to stay within review capacity. Parallel writers get isolated worktrees. +- **Isolated trees do not isolate ports** (`unprobed` — private incident as + shape; see Provenance). Sibling sessions contend for the same configured + dev-server port; once auto-port-fallback moves yours, any hardcoded + `localhost:` proxy or target elsewhere in the app's config now + silently reaches ANOTHER session's server — the page loads blank or shows + the wrong build while every request returns 200, which reads as a bug in + your own change. In a worktree fan-out: enable auto-port assignment from + the start, verify against the port you were ACTUALLY assigned, and when a + fanned-out preview misbehaves with all-green requests, check cross-port + references before debugging your own code — stopping your preview cannot + stop a sibling's server, so the wrong upstream stays up. + ❌ "every request is 200, so the proxy target must be my server." - Route by task: mechanical clear-spec work → cheapest capable model; user-facing output → high-taste model; reviews and hard debugging → strongest available. Tie-break intelligence > taste > cost. Model lineups are volatile facts: read @@ -301,5 +313,15 @@ enforcement or a defect in that sandbox is unestablished, so the rule prescribes only the defensive split. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. +The §1 port-contention bullet (2026-07-21) comes from a private incident in +a multi-worktree fan-out: a dev server displaced from its configured port +by auto-port-fallback left a hardcoded same-port proxy in the app config +pointing at a concurrent sibling session's server — blank app, all +requests 200, roughly forty lines of in-your-own-code diagnosis before the +cross-port reference was checked (contributor-reported; the private repo +is verifiable by the contributor, not linkable here). Ships `unprobed` per +the README covenant's second branch: no in-repo probe has run — a probe +would need two live servers and a displaced port, a fixture this pack does +not yet carry; the marker records that debt. Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. From c47bac5ea2474b97171520ec0eaf881b1833fcd6 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 08:24:22 +0800 Subject: [PATCH 07/66] =?UTF-8?q?delegation-and-review=20=C2=A71:=20a=20pi?= =?UTF-8?q?nned=20model=20string=20does=20not=20pin=20behavior?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two independent private incidents in one week, two vendors: a pre-registered one-day re-measurement of a CLI's unstated-edge guard rate (same --model flag, same prompt battery) flipped enough to force retraction of the prior day's published claim; a second vendor's endpoint inverted a reproduced infinite-loop failure into a fully guarded pass over twelve days behind unchanged model strings. §1 already says lineups are volatile; this says the MEASUREMENTS are too — a behavioral number about a hosted endpoint is a measurement of a day, not of the string. Date-stamp such numbers, re-run the probe when a routing/safety decision depends on one, treat undated claims as expired. Ships unprobed per the README covenant (nothing can fixture scheduled endpoint drift); Provenance records longitudinal re-measurement as the honest test. --- skills/delegation-and-review/SKILL.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 9689451..38a30f1 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -26,6 +26,20 @@ treat every returned result as a claim until verified. output → high-taste model; reviews and hard debugging → strongest available. Tie-break intelligence > taste > cost. Model lineups are volatile facts: read the environment at session time, not memory. +- **A pinned model string does not pin behavior** (`unprobed` — private + incidents as shape; see Provenance). Hosted endpoints drift behind + identical slugs: in one week, one CLI's measured edge-guard rate collapsed + on re-measurement a single day later (same flag, same prompt battery, + forcing a published claim's retraction), and a second vendor's endpoint + inverted a reproduced infinite-loop failure into a fully guarded pass over + twelve days — model strings unchanged in both. So a measured behavioral + property of a hosted model — an edge-safety rate, a failure signature, a + latency class — is a measurement of a DAY, not of the string. Date-stamp + every such number where it is recorded, and when a routing or safety + decision depends on one, re-run the probe instead of reusing it; an + undated behavioral claim about a hosted endpoint is expired on arrival. + ❌ "we measured that model guarding this edge last week, so route the + edge-risky work to it." ## 2. The dispatch packet @@ -301,5 +315,18 @@ enforcement or a defect in that sandbox is unestablished, so the rule prescribes only the defensive split. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. +The §1 pinned-string bullet (2026-07-22) generalizes two private incidents +from one contributor's subordinate-CLI benchmarks: a pre-registered +re-measurement of one CLI's unstated-edge guard rate, run one day after the +original probe with the model flag and prompt battery unchanged, flipped +the result enough to force retraction of the prior day's published +regression claim; and a second vendor's endpoint, over twelve days behind +unchanged model strings, inverted a reproduced infinite-loop failure into a +fully guarded pass. Both are contributor-reported (private harnesses, +verifiable by the contributor, not linkable here); numbers not restated per +the README covenant — cited as shape, in-body `unprobed` marker. A probe +would require a hosted endpoint that drifts on schedule, which nothing can +fixture; the honest test is longitudinal re-measurement, recorded here as +the debt. Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. From e8c4c01060eb7069b67d2b404fe7896bee8d6b36 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 10:08:48 +0800 Subject: [PATCH 08/66] =?UTF-8?q?delegation-and-review=20=C2=A72:=20recurr?= =?UTF-8?q?ing=20sweeps=20carry=20ledgers=20=E2=80=94=20prior=20fixes=20an?= =?UTF-8?q?d=20refuted=20classes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Repeated review sweeps over the same codebase pay a reproduction cycle every time a reviewer re-litigates history: re-raising a finding class an earlier iteration already refuted, or flagging a prior iteration's fix as a defect. A do-not-re-flag packet block demonstrably prevented this where present; the misses were on surfaces without one. New packet field for recurring sweeps: two ledgers (prior fixes / refuted classes), each entry with a one-line reason. Ships unprobed with Provenance per the covenant. --- skills/delegation-and-review/SKILL.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 9689451..909562e 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -54,6 +54,19 @@ Every packet names: - **Cost asymmetry** — for reviewers/verifiers, name which failure direction is expensive (e.g. a missed unverified claim vs. a false alarm) so scrutiny is weighted toward it, not split evenly. +- **Recurring sweeps carry ledgers** (`unprobed` — private incident as shape; + see Provenance). On repeated review sweeps over the same codebase, reviewers + re-litigate history: in one iteration, one reviewer re-raised a finding + class an earlier iteration had refuted against the dependency's own source, + and another flagged as a defect the exact code a prior iteration had shipped + as a fix — each costing a fresh reproduction cycle to re-refute. A packet + block listing known prior fixes ("do not re-flag") prevented exactly this + where it was present; the misses were on surfaces without one. So a + recurring-sweep packet carries two ledgers, each entry with a one-line + reason: prior fixes (do not re-flag) and refuted finding-classes (do not + re-raise without new evidence). + ❌ "the reviewer gets fresh context each round, so the packet doesn't need + the sweep's history." - **Rules** — do not merge, weaken gates, or revert unrelated work; report blockers and failures plainly. Plausible success is worse than honest failure. For an implementation task, after bounded discovery (interfaces read, ambiguity @@ -301,5 +314,15 @@ enforcement or a defect in that sandbox is unestablished, so the rule prescribes only the defensive split. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. +The §2 recurring-sweep ledgers rule (2026-07-22) comes from a private +incident: across iterations of a repeated review sweep, one reviewer +re-raised a finding class an earlier iteration had refuted against the +dependency's source, and a second flagged as a defect the exact code an +earlier iteration had shipped as a fix; a do-not-re-flag block already +present in one packet prevented exactly this on its surfaces, and both +misses occurred where the block was absent. Private evidence, cited as +shape per the README covenant's second branch; the executable probe — the +same sweep run with and without ledgers, counting re-litigated findings — +has not been run; the in-body `unprobed` marker records that debt. Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. From 8c21ca3273019f8132b668d0ec22d809cf50ccec Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 10:09:20 +0800 Subject: [PATCH 09/66] =?UTF-8?q?delegation-and-review=20=C2=A71:=20labels?= =?UTF-8?q?=20are=20routes,=20listings=20are=20claims?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two traps in wrapper-CLI model routing: (1) a wrapper's model strings are internal routing names, not provider API IDs — pasting them into direct API calls or quota lookups queries a name that may not exist; (2) a model listed in a lineup is not proven callable — a listed entry failed hard on first invocation, the second such ghost across two independent tools. Rule: invoke once and see output before building on a listed model. Ships unprobed with Provenance per the covenant. --- skills/delegation-and-review/SKILL.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 9689451..448db3d 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -26,6 +26,16 @@ treat every returned result as a claim until verified. output → high-taste model; reviews and hard debugging → strongest available. Tie-break intelligence > taste > cost. Model lineups are volatile facts: read the environment at session time, not memory. +- **Labels are routes, listings are claims** (`unprobed` — private incidents + as shape; see Provenance). A wrapper CLI's model strings are its internal + routing names, not necessarily the provider's API model IDs — pasting one + into a direct API call or a pricing/quota lookup queries a name that may + not exist on the provider's side. And a model's presence in a lineup + listing does not prove it is callable: across two independent tools, a + listed entry failed hard on first real invocation. The listing is the + tool's routing claim; before building on a model, invoke it once and see + output. + ❌ "the CLI lists it, so it's available — route tomorrow's batch to it." ## 2. The dispatch packet @@ -301,5 +311,15 @@ enforcement or a defect in that sandbox is unestablished, so the rule prescribes only the defensive split. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. +The §1 labels-and-listing rule (2026-07-22) comes from two private +incidents in one contributor's subordinate tooling: a model entry listed +by one wrapper CLI's lineup failed hard on its first real invocation (the +second such ghost entry observed across two independent tools), and a +session caught itself about to treat another wrapper's model strings as +provider API IDs for a quota lookup before verifying they are the +wrapper's internal routing names. Private evidence, cited as shape per +the README covenant's second branch; the executable probe — invoke every +listed model once and diff claimed-vs-callable — has not been run +in-repo; the in-body `unprobed` marker records that debt. Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. From 396c2ae0b5c26d1e5ccd586d8f37c6247ad5f9a9 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 10:09:47 +0800 Subject: [PATCH 10/66] =?UTF-8?q?operational-rigor=20=C2=A74:=20a=20check'?= =?UTF-8?q?s=20name=20is=20not=20its=20coverage?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A named check, test, or CI job earns evidentiary weight only from its assertion body. Incident shape: a check whose name implied it gated a model integration turned out to exercise only a regex pre-filter where the model's name was a routing label — the session had to correct a safety claim already given to the user. Rule: read what the check actually asserts before citing it as evidence a change is safe. Ships unprobed with Provenance per the covenant. --- skills/operational-rigor/SKILL.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 82300cc..d840747 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -255,6 +255,17 @@ When rigor conflicts with finishing sooner, rigor wins. - Between failed fixes, return to a clean state; stacked half-fixes hide causes. - Reproduce reported bugs before fixing. Fix the observed failure, not the implied one. Refutation is valid: report confirmed non-bugs and ship nothing. +- **A check's name is not its coverage** (`unprobed` — private incident as + shape; see Provenance). A named gate earns evidentiary weight only from + its assertion body: one session cited a check whose name implied it gated + a model integration's behavior, then read its source and found it + exercised only a regex pre-filter in which the model's name was a routing + label — and had to correct a safety claim already given to the user. + Before citing a check, test, or CI job as evidence a change is safe, read + what it actually asserts and cite that; "there is a check called X" is a + claim about naming, not behavior. + ✅ "read check X: it asserts A and B but never drives C — C is unverified." + ❌ "the change is safe, check X covers it" (named, never read). - **A failing check has two suspects: the code and the check itself.** Before editing either, open the statement of intended behavior (spec, README, docstring, type) and confirm which side it backs; a disagreement is the @@ -538,6 +549,15 @@ the deployed path (contributor-reported shape; the private repo is verifiable by the contributor, not linkable here). It ships `unprobed` — the pack's private fixtures have no interactive arm to drive it (cf. the grill-pass note above); the marker records that debt, not an exemption. +The §4 check-name rule (2026-07-22) comes from a private incident: a +session presented a named CI check as gating a model integration's +behavior, then read the check's source and found it exercised only a +regex pre-filter in which the model's name was merely a routing label, +and had to correct the safety framing it had already given the user. +Private evidence, cited as shape per the README covenant's second branch; +the executable probe — sample a repo's named checks and diff name-implied +vs actual assertion coverage — has not been run; the in-body `unprobed` +marker records that debt. Stable behavioral rules; the environment-specific facts to re-verify now travel with the rules that cite them — the external-systems set in `references/external-systems.md`, plus §2's mount-check commands From cb9f48ad68a10c7839abb6ec8d23715f7f18acb1 Mon Sep 17 00:00:00 2001 From: firaen22 Date: Wed, 22 Jul 2026 10:10:20 +0800 Subject: [PATCH 11/66] =?UTF-8?q?skill-authoring=20=C2=A73:=20capability-n?= =?UTF-8?q?egative=20claims=20rot=20the=20worst?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 'No such flag' / 'only works interactively' / 'the API can't do X' are version-scoped observations that read as timeless rules. A stale positive fails loud when followed; a stale negative fails silent — it steers every later session away from a capability that now exists and nothing ever exercises it to expose the rot. Incident shape: a playbook's no-flag claim was actively wrong at the tool's current version and had been routing sessions into a degraded path. Rule: pin capability-negatives to the observed version; re-verify on version change before repeating. Ships unprobed with Provenance per the covenant. --- skills/skill-authoring/SKILL.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index f9bc110..fe72eec 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -94,6 +94,19 @@ artifact-producing step. ## 3. Provenance and decay - Date-stamp volatile facts (versions, flags, model names, defaults). +- **Capability-negative claims rot the worst** (`unprobed` — private incident + as shape; see Provenance). "No such flag", "only works interactively", + "the API can't do X" are version-scoped observations that read as timeless + rules. A stale positive claim fails loud the first time someone follows + it; a stale negative fails silent — it steers every later session away + from a capability that now exists, and nothing ever exercises it to + expose the rot. One playbook's "model switching only works in the + interactive UI; no flag" was actively wrong at the tool's current version + and had been routing sessions into a degraded path. Pin every + capability-negative to the version it was observed on, and re-verify it + (one `--help` or probe call) when the tool's version changes, before + repeating it. + ❌ "the playbook says there's no flag, so drive it through the UI." - Correct a stale rule in place — never append the correction below the old line. A zero-context reader obeys whichever sentence it reads first, not the latest one. @@ -397,4 +410,14 @@ marker per the README covenant: the external measurement is of one skill's one gate, and whether placement generalizes across gate types is exactly what an in-house probe would test — that probe has not been run; the marker records the debt. +The §3 capability-negative rule (2026-07-22) comes from a private +incident: a subordinate-CLI playbook asserted a capability did not exist +("model switching only works interactively; no flag") — true when +written, false at the tool's current version — and the stale negative had +been silently steering sessions into a degraded interactive-only path +until a review pass re-probed the binary. Private evidence, cited as +shape per the README covenant's second branch; the executable probe — +re-running recorded capability-negatives against the current binary on +each version change and counting flips — has not been run as a standing +check; the in-body `unprobed` marker records that debt. Stable method; no environment facts to re-verify. From 28b2ef1fe668f2b13b8ef9117d4729b792943915 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:32:21 +0800 Subject: [PATCH 12/66] delegation-and-review: harden the settled-tree bullet per r1 dual review PR #48 round-1 cross-model gate (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1,2,3). All must-fix findings reproduced and addressed: - dangling "hence the check below" replaced with explicit on-return state re-checks (grok F1 / codex F2) - verdict baseline pinned to the recorded dispatched state (revision + dirty-file set), intentions excluded, second neg example added (grok F2 / codex F2) - no-write isolation made first-class (snapshot preferred; foreign HEAD/index motion = suspect verdict and tree) so the second motivating incident is prevented, not just narrated (grok F3 / codex F2) - shard branch tightened: file-disjoint is not dependency-disjoint (codex F1) - "Land or hold" replaced by stabilize-without-merging with named destinations for held edits (codex F3 / grok N6) - in-body marker pluralized; provenance fix-summary updated to match (grok N7) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 48 ++++++++++++++++----------- 1 file changed, 29 insertions(+), 19 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 527748f..04f3f77 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -83,25 +83,34 @@ reviewers that they silently absorb as implementers. verdicts name the point nearest failure or they are rubber stamps. - Critic verdicts carry evidence: REFUTED needs a counterexample; untested assumptions are listed. Verify critics too; stale or missing review is not approval. -- **Freeze the tree for a read-only review dispatch, or shard it disjointly** - (`unprobed` — private incident as shape; see Provenance). Editing a file a - fresh-context critic is still reading contaminates its verdict: one - read-only critic re-read a file the orchestrator had already fixed - mid-review and voted REFUTED on a bug already confirmed elsewhere. A - separate critic committed the very worktree it was reviewing, moving the - tree out from under the orchestrator's expected end-state. Neither is - §4's write-write clobber below (a subordinate overwriting concurrent - edits with no conflict signal): the first is a read verdict going stale - mid-read, the second a "read-only" reviewer writing anyway — nothing - overwritten, but the tree moved. Land or hold pending edits before - dispatching a read-only wave; if edits must continue, shard the review - over files disjoint from what you are touching (safe only if the - dispatch is enforced read-only — hence the check below), or re-dispatch - a fresh wave against the settled state rather than trust a verdict - formed on a moving tree. After any reviewer returns, confirm the tree - still matches what you expect before trusting its verdict. +- **Settle the tree before a read-only review dispatch** — a fresh-context + critic wave in flight while the tree it reads can still move returns a + verdict about a state that no longer exists (`unprobed` — private + incidents as shape; see Provenance). One read-only critic re-read a file + the orchestrator had already fixed mid-review and voted REFUTED on a bug + already confirmed elsewhere; a separate critic committed the very + worktree it was reviewing, moving the tree out from under the requested + end-state. Neither is §4's write-write clobber below (a subordinate + overwriting concurrent edits with no conflict signal): the first is a + read verdict going stale mid-read, the second a "read-only" reviewer + writing anyway. Before dispatch: stabilize without merging — commit + pending edits on the reviewed branch, or move them out of the reviewed + tree (stash, scratch copy); merging is never part of dispatch — and + record the exact state dispatched against (revision plus dirty-file + set). Prefer handing the wave an isolated snapshot (a copy or worktree + pinned at that revision, write access withheld); if it must read the + live tree while your edits continue, edit only files the reviewed slice + neither contains nor depends on — file-disjoint is not + dependency-disjoint. On each return, re-check the recorded state: + reviewed files changed (your own edits included) → the verdict is + stale; re-dispatch against the settled state. Repo state moved without + your doing (a commit, a moved HEAD or index) → the "read-only" wave + wrote; treat its verdict and the tree as suspect and investigate before + trusting either. ✅ "held my own edits until the critic's wave returned, then applied them." ❌ "kept fixing files while the critic was still reading them." + ❌ "the tree matches what I intended, so the verdict stands" — the + baseline is the dispatched state, not your intentions. - Review against the packet contract, not line-by-line theater. New bug class caught → sweep the codebase: one catch, one class, one sweep. The worker's sweep report obeys operational-rigor §5 (the canonical copy, verbatim: @@ -327,8 +336,9 @@ fixed mid-dispatch and voted REFUTED on an already-confirmed bug, and a separate critic committed the reviewed worktree to a branch mid-review, leaving the requested end-state unreachable. Both observed in a private audit harness (contributor-verifiable, not linkable here); the fix -(freeze-or-shard, re-check on return) is the defensive split, not a -mechanism finding, mirroring how the §4 silent-clobber bullet above +(settle-or-snapshot, dependency-disjoint sharding, a recorded-state +re-check on return) is the defensive split, not a mechanism finding, +mirroring how the §4 silent-clobber bullet above handles its own single-sandbox observation. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. From 5e11a10de38360f90ee01ed0a23c5d4cbb73b619 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:47:33 +0800 Subject: [PATCH 13/66] delegation-and-review: replace the settled-tree bullet's concurrency mechanism per r2 dual review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round-2 gate on PR #48 (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1-7). Five of the nine r2 must-fixes hit one mechanism — the conditional live-tree concurrent-edit branch — so per operational-rigor S5 (three defects, one mechanism) that branch is removed, not patched: snapshot-or-freeze is now the only dispatch shape, and the snapshot arm restores the concurrency sharding was buying. - reviewed content settles in place; stash arm scoped to non-reviewed WIP; audit-target trees defer to the completion-claim rule (grok F1 / codex F2) - dispatched state recorded as content (saved diff or hash), not a filename list (codex F3) - unaccountable deltas on reviewed paths = suspect verdict AND tree, restore baseline before re-dispatch (grok F2) - live-tree editing branch removed; write-capable waves fall to S4's silent-clobber discipline (grok F3 / codex F1, F5) - endpoint match demoted to detection-of-persistent-drift; prevention is the snapshot / withheld write access (codex F4) - pos example now carries the return-state check (codex F6) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 45 ++++++++++++++++----------- 1 file changed, 26 insertions(+), 19 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 04f3f77..092d127 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -93,22 +93,29 @@ reviewers that they silently absorb as implementers. end-state. Neither is §4's write-write clobber below (a subordinate overwriting concurrent edits with no conflict signal): the first is a read verdict going stale mid-read, the second a "read-only" reviewer - writing anyway. Before dispatch: stabilize without merging — commit - pending edits on the reviewed branch, or move them out of the reviewed - tree (stash, scratch copy); merging is never part of dispatch — and - record the exact state dispatched against (revision plus dirty-file - set). Prefer handing the wave an isolated snapshot (a copy or worktree - pinned at that revision, write access withheld); if it must read the - live tree while your edits continue, edit only files the reviewed slice - neither contains nor depends on — file-disjoint is not - dependency-disjoint. On each return, re-check the recorded state: - reviewed files changed (your own edits included) → the verdict is - stale; re-dispatch against the settled state. Repo state moved without - your doing (a commit, a moved HEAD or index) → the "read-only" wave - wrote; treat its verdict and the tree as suspect and investigate before - trusting either. - ✅ "held my own edits until the critic's wave returned, then applied - them." ❌ "kept fixing files while the critic was still reading them." + writing anyway. Before dispatch, stabilize — committing is fine, + merging is not: the content under review stays in place (commit it on + the reviewed branch, or leave it uncommitted as part of the recorded + state — never stash away the very change the wave reviews; a delivered + tree under §3's completion-claim audit above stays untouched, that + rule governs); WIP outside the reviewed content moves out (stash, + scratch copy). Record the dispatched state as content, not filenames: + the revision plus a saved diff or hash of every dirty path. Then hand + the wave an isolated snapshot (a copy or worktree pinned at that + state, write access withheld) — the snapshot is what lets your own + edits continue safely; no snapshot → freeze: hold your edits until the + wave returns. On return, diff the reviewed paths against the recorded + content: any delta you cannot account for, or a commit, HEAD, or index + motion not yours → the "read-only" wave wrote — verdict and tree are + suspect; restore the recorded baseline or cut a fresh snapshot before + re-dispatching. An endpoint match is detection of persistent drift + only, never proof the tree held still mid-read (a writer can restore + before returning) — prevention lives in the snapshot or the withheld + write access, and a live-tree wave that held write capability clears + nothing by matching (§4's discipline below governs that case). + ✅ "held my own edits until the wave returned and the reviewed paths + diffed clean against the recorded state, then applied them." + ❌ "kept fixing files while the critic was still reading them." ❌ "the tree matches what I intended, so the verdict stands" — the baseline is the dispatched state, not your intentions. - Review against the packet contract, not line-by-line theater. New bug class @@ -336,9 +343,9 @@ fixed mid-dispatch and voted REFUTED on an already-confirmed bug, and a separate critic committed the reviewed worktree to a branch mid-review, leaving the requested end-state unreachable. Both observed in a private audit harness (contributor-verifiable, not linkable here); the fix -(settle-or-snapshot, dependency-disjoint sharding, a recorded-state -re-check on return) is the defensive split, not a mechanism finding, -mirroring how the §4 silent-clobber bullet above +(settle-in-place, snapshot-or-freeze, content-recorded dispatch state, +return-time drift detection) is the defensive split, not a mechanism +finding, mirroring how the §4 silent-clobber bullet above handles its own single-sandbox observation. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. From 0f2a537ef6e2d6c88e4b9391c27a1b879b5632d0 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:00:48 +0800 Subject: [PATCH 14/66] delegation-and-review: post-cap r3 repairs to the settled-tree bullet; dual gate NOT re-run Round 3 (grok-4.5 high: FIX 1-4; gpt-5.6-sol max: FIX 1-6) landed after the 2-3 round cap, so this commit repairs the r3 findings and the loop STOPS: the dual gate has not re-reviewed this text, and the PR is held for the owner instead of merged (cross-model-review S4). - restorable capture (staged/unstaged/untracked, not hashes), copy verified against capture pre-dispatch, worktree-omits-dirty named (grok F3 / codex F1) - any reviewed-path delta invalidates use of the verdict, own edits included - restores the stale-arm v3 dropped (grok F2 / codex F2) - valid prevention combinations stated (copy or frozen tree, each with write withheld); the misdirecting S4 pointer removed (grok F4 / codex F3) - recovery semantics: quarantine own edits, restore from capture, never adopt the suspect tree as baseline (codex F4) - audit-tree cross-ref removed entirely (its direction word was wrong and the pointer confused more than it bound: codex F5 / grok n6) - neg example scoped to the live tree the critic reads (grok F1) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 70 +++++++++++++-------------- 1 file changed, 35 insertions(+), 35 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 092d127..4913744 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -84,40 +84,40 @@ reviewers that they silently absorb as implementers. - Critic verdicts carry evidence: REFUTED needs a counterexample; untested assumptions are listed. Verify critics too; stale or missing review is not approval. - **Settle the tree before a read-only review dispatch** — a fresh-context - critic wave in flight while the tree it reads can still move returns a - verdict about a state that no longer exists (`unprobed` — private - incidents as shape; see Provenance). One read-only critic re-read a file - the orchestrator had already fixed mid-review and voted REFUTED on a bug - already confirmed elsewhere; a separate critic committed the very - worktree it was reviewing, moving the tree out from under the requested - end-state. Neither is §4's write-write clobber below (a subordinate - overwriting concurrent edits with no conflict signal): the first is a - read verdict going stale mid-read, the second a "read-only" reviewer - writing anyway. Before dispatch, stabilize — committing is fine, - merging is not: the content under review stays in place (commit it on - the reviewed branch, or leave it uncommitted as part of the recorded - state — never stash away the very change the wave reviews; a delivered - tree under §3's completion-claim audit above stays untouched, that - rule governs); WIP outside the reviewed content moves out (stash, - scratch copy). Record the dispatched state as content, not filenames: - the revision plus a saved diff or hash of every dirty path. Then hand - the wave an isolated snapshot (a copy or worktree pinned at that - state, write access withheld) — the snapshot is what lets your own - edits continue safely; no snapshot → freeze: hold your edits until the - wave returns. On return, diff the reviewed paths against the recorded - content: any delta you cannot account for, or a commit, HEAD, or index - motion not yours → the "read-only" wave wrote — verdict and tree are - suspect; restore the recorded baseline or cut a fresh snapshot before - re-dispatching. An endpoint match is detection of persistent drift - only, never proof the tree held still mid-read (a writer can restore - before returning) — prevention lives in the snapshot or the withheld - write access, and a live-tree wave that held write capability clears - nothing by matching (§4's discipline below governs that case). + critic wave reading a tree that can still move returns a verdict about + a state that no longer exists (`unprobed` — private incidents as shape; + see Provenance). One read-only critic re-read a file the orchestrator + had already fixed mid-review and voted REFUTED on a bug already + confirmed elsewhere; a separate critic committed the very worktree it + was reviewing, moving the tree out from under the requested end-state. + Neither is §4's write-write clobber below (a subordinate overwriting + concurrent edits with no conflict signal): the first is a read verdict + going stale mid-read, the second a "read-only" reviewer writing anyway. + The defensive split: (1) settle the content under review in place — + commit it on the reviewed branch, or capture it restorably (staged, + unstaged, and untracked content, not filenames or bare hashes) — and + never stash away the very change the wave reviews. (2) Give the wave + an immutable read: a full copy verified against that capture before + dispatch (a worktree pinned at a revision omits dirty content unless + the capture is applied into it), or the live tree with your own edits + frozen until return — and in both shapes withhold the wave's write + access wherever the harness can; "read-only" is a claim, not a + property. (3) On return, diff the reviewed paths against the capture: + ANY delta there — your own later edits included — means the verdict + binds the captured state, not the current one; re-verify or + re-dispatch before acting on it. A delta you did not make, or a + commit, HEAD, or index motion not yours, additionally means the wave + wrote: quarantine your own post-dispatch edits first, restore the + reviewed paths from the capture (never adopt the suspect tree as the + new baseline), then re-dispatch. An endpoint match is detection of + persistent drift only — a write-capable wave can mutate and restore + mid-read without a trace; only the verified copy or the frozen tree, + each with write withheld, prevents. ✅ "held my own edits until the wave returned and the reviewed paths - diffed clean against the recorded state, then applied them." - ❌ "kept fixing files while the critic was still reading them." + diffed clean against the capture, then applied them." + ❌ "kept fixing files in the live tree the critic was reading." ❌ "the tree matches what I intended, so the verdict stands" — the - baseline is the dispatched state, not your intentions. + baseline is the captured state, not your intentions. - Review against the packet contract, not line-by-line theater. New bug class caught → sweep the codebase: one catch, one class, one sweep. The worker's sweep report obeys operational-rigor §5 (the canonical copy, verbatim: @@ -343,9 +343,9 @@ fixed mid-dispatch and voted REFUTED on an already-confirmed bug, and a separate critic committed the reviewed worktree to a branch mid-review, leaving the requested end-state unreachable. Both observed in a private audit harness (contributor-verifiable, not linkable here); the fix -(settle-in-place, snapshot-or-freeze, content-recorded dispatch state, -return-time drift detection) is the defensive split, not a mechanism -finding, mirroring how the §4 silent-clobber bullet above +(restorable capture, verified-copy-or-frozen-tree with write withheld, +any-drift-invalidates return check) is the defensive split, not a +mechanism finding, mirroring how the §4 silent-clobber bullet above handles its own single-sandbox observation. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. From b015f36a4ff05f45f455879e4eb918f9160578b1 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:04:07 +0800 Subject: [PATCH 15/66] operational-rigor: rework the scheduled-process rule per r1 dual review PR #49 round-1 gate (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1-8,10). Reproduced and addressed: - supervised run pinned to the schedule's own execution context (principal/env/cwd/headless, or one real scheduled fire) (grok F2 / codex F3) - per-channel verification moved to the DESTINATION (content, receipt, observed state; async 2xx acceptance is not delivery) (codex F2) - repeat-run behavior check before arming - recurring work dies on the second pass (codex F8); any unverified channel leaves the schedule unarmed, pos example covers both channels (codex F7 / grok n6) - review-vs-arm split: reviewing without run authorization inspects existing evidence only; consequential effects in a supervised run stay behind S2's gates (codex F4) - permission-gate clause rewritten: durable non-interactive technical grants under the schedule principal; consequential actions need S2's explicitly scoped standing authorization; self-answering and blanket pre-approval both excluded (grok F3 / codex F5) - destination-freshness cadence independent of the task; the task's own health line demoted to ran-not-arrived evidence (codex F1 / grok n5) - audit path = per-channel evidence, mtimes one signal (grok F1); 'proves' downgraded to evidence-of-self-report (codex F6); 'roughly three months' restored (codex F9 nit) - codex F10 rejected-with-reason: the contributor Checks section is a factual process self-report whose claims this gate independently re-ran (checks.py pass, single-file diff both true); not an authority directive, no finding was downgraded on its account Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 45 ++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 16 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 9e2ee6d..8c27d25 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -303,22 +303,35 @@ When rigor conflicts with finishing sooner, rigor wins. - Never fabricate observations or report outputs not produced. Report skipped verification as skipped. - **A recurring scheduled process's own "completed" report is not evidence its - side effects landed.** A weekly task reported success for three months while - its write step silently never executed — every output file's mtime frozen at - the date the write path broke, caught only by an unrelated mtime audit; a - second, independent output channel on the same task was separately dead on a - stale hardcoded credential the whole time (`unprobed` — private incident as - shape; see Provenance). Arming or reviewing any recurring automation: run it - supervised once and verify each output channel by its actual artifact or - response body, not the runner's exit status; have the task write a dated - health line whose absence itself is the failure signal (an "OK" it can only - ever emit is not one); pre-confirm every permission-gated call it makes, - since a headless run cannot clear an interactive prompt; and when auditing an - existing schedule, check output mtimes before trusting its run history — a - green log proves the process executed, not that anything downstream received - what it produced. - ✅ "ran it once watched, confirmed a new file appeared with today's mtime and - the correct content, then armed the schedule." + side effects landed.** A weekly task reported success for roughly three + months while its write step silently never executed — every output file's + mtime frozen at the date the write path broke, caught only by an unrelated + mtime audit; a second, independent output channel on the same task was + separately dead on a stale hardcoded credential the whole time (`unprobed` + — private incident as shape; see Provenance). Arming one: run it once + under the schedule's own execution context — its principal, environment, + working directory, and headless path, or one real scheduled fire — and + verify every output channel at its destination (the artifact's content, a + delivery receipt or observed destination state; an async 2xx acceptance is + not delivery), then repeat the run and watch the second pass behave + (existing output, locks, overlap): any unverified channel leaves the + schedule unarmed. A consequential send or spend in a supervised run stays + behind §2's gates — arming is not authorization to fire it. Permission + gates: a headless run cannot clear an interactive prompt, so the scheduled + path must hold durable non-interactive grants under the schedule's + principal for its technical permissions, while consequential actions still + need §2's explicitly scoped standing authorization — "pre-confirmed once + while watched" is neither. Ongoing: a dead task cannot report its own + death, so check each destination's freshness on a cadence independent of + the task (a dated health line the task writes shows the task ran, not + that anything arrived). Reviewing an existing schedule without + authorization to run it: inspect the evidence that already exists — + per-channel artifacts, receipts, output mtimes — and treat a green run + history as evidence the runner reported success, never that downstream + received anything. + ✅ "ran it under the cron user's environment: today's file content + verified AND the second channel's receipt checked; repeat run clean; then + armed the schedule." ❌ "the log shows 200/exit-0 every week, so it's working." - **Data-path integrity — fail loud on *unspecified* ambiguity, never emit a silently-wrong value.** Honor an explicit, documented contract (a declared From 5437d9168ff5c4d7fc97a429d68fed04cc03d96f Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:13:51 +0800 Subject: [PATCH 16/66] delegation-and-review: restructure the sweep-scope addition per r1 dual review PR #50 round-1 gate (grok-4.5 high: FIX 1,2,3,4; gpt-5.6-sol max: FIX 1-5). Reproduced and addressed: - search scope vs write scope split: inspecting a generator does not own it; out-of-scope generators are reported, never edited on discovery (codex F2) - generator inventory from definition surfaces, never the token grep; unresolved discovery gaps block exhaustive claims (grok F2 / codex F1) - acceptance moved into the Proof gate field and bound to every inventoried surface and tier, declared partitions the only shortcut; zero-hit search demoted to a report (grok F1, F4 / codex F3) - open-ended families get a declared bound per S3's bounded-sweep clause instead of a forbidden-sampling mandate (grok F3 / codex F4) - pos/neg pair added at the proof gate; dangling 'not that the defect is' parallel completed (grok n5, n6) - S3 sweep bullet now points at the S2 sweep fields so the review path lands on the acceptance rule (grok F4) - codex F5 (contributor Checks self-vouch) rejected-with-reason: factual process self-report, independently re-verified by this gate; packet rubric clarified to stop this recurring false-positive class Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 43 +++++++++++++++++---------- 1 file changed, 27 insertions(+), 16 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index deeeb45..5c57c8e 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -33,22 +33,29 @@ Every packet names: - **Goal + motivation** — what and why. - **Owned scope + explicit non-scope** — files/modules it may and may not touch. - For a find-and-fix-every-instance sweep, scope means every surface that can - generate the target pattern, not one search pattern: a 53-file styling sweep, - three review rounds, and a merged fix all missed the actual defect because it - lived in a shared utility class the token grep never matched, and each - follow-up round found a different category (a color-tier band, a - class-emitting helper function) the prior round's pattern structurally - excluded (`unprobed` — private incident as shape; see Provenance). Before - dispatching or accepting such a sweep, enumerate every generator (literals, - shared/global definitions, helper functions returning the pattern) and the - full value space (every tier/variant in the family, not a sample), and gate - acceptance on observing the effect (render it, run it) rather than on the - search returning zero — a clean grep proves one spelling is gone, not that - the defect is. + For a find-and-fix-every-instance sweep, scope splits in two + (`unprobed` — private incident as shape; see Provenance): the SEARCH + scope is every surface that can generate the target — literals, + shared/global definitions, helpers that construct or return it — + inventoried from the definition surfaces themselves, never from the + token grep (a 53-file styling sweep missed its defect in a shared + utility class the token grep never matched, and each review round + surfaced another category the prior round's pattern structurally + excluded); the WRITE scope stays this field, and a generator discovered + outside it is reported for escalation, never edited on discovery. Name + the value family and close it (every tier/variant listed), or declare + the bound per §3's bounded-sweep clause — an unresolved discovery gap + blocks any exhaustive claim. - **Invariant** — property to close and properties to preserve. - **Proof gate** — concrete check that would fail under the broken behavior; - worker-chosen "tests pass" is not a gate. + worker-chosen "tests pass" is not a gate. For an every-instance sweep, + the gate is the observed effect on every inventoried generator surface + and value tier (render or run each; a declared coverage partition with + its gaps stated is the only shortcut) — a zero-hit search is a report, + not the gate: a clean grep proves one spelling is gone, not that the + defect is gone. + ✅ "every tier rendered through the shared helper path — effect gone." + ❌ "the grep is clean across all 53 files, so the sweep is done." - **Output contract** — conclusions + `file:line` refs, each tagged `[verified: ran ]`, `[verified: read ]`, or `[unverified: ]`; long artifacts go to files, return paths. @@ -103,7 +110,9 @@ reviewers that they silently absorb as implementers. 'none')"). The reviewer re-runs that named search, never takes it on trust — then challenges its coverage with one differently-shaped query (a broader or structural pattern, or a class-aware check): re-running a - narrow pattern reproduces its hits AND its misses. + narrow pattern reproduces its hits AND its misses. (An every-instance + sweep's dispatch scope and acceptance gate are §2's sweep fields — + generator inventory and effect-per-surface, never search-zero.) - **Machinery is not the user.** Tool completions, CI events, and agent statuses are state changes, not approval or proof. Open the artifact and verify. - **Auditing a completion claim** (an agent's or contractor's "done", a @@ -314,7 +323,9 @@ enforcement or a defect in that sandbox is unestablished, so the rule prescribes only the defensive split. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. -The §2 sweep-scope bullet (2026-07-21) comes from a private incident: a +The §2 sweep-scope additions (2026-07-21; search-scope/write-scope split, +definition-surface inventory, effect-per-surface proof gate, and the §3 +pointer) come from a private incident: a find-and-fix-every-instance styling sweep (53 files), three review rounds, and a merged fix all missed the actual defect — it lived in a shared global utility class the token grep pattern never touched, and each follow-up round's From 3dcaae424833cc49b0f122531bbe9807966b1fef Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:17:07 +0800 Subject: [PATCH 17/66] operational-rigor: r2 rework of the scheduled-process rule - gates first, drive-and-attribute PR #49 round-2 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-8). All reproduced and addressed: - authorization gate moved BEFORE the first test fire per the pack's own gate-placement rule; per-invocation (each supervised fire) vs explicitly scoped standing authorization (unattended recurrence) split per the canonical S2 boundary (codex F5, F6) - credential handling: verify existing grants; minting or broadening one is itself S2-gated; no safe grant leaves it unarmed (codex F8) - scheduler binding: inspect the configured entry (command/args/ trigger/enabled) before trusting a manual pass (codex F3) - destination evidence must be invocation-correlated (before/after or run-tied receipt); sibling-writer freshness proves nothing (codex F1) - sequential repeat cannot exercise overlap; concurrency tested deliberately or stated unverified (codex F2) - conditional channels: freshness keyed to documented emission condition + deadline; stale-or-uncheckable = unhealthy (codex F4) - headless / no-human-cleared-prompt folded into the arming done condition and the pos example (grok F1, n2) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 55 +++++++++++++++++-------------- 1 file changed, 31 insertions(+), 24 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 8c27d25..ba12d41 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -308,30 +308,37 @@ When rigor conflicts with finishing sooner, rigor wins. mtime frozen at the date the write path broke, caught only by an unrelated mtime audit; a second, independent output channel on the same task was separately dead on a stale hardcoded credential the whole time (`unprobed` - — private incident as shape; see Provenance). Arming one: run it once - under the schedule's own execution context — its principal, environment, - working directory, and headless path, or one real scheduled fire — and - verify every output channel at its destination (the artifact's content, a - delivery receipt or observed destination state; an async 2xx acceptance is - not delivery), then repeat the run and watch the second pass behave - (existing output, locks, overlap): any unverified channel leaves the - schedule unarmed. A consequential send or spend in a supervised run stays - behind §2's gates — arming is not authorization to fire it. Permission - gates: a headless run cannot clear an interactive prompt, so the scheduled - path must hold durable non-interactive grants under the schedule's - principal for its technical permissions, while consequential actions still - need §2's explicitly scoped standing authorization — "pre-confirmed once - while watched" is neither. Ongoing: a dead task cannot report its own - death, so check each destination's freshness on a cadence independent of - the task (a dated health line the task writes shows the task ran, not - that anything arrived). Reviewing an existing schedule without - authorization to run it: inspect the evidence that already exists — - per-channel artifacts, receipts, output mtimes — and treat a green run - history as evidence the runner reported success, never that downstream - received anything. - ✅ "ran it under the cron user's environment: today's file content - verified AND the second channel's receipt checked; repeat run clean; then - armed the schedule." + — private incident as shape; see Provenance). Arming one, gates first: + a consequential send or spend needs its own per-invocation authorization + for every test fire, and the unattended recurrence needs an explicitly + scoped standing authorization — §2's confirmation-gate rule governs + both, and neither substitutes for the other. Verify the existing + non-interactive grants under the schedule's principal; creating or + broadening a credential is itself a §2-gated action, and with no safely + scoped grant the schedule stays unarmed. Then drive and attribute: + confirm the schedule's configured entry (command, arguments, trigger, + enabled) invokes the thing you are testing; run it headless under the + schedule's own execution context (principal, environment, working + directory) or watch one real scheduled fire; verify every output channel + at its destination with evidence correlated to that invocation — a + before/after state or a run-tied receipt; a fresh artifact another + writer could have produced proves nothing, and an async 2xx acceptance + is not delivery. Repeat the run for existing-output and lock behavior + (a sequential repeat cannot exercise overlap — test concurrency + deliberately or state it unverified, never by overlapping consequential + actions). Any unverified channel, or a run that needed a human to clear + a prompt, leaves the schedule unarmed. Ongoing: a dead task cannot + report its own death — check each destination on a cadence independent + of the task, against that channel's documented emission condition and + deadline (a task-written health line shows the task ran, not that + anything arrived; stale-or-uncheckable reads as unhealthy, never + healthy). Reviewing an existing schedule without authorization to run + it: inspect the evidence that already exists — per-channel artifacts, + receipts, output mtimes — and treat a green run history as evidence the + runner reported success, never that downstream received anything. + ✅ "confirmed the cron entry runs this script, fired it headless as the + cron user, correlated both channels' new evidence to that run, repeat + pass clean — then armed the schedule." ❌ "the log shows 200/exit-0 every week, so it's working." - **Data-path integrity — fail loud on *unspecified* ambiguity, never emit a silently-wrong value.** Honor an explicit, documented contract (a declared From efb5bedec4b81c3bf79daadd4323c083a1a36659 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:19:33 +0800 Subject: [PATCH 18/66] skill-authoring: rework the grep-absence rule per r1 dual review PR #51 round-1 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1,2,3,4). All reproduced and addressed: - candidate-home read made UNCONDITIONAL (hits or none), closing the optional-read path that reproduced the motivating failure; no nameable candidate home -> unresolved + escalate, never an absence claim (grok F2 / codex F1) - pos example was mechanism-false (grep 'revert' cannot hit text worded 'restore') and its bare paragraph-sign-3 dangled against THIS file's actual section 3; replaced with an empty-grep -> read-anyway -> found- under-other-wording template with no dangling ref (grok F1 / codex F3) - per-addition completion record: the change record carries the sections-read + verdict line, the enforcement-ladder form this file itself prescribes (codex F2) - siblings defined executably (other skills in the set, list the directory); every-hit-section + every-candidate-home quantifiers explicit (codex F4 / grok n4) - private count moved behind contributor-log attribution (grok n5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index dc5f46f..f248505 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -151,19 +151,26 @@ artifact-producing step. sibling instead. Each skill states **when NOT to use it** and which sibling to use. - **Keyword-grep absence is not absence** (`unprobed` — private incidents as - shape; see Provenance). The no-duplicate-homes rule above needs a dup-check - before every addition, and a grep that returns nothing is not that check: - an existing rule phrased differently from the search term produced three - false "not covered" verdicts in one week — one a proposed addition whose - content already sat in the target file under other wording, caught only - when the section was actually read at drafting time. Before concluding a - fact has no home, grep the target file AND its siblings for the concept's - synonyms, and when any hit lands near the topic — or the fact plausibly - belongs to an existing section — read that section in full first. A - "not covered" verdict cites the section read, not the grep that found - nothing. - ✅ "grepped 'revert', hit §3's regression bullet, read §3 — the rule is - already there under 'restore'; no addition needed." + shape; see Provenance). The no-duplicate-homes rule above needs a + dup-check before every addition, and an empty grep is not that check: + rules phrased differently from the search term repeatedly produced + false "not covered" verdicts (three in one week in the contributor's + private log; see Provenance) — one a proposed addition whose content + already sat in the target file under other wording, caught only by + reading the section at drafting time. The check: grep the target file + and its sibling skills (the other skills in the same set — list the + directory, don't recall it) for the concept's synonyms; then, hits or + none, name the candidate homes — every section a hit landed in, plus + every section the fact would live in if it existed — and read each + named section in full before any verdict. The addition's change record + carries the result line: the sections read, and either the duplicate + found or "not found under the searches and sections listed". A bare + "not covered" backed only by empty greps is the failure this rule + exists to stop; no candidate home nameable at all → the placement is + unresolved — escalate it, never assert absence. + ✅ "grep for 'revert' and two synonyms returned nothing; still read the + rollback-shaped sections end to end — the rule already exists under + 'restore'; no addition needed." ❌ "grep returned nothing, so the file doesn't cover it." - **A cross-reference is not a load** (`unprobed` in-house; external evidence — see Provenance). On weak tiers, discovering that a sibling From 3b68c4575bf00281a457eb22ed0d01bc0f24f020 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:23:10 +0800 Subject: [PATCH 19/66] delegation-and-review: r2 rework of the sweep-scope fields - inventory closure via S3's own loop PR #50 round-2 gate (grok-4.5 high: FIX 1,2,5; gpt-5.6-sol max: FIX 1,2,3,4,5,7). All reproduced and addressed: - inventory gains a concrete build procedure (axis-diverse searches) and a closure criterion borrowed from S3's discovery loop (two consecutive empty passes); the token-grep ban is now aimed at the completeness INFERENCE, not at using search - fixes the direct- literal flip (grok F1, F2 / codex F1) - partition shortcut replaced: equivalence-class observation with the shared-outcome reason stated; unobserved = reported unverified, never folded into exhaustive (codex F2) - S3 pointer now quotes the canonical report-not-the-gate sentence verbatim instead of paraphrasing it (codex F3) - pos example covers every inventoried surface class (codex F4) - WRITE-scope referent pinned to the explicitly listed owned files/modules (grok F5 / codex F7) - PR body Checks line to be updated to disclose the S3 amendment (grok n4 / codex F5); codex n6 (in-packet unverifiability of checks.py claim) recorded - the gate-runner re-runs checks.py independently each round Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 50 ++++++++++++++++----------- 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 5c57c8e..e33acc5 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -35,26 +35,33 @@ Every packet names: - **Owned scope + explicit non-scope** — files/modules it may and may not touch. For a find-and-fix-every-instance sweep, scope splits in two (`unprobed` — private incident as shape; see Provenance): the SEARCH - scope is every surface that can generate the target — literals, - shared/global definitions, helpers that construct or return it — - inventoried from the definition surfaces themselves, never from the - token grep (a 53-file styling sweep missed its defect in a shared - utility class the token grep never matched, and each review round - surfaced another category the prior round's pattern structurally - excluded); the WRITE scope stays this field, and a generator discovered - outside it is reported for escalation, never edited on discovery. Name - the value family and close it (every tier/variant listed), or declare - the bound per §3's bounded-sweep clause — an unresolved discovery gap - blocks any exhaustive claim. + scope is every surface that can generate the target — literals and + direct references, shared/global definitions, helpers that construct + or return it. Searches build that inventory — reference search from + the symbol, reads of the defining files, tracing of emitting helpers, + one axis per pass so blind spots don't line up — and it closes per + §3's discovery loop: stop only after two consecutive passes surface + nothing new; no single pattern's zero hits ever prove it complete (a + 53-file styling sweep missed its defect in a shared utility class the + token grep never matched, and each review round surfaced another + category the prior round's pattern structurally excluded). The packet + lists the inventory (each surface and how it was found) and the value + family, closed (every tier/variant listed) or bounded per §3's + bounded-sweep clause. The WRITE scope stays the owned files/modules + explicitly listed above: a generator discovered outside that WRITE + scope is reported for escalation, never edited on discovery. - **Invariant** — property to close and properties to preserve. - **Proof gate** — concrete check that would fail under the broken behavior; worker-chosen "tests pass" is not a gate. For an every-instance sweep, the gate is the observed effect on every inventoried generator surface - and value tier (render or run each; a declared coverage partition with - its gaps stated is the only shortcut) — a zero-hit search is a report, - not the gate: a clean grep proves one spelling is gone, not that the - defect is gone. - ✅ "every tier rendered through the shared helper path — effect gone." + and value tier (render or run each); within a value family, one + observation may stand for a declared equivalence class only with the + shared-outcome reason stated, and anything unobserved is reported + unverified — never folded into an exhaustive claim. A zero-hit search + is a report, not the gate: a clean grep proves one spelling is gone, + not that the defect is gone. + ✅ "literals swept, the shared class rebuilt, every tier rendered + through the emitting helper — effect gone on each inventoried surface." ❌ "the grep is clean across all 53 files, so the sweep is done." - **Output contract** — conclusions + `file:line` refs, each tagged `[verified: ran ]`, `[verified: read ]`, or @@ -110,9 +117,10 @@ reviewers that they silently absorb as implementers. 'none')"). The reviewer re-runs that named search, never takes it on trust — then challenges its coverage with one differently-shaped query (a broader or structural pattern, or a class-aware check): re-running a - narrow pattern reproduces its hits AND its misses. (An every-instance - sweep's dispatch scope and acceptance gate are §2's sweep fields — - generator inventory and effect-per-surface, never search-zero.) + narrow pattern reproduces its hits AND its misses. (A + find-and-fix-every-instance sweep's dispatch scope and acceptance gate + are §2's sweep fields; there, "a zero-hit search is a report, not the + gate.") - **Machinery is not the user.** Tool completions, CI events, and agent statuses are state changes, not approval or proof. Open the artifact and verify. - **Auditing a completion claim** (an agent's or contractor's "done", a @@ -324,8 +332,8 @@ prescribes only the defensive split. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. The §2 sweep-scope additions (2026-07-21; search-scope/write-scope split, -definition-surface inventory, effect-per-surface proof gate, and the §3 -pointer) come from a private incident: a +axis-diverse inventory closed per §3's discovery loop, effect-per-surface +proof gate, and the §3 pointer) come from a private incident: a find-and-fix-every-instance styling sweep (53 files), three review rounds, and a merged fix all missed the actual defect — it lived in a shared global utility class the token grep pattern never touched, and each follow-up round's From 72c4a499c1f7415c510d9a78f02274dc0ae4a44e Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:29:29 +0800 Subject: [PATCH 20/66] operational-rigor: r3 rework of the scheduled-process rule - attribution, failure domains, canonical S2 pointers PR #49 round-3 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1,2,3,4,5,7,8). All reproduced and addressed: - arm-path channel checks now keyed to the invocation's emission condition (run-tied evidence where it should emit, justified absence where it should not) - conditional channels no longer unarm forever (grok F1) - credential clause scoped to what the work actually needs; credential-free schedules no longer blocked (grok F2) - overlap: a possible-overlap schedule arms only after the guard is observed blocking a dry second entry (codex F1) - ongoing watch moved outside the schedule's failure domain (or nearest available independence + named shared-fate residue), with a defined response to unhealthy/missed (codex F2); watch-in-place added to the arming done-set (grok n3) - review-arm evidence made asymmetric: stale refutes, fresh proves only with invocation tie or exclusive writer (codex F3) - S2 restatement replaced with named canonical scope + AUTH: pointer; permission-is-not-authorization stated; standing-auth demand scoped to consequential unattended fires (codex F4 / grok n4) - enabled-state read-only until arming completes (codex F7); pos example now carries the full arming boundary (codex F5) - codex F8 accepted per the PR #48 precedent: maintainer review- authority phrasing removed from the body (separate body edit); codex n6 (in-packet checks.py unverifiability) recorded - gate-runner re-runs it independently Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 72 ++++++++++++++++++------------- 1 file changed, 42 insertions(+), 30 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index ba12d41..7e68251 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -309,36 +309,48 @@ When rigor conflicts with finishing sooner, rigor wins. mtime audit; a second, independent output channel on the same task was separately dead on a stale hardcoded credential the whole time (`unprobed` — private incident as shape; see Provenance). Arming one, gates first: - a consequential send or spend needs its own per-invocation authorization - for every test fire, and the unattended recurrence needs an explicitly - scoped standing authorization — §2's confirmation-gate rule governs - both, and neither substitutes for the other. Verify the existing - non-interactive grants under the schedule's principal; creating or - broadening a credential is itself a §2-gated action, and with no safely - scoped grant the schedule stays unarmed. Then drive and attribute: - confirm the schedule's configured entry (command, arguments, trigger, - enabled) invokes the thing you are testing; run it headless under the - schedule's own execution context (principal, environment, working - directory) or watch one real scheduled fire; verify every output channel - at its destination with evidence correlated to that invocation — a - before/after state or a run-tied receipt; a fresh artifact another - writer could have produced proves nothing, and an async 2xx acceptance - is not delivery. Repeat the run for existing-output and lock behavior - (a sequential repeat cannot exercise overlap — test concurrency - deliberately or state it unverified, never by overlapping consequential - actions). Any unverified channel, or a run that needed a human to clear - a prompt, leaves the schedule unarmed. Ongoing: a dead task cannot - report its own death — check each destination on a cadence independent - of the task, against that channel's documented emission condition and - deadline (a task-written health line shows the task ran, not that - anything arrived; stale-or-uncheckable reads as unhealthy, never - healthy). Reviewing an existing schedule without authorization to run - it: inspect the evidence that already exists — per-channel artifacts, - receipts, output mtimes — and treat a green run history as evidence the - runner reported success, never that downstream received anything. - ✅ "confirmed the cron entry runs this script, fired it headless as the - cron user, correlated both channels' new evidence to that run, repeat - pass clean — then armed the schedule." + a consequential test fire (destructive, spending, publishing, + credential — §2's confirmation gate and its AUTH: artifact govern) + needs its own per-invocation authorization, and a schedule whose + unattended fires are themselves consequential needs §2's + project-policy-scoped standing authorization before running unattended + — a request to arm covers the arming, not those future fires, and a + permission or credential in place is not authorization (§2). Verify + the credentials the work actually needs under the schedule's + principal; minting or broadening one is itself §2-gated, and + session-only credentials do not travel to headless runs. Then drive + and attribute: read the schedule's configured entry — command, + arguments, trigger, and its enabled/disabled state, with recurrence + left disabled until arming completes — and confirm it invokes what you + are testing; fire once headless under the schedule's own execution + context (principal, environment, working directory) or watch one real + fire; check each channel against that invocation's emission condition: + run-tied evidence where it should emit (a before/after state, a + run-correlated receipt — a fresh artifact another writer could have + produced proves nothing, and an async 2xx acceptance is not delivery), + a justified condition-matched absence where it should not. Repeat the + run against its stated existing-output and lock expectations; where + runs can overlap, observe the mutual-exclusion guard block a dry + second entry. Armed means: every channel verified, no human cleared a + prompt mid-run, overlap guarded or impossible, and the independent + watch below in place — anything short stays unarmed. Ongoing: a dead + task cannot report its own death — watch each destination from outside + the schedule's own failure domain (scheduler, host, principal; where + full independence is unavailable, use at least a different trigger + path and name the shared-fate residue), against each channel's + documented emission condition and deadline; a task-written health line + shows the task ran, not that anything arrived; stale-or-uncheckable, + or a missed watch, is unhealthy and gets a defined response (alert, + disarm, escalate), never a shrug. Reviewing an existing schedule + without authorization to run it: inspect existing evidence + asymmetrically — stale evidence can refute; fresh evidence proves only + when tied to an invocation or an established exclusive writer, + otherwise it stays unverified — and a green run history is evidence + the runner reported success, never that downstream received anything. + ✅ "authorized the test fire; cron entry read and left disabled; fired + headless as the cron user; both channels' evidence tied to that run; + repeat met its stated expectations; lock blocked a dry second entry; + dead-man watch armed outside the host — then enabled the schedule." ❌ "the log shows 200/exit-0 every week, so it's working." - **Data-path integrity — fail loud on *unspecified* ambiguity, never emit a silently-wrong value.** Honor an explicit, documented contract (a declared From 2195114ad40c1543956b70779506ae64da4740e4 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:32:15 +0800 Subject: [PATCH 21/66] skill-authoring: r2 rework of the grep-absence rule - outline-based candidates, reviewer recheck PR #51 round-2 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1-5). All reproduced and addressed: - candidate homes now chosen from the LISTED section outline of the target and hit files, never from recalled/invented section names - closes the recall hole one level up (grok F1 / codex F1) - escalation widened to cover doubt that the candidate list is complete, not only the zero-candidate case (codex F1) - change record defined inline (PR description / commit message / completion report, S7's form) (grok F2) - reviewer-side out-of-band check added: re-run the recorded searches, open one unlisted candidate - absence-sensitive compliance never rests on the author's own line, per S7's ladder (codex F3) - pos example made auditable (three named terms, two named sections) and framed on a hypothetical playbook so no in-file ref dangles (codex F4) - sibling set + references files defined executably (codex F5); trigger scoped to new facts/rules, wording/provenance edits out (grok n3 / codex n6); on-hit path routes to the parent rule's cross-reference duty (grok n5) S2 mechanism gate run (both arms, in-repo): - motivating arm (reworded twin): headword 'twin' in delegation-and-review hits only Provenance; synonym 'differently' hits the S3 named-search bullet (line 91); outline -> read S3 -> concept found under 'differently-shaped query' wording. Procedure catches the twin. PASS - flipped arm (true absence): word-boundary grep for port/localhost in skill-authoring = 0 rule-body hits (substring hits were the important/support class); outline offers no plausible home; fact belongs to a sibling (delegation-and-review S1) -> scoped not-found, placement routed. PASS Cross-family mechanism review = this PR's own dual gate (S2 arm 3). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 51 +++++++++++++++++++++------------ 1 file changed, 32 insertions(+), 19 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index f248505..e6922e3 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -152,25 +152,38 @@ artifact-producing step. to use. - **Keyword-grep absence is not absence** (`unprobed` — private incidents as shape; see Provenance). The no-duplicate-homes rule above needs a - dup-check before every addition, and an empty grep is not that check: - rules phrased differently from the search term repeatedly produced - false "not covered" verdicts (three in one week in the contributor's - private log; see Provenance) — one a proposed addition whose content - already sat in the target file under other wording, caught only by - reading the section at drafting time. The check: grep the target file - and its sibling skills (the other skills in the same set — list the - directory, don't recall it) for the concept's synonyms; then, hits or - none, name the candidate homes — every section a hit landed in, plus - every section the fact would live in if it existed — and read each - named section in full before any verdict. The addition's change record - carries the result line: the sections read, and either the duplicate - found or "not found under the searches and sections listed". A bare - "not covered" backed only by empty greps is the failure this rule - exists to stop; no candidate home nameable at all → the placement is - unresolved — escalate it, never assert absence. - ✅ "grep for 'revert' and two synonyms returned nothing; still read the - rollback-shaped sections end to end — the rule already exists under - 'restore'; no addition needed." + dup-check before adding any new fact or rule (wording-only and + provenance edits are out of scope), and an empty grep is not that + check: rules phrased differently from the search term repeatedly + produced false "not covered" verdicts (three in one week in the + contributor's private log; see Provenance) — one a proposed addition + whose content already sat in the target file under other wording, + caught only by reading the section at drafting time. The check: grep + the target file and its sibling skills (the skills shipped beside it — + list the parent skills directory, don't recall it, and include a + skill's references files when the topic plausibly lives there) for the + headword plus at least two synonyms (outcome words, opposite + operations, domain jargon); list the actual section headings of the + target and of every file a hit landed in; from that real outline — + never from memory — name the candidate homes (every section with a + hit, plus every section the fact would live in if it existed) and read + each in full before any verdict. A duplicate found → the parent rule + governs: cross-reference the sibling, never re-add. Otherwise the + change record — the PR description or commit message when one is + being created, otherwise the completion report — carries the result + line: the terms searched, the sections read, and "not found under the + searches and sections listed"; the addition's reviewer re-runs those + searches and opens at least one candidate the record did not name + (absence-sensitive compliance never rests on the author's own line — + §7's ladder). A bare "not covered" backed only by empty greps is the + failure this rule exists to stop; an outline with no plausible home + for a fact that must have one, or doubt that the candidate list is + complete → the placement is unresolved — escalate it, never assert + absence. + ✅ "grep for 'revert', 'rollback', 'undo' across the playbook and its + two siblings returned nothing; read the playbook's 'State recovery' + and 'Cleanup' sections end to end — the rule exists under 'restore'; + the change record lists all three terms and both sections." ❌ "grep returned nothing, so the file doesn't cover it." - **A cross-reference is not a load** (`unprobed` in-house; external evidence — see Provenance). On weak tiers, discovering that a sibling From 63a1fb020f85a67d3e777ba76876b58b66c35b5a Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:36:29 +0800 Subject: [PATCH 22/66] delegation-and-review: r4 rework of the settled-tree bullet - void-not-bind, ownership before restore PR #48 round-4 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-8; core finding convergent across both). All reproduced and addressed: - moving-tree verdicts VOID instead of re-binding to the capture; the return check is read-surface-aware (copy path vs live path), and the copy path re-gates live-drifted paths before applying the verdict (grok F1 / codex F3, F6) - capture dimensions defined once (working content, index, untracked, HEAD/ref) and compared per-dimension on return - covers the empty-commit / ref-motion flip a path diff misses (codex F2, F8) - unaccountable motion no longer auto-attributed to the wave: a user, hook, or sibling process may own it; quarantine + investigate before restoring, per S4's edit-conflict protection; a contaminated copy is discarded and re-cut, never repaired-in-place (codex F4, F2) - write-withholding failure path defined: cannot withhold -> recorded gap, verdict provisional evidence, never a clean gate pass (codex F1) - completion-claim-audit carve-out restored as one clause with the correct direction word: a delivered tree is settled by copying only (codex F5; ends the add/remove oscillation on this clause - final) - pos example carries the applied-edits-are-the-next-change tail (codex F6); PR body What-section to be synced (codex F7 / grok r4 covenant note) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 57 ++++++++++++++++----------- 1 file changed, 34 insertions(+), 23 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 4913744..c3a1a6e 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -94,30 +94,40 @@ reviewers that they silently absorb as implementers. concurrent edits with no conflict signal): the first is a read verdict going stale mid-read, the second a "read-only" reviewer writing anyway. The defensive split: (1) settle the content under review in place — - commit it on the reviewed branch, or capture it restorably (staged, - unstaged, and untracked content, not filenames or bare hashes) — and - never stash away the very change the wave reviews. (2) Give the wave - an immutable read: a full copy verified against that capture before - dispatch (a worktree pinned at a revision omits dirty content unless - the capture is applied into it), or the live tree with your own edits - frozen until return — and in both shapes withhold the wave's write - access wherever the harness can; "read-only" is a claim, not a - property. (3) On return, diff the reviewed paths against the capture: - ANY delta there — your own later edits included — means the verdict - binds the captured state, not the current one; re-verify or - re-dispatch before acting on it. A delta you did not make, or a - commit, HEAD, or index motion not yours, additionally means the wave - wrote: quarantine your own post-dispatch edits first, restore the - reviewed paths from the capture (never adopt the suspect tree as the - new baseline), then re-dispatch. An endpoint match is detection of + commit it on the reviewed branch, or capture it restorably: the + reviewed paths' working content, index state, and untracked files, + plus the HEAD/ref position — and never stash away the very change the + wave reviews (a delivered tree under §3's completion-claim audit below + is settled by copying only — that rule forbids mutating it). (2) Give + the wave an immutable read: a full copy verified against that capture + before dispatch (a worktree pinned at a revision omits dirty content + unless the capture is applied into it), or the live tree with your own + edits frozen until return; withhold the wave's write access — + "read-only" is a claim, not a property — and where the harness cannot + withhold it, record that gap at dispatch: the wave's verdict is then + provisional evidence at best, never a clean gate pass. (3) On return, + check by read surface. Wave read the copy: inspect the copy across + every captured dimension (content, index, untracked, HEAD/ref) — any + change there means the copy was written: discard it, void the verdict, + re-cut and re-dispatch; otherwise the verdict describes the capture, + and paths that moved in the live tree since dispatch are re-gated + before the verdict is applied to them. Wave read the live tree: any + change to the reviewed paths' captured dimensions — your own edits + included — voids the verdict; re-dispatch against a settled tree, + never re-attribute it to the capture. Motion you did not make is not + proof the wave wrote: a user, hook, or sibling process may own it — + quarantine your own post-dispatch edits and investigate who moved what + before restoring anything (§4's edit-conflict rule protects a + concurrent editor's work). An endpoint match is detection of persistent drift only — a write-capable wave can mutate and restore - mid-read without a trace; only the verified copy or the frozen tree, - each with write withheld, prevents. + mid-read without a trace; prevention is the verified copy or the + frozen tree, with write withheld. ✅ "held my own edits until the wave returned and the reviewed paths - diffed clean against the capture, then applied them." + diffed clean against the capture, then applied them — the applied + edits are the next change to review, not part of the approved one." ❌ "kept fixing files in the live tree the critic was reading." - ❌ "the tree matches what I intended, so the verdict stands" — the - baseline is the captured state, not your intentions. + ❌ "the tree matches what I intended, so the verdict stands" — a + moved tree voids the verdict; it does not re-bind to the capture. - Review against the packet contract, not line-by-line theater. New bug class caught → sweep the codebase: one catch, one class, one sweep. The worker's sweep report obeys operational-rigor §5 (the canonical copy, verbatim: @@ -344,8 +354,9 @@ separate critic committed the reviewed worktree to a branch mid-review, leaving the requested end-state unreachable. Both observed in a private audit harness (contributor-verifiable, not linkable here); the fix (restorable capture, verified-copy-or-frozen-tree with write withheld, -any-drift-invalidates return check) is the defensive split, not a -mechanism finding, mirroring how the §4 silent-clobber bullet above +read-surface-aware return checks that void a moved verdict) is the +defensive split, not a mechanism finding, mirroring how the §4 +silent-clobber bullet above handles its own single-sandbox observation. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. From 2727c6844084e671c30fe7018e40f232fa5c9a9d Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:38:26 +0800 Subject: [PATCH 23/66] delegation-and-review: r3 rework of the sweep fields - spelling-free axis, verbatim loop cite, textual carve-out PR #50 round-3 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1,2,3,4). All reproduced and addressed: - at least one inventory axis must never match the target's spelling (effect-source definitions/constructors) - the axis set was spelling-seeded and could not reach the cited utility class (grok F1) - S3 anchors cited by real name with the loop quoted verbatim ('Stop only after two consecutive empty rounds; one clean round is not convergence'), a round defined as every-axis-ran, dedup imported (grok F2 / codex F1 / grok r3 n5 of r2) - equivalence classes need verified branch-free shared paths, not a stated reason (codex F2) - textual-invariant carve-out: an exact-spelling sweep over a declared corpus is gated by the scoped search itself; effect-gate scoped to behavioral targets (codex F3) - bounded/gap-carrying sweeps return a non-exhaustive outcome; scope reduction needs the dispatcher's say; every-instance claims with unobserved members are false (codex F4) - inventory neg example added; pos example names per-surface observations (grok n6 / codex n5); target forms glossed (grok n4) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 60 +++++++++++++++++---------- 1 file changed, 37 insertions(+), 23 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index e33acc5..65d308c 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -37,31 +37,45 @@ Every packet names: (`unprobed` — private incident as shape; see Provenance): the SEARCH scope is every surface that can generate the target — literals and direct references, shared/global definitions, helpers that construct - or return it. Searches build that inventory — reference search from - the symbol, reads of the defining files, tracing of emitting helpers, - one axis per pass so blind spots don't line up — and it closes per - §3's discovery loop: stop only after two consecutive passes surface - nothing new; no single pattern's zero hits ever prove it complete (a - 53-file styling sweep missed its defect in a shared utility class the - token grep never matched, and each review round surfaced another - category the prior round's pattern structurally excluded). The packet - lists the inventory (each surface and how it was found) and the value - family, closed (every tier/variant listed) or bounded per §3's - bounded-sweep clause. The WRITE scope stays the owned files/modules - explicitly listed above: a generator discovered outside that WRITE - scope is reported for escalation, never edited on discovery. + or return it. Build the inventory from the target's forms (symbol, + string, or emit site) AND from at least one axis that never matches + its spelling — the shared definitions and constructors that produce + that kind of output (a 53-file styling sweep missed its defect in a + shared utility class the token grep never matched, and each review + round surfaced another category the prior round's pattern + structurally excluded). The inventory closes per §3's miss-is-costly + loop, verbatim: "Stop only after two consecutive empty rounds; one + clean round is not convergence" — a round counts only when every axis + ran, with dedup against everything already surfaced; no single + pattern's zero hits ever prove completeness. The packet lists the + inventory (each surface and how it was found) and the value family, + closed (every tier/variant listed) or bounded per §3's "State + anything you bounded" clause — and a bounded or gap-carrying sweep + returns a non-exhaustive outcome: reducing scope needs the + dispatcher's explicit say, and an every-instance claim with + unobserved members is false. The WRITE scope stays the owned + files/modules explicitly listed above: a generator discovered outside + that WRITE scope is reported for escalation, never edited on + discovery. + ❌ "the inventory is the 53 grep hits — the shared utility never made + the list." - **Invariant** — property to close and properties to preserve. - **Proof gate** — concrete check that would fail under the broken behavior; - worker-chosen "tests pass" is not a gate. For an every-instance sweep, - the gate is the observed effect on every inventoried generator surface - and value tier (render or run each); within a value family, one - observation may stand for a declared equivalence class only with the - shared-outcome reason stated, and anything unobserved is reported - unverified — never folded into an exhaustive claim. A zero-hit search - is a report, not the gate: a clean grep proves one spelling is gone, - not that the defect is gone. - ✅ "literals swept, the shared class rebuilt, every tier rendered - through the emitting helper — effect gone on each inventoried surface." + worker-chosen "tests pass" is not a gate. For an every-instance sweep + whose target is behavior or rendered effect, the gate is the observed + effect at every inventoried generator surface and value tier (render + or run each); one observation may stand for a declared equivalence + class only when the shared path is verified branch-free for that + outcome (read the path — a stated "they share a helper" is a claim, + not evidence), and anything unobserved is reported unverified — never + folded into an exhaustive claim. Where the invariant is itself textual + (an exact forbidden spelling in a declared corpus), a correctly scoped + search over that corpus IS the gate. A zero-hit search on a behavioral + target is a report, not the gate: a clean grep proves one spelling is + gone, not that the defect is gone. + ✅ "each literal's site re-rendered, the shared class's consumers + re-rendered, every tier through the emitting helper — effect gone at + each observation point." ❌ "the grep is clean across all 53 files, so the sweep is done." - **Output contract** — conclusions + `file:line` refs, each tagged `[verified: ran ]`, `[verified: read ]`, or From 1d401e03e9a5447f64216de9be5636411e7a6778 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:43:42 +0800 Subject: [PATCH 24/66] operational-rigor: r4 restructure - lean S4 trigger bullet, protocol body to external-systems reference PR #49 round-4 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1-6). Four rounds of findings kept landing on one mechanism - a single S4 bullet carrying a full scheduler protocol - so per the file's own architecture (the 2026-07-14 split precedent: boundary-specific protocols live in references/external-systems.md, S4 stays lean) the rule is split: S4 keeps a state-phrased trigger (grok F2), the claim, the incident shape, and the pointer; the protocol body becomes the scheduled-process entry in the reference, folding every r4 finding: - emission-positive drive per channel; absence verifies only the suppression branch (codex F1) - terminal dead-man watch: alarm-on-absence by construction, outside the failure domain, proven once by skipping a ping (codex F2) - per-invocation authorization for EVERY consequential invocation, repeat included, verbatim AUTH: artifact named (codex F3) - overlap: real lock-acquisition path under a held guard; 'impossible' = scheduler-enforced, not short runtime (codex F4) - execution context = principal AND environment AND working directory; the interactive-session-credential trap named (codex F5) - watch-one-real-fire scoped to already-enabled schedules under observation authority (codex F6 / grok F1) - exit-code scope note added at the S4 bullet (grok n4); watch/dead-man terms unified; S4 boundary list + reference header gain 'recurring schedule'; reference Provenance records the placement Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 74 ++++++------------- .../references/external-systems.md | 66 ++++++++++++++++- 2 files changed, 87 insertions(+), 53 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 7e68251..3da1d86 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -302,55 +302,22 @@ When rigor conflicts with finishing sooner, rigor wins. (contract holds under adversarial input). Only correct permits "done". - Never fabricate observations or report outputs not produced. Report skipped verification as skipped. -- **A recurring scheduled process's own "completed" report is not evidence its - side effects landed.** A weekly task reported success for roughly three - months while its write step silently never executed — every output file's - mtime frozen at the date the write path broke, caught only by an unrelated - mtime audit; a second, independent output channel on the same task was - separately dead on a stale hardcoded credential the whole time (`unprobed` - — private incident as shape; see Provenance). Arming one, gates first: - a consequential test fire (destructive, spending, publishing, - credential — §2's confirmation gate and its AUTH: artifact govern) - needs its own per-invocation authorization, and a schedule whose - unattended fires are themselves consequential needs §2's - project-policy-scoped standing authorization before running unattended - — a request to arm covers the arming, not those future fires, and a - permission or credential in place is not authorization (§2). Verify - the credentials the work actually needs under the schedule's - principal; minting or broadening one is itself §2-gated, and - session-only credentials do not travel to headless runs. Then drive - and attribute: read the schedule's configured entry — command, - arguments, trigger, and its enabled/disabled state, with recurrence - left disabled until arming completes — and confirm it invokes what you - are testing; fire once headless under the schedule's own execution - context (principal, environment, working directory) or watch one real - fire; check each channel against that invocation's emission condition: - run-tied evidence where it should emit (a before/after state, a - run-correlated receipt — a fresh artifact another writer could have - produced proves nothing, and an async 2xx acceptance is not delivery), - a justified condition-matched absence where it should not. Repeat the - run against its stated existing-output and lock expectations; where - runs can overlap, observe the mutual-exclusion guard block a dry - second entry. Armed means: every channel verified, no human cleared a - prompt mid-run, overlap guarded or impossible, and the independent - watch below in place — anything short stays unarmed. Ongoing: a dead - task cannot report its own death — watch each destination from outside - the schedule's own failure domain (scheduler, host, principal; where - full independence is unavailable, use at least a different trigger - path and name the shared-fate residue), against each channel's - documented emission condition and deadline; a task-written health line - shows the task ran, not that anything arrived; stale-or-uncheckable, - or a missed watch, is unhealthy and gets a defined response (alert, - disarm, escalate), never a shrug. Reviewing an existing schedule - without authorization to run it: inspect existing evidence - asymmetrically — stale evidence can refute; fresh evidence proves only - when tied to an invocation or an established exclusive writer, - otherwise it stays unverified — and a green run history is evidence - the runner reported success, never that downstream received anything. - ✅ "authorized the test fire; cron entry read and left disabled; fired - headless as the cron user; both channels' evidence tied to that run; - repeat met its stated expectations; lock blocked a dry second entry; - dead-man watch armed outside the host — then enabled the schedule." +- **Arming, enabling, relying on, or reviewing a recurring scheduled + process → its side effects are unverified until checked at their + destinations; the process's own "completed" report is not that + evidence** (`unprobed` — private incident as shape; see Provenance). A + weekly task reported success for roughly three months while its write + step silently never executed, and a second output channel on the same + task was separately dead on a stale hardcoded credential the whole + time. The arming and audit protocol is the scheduled-process entry in + `references/external-systems.md` — load it before arming, enabling, + or auditing one. A green run history is evidence the runner reported + success, never that downstream received anything (the earlier + exit-code line governs the immediate command you just ran; a + schedule's downstream is this rule). + ✅ "loaded the reference, drove both channels emission-positive tied + to the test fire, dead-man alarm proven once — then enabled the + schedule." ❌ "the log shows 200/exit-0 every week, so it's working." - **Data-path integrity — fail loud on *unspecified* ambiguity, never emit a silently-wrong value.** Honor an explicit, documented contract (a declared @@ -367,7 +334,8 @@ When rigor conflicts with finishing sooner, rigor wins. - ✅ blank / `—` when genuinely unknown. ❌ "null rate → show 0% so the chart still renders." - **Building, configuring, or verifying work that crosses a boundary into an - external tool, cache, fallback chain, clock/timezone, or deploy target? Load + external tool, cache, fallback chain, clock/timezone, deploy target, or + recurring schedule? Load `references/external-systems.md`.** Each of those boundaries reports success while lying about it in a specific, incident-backed way; the reference holds the verify-before-trust rule for each — exit-code contracts (a tool that @@ -596,7 +564,11 @@ the same task was separately dead the entire time on a stale hardcoded credential (contributor-reported shape; the private repo is verifiable by the contributor, not linkable here). It ships `unprobed` — the pack's private fixtures have no long-running-schedule arm to drive it; the marker records -that debt, not an exemption. +that debt, not an exemption. The protocol body lives in +`references/external-systems.md` (its scheduled-process entry) per the +2026-07-14 split precedent — boundary-specific protocols out of the lean +core; the §4 bullet keeps the trigger, the claim, the incident shape, and +the pointer. Stable behavioral rules; the environment-specific facts to re-verify now travel with the rules that cite them — the external-systems set in `references/external-systems.md`, plus §2's mount-check commands diff --git a/skills/operational-rigor/references/external-systems.md b/skills/operational-rigor/references/external-systems.md index 465370a..6121de0 100644 --- a/skills/operational-rigor/references/external-systems.md +++ b/skills/operational-rigor/references/external-systems.md @@ -1,7 +1,8 @@ # operational-rigor · references: external-systems Verify-before-trust rules for work that crosses a boundary into an external -tool, cache, fallback chain, timezone/clock, or deploy target. These are NOT +tool, cache, fallback chain, timezone/clock, deploy target, or recurring +schedule. These are NOT core discipline — each is an incident-backed trap specific to one boundary, where the boundary *reports success while lying about it* in a particular way, and the rule names the observation that catches it. They live here, out of the @@ -111,6 +112,60 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. and importing it — dev-mode resolvers prove nothing about production module loading. +- **A recurring schedule's own "completed" report is not evidence its side + effects landed — verify at the destinations, attributed to the + invocation.** (Motivating incident: a weekly task reported success for + roughly three months while its write step silently never executed; a + second output channel on the same task was separately dead on a stale + hardcoded credential — contributor-reported shape; see the skill's + Provenance.) Gates first: every consequential invocation — the repeat + run below included — carries its own per-invocation authorization + (destructive / spending / publishing / credential: operational-rigor + §2's confirmation gate and verbatim AUTH: artifact govern), and a + schedule whose unattended fires are themselves consequential needs §2's + project-policy-scoped standing authorization before running unattended; + a request to arm covers the arming, not those future fires; a + permission or credential in place is not authorization. Verify the + credentials the work actually needs under the schedule's principal; + minting or broadening one is itself gated; session-only credentials do + not travel to headless runs. Drive and attribute: read the configured + entry (command, arguments, trigger, enabled/disabled state) and confirm + it invokes what you test; recurrence stays disabled while arming — fire + the entry once yourself, headless, under the schedule's execution + context, meaning principal AND environment AND working directory + (running interactively as the right user can carry a session credential + the real schedule lacks — the incident's dead channel); "watch one real + fire" establishes scheduler binding only on an already-enabled schedule + you hold observation authority over. Verify each channel with its + emission condition driven TRUE at least once: run-tied destination + evidence (a before/after state, a run-correlated receipt; a fresh + artifact another writer could have produced proves nothing; an async + 2xx acceptance is not delivery) — a condition-matched absence verifies + only the suppression branch, never the channel. Repeat the run (its own + grant if consequential) against stated existing-output and lock + expectations; a hung run overlaps the next fire regardless of average + runtime, so where overlap is possible the second entry must traverse + the real lock-acquisition path while the first holds the guard — + "impossible" means scheduler-enforced non-concurrency, not short + runtime. Armed means: every channel emission-positive-verified; no + human cleared a prompt mid-run; overlap guarded or scheduler-excluded; + the watch below armed and its alarm proven once. Anything short stays + unarmed. Ongoing: a dead task cannot report its own death, and a + watcher that can die silently moves the problem one layer down — + terminate the chain in a mechanism whose alarm fires on ABSENCE by + construction (an externally enforced missed-deadline alert), outside + the schedule's failure domain (scheduler, host, principal; where full + independence is unavailable, the nearest different trigger path, with + the shared-fate residue named); key it to each channel's documented + emission condition and deadline; prove it once by skipping a ping. A + task-written health line shows the task ran, not that anything arrived; + stale, uncheckable, or a missed watch is unhealthy and gets the defined + response (alert, disarm, escalate), never a shrug. Reviewing an + existing schedule without authorization to run it: inspect existing + evidence asymmetrically — stale evidence can refute; fresh evidence + proves only when tied to an invocation or an established exclusive + writer; otherwise it stays unverified. + ## Provenance These six rules are the 2026-07-13 external-systems batch, mined from five @@ -129,7 +184,14 @@ error-cooldown cache state, typed advance-signal vs. valid empty, executed DST gap/fold cases, and the durable-handoff scope of "await side effects" — trail in `reviews/2026-07-16-post-merge-validation-pr25-29.md`. +The scheduled-process entry (2026-07-22) is the protocol body of the §4 +scheduled-process rule added in opus-pack #49 — placed here per the +2026-07-14 split precedent (boundary-specific protocols out of the lean +core); its incident provenance and `unprobed` marker live with that rule in +the skill's Provenance. + Environment-specific facts to re-verify against current tooling: a tool's exit-code table (qpdf's), real success-latency distributions, cache TTL/state semantics, fallback-provider quotas, date-constructor normalization + TZ/DST -behavior, and serverless lifecycle + bundler file-tracing. +behavior, serverless lifecycle + bundler file-tracing, and scheduler +concurrency/one-shot semantics. From 6f81dba30c7fc18beefb2d650bc0cddbb99642c4 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:46:18 +0800 Subject: [PATCH 25/66] delegation-and-review: r5 rework of the settled-tree bullet - exclusivity, unreviewed closure, concrete recovery PR #48 round-5 gate (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1,2,3,4,5,7). All reproduced and addressed: - copy REQUIRED when write cannot be withheld or any third writer (user, hook, sibling) can move the live tree; live arm gated on all three conditions; neither enforceable -> provisional label only, never a clean gate pass (grok F2 / codex F1, F4) - moved live paths while a copy was reviewed: verdict describes the baseline only; moved paths AND their dependents are UNREVIEWED and need fresh-context coverage, not an orchestrator glance (grok F1 / codex F2) - commit arm now records the baseline (noted revision) and verifies the capture holds everything under review (codex F3) - 're-cut' replaced by the concrete recovery: quarantine the written copy for attribution (never delete unexamined), fresh verified copy from the settled tree, re-dispatch (grok F3 / codex F7) - pos examples: copy-arm example added; both carry write-withheld and the four-dimension check (grok n4 / codex F5) - lead state-phrased (grok n5); PR body diffstat to be refreshed (codex n6) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 102 ++++++++++++++------------ 1 file changed, 55 insertions(+), 47 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index c3a1a6e..d95eaeb 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -83,51 +83,59 @@ reviewers that they silently absorb as implementers. verdicts name the point nearest failure or they are rubber stamps. - Critic verdicts carry evidence: REFUTED needs a counterexample; untested assumptions are listed. Verify critics too; stale or missing review is not approval. -- **Settle the tree before a read-only review dispatch** — a fresh-context - critic wave reading a tree that can still move returns a verdict about - a state that no longer exists (`unprobed` — private incidents as shape; - see Provenance). One read-only critic re-read a file the orchestrator - had already fixed mid-review and voted REFUTED on a bug already - confirmed elsewhere; a separate critic committed the very worktree it - was reviewing, moving the tree out from under the requested end-state. - Neither is §4's write-write clobber below (a subordinate overwriting - concurrent edits with no conflict signal): the first is a read verdict - going stale mid-read, the second a "read-only" reviewer writing anyway. - The defensive split: (1) settle the content under review in place — - commit it on the reviewed branch, or capture it restorably: the - reviewed paths' working content, index state, and untracked files, - plus the HEAD/ref position — and never stash away the very change the - wave reviews (a delivered tree under §3's completion-claim audit below - is settled by copying only — that rule forbids mutating it). (2) Give - the wave an immutable read: a full copy verified against that capture - before dispatch (a worktree pinned at a revision omits dirty content - unless the capture is applied into it), or the live tree with your own - edits frozen until return; withhold the wave's write access — - "read-only" is a claim, not a property — and where the harness cannot - withhold it, record that gap at dispatch: the wave's verdict is then - provisional evidence at best, never a clean gate pass. (3) On return, - check by read surface. Wave read the copy: inspect the copy across - every captured dimension (content, index, untracked, HEAD/ref) — any - change there means the copy was written: discard it, void the verdict, - re-cut and re-dispatch; otherwise the verdict describes the capture, - and paths that moved in the live tree since dispatch are re-gated - before the verdict is applied to them. Wave read the live tree: any - change to the reviewed paths' captured dimensions — your own edits - included — voids the verdict; re-dispatch against a settled tree, - never re-attribute it to the capture. Motion you did not make is not - proof the wave wrote: a user, hook, or sibling process may own it — - quarantine your own post-dispatch edits and investigate who moved what - before restoring anything (§4's edit-conflict rule protects a - concurrent editor's work). An endpoint match is detection of - persistent drift only — a write-capable wave can mutate and restore - mid-read without a trace; prevention is the verified copy or the - frozen tree, with write withheld. - ✅ "held my own edits until the wave returned and the reviewed paths - diffed clean against the capture, then applied them — the applied - edits are the next change to review, not part of the approved one." +- **A fresh-context critic wave is reading (or about to read) a tree that + can still move — settle it first: a verdict formed on a moving tree + describes a state that no longer exists** (`unprobed` — private + incidents as shape; see Provenance). One read-only critic re-read a + file the orchestrator had already fixed mid-review and voted REFUTED + on a bug already confirmed elsewhere; a separate critic committed the + very worktree it was reviewing, moving the tree out from under the + requested end-state. Neither is §4's write-write clobber below (a + subordinate overwriting concurrent edits): the first is a read verdict + going stale mid-read, the second a "read-only" reviewer writing + anyway. (1) Settle in place and record the baseline: commit the + content under review on the reviewed branch and note the resulting + revision, or capture it restorably — working content, index state, + untracked files, HEAD/ref position — verifying the capture holds + everything under review; never stash away the very change the wave + reviews (a delivered tree under §3's completion-claim audit below is + settled by copying only — that rule forbids mutating it). (2) Choose + the read surface by what you can enforce: a full copy verified against + the baseline before dispatch (a worktree pinned at a revision omits + dirty content unless the capture is applied into it) — required + whenever the wave's write access cannot be withheld, or when any other + writer (a user, a hook, a sibling process) can touch the live tree + mid-read; the live tree only when your edits are frozen until return + AND the wave's write access is withheld AND no other writer can move + the reviewed paths ("read-only" is a claim, not a property). Neither + enforceable → the review runs labeled provisional; its verdict is + never a clean gate pass. (3) On return, compare every baseline + dimension (content, index, untracked, HEAD/ref). Copy written → + quarantine the copy for attribution (never delete it unexamined — the + motion may be another actor's work), void the verdict, make a fresh + verified copy from the settled tree, re-dispatch. Live reviewed paths + moved → the verdict is void; re-dispatch against a settled tree, + never re-attribute it to the baseline. Live tree moved while the wave + read a clean copy → the verdict describes the baseline only; the + moved paths and everything that depends on them are UNREVIEWED — + fresh-context re-review covers them, not the orchestrator's own + glance (the author is not the judge). Motion you did not make is + never proof the wave wrote — investigate ownership before restoring + anything (§4's edit-conflict rule protects a concurrent editor's + work). An endpoint match detects only persistent drift — a + write-capable reader can mutate and restore without a trace; + prevention is the enforced copy, or the frozen tree with write + withheld and no third writer. + ✅ "committed the slice, noted the revision, dispatched a verified + copy with write withheld, kept editing the live tree; on return the + copy's four dimensions matched — the verdict holds for the baseline, + and my later edits go to the next review." + ✅ "held my own edits until the wave returned and the reviewed paths' + four dimensions diffed clean against the baseline, then applied them + — the applied edits are the next change to review." ❌ "kept fixing files in the live tree the critic was reading." ❌ "the tree matches what I intended, so the verdict stands" — a - moved tree voids the verdict; it does not re-bind to the capture. + moved tree voids the verdict; it does not re-bind to the baseline. - Review against the packet contract, not line-by-line theater. New bug class caught → sweep the codebase: one catch, one class, one sweep. The worker's sweep report obeys operational-rigor §5 (the canonical copy, verbatim: @@ -353,10 +361,10 @@ fixed mid-dispatch and voted REFUTED on an already-confirmed bug, and a separate critic committed the reviewed worktree to a branch mid-review, leaving the requested end-state unreachable. Both observed in a private audit harness (contributor-verifiable, not linkable here); the fix -(restorable capture, verified-copy-or-frozen-tree with write withheld, -read-surface-aware return checks that void a moved verdict) is the -defensive split, not a mechanism finding, mirroring how the §4 -silent-clobber bullet above +(recorded baseline, enforced-copy-or-frozen-tree with write withheld +and no third writer, read-surface-aware return checks that void a +moved verdict) is the defensive split, not a mechanism finding, +mirroring how the §4 silent-clobber bullet above handles its own single-sandbox observation. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has run — in-body `unprobed` marker. From 360c89d332a331f6e0f810c53e4a0d3d3ed1be34 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:49:41 +0800 Subject: [PATCH 26/66] skill-authoring: rework the deployment-runtime rule per r1 dual review PR #52 round-1 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1-5). Reproduced and addressed: - unknown/unaskable runtime -> mark user-must-provide, conclude without a portability verdict, never default to the authoring host (grok F1) - MCP clause made executable and bounded to instance-specific identifiers: verified portable name, or a runtime/instance label; no invented discovery mechanism (grok F2 / codex F5) - Done now requires compatibility with every NAMED target - a labeled incompatibility blocks completion or explicitly shrinks the supported scope (codex F1, F4) - S2 citation restored to its qualified form: hard-coded machine-absolute paths (codex F2) - pos/neg pair added at the portable-vs-labeled boundary (codex F4 / grok n4); sweep categories glossed with concrete cues (grok n3); lead state-phrased (grok n5) - codex F3 rejected-with-reason: single-incident rules with unprobed markers are this repo's documented covenant and settled precedent (silent-clobber, fan-in, interactive-runtime all shipped on one observation); S4's two-strike governs fix-log promotion in consuming projects, not this pack's covenant-governed rule adoption - codex n6 (in-packet checks.py unverifiability): standing disposition, gate-runner re-runs it each round Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 43 +++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 3a22838..35a478f 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -229,21 +229,34 @@ The sharpest usability probe is behavioral: give a fresh weaker-tier behavior down first, then patch the gaps the probe surfaces — not the ones you imagine. -**Name the deployment runtime before the review concludes** (`unprobed` — -private incident as shape; see Provenance). A skill or plugin verified only -on the author's machine can pass every lens above and still be wrong where -it will actually run: one reviewed-and-finalized skill was reworked -wholesale when its real target — a sandboxed Linux VM, not the author's -macOS — surfaced only after sign-off. Ask where it will run as a review -input, not a deploy-time discovery, then sweep the file for assumptions -that silently bind it to the author's machine: absolute paths (§2's rule), -OS-specific launchers and helpers (URL-scheme opens, clipboard or -notification tools), host identity, wall-clock and timezone, and -hard-coded MCP tool names — a connector's tool prefix can be unique to the -author's instance, so a distributable skill discovers its tools at runtime -instead of naming one machine's. Done when the review names the target -runtime(s) and each machine-bound assumption is either portable or labeled -with the runtime it requires. +**A skill or plugin is under review here and its target runtime(s) are +not yet named in the review record — name them before the review +concludes** (`unprobed` — private incident as shape; see Provenance). A +skill verified only on the author's machine can pass every lens above and +still be wrong where it will actually run: one reviewed-and-finalized +skill was reworked wholesale when its real target — a sandboxed Linux VM, +not the author's macOS — surfaced only after sign-off. Obtain the target +from the request or the user; when no answer is available, mark the +runtime `user-must-provide` and conclude without a portability verdict — +never default to the authoring host. Then sweep for assumptions that +silently bind the file to the author's machine: hard-coded +machine-absolute paths (§2's rule), OS-specific launchers and helpers +(URL-scheme opens, clipboard or notification tools), host identity (a +literal hostname or username), wall-clock or timezone assumptions (a +hard-coded TZ, a locale), and instance-specific tool identifiers — a +connector's tool prefix can be unique to the author's instance: keep a +verified portable name, or label the dependency with the runtime or +instance it requires; when no verified discovery mechanism or portable +form exists, that label is the honest outcome — never invent one. Done +when every named target runtime is compatible with every kept +assumption — a labeled incompatibility with a named target blocks +completion or explicitly shrinks the supported target scope — and +everything machine-bound carries its label. +✅ "target: sandboxed Linux VM; the notify helper is macOS-only — +replaced with a portable path; the connector prefix labeled +instance-specific." +❌ "labeled the launcher 'requires macOS' and concluded — while the +named target is a Linux VM." Fix what blocks, then read back the final files to confirm they landed complete. When mining sessions or external material into skills, strip From d38c63635a4e7883fc00fa96624b8eded4d8380d Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:51:52 +0800 Subject: [PATCH 27/66] delegation-and-review: r4 rework of the sweep fields - closure honesty, equivalence evidence, contained observation PR #50 round-4 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1,2,3,4). All reproduced and addressed: - textual carve-out guarded: only when the declared corpus covers every inventoried surface AND no inventoried generator can emit the target without the literal; token sweeps with emitters stay on the effect gate (grok F1 / grok n6) - value family closes only via its named canonical source (file:line) or the same discovery loop, else bounded - the color-tier axis of the incident (grok F2) - rounds must add a broadened or new query; identical reruns count for nothing (codex F1) - equivalence requires evidence across inputs, backing data, and downstream context; branch-free control flow alone is not equivalence (codex F2) - observation runs inside an authorized side-effect-contained harness; undrivable outward effects reported unverified + escalated, never fired for the gate (codex F4) - 'behavioral target' qualifier restored at both categorical zero-hit statements and the S3 pointer, which now also carries the positive half of acceptance (codex F3 / grok n4); scope-side pos example added (grok n5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 63 +++++++++++++++++---------- 1 file changed, 39 insertions(+), 24 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 65d308c..26c20be 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -46,33 +46,47 @@ Every packet names: structurally excluded). The inventory closes per §3's miss-is-costly loop, verbatim: "Stop only after two consecutive empty rounds; one clean round is not convergence" — a round counts only when every axis - ran, with dedup against everything already surfaced; no single - pattern's zero hits ever prove completeness. The packet lists the - inventory (each surface and how it was found) and the value family, - closed (every tier/variant listed) or bounded per §3's "State - anything you bounded" clause — and a bounded or gap-carrying sweep - returns a non-exhaustive outcome: reducing scope needs the - dispatcher's explicit say, and an every-instance claim with - unobserved members is false. The WRITE scope stays the owned - files/modules explicitly listed above: a generator discovered outside - that WRITE scope is reported for escalation, never edited on - discovery. + ran AND it adds a broadened or newly derived query (rerunning + yesterday's identical searches is empty by construction and counts + for nothing), with dedup against everything already surfaced; for a + behavioral target, no single pattern's zero hits ever prove + completeness. The packet lists the inventory (each surface and how it + was found) and the value family — closed only by its named canonical + source (the enum, config, or definition site, `file:line`) or by the + same discovery loop, else bounded per §3's "State anything you + bounded" clause — and a bounded or gap-carrying sweep returns a + non-exhaustive outcome: reducing scope needs the dispatcher's + explicit say, and an every-instance claim with unobserved members is + false. The WRITE scope stays the owned files/modules explicitly + listed above: a generator discovered outside that WRITE scope is + reported for escalation, never edited on discovery. + ✅ "inventory: 53 literal sites (reference search), the shared class + (style audit), the emitting helper (trace); tiers from the palette + enum at its definition site." ❌ "the inventory is the 53 grep hits — the shared utility never made the list." - **Invariant** — property to close and properties to preserve. - **Proof gate** — concrete check that would fail under the broken behavior; worker-chosen "tests pass" is not a gate. For an every-instance sweep whose target is behavior or rendered effect, the gate is the observed - effect at every inventoried generator surface and value tier (render - or run each); one observation may stand for a declared equivalence - class only when the shared path is verified branch-free for that - outcome (read the path — a stated "they share a helper" is a claim, - not evidence), and anything unobserved is reported unverified — never - folded into an exhaustive claim. Where the invariant is itself textual - (an exact forbidden spelling in a declared corpus), a correctly scoped - search over that corpus IS the gate. A zero-hit search on a behavioral - target is a report, not the gate: a clean grep proves one spelling is - gone, not that the defect is gone. + effect at every inventoried generator surface and value tier — render + or run each inside an authorized, side-effect-contained harness; an + outward effect you cannot safely drive (a payment, a send, a delete) + is reported unverified and escalated, never fired for the gate + (operational-rigor §2's gates govern). One observation may stand for + a declared equivalence class only when equivalence is verified across + the members' inputs, backing data, and downstream context — + branch-free control flow alone is not equivalence (a table lookup + differs per entry), and a stated "they share a helper" is a claim, + not evidence; anything unobserved is reported unverified — never + folded into an exhaustive claim. Where the invariant is itself + textual (an exact forbidden spelling; the declared corpus covers + every inventoried surface) AND no inventoried generator can emit the + target without that literal appearing, the correctly scoped search + over that corpus IS the gate — any emitting generator in the + inventory keeps the sweep on the effect gate. A zero-hit search on a + behavioral target is a report, not the gate: a clean grep proves one + spelling is gone, not that the defect is gone. ✅ "each literal's site re-rendered, the shared class's consumers re-rendered, every tier through the emitting helper — effect gone at each observation point." @@ -132,9 +146,10 @@ reviewers that they silently absorb as implementers. trust — then challenges its coverage with one differently-shaped query (a broader or structural pattern, or a class-aware check): re-running a narrow pattern reproduces its hits AND its misses. (A - find-and-fix-every-instance sweep's dispatch scope and acceptance gate - are §2's sweep fields; there, "a zero-hit search is a report, not the - gate.") + find-and-fix-every-instance sweep's dispatch scope and acceptance + gate are §2's sweep fields — acceptance is the effect at every + inventoried surface; there, for behavioral targets, "a zero-hit + search is a report, not the gate.") - **Machinery is not the user.** Tool completions, CI events, and agent statuses are state changes, not approval or proof. Open the artifact and verify. - **Auditing a completion claim** (an agent's or contractor's "done", a From a15c2863dcc8cf218824b41246f86567d5cbc311 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:53:54 +0800 Subject: [PATCH 28/66] skill-authoring: r3 rework of the grep-absence rule - outcome split, searched-file outlines, reviewer independence PR #51 round-3 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1-9,12,13). Adjudication: - outlines assembled from every file SEARCHED, not only hit files - all-empty greps no longer drop sibling outlines (grok F1 / codex F2) - S7-ladder paraphrase replaced with a pointer (grok F2) - duplicate-outcome split: in-target -> no addition; sibling-owned -> cross-reference, or S5's verbatim-carry with sync contract (codex F1, F4) - reviewer re-runs against the pre-addition text, proposed lines excluded - the rule no longer matches itself (codex F3) - reviewer reads a candidate chosen INDEPENDENTLY of the record - ends the exhaustive-list-vs-unnamed-candidate contradiction (codex F9) - search-term derivation glossed (codex F12); must-have-a-home cue tied to task-asserted coverage or relocation (grok n4); absence-path pos example with the forced phrase added (grok n3) - rejected with reason on the trail: codex F7 (whole-file compaction = pre-existing condition, owner-scheduled maintenance, not this diff); codex F8 (sibling sections verified by the gate-runner who read both files in full this session); codex F13 (a prospective standing rule for future additions is doctrine's normal function, not an instruction to this PR's gate); codex F10 already fixed (+46) - PR body dup-check record to be corrected to the exact forced phrase, actual headings, and the S2 section its substring hits touched (codex F5, F6) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 71 ++++++++++++++++++--------------- 1 file changed, 39 insertions(+), 32 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index e6922e3..6e02ed4 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -151,39 +151,46 @@ artifact-producing step. sibling instead. Each skill states **when NOT to use it** and which sibling to use. - **Keyword-grep absence is not absence** (`unprobed` — private incidents as - shape; see Provenance). The no-duplicate-homes rule above needs a - dup-check before adding any new fact or rule (wording-only and - provenance edits are out of scope), and an empty grep is not that - check: rules phrased differently from the search term repeatedly - produced false "not covered" verdicts (three in one week in the - contributor's private log; see Provenance) — one a proposed addition - whose content already sat in the target file under other wording, - caught only by reading the section at drafting time. The check: grep - the target file and its sibling skills (the skills shipped beside it — - list the parent skills directory, don't recall it, and include a - skill's references files when the topic plausibly lives there) for the - headword plus at least two synonyms (outcome words, opposite - operations, domain jargon); list the actual section headings of the - target and of every file a hit landed in; from that real outline — - never from memory — name the candidate homes (every section with a - hit, plus every section the fact would live in if it existed) and read - each in full before any verdict. A duplicate found → the parent rule - governs: cross-reference the sibling, never re-add. Otherwise the - change record — the PR description or commit message when one is - being created, otherwise the completion report — carries the result - line: the terms searched, the sections read, and "not found under the - searches and sections listed"; the addition's reviewer re-runs those - searches and opens at least one candidate the record did not name - (absence-sensitive compliance never rests on the author's own line — - §7's ladder). A bare "not covered" backed only by empty greps is the - failure this rule exists to stop; an outline with no plausible home - for a fact that must have one, or doubt that the candidate list is - complete → the placement is unresolved — escalate it, never assert - absence. + shape; see Provenance). About to add a new fact or rule, or to + conclude a file does not cover one (wording-only and provenance edits + are out of scope): an empty grep is not the dup-check the + no-duplicate-homes rule above needs — rules phrased differently from + the search term repeatedly produced false "not covered" verdicts + (three in one week in the contributor's private log; see Provenance), + one a proposed addition whose content already sat in the target file + under other wording, caught only by reading the section at drafting + time. The check: grep the target file and its sibling skills (the + skills shipped beside it — list the parent skills directory, don't + recall it, and include a skill's references files when the topic + plausibly lives there) for the concept's name plus at least two + alternates drawn from how the file might phrase it (the outcome it + produces, the operation's other names, its domain jargon); list the + actual section headings of the target AND of every file searched; + from that real outline — never from memory — name the candidate homes + (every section with a hit, plus every section the fact would live in + if it existed) and read each in full before any verdict. Duplicate + found in the target → no addition needed; owned by a sibling → + cross-reference it — or, where §5's clause-travels-with-the-trigger + rule applies, quote it verbatim with its sync contract — never a + silent second home. Otherwise the change record — the PR description + or commit message when one is being created, otherwise the completion + report — carries the result line: the terms searched, the sections + read, and "not found under the searches and sections listed". The + addition's reviewer re-runs those searches against the pre-addition + text (the proposed lines excluded) and reads at least one candidate + section chosen independently of the record (out-of-band check — §7's + enforcement ladder). A bare "not covered" backed only by empty greps + is the failure this rule exists to stop; no plausible home in the + outline for a fact the task says is covered or being relocated, or + doubt that the candidate list is complete → the placement is + unresolved — escalate it, never assert absence. ✅ "grep for 'revert', 'rollback', 'undo' across the playbook and its - two siblings returned nothing; read the playbook's 'State recovery' - and 'Cleanup' sections end to end — the rule exists under 'restore'; - the change record lists all three terms and both sections." + two siblings returned nothing; still read the playbook's 'State + recovery' and 'Cleanup' sections end to end — the rule exists under + 'restore'; the change record lists all three terms and both sections." + ✅ "searches and all four candidate sections empty — recorded 'not + found under the searches and sections listed: revert, rollback, undo; + State recovery, Cleanup' — then added the rule." ❌ "grep returned nothing, so the file doesn't cover it." - **A cross-reference is not a load** (`unprobed` in-house; external evidence — see Provenance). On weak tiers, discovering that a sibling From 164d1a2b4033a0c4ef7c32df5d8ba88811dcbd75 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:57:16 +0800 Subject: [PATCH 29/66] operational-rigor: r5 refinements to the scheduled-process rule and entry PR #49 round-5 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1,2,3,4,6,7). All reproduced and addressed: - loader-bullet gloss catalog gains the seventh entry it was missing on a line this PR touched (grok F1 / codex n5's first half); the reference Provenance count now reads 'the first six rules' (codex n5) - watch signals derive from destination-observed state or receipts, never a task-written ping (live task + dead write pings green); proven by withholding a destination effect while the task runs (codex F1) - enabling leaves scheduler binding an open claim until the first scheduler-originated fire lands attributed effects by its deadline (codex F2) - exclusive-writer freshness still needs a post-invocation state transition (codex F3) - SKILL.md pointer names the reference entry canonical on wording disagreement; the S2 authorization line points (grant + AUTH: for outward/irreversible steps) instead of restating (codex F4) - unhealthy response documented and authorized at arming time; safe default alert-only (codex F6) - load-verbs aligned with the trigger verbs, pos example 'every channel', dual dates explained in the reference Provenance (grok n2, n3, n4); PR body scope claim to be corrected (codex F7) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 12 +++--- .../references/external-systems.md | 39 ++++++++++++------- 2 files changed, 33 insertions(+), 18 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 3da1d86..67b0643 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -311,12 +311,13 @@ When rigor conflicts with finishing sooner, rigor wins. task was separately dead on a stale hardcoded credential the whole time. The arming and audit protocol is the scheduled-process entry in `references/external-systems.md` — load it before arming, enabling, - or auditing one. A green run history is evidence the runner reported + relying on, or reviewing one; on any wording disagreement, that entry + is canonical. A green run history is evidence the runner reported success, never that downstream received anything (the earlier exit-code line governs the immediate command you just ran; a schedule's downstream is this rule). - ✅ "loaded the reference, drove both channels emission-positive tied - to the test fire, dead-man alarm proven once — then enabled the + ✅ "loaded the reference, drove every channel emission-positive tied + to the test fire, destination watch proven once — then enabled the schedule." ❌ "the log shows 200/exit-0 every week, so it's working." - **Data-path integrity — fail loud on *unspecified* ambiguity, never emit a @@ -342,9 +343,10 @@ When rigor conflicts with finishing sooner, rigor wins. exits non-zero on success), success-latency tails (a timeout that aborts slow successes), three-state cache discipline (never cache an unvalidated empty), fallback-chain rot (a dead leg invisible until the primary fails), the - two-time-convention + calendar round-trip (Feb 30 normalizes silently), and + two-time-convention + calendar round-trip (Feb 30 normalizes silently), deploy-target contracts (serverless fire-and-forget after the response never - runs). + runs), and the scheduled-process protocol (a recurring schedule's green + history vs destination-attributed side effects). - **A clue about external data is a map, not a schema.** A field shape learned from docs, a blog, another repo's code, or memory tells you where to look, never what is there — sample the real shape on a real instance before writing a diff --git a/skills/operational-rigor/references/external-systems.md b/skills/operational-rigor/references/external-systems.md index 6121de0..786439e 100644 --- a/skills/operational-rigor/references/external-systems.md +++ b/skills/operational-rigor/references/external-systems.md @@ -120,8 +120,9 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. hardcoded credential — contributor-reported shape; see the skill's Provenance.) Gates first: every consequential invocation — the repeat run below included — carries its own per-invocation authorization - (destructive / spending / publishing / credential: operational-rigor - §2's confirmation gate and verbatim AUTH: artifact govern), and a + (destructive / spending / publishing / credential — operational-rigor + §2's confirmation gate governs: its per-invocation grant, plus its + AUTH: artifact for the outward or irreversible steps), and a schedule whose unattended fires are themselves consequential needs §2's project-policy-scoped standing authorization before running unattended; a request to arm covers the arming, not those future fires; a @@ -149,26 +150,36 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. "impossible" means scheduler-enforced non-concurrency, not short runtime. Armed means: every channel emission-positive-verified; no human cleared a prompt mid-run; overlap guarded or scheduler-excluded; - the watch below armed and its alarm proven once. Anything short stays - unarmed. Ongoing: a dead task cannot report its own death, and a + the watch below armed and proven once. Anything short stays unarmed — + and enabling is not the end: scheduler binding stays an open claim + until the first scheduler-originated fire lands its attributed + effects by its deadline (the watch's first cycle checks exactly + that). Ongoing: a dead task cannot report its own death, and a watcher that can die silently moves the problem one layer down — terminate the chain in a mechanism whose alarm fires on ABSENCE by construction (an externally enforced missed-deadline alert), outside the schedule's failure domain (scheduler, host, principal; where full independence is unavailable, the nearest different trigger path, with - the shared-fate residue named); key it to each channel's documented - emission condition and deadline; prove it once by skipping a ping. A - task-written health line shows the task ran, not that anything arrived; - stale, uncheckable, or a missed watch is unhealthy and gets the defined - response (alert, disarm, escalate), never a shrug. Reviewing an + the shared-fate residue named). Its signal derives from + destination-observed state or receipts, never from a ping the task + itself writes — a live task with a dead write step keeps pinging + green; key it to each channel's documented emission condition and + deadline, and prove it once by withholding a destination effect while + the task still runs. A task-written health line shows the task ran, + not that anything arrived; stale, uncheckable, or a missed watch is + unhealthy and gets the response documented and authorized at arming + time (absent one, the safe default is alert only — disarming or + escalating needs its own authorization), never a shrug. Reviewing an existing schedule without authorization to run it: inspect existing evidence asymmetrically — stale evidence can refute; fresh evidence - proves only when tied to an invocation or an established exclusive - writer; otherwise it stays unverified. + proves only when tied to the invocation under review (an established + exclusive writer narrows the author, not the run — its artifact still + needs a timestamp or state transition placing it after that + invocation); otherwise it stays unverified. ## Provenance -These six rules are the 2026-07-13 external-systems batch, mined from five +The first six rules are the 2026-07-13 external-systems batch, mined from five private production retiring-architect libraries (a link-shortener, a market dashboard, a Telegram bot, an engine-parity port, a learning lab), merged in opus-pack #26 and maintainer-fixed under cross-model review; two (cache @@ -184,7 +195,9 @@ error-cooldown cache state, typed advance-signal vs. valid empty, executed DST gap/fold cases, and the durable-handoff scope of "await side effects" — trail in `reviews/2026-07-16-post-merge-validation-pr25-29.md`. -The scheduled-process entry (2026-07-22) is the protocol body of the §4 +The scheduled-process entry (2026-07-22; one addition with its §4 rule, +which carries the contributor's 2026-07-21 date — the entry records its +placement during review) is the protocol body of the §4 scheduled-process rule added in opus-pack #49 — placed here per the 2026-07-14 split precedent (boundary-specific protocols out of the lean core); its incident provenance and `unprobed` marker live with that rule in From ababa7d623bb266f213105e76132d4df2940097d Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:59:46 +0800 Subject: [PATCH 30/66] delegation-and-review: r6 refinements - surface-scoped return checks, ref-sharing, audit-scratch carve-out PR #48 round-6 gate (grok-4.5 high: FIX 1,3; gpt-5.6-sol max: FIX 1-6). All reproduced and addressed: - already-reading wave with no pre-read baseline: void + settle + re-dispatch; no retroactive settling (codex F1) - copy-without-withhold is the provisional case too - prevention redefined as write-withheld on whatever surface is read, plus no third writer there (grok F1 / codex F2) - return checks re-scoped by read surface, removing the two-branch overlap where both conditions were simultaneously true (codex F3); 'Copy written' telegraphese replaced by explicit comparisons (grok F3) - linked worktrees share repository refs: write-capable waves need a fully independent copy (codex F4) - authorized scratch outputs of the review itself are not contamination - ends the audit-copy re-run/void loop (codex F5) - dimensions split: path-scoped content/index/untracked vs repository-wide HEAD/ref (codex F6) - terminal Done-when line added (grok n2); settle arms equal-ranked (grok n5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 73 ++++++++++++++++----------- 1 file changed, 43 insertions(+), 30 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index d95eaeb..f6dc8a7 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -93,39 +93,52 @@ reviewers that they silently absorb as implementers. requested end-state. Neither is §4's write-write clobber below (a subordinate overwriting concurrent edits): the first is a read verdict going stale mid-read, the second a "read-only" reviewer writing - anyway. (1) Settle in place and record the baseline: commit the - content under review on the reviewed branch and note the resulting - revision, or capture it restorably — working content, index state, - untracked files, HEAD/ref position — verifying the capture holds - everything under review; never stash away the very change the wave - reviews (a delivered tree under §3's completion-claim audit below is - settled by copying only — that rule forbids mutating it). (2) Choose - the read surface by what you can enforce: a full copy verified against - the baseline before dispatch (a worktree pinned at a revision omits - dirty content unless the capture is applied into it) — required - whenever the wave's write access cannot be withheld, or when any other - writer (a user, a hook, a sibling process) can touch the live tree - mid-read; the live tree only when your edits are frozen until return - AND the wave's write access is withheld AND no other writer can move - the reviewed paths ("read-only" is a claim, not a property). Neither - enforceable → the review runs labeled provisional; its verdict is - never a clean gate pass. (3) On return, compare every baseline - dimension (content, index, untracked, HEAD/ref). Copy written → - quarantine the copy for attribution (never delete it unexamined — the - motion may be another actor's work), void the verdict, make a fresh - verified copy from the settled tree, re-dispatch. Live reviewed paths - moved → the verdict is void; re-dispatch against a settled tree, - never re-attribute it to the baseline. Live tree moved while the wave - read a clean copy → the verdict describes the baseline only; the - moved paths and everything that depends on them are UNREVIEWED — - fresh-context re-review covers them, not the orchestrator's own - glance (the author is not the judge). Motion you did not make is - never proof the wave wrote — investigate ownership before restoring + anyway. A wave already reading with no pre-read baseline recorded + cannot be settled retroactively — treat its verdict as void, settle + now, re-dispatch. Otherwise: (1) settle in place and record the + baseline — either commit the content under review on the reviewed + branch and note the resulting revision, or capture it restorably + (working content, index state, and untracked files of the reviewed + paths, plus the repository's HEAD/ref position), verifying the + capture holds everything under review; never stash away the very + change the wave reviews (a delivered tree under §3's completion-claim + audit below is settled by copying only — that rule forbids mutating + it). (2) Choose the read surface by what you can enforce: a full copy + verified against the baseline before dispatch (a worktree pinned at a + revision omits dirty content unless the capture is applied into it, + and a linked worktree shares the repository's refs — a write-capable + wave needs a fully independent copy) — the copy is required whenever + any other writer (a user, a hook, a sibling process) can touch the + live tree mid-read; the live tree only when your edits are frozen + until return AND the wave's write access is withheld AND no other + writer can move the reviewed paths ("read-only" is a claim, not a + property). Write access not withholdable on whatever surface the wave + reads — the copy included → the review runs labeled provisional; its + verdict is never a clean gate pass. (3) On return, check by read + surface. The wave read a copy: compare the copy's reviewed paths + (content, index, untracked) and its repository refs against the + baseline — authorized scratch outputs of the review itself (caches, + artifacts of re-run checks) are not contamination; reviewed inputs or + refs moved → quarantine the copy for attribution (never delete it + unexamined — the motion may be another actor's work), void the + verdict, make a fresh verified copy from the settled tree, + re-dispatch; the copy held → the verdict binds the baseline, and live + paths that moved since dispatch (plus everything depending on them) + are UNREVIEWED — fresh-context re-review covers them, not the + orchestrator's own glance (the author is not the judge). The wave + read the live tree: any change to the reviewed paths' recorded + dimensions or to the repository's HEAD/ref — your own edits included + → the verdict is void; re-dispatch against a settled tree, never + re-attribute it to the baseline. Motion you did not make is never + proof the wave wrote — investigate ownership before restoring anything (§4's edit-conflict rule protects a concurrent editor's work). An endpoint match detects only persistent drift — a write-capable reader can mutate and restore without a trace; - prevention is the enforced copy, or the frozen tree with write - withheld and no third writer. + prevention is write withheld on whatever surface is read, plus no + third writer there. Done when: the baseline is recorded, the surface + matched what was enforceable, the return check ran, and the verdict + was applied only to the state it bound — else voided or labeled + provisional. ✅ "committed the slice, noted the revision, dispatched a verified copy with write withheld, kept editing the live tree; on return the copy's four dimensions matched — the verdict holds for the baseline, From d913732e18bc0fbc4a445132adf422a9e7e3e129 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:01:55 +0800 Subject: [PATCH 31/66] skill-authoring: r2 rework of the deployment-runtime rule - always-sweep, authoring-time ask, adoption block PR #52 round-2 gate (grok-4.5 high: FIX 1,2,3,4; gpt-5.6-sol max: FIX 1,2,3,4,5,7). All reproduced and addressed: - the sweep now runs on every review; naming is a conditional first step, not the trigger - an already-named target no longer skips the whole rule (grok F1 / codex F2) - the runtime ASK moved to authoring start per the file's own gate-placement rule; this review verifies it landed (codex F1) - no-answer path: user-must-provide recorded, sweep still runs, adoption blocked until the owner resolves or explicitly defers (grok F2 / codex F4) - review record defined via S7's change-record shape; target runtime defined as execution environment + governing connector/tool instance (grok F3 / codex F7) - machine-absolute paths get S2's VCS-root remedy - a label never keeps one (grok F4) - scope shrink can only exclude an OPTIONAL target with the user's explicit say; labeled incompatibility with the actual deployment target blocks (codex F3) - pos example made concrete and verifiable: named replacement, run on the target image, instance named (codex F5 / grok n5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 62 +++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 26 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 35a478f..61a5ecb 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -229,32 +229,42 @@ The sharpest usability probe is behavioral: give a fresh weaker-tier behavior down first, then patch the gaps the probe surfaces — not the ones you imagine. -**A skill or plugin is under review here and its target runtime(s) are -not yet named in the review record — name them before the review -concludes** (`unprobed` — private incident as shape; see Provenance). A -skill verified only on the author's machine can pass every lens above and -still be wrong where it will actually run: one reviewed-and-finalized -skill was reworked wholesale when its real target — a sandboxed Linux VM, -not the author's macOS — surfaced only after sign-off. Obtain the target -from the request or the user; when no answer is available, mark the -runtime `user-must-provide` and conclude without a portability verdict — -never default to the authoring host. Then sweep for assumptions that -silently bind the file to the author's machine: hard-coded -machine-absolute paths (§2's rule), OS-specific launchers and helpers -(URL-scheme opens, clipboard or notification tools), host identity (a -literal hostname or username), wall-clock or timezone assumptions (a -hard-coded TZ, a locale), and instance-specific tool identifiers — a -connector's tool prefix can be unique to the author's instance: keep a -verified portable name, or label the dependency with the runtime or -instance it requires; when no verified discovery mechanism or portable -form exists, that label is the honest outcome — never invent one. Done -when every named target runtime is compatible with every kept -assumption — a labeled incompatibility with a named target blocks -completion or explicitly shrinks the supported target scope — and -everything machine-bound carries its label. -✅ "target: sandboxed Linux VM; the notify helper is macOS-only — -replaced with a portable path; the connector prefix labeled -instance-specific." +**A skill or plugin is under this section's review — verify its +deployment runtime before the review concludes** (`unprobed` — private +incident as shape; see Provenance). A skill verified only on the +author's machine can pass every lens above and still be wrong where it +will actually run: one reviewed-and-finalized skill was reworked +wholesale when its real target — a sandboxed Linux VM, not the author's +macOS — surfaced only after sign-off. The target question belongs at +authoring start (§1's gate placement: ask before the first +artifact-producing step); this review verifies the answer landed and +the sweep ran. Confirm the review record — the same artifact as §7's +change record (the PR description or commit message, else the +completion report) — names the target runtime(s): the execution +environment (OS, container, sandbox) and any governing connector or +tool instance. Not named → obtain it from the request or the user; no +answer → write `user-must-provide` in the record, and adoption stays +blocked until the owner resolves or explicitly defers it. Named or +not, always run the sweep for assumptions that silently bind the file +to the author's machine: hard-coded machine-absolute paths get §2's +remedy (anchor to the VCS root — a label never keeps one); OS-specific +launchers and helpers (URL-scheme opens, clipboard or notification +tools), host identity (a literal hostname or username), wall-clock or +timezone assumptions (a hard-coded TZ, a locale), and +instance-specific tool identifiers (a connector's tool prefix can be +unique to the author's instance) each keep a verified portable form or +carry a label naming the exact runtime or instance required; when no +verified portable form exists, that named label is the honest outcome +— never an invented mechanism. Done when every named target runtime is +compatible with every kept assumption — a labeled incompatibility with +the actual deployment target blocks completion, and shrinking the +supported scope can only exclude an optional target with the user's +explicit say — and everything machine-bound carries its named label in +the record. +✅ "target: sandboxed Linux VM plus the team's shared connector +instance; the macOS-only notify helper replaced with the project's CLI +logger and run once on the target image; the connector prefix labeled +'requires the shared instance'." ❌ "labeled the launcher 'requires macOS' and concluded — while the named target is a Linux VM." From 7a2e355742a46a6a3c4ec2d3e9ed1f9f81ab5fc9 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:04:50 +0800 Subject: [PATCH 32/66] delegation-and-review: r5 de-escalation of the sweep fields - probes vs target, ledgered hunt, clean textual discriminator PR #50 round-5 gate (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1-6). All reproduced; the fix removes guarantee surfaces instead of adding conditions: - TARGET defined as the defect/effect, spellings demoted to probes; trigger gains task-phrasing synonyms (grok F1, F3) - generator hunt delegated to S3's miss-is-costly loop as written (axis-diverse finders, dedup, stop rule) instead of restating a two-axis floor with its own round semantics (codex F1 / grok F3) - per-round query/result ledger (empty rounds included) carried in the packet; seed inventory + worker-continues resolves the packet- closure-vs-delegation tension (codex F5 / grok r5 n6) - value-family closure needs a verified-finite source; extensible registries/configs are never closed (codex F2) - gate covers declared variation axes where the outcome can differ; untested combinations reported unobserved (codex F3) - textual branch rewritten to a single discriminator (string-absence IS the invariant; nothing produces the outcome without the exact spelling) - removes the self-contradicting emitting-generator clause (codex F4 / grok F1) - S3 pointer reduced to a pure pointer, no acceptance restatement (grok F2); unprobed marker added on the proof-gate half (grok n5); 53-file unit drift fixed in both examples (codex F6) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 80 +++++++++++++-------------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 26c20be..1827a42 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -33,44 +33,48 @@ Every packet names: - **Goal + motivation** — what and why. - **Owned scope + explicit non-scope** — files/modules it may and may not touch. - For a find-and-fix-every-instance sweep, scope splits in two - (`unprobed` — private incident as shape; see Provenance): the SEARCH - scope is every surface that can generate the target — literals and - direct references, shared/global definitions, helpers that construct - or return it. Build the inventory from the target's forms (symbol, - string, or emit site) AND from at least one axis that never matches - its spelling — the shared definitions and constructors that produce - that kind of output (a 53-file styling sweep missed its defect in a - shared utility class the token grep never matched, and each review - round surfaced another category the prior round's pattern - structurally excluded). The inventory closes per §3's miss-is-costly - loop, verbatim: "Stop only after two consecutive empty rounds; one - clean round is not convergence" — a round counts only when every axis - ran AND it adds a broadened or newly derived query (rerunning - yesterday's identical searches is empty by construction and counts - for nothing), with dedup against everything already surfaced; for a - behavioral target, no single pattern's zero hits ever prove - completeness. The packet lists the inventory (each surface and how it - was found) and the value family — closed only by its named canonical - source (the enum, config, or definition site, `file:line`) or by the - same discovery loop, else bounded per §3's "State anything you - bounded" clause — and a bounded or gap-carrying sweep returns a + For a find-and-fix-every-instance sweep — a "purge every X", "replace + all Y", "no instance of Z survives" task — scope splits in two + (`unprobed` — private incident as shape; see Provenance). The TARGET + is the defect or effect to eliminate, never the first search string — + a spelling is a probe. The SEARCH scope is every surface that can + produce that target: literals and direct references, shared/global + definitions, helpers that construct or return it. Hunt generators + per §3's miss-is-costly loop (its axis-diverse finders, dedup, and + two-consecutive-empty-rounds stop rule apply as written there), with + the spelling-based probes as only some of the axes — the effect-side + axes (what shared definitions and constructors can produce this kind + of output) never match the spelling at all; a 53-file styling sweep + missed its defect in a shared utility class the token grep never + matched, and each review round surfaced another category the prior + round's pattern structurally excluded. The packet carries the seed + inventory, the hunt method, and a per-round ledger duty (each round's + queries and results, empty ones included — the worker continues the + loop to closure); it also names the value family (the tiers/variants + the target ranges over), closed only by a verified-finite source (a + sealed enum read at its `file:line` — an extensible registry or + config is never closed), else bounded per §3's "State anything you + bounded" clause. A bounded or gap-carrying sweep returns a non-exhaustive outcome: reducing scope needs the dispatcher's explicit say, and an every-instance claim with unobserved members is false. The WRITE scope stays the owned files/modules explicitly listed above: a generator discovered outside that WRITE scope is reported for escalation, never edited on discovery. - ✅ "inventory: 53 literal sites (reference search), the shared class - (style audit), the emitting helper (trace); tiers from the palette - enum at its definition site." - ❌ "the inventory is the 53 grep hits — the shared utility never made + ✅ "seed inventory: the 53-file hit list (reference search), the + shared class (style audit), the emitting helper (trace); tiers from + the sealed palette enum at its definition site; round ledger in the + packet." + ❌ "the inventory is the grep hit list — the shared utility never made the list." - **Invariant** — property to close and properties to preserve. - **Proof gate** — concrete check that would fail under the broken behavior; worker-chosen "tests pass" is not a gate. For an every-instance sweep - whose target is behavior or rendered effect, the gate is the observed - effect at every inventoried generator surface and value tier — render - or run each inside an authorized, side-effect-contained harness; an + whose target is behavior or rendered effect (`unprobed` — same + provenance as the sweep-scope field above), the gate is the observed + effect at every inventoried generator surface, across each declared + variation axis where the outcome can differ (tier, theme, locale — + untested combinations are unobserved, reported as such) — render or + run each inside an authorized, side-effect-contained harness; an outward effect you cannot safely drive (a payment, a send, a delete) is reported unverified and escalated, never fired for the gate (operational-rigor §2's gates govern). One observation may stand for @@ -79,14 +83,12 @@ Every packet names: branch-free control flow alone is not equivalence (a table lookup differs per entry), and a stated "they share a helper" is a claim, not evidence; anything unobserved is reported unverified — never - folded into an exhaustive claim. Where the invariant is itself - textual (an exact forbidden spelling; the declared corpus covers - every inventoried surface) AND no inventoried generator can emit the - target without that literal appearing, the correctly scoped search - over that corpus IS the gate — any emitting generator in the - inventory keeps the sweep on the effect gate. A zero-hit search on a - behavioral target is a report, not the gate: a clean grep proves one - spelling is gone, not that the defect is gone. + folded into an exhaustive claim. Only when the invariant is literally + the string's absence — nothing at runtime produces the outcome + without that exact spelling — is the correctly scoped search over the + declared corpus itself the gate. A zero-hit search on a behavioral + target is a report, not the gate: a clean grep proves one spelling is + gone, not that the defect is gone. ✅ "each literal's site re-rendered, the shared class's consumers re-rendered, every tier through the emitting helper — effect gone at each observation point." @@ -147,9 +149,7 @@ reviewers that they silently absorb as implementers. broader or structural pattern, or a class-aware check): re-running a narrow pattern reproduces its hits AND its misses. (A find-and-fix-every-instance sweep's dispatch scope and acceptance - gate are §2's sweep fields — acceptance is the effect at every - inventoried surface; there, for behavioral targets, "a zero-hit - search is a report, not the gate.") + gate are §2's sweep fields.) - **Machinery is not the user.** Tool completions, CI events, and agent statuses are state changes, not approval or proof. Open the artifact and verify. - **Auditing a completion claim** (an agent's or contractor's "done", a From 5be9963362c3fd4c2ebd3fe98edbbe98e516eb82 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:07:42 +0800 Subject: [PATCH 33/66] skill-authoring: r4 refinements to the grep-absence rule PR #51 round-4 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1,2,3,4,5,7,8). Adjudication: - empty searches -> read the WHOLE target file before any verdict; the incident's catch was the read (codex F1) - duplicate-outcome rewritten: no second home wherever it lives, with the 'A cross-reference is not a load' rule cited by its real title and applying to both ownership branches (codex F2 / grok n3) - standalone not-covered verdicts stay provisional until an out-of-band read; landing additions get the S6 fresh-context reviewer re-run (codex F3 / grok n2) - result line carries terms + files + file-qualified sections (codex F5); router-file and headingless fallbacks defined (codex F7) - references-files quantifier fixed to each searched skill (grok n4); 'never assert absence' scoped to its conditions (grok n5); second neg example pins the multi-synonym-empty-but-never-read boundary (grok F1) - rejected with reason, standing dispositions: codex F4 (nine-file packet inlining infeasible; gate-runner read all nine skills in full this session), codex F8 (prospective reviewer doctrine is the file's normal function - same shape as delegation-and-review S3's merged 'reviewer re-runs the named search' rule) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 58 +++++++++++++++++++-------------- 1 file changed, 34 insertions(+), 24 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 6e02ed4..5b44f44 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -161,37 +161,47 @@ artifact-producing step. under other wording, caught only by reading the section at drafting time. The check: grep the target file and its sibling skills (the skills shipped beside it — list the parent skills directory, don't - recall it, and include a skill's references files when the topic - plausibly lives there) for the concept's name plus at least two - alternates drawn from how the file might phrase it (the outcome it - produces, the operation's other names, its domain jargon); list the - actual section headings of the target AND of every file searched; - from that real outline — never from memory — name the candidate homes - (every section with a hit, plus every section the fact would live in - if it existed) and read each in full before any verdict. Duplicate - found in the target → no addition needed; owned by a sibling → - cross-reference it — or, where §5's clause-travels-with-the-trigger - rule applies, quote it verbatim with its sync contract — never a - silent second home. Otherwise the change record — the PR description - or commit message when one is being created, otherwise the completion - report — carries the result line: the terms searched, the sections - read, and "not found under the searches and sections listed". The - addition's reviewer re-runs those searches against the pre-addition - text (the proposed lines excluded) and reads at least one candidate - section chosen independently of the record (out-of-band check — §7's - enforcement ladder). A bare "not covered" backed only by empty greps - is the failure this rule exists to stop; no plausible home in the - outline for a fact the task says is covered or being relocated, or - doubt that the candidate list is complete → the placement is - unresolved — escalate it, never assert absence. + recall it, and include each searched skill's references files when + the topic plausibly lives there; a router file like CLAUDE.md has no + siblings — its "siblings" are the files it points into, and a + headingless file is read in full) for the concept's name plus at + least two alternates drawn from how the file might phrase it (the + outcome it produces, the operation's other names, its domain jargon); + list the actual section headings of the target AND of every file + searched; from that real outline — never from memory — name the + candidate homes (every section with a hit, plus every section the + fact would live in if it existed) and read each in full before any + verdict — and when every search came back empty, read the whole + target file before concluding anything (the incident's catch was the + read, not the grep). Duplicate found → no second home, wherever it + lives: in the target, no addition; in a sibling, cross-reference it — + in either case the "A cross-reference is not a load" rule below still + applies as written (a cannot-miss clause is quoted verbatim at its + trigger site with the sync contract naming the winner). Otherwise the + change record — the PR description or commit message when one is + being created, otherwise the completion report — carries the result + line: the terms searched, the files searched, the file-qualified + sections read, and "not found under the searches and sections + listed". For a landing addition, the fresh-context reviewer (§6) + re-runs those searches against the pre-addition text and reads at + least one candidate section of their own choosing; a standalone + not-covered verdict with no reviewer stays provisional in the report + until an out-of-band read confirms it (§7's enforcement ladder). A + bare "not covered" backed only by empty greps is the failure this + rule exists to stop; no plausible home in the outline for a fact the + task says is covered or being relocated, or doubt that the candidate + list is complete → the placement is unresolved — escalate it, and + under those conditions never assert absence. ✅ "grep for 'revert', 'rollback', 'undo' across the playbook and its two siblings returned nothing; still read the playbook's 'State recovery' and 'Cleanup' sections end to end — the rule exists under 'restore'; the change record lists all three terms and both sections." ✅ "searches and all four candidate sections empty — recorded 'not found under the searches and sections listed: revert, rollback, undo; - State recovery, Cleanup' — then added the rule." + playbook §State recovery, playbook §Cleanup' — then added the rule." ❌ "grep returned nothing, so the file doesn't cover it." + ❌ "three synonyms, all empty — not covered" (no section was ever + read). - **A cross-reference is not a load** (`unprobed` in-house; external evidence — see Provenance). On weak tiers, discovering that a sibling skill applies is a judgment act: fable-method published a smoke-grade From a9c31ee4153c6be1488add488fe829f8cecbfdb0 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:10:58 +0800 Subject: [PATCH 34/66] delegation-and-review: rework the port-contention bullet per r1 dual review PR #53 round-1 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1,2,3). All reproduced and addressed: - auto-port fallback named as the displacement mechanism, never the repair; defense = unique fixed port propagated to every session-local reference OR fail-loud strict port (grok F1 / codex F1) - verify step made observable: endpoint-identity check via a session-unique marker in the response, with a done condition and a mismatch action that never kills the sibling's server (grok F2 / codex F2) - trigger scoped to sibling-owned servers sharing a port namespace and configured port; intentionally shared local services carved out (codex F3); pos example added, auto-port glossed via the either-arm defense (grok n3) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 34 +++++++++++++++++++-------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 0bc7ed2..4c0e72a 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -23,16 +23,30 @@ treat every returned result as a claim until verified. slices only need to stay within review capacity. Parallel writers get isolated worktrees. - **Isolated trees do not isolate ports** (`unprobed` — private incident as - shape; see Provenance). Sibling sessions contend for the same configured - dev-server port; once auto-port-fallback moves yours, any hardcoded - `localhost:` proxy or target elsewhere in the app's config now - silently reaches ANOTHER session's server — the page loads blank or shows - the wrong build while every request returns 200, which reads as a bug in - your own change. In a worktree fan-out: enable auto-port assignment from - the start, verify against the port you were ACTUALLY assigned, and when a - fanned-out preview misbehaves with all-green requests, check cross-port - references before debugging your own code — stopping your preview cannot - stop a sibling's server, so the wrong upstream stays up. + shape; see Provenance). When sibling sessions run servers sharing a + port namespace and a configured port, they contend for it; once one is + displaced (auto-port fallback, a restart elsewhere), any reference + meant for THAT session's server — a `localhost:` proxy, target, + or env entry — still aims at the configured port and now silently + reaches the sibling's server: the page loads blank or shows the wrong + build while every request returns 200, which reads as a bug in your + own change. Defense, either arm: give each worktree a unique fixed + port AND propagate it to every session-local reference (proxy, env, + browser entry), or run fail-loud (strict port, no fallback) so a + collision stops the server instead of silently rerouting — auto-port + fallback alone is the displacement mechanism, never the repair. Done + when an endpoint-identity check passes: the preview response carries + this session's own marker (a build id, the worktree name), not just + any 200. On mismatch, fix this session's references — never kill the + sibling's server (it is another session's work). When a fanned-out + preview misbehaves with all-green requests, check cross-port + references before debugging your own code — stopping your preview + cannot stop a sibling's server, so the wrong upstream stays up. A + reference to an intentionally shared local service (one database for + all worktrees) is not a cross-port defect; the rule covers references + meant for the displaced session-owned server. + ✅ "each worktree pinned to its own port, proxy and env updated; the + preview page shows this worktree's build id." ❌ "every request is 200, so the proxy target must be my server." - Route by task: mechanical clear-spec work → cheapest capable model; user-facing output → high-taste model; reviews and hard debugging → strongest available. From 041b8531df82f5a3d0d50310d94f553be377bd45 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:13:12 +0800 Subject: [PATCH 35/66] skill-authoring: r3 refinements to the deployment-runtime rule PR #52 round-3 gate (grok-4.5 high: FIX 1-5; gpt-5.6-sol max: FIX 1-8). All reproduced and addressed: - unknown-target semantics: requester supplies or records explicit risk-acceptance deferral; silence is neither; empty target list never satisfies Done vacuously (grok F1-analog / codex F1) - named-target attribution: obtained from the requester, not author-inferred presence of a string (grok r3 F1) - runtime-agnostic recorded outcome for doctrine-only files (grok F4) - compatibility judged per target over assumptions REACHABLE on it; verified target-scoped dispatch branches count compatible (codex F2) - S2 path remedy quoted verbatim incl. prefix verification, scoped to accidentally machine-local repo paths; target-defined absolute paths are ordinary machine-bound assumptions (codex F3, F6 / grok F2-analog) - S7 record-selection clause quoted verbatim (codex F7) - labels live IN the skill file beside the dependency, verified where reachable, marked unverified where not - a label records a limitation, never proves compatibility (codex F4, F8) - review-cannot-retro-place-the-ask stated; S6 is the blocking backstop, not a time machine (codex F5); target-image run dropped from the pos example (grok F3-analog) - optional-vs-required target pinned to the requester's explicit say (grok F5-analog) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 54 ++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 21 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 61a5ecb..2d3a436 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -237,34 +237,46 @@ will actually run: one reviewed-and-finalized skill was reworked wholesale when its real target — a sandboxed Linux VM, not the author's macOS — surfaced only after sign-off. The target question belongs at authoring start (§1's gate placement: ask before the first -artifact-producing step); this review verifies the answer landed and -the sweep ran. Confirm the review record — the same artifact as §7's -change record (the PR description or commit message, else the -completion report) — names the target runtime(s): the execution -environment (OS, container, sandbox) and any governing connector or -tool instance. Not named → obtain it from the request or the user; no -answer → write `user-must-provide` in the record, and adoption stays -blocked until the owner resolves or explicitly defers it. Named or +artifact-producing step); this review cannot retro-place that ask — it +verifies the answer exists and blocks adoption when it does not. +Confirm the review record — the same artifact as §7's change record, +verbatim: "the PR description or commit message when one is being +created, otherwise the completion report" — names the target +runtime(s): the execution environment (OS, container, sandbox) and any +governing connector or tool instance; a sweep that finds nothing +machine-bound may record `runtime-agnostic` as the named outcome. Not +named → obtain it from the requester; no answer → write +`user-must-provide` in the record, and adoption stays blocked until +the requester either supplies the target or records an explicit +risk-acceptance deferral — silence is neither, and an empty target +list never satisfies the compatibility check below vacuously. Named or not, always run the sweep for assumptions that silently bind the file -to the author's machine: hard-coded machine-absolute paths get §2's -remedy (anchor to the VCS root — a label never keeps one); OS-specific +to the author's machine: an accidentally machine-local repository path +gets §2's remedy, verbatim ("Anchor to the VCS root (`git rev-parse +--show-toplevel`) and verify the path prefix before reading"), while +an absolute path the target itself defines (a socket, device, or +mount) is a machine-bound assumption like the rest; OS-specific launchers and helpers (URL-scheme opens, clipboard or notification tools), host identity (a literal hostname or username), wall-clock or timezone assumptions (a hard-coded TZ, a locale), and instance-specific tool identifiers (a connector's tool prefix can be -unique to the author's instance) each keep a verified portable form or -carry a label naming the exact runtime or instance required; when no -verified portable form exists, that named label is the honest outcome -— never an invented mechanism. Done when every named target runtime is -compatible with every kept assumption — a labeled incompatibility with -the actual deployment target blocks completion, and shrinking the -supported scope can only exclude an optional target with the user's -explicit say — and everything machine-bound carries its named label in -the record. +unique to the author's instance) each keep a verified portable form, +or stay behind a verified target-scoped dispatch (an OS-conditional +branch counts as compatible with targets that never reach it), or +carry a label naming the exact runtime or instance required — written +IN the skill file beside the dependency (§2's embed-the-knowledge; the +review record points to it), verified against that instance where +reachable and marked `unverified` (§2) where not: a label records a +limitation, never proves compatibility. Done when every named target +runtime is compatible with every assumption reachable on it — a +labeled incompatibility with the actual deployment target blocks +completion, and shrinking the supported scope can only exclude an +optional target with the requester's explicit say — and everything +machine-bound carries its named label in the file. ✅ "target: sandboxed Linux VM plus the team's shared connector instance; the macOS-only notify helper replaced with the project's CLI -logger and run once on the target image; the connector prefix labeled -'requires the shared instance'." +logger; the connector prefix labeled in-file 'requires the shared +instance' and resolved against it." ❌ "labeled the launcher 'requires macOS' and concluded — while the named target is a Linux VM." From d6769fdc0164a9e84f70e05730491589057f8a93 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:15:15 +0800 Subject: [PATCH 36/66] operational-rigor: r6 refinements to the scheduled-process rule and entry PR #49 round-6 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1,2,3,4,5,7,8). All reproduced and addressed: - channel INVENTORY step added: trace the invoked task's config/code/ runbook into destinations, conditions, deadlines, credentials - the scheduler entry names the script, not the channels; incident's second channel correctly re-attributed to the stale hardcoded credential in task config, session-credential trap kept as a labeled related trap (codex F1 / grok F1) - attribution strengthened: invocation identifier where supported, else before/after + no-other-eligible-invocation-in-window (codex F2) - conditional channels in the ongoing alarm need an independent condition signal or positive canary, else explicitly unverified (codex F3) - trigger-site lead now carries 'attributed to the invocation' (codex F4); watch/alarm terms split: scheduler-binding observation vs absence alarm; SKILL.md pos example names authorized fires and the alarm (grok F2, n4) - consequential outbound channels fire in separately authorized runs, never batched (codex F5) - alarm-prove suppression is its own consequential action: synthetic destination or separately authorized suppression, re-drive emission-positive after the fault (codex F7 / grok n5) - alert channel's standing authorization is an arming prerequisite; without it the alarm is unarmed and the gap is the report (codex F8) - unprobed pointer added to the standalone reference entry (grok n3); codex n6 (checks.py packet-unverifiable) standing disposition Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 10 +- .../references/external-systems.md | 107 +++++++++++------- 2 files changed, 68 insertions(+), 49 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 67b0643..bdd9cf2 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -304,8 +304,9 @@ When rigor conflicts with finishing sooner, rigor wins. verification as skipped. - **Arming, enabling, relying on, or reviewing a recurring scheduled process → its side effects are unverified until checked at their - destinations; the process's own "completed" report is not that - evidence** (`unprobed` — private incident as shape; see Provenance). A + destinations, attributed to the invocation; the process's own + "completed" report is not that evidence** (`unprobed` — private + incident as shape; see Provenance). A weekly task reported success for roughly three months while its write step silently never executed, and a second output channel on the same task was separately dead on a stale hardcoded credential the whole @@ -316,9 +317,8 @@ When rigor conflicts with finishing sooner, rigor wins. success, never that downstream received anything (the earlier exit-code line governs the immediate command you just ran; a schedule's downstream is this rule). - ✅ "loaded the reference, drove every channel emission-positive tied - to the test fire, destination watch proven once — then enabled the - schedule." + ✅ "authorized the fires; drove every channel emission-positive tied + to them; absence alarm proven once — then enabled the schedule." ❌ "the log shows 200/exit-0 every week, so it's working." - **Data-path integrity — fail loud on *unspecified* ambiguity, never emit a silently-wrong value.** Honor an explicit, documented contract (a declared diff --git a/skills/operational-rigor/references/external-systems.md b/skills/operational-rigor/references/external-systems.md index 786439e..ef9c105 100644 --- a/skills/operational-rigor/references/external-systems.md +++ b/skills/operational-rigor/references/external-systems.md @@ -114,11 +114,12 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. - **A recurring schedule's own "completed" report is not evidence its side effects landed — verify at the destinations, attributed to the - invocation.** (Motivating incident: a weekly task reported success for - roughly three months while its write step silently never executed; a - second output channel on the same task was separately dead on a stale - hardcoded credential — contributor-reported shape; see the skill's - Provenance.) Gates first: every consequential invocation — the repeat + invocation** (`unprobed` — see the skill's Provenance). (Motivating + incident: a weekly task reported success for roughly three months + while its write step silently never executed; a second output channel + on the same task was separately dead on a stale hardcoded credential — + contributor-reported shape.) Gates first: every consequential + invocation — the repeat run below included — carries its own per-invocation authorization (destructive / spending / publishing / credential — operational-rigor §2's confirmation gate governs: its per-invocation grant, plus its @@ -131,45 +132,63 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. minting or broadening one is itself gated; session-only credentials do not travel to headless runs. Drive and attribute: read the configured entry (command, arguments, trigger, enabled/disabled state) and confirm - it invokes what you test; recurrence stays disabled while arming — fire - the entry once yourself, headless, under the schedule's execution - context, meaning principal AND environment AND working directory - (running interactively as the right user can carry a session credential - the real schedule lacks — the incident's dead channel); "watch one real - fire" establishes scheduler binding only on an already-enabled schedule - you hold observation authority over. Verify each channel with its - emission condition driven TRUE at least once: run-tied destination - evidence (a before/after state, a run-correlated receipt; a fresh - artifact another writer could have produced proves nothing; an async - 2xx acceptance is not delivery) — a condition-matched absence verifies - only the suppression branch, never the channel. Repeat the run (its own - grant if consequential) against stated existing-output and lock - expectations; a hung run overlaps the next fire regardless of average - runtime, so where overlap is possible the second entry must traverse - the real lock-acquisition path while the first holds the guard — - "impossible" means scheduler-enforced non-concurrency, not short - runtime. Armed means: every channel emission-positive-verified; no - human cleared a prompt mid-run; overlap guarded or scheduler-excluded; - the watch below armed and proven once. Anything short stays unarmed — - and enabling is not the end: scheduler binding stays an open claim - until the first scheduler-originated fire lands its attributed - effects by its deadline (the watch's first cycle checks exactly - that). Ongoing: a dead task cannot report its own death, and a - watcher that can die silently moves the problem one layer down — - terminate the chain in a mechanism whose alarm fires on ABSENCE by - construction (an externally enforced missed-deadline alert), outside - the schedule's failure domain (scheduler, host, principal; where full - independence is unavailable, the nearest different trigger path, with - the shared-fate residue named). Its signal derives from - destination-observed state or receipts, never from a ping the task - itself writes — a live task with a dead write step keeps pinging - green; key it to each channel's documented emission condition and - deadline, and prove it once by withholding a destination effect while - the task still runs. A task-written health line shows the task ran, - not that anything arrived; stale, uncheckable, or a missed watch is - unhealthy and gets the response documented and authorized at arming - time (absent one, the safe default is alert only — disarming or - escalating needs its own authorization), never a shrug. Reviewing an + it invokes what you test, then trace the invoked task's own config, + code, or runbook into a channel inventory — each destination, emission + condition, deadline, and credential; the scheduler entry names the + script, not the channels, and the incident's second channel (with its + stale hardcoded credential) lived in the task's own config. Recurrence + stays disabled while arming — fire the entry once yourself, headless, + under the schedule's execution context, meaning principal AND + environment AND working directory (running interactively as the right + user can carry a session credential the real schedule lacks — a + related trap, distinct from the incident's); "watch one real fire" + establishes scheduler binding only on an already-enabled schedule you + hold observation authority over. Verify each inventoried channel with + its emission condition driven TRUE at least once: destination evidence + carrying that invocation's identifier where the channel supports one, + else a before/after transition plus confirmation that no other + eligible invocation ran in the window (a fresh artifact another writer + or run could have produced proves nothing; an async 2xx acceptance is + not delivery) — a condition-matched absence verifies only the + suppression branch, never the channel. Consequential outbound channels + are driven in separately authorized fires, never batched (§2's + one-at-a-time rule). Repeat the run (its own grant if consequential) + against stated existing-output and lock expectations; a hung run + overlaps the next fire regardless of average runtime, so where overlap + is possible the second entry must traverse the real lock-acquisition + path while the first holds the guard — "impossible" means + scheduler-enforced non-concurrency, not short runtime. Armed means: + every inventoried channel emission-positive-verified; no human cleared + a prompt mid-run; overlap guarded or scheduler-excluded; the absence + alarm below armed, its firing proven once, and its alert channel's + standing authorization in place (no authorized alert path → the alarm + is unarmed and that gap is the report; no automated outward action + invents itself). Anything short stays unarmed — and enabling is not + the end: scheduler binding stays an open claim until the first + scheduler-originated fire lands its attributed effects by its deadline + (the alarm's first cycle checks exactly that). Ongoing: a dead task + cannot report its own death, and a watcher that can die silently moves + the problem one layer down — terminate the chain in a mechanism whose + alarm fires on ABSENCE by construction (an externally enforced + missed-deadline alert), outside the schedule's failure domain + (scheduler, host, principal; where full independence is unavailable, + the nearest different trigger path, with the shared-fate residue + named). Its signal derives from destination-observed state or + receipts, never from a ping the task itself writes — a live task with + a dead write step keeps pinging green; key it to each channel's + documented emission condition and deadline, and a conditional channel + needs an independently observed condition signal or a periodic + positive canary, else it stays explicitly unverified in the alarm's + coverage. Prove the alarm once by withholding a destination effect + while the task runs — the suppression is its own consequential + action: use a synthetic or test destination where one exists, a + separately authorized suppression where not, and re-drive the channel + emission-positive after the fault. A task-written health line shows + the task ran, not that anything arrived; stale, uncheckable, or a + missed check is unhealthy and gets the response documented and + authorized at arming time — disarming or escalating needs its own + authorization, and with no authorized response the gap itself is the + report, never a shrug. Reviewing an existing schedule without authorization to run it: inspect existing evidence asymmetrically — stale evidence can refute; fresh evidence proves only when tied to the invocation under review (an established From 1cf991cb291e9a8e2d052fcfbf5624520915e6c3 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:18:00 +0800 Subject: [PATCH 37/66] delegation-and-review: r7 rework - defined terms end the referent drift PR #48 round-7 gate (grok-4.5 high: FIX 1,3 + prior; gpt-5.6-sol max: FIX 1-9). All reproduced or dispositioned: - Definitions block pins PROTECTED READ SET (reviewed paths + declared read scope), BASELINE REFS (HEAD + reviewed branch at dispatch), WITHHELD (harness-enforced, not prompt-asked), and predeclared scratch - used consistently in both surfaces' conditions and return checks (codex F2, F3, F8 / grok r7 F1, n4) - commit arm gated on the requested end-state permitting a commit; unchanged-history/uncommitted end-states take the capture (codex F1) - one independent copy per write-capable critic, or serialize (codex F4) - S4 cross-ref rewritten to the canonical restore mechanism (codex F5) - enforcement-unavailable exit defined: independent copy + return check = working standard with recorded mutate-restore caveat; live-without-enforcement = provisional (grok r7 F2) - pos examples carry withhold + third-writer + per-critic copies; Done-when maps each outcome explicitly (codex F6) - codex F7 already-fixed pre-verdict (body updated to +80 before the packet build lagged it); body authority phrasings neutralized and the self-check's S4 characterization corrected (codex F9, F5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 115 ++++++++++++++------------ 1 file changed, 61 insertions(+), 54 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index f6dc8a7..be02c09 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -90,62 +90,69 @@ reviewers that they silently absorb as implementers. file the orchestrator had already fixed mid-review and voted REFUTED on a bug already confirmed elsewhere; a separate critic committed the very worktree it was reviewing, moving the tree out from under the - requested end-state. Neither is §4's write-write clobber below (a - subordinate overwriting concurrent edits): the first is a read verdict - going stale mid-read, the second a "read-only" reviewer writing + requested end-state. Neither is §4's silent-clobber below — that one + is a sandbox restoring out-of-scope files on exit; these are a read + verdict going stale mid-read, and a "read-only" reviewer writing anyway. A wave already reading with no pre-read baseline recorded cannot be settled retroactively — treat its verdict as void, settle - now, re-dispatch. Otherwise: (1) settle in place and record the - baseline — either commit the content under review on the reviewed - branch and note the resulting revision, or capture it restorably - (working content, index state, and untracked files of the reviewed - paths, plus the repository's HEAD/ref position), verifying the - capture holds everything under review; never stash away the very - change the wave reviews (a delivered tree under §3's completion-claim - audit below is settled by copying only — that rule forbids mutating - it). (2) Choose the read surface by what you can enforce: a full copy - verified against the baseline before dispatch (a worktree pinned at a - revision omits dirty content unless the capture is applied into it, - and a linked worktree shares the repository's refs — a write-capable - wave needs a fully independent copy) — the copy is required whenever - any other writer (a user, a hook, a sibling process) can touch the - live tree mid-read; the live tree only when your edits are frozen - until return AND the wave's write access is withheld AND no other - writer can move the reviewed paths ("read-only" is a claim, not a - property). Write access not withholdable on whatever surface the wave - reads — the copy included → the review runs labeled provisional; its - verdict is never a clean gate pass. (3) On return, check by read - surface. The wave read a copy: compare the copy's reviewed paths - (content, index, untracked) and its repository refs against the - baseline — authorized scratch outputs of the review itself (caches, - artifacts of re-run checks) are not contamination; reviewed inputs or - refs moved → quarantine the copy for attribution (never delete it - unexamined — the motion may be another actor's work), void the - verdict, make a fresh verified copy from the settled tree, - re-dispatch; the copy held → the verdict binds the baseline, and live - paths that moved since dispatch (plus everything depending on them) - are UNREVIEWED — fresh-context re-review covers them, not the - orchestrator's own glance (the author is not the judge). The wave - read the live tree: any change to the reviewed paths' recorded - dimensions or to the repository's HEAD/ref — your own edits included - → the verdict is void; re-dispatch against a settled tree, never - re-attribute it to the baseline. Motion you did not make is never - proof the wave wrote — investigate ownership before restoring - anything (§4's edit-conflict rule protects a concurrent editor's - work). An endpoint match detects only persistent drift — a - write-capable reader can mutate and restore without a trace; - prevention is write withheld on whatever surface is read, plus no - third writer there. Done when: the baseline is recorded, the surface - matched what was enforceable, the return check ran, and the verdict - was applied only to the state it bound — else voided or labeled - provisional. - ✅ "committed the slice, noted the revision, dispatched a verified - copy with write withheld, kept editing the live tree; on return the - copy's four dimensions matched — the verdict holds for the baseline, - and my later edits go to the next review." - ✅ "held my own edits until the wave returned and the reviewed paths' - four dimensions diffed clean against the baseline, then applied them - — the applied edits are the next change to review." + now, re-dispatch. Definitions: the PROTECTED READ SET is the reviewed + paths plus the wave's declared read scope; the BASELINE REFS are HEAD + and the reviewed branch as recorded at dispatch; WITHHELD means + harness-enforced (a sandbox or filesystem control), not asked in a + prompt; a wave's writes are legitimate only in scratch locations + predeclared in its packet, outside the protected read set — scratch + feeding back into a reviewed input voids the verdict, on either + surface. (1) Settle in place and record the baseline: when the + requested end-state permits a commit, commit the content under review + on the reviewed branch and note the revision; an end-state requiring + unchanged history or uncommitted work takes the restorable capture — + working content, index, and untracked files of the reviewed paths, + plus the baseline refs — verified to hold everything under review; + never stash away the very change the wave reviews (a delivered tree + under §3's completion-claim audit below is settled by copying only — + that rule forbids mutating it). (2) Choose the read surface by what + you can enforce: a full copy verified against the baseline before + dispatch (a worktree pinned at a revision omits dirty content unless + the capture is applied into it, and a linked worktree shares the + repository's refs — a write-capable wave needs a fully independent + copy, one per write-capable critic, or the critics run serialized) — + required whenever any other writer (a user, a hook, a sibling + process) can touch the protected read set mid-read; the live tree + only when your edits are frozen until return AND the wave's write + access is withheld AND no other writer can touch the protected read + set. Enforcement unavailable → the independent-copy path with the + return check below is the working standard, its residual + mutate-and-restore risk recorded as a caveat on the verdict; a live + tree without enforcement runs provisional — never a clean gate pass. + (3) On return, check by read surface. Copy: compare its protected + read set (content, index, untracked) and its baseline refs — outside + predeclared scratch, any change means the copy was written: + quarantine it for attribution (never delete unexamined — the motion + may be another actor's work), void the verdict, cut a fresh verified + copy from the settled tree, re-dispatch; a clean copy binds the + verdict to the baseline, and live paths that moved since dispatch + (plus their dependents) are UNREVIEWED — fresh-context re-review + covers them, not the orchestrator's own glance. Live tree: any change + to the protected read set or baseline refs — your own edits included + → void; re-dispatch against a settled tree, never re-attribute to the + baseline. Motion you did not make is never proof the wave wrote — + investigate ownership before restoring anything (§4's edit-conflict + rule protects a concurrent editor's work). An endpoint match detects + only persistent drift — a write-capable reader can mutate and restore + without a trace; prevention is enforced withholding on the read + surface plus no third writer. Done when: baseline recorded; surface + matched to what was enforceable; return check run; and the verdict + either applied to the exact state it bound, or voided and + re-dispatched (moved state), or labeled provisional (unenforceable + live read) — never promoted past its label. + ✅ "committed the slice, noted the revision, dispatched one verified + copy per critic with write withheld, kept editing the live tree; on + return each copy's read set and baseline refs matched — verdicts bind + the baseline; my later edits go to the next review." + ✅ "write withheld and no third writer on the live tree; held my own + edits until the wave returned and the protected read set and baseline + refs diffed clean — then applied them (the applied edits are the next + change to review)." ❌ "kept fixing files in the live tree the critic was reading." ❌ "the tree matches what I intended, so the verdict stands" — a moved tree voids the verdict; it does not re-bind to the baseline. From 5d2fd764be177315592410ee34afbc65708f4229 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:21:51 +0800 Subject: [PATCH 38/66] skill-authoring: r5 refinements to the grep-absence rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #51 round-5 gate (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1-8). Adjudication: - empty-search recovery widened to EVERY searched file read in full, and the not-covered decision keyed to reading, not grep emptiness; both pos examples now model the whole-file mandate with file- qualified records (grok F1, F2 / codex F1, F5) - paraphrase parenthetical deleted; pointer-only to the cross-ref rule (grok F3 / codex F2) - pre-addition baseline defined as the branch-base revision, never the edited working copy (codex F6); standalone verdicts confirmed by a fresh-context reader without the author's session (codex F7) - trigger names instruction files explicitly (codex F8); in-body private count dropped to shape (grok n4); headingless-file clause made global (grok n5); reviewer empty-search parity (grok n6) - codex F3: PR-body dup-check record corrected separately (adds §4 one-source-of-truth to sections read, names all nine files) - codex F4 rejected-with-reason (standing): file length is a pre-existing condition; compaction is owner-scheduled maintenance, not this diff's burden Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 96 ++++++++++++++++----------------- 1 file changed, 48 insertions(+), 48 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 5b44f44..745baff 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -151,57 +151,57 @@ artifact-producing step. sibling instead. Each skill states **when NOT to use it** and which sibling to use. - **Keyword-grep absence is not absence** (`unprobed` — private incidents as - shape; see Provenance). About to add a new fact or rule, or to - conclude a file does not cover one (wording-only and provenance edits - are out of scope): an empty grep is not the dup-check the - no-duplicate-homes rule above needs — rules phrased differently from - the search term repeatedly produced false "not covered" verdicts - (three in one week in the contributor's private log; see Provenance), - one a proposed addition whose content already sat in the target file - under other wording, caught only by reading the section at drafting - time. The check: grep the target file and its sibling skills (the - skills shipped beside it — list the parent skills directory, don't - recall it, and include each searched skill's references files when - the topic plausibly lives there; a router file like CLAUDE.md has no - siblings — its "siblings" are the files it points into, and a - headingless file is read in full) for the concept's name plus at - least two alternates drawn from how the file might phrase it (the - outcome it produces, the operation's other names, its domain jargon); - list the actual section headings of the target AND of every file - searched; from that real outline — never from memory — name the - candidate homes (every section with a hit, plus every section the - fact would live in if it existed) and read each in full before any - verdict — and when every search came back empty, read the whole - target file before concluding anything (the incident's catch was the - read, not the grep). Duplicate found → no second home, wherever it - lives: in the target, no addition; in a sibling, cross-reference it — - in either case the "A cross-reference is not a load" rule below still - applies as written (a cannot-miss clause is quoted verbatim at its - trigger site with the sync contract naming the winner). Otherwise the - change record — the PR description or commit message when one is - being created, otherwise the completion report — carries the result - line: the terms searched, the files searched, the file-qualified - sections read, and "not found under the searches and sections + shape; see Provenance). About to add a new fact or rule to an + instruction file, or to conclude one does not cover a fact + (wording-only and provenance edits are out of scope): an empty grep is + not the dup-check the no-duplicate-homes rule above needs — rules + phrased differently from the search term repeatedly produced false + "not covered" verdicts in the contributor's private log (see + Provenance), one a proposed addition whose content already sat in the + target file under other wording, caught only by reading the section at + drafting time. The check: grep the target file and its sibling skills + (the skills shipped beside it — list the parent skills directory, + don't recall it, and include each searched skill's references files + when the topic plausibly lives there; a router file like CLAUDE.md has + no siblings — its "siblings" are the files it points into) for the + concept's name plus at least two alternates drawn from how the file + might phrase it (the outcome it produces, the operation's other names, + its domain jargon); list the actual section headings of the target AND + of every file searched; from that real outline — never from memory — + name the candidate homes (every section with a hit, plus every section + the fact would live in if it existed) and read each in full before any + verdict. A headingless file is read in full. When every search came + back empty, read every searched file in full before concluding + anything — the incidents' catch was the read, not the grep. Duplicate + found → no second home, wherever it lives: in the target, no addition; + in a sibling, cross-reference it — the "A cross-reference is not a + load" rule below still applies as written. Otherwise the change record + — the PR description or commit message when one is being created, + otherwise the completion report — carries the result line: the terms + searched, each file searched with what was read of it (named sections, + or "read in full"), and "not found under the searches and sections listed". For a landing addition, the fresh-context reviewer (§6) - re-runs those searches against the pre-addition text and reads at - least one candidate section of their own choosing; a standalone - not-covered verdict with no reviewer stays provisional in the report - until an out-of-band read confirms it (§7's enforcement ladder). A - bare "not covered" backed only by empty greps is the failure this - rule exists to stop; no plausible home in the outline for a fact the - task says is covered or being relocated, or doubt that the candidate - list is complete → the placement is unresolved — escalate it, and - under those conditions never assert absence. + re-runs those searches against the pre-addition text (the file at the + revision the change branches from — never the edited working copy) and + reads at least one candidate of their own choosing — on empty + searches, one searched file in full; a standalone not-covered verdict + with no reviewer stays provisional in the report until a fresh-context + reader without the author's session confirms it there. A bare "not + covered" backed only by empty greps is the failure this rule exists to + stop; no plausible home in the outline for a fact the task says is + covered or being relocated, or doubt that the candidate list is + complete → the placement is unresolved — escalate it, and under those + conditions never assert absence. ✅ "grep for 'revert', 'rollback', 'undo' across the playbook and its - two siblings returned nothing; still read the playbook's 'State - recovery' and 'Cleanup' sections end to end — the rule exists under - 'restore'; the change record lists all three terms and both sections." - ✅ "searches and all four candidate sections empty — recorded 'not - found under the searches and sections listed: revert, rollback, undo; - playbook §State recovery, playbook §Cleanup' — then added the rule." + two siblings returned nothing; read all three files end to end — the + rule exists in the playbook under 'restore'; the change record lists + the three terms and the three files, each 'read in full'." + ✅ "all searches empty — read both searched files end to end; recorded + 'not found under the searches and sections listed: revert, rollback, + undo; playbook.md (read in full), helpers.md (read in full)' — then + added the rule." ❌ "grep returned nothing, so the file doesn't cover it." - ❌ "three synonyms, all empty — not covered" (no section was ever - read). + ❌ "three synonyms, all empty — not covered" (no file was ever read). - **A cross-reference is not a load** (`unprobed` in-house; external evidence — see Provenance). On weak tiers, discovering that a sibling skill applies is a judgment act: fable-method published a smoke-grade From 54a38d5d429e24c7fb1e43ac99b44363b52a4e6f Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:23:22 +0800 Subject: [PATCH 39/66] delegation-and-review: r2 rework of the port-contention bullet PR #53 round-2 gate (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1,2,3,4). All reproduced and addressed: - claim scoped to STATIC references; runtime-derived-and-propagated references recognized as a valid defense (codex F1) - strict-port arm turned into a collision policy with a defined exit: bind refusal is the diagnostic -> free unique port + propagate + restart; no dead end vs Done (grok F1 / codex F2) - mismatch fix gains its discovery step: read the actually-bound port from the server report or listener (grok F2) - identity check traverses every relied session-local target (API proxy included) with a marker unique among live siblings; same- revision build ids called out as non-discriminating; no-marker fallbacks named (grok F3 / codex F3) - cross-port references glossed (grok n6); PR body What to be synced (grok F4-analog / codex F4) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 53 ++++++++++++++++----------- 1 file changed, 32 insertions(+), 21 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 4c0e72a..1a818f4 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -25,28 +25,39 @@ treat every returned result as a claim until verified. - **Isolated trees do not isolate ports** (`unprobed` — private incident as shape; see Provenance). When sibling sessions run servers sharing a port namespace and a configured port, they contend for it; once one is - displaced (auto-port fallback, a restart elsewhere), any reference - meant for THAT session's server — a `localhost:` proxy, target, - or env entry — still aims at the configured port and now silently - reaches the sibling's server: the page loads blank or shows the wrong - build while every request returns 200, which reads as a bug in your - own change. Defense, either arm: give each worktree a unique fixed - port AND propagate it to every session-local reference (proxy, env, - browser entry), or run fail-loud (strict port, no fallback) so a - collision stops the server instead of silently rerouting — auto-port - fallback alone is the displacement mechanism, never the repair. Done - when an endpoint-identity check passes: the preview response carries - this session's own marker (a build id, the worktree name), not just - any 200. On mismatch, fix this session's references — never kill the - sibling's server (it is another session's work). When a fanned-out - preview misbehaves with all-green requests, check cross-port - references before debugging your own code — stopping your preview - cannot stop a sibling's server, so the wrong upstream stays up. A - reference to an intentionally shared local service (one database for - all worktrees) is not a cross-port defect; the rule covers references - meant for the displaced session-owned server. + displaced (auto-port fallback, a restart elsewhere), any STATIC + reference meant for that session's server — a `localhost:` + proxy, target, or env entry still naming the configured port — now + silently reaches the sibling's server: the page loads blank or shows + the wrong build while every request returns 200, which reads as a bug + in your own change. Defenses (any one, fully applied): give each + worktree a unique port and propagate it to every session-local + reference (proxy, env, browser entry); or derive every reference at + runtime from the port the server actually bound, propagated to every + consumer; or run strict-port so a collision stops the server — a bind + refusal IS the diagnostic (the port is contended): pick a free unique + port, propagate, restart. Auto-port fallback alone is the displacement + mechanism, never the repair. To fix a suspected mismatch: discover the + port this session's server actually bound (its own startup report, or + the process's listener), point every session-local reference at it, + and never kill the sibling's server — it is another session's work. + Done when an endpoint-identity check passes through EVERY relied + session-local target (the API proxy included, not just the top page): + the response carries a marker unique among live sibling sessions — + the worktree name served by this session, a session nonce; a content + build id shared by same-revision worktrees does not discriminate; + when the app exposes no marker, serve one temporarily or match the + process to the port (an `lsof`-style listener check) as identity + evidence. When a fanned-out preview misbehaves with all-green + requests, check cross-port references — references still naming the + shared configured port instead of this session's bound port — before + debugging your own code: stopping your preview cannot stop a + sibling's server, so the wrong upstream stays up. A reference to an + intentionally shared local service (one database for all worktrees) + is not a cross-port defect; the rule covers references meant for the + displaced session-owned server. ✅ "each worktree pinned to its own port, proxy and env updated; the - preview page shows this worktree's build id." + preview and its API proxy both return this worktree's name." ❌ "every request is 200, so the proxy target must be my server." - Route by task: mechanical clear-spec work → cheapest capable model; user-facing output → high-taste model; reviews and hard debugging → strongest available. From 39409db07e6d151c0c6d2a02832b75093cbeba12 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:24:27 +0800 Subject: [PATCH 40/66] delegation-and-review: rework the pinned-string bullet per r1 dual review PR #54 round-1 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-6). All reproduced and addressed: - decision-time re-run made canonical; DAY framing replaced by not-a-durable-attribute ontology; fresh results INFORM routing and never replace S2's edge spec + proof gate; no measurement pins the next request (grok F1 / codex F1) - 'number' -> 'measurement' covering categorical properties (grok n2 / codex F2) - terminal re-verification line now includes recorded hosted-endpoint behavioral claims (codex F3) - Done defined (fresh probe cited w/ timestamp+config, or the unknown-property fallback: route as if unguarded + spec the edge); probe-unavailable disposition named; pos example added; neg example generalized to any prior measurement incl. this morning's (grok F1 / codex F4) - provenance: rates-not-restated claim qualified (intervals are contributor-reported shape); in-body interval phrasing loosened to match (codex F5) - probe debt re-characterized as the behavioral executor trap (stale dated result + changed same-slug probe), distinct from premise re-verification (codex F6) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 54 +++++++++++++++++---------- 1 file changed, 34 insertions(+), 20 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 38a30f1..29c8ca8 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -27,19 +27,30 @@ treat every returned result as a claim until verified. Tie-break intelligence > taste > cost. Model lineups are volatile facts: read the environment at session time, not memory. - **A pinned model string does not pin behavior** (`unprobed` — private - incidents as shape; see Provenance). Hosted endpoints drift behind - identical slugs: in one week, one CLI's measured edge-guard rate collapsed - on re-measurement a single day later (same flag, same prompt battery, - forcing a published claim's retraction), and a second vendor's endpoint - inverted a reproduced infinite-loop failure into a fully guarded pass over - twelve days — model strings unchanged in both. So a measured behavioral - property of a hosted model — an edge-safety rate, a failure signature, a - latency class — is a measurement of a DAY, not of the string. Date-stamp - every such number where it is recorded, and when a routing or safety - decision depends on one, re-run the probe instead of reusing it; an - undated behavioral claim about a hosted endpoint is expired on arrival. - ❌ "we measured that model guarding this edge last week, so route the - edge-risky work to it." + incidents as shape; see Provenance). A routing or safety decision is + about to rely on a previously measured behavioral property of a + hosted model — an edge-safety rate, a failure signature, a latency + class: that property is not a durable attribute of the slug (hosted + endpoints drift behind identical strings — in the contributor's + harnesses, one CLI's edge-guard measurement flipped on re-measurement + with flag and battery unchanged, and a second vendor's reproduced + failure inverted to a pass days later, strings unchanged). Date-stamp + every such measurement where it is recorded; at decision time, re-run + the probe and cite the fresh result's timestamp and configuration — + the fresh result informs the routing, it never replaces §2's edge + specification and proof gate for the work itself, and no measurement + pins the endpoint's behavior on the next request. Probe unavailable + or failing → the property is unknown: route as if unguarded and spec + the edge per §2. Done when the decision record cites the fresh probe + (timestamp + configuration) or the unknown-property fallback — an + undated behavioral claim about a hosted endpoint is expired on + arrival. + ✅ "re-ran the edge battery this session, cited its timestamp in the + routing note, and specced the edge in the packet anyway." + ❌ "we already measured that model guarding this edge, so route the + edge-risky work to it" — any prior measurement reused for a routing + or safety decision without a decision-time re-run, last week's or + this morning's. ## 2. The dispatch packet @@ -323,10 +334,13 @@ the result enough to force retraction of the prior day's published regression claim; and a second vendor's endpoint, over twelve days behind unchanged model strings, inverted a reproduced infinite-loop failure into a fully guarded pass. Both are contributor-reported (private harnesses, -verifiable by the contributor, not linkable here); numbers not restated per -the README covenant — cited as shape, in-body `unprobed` marker. A probe -would require a hosted endpoint that drifts on schedule, which nothing can -fixture; the honest test is longitudinal re-measurement, recorded here as -the debt. -Stable behavioral rules; re-check only -worktree/agent mechanics against the current harness. +verifiable by the contributor, not linkable here); benchmark rates are not +restated, and the elapsed intervals are contributor-reported shape — cited +per the README covenant, in-body `unprobed` marker. The executable probe +debt is behavioral: fixture a stale dated measurement beside a changed +same-slug probe result and observe whether a weak executor re-runs before +routing — distinct from re-verifying the drift premise itself, which only +longitudinal re-measurement of live endpoints can do. +Stable behavioral rules; re-check +worktree/agent mechanics and any recorded hosted-endpoint behavioral +claims against the current environment. From 85ac8bca16d98f5d63ab7e5efed18c7034e61150 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:25:32 +0800 Subject: [PATCH 41/66] operational-rigor: r7 refinements to the scheduled-process rule PR #49 round-7 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-4). Adjudication: - attribution fallback now requires excluding other producers AND earlier invocations' outstanding queued effects; async delivery without an identifier stays unverified when exclusion cannot be established (codex F1) - per-invocation grants scoped to supervised/test invocations; the project-policy standing authorization named as the canonical exception covering unattended fires (codex F2) - SKILL.md trigger now QUOTES the reference headline verbatim, and the reference carries the change-X-update-Y sync contract with itself as winner (codex F3) - relying-on path made executable: review arm + the absence alarm's current health (grok F1) - codex F4 (in-packet checks.py unverifiability): standing disposition - the gate-runner re-runs checks.py each round Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 9 ++++--- .../references/external-systems.md | 25 +++++++++++++------ 2 files changed, 22 insertions(+), 12 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index bdd9cf2..4a75743 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -303,10 +303,11 @@ When rigor conflicts with finishing sooner, rigor wins. - Never fabricate observations or report outputs not produced. Report skipped verification as skipped. - **Arming, enabling, relying on, or reviewing a recurring scheduled - process → its side effects are unverified until checked at their - destinations, attributed to the invocation; the process's own - "completed" report is not that evidence** (`unprobed` — private - incident as shape; see Provenance). A + process → "A recurring schedule's own 'completed' report is not + evidence its side effects landed — verify at the destinations, + attributed to the invocation"** (the scheduled-process entry's + headline, quoted; that entry wins on disagreement) (`unprobed` — + private incident as shape; see Provenance). A weekly task reported success for roughly three months while its write step silently never executed, and a second output channel on the same task was separately dead on a stale hardcoded credential the whole diff --git a/skills/operational-rigor/references/external-systems.md b/skills/operational-rigor/references/external-systems.md index ef9c105..08c8cd6 100644 --- a/skills/operational-rigor/references/external-systems.md +++ b/skills/operational-rigor/references/external-systems.md @@ -119,15 +119,17 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. while its write step silently never executed; a second output channel on the same task was separately dead on a stale hardcoded credential — contributor-reported shape.) Gates first: every consequential - invocation — the repeat - run below included — carries its own per-invocation authorization + supervised or test invocation — the repeat run below included — + carries its own per-invocation authorization (destructive / spending / publishing / credential — operational-rigor §2's confirmation gate governs: its per-invocation grant, plus its AUTH: artifact for the outward or irreversible steps), and a schedule whose unattended fires are themselves consequential needs §2's - project-policy-scoped standing authorization before running unattended; - a request to arm covers the arming, not those future fires; a - permission or credential in place is not authorization. Verify the + project-policy-scoped standing authorization before running unattended — + that standing authorization is the canonical exception covering the + unattended fires themselves; a request to arm covers the arming, not + those future fires; a permission or credential in place is not + authorization. Verify the credentials the work actually needs under the schedule's principal; minting or broadening one is itself gated; session-only credentials do not travel to headless runs. Drive and attribute: read the configured @@ -146,8 +148,11 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. hold observation authority over. Verify each inventoried channel with its emission condition driven TRUE at least once: destination evidence carrying that invocation's identifier where the channel supports one, - else a before/after transition plus confirmation that no other - eligible invocation ran in the window (a fresh artifact another writer + else a before/after transition plus exclusion of every other + producer AND of earlier invocations' still-outstanding effects (an + effect queued before the window can land inside it — asynchronous + delivery without an identifier stays unverified when that exclusion + cannot be established) (a fresh artifact another writer or run could have produced proves nothing; an async 2xx acceptance is not delivery) — a condition-matched absence verifies only the suppression branch, never the channel. Consequential outbound channels @@ -188,7 +193,8 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. missed check is unhealthy and gets the response documented and authorized at arming time — disarming or escalating needs its own authorization, and with no authorized response the gap itself is the - report, never a shrug. Reviewing an + report, never a shrug. Relying on an armed schedule mid-flight uses this same review arm plus + the absence alarm's current health as the evidence. Reviewing an existing schedule without authorization to run it: inspect existing evidence asymmetrically — stale evidence can refute; fresh evidence proves only when tied to the invocation under review (an established @@ -214,6 +220,9 @@ error-cooldown cache state, typed advance-signal vs. valid empty, executed DST gap/fold cases, and the durable-handoff scope of "await side effects" — trail in `reviews/2026-07-16-post-merge-validation-pr25-29.md`. +Sync contract: the §4 scheduled-process bullet's opening claim quotes +this entry's headline verbatim — change the headline here → update that +quote (this entry wins on disagreement). The scheduled-process entry (2026-07-22; one addition with its §4 rule, which carries the contributor's 2026-07-21 date — the entry records its placement during review) is the protocol body of the §4 From ae73e9b9bb97b4a31c18bdf1da89c108ae6d08c9 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:27:50 +0800 Subject: [PATCH 42/66] skill-authoring: r4 refinements to the deployment-runtime rule PR #52 round-4 gate (grok-4.5 high: FIX 1,2,3; gpt-5.6-sol max: FIX 1-6). Adjudication: - deferral terminal state unified: recorded risk acceptance by the deployment owner = alternate Done that still requires the sweep and in-file labels; no acceptance -> blocked; anti-vacuity clash removed (grok F1 / codex F1) - target-scoped dispatch satisfies a named target only when that target keeps a working path for every claimed capability - costume conditionals excluded (grok F2) - Done vocabulary unified on named-target-in-record (grok F3) - sweep list declared a floor; executable-dependency dimensions added (arch, interpreter/deps, versions, fs, permissions, network); runtime-agnostic restricted to pure instruction text (codex F2) - authoring-start requirement made answer-or-user-must-provide BEFORE first artifact-producing step; review = enforcement backstop (codex F4) - plugin branch narrowed to a plugin's instruction files, matching the frontmatter router (codex F6); repo-manifests-first discovery order (codex n7) - codex F3: this PR's own record gains its runtime line (body edit: runtime-agnostic, pure doctrine); codex n8: body Unicode claim corrected to include the arrow glyph - codex F5 rejected-with-reason (standing): single-incident rules with unprobed markers are this repo's covenant and precedent; S4 two-strike governs fix-log promotion in consuming projects Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/skill-authoring/SKILL.md | 92 ++++++++++++++++++--------------- 1 file changed, 50 insertions(+), 42 deletions(-) diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 2d3a436..97aeeee 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -229,49 +229,57 @@ The sharpest usability probe is behavioral: give a fresh weaker-tier behavior down first, then patch the gaps the probe surfaces — not the ones you imagine. -**A skill or plugin is under this section's review — verify its -deployment runtime before the review concludes** (`unprobed` — private -incident as shape; see Provenance). A skill verified only on the -author's machine can pass every lens above and still be wrong where it -will actually run: one reviewed-and-finalized skill was reworked -wholesale when its real target — a sandboxed Linux VM, not the author's -macOS — surfaced only after sign-off. The target question belongs at -authoring start (§1's gate placement: ask before the first -artifact-producing step); this review cannot retro-place that ask — it -verifies the answer exists and blocks adoption when it does not. -Confirm the review record — the same artifact as §7's change record, -verbatim: "the PR description or commit message when one is being -created, otherwise the completion report" — names the target -runtime(s): the execution environment (OS, container, sandbox) and any -governing connector or tool instance; a sweep that finds nothing -machine-bound may record `runtime-agnostic` as the named outcome. Not -named → obtain it from the requester; no answer → write -`user-must-provide` in the record, and adoption stays blocked until -the requester either supplies the target or records an explicit -risk-acceptance deferral — silence is neither, and an empty target -list never satisfies the compatibility check below vacuously. Named or -not, always run the sweep for assumptions that silently bind the file -to the author's machine: an accidentally machine-local repository path -gets §2's remedy, verbatim ("Anchor to the VCS root (`git rev-parse +**A skill — or a plugin's instruction files — is under this section's +review: verify the deployment runtime before the review concludes** +(`unprobed` — private incident as shape; see Provenance). A skill +verified only on the author's machine can pass every lens above and +still be wrong where it will actually run: one reviewed-and-finalized +skill was reworked wholesale when its real target — a sandboxed Linux +VM, not the author's macOS — surfaced only after sign-off. §1's gate +placement applies at authoring start: the target answer (or a recorded +`user-must-provide`) is required before the first artifact-producing +step; this review is the enforcement backstop, and it blocks adoption +when the answer is missing. Confirm the review record — the same +artifact as §7's change record, verbatim: "the PR description or commit +message when one is being created, otherwise the completion report" — +names the target runtime(s): the execution environment (OS, container, +sandbox) and any governing connector or tool instance. Not named → +read the repo's own deployment manifests and docs first, then obtain +what they cannot tell you from the requester; no answer → write +`user-must-provide` in the record; adoption then proceeds ONLY under a +recorded risk acceptance by whoever owns the deployment — that +acceptance is an alternate Done which still requires the sweep below +and every in-file label; without it the artifact stays blocked. +Named or not, always run the sweep for assumptions that silently bind +the file to the author's machine — this list is a floor, not the +ceiling: an accidentally machine-local repository path gets §2's +remedy, verbatim ("Anchor to the VCS root (`git rev-parse --show-toplevel`) and verify the path prefix before reading"), while -an absolute path the target itself defines (a socket, device, or -mount) is a machine-bound assumption like the rest; OS-specific -launchers and helpers (URL-scheme opens, clipboard or notification -tools), host identity (a literal hostname or username), wall-clock or -timezone assumptions (a hard-coded TZ, a locale), and -instance-specific tool identifiers (a connector's tool prefix can be -unique to the author's instance) each keep a verified portable form, -or stay behind a verified target-scoped dispatch (an OS-conditional -branch counts as compatible with targets that never reach it), or -carry a label naming the exact runtime or instance required — written -IN the skill file beside the dependency (§2's embed-the-knowledge; the -review record points to it), verified against that instance where -reachable and marked `unverified` (§2) where not: a label records a -limitation, never proves compatibility. Done when every named target -runtime is compatible with every assumption reachable on it — a -labeled incompatibility with the actual deployment target blocks -completion, and shrinking the supported scope can only exclude an -optional target with the requester's explicit say — and everything +an absolute path the target itself defines (a socket, device, mount) +is a machine-bound assumption like the rest; OS-specific launchers and +helpers (URL-scheme opens, clipboard or notification tools), host +identity (a literal hostname or username), wall-clock or timezone +assumptions (a hard-coded TZ, a locale), instance-specific tool +identifiers (a connector's tool prefix can be unique to the author's +instance), and — for anything that executes programs — architecture, +interpreter and dependency availability, runtime versions, filesystem +semantics, permissions, and network reach. `runtime-agnostic` may be +recorded only for pure instruction text with no executable dependency; +anything that runs programs names its dimensions instead. Each +machine-bound assumption keeps a verified portable form, or stays +behind a verified target-scoped dispatch — which satisfies a named +target only when that target ALSO keeps a working path for every +capability the file claims (a foreign-OS-only branch is not +compatibility) — or carries a label naming the exact runtime or +instance required, written IN the skill file beside the dependency +(§2's embed-the-knowledge; the review record points to it), verified +against that instance where reachable and marked `unverified` (§2) +where not: a label records a limitation, never proves compatibility. +Done when every target runtime named in the record is compatible with +every assumption reachable on it — a labeled incompatibility with a +named target blocks completion, and shrinking the supported scope can +only exclude an optional target with the requester's explicit say — or +when the recorded risk acceptance above stands in; and everything machine-bound carries its named label in the file. ✅ "target: sandboxed Linux VM plus the team's shared connector instance; the macOS-only notify helper replaced with the project's CLI From 27ac396a2f9894e5921561913877a2d615ea0b61 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:30:10 +0800 Subject: [PATCH 43/66] delegation-and-review: r6 rework of the sweep fields - branch-first, mandatory producer axis, honest closure PR #50 round-6 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-7). All reproduced and addressed: - textual-vs-behavioral branched FIRST; textual gate claims corpus- level absence only, corpus = packet's readable scope named explicitly, never the seed hit list (codex F3 / grok n4-of-r6) - producer/effect axis made a MUST before loop close; spelling-only axis sets non-compliant regardless of rounds (grok F1) - S3 finder list quoted verbatim; dedup + stop rule cited, not restated (codex F4) - closure honesty: producer surfaces/variation axes not closable from a verified-finite source -> non-exhaustive outcome (codex F1); verified-finite wording covers const unions (grok n5-of-r6) - equivalence requires the producing implementation itself; unproved divergence -> per-member observation (codex F2) - search bounded to the packet's readable scope; outside surfaces are reported gaps (codex F6) - outward effects carry per-invocation authorization at fire time (codex F7) - PR-body Rule sync next (codex F5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 92 +++++++++++++++------------ 1 file changed, 52 insertions(+), 40 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 1827a42..fb3b409 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -35,31 +35,42 @@ Every packet names: - **Owned scope + explicit non-scope** — files/modules it may and may not touch. For a find-and-fix-every-instance sweep — a "purge every X", "replace all Y", "no instance of Z survives" task — scope splits in two - (`unprobed` — private incident as shape; see Provenance). The TARGET - is the defect or effect to eliminate, never the first search string — - a spelling is a probe. The SEARCH scope is every surface that can - produce that target: literals and direct references, shared/global - definitions, helpers that construct or return it. Hunt generators - per §3's miss-is-costly loop (its axis-diverse finders, dedup, and - two-consecutive-empty-rounds stop rule apply as written there), with - the spelling-based probes as only some of the axes — the effect-side - axes (what shared definitions and constructors can produce this kind - of output) never match the spelling at all; a 53-file styling sweep - missed its defect in a shared utility class the token grep never - matched, and each review round surfaced another category the prior - round's pattern structurally excluded. The packet carries the seed - inventory, the hunt method, and a per-round ledger duty (each round's - queries and results, empty ones included — the worker continues the - loop to closure); it also names the value family (the tiers/variants - the target ranges over), closed only by a verified-finite source (a - sealed enum read at its `file:line` — an extensible registry or - config is never closed), else bounded per §3's "State anything you - bounded" clause. A bounded or gap-carrying sweep returns a - non-exhaustive outcome: reducing scope needs the dispatcher's - explicit say, and an every-instance claim with unobserved members is - false. The WRITE scope stays the owned files/modules explicitly - listed above: a generator discovered outside that WRITE scope is - reported for escalation, never edited on discovery. + (`unprobed` — private incident as shape; see Provenance). First branch + by what the invariant IS. Textual: the deliverable is literally the + string's absence from a declared corpus — the corpus is the packet's + readable scope, named explicitly, never the seed grep's hit list — + and the correctly scoped search over that corpus is the gate, claiming + corpus-level textual absence and nothing more. Behavioral: the TARGET + is the defect or effect to eliminate; a spelling is a probe. The + SEARCH scope is then every surface that can produce that target: + literals and direct references, shared/global definitions, helpers + that construct or return it. Hunt generators per §3's miss-is-costly + loop — its finders quoted verbatim: "Run axis-diverse finders — by- + container, by-content, by-entity, by-time — one axis per finder so + blind spots don't line up", with dedup against everything surfaced + and its two-consecutive-empty-rounds stop rule — and at least one + producer/effect axis (what shared definitions and constructors can + produce this kind of output) MUST run before the loop may close: a + spelling-only axis set is non-compliant however many rounds it ran (a + 53-file styling sweep missed its defect in a shared utility class the + token grep never matched, and each review round surfaced another + category the prior round's pattern structurally excluded). Searching + stays inside the packet's readable scope: a surface outside it is a + reported gap, never a silent crossing. The packet carries the seed + inventory, the hunt method, and a per-round ledger duty — each + round's queries and results, empty ones included; the worker + continues the loop to closure. It also names the value family (the + tiers/variants the target ranges over), closed only by a + verified-finite source (a sealed enum or const union read at its + `file:line` — an extensible registry or config is never closed), else + bounded per §3's "State anything you bounded" clause. Producer + surfaces or variation axes not closable from a verified-finite source + → the sweep returns a non-exhaustive outcome, as does any bounded or + gap-carrying run: reducing scope needs the dispatcher's explicit say, + and an every-instance claim with unobserved members is false. The + WRITE scope stays the owned files/modules explicitly listed above: a + generator discovered outside that WRITE scope is reported for + escalation, never edited on discovery. ✅ "seed inventory: the 53-file hit list (reference search), the shared class (style audit), the emitting helper (trace); tiers from the sealed palette enum at its definition site; round ledger in the @@ -74,21 +85,22 @@ Every packet names: effect at every inventoried generator surface, across each declared variation axis where the outcome can differ (tier, theme, locale — untested combinations are unobserved, reported as such) — render or - run each inside an authorized, side-effect-contained harness; an - outward effect you cannot safely drive (a payment, a send, a delete) - is reported unverified and escalated, never fired for the gate - (operational-rigor §2's gates govern). One observation may stand for - a declared equivalence class only when equivalence is verified across - the members' inputs, backing data, and downstream context — - branch-free control flow alone is not equivalence (a table lookup - differs per entry), and a stated "they share a helper" is a claim, - not evidence; anything unobserved is reported unverified — never - folded into an exhaustive claim. Only when the invariant is literally - the string's absence — nothing at runtime produces the outcome - without that exact spelling — is the correctly scoped search over the - declared corpus itself the gate. A zero-hit search on a behavioral - target is a report, not the gate: a clean grep proves one spelling is - gone, not that the defect is gone. + run each inside a side-effect-contained harness; every outward + effect keeps operational-rigor §2's per-invocation authorization at + the moment it fires, and one you cannot safely and authorizedly + drive (a payment, a send, a delete) is reported unverified and + escalated, never fired for the gate. One observation may stand for a + declared equivalence class only when equivalence is verified across + the members' inputs, backing data, downstream context, AND the + producing implementation itself (two independent renderers are never + one class on shared inputs alone; branch-free control flow is not + equivalence — a table lookup differs per entry; "they share a + helper" is a claim, not evidence); unproved divergence forces + per-member observation, and anything unobserved is reported + unverified — never folded into an exhaustive claim. A zero-hit + search on a behavioral target is a report, not the gate: a clean + grep proves one spelling is gone, not that the defect is gone (the + textual branch above is the only search-as-gate case). ✅ "each literal's site re-rendered, the shared class's consumers re-rendered, every tier through the emitting helper — effect gone at each observation point." From 32fab1faa8a075b565c2d2ac37a896739529ea77 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:34:58 +0800 Subject: [PATCH 44/66] delegation-and-review: r3 refinements to the port-contention bullet PR #53 round-3 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-4). All reproduced and addressed: - repair now persists a chosen defense, updates every reference, and restarts/reloads startup-configured consumers; retargeting at an ephemeral fallback port called out as a non-defense (codex F1) - listener checks demoted to port discovery; Done requires fresh TARGET-ORIGINATED identity evidence observed through every relied consumer path, killing the lsof-anaphora false-pass (grok F1 / codex F2) - contention diagnostic narrowed to explicit address-in-use errors; other bind failures handled as their own faults (codex F3) - temporary markers removed after the check with a clean-diff debris check (codex F4); strict-port jargon replaced by behavioral wording (grok n2); body checklist counts/glyphs to be synced (codex n5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 63 +++++++++++++++------------ 1 file changed, 35 insertions(+), 28 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 1a818f4..37ef7fa 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -30,34 +30,41 @@ treat every returned result as a claim until verified. proxy, target, or env entry still naming the configured port — now silently reaches the sibling's server: the page loads blank or shows the wrong build while every request returns 200, which reads as a bug - in your own change. Defenses (any one, fully applied): give each - worktree a unique port and propagate it to every session-local - reference (proxy, env, browser entry); or derive every reference at - runtime from the port the server actually bound, propagated to every - consumer; or run strict-port so a collision stops the server — a bind - refusal IS the diagnostic (the port is contended): pick a free unique - port, propagate, restart. Auto-port fallback alone is the displacement - mechanism, never the repair. To fix a suspected mismatch: discover the - port this session's server actually bound (its own startup report, or - the process's listener), point every session-local reference at it, - and never kill the sibling's server — it is another session's work. - Done when an endpoint-identity check passes through EVERY relied - session-local target (the API proxy included, not just the top page): - the response carries a marker unique among live sibling sessions — - the worktree name served by this session, a session nonce; a content - build id shared by same-revision worktrees does not discriminate; - when the app exposes no marker, serve one temporarily or match the - process to the port (an `lsof`-style listener check) as identity - evidence. When a fanned-out preview misbehaves with all-green - requests, check cross-port references — references still naming the - shared configured port instead of this session's bound port — before - debugging your own code: stopping your preview cannot stop a - sibling's server, so the wrong upstream stays up. A reference to an - intentionally shared local service (one database for all worktrees) - is not a cross-port defect; the rule covers references meant for the - displaced session-owned server. - ✅ "each worktree pinned to its own port, proxy and env updated; the - preview and its API proxy both return this worktree's name." + in your own change. Defenses (pick one, apply it fully, PERSIST it): + give each worktree a unique port and propagate it to every + session-local reference (proxy, env, browser entry); or derive every + reference at runtime from the port the server actually bound, + propagated to every consumer; or run a fixed port with fallback + disabled, so a collision stops the server — an explicit + address-in-use bind error IS the contention diagnostic (any other + bind error — permissions, bad address, exhaustion — is its own + failure, not a cue to switch ports): pick a free unique port, + propagate, restart. Auto-port fallback alone is the displacement + mechanism, never the repair, and retargeting references at an + ephemeral fallback port is not one of the defenses — the next restart + recreates the mismatch. To repair a mismatch: choose a defense, + persist its port choice, update every session-local reference, + restart or reload every consumer that read its target at startup, and + never kill the sibling's server — it is another session's work. Done + when fresh, target-originated identity evidence — a marker the final + server generates: the worktree name it serves, a session nonce; a + content build id shared by same-revision worktrees does not + discriminate — is observed THROUGH every relied session-local + consumer path (the API proxy included, not just the top page); a + listener check (`lsof`-style) is port discovery, never identity + evidence. A marker served temporarily for this check is removed + afterward, with a clean-diff check that no instrumentation remains. + When a fanned-out preview misbehaves with all-green requests, check + cross-port references — references still naming the shared configured + port instead of this session's bound port — before debugging your own + code: stopping your preview cannot stop a sibling's server, so the + wrong upstream stays up. A reference to an intentionally shared local + service (one database for all worktrees) is not a cross-port defect; + the rule covers references meant for the displaced session-owned + server. + ✅ "each worktree pinned to its own persisted port, proxy and env + updated and reloaded; the page AND a request through the API proxy + both return this worktree's name; the temporary marker removed." ❌ "every request is 200, so the proxy target must be my server." - Route by task: mechanical clear-spec work → cheapest capable model; user-facing output → high-taste model; reviews and hard debugging → strongest available. From 7622277ac0da8c6d3ad9bc05e87ec7552f685c7d Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:38:48 +0800 Subject: [PATCH 45/66] operational-rigor: r8 refinements to the scheduled-process rule PR #49 round-8 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-5). All reproduced and addressed: - alarm proof required per independently configured alarm path; synthetic destinations valid only with production-equivalent routing (codex F1) - review-arm staleness refutation qualified by due-emission + passed deadline; conditional channels not falsely refuted (codex F2) - 'this same review arm' anaphora replaced with explicit antecedents; after-the-invocation stated necessary-never-sufficient with the identifier/exclusion procedure applying (grok F1 / codex F3) - canonical-winner clause scoped to the quoted headline only; S2 authorization rules explicitly untouched; alert grant named as the S2 project-policy-scoped kind (codex F4) - pos example ends with binding held open until the first scheduled fire lands attributed effects (codex F5 / grok n2) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 8 +++++--- .../references/external-systems.md | 20 ++++++++++++++----- 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 4a75743..16015e6 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -313,13 +313,15 @@ When rigor conflicts with finishing sooner, rigor wins. task was separately dead on a stale hardcoded credential the whole time. The arming and audit protocol is the scheduled-process entry in `references/external-systems.md` — load it before arming, enabling, - relying on, or reviewing one; on any wording disagreement, that entry - is canonical. A green run history is evidence the runner reported + relying on, or reviewing one; on wording disagreement in the quoted + headline, that entry's headline is canonical (§2's authorization rules + are untouched by that winner clause). A green run history is evidence the runner reported success, never that downstream received anything (the earlier exit-code line governs the immediate command you just ran; a schedule's downstream is this rule). ✅ "authorized the fires; drove every channel emission-positive tied - to them; absence alarm proven once — then enabled the schedule." + to them; each alarm path proven — then enabled, with scheduler binding + held open until the first scheduled fire lands attributed effects." ❌ "the log shows 200/exit-0 every week, so it's working." - **Data-path integrity — fail loud on *unspecified* ambiguity, never emit a silently-wrong value.** Honor an explicit, documented contract (a declared diff --git a/skills/operational-rigor/references/external-systems.md b/skills/operational-rigor/references/external-systems.md index 08c8cd6..674b73e 100644 --- a/skills/operational-rigor/references/external-systems.md +++ b/skills/operational-rigor/references/external-systems.md @@ -165,8 +165,12 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. scheduler-enforced non-concurrency, not short runtime. Armed means: every inventoried channel emission-positive-verified; no human cleared a prompt mid-run; overlap guarded or scheduler-excluded; the absence - alarm below armed, its firing proven once, and its alert channel's - standing authorization in place (no authorized alert path → the alarm + alarm below armed, its firing proven once per independently configured + alarm path (one channel's alert does not prove another's mapping; a + synthetic destination proves a path only when its routing matches the + production configuration), and its alert channel's standing + authorization in place — the §2 project-policy-scoped kind, covering + exactly the automated alert (no authorized alert path → the alarm is unarmed and that gap is the report; no automated outward action invents itself). Anything short stays unarmed — and enabling is not the end: scheduler binding stays an open claim until the first @@ -193,10 +197,16 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. missed check is unhealthy and gets the response documented and authorized at arming time — disarming or escalating needs its own authorization, and with no authorized response the gap itself is the - report, never a shrug. Relying on an armed schedule mid-flight uses this same review arm plus - the absence alarm's current health as the evidence. Reviewing an + report, never a shrug. Relying on an armed schedule mid-flight uses the ongoing + destination-and-deadline checks above plus the asymmetric evidence + rules below as the evidence — and "after the invocation" stays + necessary but never sufficient: the identifier-or-exclusion procedure + above applies unchanged. Reviewing an existing schedule without authorization to run it: inspect existing - evidence asymmetrically — stale evidence can refute; fresh evidence + evidence asymmetrically — stale evidence refutes only when an + independently established emission was due and its deadline passed (a + conditional channel whose condition never fired is not stale); fresh + evidence proves only when tied to the invocation under review (an established exclusive writer narrows the author, not the run — its artifact still needs a timestamp or state transition placing it after that From 6bb98582f9729ac2188471a523b48e5f3232f428 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:40:58 +0800 Subject: [PATCH 46/66] operational-rigor: r1 refinement of the check-name rule PR #57 round-1 gate (grok-4.5 high: PROCEED; gpt-5.6-sol max: FIX 1). codex F1 reproduced and addressed: evidentiary weight now comes from the full trace to the pass/fail oracle - assertions (rule set + inputs for assertion-less job types), invocation path and setup, and whether that path executed in the cited run; identical assertions with different drive paths named as the discriminating case; uninspectable trace = coverage unverified, said so. Examples updated to the trace form. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index d840747..e8480a0 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -256,15 +256,22 @@ When rigor conflicts with finishing sooner, rigor wins. - Reproduce reported bugs before fixing. Fix the observed failure, not the implied one. Refutation is valid: report confirmed non-bugs and ship nothing. - **A check's name is not its coverage** (`unprobed` — private incident as - shape; see Provenance). A named gate earns evidentiary weight only from - its assertion body: one session cited a check whose name implied it gated - a model integration's behavior, then read its source and found it - exercised only a regex pre-filter in which the model's name was a routing - label — and had to correct a safety claim already given to the user. - Before citing a check, test, or CI job as evidence a change is safe, read - what it actually asserts and cite that; "there is a check called X" is a - claim about naming, not behavior. - ✅ "read check X: it asserts A and B but never drives C — C is unverified." + shape; see Provenance). A named gate earns evidentiary weight from what + it asserts AND what it actually drives: one session cited a check whose + name implied it gated a model integration's behavior, then read its + source and found it exercised only a regex pre-filter in which the + model's name was a routing label — and had to correct a safety claim + already given to the user. Before citing a check, test, or CI job as + evidence a change is safe, trace it through to its pass/fail oracle — + the assertions (or, for a linter or build job, its rule set and + inputs), the invocation path and setup that feed them, and whether + that path executed in the cited run — and cite what the trace showed; + two checks with identical assertions differ when one drives the real + integration and the other a pre-filter. A trace you cannot inspect + leaves that coverage unverified — say so. "There is a check called X" + is a claim about naming, not behavior. + ✅ "traced check X: it asserts A and B against the real adapter, but + nothing in its path drives C — C is unverified." ❌ "the change is safe, check X covers it" (named, never read). - **A failing check has two suspects: the code and the check itself.** Before editing either, open the statement of intended behavior (spec, README, From 5f7bc32b8849178441b5f185779dc081824e3232 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:44:13 +0800 Subject: [PATCH 47/66] delegation-and-review: rework the labels-are-routes bullet per r1 dual review PR #56 round-1 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1,2,3). All reproduced and addressed: - the two boundaries split with their own state triggers and checks; the provider-ID half gains its executable stop (resolve the mapping against the provider's own ID list before crossing namespaces) - wrapper invocation proves nothing provider-side (grok F1 / codex F1) - callability success defined as an attributable model response through the same wrapper and execution context the work will use; failure leaves the route unverified, no dependent dispatch, S4 ladder governs; pass is session-scoped per the adjacent volatility rule (codex F2) - pos example added covering both boundaries separately (codex F3) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 30 +++++++++++++++++++-------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 448db3d..0b67595 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -27,15 +27,27 @@ treat every returned result as a claim until verified. Tie-break intelligence > taste > cost. Model lineups are volatile facts: read the environment at session time, not memory. - **Labels are routes, listings are claims** (`unprobed` — private incidents - as shape; see Provenance). A wrapper CLI's model strings are its internal - routing names, not necessarily the provider's API model IDs — pasting one - into a direct API call or a pricing/quota lookup queries a name that may - not exist on the provider's side. And a model's presence in a lineup - listing does not prove it is callable: across two independent tools, a - listed entry failed hard on first real invocation. The listing is the - tool's routing claim; before building on a model, invoke it once and see - output. - ❌ "the CLI lists it, so it's available — route tomorrow's batch to it." + as shape; see Provenance). Two separate boundaries, each with its own + check. About to route work through a listed model: a lineup listing is + the tool's routing claim, not callability — across two independent + tools, a listed entry failed hard on first real invocation. Verify by + one invocation through the SAME wrapper and execution context the work + will use, and success means an attributable model response, not just + output (a ghost route can print diagnostics); an error or non-response + leaves the route unverified — do not dispatch dependent work on it + (§4's retry/escalation ladder governs), and a pass is session-scoped + per the volatile-lineups rule above. About to use a wrapper's model + string OUTSIDE the wrapper — a direct provider API call, a pricing or + quota lookup: the string is the wrapper's internal routing name, not + necessarily the provider's ID; do not cross that namespace until the + provider's own ID list or docs confirm the identifier (resolve the + mapping first — a working wrapper invocation proves nothing about the + provider-side name). + ✅ "invoked it once through the wrapper we dispatch with — real + completion came back; and for the quota check, looked the ID up in + the provider's model list instead of pasting the wrapper's alias." + ❌ "the CLI lists it, so it's available — route tomorrow's batch to + it." ## 2. The dispatch packet From 24ca35076cd65c912e6883a140c1bc15de32a210 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:45:25 +0800 Subject: [PATCH 48/66] operational-rigor: r2 refinement of the check-name rule - claim scope pinned to the trace PR #57 round-2 gate (grok-4.5 high: FIX 1; codex r2 pending). grok F1 reproduced: a costume-complying executor could trace, cite, and still over-claim the name-implied property. Fixed: assert only what the trace established; name-implied remainder is unverified and said so; third neg example pins the post-trace over-claim. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index e8480a0..f06a347 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -265,14 +265,19 @@ When rigor conflicts with finishing sooner, rigor wins. evidence a change is safe, trace it through to its pass/fail oracle — the assertions (or, for a linter or build job, its rule set and inputs), the invocation path and setup that feed them, and whether - that path executed in the cited run — and cite what the trace showed; - two checks with identical assertions differ when one drives the real - integration and the other a pre-filter. A trace you cannot inspect - leaves that coverage unverified — say so. "There is a check called X" - is a claim about naming, not behavior. + that path executed in the cited run — and assert only the properties + that trace established: whatever the check's NAME implies but the + trace did not show stays unverified, said so; two checks with + identical assertions differ when one drives the real integration and + the other a pre-filter. A trace you cannot inspect leaves that + coverage unverified — say so. "There is a check called X" is a claim + about naming, not behavior. ✅ "traced check X: it asserts A and B against the real adapter, but nothing in its path drives C — C is unverified." ❌ "the change is safe, check X covers it" (named, never read). + ❌ "read it — it's a regex pre-filter, but the name says integration, + so the integration is covered" — a trace read and then overridden by + the name. - **A failing check has two suspects: the code and the check itself.** Before editing either, open the statement of intended behavior (spec, README, docstring, type) and confirm which side it backs; a disagreement is the From bd5ed5218a976fff61b290b541b678a800ddbcb2 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:46:52 +0800 Subject: [PATCH 49/66] delegation-and-review: r4 refinements to the port-contention bullet PR #53 round-4 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-5). All reproduced and addressed: - persistence split by defense: fixed arm persists the NUMBER and runs fallback-disabled (collision-free by failing loud, re-verified after every rebind); runtime arm persists the derivation MECHANISM, re-run after every bind - freezing a bound number into static refs named as the forbidden retarget (grok F1 / codex F1, F2) - expected marker recorded BEFORE the request; exact equality required (a wrong sibling's fresh nonce no longer passes) (codex F3) - identity check made terminal: any restart/reload after it - marker cleanup included - voids it; re-prove without mutating (codex F4) - cleanup verification defined against the pre-instrumentation state incl. untracked/ignored, with persisted port config exempt (codex F5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 56 +++++++++++++++------------ 1 file changed, 32 insertions(+), 24 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 37ef7fa..b8abc68 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -30,30 +30,37 @@ treat every returned result as a claim until verified. proxy, target, or env entry still naming the configured port — now silently reaches the sibling's server: the page loads blank or shows the wrong build while every request returns 200, which reads as a bug - in your own change. Defenses (pick one, apply it fully, PERSIST it): - give each worktree a unique port and propagate it to every - session-local reference (proxy, env, browser entry); or derive every - reference at runtime from the port the server actually bound, - propagated to every consumer; or run a fixed port with fallback - disabled, so a collision stops the server — an explicit - address-in-use bind error IS the contention diagnostic (any other - bind error — permissions, bad address, exhaustion — is its own - failure, not a cue to switch ports): pick a free unique port, - propagate, restart. Auto-port fallback alone is the displacement - mechanism, never the repair, and retargeting references at an - ephemeral fallback port is not one of the defenses — the next restart - recreates the mismatch. To repair a mismatch: choose a defense, - persist its port choice, update every session-local reference, - restart or reload every consumer that read its target at startup, and - never kill the sibling's server — it is another session's work. Done - when fresh, target-originated identity evidence — a marker the final - server generates: the worktree name it serves, a session nonce; a - content build id shared by same-revision worktrees does not - discriminate — is observed THROUGH every relied session-local + in your own change. Defenses (pick one, apply it fully — what you + persist differs by defense): a unique fixed port per worktree, run + with fallback disabled so a collision fails loud, the NUMBER + persisted and propagated to every session-local reference (proxy, + env, browser entry) — an explicit address-in-use bind error is the + contention diagnostic (any other bind error — permissions, bad + address, exhaustion — is its own failure, not a cue to switch + ports): then pick a different free unique port, propagate, restart; + or runtime derivation, where the MECHANISM is what persists — every + reference re-derived from the actually-bound port after every bind, + never a bound number frozen into a static ref. Auto-port fallback + alone is the displacement mechanism, never the repair; writing + today's fallback port into static references is the forbidden + ephemeral retarget — the next restart recreates the mismatch. To + repair a mismatch: choose a defense, apply its own persistence shape + as above, update every session-local reference, restart or reload + every consumer that read its target at startup, and never kill the + sibling's server — it is another session's work. Identity check, + LAST, after all mutations including cleanup: record the expected + marker for THIS session first (the worktree name it serves, a + session nonce noted before the request — a fresh nonce from the + wrong sibling still looks fresh; a content build id shared by + same-revision worktrees does not discriminate), then observe exact + equality with that recorded value THROUGH every relied session-local consumer path (the API proxy included, not just the top page); a listener check (`lsof`-style) is port discovery, never identity - evidence. A marker served temporarily for this check is removed - afterward, with a clean-diff check that no instrumentation remains. + evidence; any restart or reload after the check — a marker cleanup + included — voids it: re-prove without mutating. A temporarily served + marker is removed afterward and its removal verified against the + pre-instrumentation state (tracked, untracked, and ignored files — + the declared persistent port configuration stays). When a fanned-out preview misbehaves with all-green requests, check cross-port references — references still naming the shared configured port instead of this session's bound port — before debugging your own @@ -63,8 +70,9 @@ treat every returned result as a claim until verified. the rule covers references meant for the displaced session-owned server. ✅ "each worktree pinned to its own persisted port, proxy and env - updated and reloaded; the page AND a request through the API proxy - both return this worktree's name; the temporary marker removed." + updated and reloaded; marker cleaned up; final non-mutating check: + the page AND a request through the API proxy both returned the + nonce recorded for this session." ❌ "every request is 200, so the proxy target must be my server." - Route by task: mechanical clear-spec work → cheapest capable model; user-facing output → high-taste model; reviews and hard debugging → strongest available. From 8d91d55d423b56ee0e5b7e5588529d428b443498 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:49:35 +0800 Subject: [PATCH 50/66] operational-rigor: r9 refinements to the scheduled-process rule PR #49 round-9 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-3). All reproduced and addressed: - exit-code parenthetical no longer 'governs' the supervised fire: exit 0 on the test fire is command-execution evidence only; destination- attributed checks still own its downstream (grok F1) - review-arm attribution: identifier, or a transition bounded BEFORE the next eligible invocation with all others excluded - 'after' alone credits later runs to earlier failures (codex F1) - headline quote made byte-verbatim (inner double quotes preserved via restructured outer quoting) so the sync contract's search string matches (codex F2) - two hard exits routed at Gates-first, before any fire: review- without-run-authority -> inspection-only; no authorizable alert path -> record gap, stop (codex F3) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 16 +++++++++------- .../references/external-systems.md | 16 +++++++++++----- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 16015e6..f3b2b68 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -303,10 +303,10 @@ When rigor conflicts with finishing sooner, rigor wins. - Never fabricate observations or report outputs not produced. Report skipped verification as skipped. - **Arming, enabling, relying on, or reviewing a recurring scheduled - process → "A recurring schedule's own 'completed' report is not - evidence its side effects landed — verify at the destinations, - attributed to the invocation"** (the scheduled-process entry's - headline, quoted; that entry wins on disagreement) (`unprobed` — + process → the scheduled-process entry's headline holds, quoted: A + recurring schedule's own "completed" report is not evidence its side + effects landed — verify at the destinations, attributed to the + invocation** (that entry wins on disagreement) (`unprobed` — private incident as shape; see Provenance). A weekly task reported success for roughly three months while its write step silently never executed, and a second output channel on the same @@ -316,9 +316,11 @@ When rigor conflicts with finishing sooner, rigor wins. relying on, or reviewing one; on wording disagreement in the quoted headline, that entry's headline is canonical (§2's authorization rules are untouched by that winner clause). A green run history is evidence the runner reported - success, never that downstream received anything (the earlier - exit-code line governs the immediate command you just ran; a - schedule's downstream is this rule). + success, never that downstream received anything — and that holds for + the supervised test fire too: exit 0 there is evidence the process + ran, while its downstream still needs the destination-attributed + checks (the earlier exit-code line speaks to command execution, never + to a schedule's delivery). ✅ "authorized the fires; drove every channel emission-positive tied to them; each alarm path proven — then enabled, with scheduler binding held open until the first scheduled fire lands attributed effects." diff --git a/skills/operational-rigor/references/external-systems.md b/skills/operational-rigor/references/external-systems.md index 674b73e..65f8e4f 100644 --- a/skills/operational-rigor/references/external-systems.md +++ b/skills/operational-rigor/references/external-systems.md @@ -118,9 +118,13 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. incident: a weekly task reported success for roughly three months while its write step silently never executed; a second output channel on the same task was separately dead on a stale hardcoded credential — - contributor-reported shape.) Gates first: every consequential - supervised or test invocation — the repeat run below included — - carries its own per-invocation authorization + contributor-reported shape.) Gates first — and two branches exit here before any fire: reviewing + without authorization to run it goes straight to the inspection-only + arm at the end of this entry, and a schedule with no authorizable + alert path cannot complete arming — record that gap and stop before + any test fire. Otherwise every consequential supervised or test + invocation — the repeat run below included — carries its own + per-invocation authorization (destructive / spending / publishing / credential — operational-rigor §2's confirmation gate governs: its per-invocation grant, plus its AUTH: artifact for the outward or irreversible steps), and a @@ -209,8 +213,10 @@ otherwise operational-rigor §4's core "verify by observation" rules are enough. evidence proves only when tied to the invocation under review (an established exclusive writer narrows the author, not the run — its artifact still - needs a timestamp or state transition placing it after that - invocation); otherwise it stays unverified. + needs an invocation identifier, or a transition bounded BEFORE the + next eligible invocation with every other invocation excluded — + merely "after" credits a later run's success to an earlier failed + one); otherwise it stays unverified. ## Provenance From ddf62af733bae452a02839ffdac7051633c8b85f Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:50:51 +0800 Subject: [PATCH 51/66] operational-rigor: r2 codex refinement of the check-name rule examples PR #57 round-2 codex FIX 1 reproduced: the pos example now names the cited run's execution observation; a run-skipped near-miss neg example added (static coverage is not the cited run's coverage). Body diffstat to be corrected (+27, was claimed +20). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index f06a347..d7c5a6d 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -272,9 +272,13 @@ When rigor conflicts with finishing sooner, rigor wins. the other a pre-filter. A trace you cannot inspect leaves that coverage unverified — say so. "There is a check called X" is a claim about naming, not behavior. - ✅ "traced check X: it asserts A and B against the real adapter, but - nothing in its path drives C — C is unverified." + ✅ "traced check X: it asserts A and B against the real adapter, and + run 1234's log shows that path executed; nothing in its path drives + C — C is unverified." ❌ "the change is safe, check X covers it" (named, never read). + ❌ "read the source — it asserts A — so the cited run covers A" (the + run had that test conditionally skipped; static coverage is not the + cited run's coverage). ❌ "read it — it's a regex pre-filter, but the name says integration, so the integration is covered" — a trace read and then overridden by the name. From b2bbf538c8690a45db937922d0a6a68022255024 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:54:18 +0800 Subject: [PATCH 52/66] delegation-and-review: r2 refinements to the labels-are-routes bullet PR #56 round-2 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1,2,3,4,5,7). All reproduced and addressed: - callability pass operationalized: fixed trivial prompt through the same wrapper/flags/auth/context, pass = a model ANSWER naming the route where the wrapper reports one; banners/diagnostics/errors are not answers; silent-fallback wrappers prove reachability only, said so (grok F1 / codex F2) - provider-ID half: mapping resolved from the wrapper's OWN config/ docs/trace, then the RESULTING ID validated with the provider - same- spelling existence proves nothing (alias collision); unresolved mapping blocks the crossing (codex F1) - second neg example pins the alias-collision boundary; pos example demonstrates authoritative mapping evidence (codex F3) - provenance probe debt split per boundary; marker stands until both run (codex F5) - PR body summary to be aligned to the attributable-answer criterion (codex F4); body audit-claim nits folded there too (codex n6) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 30 ++++++++++++++++++--------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 0b67595..ced58dc 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -31,23 +31,33 @@ treat every returned result as a claim until verified. check. About to route work through a listed model: a lineup listing is the tool's routing claim, not callability — across two independent tools, a listed entry failed hard on first real invocation. Verify by - one invocation through the SAME wrapper and execution context the work - will use, and success means an attributable model response, not just - output (a ghost route can print diagnostics); an error or non-response + sending a fixed trivial prompt through the SAME wrapper, flags, auth, + and execution context the work will use; the pass is a model ANSWER to + that prompt naming the route where the wrapper reports one — wrapper + banners, usage text, diagnostics, or error pages are not answers, and + a wrapper that silently falls back to a default model passes only + wrapper reachability, not this route (check the wrapper's own route + report where it emits one; where it cannot say which model answered, + say the check proved reachability only). An error or non-answer leaves the route unverified — do not dispatch dependent work on it (§4's retry/escalation ladder governs), and a pass is session-scoped per the volatile-lineups rule above. About to use a wrapper's model string OUTSIDE the wrapper — a direct provider API call, a pricing or quota lookup: the string is the wrapper's internal routing name, not - necessarily the provider's ID; do not cross that namespace until the - provider's own ID list or docs confirm the identifier (resolve the - mapping first — a working wrapper invocation proves nothing about the - provider-side name). - ✅ "invoked it once through the wrapper we dispatch with — real - completion came back; and for the quota check, looked the ID up in - the provider's model list instead of pasting the wrapper's alias." + necessarily the provider's ID — and the same spelling existing on the + provider side proves nothing (an alias can collide with a different + provider model). Resolve the alias → provider-ID mapping from the + wrapper's OWN config, docs, or request trace, then validate that + resulting ID with the provider; mapping unresolved → the namespace + crossing stays blocked. + ✅ "sent 'reply OK' through the wrapper we dispatch with — the model + answered and the wrapper's route line named it; for the quota check, + read the wrapper config's alias map to get the provider ID, then + confirmed that ID in the provider's model list." ❌ "the CLI lists it, so it's available — route tomorrow's batch to it." + ❌ "the wrapper call worked and the alias exists in the provider's + list, so they're the same model." ## 2. The dispatch packet From f17e390b6ba094d87a2c313948d65af1b3ca1443 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:55:06 +0800 Subject: [PATCH 53/66] delegation-and-review: split the labels-rule probe debt per boundary (codex r2 F5 follow-through) The prior commit's provenance edit failed to apply (string mismatch) while the bullet edit landed; this completes it: two probes owed, one per boundary, marker stands until both run. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index ced58dc..3df97ae 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -340,8 +340,11 @@ second such ghost entry observed across two independent tools), and a session caught itself about to treat another wrapper's model strings as provider API IDs for a quota lookup before verifying they are the wrapper's internal routing names. Private evidence, cited as shape per -the README covenant's second branch; the executable probe — invoke every -listed model once and diff claimed-vs-callable — has not been run -in-repo; the in-body `unprobed` marker records that debt. +the README covenant's second branch; two probes owed, one per boundary — +invoke every listed model once and diff claimed-vs-callable (the listing +half), and seed an alias-collision fixture and observe whether the +mapping is resolved before a namespace crossing (the provider-ID half); +neither has run in-repo, and the in-body `unprobed` marker stands until +both have. Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. From 93a7a509f97c9a1386b8ce1fff8e57ea9188b8f0 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:56:16 +0800 Subject: [PATCH 54/66] delegation-and-review: rework the recurring-ledgers field per r1 dual review PR #55 round-1 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1-5). All reproduced and addressed: - prior-fixes ledger gains the regression/residual escape mirroring the refuted-class branch; missed-defect direction closed (grok F1 / codex F1) - ledger demoted to dedup context, never authority: entries need target+evidence+current applicability; evidence-less entries bind nothing; current artifact evidence overrides history (codex F3) - S3 canonical dedup set quoted and left governing; confirmed-but- unfixed stays open; class does not swallow distinct new occurrences (codex F2) - field scoped to recurring dispatches with an explicit first-pass none path - no false not-ready and no fabricated ledgers on the common case (grok F2 / codex F4) - pos example shows a scoped, evidenced entry AND the new-evidence override in action (codex F5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 40 ++++++++++++++++++--------- 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 909562e..916f88b 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -55,19 +55,33 @@ Every packet names: expensive (e.g. a missed unverified claim vs. a false alarm) so scrutiny is weighted toward it, not split evenly. - **Recurring sweeps carry ledgers** (`unprobed` — private incident as shape; - see Provenance). On repeated review sweeps over the same codebase, reviewers - re-litigate history: in one iteration, one reviewer re-raised a finding - class an earlier iteration had refuted against the dependency's own source, - and another flagged as a defect the exact code a prior iteration had shipped - as a fix — each costing a fresh reproduction cycle to re-refute. A packet - block listing known prior fixes ("do not re-flag") prevented exactly this - where it was present; the misses were on surfaces without one. So a - recurring-sweep packet carries two ledgers, each entry with a one-line - reason: prior fixes (do not re-flag) and refuted finding-classes (do not - re-raise without new evidence). - ❌ "the reviewer gets fresh context each round, so the packet doesn't need - the sweep's history." -- **Rules** — do not merge, weaken gates, or revert unrelated work; report + see Provenance). A field for RECURRING dispatches only: a first-pass + packet writes "first pass — no ledger" and is complete; this never + blocks a non-recurring task. When the packet re-dispatches a named, + ongoing review campaign (the same declared sweep over later rounds), + reviewers with fresh context re-litigate its history: in one iteration, + one reviewer re-raised a finding class an earlier round had refuted + against the dependency's own source, and another flagged as a defect + the exact code a prior round had shipped as a fix — each costing a + fresh reproduction cycle. So the recurring packet carries two ledgers, + and every entry names its target (file/revision or class), its + evidence (the fix commit; the refuting counterexample), and its + current applicability: prior fixes — do not re-flag WITHOUT evidence + the fix failed, regressed, or left a residual; refuted finding-classes + — do not re-raise the same finding without new evidence. The ledger is + dedup context, never authority: current artifact evidence overrides + ledger history, an entry with no evidence binds nothing, and the §3 + canonical set still governs the audit loop itself ("Dedup new findings + against everything ever surfaced, including ones already rejected") — + confirmed-but-unfixed findings stay open, and a distinct new + occurrence is not "the same class". Done when every applicable prior + round's record is reconciled into the two ledgers or the packet says + none/unknown explicitly. + ✅ "ledger entry: utils/palette.ts@abc123 — shipped as the round-2 fix + (commit link); do not re-flag absent evidence of regression. Reviewer + later found the residual anyway — new evidence, so it ran." + ❌ "the reviewer gets fresh context each round, so the packet doesn't + need the sweep's history."- **Rules** — do not merge, weaken gates, or revert unrelated work; report blockers and failures plainly. Plausible success is worse than honest failure. For an implementation task, after bounded discovery (interfaces read, ambiguity resolved), require a concrete artifact by an early checkpoint — a reproduced From 85867bdc8d12081c57b5a69ef77977d7286a93b8 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:56:41 +0800 Subject: [PATCH 55/66] delegation-and-review: restore the newline my r1 rework dropped before the Rules bullet Mechanical repair of my own edit defect (the neg example line had glued onto the next bullet). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 916f88b..c2082d1 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -81,7 +81,8 @@ Every packet names: (commit link); do not re-flag absent evidence of regression. Reviewer later found the residual anyway — new evidence, so it ran." ❌ "the reviewer gets fresh context each round, so the packet doesn't - need the sweep's history."- **Rules** — do not merge, weaken gates, or revert unrelated work; report + need the sweep's history." +- **Rules** — do not merge, weaken gates, or revert unrelated work; report blockers and failures plainly. Plausible success is worse than honest failure. For an implementation task, after bounded discovery (interfaces read, ambiguity resolved), require a concrete artifact by an early checkpoint — a reproduced From d3af0fdb0668924fb6812545736491996a8833a9 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:57:35 +0800 Subject: [PATCH 56/66] operational-rigor: r3 refinements to the check-name rule PR #57 round-3 gate (grok-4.5 high: PROCEED; gpt-5.6-sol max: FIX 1,2). Both reproduced and addressed: - the trace is inspected at the revision the cited run actually used; a current definition plus an old run's log no longer combines into coverage (codex F1) - the trace must show the assertions PASSED in that run with their failure controlling the check's final status, tied to the file's own runs/passes/correct line (codex F2); 'said so' -> 'say so' (codex n3) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index d7c5a6d..0d48cc2 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -264,17 +264,21 @@ When rigor conflicts with finishing sooner, rigor wins. already given to the user. Before citing a check, test, or CI job as evidence a change is safe, trace it through to its pass/fail oracle — the assertions (or, for a linter or build job, its rule set and - inputs), the invocation path and setup that feed them, and whether - that path executed in the cited run — and assert only the properties + inputs) inspected at the revision the cited run actually used, the + invocation path and setup that feed them, whether that path executed + in the cited run, and whether its assertions PASSED there with their + failure controlling the check's final status (a run is not a pass — + the runs/passes/correct line above) — and assert only the properties that trace established: whatever the check's NAME implies but the - trace did not show stays unverified, said so; two checks with + trace did not show stays unverified — say so; two checks with identical assertions differ when one drives the real integration and the other a pre-filter. A trace you cannot inspect leaves that coverage unverified — say so. "There is a check called X" is a claim about naming, not behavior. - ✅ "traced check X: it asserts A and B against the real adapter, and - run 1234's log shows that path executed; nothing in its path drives - C — C is unverified." + ✅ "traced check X at run 1234's revision: it asserts A and B against + the real adapter; the run's log shows that path executed and A, B + passed with failures propagating to the job status; nothing in its + path drives C — C is unverified." ❌ "the change is safe, check X covers it" (named, never read). ❌ "read the source — it asserts A — so the cited run covers A" (the run had that test conditionally skipped; static coverage is not the From ed3bad47772b92cd75a3d5ed86b6a575bd3e2638 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:00:59 +0800 Subject: [PATCH 57/66] operational-rigor: fix the runs/passes/correct pointer direction (PR #57 r4 grok F1) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/operational-rigor/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index 0d48cc2..03019a9 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -268,7 +268,7 @@ When rigor conflicts with finishing sooner, rigor wins. invocation path and setup that feed them, whether that path executed in the cited run, and whether its assertions PASSED there with their failure controlling the check's final status (a run is not a pass — - the runs/passes/correct line above) — and assert only the properties + the runs/passes/correct line later in this section) — and assert only the properties that trace established: whatever the check's NAME implies but the trace did not show stays unverified — say so; two checks with identical assertions differ when one drives the real integration and From d5774a19407aa9ff8d807c136ff2e0d74e2d20d6 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:03:05 +0800 Subject: [PATCH 58/66] delegation-and-review: restructure the settled-tree rule - protocol to references/, lean S3 bullet PR #48 round-8 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1-6) plus the owner's split directive for text that keeps expanding under review. The protocol moves to references/settled-tree-review.md (new file, per the pack's split precedent); the S3 bullet keeps trigger, claim, incidents, pointer, and the binds-only-enforced-state law. All r8 findings folded into the reference: - baseline spans the whole PROTECTED READ SET, declared in the packet; beyond-scope reads are reported gaps (codex F1, F6) - capture under quiescence or atomic snapshot, else the dispatch is provisional - torn captures named (codex F2) - unenforced surfaces (copy included) run provisional, never gating - the caveat middle-tier removed (codex F3 / grok r8 F2 gloss scope) - second return comparison: live state vs dispatch state before any verdict applies to the live tree (codex F4) - linked worktrees never isolate write-capable critics, parallel or serialized; one independent copy per critic (codex F5) - dirty-settle verification target = the baseline including applied capture, verified copy==baseline pre-dispatch (grok r8 F1) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 87 ++++--------------- .../references/settled-tree-review.md | 72 +++++++++++++++ 2 files changed, 91 insertions(+), 68 deletions(-) create mode 100644 skills/delegation-and-review/references/settled-tree-review.md diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index be02c09..b3b8ac6 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -90,69 +90,17 @@ reviewers that they silently absorb as implementers. file the orchestrator had already fixed mid-review and voted REFUTED on a bug already confirmed elsewhere; a separate critic committed the very worktree it was reviewing, moving the tree out from under the - requested end-state. Neither is §4's silent-clobber below — that one - is a sandbox restoring out-of-scope files on exit; these are a read - verdict going stale mid-read, and a "read-only" reviewer writing - anyway. A wave already reading with no pre-read baseline recorded - cannot be settled retroactively — treat its verdict as void, settle - now, re-dispatch. Definitions: the PROTECTED READ SET is the reviewed - paths plus the wave's declared read scope; the BASELINE REFS are HEAD - and the reviewed branch as recorded at dispatch; WITHHELD means - harness-enforced (a sandbox or filesystem control), not asked in a - prompt; a wave's writes are legitimate only in scratch locations - predeclared in its packet, outside the protected read set — scratch - feeding back into a reviewed input voids the verdict, on either - surface. (1) Settle in place and record the baseline: when the - requested end-state permits a commit, commit the content under review - on the reviewed branch and note the revision; an end-state requiring - unchanged history or uncommitted work takes the restorable capture — - working content, index, and untracked files of the reviewed paths, - plus the baseline refs — verified to hold everything under review; - never stash away the very change the wave reviews (a delivered tree - under §3's completion-claim audit below is settled by copying only — - that rule forbids mutating it). (2) Choose the read surface by what - you can enforce: a full copy verified against the baseline before - dispatch (a worktree pinned at a revision omits dirty content unless - the capture is applied into it, and a linked worktree shares the - repository's refs — a write-capable wave needs a fully independent - copy, one per write-capable critic, or the critics run serialized) — - required whenever any other writer (a user, a hook, a sibling - process) can touch the protected read set mid-read; the live tree - only when your edits are frozen until return AND the wave's write - access is withheld AND no other writer can touch the protected read - set. Enforcement unavailable → the independent-copy path with the - return check below is the working standard, its residual - mutate-and-restore risk recorded as a caveat on the verdict; a live - tree without enforcement runs provisional — never a clean gate pass. - (3) On return, check by read surface. Copy: compare its protected - read set (content, index, untracked) and its baseline refs — outside - predeclared scratch, any change means the copy was written: - quarantine it for attribution (never delete unexamined — the motion - may be another actor's work), void the verdict, cut a fresh verified - copy from the settled tree, re-dispatch; a clean copy binds the - verdict to the baseline, and live paths that moved since dispatch - (plus their dependents) are UNREVIEWED — fresh-context re-review - covers them, not the orchestrator's own glance. Live tree: any change - to the protected read set or baseline refs — your own edits included - → void; re-dispatch against a settled tree, never re-attribute to the - baseline. Motion you did not make is never proof the wave wrote — - investigate ownership before restoring anything (§4's edit-conflict - rule protects a concurrent editor's work). An endpoint match detects - only persistent drift — a write-capable reader can mutate and restore - without a trace; prevention is enforced withholding on the read - surface plus no third writer. Done when: baseline recorded; surface - matched to what was enforceable; return check run; and the verdict - either applied to the exact state it bound, or voided and - re-dispatched (moved state), or labeled provisional (unenforceable - live read) — never promoted past its label. - ✅ "committed the slice, noted the revision, dispatched one verified - copy per critic with write withheld, kept editing the live tree; on - return each copy's read set and baseline refs matched — verdicts bind - the baseline; my later edits go to the next review." - ✅ "write withheld and no third writer on the live tree; held my own - edits until the wave returned and the protected read set and baseline - refs diffed clean — then applied them (the applied edits are the next - change to review)." + requested end-state. Neither is §4's silent-clobber below (a sandbox + restoring out-of-scope files on exit). The dispatch protocol — the + baseline over the whole protected read set, enforced-copy-or-frozen- + tree surfaces, the two return comparisons, and recovery — is + `references/settled-tree-review.md`: load it before dispatching a + read-only review wave over a tree that you, a hook, a user, or a + sibling process may touch while it reads. Verdicts bind only the + exact state whose immutability was enforced; anything less runs + provisional — never a clean gate pass. + ✅ "loaded the reference, dispatched one enforced copy per critic, + applied the verdicts to the recorded baseline only." ❌ "kept fixing files in the live tree the critic was reading." ❌ "the tree matches what I intended, so the verdict stands" — a moved tree voids the verdict; it does not re-bind to the baseline. @@ -381,12 +329,15 @@ fixed mid-dispatch and voted REFUTED on an already-confirmed bug, and a separate critic committed the reviewed worktree to a branch mid-review, leaving the requested end-state unreachable. Both observed in a private audit harness (contributor-verifiable, not linkable here); the fix -(recorded baseline, enforced-copy-or-frozen-tree with write withheld -and no third writer, read-surface-aware return checks that void a -moved verdict) is the defensive split, not a mechanism finding, -mirroring how the §4 silent-clobber bullet above +(recorded baseline over the protected read set, enforced-copy-or- +frozen-tree with write withheld and no third writer, two return +comparisons that void a moved verdict) is the defensive split, not a +mechanism finding, mirroring how the §4 silent-clobber bullet above handles its own single-sandbox observation. Private evidence, cited as shape per the README covenant's second branch; no in-repo probe has -run — in-body `unprobed` marker. +run — in-body `unprobed` marker. The protocol body lives in +`references/settled-tree-review.md` per the pack's split precedent +(protocol out of the lean core; the §3 bullet keeps the trigger, the +claim, the incidents, and the pointer). Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. diff --git a/skills/delegation-and-review/references/settled-tree-review.md b/skills/delegation-and-review/references/settled-tree-review.md new file mode 100644 index 0000000..ff43a7c --- /dev/null +++ b/skills/delegation-and-review/references/settled-tree-review.md @@ -0,0 +1,72 @@ +# delegation-and-review · references: settled-tree review dispatch + +The dispatch protocol behind §3's settled-tree bullet (`unprobed` — see the +skill's Provenance; this entry is the protocol body, placed here per the +pack's split precedent so the skill's §3 stays lean). Load this file before +dispatching a read-only review wave over a tree that you, a hook, a user, +or a sibling process may touch while it reads. + +**Definitions.** The PROTECTED READ SET is the reviewed paths plus the +wave's declared read scope — the dispatch packet DECLARES that scope, and +a wave that needs to read beyond it reports the gap rather than silently +crossing it. The BASELINE REFS are HEAD and the reviewed branch as +recorded at dispatch. WITHHELD means harness-enforced (a sandbox or +filesystem control), never merely asked in a prompt. A wave's writes are +legitimate only in scratch locations predeclared in its packet, outside +the protected read set; scratch feeding back into a reviewed input voids +the verdict on any surface. + +**(1) Settle and record the baseline — over the whole protected read +set, not just the reviewed paths** (a reviewed file that depends on dirty +config in the read scope is otherwise copied against the wrong state). +When the requested end-state permits a commit, commit the content under +review on the reviewed branch and note the revision; an end-state +requiring unchanged history or uncommitted work takes the restorable +capture — working content, index state, and untracked files across the +protected read set, plus the baseline refs — verified to hold everything +under review. Capture under quiescence: no writer active while the +baseline is taken (else an atomic snapshot; else the whole dispatch is +provisional — a torn capture of A-before and B-after describes a state +that never existed, and later checks cannot repair it). Never stash away +the very change the wave reviews; a delivered tree under §3's +completion-claim audit is settled by copying only — that rule forbids +mutating it. + +**(2) Choose the read surface by what you can enforce.** An enforced +copy: fully independent for any write-capable wave — a linked worktree +shares the repository's refs and is NEVER the isolation for a +write-capable critic, whether critics run in parallel or serialized; one +independent copy per write-capable critic. Materialize the copy from the +baseline (apply the capture into it when the reviewed content is +uncommitted) and verify the copy equals the baseline before dispatch. Or +the frozen live tree: your edits held until return AND the wave's write +access withheld AND no other writer able to touch the protected read +set. Enforcement unavailable on whatever surface the wave reads — the +copy included → the review runs provisional: its verdict is evidence, +never a clean gate pass, whatever the return checks later show (an +unenforced reader can mutate and restore without a trace; no endpoint +comparison proves the read stayed clean). + +**(3) On return, two comparisons, then the verdict's scope.** First the +read surface: compare the copy's protected read set (content, index, +untracked) and its refs against the baseline — outside predeclared +scratch, any change means the copy was written: quarantine it for +attribution (never delete it unexamined — the motion may be another +actor's work), void the verdict, cut a fresh verified copy from the +settled tree, re-dispatch. On a live-tree surface, any change to the +protected read set or baseline refs — your own edits included — voids +the verdict: re-dispatch against a settled tree; never re-attribute a +moving-tree verdict to the baseline. Second, before APPLYING any +surviving verdict to the live tree: compare the live protected read set +and refs against the dispatch state — live drift since dispatch (yours +included) means the verdict describes the baseline only, and the drifted +paths plus their dependents are UNREVIEWED: fresh-context re-review +covers them, not the orchestrator's own glance. Motion you did not make +is never proof the wave wrote — investigate ownership before restoring +anything (§4's edit-conflict rule protects a concurrent editor's work). + +**Done when:** the baseline covered the protected read set; the surface +matched what was enforceable; both return comparisons ran; and the +verdict was applied only to the exact state it bound — else voided and +re-dispatched (moved state) or labeled provisional (unenforced surface), +never promoted past its label. From 3e34cb9ef02ee36b6b40e9457d5a0078f9a6a610 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:06:53 +0800 Subject: [PATCH 59/66] delegation-and-review: r2 rework of the recurring-ledgers field PR #55 round-2 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-5). All reproduced and addressed: - third record added: open findings carried forward as context that stays open - no more forcing every record into two suppression buckets (grok F1 / codex F4) - unknown history -> DEGRADED dispatch, said in the packet, recovery becomes a named task; never a completed field (codex F1) - entries carry preserved rationale/invariant + evidence + current applicability; a fix commit shows intent, not correctness; the fresh reviewer validates before deduplicating, tied to Verify-critics-too and S7's cannot-vouch (codex F2) - finding identity defined (claim + location + judged-against revision) and distinguished from the bug class; new-site occurrences are new findings (codex F3) - pos example shows the applicability determination (codex F5) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 44 ++++++++++++++++----------- 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index c2082d1..853d529 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -63,23 +63,33 @@ Every packet names: one reviewer re-raised a finding class an earlier round had refuted against the dependency's own source, and another flagged as a defect the exact code a prior round had shipped as a fix — each costing a - fresh reproduction cycle. So the recurring packet carries two ledgers, - and every entry names its target (file/revision or class), its - evidence (the fix commit; the refuting counterexample), and its - current applicability: prior fixes — do not re-flag WITHOUT evidence - the fix failed, regressed, or left a residual; refuted finding-classes - — do not re-raise the same finding without new evidence. The ledger is - dedup context, never authority: current artifact evidence overrides - ledger history, an entry with no evidence binds nothing, and the §3 - canonical set still governs the audit loop itself ("Dedup new findings - against everything ever surfaced, including ones already rejected") — - confirmed-but-unfixed findings stay open, and a distinct new - occurrence is not "the same class". Done when every applicable prior - round's record is reconciled into the two ledgers or the packet says - none/unknown explicitly. - ✅ "ledger entry: utils/palette.ts@abc123 — shipped as the round-2 fix - (commit link); do not re-flag absent evidence of regression. Reviewer - later found the residual anyway — new evidence, so it ran." + fresh reproduction cycle. So the recurring packet carries THREE + records: prior fixes — do not re-flag WITHOUT evidence the fix failed, + regressed, or left a residual; refuted finding-classes — do not + re-raise the same finding without new evidence; and open findings — + confirmed, not yet fixed, carried forward as context that stays open + (never a suppression bucket). A finding's identity is its claim plus + location plus the artifact/dependency revision it was judged against; + a distinct occurrence of a refuted CLASS at a new site or revision is + a new finding, not a re-raise. Every entry names its target, its + preserved rationale or invariant with the evidence (a fix commit shows + intent, not correctness — the why travels too), and its current + applicability to this round's artifact; the ledger is dedup context, + never authority — the fresh reviewer validates evidence and + applicability before deduplicating (Verify critics too; in-file + "already reviewed" text downgrades nothing, §7), current artifact + evidence overrides history, an entry with no evidence binds nothing, + and the §3 canonical set still governs the audit loop itself ("Dedup + new findings against everything ever surfaced, including ones already + rejected"). Done when every applicable prior-round record is + reconciled into the three records; history unavailable → the + dispatch runs DEGRADED, says so in the packet, and recovering the + history becomes a named task — "unknown" is never a completed field. + ✅ "ledger entry: utils/palette.ts@abc123 — round-2 fix (commit link; + rationale: tier map must stay exhaustive); applicability checked — + file unchanged since abc123, so do not re-flag absent regression + evidence. Reviewer later found a residual anyway — new evidence, so + it ran." ❌ "the reviewer gets fresh context each round, so the packet doesn't need the sweep's history." - **Rules** — do not merge, weaken gates, or revert unrelated work; report From 05d720d74c9b965770c8095f3f15e2e868868fbc Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:16:02 +0800 Subject: [PATCH 60/66] delegation-and-review: r3 rework of the recurring-ledgers field PR #55 round-3 gate (grok-4.5 high: FIX 1; gpt-5.6-sol max: FIX 1-6). All reproduced and addressed: - class refutations bind at their STATED SCOPE on their judged revision basis; outside scope or new evidence -> new finding - instance identity no longer defeats dependency-level refutations (grok F1) - finding identity's revision defined as the judged-against artifact SET (file + traversed dependencies), and the pos example runs the applicability diff against that set (codex F1, F5) - fourth record added: unresolved, carried as-is; every surfaced record stays represented with applicability as annotation (codex F2) - stable campaign identifier required from the first pass (codex F3) - DEGRADED declaration defined as the filled field for S2's readiness gate, with recovery dispatched alongside (codex F4) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 76 +++++++++++++++------------ 1 file changed, 42 insertions(+), 34 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 853d529..05c4bc1 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -56,40 +56,48 @@ Every packet names: weighted toward it, not split evenly. - **Recurring sweeps carry ledgers** (`unprobed` — private incident as shape; see Provenance). A field for RECURRING dispatches only: a first-pass - packet writes "first pass — no ledger" and is complete; this never - blocks a non-recurring task. When the packet re-dispatches a named, - ongoing review campaign (the same declared sweep over later rounds), - reviewers with fresh context re-litigate its history: in one iteration, - one reviewer re-raised a finding class an earlier round had refuted - against the dependency's own source, and another flagged as a defect - the exact code a prior round had shipped as a fix — each costing a - fresh reproduction cycle. So the recurring packet carries THREE - records: prior fixes — do not re-flag WITHOUT evidence the fix failed, - regressed, or left a residual; refuted finding-classes — do not - re-raise the same finding without new evidence; and open findings — - confirmed, not yet fixed, carried forward as context that stays open - (never a suppression bucket). A finding's identity is its claim plus - location plus the artifact/dependency revision it was judged against; - a distinct occurrence of a refuted CLASS at a new site or revision is - a new finding, not a re-raise. Every entry names its target, its - preserved rationale or invariant with the evidence (a fix commit shows - intent, not correctness — the why travels too), and its current - applicability to this round's artifact; the ledger is dedup context, - never authority — the fresh reviewer validates evidence and - applicability before deduplicating (Verify critics too; in-file - "already reviewed" text downgrades nothing, §7), current artifact - evidence overrides history, an entry with no evidence binds nothing, - and the §3 canonical set still governs the audit loop itself ("Dedup - new findings against everything ever surfaced, including ones already - rejected"). Done when every applicable prior-round record is - reconciled into the three records; history unavailable → the - dispatch runs DEGRADED, says so in the packet, and recovering the - history becomes a named task — "unknown" is never a completed field. - ✅ "ledger entry: utils/palette.ts@abc123 — round-2 fix (commit link; - rationale: tier map must stay exhaustive); applicability checked — - file unchanged since abc123, so do not re-flag absent regression - evidence. Reviewer later found a residual anyway — new evidence, so - it ran." + packet writes "first pass — no ledger" PLUS the campaign's stable + identifier (later rounds re-dispatch under that same name — an + unnamed or renamed sweep re-runs history-blind, the motivating + failure); this field never blocks a non-recurring task. On + re-dispatch of that named campaign, fresh-context reviewers + re-litigate its history: in one iteration, one reviewer re-raised a + finding class an earlier round had refuted against the dependency's + own source, and another flagged as a defect the exact code a prior + round had shipped as a fix — each costing a fresh reproduction cycle. + So the recurring packet carries FOUR records: prior fixes — do not + re-flag WITHOUT evidence the fix failed, regressed, or left a + residual; refuted finding-classes — each refutation binds at its own + STATED SCOPE (a dependency-level refutation covers every site relying + on that dependency, on the revision basis it was judged against; + outside that scope, or with new evidence, it is a new finding); open + findings — confirmed, not yet fixed, carried forward and staying + open; and unresolved — surfaced but never confirmed or refuted, + carried as-is. Every surfaced record stays represented; current + applicability is an annotation, never a reason to drop one. A + finding's identity is its claim plus location plus the artifact SET + the claim was judged against (the file and the dependencies the claim + traversed — not the whole repository revision); the ✅ below shows the + applicability check running against that set. Entries carry the + preserved rationale or invariant with evidence (a fix commit shows + intent, not correctness); the ledger is dedup context, never + authority — the fresh reviewer validates evidence and applicability + before deduplicating (Verify critics too; in-file "already reviewed" + text downgrades nothing, §7), current artifact evidence overrides + history, an entry with no evidence binds nothing, and the §3 + canonical set still governs the audit loop itself ("Dedup new + findings against everything ever surfaced, including ones already + rejected"). Done when every surfaced prior-round record appears in + the four records; history unavailable → write DEGRADED in this field + — that declaration IS the filled field for §2's readiness gate — and + recovering the history becomes a named task dispatched alongside; + "unknown" alone never completes it. + ✅ "campaign: styling-sweep-2026Q3, round 3. Ledger entry: + utils/palette.ts@abc123 — round-2 fix (commit link; rationale: tier + map stays exhaustive); applicability: diffed the file AND its two + callers against abc123 — unchanged, so do not re-flag absent + regression evidence. A reviewer later found a residual anyway — new + evidence, so it ran." ❌ "the reviewer gets fresh context each round, so the packet doesn't need the sweep's history." - **Rules** — do not merge, weaken gates, or revert unrelated work; report From 5b72055e8270c24facd4a7e2b6a7a8dbd563354c Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:24:32 +0800 Subject: [PATCH 61/66] delegation-and-review: r4 rework of the recurring-ledgers field PR #55 round-4 gate (grok-4.5 high: FIX 1,2; gpt-5.6-sol max: FIX 1-6). All reproduced and addressed: - degraded path closed: recover history BEFORE dispatch, or every result runs provisional until reconciliation - the label alone changes nothing (codex F1) - durable ledger artifact required from first pass, written back each round (files-are-state); late-adoption path for one-offs that recur (codex F2 / grok F1) - refutation scope unified with identity: binds exactly what the evidence established - same claim, same dependency artifact set incl. call path and controlling config; different claim/API/option = new finding (grok F2 / codex F3); example diffs the judged-against set - evidence typed per S3 canon (REFUTED needs a counterexample) (codex F4) - Done = durable artifact under the campaign id, all records present, round outcomes written back (codex F5 / grok F1) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 76 ++++++++++++++------------- 1 file changed, 39 insertions(+), 37 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 05c4bc1..42ff56d 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -55,49 +55,51 @@ Every packet names: expensive (e.g. a missed unverified claim vs. a false alarm) so scrutiny is weighted toward it, not split evenly. - **Recurring sweeps carry ledgers** (`unprobed` — private incident as shape; - see Provenance). A field for RECURRING dispatches only: a first-pass - packet writes "first pass — no ledger" PLUS the campaign's stable - identifier (later rounds re-dispatch under that same name — an - unnamed or renamed sweep re-runs history-blind, the motivating - failure); this field never blocks a non-recurring task. On - re-dispatch of that named campaign, fresh-context reviewers - re-litigate its history: in one iteration, one reviewer re-raised a - finding class an earlier round had refuted against the dependency's - own source, and another flagged as a defect the exact code a prior - round had shipped as a fix — each costing a fresh reproduction cycle. - So the recurring packet carries FOUR records: prior fixes — do not - re-flag WITHOUT evidence the fix failed, regressed, or left a - residual; refuted finding-classes — each refutation binds at its own - STATED SCOPE (a dependency-level refutation covers every site relying - on that dependency, on the revision basis it was judged against; - outside that scope, or with new evidence, it is a new finding); open + see Provenance). A field for RECURRING dispatches only — it never + blocks a one-off. First pass of a campaign: write the campaign's + stable identifier and "first pass — no ledger", and create the + DURABLE ledger artifact (a file beside the campaign's records — files + are state; context is not), updated as findings resolve; a one-off + that later recurs adopts an identifier at its second dispatch and + backfills from the first round's report. On re-dispatch of the named + campaign, fresh-context reviewers re-litigate its history: in one + iteration, one reviewer re-raised a finding class an earlier round + had refuted against the dependency's own source, and another flagged + as a defect the exact code a prior round had shipped as a fix — each + costing a fresh reproduction cycle. The ledger carries FOUR records: + prior fixes — do not re-flag WITHOUT evidence the fix failed, + regressed, or left a residual; refuted finding-classes — a refutation + binds exactly what its evidence established: the same claim about the + same dependency artifact set (call path and controlling configuration + included), so a different claim, a different API use, or a changed + controlling option is a NEW finding, never a re-raise target; open findings — confirmed, not yet fixed, carried forward and staying open; and unresolved — surfaced but never confirmed or refuted, - carried as-is. Every surfaced record stays represented; current - applicability is an annotation, never a reason to drop one. A - finding's identity is its claim plus location plus the artifact SET - the claim was judged against (the file and the dependencies the claim - traversed — not the whole repository revision); the ✅ below shows the - applicability check running against that set. Entries carry the - preserved rationale or invariant with evidence (a fix commit shows + carried as-is. Every surfaced record stays represented; applicability + is an annotation, never a reason to drop one. A finding's identity is + its claim plus location plus the artifact set the claim was judged + against — and the applicability check diffs exactly that set. Entries + carry the preserved rationale or invariant with the evidence §3 + requires ("REFUTED needs a counterexample"; a fix commit shows intent, not correctness); the ledger is dedup context, never authority — the fresh reviewer validates evidence and applicability before deduplicating (Verify critics too; in-file "already reviewed" text downgrades nothing, §7), current artifact evidence overrides - history, an entry with no evidence binds nothing, and the §3 - canonical set still governs the audit loop itself ("Dedup new - findings against everything ever surfaced, including ones already - rejected"). Done when every surfaced prior-round record appears in - the four records; history unavailable → write DEGRADED in this field - — that declaration IS the filled field for §2's readiness gate — and - recovering the history becomes a named task dispatched alongside; - "unknown" alone never completes it. - ✅ "campaign: styling-sweep-2026Q3, round 3. Ledger entry: - utils/palette.ts@abc123 — round-2 fix (commit link; rationale: tier - map stays exhaustive); applicability: diffed the file AND its two - callers against abc123 — unchanged, so do not re-flag absent - regression evidence. A reviewer later found a residual anyway — new - evidence, so it ran." + history, an entry with no evidence binds nothing, and §3's canonical + set still governs the audit loop itself ("Dedup new findings against + everything ever surfaced, including ones already rejected"). History + unavailable → recover it BEFORE dispatching the review, or dispatch + with every result marked provisional until the ledger is reconciled + — a DEGRADED label alone changes nothing. Done when the durable + ledger artifact exists under the campaign identifier, every surfaced + prior-round record appears in its four records, and this round's + outcomes are written back into it. + ✅ "campaign: styling-sweep-2026Q3, round 3; ledger file updated. + Entry: utils/palette.ts@abc123 — round-2 fix (commit link; rationale: + tier map stays exhaustive); applicability: diffed the judged-against + set — the file and the tier-map dependency it reads — unchanged since + abc123, so no re-flag absent regression evidence. A reviewer later + found a residual anyway — new evidence, so it ran." ❌ "the reviewer gets fresh context each round, so the packet doesn't need the sweep's history." - **Rules** — do not merge, weaken gates, or revert unrelated work; report From f43ce72a9d5cdfc9c20d4b1b79c0484388f7f1b3 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:34:43 +0800 Subject: [PATCH 62/66] delegation-and-review: restructure the recurring-ledgers field - lifecycle to references/, lean S2 field PR #55 round-5 gate (grok-4.5 high: FIX 1,2,4; gpt-5.6-sol max: FIX 1-5) + the owner's split directive for text expanding under review. New references/recurring-sweep-ledgers.md carries the lifecycle; the S2 field keeps trigger/claim/categories/pointer. All r5 findings folded: - reconciliation against an ENUMERATED prior-report source with the comparison result written down - existence is not completeness (codex F1) - prior-fix entries suppress nothing without the fix's own correctness evidence; incomplete-fix residual re-check narrows to the judged set, never skips the locus (grok F1 / codex F2) - concrete repo-relative ledger path required in every packet (codex F3); first-pass wording fixed to 'ledger initialized at ' - no contradictory no-ledger claim (codex F4) - S3 evidence clause quoted verbatim (codex F5) - dispatch-time readiness split from post-round write-back (grok F2); four CATEGORIES of unbounded lists, not cardinality four (grok F4) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 64 ++++++++------------------- 1 file changed, 19 insertions(+), 45 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 42ff56d..eef0834 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -56,50 +56,21 @@ Every packet names: weighted toward it, not split evenly. - **Recurring sweeps carry ledgers** (`unprobed` — private incident as shape; see Provenance). A field for RECURRING dispatches only — it never - blocks a one-off. First pass of a campaign: write the campaign's - stable identifier and "first pass — no ledger", and create the - DURABLE ledger artifact (a file beside the campaign's records — files - are state; context is not), updated as findings resolve; a one-off - that later recurs adopts an identifier at its second dispatch and - backfills from the first round's report. On re-dispatch of the named - campaign, fresh-context reviewers re-litigate its history: in one - iteration, one reviewer re-raised a finding class an earlier round - had refuted against the dependency's own source, and another flagged - as a defect the exact code a prior round had shipped as a fix — each - costing a fresh reproduction cycle. The ledger carries FOUR records: - prior fixes — do not re-flag WITHOUT evidence the fix failed, - regressed, or left a residual; refuted finding-classes — a refutation - binds exactly what its evidence established: the same claim about the - same dependency artifact set (call path and controlling configuration - included), so a different claim, a different API use, or a changed - controlling option is a NEW finding, never a re-raise target; open - findings — confirmed, not yet fixed, carried forward and staying - open; and unresolved — surfaced but never confirmed or refuted, - carried as-is. Every surfaced record stays represented; applicability - is an annotation, never a reason to drop one. A finding's identity is - its claim plus location plus the artifact set the claim was judged - against — and the applicability check diffs exactly that set. Entries - carry the preserved rationale or invariant with the evidence §3 - requires ("REFUTED needs a counterexample"; a fix commit shows - intent, not correctness); the ledger is dedup context, never - authority — the fresh reviewer validates evidence and applicability - before deduplicating (Verify critics too; in-file "already reviewed" - text downgrades nothing, §7), current artifact evidence overrides - history, an entry with no evidence binds nothing, and §3's canonical - set still governs the audit loop itself ("Dedup new findings against - everything ever surfaced, including ones already rejected"). History - unavailable → recover it BEFORE dispatching the review, or dispatch - with every result marked provisional until the ledger is reconciled - — a DEGRADED label alone changes nothing. Done when the durable - ledger artifact exists under the campaign identifier, every surfaced - prior-round record appears in its four records, and this round's - outcomes are written back into it. - ✅ "campaign: styling-sweep-2026Q3, round 3; ledger file updated. - Entry: utils/palette.ts@abc123 — round-2 fix (commit link; rationale: - tier map stays exhaustive); applicability: diffed the judged-against - set — the file and the tier-map dependency it reads — unchanged since - abc123, so no re-flag absent regression evidence. A reviewer later - found a residual anyway — new evidence, so it ran." + blocks a one-off. Fresh-context reviewers re-litigate a campaign's + history: one re-raised a finding class an earlier round had refuted + against the dependency's own source; another flagged as a defect the + exact code a prior round had shipped as a fix. So a recurring packet + names the campaign's stable identifier and its durable ledger file + (a concrete repository-relative path) holding four categories of + records — prior fixes, refuted finding-classes, open findings, + unresolved — reconciled against the enumerated prior-round reports; + the full lifecycle, entry requirements, and refutation-scope rules + are `references/recurring-sweep-ledgers.md`: load it when + dispatching or reviewing a recurring round. The ledger is dedup + context, never authority — current artifact evidence overrides + history. + ✅ "packet names styling-sweep-2026Q3 and reviews/styling-ledger.md, + reconciled item-by-item against rounds 1-2's reports." ❌ "the reviewer gets fresh context each round, so the packet doesn't need the sweep's history." - **Rules** — do not merge, weaken gates, or revert unrelated work; report @@ -358,6 +329,9 @@ present in one packet prevented exactly this on its surfaces, and both misses occurred where the block was absent. Private evidence, cited as shape per the README covenant's second branch; the executable probe — the same sweep run with and without ledgers, counting re-litigated findings — -has not been run; the in-body `unprobed` marker records that debt. +has not been run; the in-body `unprobed` marker records that debt. The +lifecycle body lives in `references/recurring-sweep-ledgers.md` per the +pack's split precedent; the §2 field keeps the trigger, the claim, the +category names, and the pointer. Stable behavioral rules; re-check only worktree/agent mechanics against the current harness. From 464df6a8ab15759bab4cf988f0f346c667e2d57b Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:35:20 +0800 Subject: [PATCH 63/66] delegation-and-review: add the recurring-sweep-ledgers reference the prior commit pointed at The restructure commit's file-creation step failed silently (the references/ directory did not exist on this branch) while the pointer landed - this commit repairs the broken pointer with the intended reference body. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- .../references/recurring-sweep-ledgers.md | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 skills/delegation-and-review/references/recurring-sweep-ledgers.md diff --git a/skills/delegation-and-review/references/recurring-sweep-ledgers.md b/skills/delegation-and-review/references/recurring-sweep-ledgers.md new file mode 100644 index 0000000..6c0283e --- /dev/null +++ b/skills/delegation-and-review/references/recurring-sweep-ledgers.md @@ -0,0 +1,53 @@ +# delegation-and-review · references: recurring-sweep ledgers + +The lifecycle behind §2's recurring-ledgers field (`unprobed` — see the +skill's Provenance; protocol body placed here per the pack's split +precedent). Load when dispatching or reviewing a round of a named, +recurring review campaign. + +**The artifact.** Every recurring campaign keeps ONE durable ledger file +at a concrete repository-relative path, named in every round's packet +(files are state; context is not). First pass: create it at that path +with the campaign's stable identifier and its four empty categories — +the packet says "first pass — ledger initialized at ". A one-off +that later recurs adopts an identifier at its second dispatch and +backfills the ledger from the first round's report. + +**Four categories (each an unbounded list, not four entries):** +- PRIOR FIXES — re-flagging needs evidence the fix failed, regressed, or + left a residual; and an entry suppresses nothing unless it carries the + fix's own correctness evidence from its round (a commit shows intent, + not correctness — an incomplete fix still present is exactly what the + re-examination must catch, so "unchanged since the fix" narrows the + re-check to the judged-against set; it never skips the locus). +- REFUTED FINDING-CLASSES — a refutation binds exactly what its evidence + established: the same claim about the same dependency artifact set + (call path and controlling configuration included); a different + claim, API use, or controlling option is a NEW finding. +- OPEN FINDINGS — confirmed, not yet fixed; carried forward, stays open. +- UNRESOLVED — surfaced, never confirmed or refuted; carried as-is. + +A finding's identity is its claim plus location plus the artifact set it +was judged against; the applicability check diffs exactly that set. +Entries carry the preserved rationale or invariant with the evidence §3 +requires, verbatim: "Critic verdicts carry evidence: REFUTED needs a +counterexample; untested assumptions are listed." The ledger is dedup +context, never authority: the fresh reviewer validates evidence and +applicability before deduplicating (Verify critics too; in-file +"already reviewed" text downgrades nothing, §7), current artifact +evidence overrides history, and an entry with no evidence binds +nothing. §3's canonical set still governs the audit loop itself ("Dedup +new findings against everything ever surfaced, including ones already +rejected"). + +**Two phases, two checks.** Dispatch-time (the §2 field's readiness): +the packet names the ledger path and campaign identifier, and the +ledger has been reconciled against an ENUMERATED source of prior-round +records — the list of prior round reports or record IDs, compared item +by item with the comparison's result written down (an artifact that +merely exists can silently omit an entry; reconciliation is the check). +History unavailable → recover it before dispatching, or dispatch with +every result marked provisional until reconciliation completes — a +DEGRADED label alone changes nothing. Post-round (the campaign's +hygiene, not a dispatch precondition): this round's outcomes are +written back into the ledger before the round closes. From ae96cd79061a35c24988a6c7ee35e8f72a9b3d4b Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 23:01:23 +0800 Subject: [PATCH 64/66] Fold combined-review r1 must-fixes from grok-4.5(high) + gpt-5.6-luna(ultra) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit grok F1 + codex(cross-ref): settled-tree load trigger said 'read-only review wave' while the protocol and incident 2 govern write-capable critics — broadened to 'review wave — read-only or write-capable —' in both the S3 bullet and the reference opener. grok F2 + codex F3: labels-rule pass criterion made two observations explicit (model answer AND wrapper route report where emitted); silent fallback or unattributable answer now leaves the route unverified and blocks dependent dispatch alongside error/non-answer. grok F3: session-scope of a callability pass now stands on its own (expires with the session; re-probe before later dispatch) instead of citing the volatile-lineups rule, which only governs listings. codex F1: port-identity ordering contradiction resolved — identity check follows repair mutations with the marker in place; marker cleanup is the one mutation after the check, restricted to markers whose removal restarts/reloads nothing; the pos example re-ordered to match. codex F2: campaign ledger path pinned to the dispatching side's own repository (never inside a tree under review) in both the S2 field and the reference. codex F4: behavioral sweep gate now requires the effect's producing condition driven true at each surface (empty-data/disabled-branch renders observe nothing). codex F5 + grok n6: capability-negative rule restructured to the file's own format — state-phrased trigger (writing vs acting), probe branch for missing/stale pins, unknown-not-absent fallback, Done line, positive example. codex F6: dup-check search scope joins repo router/entry files (CLAUDE.md, AGENTS.md, memory index) when the target is a skill. grok n4 + codex n8: sweep per-round record renamed hunt-log and explicitly distinguished from the campaign ledger, both sites. grok n5: recurring-ledgers field title aligned to its body (dispatches, not sweeps). grok n7: first keyword-grep pos example now ends on the duplicate-found outcome (no addition, cross-reference). grok n8: deployment-runtime review-record reference decoupled from S7's word-diff artifact (same artifact class, inline definition kept). Rejected with counter-evidence (recorded in the PR trail): codex F7 (deployment-runtime gate misapplied to this merge — the gate governs S6 usability reviews of a skill; the added rules are pure instruction text under that rule's own runtime-agnostic branch); codex n9 (the rule already lists the wrapper's request trace among mapping sources). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 84 +++++++++++-------- .../references/recurring-sweep-ledgers.md | 9 +- .../references/settled-tree-review.md | 4 +- skills/skill-authoring/SKILL.md | 34 +++++--- 4 files changed, 83 insertions(+), 48 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 54eab71..ced7383 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -47,20 +47,26 @@ treat every returned result as a claim until verified. repair a mismatch: choose a defense, apply its own persistence shape as above, update every session-local reference, restart or reload every consumer that read its target at startup, and never kill the - sibling's server — it is another session's work. Identity check, - LAST, after all mutations including cleanup: record the expected - marker for THIS session first (the worktree name it serves, a - session nonce noted before the request — a fresh nonce from the - wrong sibling still looks fresh; a content build id shared by - same-revision worktrees does not discriminate), then observe exact - equality with that recorded value THROUGH every relied session-local - consumer path (the API proxy included, not just the top page); a - listener check (`lsof`-style) is port discovery, never identity - evidence; any restart or reload after the check — a marker cleanup - included — voids it: re-prove without mutating. A temporarily served - marker is removed afterward and its removal verified against the + sibling's server — it is another session's work. Identity check + comes after every repair mutation (reference updates, restarts, + reloads): record the expected marker for THIS session first (the + worktree name it serves, a session nonce noted before the request — + a fresh nonce from the wrong sibling still looks fresh; a content + build id shared by same-revision worktrees does not discriminate), + then observe exact equality with that recorded value THROUGH every + relied session-local consumer path (the API proxy included, not + just the top page); a listener check (`lsof`-style) is port + discovery, never identity evidence. Marker cleanup is the one + mutation that follows the check — use a marker whose removal + restarts or reloads nothing (a static file, a debug endpoint's + echo), remove it, and verify the removal against the pre-instrumentation state (tracked, untracked, and ignored files — - the declared persistent port configuration stays). + the declared persistent port configuration stays); a marker that + cannot be removed without a restart or reload is the wrong marker — + pick one that can be. Any restart or reload after the check — a cleanup that + broke the rule above included — voids the identity: re-prove it + (serve a fresh marker, check, clean up again) before relying on + the routing. When a fanned-out preview misbehaves with all-green requests, check cross-port references — references still naming the shared configured port instead of this session's bound port — before debugging your own @@ -70,9 +76,10 @@ treat every returned result as a claim until verified. the rule covers references meant for the displaced session-owned server. ✅ "each worktree pinned to its own persisted port, proxy and env - updated and reloaded; marker cleaned up; final non-mutating check: - the page AND a request through the API proxy both returned the - nonce recorded for this session." + updated and reloaded; identity check: the page AND a request + through the API proxy both returned the nonce recorded for this + session; then the marker file removed — no reload needed — and its + removal verified." ❌ "every request is 200, so the proxy target must be my server." - Route by task: mechanical clear-spec work → cheapest capable model; user-facing output → high-taste model; reviews and hard debugging → strongest available. @@ -109,16 +116,18 @@ treat every returned result as a claim until verified. the tool's routing claim, not callability — across two independent tools, a listed entry failed hard on first real invocation. Verify by sending a fixed trivial prompt through the SAME wrapper, flags, auth, - and execution context the work will use; the pass is a model ANSWER to - that prompt naming the route where the wrapper reports one — wrapper - banners, usage text, diagnostics, or error pages are not answers, and - a wrapper that silently falls back to a default model passes only - wrapper reachability, not this route (check the wrapper's own route - report where it emits one; where it cannot say which model answered, - say the check proved reachability only). An error or non-answer - leaves the route unverified — do not dispatch dependent work on it - (§4's retry/escalation ladder governs), and a pass is session-scoped - per the volatile-lineups rule above. About to use a wrapper's model + and execution context the work will use; the pass is two observations + — a model ANSWER to that prompt, AND the wrapper's own route report + naming this route where the wrapper emits one — wrapper banners, + usage text, diagnostics, or error pages are not answers, and a + wrapper that silently falls back to a default model, or cannot say + which model answered, proves wrapper reachability only: the route + stays unverified. An error, a non-answer, or a route left unverified + — do not dispatch dependent work on it + (§4's retry/escalation ladder governs); and a pass expires with the + session — a later session re-runs the probe before dispatching on + it (re-reading the lineup, per the volatile-lineups rule above, is + a separate duty, never the re-verification). About to use a wrapper's model string OUTSIDE the wrapper — a direct provider API call, a pricing or quota lookup: the string is the wrapper's internal routing name, not necessarily the provider's ID — and the same spelling existing on the @@ -166,9 +175,10 @@ Every packet names: category the prior round's pattern structurally excluded). Searching stays inside the packet's readable scope: a surface outside it is a reported gap, never a silent crossing. The packet carries the seed - inventory, the hunt method, and a per-round ledger duty — each - round's queries and results, empty ones included; the worker - continues the loop to closure. It also names the value family (the + inventory, the hunt method, and a per-round hunt-log duty — each + round's queries and results, empty ones included (a discovery + record, distinct from the recurring-campaign ledger field below); + the worker continues the loop to closure. It also names the value family (the tiers/variants the target ranges over), closed only by a verified-finite source (a sealed enum or const union read at its `file:line` — an extensible registry or config is never closed), else @@ -194,7 +204,11 @@ Every packet names: effect at every inventoried generator surface, across each declared variation axis where the outcome can differ (tier, theme, locale — untested combinations are unobserved, reported as such) — render or - run each inside a side-effect-contained harness; every outward + run each inside a side-effect-contained harness with the effect's + producing condition driven true at that surface (the input, branch, + or state under which the defect appeared; a render on empty data or + a disabled branch observes nothing — that surface stays + unobserved); every outward effect keeps operational-rigor §2's per-invocation authorization at the moment it fires, and one you cannot safely and authorizedly drive (a payment, a send, a delete) is reported unverified and @@ -232,14 +246,16 @@ Every packet names: - **Cost asymmetry** — for reviewers/verifiers, name which failure direction is expensive (e.g. a missed unverified claim vs. a false alarm) so scrutiny is weighted toward it, not split evenly. -- **Recurring sweeps carry ledgers** (`unprobed` — private incident as shape; +- **Recurring dispatches carry ledgers** (`unprobed` — private incident as shape; see Provenance). A field for RECURRING dispatches only — it never blocks a one-off. Fresh-context reviewers re-litigate a campaign's history: one re-raised a finding class an earlier round had refuted against the dependency's own source; another flagged as a defect the exact code a prior round had shipped as a fix. So a recurring packet names the campaign's stable identifier and its durable ledger file - (a concrete repository-relative path) holding four categories of + (a concrete repository-relative path in the dispatching side's own + repository — never inside a tree under review, whose settled or + delivered state review rules forbid mutating) holding four categories of records — prior fixes, refuted finding-classes, open findings, unresolved — reconciled against the enumerated prior-round reports; the full lifecycle, entry requirements, and refutation-scope rules @@ -292,8 +308,8 @@ reviewers that they silently absorb as implementers. baseline over the whole protected read set, enforced-copy-or-frozen- tree surfaces, the two return comparisons, and recovery — is `references/settled-tree-review.md`: load it before dispatching a - read-only review wave over a tree that you, a hook, a user, or a - sibling process may touch while it reads. Verdicts bind only the + review wave — read-only or write-capable — over a tree that you, a + hook, a user, or a sibling process may touch while it reads. Verdicts bind only the exact state whose immutability was enforced; anything less runs provisional — never a clean gate pass. ✅ "loaded the reference, dispatched one enforced copy per critic, diff --git a/skills/delegation-and-review/references/recurring-sweep-ledgers.md b/skills/delegation-and-review/references/recurring-sweep-ledgers.md index 6c0283e..f6b6c5d 100644 --- a/skills/delegation-and-review/references/recurring-sweep-ledgers.md +++ b/skills/delegation-and-review/references/recurring-sweep-ledgers.md @@ -6,8 +6,13 @@ precedent). Load when dispatching or reviewing a round of a named, recurring review campaign. **The artifact.** Every recurring campaign keeps ONE durable ledger file -at a concrete repository-relative path, named in every round's packet -(files are state; context is not). First pass: create it at that path +at a concrete repository-relative path in the dispatching side's own +repository — never inside a tree under review, whose settled or +delivered state review rules forbid mutating — named in every round's +packet (files are state; context is not). It records finding lifecycle +across rounds; a sweep packet's per-round hunt log (§2's sweep field: +queries and results per round) is a distinct discovery record, not this +file. First pass: create it at that path with the campaign's stable identifier and its four empty categories — the packet says "first pass — ledger initialized at ". A one-off that later recurs adopts an identifier at its second dispatch and diff --git a/skills/delegation-and-review/references/settled-tree-review.md b/skills/delegation-and-review/references/settled-tree-review.md index ff43a7c..419c699 100644 --- a/skills/delegation-and-review/references/settled-tree-review.md +++ b/skills/delegation-and-review/references/settled-tree-review.md @@ -3,8 +3,8 @@ The dispatch protocol behind §3's settled-tree bullet (`unprobed` — see the skill's Provenance; this entry is the protocol body, placed here per the pack's split precedent so the skill's §3 stays lean). Load this file before -dispatching a read-only review wave over a tree that you, a hook, a user, -or a sibling process may touch while it reads. +dispatching a review wave — read-only or write-capable — over a tree that +you, a hook, a user, or a sibling process may touch while it reads. **Definitions.** The PROTECTED READ SET is the reviewed paths plus the wave's declared read scope — the dispatch packet DECLARES that scope, and diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 7e214b8..1775b5c 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -95,17 +95,26 @@ artifact-producing step. - Date-stamp volatile facts (versions, flags, model names, defaults). - **Capability-negative claims rot the worst** (`unprobed` — private incident - as shape; see Provenance). "No such flag", "only works interactively", - "the API can't do X" are version-scoped observations that read as timeless + as shape; see Provenance). About to write "no such flag", "only works + interactively", "the API can't do X" into an instruction file — or + about to act on one already there: these are version-scoped + observations that read as timeless rules. A stale positive claim fails loud the first time someone follows it; a stale negative fails silent — it steers every later session away from a capability that now exists, and nothing ever exercises it to expose the rot. One playbook's "model switching only works in the interactive UI; no flag" was actively wrong at the tool's current version - and had been routing sessions into a degraded path. Pin every - capability-negative to the version it was observed on, and re-verify it - (one `--help` or probe call) when the tool's version changes, before - repeating it. + and had been routing sessions into a degraded path. Writing one: pin + it to the version and probe it was observed on. Acting on one: read + its pin; the tool's version has changed, or the pin is missing → + re-verify with one probe (`--help`, a trial invocation) before + obeying it; probe unavailable or inconclusive → the capability is + unknown, not absent — record that where the claim is used and do not + repeat the negative as fact. Done when the claim carries its version + pin and the session acting on it has verified the pin against the + current version. + ✅ "playbook says no flag (pinned v0.2.98); current binary v0.2.101 — + ran --help: the flag exists now; corrected the playbook in place." ❌ "the playbook says there's no flag, so drive it through the UI." - Correct a stale rule in place — never append the correction below the old line. A zero-context reader obeys whichever sentence it reads first, not @@ -175,7 +184,11 @@ artifact-producing step. drafting time. The check: grep the target file and its sibling skills (the skills shipped beside it — list the parent skills directory, don't recall it, and include each searched skill's references files - when the topic plausibly lives there; a router file like CLAUDE.md has + when the topic plausibly lives there; when the repo also carries + router or entry instruction files — CLAUDE.md, AGENTS.md, a memory + index — those join the search too, since a fact canonical in an + entry file makes any skill addition a second home; a router file + like CLAUDE.md as the TARGET has no siblings — its "siblings" are the files it points into) for the concept's name plus at least two alternates drawn from how the file might phrase it (the outcome it produces, the operation's other names, @@ -207,8 +220,8 @@ artifact-producing step. conditions never assert absence. ✅ "grep for 'revert', 'rollback', 'undo' across the playbook and its two siblings returned nothing; read all three files end to end — the - rule exists in the playbook under 'restore'; the change record lists - the three terms and the three files, each 'read in full'." + rule exists in the playbook under 'restore': duplicate found, no + addition; cross-referenced the playbook's rule instead." ✅ "all searches empty — read both searched files end to end; recorded 'not found under the searches and sections listed: revert, rollback, undo; playbook.md (read in full), helpers.md (read in full)' — then @@ -305,7 +318,8 @@ placement applies at authoring start: the target answer (or a recorded `user-must-provide`) is required before the first artifact-producing step; this review is the enforcement backstop, and it blocks adoption when the answer is missing. Confirm the review record — the same -artifact as §7's change record, verbatim: "the PR description or commit +artifact class as the change record used elsewhere in this file: "the +PR description or commit message when one is being created, otherwise the completion report" — names the target runtime(s): the execution environment (OS, container, sandbox) and any governing connector or tool instance. Not named → From 8a9440762fa13f48c19a3eb8d1eea6893d2c5ff1 Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 23:22:42 +0800 Subject: [PATCH 65/66] Fold combined-review r2: grok F1 + n2,n3; codex F1,F2,F3,F5 + n7,n8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit grok r2 F1: the sweep pos example's 'round ledger' (missed in the r1 rename) now reads 'per-round hunt-log' — the noun the r1 fix retired. grok r2 n2: the two port defenses numbered (1)/(2) so 'pick one' cannot be read as picking one comma-clause of defense (1). grok r2 n3: capability-negative Done split by branch (writing: pin + probe cited; acting: pin matched / re-probed / recorded unknown). codex r2 F1: S1's pre-existing 'parallel writers get isolated worktrees' now carries the settled-tree carve-out (a write-capable review critic needs an independent copy, not a linked worktree). codex r2 F2: the pinned-string rule's decision-time re-probe now requires route attribution per the labels rule first (an unattributed answer measures an unknown model). codex r2 F3: capability-negatives about a hosted model's behavior are scoped OUT of the version-pin protocol to d-a-r S1's pinned-string rule (endpoints drift behind unchanged strings). codex r2 F5: the settle-by-commit path stages exactly the content under review; unrelated dirty/untracked material is attributed first (operational-rigor baseline rule), never swept into the settle commit. codex r2 n7: the PRIOR-FIXES 'unchanged since the fix' narrowing is scoped to re-flagging that entry; a current round's proof gate is never narrowed by history. codex r2 n8: explicit write-back transitions added (OPEN->PRIOR FIXES with fix evidence; OPEN/UNRESOLVED->REFUTED with counterexample). Rejected with counter-evidence (recorded in the PR trail): codex r2 F4 (sweep packet scope vs op-rigor whole-project twin search — different duty-bearers: the worker's reported gap IS the disclosed limitation, the dispatcher owns the whole-project duty; escalation path already in the rule text); codex r2 n6 (the miss-is-costly loop runs all axes each round — a new producer category makes the round non-empty, so the described early close cannot occur); codex r2 n9 ('not found' binds to the fact under dup-check by the rule's opening context; hit-bearing sections are already force-read). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 18 +++++++++++------- .../references/recurring-sweep-ledgers.md | 10 +++++++++- .../references/settled-tree-review.md | 5 ++++- skills/skill-authoring/SKILL.md | 12 ++++++++---- 4 files changed, 32 insertions(+), 13 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index ced7383..815d124 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -21,7 +21,8 @@ treat every returned result as a claim until verified. - **Bounded fan-out:** launch no more agents than you can review/merge. If a wave depends on the last, accept/reject the last wave before the next; independent slices only need to stay within review capacity. Parallel writers get isolated - worktrees. + worktrees (a write-capable review critic needs more — an independent + copy per §3's settled-tree reference, not a linked worktree). - **Isolated trees do not isolate ports** (`unprobed` — private incident as shape; see Provenance). When sibling sessions run servers sharing a port namespace and a configured port, they contend for it; once one is @@ -30,15 +31,16 @@ treat every returned result as a claim until verified. proxy, target, or env entry still naming the configured port — now silently reaches the sibling's server: the page loads blank or shows the wrong build while every request returns 200, which reads as a bug - in your own change. Defenses (pick one, apply it fully — what you - persist differs by defense): a unique fixed port per worktree, run + in your own change. Defenses (pick one of the two, apply it fully — + what you persist differs by defense): (1) a unique fixed port per + worktree, run with fallback disabled so a collision fails loud, the NUMBER persisted and propagated to every session-local reference (proxy, env, browser entry) — an explicit address-in-use bind error is the contention diagnostic (any other bind error — permissions, bad address, exhaustion — is its own failure, not a cue to switch ports): then pick a different free unique port, propagate, restart; - or runtime derivation, where the MECHANISM is what persists — every + or (2) runtime derivation, where the MECHANISM is what persists — every reference re-derived from the actually-bound port after every bind, never a bound number frozen into a static ref. Auto-port fallback alone is the displacement mechanism, never the repair; writing @@ -95,7 +97,9 @@ treat every returned result as a claim until verified. with flag and battery unchanged, and a second vendor's reproduced failure inverted to a pass days later, strings unchanged). Date-stamp every such measurement where it is recorded; at decision time, re-run - the probe and cite the fresh result's timestamp and configuration — + the probe — its route first verified per the labels rule below (an + unattributed answer measures an unknown model, not the slug's) — + and cite the fresh result's timestamp and configuration — the fresh result informs the routing, it never replaces §2's edge specification and proof gate for the work itself, and no measurement pins the endpoint's behavior on the next request. Probe unavailable @@ -192,8 +196,8 @@ Every packet names: escalation, never edited on discovery. ✅ "seed inventory: the 53-file hit list (reference search), the shared class (style audit), the emitting helper (trace); tiers from - the sealed palette enum at its definition site; round ledger in the - packet." + the sealed palette enum at its definition site; per-round hunt-log + in the packet." ❌ "the inventory is the grep hit list — the shared utility never made the list." - **Invariant** — property to close and properties to preserve. diff --git a/skills/delegation-and-review/references/recurring-sweep-ledgers.md b/skills/delegation-and-review/references/recurring-sweep-ledgers.md index f6b6c5d..20e6161 100644 --- a/skills/delegation-and-review/references/recurring-sweep-ledgers.md +++ b/skills/delegation-and-review/references/recurring-sweep-ledgers.md @@ -24,7 +24,9 @@ backfills the ledger from the first round's report. fix's own correctness evidence from its round (a commit shows intent, not correctness — an incomplete fix still present is exactly what the re-examination must catch, so "unchanged since the fix" narrows the - re-check to the judged-against set; it never skips the locus). + re-check to the judged-against set; it never skips the locus — and + the narrowing governs re-flagging this entry only: a current + round's own proof gate is never narrowed by history). - REFUTED FINDING-CLASSES — a refutation binds exactly what its evidence established: the same claim about the same dependency artifact set (call path and controlling configuration included); a different @@ -45,6 +47,12 @@ nothing. §3's canonical set still governs the audit loop itself ("Dedup new findings against everything ever surfaced, including ones already rejected"). +Write-back moves entries across categories: an OPEN finding whose fix +landed this round moves to PRIOR FIXES carrying the fix's correctness +evidence; an OPEN or UNRESOLVED item refuted this round moves to +REFUTED FINDING-CLASSES carrying the counterexample; everything else +stays where it is. + **Two phases, two checks.** Dispatch-time (the §2 field's readiness): the packet names the ledger path and campaign identifier, and the ledger has been reconciled against an ENUMERATED source of prior-round diff --git a/skills/delegation-and-review/references/settled-tree-review.md b/skills/delegation-and-review/references/settled-tree-review.md index 419c699..c3e16eb 100644 --- a/skills/delegation-and-review/references/settled-tree-review.md +++ b/skills/delegation-and-review/references/settled-tree-review.md @@ -20,7 +20,10 @@ the verdict on any surface. set, not just the reviewed paths** (a reviewed file that depends on dirty config in the read scope is otherwise copied against the wrong state). When the requested end-state permits a commit, commit the content under -review on the reviewed branch and note the revision; an end-state +review on the reviewed branch and note the revision — staging exactly +the content under review; unrelated dirty or untracked material is +attributed first (operational-rigor's baseline rule), never swept into +the settle commit; an end-state requiring unchanged history or uncommitted work takes the restorable capture — working content, index state, and untracked files across the protected read set, plus the baseline refs — verified to hold everything diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 1775b5c..54a793d 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -104,15 +104,19 @@ artifact-producing step. from a capability that now exists, and nothing ever exercises it to expose the rot. One playbook's "model switching only works in the interactive UI; no flag" was actively wrong at the tool's current version - and had been routing sessions into a degraded path. Writing one: pin + and had been routing sessions into a degraded path. A negative about + a hosted model's BEHAVIOR is the one class a version pin cannot + hold — hosted endpoints drift behind unchanged strings; that class + follows delegation-and-review §1's pinned-string rule (decision-time + re-probe), not this protocol. Writing one: pin it to the version and probe it was observed on. Acting on one: read its pin; the tool's version has changed, or the pin is missing → re-verify with one probe (`--help`, a trial invocation) before obeying it; probe unavailable or inconclusive → the capability is unknown, not absent — record that where the claim is used and do not - repeat the negative as fact. Done when the claim carries its version - pin and the session acting on it has verified the pin against the - current version. + repeat the negative as fact. Done: writing — the claim carries its + version pin and the probe that observed it; acting — the pin is + matched to the current version, or re-probed, or recorded unknown. ✅ "playbook says no flag (pinned v0.2.98); current binary v0.2.101 — ran --help: the flag exists now; corrected the playbook in place." ❌ "the playbook says there's no flag, so drive it through the UI." From ed47089ec8efe2fc848c8cddc43791d1d9c4464c Mon Sep 17 00:00:00 2001 From: F-e-u-e-r <189464303+F-e-u-e-r@users.noreply.github.com> Date: Wed, 22 Jul 2026 23:43:25 +0800 Subject: [PATCH 66/66] Fold combined-review r3: grok F1,F2 + n3-n6; codex F2,F3,F4 (scoped) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit grok r3 F1: the labels rule's unverified-route block no longer bricks wrappers with no attribution channel by design — channel present but report missing/ambiguous/fallback-named blocks dispatch; no channel by design yields a reachability-only pass with the limit recorded wherever cited, never a verified-route claim. grok r3 F2: pinned-string Done and pos example now carry the r2 route-attribution requirement (an unattributed probe never satisfies the citation; the pos example shows the wrapper's route line). grok r3 n3: hosted-behavior carve-out parenthetical now names both duties (date-stamp the recorded claim; decision-time re-probe); the writing imperative binds explicitly to tool-interface negatives. grok r3 n4: check-name trigger broadened from 'safe' to any cited property of a change (safe, correct, covered). grok r3 n5: port recovery clause moved inside the address-in-use branch; other bind errors stay terminal for that path. grok r3 n6: ledger reference now cites the field by its actual title ('Recurring dispatches carry ledgers'). codex r3 F2 (scoped): attribution channel defined as reporting what ANSWERED — a banner echoing the requested slug is configuration, not attribution. codex r3 F3 (scoped): the re-verify probe example now exercises the claimed-absent capability; runtime-scoped verification remains S6's deployment-runtime gate (no duplicate home). codex r3 F4: ledger write-back gains the regressed-prior-fix transition — re-flagging with evidence spawns a new OPEN finding, the historical entry staying put with a pointer. Rejected with counter-evidence (recorded in the PR trail): codex r3 F1 (mutate-and-restore on an unenforced copy is the exact case the reference already rules — 'an unenforced reader can mutate and restore without a trace; no endpoint comparison proves the read stayed clean' -> provisional, never a clean gate pass); codex r3 F5 (re-raise of PR #52's two-strike standing rejection — S1 placement already gates authoring start, S6 is the named enforcement backstop, adjudicated in that PR's own review; the frontmatter loader is pre-existing structure outside this diff). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx --- skills/delegation-and-review/SKILL.md | 34 ++++++++++++------- .../references/recurring-sweep-ledgers.md | 8 +++-- skills/operational-rigor/SKILL.md | 3 +- skills/skill-authoring/SKILL.md | 8 +++-- 4 files changed, 34 insertions(+), 19 deletions(-) diff --git a/skills/delegation-and-review/SKILL.md b/skills/delegation-and-review/SKILL.md index 815d124..2ade01b 100644 --- a/skills/delegation-and-review/SKILL.md +++ b/skills/delegation-and-review/SKILL.md @@ -37,9 +37,10 @@ treat every returned result as a claim until verified. with fallback disabled so a collision fails loud, the NUMBER persisted and propagated to every session-local reference (proxy, env, browser entry) — an explicit address-in-use bind error is the - contention diagnostic (any other bind error — permissions, bad - address, exhaustion — is its own failure, not a cue to switch - ports): then pick a different free unique port, propagate, restart; + contention diagnostic: then pick a different free unique port, + propagate, restart (any other bind error — permissions, bad + address, exhaustion — is its own failure, never a cue to switch + ports); or (2) runtime derivation, where the MECHANISM is what persists — every reference re-derived from the actually-bound port after every bind, never a bound number frozen into a static ref. Auto-port fallback @@ -105,10 +106,12 @@ treat every returned result as a claim until verified. pins the endpoint's behavior on the next request. Probe unavailable or failing → the property is unknown: route as if unguarded and spec the edge per §2. Done when the decision record cites the fresh probe - (timestamp + configuration) or the unknown-property fallback — an + (timestamp + configuration, its route attributed per the labels + rule below) or the unknown-property fallback — an undated behavioral claim about a hosted endpoint is expired on - arrival. - ✅ "re-ran the edge battery this session, cited its timestamp in the + arrival, and an unattributed probe never satisfies the citation. + ✅ "re-ran the edge battery this session — the wrapper's route line + named the slug — cited its timestamp in the routing note, and specced the edge in the packet anyway." ❌ "we already measured that model guarding this edge, so route the edge-risky work to it" — any prior measurement reused for a routing @@ -122,13 +125,18 @@ treat every returned result as a claim until verified. sending a fixed trivial prompt through the SAME wrapper, flags, auth, and execution context the work will use; the pass is two observations — a model ANSWER to that prompt, AND the wrapper's own route report - naming this route where the wrapper emits one — wrapper banners, - usage text, diagnostics, or error pages are not answers, and a - wrapper that silently falls back to a default model, or cannot say - which model answered, proves wrapper reachability only: the route - stays unverified. An error, a non-answer, or a route left unverified - — do not dispatch dependent work on it - (§4's retry/escalation ladder governs); and a pass expires with the + naming this route as what ANSWERED (a banner echoing the requested + slug is configuration, not attribution) — wrapper banners, + usage text, diagnostics, or error pages are not answers. A wrapper + WITH an attribution channel whose report is missing, ambiguous, or + names a silent fallback leaves the route unverified — like an error + or a non-answer, do not dispatch dependent work on it + (§4's retry/escalation ladder governs). A wrapper with NO + attribution channel by design can only ever yield a + reachability-only pass: the route stays unattributed — record that + limit wherever the pass is cited, and dependent dispatch on it + carries the recorded limitation, never a verified-route claim. A + pass expires with the session — a later session re-runs the probe before dispatching on it (re-reading the lineup, per the volatile-lineups rule above, is a separate duty, never the re-verification). About to use a wrapper's model diff --git a/skills/delegation-and-review/references/recurring-sweep-ledgers.md b/skills/delegation-and-review/references/recurring-sweep-ledgers.md index 20e6161..4e11fb4 100644 --- a/skills/delegation-and-review/references/recurring-sweep-ledgers.md +++ b/skills/delegation-and-review/references/recurring-sweep-ledgers.md @@ -1,6 +1,7 @@ # delegation-and-review · references: recurring-sweep ledgers -The lifecycle behind §2's recurring-ledgers field (`unprobed` — see the +The lifecycle behind §2's "Recurring dispatches carry ledgers" field +(`unprobed` — see the skill's Provenance; protocol body placed here per the pack's split precedent). Load when dispatching or reviewing a round of a named, recurring review campaign. @@ -50,7 +51,10 @@ rejected"). Write-back moves entries across categories: an OPEN finding whose fix landed this round moves to PRIOR FIXES carrying the fix's correctness evidence; an OPEN or UNRESOLVED item refuted this round moves to -REFUTED FINDING-CLASSES carrying the counterexample; everything else +REFUTED FINDING-CLASSES carrying the counterexample; a PRIOR-FIXES +entry re-flagged this round with evidence the fix failed, regressed, +or left a residual spawns a NEW OPEN finding carrying that evidence, +the historical entry staying put with a pointer to it; everything else stays where it is. **Two phases, two checks.** Dispatch-time (the §2 field's readiness): diff --git a/skills/operational-rigor/SKILL.md b/skills/operational-rigor/SKILL.md index dd56953..45630f2 100644 --- a/skills/operational-rigor/SKILL.md +++ b/skills/operational-rigor/SKILL.md @@ -262,7 +262,8 @@ When rigor conflicts with finishing sooner, rigor wins. source and found it exercised only a regex pre-filter in which the model's name was a routing label — and had to correct a safety claim already given to the user. Before citing a check, test, or CI job as - evidence a change is safe, trace it through to its pass/fail oracle — + evidence of a property of a change (safe, correct, covered), trace + it through to its pass/fail oracle — the assertions (or, for a linter or build job, its rule set and inputs) inspected at the revision the cited run actually used, the invocation path and setup that feed them, whether that path executed diff --git a/skills/skill-authoring/SKILL.md b/skills/skill-authoring/SKILL.md index 54a793d..9e3858b 100644 --- a/skills/skill-authoring/SKILL.md +++ b/skills/skill-authoring/SKILL.md @@ -107,11 +107,13 @@ artifact-producing step. and had been routing sessions into a degraded path. A negative about a hosted model's BEHAVIOR is the one class a version pin cannot hold — hosted endpoints drift behind unchanged strings; that class - follows delegation-and-review §1's pinned-string rule (decision-time - re-probe), not this protocol. Writing one: pin + follows delegation-and-review §1's pinned-string rule (date-stamp + the recorded claim; re-probe at decision time), not this protocol. + Writing a tool-interface negative: pin it to the version and probe it was observed on. Acting on one: read its pin; the tool's version has changed, or the pin is missing → - re-verify with one probe (`--help`, a trial invocation) before + re-verify with one probe (`--help`, or a trial invocation exercising + the claimed-absent capability) before obeying it; probe unavailable or inconclusive → the capability is unknown, not absent — record that where the claim is used and do not repeat the negative as fact. Done: writing — the claim carries its