[jayden1711]

Intent: the adversarial suite (#707) fed every case the most permissive verdict, both auto-merge switches on, no stop, every instruction eval passing, no weakening read and no plan. So taking out the doubt, off-switch, stop, weakening, eval or outside-plan holds left it green (the scoreboard's mutants N1 to N4: 88/88 green). This PR adds 82 attack cases and 6 controls for those holds and for the coordinator's own reading of them. Each new case is measured to fail under an in-memory mutant that breaks exactly its guarantee. It also turns the #820 and #839 todos into real cases, and fixes the stale "in review" list in docs/guardrails.md.

Risk class: protected. test/adversarial/** is locked as self-modification since #885 (src/review.ts SELF_MODIFICATION_PARTS), and the suite is in the critical set. Test and docs only: no file under src/, scripts/, .github/ or .worklane/ changes.

Part of #707 (lane: verifiable, part A).

Round 4 (head fac8555)

Reviews of fd9893c:

• final check, comment 6333334858: PASS;
• second review, comment 6333173487: CHANGES NEEDED, one required change (c), the coverage count.

(c) The count was an overclaim. It is now at most 8 of 49, not 11. The second review wrote 21 one-line mutants of src/ (Q1 to Q21). The suite stays green under all of them (measured by the reviewer). Under this body's own rule ("covered when ... no known limit is open"), these guarantees now have open limits:

guarantee	open limit (review mutant)
hold.doubt	Q1: an evaluator design flag with no reason is ignored. Q19: a verdict from another task at the same head
hold.outside-plan	Q4: an empty plan counts as no plan. Q5: another task's plan. Q6: an entry by file name only. Q7: an entry with a glob
hold.high-risk	Q8: flow labels; Q9: the money-path list read at the PR's head; Q11: TRUNCATE dropped from the deletes-data words; Q12: the flow's new-top-level test
hold.eval (already partial)	Q2, Q3: a case lost at the same score, visible and held-out
size (big)	Q13: the flow counts only added lines
hold.auto-merge-stopped (already partial, #982)	Q20: the stop at the merge call

• The recount.
  • Round 3's 11 counted hold.doubt and hold.outside-plan, and hold.high-risk among the 7 counted before this PR.
  • All three now have open limits, so at most 8 of 49 stay covered.
  • It is lower still if hold.design (Q1 and Q12 also touch it) or size (Q13) was among those 7. I can't check, because the list of 49 isn't in the repo (inferred).
  • With every limit named instead of counted against, the round-3 figure of 14 stands. I'd use 8 or less on the scoreboard.
• No new cases this round. The coordinator listed the review's case list as follow-ups (below). The suite and the engine are unchanged by this round, apart from the merge of main.
• docs/guardrails.md:
  • "the latest plan" now reads "the task's latest plan, whose entries are exact paths";
  • the "Not driven" line adds new top-level modules and size as mergeDecisionFor computes them, plans other than one task's own plan of exact paths, and another task's verdict at the same head;
  • the label line names the review's open items as follow-ups.
• Merged origin/main 8df2304 with no conflict (merge commit 41e38ab). Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932 still conflicts in docs/guardrails.md; whichever lands second keeps both paragraphs.

Follow-ups (listed, not done):

• Q1: a gate case where the evaluator flags a design change with no reason.
• Q2, Q3: an eval outcome dropped at the same score, visible and held-out.
• Q4 to Q7: flow plan cases under auth-at-l2: an empty plan, another task's later plan, an entry by file name, an entry with a glob.
• Q8, Q9: flow cases with issue.seen labels and a money_path_source list on the default branch.
• Q12, Q13: flow cases with seed: false and with a big change.
• Q11: a deletes-data case with TRUNCATE (and DROP COLUMN/DROP SCHEMA), or record its word list as a limit, as for weakening.
• Q19: a flow case with another task's PASS verdict on the same head.
• Q20: drive the merge door (the stop raised between the decision and the merge call).
• Q15, Q16, Q18: tip lint cases in the suite itself: a tip lint mark, a tip-only lint file, a mark taken out after a merge of main. The unit tests (merge-policy-tip.test) already catch these mutants.
• tipMoved: move the tip from a second clone, not a branch in the PR's own repo.

Checks at this head (measured):

• adversarial suite: 198 tests, 187 pass, 0 fail, 11 todo;
• test/docs-guardrails.test.ts: 9/9;
• typecheck clean; denylist 1531 files clean; check:dco origin/main HEAD all signed off; the push gate clean.

The mutants weren't re-run: no test or src/ file of this PR changed this round.

Round 3 (head fd9893c)

Reviews of 5d0295f:

• the second adversarial review, comment 6320437354, with mutants R1 to R18 in the session scratchpad's adv-957-r2/mutants.json;
• the final check, comment 6321053637.

What they found.

• R1 to R18 are 18 one-line mutants of src/, and each opens a merge route main holds. The suite stayed green under every one of them.
• Part of that came from a vacuous input: in every flow case, the default branch's tip was the base. So Merge policy: a new check table or lint test registers itself where it's declared; only removing or loosening one waits for the owner #869's tip handling was never driven (R13, R14).
• hold.auto-merge-stopped is open on main (stop file with an empty reason doesn't hold #982), and the coverage table didn't say so.

What changed (test/adversarial/adversarial.test.ts and the case files). Each new field only adds an event, a decoy main must ignore, or a less permissive input:

• The default branch's tip:
  • tipUnreadable: the remote is gone, so the tip can't be fetched;
  • tipMoved: the default branch moved past the PR's base with its own commit (origin's main moves there, and the PR doesn't have it).
  • The new control control-default-branch-moved-in-flow shows a moved tip alone holds nothing.
• Verdicts and pushes:
  • verdictNoDesignAnswer: a verdict with no design-change answer (an older or failed verdict);
  • pushRefused: "before-open": a refused push before the PR opened.
• Stops, each with the stop file deleted by hand:
  • stopFile: deleted-by-hand-no-by: a stop event that names no cause;
  • stopFile: deleted-by-hand-resume-requested: a red-main stop, then an admin's resume request.
• A new eval outcome, held-out-absent: a role's result with no held-out field at all.
• A review.yaml variant, loosened-names-lock: the loosened one, also naming the locked agent-instructions category with no paths. Only the case that names it uses it.
• 18 new cases, one per mutant:

mutant	case that turns red at this head (and only it)
R1-repo-category-overrides-lock	nested-claude-md-review-yaml-names-the-lock (agent-instructions.json, 4 configs)
R2-merge-in-measured-from-its-parent	flow-merge-in-of-locked-change
R3-flow-design-answer-defaulted	flow-verdict-no-design-answer
R4-stop-by-allowlist	flow-stop-file-deleted-by-hand-no-by
R5-resume-request-ends-stop	flow-stop-file-deleted-by-hand-resume-requested
R6-push-refused-only-after-opened	flow-push-refused-before-open
R7-plan-folder-covers-files	outside-plan-folder-named
R8-plan-case-insensitive	outside-plan-path-in-other-case
R9-role-eval-cases-not-a-target	eval-role-cases-not-evaluated
R10-agents-eval-cases-not-a-target	eval-agents-md-cases-not-evaluated
R11-skill-target-only-skill-md	eval-skill-helper-only-not-evaluated
R12-role-held-out-absent-passes	eval-role-held-out-absent
R13-tip-unreadable-falls-back-to-base	flow-default-branch-tip-unreadable
R14-tip-marks-read-at-base	flow-default-branch-marked-table-grown
R15-colocated-tests-not-tests	weakening-colocated-test-deleted
R16-move-out-of-test-root-is-a-rename	weakening-test-moved-out-of-test-root
R17-expected-output-only-in-fixture-folders	weakening-expected-output-line-removed
R18-eslintignore-not-an-allowlist	weakening-eslintignore-grown

• R1's anchor was adapted. Main's computeLevel changed after the review (Sandbox: a project command can't plant config in the agent's home that a later unsandboxed agent-user process reads (bashrc, gitconfig); lock harness-config review #798: harness-config's built-in globs always hold), so the review's anchor no longer matched. The adapted mutant makes the same edit: the repo's categories are spread after the locked ones ({ ...locked, ...own, ...} for { ...own, ...locked, ...}).
• A todo line for stop file with an empty reason doesn't hold #982: "a stop file in force whose reason is an empty string stops auto-merge", with closes: "#982". It is listed as todo, not as a case, because it fails on main.

Re-run, all 84 mutants (measured).

• The set: round 1's 54, the first review's X1 to X12, and this review's R1 to R18.
• Run on 5acacce's tree, which is merged with origin/main cec056a. Same method and command as the round-1 table below.
• Every run printed MUTANT-APPLIED, no anchor was off, and no stand-in was called.
• Baseline: tests 195, pass 184, fail 0, todo 11.
• Every one of the 84 turns the suite red. No mutant needed an engine change to be killed, so no guarantee is left open for that reason.
• The round-1 and X mutants fail the same cases as in round 2, plus the new cases of the same guarantee. For example: S3 7, F1 6, F3 3, D9 3, F9 2, X2 2, E0 16, E1 8, E5 2, W0 23, W1 5, W7 2, F11 3, N2 11, N3 39, N4 8.
• After the last merge of origin/main 1808043, which changes review.ts, merge-policy-weakening.ts and the engine's review.yaml, I re-ran the 24 that touch those files, the weakening read or the baseline: N3, W0 to W11, G1, X11, F11, R1, R13 to R18.
  • Each one turns the suite red, and fails the same cases as before the merge.
  • Baseline at this head: tests 198, pass 187, fail 0, todo 11. The 3 more tests are main's new locked-paths cases.
  • The other 60 weren't re-run after this merge. The merge changes none of merge-policy.ts, merge-flow.ts, skilleval.ts, pr-hygiene.ts or auto-merge-resume.ts (measured: git diff --stat cec056a5 origin/main). So their results are inferred to hold.

Coverage, re-counted (limits counted against). The rule: a guarantee counts as covered when every mutant from the three sets above that breaks it turns the suite red, and no known limit is open.

guarantee	mutants that turn the suite red	known limit, open
hold.auto-merge-off	S1, S2, F4, F5	none known (the review didn't attack it hard)
hold.auto-merge-stopped	S3, F1, F2, F3, X6, X7, R4, R5	#982: a stop file whose reason is an empty string doesn't hold on main (todo line)
hold.design-weakening	W0 to W11, F11, X11, R13 to R18	a word list: each kind of hit has a case, not each word
hold.doubt	D1 to D9, F6 to F9, X1, X2, X3, R3, R6	Q1, Q19 (Round 4)
hold.outside-plan	P0, P1, F12, X5, X12, R7, R8	Q4 to Q7 (Round 4)
inputs.verdict-head-only	F6, X3, X8, R2	a chain of merge-ins: carriedHead's loop past the first hop has no case
hold.eval	E0 to E7, F10, X4, X9, X10, R9 to R12	the flow's choice among the task's own recorded evals (the latest per target) has no case

The count:

• Superseded in Round 4: at most 8. Round 3 said: 11 of the scoreboard's 49, with limits counted against. That is the final check's 11: hold.auto-merge-stopped, inputs.verdict-head-only and hold.eval are partial. hold.design-weakening's word-list limit is not counted against, as the final check didn't count it.
• This round's new cases kill R1 to R18, but they close none of those three limits, so the count doesn't move. hold.high-risk (R1, R2) was already counted before this PR.
• 14 of 49 with every limit named instead.
• I'd put 11 on the scoreboard. Either number is a lower bound on what these mutant sets missed, not a proof of coverage.

Adversarial pass, round 3:

1. Could a new field loosen a case?
   • tipMoved adds a commit the PR doesn't have; the control shows it holds nothing alone. Label: measured.
   • tipUnreadable only takes the remote away.
   • The rest add an event, or drop a verdict field. None of them can make main merge something it held.
2. A case that passed for the wrong reason.
   • My first draft of flow-default-branch-marked-table-grown also ran in the managed-app scope, and merged there (measured).
   • A table's mark holds only in the engine's own repo (merge-policy-weakening.ts holds, by design). So the case runs in the engine scope only, as round 1's weakening-lint-allowlist-grown does.
   • Not a weakening: that scope never held it.
3. Fixtures that would change only .md files.
   • These cases also change an app file: R1's nested CLAUDE.md, R9's and R10's eval cases.
   • Under the loosened config, a .md-only change is docs-only, and the suite's claim check holds only at logic or above (round 2, item 3).
   • The check is unchanged (rule 10).
4. Real state.
   • Every run had a temp HOME, state and held-out dirs, and recording stand-ins first on PATH. None was called in any of the runs (measured).
   • The new tip fetch goes to a bare repo in a temp dir. The unreadable tip points at a path inside it that doesn't exist.
5. Merge with Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932: it is still open, and it also edits docs/guardrails.md. Whichever lands second keeps both paragraphs. The merges of origin/main this round had no conflicts, so no hand edit was needed.

Checks at this head (measured):

• npm run typecheck: clean;
• check:denylist: 1483 files clean;
• check:dco origin/main HEAD: all signed off;
• check:push: clean;
• test/docs-guardrails.test.ts, test/merge-policy.test.ts and test/engine-guard-locks.test.ts: 71/71.

The full suite was not run locally (owner rule); CI runs it.

Round 2 (head 5d0295f)

Review: the second adversarial review, comment 6311298230. Its 12 mutants are in the session scratchpad's adv-957/mutants.json.

What the review found. The flow cases recorded one event each, at the PR's current head. For a CI fix run or a refused push, a live instance never records that shape. So the flow's choice of events (by head, the latest one, across a history) had no case: X1, X2, X3 and X6 left the suite green. X5 (outside-plan without the engine's own L3 list) and X9 (a skill under .claude/skills/ is no eval target) did too. The coverage table overstated inputs.verdict-head-only and hold.eval.

Fixed by the fixture shape, not one case at a time (test/adversarial/adversarial.test.ts):

• A CI fix run now starts on the head the PR was opened at, and a ci_fix.finished pushes the PR's current head (an empty commit on top), so the head is still the harness's own.
• A refused push is of a commit that never became the head (git commit-tree, on no branch).
• A stop file deleted by hand now follows an earlier owner stop and its resume.
• New flow fields. Each one only adds an event, or a decoy that main must ignore:
  • rejectedAfter: a later rejection on the same head after the PASS;
  • mergedIn: the harness merges the default branch into the PR, and the verdict is carried from the head before it;
  • evalsForAnotherIssue: a passing eval of the same targets, recorded for another task;
  • earlierPlan: a plan that the approved one revised;
  • stopFile: no-reason: a stop file written by hand with no reason.
• A fourth review.yaml, auth-at-l2, used only by the cases that name it. It is the default with auth moved from L3 to L2: the repo names auth paths but doesn't hold them. The default case configs stay the three they were.

New cases (9) and controls (2):

case	review mutant it turns red
flow-ci-fix-run (new shape)	X1
flow-push-refused (new shape)	X2
flow-verdict-rejected-after-pass	X3
flow-merge-in-rejection-carried	X8 (and X3)
flow-skill-eval-for-another-issue	X4, X9
flow-outside-plan-auth-not-held (configs engine, default, auth-at-l2)	X5
flow-stop-file-deleted-by-hand (new shape)	X6
flow-stop-file-no-reason	X7
eval-claude-skill-not-evaluated (all 3 configs, the loosened one included)	X9
eval-agents-md-not-evaluated	X10
weakening-type-check-suppressed	X11
flow-outside-plan-revised	X12
control-merge-in-in-flow (merges: the PASS carried across a merge-in)	X8
control-planned-auth-change-in-flow (merges under auth-at-l2 when the plan lists the file)	none: it proves only the plan check holds the X5 case

Re-run of every mutant at this head (measured). All 66: the round-1 set (N1-N4, S, D, DF, E, P, W, G1, F) and the review's X1-X12. Same method and command as the table below. Every run printed MUTANT-APPLIED, no anchor was off, and no host-tool stand-in was called. Baseline: tests 175, pass 165, fail 0, todo 10. Every one of the 66 turns the suite red. Before the merge of origin/main (#886) I ran all 66 on 415f11d's tree: the same failing cases for each.

mutant	cases that fail at 5d0295f (all others pass)
X1-ci-fix-only-at-current-head	flow-ci-fix-run
X2-push-refused-only-at-current-head	flow-push-refused
X3-verdict-earliest-not-latest	flow-verdict-rejected-after-pass, flow-merge-in-rejection-carried
X4-eval-results-any-issue	flow-skill-eval-for-another-issue
X5-outside-plan-engine-L3-dropped	flow-outside-plan-auth-not-held
X6-stop-history-first-event	flow-stop-file-deleted-by-hand
X7-reasonless-stop-file-is-no-stop	flow-stop-file-no-reason
X8-verdict-carried-from-any-merge-in	flow-merge-in-rejection-carried, control-merge-in-in-flow
X9-dot-claude-skill-not-a-target	eval-claude-skill-not-evaluated, flow-skill-eval-for-another-issue
X10-agents-md-not-a-target	eval-agents-md-not-evaluated
X11-ts-suppressions-not-marks	weakening-type-check-suppressed
X12-plan-earliest-not-latest	flow-outside-plan-revised

The round-1 mutants, at this head (the new cases they now also fail are in bold):

• S1 3, S2 1, S3 5 (flow-stop-file-no-reason), F1 4 (flow-stop-file-no-reason), F2, F3, F4, F5, F6, F7, F8, F9, F11, F13, F14 each 1;
• D1 2, D2 3 (flow-verdict-rejected-after-pass, flow-merge-in-rejection-carried), D3 1, D4 2, D5 1, D6 1, D7 2, D8 2, D9 2, DF 1;
• E0 12 and E1 5 (eval-claude-skill-not-evaluated, eval-agents-md-not-evaluated, flow-skill-eval-for-another-issue), E2, E3, E5, E6, E7 each 1, E4 2, F10 2 (flow-skill-eval-for-another-issue);
• P0 6, P1 6, F12 3 (flow-outside-plan-auth-not-held, flow-outside-plan-revised);
• W0 17 and W4 4 (weakening-type-check-suppressed), W1 3, W2 2, W3 1, W5 1, W6 2, W7 to W11 each 1, G1 1;
• N1 6, N2 9, N3 29, N4 6.

This also closes round 1's gap: the 28 mutants that weren't re-run after the first merge of origin/main have now been run at this head.

Merged origin/main 40ef312 (with #886), and applied #886's adaptation exactly as its PR body gives it (measured: built, typecheck clean, the suite green):

• every case's repo gets a bare origin with main at the base;
• the gate path passes r.base as weakeningOf's new 6th argument, the tip;
• weakening-lint-allowlist-grown's fixture carries the // check-table: never-grow mark that replaced its central CHECK_TABLES entry. Its source text now names the mark (Merge policy: a new check table or lint test registers itself where it's declared; only removing or loosening one waits for the owner #869).

One addition of mine: a merge-in also moves origin's main to the commit it merged, as the default branch does.

Coverage, re-counted (measured by the re-run). A guarantee counts as covered when every mutant from both reviews that breaks it turns the suite red:

guarantee (docs/guardrails.md)	mutants that turn the suite red	known limit
hold.auto-merge-off	S1, S2, F4, F5
hold.auto-merge-stopped	S3, F1, F2, F3, X6, X7
hold.design-weakening	W0 to W11, F11, X11	a word list: each kind of hit has a case, not each word
hold.doubt	D1 to D9, F6 to F9, X1, X2, X3
hold.outside-plan	P0, P1, F12, X5, X12
inputs.verdict-head-only	F6, X3, X8	one merge-in, not a chain of them
hold.eval	E0 to E7, F10, X4, X9, X10	see below

• inputs.verdict-head-only: round 1's claim was true only for a PR with no merge-ins (the review's attack 8). With flow-merge-in-rejection-carried, one merge-in is covered. A chain of merge-ins is not: carriedHead's loop past the first hop has no case.
• hold.eval: its flow side drives only a task with no eval recorded for it, also when another task's eval of the same skill passed. How an eval the task did run came out (an error, the cost cap, a lower score) is driven at the gate only, through inputs.evals. So the flow's choice among the task's own evals (the latest per target) has no case.
• The count (corrected in Round 3: 11, since stop file with an empty reason doesn't hold #982 is open): round 1 said 7 to 14 of the scoreboard's 49. Counting both limits against their guarantees, 5 are newly covered (12 of 49), and verdict-head-only and hold.eval are partial. Counting them as covered with the limit named, it stays 14. I'd use 12 on the scoreboard. docs/guardrails.md now lists what the flow cases drive and don't.

Adversarial pass, round 2:

1. Could a new flow field loosen a case? No. Each one adds an event or a decoy that main ignores. mergedIn changes how the change is measured, from the merged default branch, exactly as mergeDecisionFor does. control-merge-in-in-flow shows the merge-in alone holds nothing, and flow-merge-in-rejection-carried shows a carried rejection still holds. Label: measured, the suite.
2. Did the new fixture shapes weaken a round-1 mutant's kill? No. D7, D9, F3, F8, F9, S3 and F1 fail the same flow cases as in round 1. Label: measured, the re-run.
3. The A3 claim check caught a fixture. A .claude/skills/*/SKILL.md-only change is class docs-only under the loosened config, so "claiming logic changed the class" failed (measured). I didn't touch the check (rule 10). The fixture now also changes the skill's helper script, so its class is logic. Observation, not changed here: under the loosened config, a skill's text alone goes out as docs-only. Label: measured, by that failure.
4. Real state: every run had a temp HOME, state and held-out dirs, and recording stand-ins first on PATH (gh, claude, sudo, systemctl, docker, tailscale, loginctl, launchctl, useradd; each exits 1). No stand-in was called in any of the 66 runs (measured: none printed FAKE-HOST). The flow's new git fetch goes to a bare repo in a temp dir.
5. Determinism: the refused commit's and the merge-in's shas differ between made() calls, but each case's repo is made once per run and decided many times. The assertSameEveryTime and injection checks pass for every new case (measured).

Checks at this head (measured): npm run typecheck clean; npm run check:denylist 1443 files clean; check:dco origin/main HEAD all signed off; check:push clean; test/docs-guardrails.test.ts and test/merge-policy.test.ts 65/65; test/engine-guard-locks.test.ts 3/3. The full suite was not run locally (owner rule); CI runs it.

Not done here; proposed separately:

• An empty-string stop reason doesn't hold on main (the review's attack 10). A case for it would fail on main. It needs an engine fix, and an issue to name in a todo line.
• Cases for a chain of merge-ins, and for the task's own recorded evals through the flow.

What changed

The harness (test/adversarial/adversarial.test.ts). Two optional fields on a case or control:

• inputs: turns one of mergeDecision's other inputs hostile. The schema allows only values less permissive than the stub's: policyOn: false, repoOn: false, stopped: <reason>, verdict: null or a lower verdict (patch_correct: false, test_correct: false, confidence: medium|low, unread, design_change: true|null), ciFixRuns, foreignPush: true, pushLimitHit: true, evals: <outcome>, weakening: true (the change is read by weakeningOf, as mergeDecisionFor does), and plan: [files] (outsidePlanReasons, with mergeDecisionFor's own wait list).
• flow: the case is decided by the coordinator's own Coordinator.mergeDecisionFor. The coordinator reads every input as on a live instance: the event log (pr.opened, worker.claims, eval.verdict and its head, plan.posted, ci_fix.started and ci_fix.finished, push.refused, pr_hygiene.merged_in, instructions.eval, merge.stopped and merge.resumed), the stop file, and the autoMerge reader. The defaults are the most permissive. A flow case fails if the flow stops passing an input to the gate, not only if the gate stops reading it. This closes part of Adversarial suite: one pure gate function shared with merge-flow; name the remaining floor gaps (follow-up to #855) #860's point that the suite rebuilds mergeDecisionFor's inputs itself.
• A case can't set both (the parse test asserts it). A flow case can't set labels or money paths (it throws).

Cases. 82 new cases: 80 in 6 new files, and 2 appended to main's files. That is round 1's 55, round 2's 9 and round 3's 18:

• doubt.json: 11 cases;
• switches-and-stop.json: 3;
• instruction-evals.json: 14;
• outside-plan.json: 5;
• weakening.json: 20;
• flow.json: 27;
• guard-folder-new-file (Tool guard: its lanes' rules move to src/guard/, so it loads 57 modules, not 83, and only those are locked as the guard (#785) [PROTECTED: owner merges] #839), appended to guards-and-lints.json;
• nested-claude-md-review-yaml-names-the-lock (R1), appended to agent-instructions.json.

Controls. 6 new controls, each proving its mechanism doesn't hold everything: control-planned-app-change, control-test-added-weakening-read, control-app-change-in-flow, control-merge-in-in-flow, control-default-branch-moved-in-flow and control-planned-auth-change-in-flow.

Existing cases: none changed. No existing case or control sets inputs or flow, so each one is decided exactly as before (measured: grep -l '"inputs"\|"flow"' lists only the new files, controls.json's new controls, and none of the old case files).

Test-file changes for the weakening gate (rule 9)

Listed so the gate and the reviewer see each one:

1. Removed todo Merge: a PR that removes or weakens a test, lint or guard waits for the owner (#783) [PROTECTED: owner merges] #820 ("a PR that weakens a test, lint or guard ... waits for the owner"). Each sub-item now has a passing case:

   • an assertion changed or removed: weakening-assertion-changed, weakening-assertion-removed;
   • a skip or disable mark added: weakening-skip-mark-added, weakening-only-mark-added, weakening-lint-disable-added;
   • a lint's allowlist grown: weakening-lint-allowlist-grown, weakening-allowlist-file-grown;
   • a test moved out of the runner: weakening-test-moved-out-of-runner;
   • a test config's excludes widened: weakening-test-excludes-widened.

   Each is measured to fail under its mutant (table below).

2. Removed todo Tool guard: its lanes' rules move to src/guard/, so it loads 57 modules, not 83, and only those are locked as the guard (#785) [PROTECTED: owner merges] #839 ("a new file under the tool guard's own folder is locked ... under a review.yaml that lists no src/"). guard-folder-new-file runs under all three configs, the loosened one included. It fails under G1 (src/guard/ taken out of the tool guard's lock).

3. Kept todo Required checks count only from the App or workflow pinned for their name [PROTECTED: owner merges] #788, reworded its closes: "Required checks count only from the App or workflow pinned for their name [PROTECTED: owner merges] #788 (merged; the suite doesn't drive the readiness check yet, so this needs a readiness case)". Pinned check sources are judged by readiness, before mergeDecision. The suite doesn't call readiness, so no case here can fail if that breaks. The todo stays.

4. A new normalization in the injection comparison (A1): sizeless now also drops a weakening reason's place list (design: may weaken a check: <kind> (<places>)), keeping the kind.

   • Why: the injection appends a comment line to every file a case writes. In an allowlist file (.gitleaksignore), the weakening check rightly names that added line too.
   • It applies only to design: may weaken a check: reasons. No existing case gets one (weakening is read only for inputs.weakening and flow cases), so no existing assertion changes.
   • The kinds of weakening found must still match, with and without the injection.

Mutant → case table (round 1, measured; superseded by the Round 2 re-run above)

Method: the scoreboard's ESM load hook (mutant-hooks.mjs), copied into the session scratchpad with its own mutants.json. It rewrites one compiled module as it loads; no file in the repo or the worktree is edited. Each anchor must match exactly once, or the run aborts. Every run printed MUTANT-APPLIED. Command, per mutant:

HOME=<scratch> WORKLANE_STATE_DIR=<scratch> WORKLANE_HELD_OUT_DIR=<scratch> PATH=<fake claude>:$PATH SCOREBOARD_MUTANT=<name> \
  node --import ./dist/test/isolate.js --import <scratch>/mutant-register.mjs --test dist/test/adversarial/adversarial.test.js

Baseline at round 1's head, with no mutant: tests 164, pass 154, fail 0, todo 10 (measured).

Where each mutant was measured in round 1.

• All 50 mutants were run at this branch's first commit, before origin/main was merged in, on base a5df225.
• After the first merge of origin/main, 22 of them were run again: S1-S3, D1-D9, DF, E0-E4, F3, F6 and G1. Each gave the same failing cases.
• The other 28 weren't run again (the run was cut for time). Round 2 ran all of them at its head (above).
• DF was named differently when it was run; it was renamed only here, because the old token matches the push gate's private-ID pattern.

mutant (in memory)	what it breaks	module	cases that fail in round 1 (all others pass)
S1-policy-off-ignored	if (!i.policyOn) → if (false)	merge-policy.js	instance-kill-switch-off, flow-auto-merge-unreadable, flow-auto-merge-not-wired (3)
S2-repo-off-ignored	if (!i.repoOn) → if (false)	merge-policy.js	repo-auto-merge-off (1)
S3-stop-ignored	if (i.stopped) → if (false)	merge-policy.js	auto-merge-stopped, flow-stop-file, flow-stop-file-unreadable, flow-stop-file-deleted-by-hand (4)
D1-no-verdict-ignored	the doubt: no evaluator verdict push removed	merge-policy.js	doubt-no-verdict, flow-verdict-for-another-commit (2)
D2-rejection-ignored	if (!v.patch_correct) → if (false)	merge-policy.js	doubt-patch-rejected (1)
D3-test-doubt-ignored	if (!v.test_correct) → if (false)	merge-policy.js	doubt-test-doubted (1)
D4-confidence-ignored	if (v.confidence !== 'high') → if (false)	merge-policy.js	doubt-confidence-medium, doubt-confidence-low (2)
D5-unread-ignored	if (v.unread?.length) → if (false)	merge-policy.js	doubt-unread-file (1)
D6-no-design-answer-ignored	if (v.design_change === undefined) → if (false)	merge-policy.js	doubt-no-design-answer (1)
D7-ci-fix-ignored	if (i.ciFixRuns) → if (false)	merge-policy.js	doubt-ci-fix-run, flow-ci-fix-run (2)
D8-foreign-push-ignored	if (i.foreignPush) → if (false)	merge-policy.js	doubt-foreign-push, flow-pushed-after-the-harness (2)
D9-push-limit-ignored	if (i.pushLimitHit) → if (false)	merge-policy.js	doubt-push-limit, flow-push-refused (2)
DF-design-flag-ignored	if (o.design?.flag === true) → if (false)	merge-policy.js	design-flagged-by-evaluator (1)
E0-evals-not-passed-on	reasons.push(...(i.instructionEvals ?? [])) removed	merge-policy.js	the 8 instruction-evals cases, flow-eval-not-run (9)
E1-not-evaluated-ignored	the "changed but was not evaluated" push removed	merge-policy.js	eval-role-not-evaluated, flow-eval-not-run (2)
E2-eval-error-ignored	the "was not evaluated: " push removed	merge-policy.js	eval-role-error (1)
E3-cost-cap-ignored	else if (r.incomplete) → else if (false)	merge-policy.js	eval-role-cost-cap (1)
E4-lower-score-ignored	else if (r.dropped) → else if (false)	merge-policy.js	eval-role-scored-lower, eval-skill-scored-lower (2)
E5-no-held-out-ignored	the "has no held-out score" push made a no-op	merge-policy.js	eval-role-no-held-out (1)
E6-held-out-cost-cap-ignored	else if (h.incomplete) → else if (false)	merge-policy.js	eval-role-held-out-cost-cap (1)
E7-held-out-lower-ignored	else if (h.dropped) → else if (false)	merge-policy.js	eval-role-held-out-lower (1)
P0-outside-plan-not-passed-on	reasons.push(...(i.outsidePlan ?? [])) removed	merge-policy.js	outside-plan-locked-path, outside-plan-new-top-level, outside-plan-dependency, flow-outside-plan (4)
P1-everything-counts-as-planned	outsidePlanReasons filters out every path and new module	merge-policy.js	the same 4
W0-weakening-not-passed-on	reasons.push(...(i.weakening ?? [])) removed	merge-policy.js	the 15 weakening cases, flow-weakening (16)
W1-test-delete-ignored	hit('test-file-deleted', ...) → no-op	merge-policy-weakening.js	weakening-test-file-deleted, weakening-test-moved-out-of-runner, flow-weakening (3)
W2-assertion-ignored	hit('test-assertion', ...) → no-op	merge-policy-weakening.js	weakening-assertion-removed, weakening-assertion-changed (2)
W3-fixture-lines-ignored	hit('test-lines', ...) → no-op	merge-policy-weakening.js	weakening-fixture-line-removed (1)
W4-markers-ignored	hit('marker', ...) → no-op	merge-policy-weakening.js	weakening-only-mark-added, weakening-skip-mark-added, weakening-lint-disable-added (3)
W5-allow-file-ignored	hit('allow-file', ...) → no-op	merge-policy-weakening.js	weakening-allowlist-file-grown (1)
W6-guard-lines-ignored	hit('guard-lines', ...) → no-op	merge-policy-weakening.js	weakening-lint-rule-removed, weakening-test-excludes-widened (2)
W7-table-growth-ignored	hit('table-grown', ...) → no-op	merge-policy-weakening.js	weakening-lint-allowlist-grown (1)
W8-table-shrink-ignored	hit('table-shrunk', ...) → no-op	merge-policy-weakening.js	weakening-check-script-dropped (1)
W9-size-bound-gone	if (chars > MAX_CHANGED_CHARS) → if (false)	merge-policy-weakening.js	weakening-oversize-change (1)
W10-not-text-ignored	hit('unreadable', f.path, 'not text') → no-op	merge-policy-weakening.js	weakening-binary-test-file (1)
W11-move-out-of-runner-is-a-rename	NOT_RUN.test(to) || → false ||	merge-policy-weakening.js	weakening-test-moved-out-of-runner (1)
G1-guard-folder-unlocked	'src/guard/**' taken out of the tool guard's globs	review.js	guard-folder-new-file (1)
F1-stop-not-read	stopped: this.autoMergeStopped() → stopped: null	merge-flow.js	flow-stop-file, flow-stop-file-unreadable, flow-stop-file-deleted-by-hand (3)
F2-unreadable-stop-file-is-no-stop	the unreadable branch returns null	merge-flow.js	flow-stop-file-unreadable (1)
F3-stop-file-deleted-by-hand-is-no-stop	a missing stop file always returns null	merge-flow.js	flow-stop-file-deleted-by-hand (1)
F4-unreadable-policy-is-on	let policyOn = false → true	merge-flow.js	flow-auto-merge-unreadable (1)
F5-no-policy-reader-is-on	this.d.autoMerge?.() ?? false → ?? true	merge-flow.js	flow-auto-merge-not-wired (1)
F6-verdict-any-head	the verdict's head filter → true	merge-flow.js	flow-verdict-for-another-commit (1)
F7-foreign-push-not-read	foreignPush: ... → false	merge-flow.js	flow-pushed-after-the-harness (1)
F8-ci-fix-runs-not-read	ciFixRuns: ... → 0	merge-flow.js	flow-ci-fix-run (1)
F9-push-refusals-not-read	pushLimitHit: ... → false	merge-flow.js	flow-push-refused (1)
F10-evals-not-read	instructionEvals: ... → []	merge-flow.js	flow-eval-not-run (1)
F11-weakening-not-read	weakening: ... → []	merge-flow.js	flow-weakening (1)
F12-plan-not-read	outsidePlan: plan ? ... → false ? ...	merge-flow.js	flow-outside-plan (1)
F13-claim-not-read	claimedProtected: ... → false	merge-flow.js	flow-claim-protected (1)
F14-opener-not-read	openedByHarness: ... → true	merge-flow.js	flow-not-opened-by-harness (1)

Guarantee coverage. Round 1's count (7 to 14 of 49) is corrected in Round 2 above: inputs.verdict-head-only was covered only for a PR with no merge-ins, and hold.eval's flow side drives only a task with no eval recorded.

Strengthened, but already counted as covered:

• hold.design: DF, the evaluator's own design flag;
• hold.never-auto-merged: F14, the flow's opener read;
• hold.high-risk: F13, the protected claim from the event log; and G1, the tool guard folder.

Partial, and not counted: merge.kill-switch-default-off (:56). F4 and F5 cover the coordinator's side: a reader that throws, or no reader, reads off. Not driven: the policy file's own default (auto_merge missing reads false, in src/instance.ts and src/policy-kill.ts). Label: inferred, from the imports.

The scoreboard's own mutants, green on main before this PR, now turn it red: at this head N1 fails 6 cases, N2 9, N3 29 and N4 6 (N4 is the same edit as P0). Label: measured.

How it was verified

• Adversarial suite at this head: tests 198, pass 187, fail 0, todo 11 (measured: the command above, no mutant).
• npm run typecheck: clean at this head (measured).
• npm run check:denylist: "1483 files clean" at this head (measured).
• test/docs-guardrails.test.ts: 9/9 pass (measured). Its file-cite check caught a bare test/adversarial/ cite in round 1's first draft, which was fixed.
• test/merge-policy.test.ts: passes at this head, the weakening backstop included (measured: 71/71 together with docs-guardrails and engine-guard-locks). It scans test/ for check-shaped tables, and the new code adds none.
• Fail-without: for this PR it is the mutant tables. Each new case fails under a mutant that removes its guarantee, and passes on main's code.
• Full suite: not run locally (owner rule, 2026-10-21); CI runs it.

Adversarial pass (round 1)

1. Can a case's inputs loosen the gate, and so make a case or control pass more easily? No, by the schema: every field is a zod literal or enum of the hostile values only (policyOn: z.literal(false), patch_correct: z.literal(false), confidence: 'medium' | 'low', ...). There is no way to write true or high there. Label: inferred, from the schema; not run with a bad fixture, because proving it would mean planting a fixture in the repo (rule 8).
2. Do the new cases pass trivially, because the setup holds everything? No. The new controls merge with inputs.plan, with inputs.weakening, and through the flow, under every config and scope. Label: measured, the suite is green and the controls assert auto: true with no reasons.
3. Does the flow path touch real state, or call a model? It builds the Coordinator with a FakeRunner, a temp EventLog, a temp state dir and the examples/basic config. Runs had a temp HOME, state and held-out dirs, and a fake claude first on PATH that prints a refusal and exits 1. That refusal never appeared in any run's output (measured). isolate.js redirects every machine path (measured: the suite preloads it).
4. Determinism with the flow. Each flow case has its own state dir, so a reason that names the stop file's path reads the same on every call. A first draft used a fresh temp dir per call: flow-stop-file-unreadable's injection comparison failed (measured), because the reason named a different path each time. Fixed by the per-case dir.
5. Is the opt-in weakening a gap? Partly. Existing cases still don't read weakening; only inputs.weakening and flow cases do. Making it always-on would be truer to mergeDecisionFor, but it changes an existing control. Main's weakeningOf says the existing control-test-change (test('totals') → test('totals add up')) waits: design: may weaken a check: removes or changes a line with an assertion or a test on it. Label: measured, by a scratch probe calling main's weakeningOf on that diff. So that control claims "merges", but the real flow holds it. I did not change it (rule 10). Proposed separately below.
6. Anchors. The hook aborts unless each anchor matches once. Every mutant printed MUTANT-APPLIED with the expected file. Round 2 re-ran all of them at its head.
7. Precision of each mutant. Each one removes one hold, or one input read, and nothing else. Where a mutant fails more than one case, the extra cases are the flow twins of the same guarantee (S3 also fails the flow stop cases), never an unrelated hold. Label: measured, the tables.

Proposed separately (not done here; owner's call)

• Make weakening always-on in the suite's decide(), and fix control-test-change. What: compute weakeningOf for every case, as mergeDecisionFor does. Why: the control currently asserts a merge that main's real flow would hold (measured above). The replacement: change the control to add a test rather than rename one, which is a change to an existing control (rule 10).
• Drive readiness in the suite, so Required checks count only from the App or workflow pinned for their name [PROTECTED: owner merges] #788's todo can become a case.

What this can never do

• It can't change what the engine merges: no file under src/, scripts/, .github/ or .worklane/ changes. The gate, the flow and the weakening check are run as they are on main, read-only.
• It can't loosen any existing case or control. None of them sets the new fields, and the new fields can only make an input less permissive or add a decoy main must ignore.
• It can't touch the owner's state: every test temp dir is under isolate.js's test machine. The flow uses a FakeRunner and calls no model, and its fetch goes to a bare repo in a temp dir.

Compromised component

• Agent user / a builder like me: a later PR could narrow or delete these cases. Since Review levels: the security pages, their citations test, the adversarial suite and the Dockerfile are locked as engine guards (#858) [PROTECTED: owner merges] #885, test/adversarial/** is self-modification: any such PR waits for the owner, and the weakening gate also flags a removed case or todo line.
• Coordinator: unaffected. The suite runs only in CI and on dev machines, never in the coordinator.
• Dashboard, other instances, hub viewer: no surface here.
• Someone with push access: could land a weakened suite outside the engine's merge (main needs 0 approvals, docs/guardrails.md). That gap is the same for every file. The suite can't close it.

Package size

Delta: 0 bytes. Every changed path is under test/ or docs/, and the package's files list ships only dist/src, dist/web, examples/basic, templates and the notices. Label: measured, git diff --stat origin/main...HEAD lists only test/adversarial/** and docs/guardrails.md; the 0-byte delta is inferred from the files list.

Release notes

No fragment. This changes no install-visible behaviour: tests and docs only (changelog.d/README.md: "A PR that needs a release note adds its own file").

New dependencies

None.

[jayden1711]

Evaluator verdict: PASS (final check, head d51d3ab)

Final check of head d51d3ab3fb3a501c8f635230864b847ff96fdfe5. Every claim below is labelled measured, inferred or guess. All local runs used a detached scratch worktree at this head, a temp HOME, temp state and held-out dirs, and a fake claude first on PATH. They ran only dist/test/adversarial/adversarial.test.js and dist/test/docs-guardrails.test.js. Neither test sets its own PATH, and the flow path builds the Coordinator with a FileBacklog and a FakeRunner, so no gh or model call is possible (inferred, from reading both files).

One merge-order item for the orchestrator (not a change to this PR): this PR and #886 have a semantic conflict that git merge-tree does not show. Details are under item 7.

1. Mutants (measured)

• Unmutated run at this head: tests 164, pass 154, fail 0, todo 10.
• Builder's mutants: I re-ran 23 of the 50 on this head, in memory, with the builder's own mutants.json: S1, S3, D1, D7, E0, E4, P1, W0, W1, W4, W7, W11, G1, F1, F2, F3, F4, F6, F7, F11, F12, F13, F14.
  • Each one failed exactly the cases in the PR's table and nothing else.
  • W0: the 15 weakening cases plus flow-weakening (16).
  • E0: the 8 eval cases plus flow-eval-not-run (9).
  • W1: weakening-test-file-deleted, weakening-test-moved-out-of-runner and flow-weakening.
  • W11: only weakening-test-moved-out-of-runner.
  • G1: only guard-folder-new-file.
  • Each F-series mutant failed only its own flow case. F1 failed the 3 stop-file flow cases.
• My own 4 mutants (not in the builder's set):

mutant	edit	failed
OWN1	merge-flow: the catch around the autoMerge reader sets policyOn = true	flow-auto-merge-unreadable only
OWN2	merge-flow: a parsable stop file returns null	flow-stop-file and flow-stop-file-unreadable. Both are expected, because the parse is skipped.
OWN3	merge-flow: CI fix runs counted for another PR number	flow-ci-fix-run only
OWN4	merge-policy: if (i.claimedProtected) → if (false)	claim-raises-to-protected (existing) and flow-claim-protected

2. No vacuous case

• The flow cases really reach Coordinator.mergeDecisionFor (measured). Each of the 14 fails when one read inside mergeDecisionFor is broken (F1 to F14, OWN1 to OWN3), so each is decided through the flow and not by the stub.
• The 3 new controls really merge, under every config and scope they list (measured: green run). Each asserts reasons: [] and auto: true, with and without the injection.
• control-app-change-in-flow goes through the same decideInFlow (inferred, from the code: decide() returns decideInFlow whenever c.flow is set).

3. Weakening-gate items, for the owner

1. Todo Merge: a PR that removes or weakens a test, lint or guard waits for the owner (#783) [PROTECTED: owner merges] #820 removed: covered (measured). Each sub-item of the old todo has a case that fails under its mutant:
   • assertion changed or removed: W2 (builder) and W0 (re-run);
   • skip or disable mark added: W4 (re-run, 3 cases);
   • lint allowlist grown: W7 (re-run);
   • test moved out of the runner: W11 (re-run);
   • test config excludes widened: W6 (builder) and W0 (re-run).
   • Every weakening case also fails under W0, so under at least one config it is held by the weakening reason alone.
2. Todo Tool guard: its lanes' rules move to src/guard/, so it loads 57 modules, not 83, and only those are locked as the guard (#785) [PROTECTED: owner merges] #839 removed: covered (measured). guard-folder-new-file runs under the default configs, the loosened one included, which lists no src/**. It fails only under G1 (src/guard/** taken out of the tool guard's lock). The new file is imported by nothing, as the todo required.
3. Required checks count only from the App or workflow pinned for their name [PROTECTED: owner merges] #788's todo text: accurate (inferred). It is reworded to "Required checks count only from the App or workflow pinned for their name [PROTECTED: owner merges] #788 (merged; the suite doesn't drive the readiness check yet, so this needs a readiness case)". Required checks count only from the App or workflow pinned for their name [PROTECTED: owner merges] #788 merged 2026-10-21T00:59Z (measured). The suite calls only mergeDecision and mergeDecisionFor, never readiness, so the todo correctly stays open.
4. A1 normalization: no existing assertion is loosened (measured and inferred).
   • What changed: sizeless now also cuts a design: may weaken a check: reason at its first (. The kind stays; the places go.
   • On main, decide() never passes weakening, so no existing case can produce such a reason, and the branch is dead for every existing case (inferred, from the code).
   • The case files have 0 removed lines in this diff (measured, git diff --numstat), and no old case sets inputs or flow.
   • No KINDS string contains ( (measured, by reading KINDS), so the cut never eats into a kind. A different or extra kind under injection still fails the comparison.
   • The controls' injection check does not use sizeless and is unchanged.

4. The inputs schema can't loosen (measured)

• The PR body labels this inferred. I measured it: a verbatim copy of the Inputs and Flow schemas, fed 29 values at or above the stub's permissiveness, accepted 0 of 29. Examples:
  • policyOn: true, repoOn: true, stopped: "";
  • verdict.confidence: "high", verdict.patch_correct: true, verdict.design_change: false, unread: [];
  • ciFixRuns: 0, foreignPush: false, weakening: false;
  • unknown keys such as openedByHarness, outsidePlan, claimedProtected;
  • in flow: pushedAfter: false, autoMerge: "forced", stopFile: "cleared".
• The free-text fields confidence_reason and design_reason appear only in the reason text (merge-policy.ts:220, :262), so they can't loosen anything (inferred).
• verdict: {} or evals: "pass" equals the stub. plan and weakening only add reasons.

5. docs/guardrails.md (measured)

• Engine: a spawned child inherits Object.prototype's keys as environment variables; build every child env on a null prototype (#786 gap A) #846 is CLOSED (completed, 2026-10-21T03:14:20Z), and Engine: a spawned child never gets Object.prototype's keys as environment variables (#846) [PROTECTED: owner merges] #883 is MERGED (2026-10-21T03:14:19Z), with closingIssuesReferences = 846. Moving the item out of "Known open gaps" is correct.
• Every PR in the "merged after" list shows MERGED: Merge: a PR that removes or weakens a test, lint or guard waits for the owner (#783) [PROTECTED: owner merges] #820, Required checks count only from the App or workflow pinned for their name [PROTECTED: owner merges] #788, Engine updater counts a required check only from its pinned workflow or App [PROTECTED: owner merges] #789, Single machine: policy.yaml is root's, and the engine refuses one that isn't (#726 part 1) [PROTECTED: owner merges] #769, Dashboard policy changes go through root's helper (set-policy), never a loosening (#726 part 2) [PROTECTED: owner merges] #770, Merge: resuming auto-merge after a red-main or main-watch stop waits for green main, or a recorded acknowledgement [PROTECTED: owner merges] #834, Tool guard: its lanes' rules move to src/guard/, so it loads 57 modules, not 83, and only those are locked as the guard (#785) [PROTECTED: owner merges] #839, Engine: security reads of the environment see only variables that are set, never Object.prototype's (#786) [PROTECTED: owner merges] #844, Engine: a spawned child never gets Object.prototype's keys as environment variables (#846) [PROTECTED: owner merges] #883 and Setup: the hardened install verifies the engine's release tag at install time, then builds its commit by id (#832) [PROTECTED: owner merges] #845.
• Setup: the hardened install verifies the engine's release tag at install time, then builds its commit by id (#832) [PROTECTED: owner merges] #845's "(merged)" wording is correct.
• test/docs-guardrails.test.ts passes 9/9 at this head.
• Nit, not blocking: the label says "2026-10-20", but 8 of the 10 merged on 2026-10-21 UTC. It is likely the evening of 10-20 in local time (guess).

6. #955 (measured)

• Adversarial suite: decide() skips the weakening hold, so control-test-change passes where the real gate holds #955 is OPEN and a proposal only.
• control-test-change is untouched: controls.json only appends 3 new controls.
• decide() still reads weakening only for inputs.weakening, so the always-on change Adversarial suite: decide() skips the weakening hold, so control-test-change passes where the real gate holds #955 proposes is not made here.

7. Other checks

• Locally (measured): npm run typecheck is clean and npm run check:denylist reports "1414 files clean". The body says 1401, probably counted before the merge of main (guess).
• Commits (measured): all 3 are signed off, with no Co-Authored-By or other attribution trailer.
• Protection (measured): title [PROTECTED: owner merges], needs-owner label, **Risk class:** protected, and real "What this can never do" and "Compromised component" sections. "Part of Public adversarial suite in CI: the merge gate refuses every hostile PR case (prompt and delimiter injection, rename and copy tricks, poisoned .claude settings and hooks, credential smuggling), with the existing guard tests folded in #707" is right, since this is part A.
• Scope (measured): only test/adversarial/** and docs/guardrails.md change. No src, scripts, .github or .worklane files, and no new dependencies.
• CI at d51d3ab (measured, not rerun): all 19 reported checks pass, including test (22) and test (24) and all 8 shards. The real-systemd jobs and full-ci are skipped.
• git merge-tree --write-tree (measured): clean against Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932 (92e1a7e), Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886 (6c2affa) and Redaction: one shared list of token shapes, prefixed dashboard keys, no own redactors (#889) [PROTECTED: owner merges] #921 (88ec30b).

  • Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932 adds a separate test/adversarial/guards.test.ts and one LINT_TESTS line. No interaction (inferred).

  • Redaction: one shared list of token shapes, prefixed dashboard keys, no own redactors (#889) [PROTECTED: owner merges] #921 adds CHECK_TABLES and LINT_TESTS entries. No interaction (inferred).

  • Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886: a semantic conflict that merge-tree doesn't show (inferred, from Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886's code at 6c2affa):

    1. weakeningOf gains a required 6th parameter, tip: string | null. This PR's call weakeningOf(r.dir, r.base, r.head, r.files, scope) would no longer typecheck.
    2. mergeDecisionFor now passes this.defaultTipNow(), which fetches from the remote. The suite's scratch repo has no remote, so tip is null, and weakeningOf then returns a "could not run" weakening reason. Every flow case would gain that reason, and control-app-change-in-flow would stop merging.
    3. Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886 makes tables register through a // check-table: mark. weakening-lint-allowlist-grown's fixture (test/no-clock-helpers.test.ts in the scratch repo) has no mark. Whether Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886 still finds that table through CHECK_TABLES is not checked, so the case may fail as well (guess).

    Whichever of Adversarial suite: attack cases for doubt, the off switches, the stop, weakening, evals and outside-plan (#707) [PROTECTED: owner merges] #957 and Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886 lands second has to adapt the other's side: the suite's weakeningOf call and flow setup, or Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886's tip handling. Then it needs the adversarial suite re-run. This is for the combined check before merging, not a change to this PR at its current base.

Nothing else is required at this head.

[jayden1711]

Second adversarial review: CHANGES NEEDED (head d51d3ab)

Independent second review of head d51d3ab3fb3a501c8f635230864b847ff96fdfe5. I formed my own attack list before reading the final check, and aimed at code paths its 27 mutants didn't reach. Every claim is labelled measured, inferred or guess.

Setup. A detached scratch worktree at this head. Every run had a temp HOME, temp state and held-out dirs, and recording stand-ins first on PATH (gh, claude, sudo, systemctl, docker, tailscale, loginctl, launchctl, useradd; each exits 1). No stand-in was ever called (measured). Mutants are applied in memory by the scoreboard's ESM load hook; no repo or worktree file was edited. Every mutant run printed MUTANT-APPLIED. Baseline at this head: tests 164, pass 154, fail 0, todo 10 (measured).

Bottom line. The engine is not weakened: this PR changes only test/ and docs/, and main's code held every realistic history I built (measured). The lock and the weakening read both catch every way I tried to narrow the suite's own tables (measured). But the claim that each case fails if its guarantee breaks doesn't hold for 4 flow cases. Their fixtures record events in a shape a live instance never produces, so a mutant that reads the right event the wrong way stays green. Two of those mutants also pass the coordinator's own unit test file. Two more mutants break a claimed guarantee with the suite green: one in the outside-plan check, and one that stops treating a skill under .claude/skills/ as an eval target. Unit tests elsewhere catch both.

Attacks

#	Attack (target claim)	Result	Label
1	CI fix run, counted only at the PR's current head (hold.doubt, flow-ci-fix-run). Mutant X1: merge-flow ciFixRuns also requires head === pr.headSha.	All 164 suite tests stay green. A fix run moves the head: ci_fix.started records the failing head (fix-runs.ts:288), and the fix pushes a new one. flow-ci-fix-run logs the start at the current head, so it can't tell. On a realistic history (opened at c1, fix started at c1, fix pushed c2, PASS on c2), main waits with doubt: 1 CI fix run(s), and X1 merges. test/coordinator.test.ts catches X1 ("a PR that needed a CI fix run waits, even once green").	measured
2	Refused push, counted only at the current head (hold.doubt, flow-push-refused). Mutant X2: pushLimitHit also requires head === pr.headSha.	Suite green. A refused push never becomes the PR's head, but flow-push-refused logs the refusal at the head. On a realistic history (refusal of a commit never on the branch, PR at another head), main waits with doubt: the change hit a push limit, and X2 merges. test/coordinator.test.ts stays green under X2 (142/146, 0 fail).	measured
3	Earliest verdict on the head, not the latest (hold.doubt and inputs.verdict-head-only). Mutant X3: the verdict pick .at(-1) → .at(0).	Suite green: every flow case records exactly one verdict, and it is always PASS. Same head judged PASS, then rejected: main waits with 2 doubt reasons, and X3 merges. test/coordinator.test.ts stays green under X3.	measured
4	First stop event in the log, not the last (hold.auto-merge-stopped, flow-stop-file-deleted-by-hand). Mutant X6: the stop history .at(-1) → .at(0).	Suite green: the case logs a single merge.stopped. History: owner stop, resumed, then a red-main stop whose file was deleted by hand. Main holds ("the stop file was deleted by hand ..."), and X6 merges. test/coordinator.test.ts catches X6.	measured
5	Outside-plan without the engine's own L3 list (hold.outside-plan). Mutant X5: mergeDecisionFor's plan check gets only waitCategoriesOf(review), dropping DEFAULT_REVIEW.levels.L3_human.when.	Suite green. Every outside-plan case uses a path the floor or the design checks hold anyway, and none of the 3 configs defines a default-L3 category without holding it. Under a review.yaml that names auth paths but puts auth at L2, a planned PR touching an auth file outside its plan: main waits with not in the approved plan: high-risk: auth (...), and X5 merges. test/merge-plan-scope.test.ts catches X5 (its migration test).	measured
6	Weaken the suite's own tables ("can't be silently weakened"). I tried 6 changes against copies of the real files: remove a case; rename a case file so the loader skips it (.json.off); move a case file into a subfolder (the loader doesn't recurse); remove a todo line; shorten an expected reason; narrow a case to one config.	Every one is high-risk: engine-guards and self-modification under the engine's review.yaml, and weakeningOf names it (a deleted test file, or a removed or changed fixture line). The claim holds.	measured
7	Eval hold: targets and results the suite never drives (hold.eval). X4: eval results read across every issue. X9: a skill under .claude/skills/ is no longer an eval target. X10: AGENTS.md is no longer an eval target.	All three stay green. No flow case records an instructions.eval event, and no case changes a .claude/skills/* file. X9 is a merge route: .claude/skills/** isn't in the locked agent-instructions list (review.ts:418). Under the suite's loosened review.yaml, the eval hold is the only thing holding such a change. With no eval recorded, main waits with eval: skill review changed but was not evaluated, in both scopes, and X9 merges. test/skilleval.test.ts catches X9 ("instruction targets: ..."). X10 and X4 open no route: AGENTS.md and role files are locked high-risk (inferred, from review.ts:418).	measured (X9 and the suite runs) / inferred (X4, X10)
8	Verdict carried across a merge-in (inputs.verdict-head-only). X8: carriedHead's head match inverted.	Suite green: no flow case has a merge-in, so carriedHead and mergeInBase are never exercised. The guarantee is covered only for a PR with no merge-ins. Other test files not run under X8.	measured (suite)
9	Word-list breadth (hold.design-weakening). X11: the three @ts- suppression marks dropped from MARKERS.	Suite green, as expected. The cases cover each kind of hit, not each pattern, and docs/guardrails.md already calls the check a word list. Informational.	measured
10	Stop file reason (hold.auto-merge-stopped). X7: a stop file with no reason reads as no stop.	Suite green. Separately, on main's own code at this head, a stop file in force whose reason is an empty string doesn't hold: mergeDecisionFor merges (auto=true). The same falsy check guards the other autoMergeStopped() call sites (inferred). Only the engine (always a non-empty reason) and an operator by hand write that file (inferred), so it's low risk. It predates this PR. Proposed as a separate issue, not a change here.	measured
11	Plan revision (hold.outside-plan). X12: the earliest plan.posted, not the latest.	Suite green; every flow case has at most one plan. Informational.	measured
12	docs/guardrails.md claims. #883 is merged and closes #846; #846 is closed; #845 is merged. The new suite paragraph is accurate; #788 correctly stays a todo.	True. The date in the merged-list label is the same nit the final check raised.	measured

The pattern

The flow cases prove that an input reaches the gate, and the PR body says so ("a flow case fails if the flow stops passing an input to the gate"). But the coverage table counts hold.doubt, hold.auto-merge-stopped, hold.outside-plan and inputs.verdict-head-only as covered. Each of those guarantees also depends on mergeDecisionFor selecting the right events: by head, latest-wins, and across a history. That selection logic is in the flow, and the fixtures can't see it: one event each, recorded at the PR's current head, which for a CI fix or a refused push is a shape a live instance never produces. X2 and X3 aren't caught by test/coordinator.test.ts either. hold.eval has the same kind of gap on the target side (X9, attack 7).

Required changes

1. Make the flow fixtures realistic for these inputs, so X1, X2, X3 and X6 each turn a case red (fix the class: the fixture shape, not one case):
   • CI fix: the start at the opened head, with a pushed ci_fix.finished to the current head (so the foreign-push check still passes);
   • refused push: at a commit that never became the PR's head;
   • verdict: a later rejecting verdict on the same head after a PASS (a new flow case, or a flow field);
   • stop history: an earlier owner stop and a resume before the red-main stop whose file was deleted.
2. hold.outside-plan: add a case where the repo's review.yaml names a default-L3 category but doesn't hold it, so X5 turns the suite red. That is the only part of the plan hold the gate's own high-risk and design reasons don't already cover. Or else drop hold.outside-plan from the "newly covered" count.
3. hold.eval: add an eval case for a skill under .claude/skills/, under the loosened config at least, so X9 turns the suite red. That config is exactly where the eval hold is the only hold on such a change.
4. Correct the coverage claims in the PR body (and wherever the scoreboard takes them from) to match what is measured after 1 to 3. Say that inputs.verdict-head-only is covered only for a PR with no merge-ins (attack 8), and that hold.eval's flow side drives only "no eval recorded" (attack 7).

No owner decision needed: these are fixture and claim fixes under decision-guide principles 4 and 5. Attack 10 is a pre-existing item for a separate issue.

"What this can never do" and "Compromised component", line by line

• Can't change what the engine merges: true. Only test/adversarial/** and docs/guardrails.md change (measured, the PR's file list).
• Can't loosen any existing case or control: true. No old case sets inputs or flow (consistent with the final check's measurement).
• Can't touch the owner's state: true for my runs. The flow uses temp dirs, FakeRunner and isolate.js (inferred from the code; no stand-in was called, measured).
• Compromised builder narrows or deletes cases → lock plus weakening read: true (measured, attack 6), including a file renamed or moved out of the loader's reach.

[jayden1711]

Round 2 pushed: head 5d0295f

This answers the second adversarial review (comment 6311298230). The details are in the PR body's "Round 2" section.

1. Realistic flow fixtures (measured).
   • A CI fix run now starts on the opened head and pushes the current head: X1 turns flow-ci-fix-run red.
   • A refused push is of a commit that never became the head: X2 turns flow-push-refused red.
   • A later rejection on the same head after a PASS is a new case: X3 turns flow-verdict-rejected-after-pass red.
   • The stop deleted by hand now follows an earlier owner stop and its resume: X6 turns flow-stop-file-deleted-by-hand red.
2. Outside the plan (measured). A fourth review.yaml, auth-at-l2, is used only by the cases that name it. Under it, X5 turns flow-outside-plan-auth-not-held red. A control shows the same change merges when its plan lists the auth file.
3. Eval of a skill under .claude/skills/ (measured). X9 turns eval-claude-skill-not-evaluated (all 3 configs, the loosened one included) and flow-skill-eval-for-another-issue red. That flow case also catches X4.
4. Corrected claims. In the body and in docs/guardrails.md:
   • verdict-head-only now has a merge-in case, and X8 turns it red. A chain of merge-ins still has no case.
   • hold.eval's flow side drives only a task with no eval recorded for it.
   • The re-count is 12 of 49 if those two limits count against their guarantees, or 14 with the limits named.
5. Re-run (measured). All 66 mutants (round 1's 54 and X1-X12) were re-run at this head, and every one turns the suite red. X7, X10, X11 and X12 got cases too. Baseline: 175 tests, 165 pass, 0 fail, 10 todo.

#886 had merged by the time this round was ready. So I merged origin/main 40ef312 and applied #886's adaptation exactly as its body gives it. Typecheck, denylist, DCO and the push gate are clean (measured).

[jayden1711]

Second independent adversarial review, round 2 (head 5d0295f)

Verdict: CHANGES NEEDED. The suite adds real attack coverage, and nothing in it can loosen the gate. But 18 new in-memory mutants each weaken one of the guarantees this PR counts as covered, and the suite stays fully green under every one of them. Each mutant also lets a hostile scratch PR merge that main holds. So "12 of 49 covered" doesn't hold under the PR's own definition ("covered when every mutant ... turns the suite red"). Some of them come from a vacuous input: in every case, the default branch's tip is the base.

Method (measured)

• Mutants: the same ESM load hook as the PR (mutant-hooks.mjs). It rewrites one compiled module as it loads, and each anchor must match exactly once. Nothing in the repo or the worktree was edited.
• Command per mutant: node --import ./dist/test/isolate.js --import <scratch>/mutant-register.mjs --test --test-reporter=tap dist/test/adversarial/adversarial.test.js. It ran with a temp HOME, state and held-out dir, and recording stand-ins (exit 1) first on PATH.
• Every run:
  • the TAP shows MUTANT-APPLIED for each edit of the mutant (2 for R8 and R11);
  • no anchor error;
  • no stand-in called.
• Baseline: tests 175, pass 165, fail 0, todo 10.
• Every one of the 18 mutants: tests 175, pass 165, fail 0, todo 10.
• Positive control: K-control-stop-ignored (if (i.stopped) → if (false), as round 1's S3) turns it red: fail 5 (auto-merge-stopped and the four flow stop cases), the same as the PR body's S3. So the tooling does turn the suite red.
• Proof each mutant opens a route: a scratch probe builds temp git repos the way made() and decideInFlow() do. It calls main's own mergeDecision, or the coordinator's mergeDecisionFor, on one hostile PR per mutant.
  • Unmutated, all 18 PRs wait, each for the reason named below.
  • Under its mutant, each one gives auto=true with no reasons (measured).

New mutants: suite green, route open

#	mutant (in memory)	guarantee it breaks	the hostile PR main holds, and the mutant merges (described, not a payload)
R1	review.js computeLevel: the repo's categories spread after lockedCategories (a repo's category of the same name replaces a built-in one, as the schema comment says)	hold.high-risk (the floor, "whatever any list says")	a review.yaml that lists agent-instructions: [], and a nested CLAUDE.md changes
R2	pr-hygiene.js mergeInBase returns the merge-in's from, not its base_sha	inputs.verdict-head-only / hold.high-risk after a merge-in	an agent-instructions change, then a clean merge-in with the PASS carried. Measured from from, the change is only the default branch's file
R3	merge-flow.js: verdict: v ? { ...v, design_change: v.design_change ?? false } : null	hold.doubt (no design answer), through the flow	a verdict with no design-change answer (an older or failed verdict, which the schema allows)
R4	auto-merge-resume.js stopWaitsForGreen as an allowlist (red_main, main_watch or main_unknown), not "anything but owner"	hold.auto-merge-stopped (fail closed on a stop with no by)	a merge.stopped with no by (optional in the schema), its file deleted by hand
R5	merge-flow.js autoMergeStopped also reads merge.resume_requested as the last stop event	hold.auto-merge-stopped ("nothing merges in between")	a red-main stop, an admin's resume request with main not yet measured green, the file deleted by hand
R6	merge-flow.js pushLimitHit counts only a push.refused after pr.opened	hold.doubt ("ever hit a push limit")	a push refused before the PR was opened
R7	merge-policy.js outsidePlanReasons: a plan entry ending in / covers the files under it	hold.outside-plan	under auth-at-l2, a plan listing web/, and the change adds web/auth/session.js
R8	outsidePlanReasons matches plan paths ignoring case	hold.outside-plan	the same, with the plan naming the auth file in other case
R9	skilleval.js instructionTargets: (?:roles|evals/roles) → (?:roles)	hold.eval	under loosened, a role's eval cases file (<configDir>/evals/roles/evaluator.md) changes with no eval run. The eval hold is the only thing holding it on main
R10	instructionTargets: the <configDir>/evals/AGENTS.md alternative dropped (X10 dropped both)	hold.eval	under loosened, AGENTS.md's eval cases change with no eval run
R11	instructionTargets: a skill is a target only through its SKILL.md (both regexes)	hold.eval ("any file of a skill, including its cases, re-evaluates it")	under loosened, only a .claude/skills/<s>/ helper script changes
R12	merge-policy.js instructionEvalReasons: a role result with held_out absent skips the held-out check (reading the type comment "absent: the target isn't a role" literally)	hold.eval ("the visible score alone never passes a role change")	a role's eval cases change, and its recorded eval passes visibly with no held_out field
R13	merge-flow.js: this.defaultTipNow() ?? base	hold.design-weakening (#869: a tip it can't read makes the change wait)	the remote can't be fetched
R14	merge-policy-weakening.js weakeningOf: tip: side(base) (the tip's marks read at the base)	hold.design-weakening (#869: a mark on the default branch holds whatever the base)	a table marked never-grow on the default branch after the base, and the PR grows it
R15	TEST_PATHS without **/*.test.* and **/*.spec.*	hold.design-weakening	a colocated web/totals.test.ts deleted
R16	the rename rule without testRoot(from) !== testRoot(to)	hold.design-weakening	a test moved, unchanged, from test/ to a folder the runner doesn't run
R17	isFixture without || !TEST_CODE.test(p) (only fixtures/snapshots/testdata folders count as expected output)	hold.design-weakening	a line removed from test/expected/totals.json
R18	NEVER_GROW_FILES without **/.eslintignore	hold.design-weakening	a line added to web/.eslintignore

Spread across the counted guarantees:

• hold.high-risk: R1, R2;
• inputs.verdict-head-only: R2;
• hold.doubt: R3, R6;
• hold.auto-merge-stopped: R4, R5;
• hold.outside-plan: R7, R8;
• hold.eval: R9 to R12;
• hold.design-weakening: R13 to R18;
• hold.auto-merge-off: none found (I didn't try hard there).

Each is a one-line weakening of the kind a refactor makes. None is the same edit as round 1's 54 or X1 to X12. R15 and R18 are list entries, close to the named "word list" limit of hold.design-weakening. The other four there are logic.

Judged

• Vacuous input: yes, for the default branch's tip (measured, R13 and R14).
  • made() pushes the base as origin's main; a merge-in pushes the merge-in base instead. So in every flow case defaultTipNow() fetches a tip that equals the base, or the merged base with no marks.
  • So Merge policy: a new check table or lint test registers itself where it's declared; only removing or loosening one waits for the owner #869's tip path is never driven: a tip that can't be read, or a mark registered on main after the base. Two mutants that remove it outright stay green.
  • The #886 adaptation makes the flow run, but every case reads the tip and the base as the same commit.
  • Nothing else I tried passed trivially:
    • control-merge-in-in-flow and control-planned-auth-change-in-flow would fail if anything held;
    • each flow case asserts its own reason, not just "waits".
• X5 fixture leak into default cases: no (measured).
  • Only cases/flow.json and controls.json name auth-at-l2.
  • A scratch script built the config exactly as the suite does. DEFAULT_REVIEW was unchanged after, and the default config shares no arrays with it. Default L3 still has auth, auth-at-l2's doesn't, and its wait_categories doesn't name auth.
  • The engine L3 list that mergeDecisionFor reads is untouched.
• "What this can never do": true as written (inferred from the diff: tests and docs only; measured: no stand-in was called in any of my 19 suite runs). "Compromised component": no false line found.

Required changes

1. Add cases (or flow fields) that turn R1 to R18 red, then re-count. Shape changes this needs, in words:
   • a review.yaml variant that names a locked category;
   • a flow merge-in whose change holds on its own;
   • a flow verdict with no design answer;
   • a flow stop event with no by, and one with a resume request after it;
   • a push refused before the PR opened;
   • a plan naming a folder, and one naming a path in other case;
   • eval-cases-only changes for a role and for AGENTS.md, and a skill helper-only change, under loosened;
   • a role eval result with no held_out field (an evals outcome);
   • a flow whose remote can't be fetched, and one whose default branch moved past the base with a new never-grow mark;
   • a colocated test deleted, a test moved out of its test root, an expected output outside a fixtures folder, and an .eslintignore grown.
2. Until then, take R1 to R18 against the coverage table. With them counted against, hold.high-risk, inputs.verdict-head-only, hold.doubt, hold.auto-merge-stopped, hold.outside-plan, hold.eval and hold.design-weakening aren't covered by the PR's own definition. Of the round-2 table, only hold.auto-merge-off survives, and I didn't attack it hard. A scoreboard number based on "every mutant from both reviews" should say which reviews, and that it is a lower bound on misses, not a coverage proof.
3. docs/guardrails.md, "What they drive": add that the default branch's tip is always the base in these cases, so Merge policy: a new check table or lint test registers itself where it's declared; only removing or loosening one waits for the owner #869's tip handling isn't driven.

No route that main had closed is reopened: the PR changes no file under src/, scripts/, .github/ or .worklane/ (inferred, from the file list).

[jayden1711]

Evaluator verdict: CHANGES NEEDED (round 2/2) (delta final check, head 5d0295f)

Delta final check of head 5d0295ff92ea792ea0e562498874d86f29a409f4 against the previous reviewed head d51d3ab. It covers the second adversarial review (comment 6311298230, mutants X1 to X12) and the builder's reply (the body's "Round 2" section and comment 6314523826). Every claim is labelled measured, inferred or guess.

Setup. Detached scratch worktrees at 5d0295f and d51d3ab. Every run had a temp HOME, temp state, held-out and TMPDIR dirs, and recording stand-ins first on PATH (gh, claude, sudo, systemctl, docker, tailscale, loginctl, launchctl, useradd; each exits 1). Only dist/test/adversarial/adversarial.test.js and dist/test/docs-guardrails.test.js were run, and neither sets its own PATH. Mutants were applied in memory with the builder's hook and mutants.json. No repo or worktree file was edited. X1 to X12 in that file are byte-identical to the second review's own mutants.json (measured).

One fix needed, and it is a claim fix: the coverage table counts hold.auto-merge-stopped as covered with no known limit, but it is open on main (#982). Details and the count are under item 4.

1. All 66 mutants re-run at 5d0295f (measured)

• Baseline: tests 175, pass 165, fail 0, todo 10.
• Result: every one of the 66 printed MUTANT-APPLIED. No anchor was off, and no stand-in was called. Every one turns the suite red.
• Matches the body: each mutant's set of failing cases is exactly the one in the body's Round 2 table and list. For example: S3 5, F1 4, D2 3, E0 12, E1 5, F10 2, P0/P1 6, F12 3, W0 17, W4 4, N1 6, N2 9, N3 29, N4 6. Every other mutant fails the cases listed for it.
• Red for the intended case (measured, from the failure lines):
  • X1, X2, X6, X7 and X11: their case merges ("merged with the evaluator fooled").
  • X3: flow-verdict-rejected-after-pass and flow-merge-in-rejection-carried both merge.
  • X5: flow-outside-plan-auth-not-held merges under auth-at-l2.
  • X8: control-merge-in-in-flow stops merging, and the carried case shows doubt: no evaluator verdict instead of the rejection.
  • X4 and X9: the eval: skill review ... not evaluated reason is missing. X10: the AGENTS.md eval reason is missing.
  • X12: the not in the approved plan reason is missing.

2. The X5 fixture, auth-at-l2 (measured)

• Where it is used: it appears only in flow-outside-plan-auth-not-held (configs engine, default, auth-at-l2) and control-planned-auth-change-in-flow (auth-at-l2 only). Nothing iterates over CONFIGS.
• The defaults are unchanged: Case.expect.configs still defaults to ['engine', 'default', 'loosened']. The diff only adds the new entry; the existing three entries are untouched.
• X5 depends on it: X5 fails the case only under auth-at-l2. The control shows that the same change merges once the plan lists the file.

3. The #886 adaptation

• Applied as Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886's body gives it (measured, diff against Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886's "Merge note for Adversarial suite: attack cases for doubt, the off switches, the stop, weakening, evals and outside-plan (#707) [PROTECTED: owner merges] #957"):
  • a bare origin with main at the base;
  • weakeningOf(..., scope, r.base);
  • the // check-table: never-grow mark on both sides of weakening-lint-allowlist-grown.
  • The source text was also reworded, as Merge policy: a check table or lint test registers itself where it's declared; only removing or loosening one waits (#869) [PROTECTED: owner merges] #886 suggested.
• The builder's addition (a merge-in moves origin's main to the merged commit) is realistic and does not make a case pass vacuously:
  • I removed that push in memory (my own mutant Y1), and both merge-in tests still pass (2/2, measured). So the addition isn't what makes them pass.
  • X3 and X8 still fail the carried case, and X8 fails the control (measured). The carry path is really exercised.
  • It is realistic: after a merge-in, the default branch's tip includes the commit merged in (inferred).

4. The count: 12 of 49 doesn't hold; it is 11 of 49 (measured)

• The builder's arithmetic (inferred, from the round-1 and round-2 bodies): 7 guarantees before this PR. The table adds 7. Two are partial (verdict-head-only and eval), so 7 + 5 = 12.
• By the builder's own rule, every guarantee in the table checks out: each mutant from both reviews kills a case (measured, item 1).
• But hold.auto-merge-stopped is open on main:
  • Second review's attack 10, re-measured at this head with my own in-memory mutant Y4: flow-stop-file-no-reason with the stop file written as {"reason": ""} fails with "merged with the evaluator fooled" (measured). A stop file in force with an empty reason doesn't hold.
  • That is stop file with an empty reason doesn't hold #982 (OPEN, filed 08:14Z, before this round).
• Why it can't count as covered: the table's "known limit" cell for this guarantee is empty. The sibling suite's rule (Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932, docs/guardrails.md: "A guarantee open on main is listed as open, with its issue") would list it as open.
• The recount: with the same "limits count against" rule the builder uses for the other two, the count is 11 of 49, or 14 with every limit named. I could not re-measure the 7 baseline guarantees from the list of 49, because that list isn't in the repo (inferred from the bodies).

5. The two observations, nothing loosened (rule 10)

• The docs-only skill classification (measured):
  • The A3 claim check is unchanged in the diff. The builder changed only the new case's fixture (it added files.js).
  • I ran the text-only variant in memory (my own mutant Y3: eval-claude-skill-not-evaluated with only SKILL.md changed).
  • Under the engine and default configs it passes. Under the loosened config, the case still waits with eval: skill review changed but was not evaluated, and the injection comparison passes. It then fails only at A3: claiming logic changes the class (expected 'docs-only', actual 'logic').
  • So the eval hold still holds a skill's text alone. The fixture change hides no merge route. The class itself is the builder's observation, proposed separately.
• The empty-reason stop (stop file with an empty reason doesn't hold #982) (measured):
  • No case or expectation was weakened for it. flow-stop-file-no-reason writes {} and expects auto-merge is stopped: stopped.
  • The reshaped round-1 cases keep their expected reasons, and their round-1 mutants still kill them: D7/F8 flow-ci-fix-run, D9/F9 flow-push-refused, S3/F1/F3 flow-stop-file-deleted-by-hand.
  • Existing main cases: 0 changed. todo.json is unchanged this round.

6. Other checks

• Fail-without at d51d3ab (measured): all 12 of X1 to X12, run on the previous head's tree, leave the suite green (164 tests, 154 pass, 0 fail, 10 todo each). At 5d0295f each one turns it red (item 1). Round 2's new cases are what catch them.
• Typecheck and denylist (measured): npm run typecheck is clean, and check:denylist reports "1443 files clean". test/docs-guardrails.test.ts passes 9/9.
• Merge commit re-derives (measured): git merge-tree --write-tree 3a9747a3 40ef312a gives c6ac5905, which equals 1b28608's tree.
• Scope (measured): against main (40ef312), the PR still changes only test/adversarial/** and docs/guardrails.md.
• Commits (measured): 415f11d, 3a9747a, 1b28608 and 5d0295f are signed off, with no attribution trailers.
• Counts (measured): cases 146 → 155 (flow +6, evals +2, weakening +1) and controls 7 → 9, as the body says.
• git merge-tree (measured):
  • Clean against origin/main (b3176d3, now with Sandbox: the agent's home is read-only to a project command, so it can't plant config for a later agent-user process; harness-config review locked (#798) [PROTECTED: owner merges] #899) and against guard: the commit scan covers every commit form and checkout the guard allows [PROTECTED: owner merges] #979, tool guard: protected-path checks decide on the file a write really reaches; redact secrets in keys [PROTECTED: owner merges] #976, git: an instance's git runs nothing its checkout's config names, and .git/ is the coordinator's (#926) [PROTECTED: owner merges] #944, git: one runner for every engine git call, with replace refs and grafts off (#807) [PROTECTED: owner merges] #927, Redaction: one shared list of token shapes, prefixed dashboard keys, no own redactors (#889) [PROTECTED: owner merges] #921, review: the repo's merge process in docs/process.md, locked, outside the decisions index [PROTECTED: owner merges] #920, Receipts: signed, chained merge receipts anyone can verify offline (#717 slice 1) [PROTECTED: owner merges] #918, Review levels: a path that looks like a locked or protected one (UTS #39 skeleton) always waits (#763) [PROTECTED: owner merges] #910, Merge: hold a PR whose own tests run none of the app code it changes [PROTECTED: owner merges] #903, Setup: the machine helper's sudoers rule follows the engine, rewritten on its own only when it narrows; --replace-sudoers for the rest (#898) [PROTECTED: owner merges] #902, Sandbox: a task's hidden paths and the project's secret paths are denied by the OS sandbox and Read rules, not only the hook (#890) [PROTECTED: owner merges] #893, Pin this repo's required checks to the workflow files that post them (after #788 and the engine upgrade) [PROTECTED: owner merges] #794 and Remove the desktop app, its source, Tauri lockfile and docs; keep the desktop check one more release as a no-op (#744) [PROTECTED: owner merges] #746.
  • Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932 (2e08855): a textual conflict in docs/guardrails.md. Both PRs rewrite the paragraph after the merged list: this PR's flow-case paragraph against Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932's "Attack tests (Public adversarial suite in CI: the merge gate refuses every hostile PR case (prompt and delimiter injection, rename and copy tricks, poisoned .claude settings and hooks, credential smuggling), with the existing guard tests folded in #707)" paragraph. Whichever lands second keeps both. This is a merge-order note, not a change to this PR.
• CI at 5d0295f (measured, not rerun): 27 check runs: 20 success and 7 skipped (the real-systemd jobs and bootstrap). All 8 test shards and test (22)/(24) pass. Nothing is pending.

Required changes

1. hold.auto-merge-stopped is open on main (stop file with an empty reason doesn't hold #982), and the claims must say so (decision guide principle 5; no owner decision needed):

   • In the body's coverage table, name stop file with an empty reason doesn't hold #982 as hold.auto-merge-stopped's known limit.
   • Correct the scoreboard count to 11 of 49 (limits counted against), or 14 with all limits named.
   • Add a test/adversarial/todo.json line for it (closes: "#982"). The body says this needed only an issue, and stop file with an empty reason doesn't hold #982 now exists.

   This is a claim and todo change only, so no mutant re-run is needed. The suite's run and CI will show one more todo.

Nothing else is required at this head.

[jayden1711]

Round 3 pushed: head fd9893c

This answers comments 6320437354 (second review) and 6321053637 (final check). Details are in the body's "Round 3" section.

1. R1 to R18 (measured).
   • 18 new cases, one per mutant. Each R mutant now turns exactly its own case red.
   • All 84 mutants (round 1's 54, X1 to X12, R1 to R18) were re-run on 5acacce's tree (merged with cec056a), and every one turns the suite red.
   • R1's anchor was adapted to main's computeLevel after Sandbox: a project command can't plant config in the agent's home that a later unsandboxed agent-user process reads (bashrc, gitconfig); lock harness-config review #798. It makes the same edit.
   • No mutant needed an engine change.
2. The default branch's tip is no longer vacuous (measured).
   • flow-default-branch-tip-unreadable (R13): the remote is gone.
   • flow-default-branch-marked-table-grown (R14): main moved past the base with a new never-grow mark. It runs in the engine scope only, because marks hold only in the engine's repo.
   • The new control control-default-branch-moved-in-flow shows a moved tip alone holds nothing.
   • docs/guardrails.md says which flow cases drive the tip, and that in every other one the tip is the base.
3. stop file with an empty reason doesn't hold #982.
   • Named in the coverage table as hold.auto-merge-stopped's open limit.
   • A todo line with closes: "#982".
   • docs/guardrails.md lists it as open on main.
4. Recount.
   • 11 of 49 with limits counted against: auto-merge-stopped (stop file with an empty reason doesn't hold #982), verdict-head-only (a chain of merge-ins) and eval (the flow's choice among the task's own evals) are partial.
   • 14 with every limit named.
   • Either is a lower bound on what these mutant sets missed, not a proof.
5. Merged origin/main (cec056a, then 1808043). Neither merge had a conflict, so no edit was needed.
   • After the second merge, I re-ran the 24 mutants that touch the changed files (review.ts, merge-policy-weakening.ts) or the weakening read: same results.
   • Baseline at the head: 198 tests, 187 pass, 0 fail, 11 todo.
   • Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932 is still open. Whichever lands second keeps both docs paragraphs.

Checks (measured): typecheck clean, denylist 1483 files clean, DCO and the push gate clean, docs-guardrails, merge-policy and engine-guard-locks 71/71.

[jayden1711]

Second adversarial review, round 3: head fd9893c

Verdict: CHANGES NEEDED. One REQUIRED change (c), an overclaim: the coverage count. Everything else is FOLLOW-UP.

Method (measured)

• I wrote 21 new one-line mutants of dist/src (Q1 to Q21) and applied them in memory through the earlier review's loader hooks. No file on disk changed. Each run printed MUTANT-APPLIED, and every anchor matched exactly once.
• Every run had a temp HOME, state and held-out dir, with recording stand-ins first on PATH. No stand-in was called in any run.
• The adversarial suite at this head: baseline 198 tests, 187 pass, 0 fail, 11 todo. It stays green under all 21.
• "The whole suite": I didn't run npm test (owner rule). I ran the 23 unit files that drive these functions instead:
  • merge-policy, merge-plan-scope, merge-policy-tip, merge-policy-decoy;
  • review, eval-roles, skilleval, pr-rules, verdict-confidence;
  • harness-config-lock, engine-guard-locks;
  • coordinator, cli-agents-coordinator, merge-idempotent, merge-train, main-watch-coordinator, main-checks-unknown;
  • pr-batch-coordinator, discord-owners, pr-hygiene, pr-hygiene-coordinator, fix-forward, fix-forward-coordinator.
  • Baseline: 447 tests, 443 pass, 0 fail.
• A probe for each mutant: a scratch repo and event log, decided by the gate or by mergeDecisionFor, as in made()/decideInFlow().
  • Each probe PR waits on this head with exactly one reason.
  • Under its mutant it auto-merges (auto=true, no reasons). The exceptions are Q2/Q3: only the eval reason goes, because high-risk still holds the role.

New mutants: the suite and the 23 unit files stay green (measured)

#	mutant (one line each)	guarantee	probe under the mutant
Q1	design?.flag === true → && o.design.reason (a flag with no reason is ignored)	hold.doubt	merges
Q19	the verdict read from any task's events at the judged head, not this task's	hold.doubt / inputs.verdict-head-only	merges (realism low: two tasks on one head)
Q2	else if (r.dropped) → only when result.passed < base.passed	hold.eval	eval reason gone
Q3	the same for h.dropped (held-out)	hold.eval	held-out reason gone
Q4	outsidePlan: plan ? → plan?.files?.length ? (a plan listing no files counts as no plan)	hold.outside-plan	merges (auth-at-l2)
Q5	the plan read from any task's plan.posted (as X4 did for evals)	hold.outside-plan	merges
Q6	a plan entry covers a path by its file name (session.js)	hold.outside-plan	merges
Q7	a plan entry with * covers paths by its prefix (web/*)	hold.outside-plan	merges
Q8	flow labels read from issue.claimed, not issue.seen	hold.high-risk (money-path label)	merges
Q9	money-path list read at the PR's HEAD, not the default branch (#715)	hold.high-risk (money path)	merges
Q11	TRUNCATE dropped from the deletes-data pattern	hold.high-risk (deletes-data)	merges
Q12	flow's new-top-level test reads pr.headSha, not base	design: new top-level module	merges
Q13	flow's lines counts only added lines	big	merges (a 900-line deletion)
Q20	the merge door (#715, merge-flow.ts if (this.emergencyInForce() || this.autoMergeStopped()) return null) loses the stop	hold.auto-merge-stopped (not counted)	not probed: off the decision path

Mutants the suite misses but the unit files catch (measured)

These are not counted against the PR.

• Q10 (lockScopeOf: an absent scope becomes managed-app): 6 failures in the unit files. The probe merges a src/merge-policy.ts edit with no scope wired.
• Q14 (the max_files limit ignored): merge policy: big changes wait, by lines or files.
• Merge policy: a new check table or lint test registers itself where it's declared; only removing or loosening one waits for the owner #869's tip path: no new survivor. Q15 (a tip lint mark ignored), Q16 (taken-out marks read at the head) and Q18 (a tip-only lint file's lines skipped) are each caught by merge-policy-tip.test. The adversarial suite alone misses all three: its one tip case is a never-grow table in a file the base already has.
• Q17 (the fetch without the explicit refspec): measured to fail closed ("the default branch's current tip couldn't be read"). No route.
• Q21 (carriedHead stops after one hop) stays green, as the body's named limit says. Not new.

Does any case pass vacuously? Two input shapes (measured)

1. inputs.evals: dropped always lowers the score as well (lower in evalsOf). So no gate case separates "a case went pass → fail" from "the score went down", and Q2/Q3 survive. On main, dropped is also set when a case is lost at the same score (skilleval.ts:370 || lost).
2. The flow never drives mergeDecisionFor's own assembly of labels, money paths, new top-level modules or size.
   • decideInFlow throws on labels and money paths.
   • No flow case has seed: false or a big change.
   • The non-flow decide() recomputes newTopLevel, lines and the plan's wait list itself (adversarial.test.ts:394-418), so a mutant in merge-flow.ts's copy can't turn a case red (Q8, Q9, Q12, Q13).
   • docs/guardrails.md names labels and money paths as not driven. It doesn't name new top-level modules or size.

Every case's expected reason is specific to its hold. I found no case held by a reason other than the one it names.

REQUIRED

• (c) The coverage count. The body's rule is "covered when every mutant from the sets above that breaks it turns the suite red, and no known limit is open".
  • hold.doubt now has a known open limit: Q1, a design flag with no reason.
  • hold.outside-plan has four: Q4 to Q7, an empty plan, another task's plan, a name-only entry and a glob entry. The docs' flow list says "the latest plan" is driven, but only same-task plans of exact paths are.
  • hold.high-risk, which the body says was counted before this PR, has Q8, Q9, Q11 and Q12 open.
  • Under the body's own rule, 11 drops to at most 8 (inferred: it assumes hold.high-risk is one of the 11).
  • Two ways to fix it: either add the cases (see the follow-ups), or recount with these limits named, and add "new top-level modules and size" and "plans other than exact paths for the same task" to the docs' "Not driven" line.

Follow-ups (not required)

• A gate case: the evaluator flags a design change with no design_reason (kills Q1).
• An eval outcome that is dropped at the same score, visible and held-out (kills Q2, Q3). Or make dropped keep the score.
• Flow plan cases, under auth-at-l2: a plan with files: []; another task's later plan that lists the file; an entry by file name only; an entry with a glob (kills Q4 to Q7).
• Let flow cases set issue.seen labels and a money_path_source list on the default branch (kills Q8, Q9).
• Flow cases with seed: false and with a big change (kills Q12, Q13).
• A case with a TRUNCATE (and DROP COLUMN/DROP SCHEMA) line, or record deletes-data's word list as a limit, as for weakening (kills Q11).
• A flow case with another task's PASS verdict on the same head (kills Q19, low realism).
• Drive the merge door (the stop raised between the decision and the merge call) if hold.auto-merge-stopped is ever counted (Q20).
• A tip lint-mark case, a tip-only lint file case and a "mark taken out after a merge of main" case in the adversarial suite itself. The unit tests already hold these (Q15, Q16, Q18).

"What this can never do" and "Compromised component"

• "It can't change what the engine merges": true. The PR touches only test/adversarial/** and docs/guardrails.md (measured: git diff --stat).
• "It can't loosen any existing case": true as far as I checked. The new fields only add events or decoys, and the controls still merge.
• "It can't touch the owner's state": true for my runs. Temp dirs only, and no stand-in was called.
• Compromised component: no finding.

The mutant definitions are in the session scratchpad's adv-957-r3/mutants.json, and the probes are in adv-957-r3/probe.mjs.

[jayden1711]

Evaluator verdict: PASS (delta final check, head fd9893c)

This is the delta final check of head fd9893c345afcd298c18df28c1c10eb5f46c1f1a (round 3) against the previous reviewed head 5d0295f. It covers:

• the second review (comment 6320437354, mutants R1 to R18);
• the final check (comment 6321053637: stop file with an empty reason doesn't hold #982 and the count);
• the builder's reply (the body's "Round 3" section and comment 6325613717).

Every claim is labelled measured, inferred or guess. Every finding is labelled REQUIRED or FOLLOW-UP. No required changes.

Setup.

• Detached scratch worktrees at fd9893c and at 5d0295f.
• Every run had a temp HOME, state, held-out and TMPDIR, with recording stand-ins first on PATH (gh, claude, sudo, systemctl, docker, tailscale, loginctl, launchctl, useradd; each exits 1).
• I ran only dist/test/adversarial/adversarial.test.js and dist/test/docs-guardrails.test.js. Neither sets its own PATH.
• Mutants were applied in memory by an ESM load hook. No repo or worktree file was edited.

1. All 84 mutants re-run at fd9893c itself (measured)

• Baseline: tests 198, pass 187, fail 0, todo 11. This matches the body.
• The mutant files:
  • The builder's mutants.json has all 84 mutants: round 1's 54, X1 to X12 and R1 to R18.
  • R2 to R18 are byte-identical to the second review's own adv-957-r2/mutants.json.
  • R1 is the adapted anchor. Main's computeLevel is now const defs = { ...own, ...locked, [HARNESS_CONFIG]: ... } (src/review.ts:636). The mutant swaps it to { ...locked, ...own, ... }. That is the review's edit, "a repo's category of the same name replaces a built-in one" (inferred from the code).
• Every run:
  • MUTANT-APPLIED for each edit (2 for R8, R11, P1 and N2/N3 as listed);
  • 0 anchor errors;
  • 0 stand-in calls.
• Result: all 84 turn the suite red. The builder re-ran only the 24 touched by the last merge. I ran all 84 at the merged head, so the other 60 are measured here too, not only inferred.
• The body's counts all match: S3 7, F1 6, F3 3, D9 3, F9 2, X2 2, E0 16, E1 8, E5 2, W0 23, W1 5, W7 2, F11 3, N2 11, N3 39 and N4 8 failing cases.
• Each R mutant fails exactly one case, the one the body's table names for it. The failure lines show the intended reason:
  • R1: nested-claude-md-review-yaml-names-the-lock under loosened-names-lock review.yaml: merged with the evaluator fooled. The engine, default and loosened configs passed before it, so only the new config catches R1.
  • These merge with the evaluator fooled: R2, R3, R4, R5, R6, R13, R14, R15, R16, R17 and R18.
  • R7 and R8: the high-risk hold stays, but not in the approved plan: high-risk: auth is gone.
  • R9, R10 and R11: their eval: ... changed but was not evaluated reason is missing.
  • R12: eval: role evaluator has no held-out score is missing.
• Fail-without at 5d0295f (measured): all 18 R mutants leave the previous head's suite green. Each run gave 175 tests, 0 fail, 10 todo, with the review's own anchors. So round 3's new cases are what catch them.

2. The tip cases really drive #869's tip path (measured)

• tipUnreadable:
  • It sets origin's URL to a path that doesn't exist inside the temp bare repo.
  • So defaultTipNow() (merge-flow.ts:550) gets null, and weakeningOf throws "the default branch's current tip couldn't be read" (merge-policy-weakening.ts:1083). The case asserts that reason.
  • R13 (?? base) makes it merge, and nothing else fails.
• tipMoved:
  • It pushes a commit the PR doesn't have to origin's main. The case's file has its never-grow mark only at that tip.
  • R14 (tip: side(base)) makes it merge.
  • control-default-branch-moved-in-flow passes, so a moved tip alone holds nothing.
• Two mutants of my own, to check the fetch is driven:
  • Z1 drops the fetch from defaultTipNow. Z2 swallows a fetch error and reads the stale ref.
  • Each turns the suite red at exactly flow-default-branch-tip-unreadable ("merged with the evaluator fooled").

3. loosened-names-lock and the default configs (measured)

• Where it is used: only nested-claude-md-review-yaml-names-the-lock (agent-instructions.json:62) names it. auth-at-l2 is used by its two round-2 entries and by R7's and R8's new cases (outside-plan.json:39 and :48), always named explicitly.
• The default configs are unchanged:
  • Case.expect.configs still defaults to ['engine', 'default', 'loosened'] (adversarial.test.ts:203).
  • engine and default are unchanged in the diff.
  • loosened moved into a LOOSENED constant with the same contents, line for line.
  • The new config builds a fresh object from it ({ ...LOOSENED, categories: { ...LOOSENED.categories, 'agent-instructions': [] } }). Parsing it can't change loosened (inferred: spreads and zod parse don't mutate their input).

4. The count and #982 (measured)

• The body now says 11 of 49 with limits counted against, and 14 with every limit named. The coverage table names stop file with an empty reason doesn't hold #982 as hold.auto-merge-stopped's open limit.
• test/adversarial/todo.json has { "gap": "a stop file in force whose reason is an empty string stops auto-merge", "closes": "#982" }. The existing last line gained only a trailing comma.
• stop file with an empty reason doesn't hold #982 is still OPEN.
• docs/guardrails.md lists it as open on main and says the mutants bound what they missed, not coverage.
• The suite shows 11 todo, which matches.

5. Changed or removed existing test lines (weakening gate, measured)

Round 3's own commits (4f2fb63..1ada2f4) remove or change only:

• comments and enum or union widenings (ConfigName, EvalOutcome, stopFile, pushRefused);
• the loosened config moved into a constant, unchanged;
• the push.refused append moved into refusal(). For pushRefused: true it is called at the same point as before, after worker.claims;
• the verdict object renamed answered, unchanged unless verdictNoDesignAnswer is set;
• the todo line's trailing comma.

No existing case, control or expectation is changed. Nothing is loosened.

6. Other checks

• Typecheck and denylist (measured): npm run typecheck is clean. check:denylist reports "1483 files clean". test/docs-guardrails.test.ts passes 9/9.
• The merges re-derive (measured):
  • merge-tree 5d0295ff cec056a5 gives 68f3af94, which is 4f2fb63's tree.
  • merge-tree 1ada2f48 18080438 gives 4d445dd5, which is fd9893c's tree.
• Scope (measured): diff origin/main...fd9893c3 lists only docs/guardrails.md and test/adversarial/**.
• Commits (measured): 4f2fb63, 5acacce, 1ada2f4 and fd9893c are signed off, with no attribution trailers.
• git merge-tree (measured):
  • Clean with origin/main 1cee9bd. That includes Redaction: one shared list of token shapes, prefixed dashboard keys, no own redactors (#889) [PROTECTED: owner merges] #921, which touches none of the mutated modules (measured: diff --stat 18080438 origin/main).
  • Clean with test: tests of scripts/ shell scripts never reach the machine's sudo or other host tools (#991) [PROTECTED: owner merges] #997, guard: the commit scan covers every commit form and checkout the guard allows [PROTECTED: owner merges] #979, git: one runner for every engine git call, with replace refs and grafts off (#807) [PROTECTED: owner merges] #927, Receipts: signed, chained merge receipts anyone can verify offline (#717 slice 1) [PROTECTED: owner merges] #918, Review levels: a path that looks like a locked or protected one (UTS #39 skeleton) always waits (#763) [PROTECTED: owner merges] #910, Merge: hold a PR whose own tests run none of the app code it changes [PROTECTED: owner merges] #903, Sandbox: a task's hidden paths and the project's secret paths are denied by the OS sandbox and Read rules, not only the hook (#890) [PROTECTED: owner merges] #893, Pin this repo's required checks to the workflow files that post them (after #788 and the engine upgrade) [PROTECTED: owner merges] #794 and Remove the desktop app, its source, Tauri lockfile and docs; keep the desktop check one more release as a no-op (#744) [PROTECTED: owner merges] #746.
  • Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932 (02773e6): a textual conflict in docs/guardrails.md, as before. Both PRs rewrite the paragraph after the merged list. Merge-order note: whichever lands second keeps both paragraphs.
  • git: an instance's git runs nothing its checkout's config names, and .git/ is the coordinator's (#926) [PROTECTED: owner merges] #944 (fb913e4) conflicts in src/review.ts and test/review.test.ts. That conflict is git: an instance's git runs nothing its checkout's config names, and .git/ is the coordinator's (#926) [PROTECTED: owner merges] #944's own with origin/main: it gives the same conflict there, and this PR changes neither file. Not this PR's.
• CI at fd9893c (measured, not rerun): run 39668892081 is at this head and concluded success. All 8 test shards, test (22)/(24), dco, denylist, push-gate, scan, scope, new-deps, agentshield and desktop pass. The real-systemd jobs and bootstrap are skipped. Nothing is pending.

Required changes

None.

Follow-ups (not required)

1. Make tipMoved also prove the fetch. made() pushes the moved tip from the PR's own clone, and that push updates the local origin/main ref. So a "no fetch" mutant (Z1) is caught only by tipUnreadable, not by tipMoved (measured). Moving the tip from a second clone would make tipMoved check the fetch on its own. FOLLOW-UP: the guarantee is already killed by a case.
2. Merge order with Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932: docs/guardrails.md, keep both paragraphs. FOLLOW-UP (a note for whoever merges second).

[jayden1711]

Second adversarial review, round 4: head fac8555

Verdict: PASS at fac8555, under the round-cap rule.

My REQUIRED (c) from round 3 is fixed.

• The body now says at most 8 of 49.
• It names each open limit against its guarantee:
  • Q1 and Q19 against hold.doubt;
  • Q4 to Q7 against hold.outside-plan;
  • Q8, Q9, Q11 and Q12 against hold.high-risk;
  • Q2 and Q3 against hold.eval;
  • Q13 against size;
  • Q20 against hold.auto-merge-stopped.
• It labels the remaining uncertainty (whether hold.design or size was among the earlier 7) as inferred.
• docs/guardrails.md:
  • "the latest plan" is scoped to "the task's latest plan, whose entries are exact paths";
  • the "Not driven" list adds new top-level modules and size as mergeDecisionFor computes them, the other plan shapes, and another task's verdict;
  • the label line names the round-3 findings as follow-ups, not cases.

No new overclaim.

• The suite and the engine are unchanged since fd9893c. Measured with git diff --stat fd9893c3 fac8555a:
  • under test/adversarial/ and docs/guardrails.md, only docs/guardrails.md changed;
  • the merge of main 8df2304 changed none of src/merge-policy.ts, merge-policy-weakening.ts, review.ts, skilleval.ts, pr-hygiene.ts, auto-merge-resume.ts or src/coordinator/.
• So round 3's results still hold (inferred). The 21 mutants, and which ones the 23 unit files catch, were measured on an identical engine and suite.
• The body's "the suite stays green under all of them" is accurate for the adversarial suite. It also correctly says merge-policy-tip.test catches Q15, Q16 and Q18.
• Checks I ran. test/docs-guardrails.test.ts at this head: 9/9 pass (measured). It ran with a temp HOME, state and held-out dir, and recording stand-ins first on PATH; none was called.

Follow-ups (not required). These are unchanged from round 3 and listed in the body: the cases that would kill Q1 to Q13, Q19 and Q20, and the tip lint cases in the suite itself.

[jayden1711]

Evaluator verdict: PASS (delta final check, head fac8555)

This is the delta final check of head fac8555a58ea8aeb0155ca92e0374719445c1332 (round 4) against fd9893c, which I passed in comment 6333334858. It covers the second review's one REQUIRED (c) item (comment 6333173487: the coverage count) and the body's "Round 4" section. It is judged under DELTA.md's round-cap rule. Every claim is labelled measured, inferred or guess. No required changes.

1. The diff from fd9893c is a merge plus docs only (measured)

• 41e38ab merges origin/main 8df2304. git merge-tree --write-tree fd9893c3 8df23045 gives 8d107054, which is 41e38ab's tree, so the merge re-derives with no hand edits.
• fac8555 against 41e38ab changes only docs/guardrails.md (+8 −3).
• Between fd9893c and fac8555, nothing under test/adversarial/ changed. Against 8df2304 the PR still changes only docs/guardrails.md and test/adversarial/**.
• So the round-3 mutant results still hold (inferred: no test or src/ file of this PR changed, and the suite's baseline is unchanged, item 3).
• Both commits are signed off, with no attribution trailers.

2. The count and limits match the review (measured against comment 6333173487)

• The count: the body says at most 8 of 49, matching the review's "11 drops to at most 8". It also keeps the review's caveat: the count assumes hold.high-risk was one of the 11, and the list of 49 isn't in the repo.
• Open limits per guarantee, each matching the review's table:
  • hold.doubt: Q1 and Q19;
  • hold.outside-plan: Q4 to Q7;
  • hold.high-risk: Q8, Q9, Q11 and Q12;
  • hold.eval: Q2 and Q3;
  • size: Q13;
  • hold.auto-merge-stopped: Q20 (with stop file with an empty reason doesn't hold #982).
• What the review counted as not against this PR is left out: Q10, Q14, Q15/16/18 (the unit files catch them), Q17 (fails closed) and Q21 (already named).
• The round-3 count line is marked "Superseded in Round 4: at most 8".
• docs/guardrails.md:
  • "the latest plan" now reads "the task's latest plan, whose entries are exact paths".
  • "Not driven" adds both items the review asked for: new top-level modules and size as mergeDecisionFor computes them, and plans other than one task's own plan of exact paths. It also adds another task's verdict at the same head.
  • The label line names the review's misses as follow-ups and says a green run bounds what the mutants missed, not coverage.
• The follow-up list in the body matches the review's.

3. The suite and docs at the head (measured)

• Adversarial suite: dist/test/adversarial/adversarial.test.js gives 198 tests, 187 pass, 0 fail, 11 todo, the same as round 3. It ran with a temp HOME, state, held-out and TMPDIR, and stand-ins first on PATH; 0 were called.
• test/docs-guardrails.test.ts: 9/9.
• Typecheck and denylist: typecheck is clean; denylist reports "1531 files clean".

4. merge-tree (measured)

• New origin/main 7b13c8b: clean (tree b5ed7443).
  • Since 8df2304, main changed src/merge-policy-weakening.ts (+6) and src/coordinator/change-files.ts. So the merged result isn't the tree I ran.
  • The textual merge is clean. I ran no local merged build (reviewer rule 12). The orchestrator's combined check covers it (inferred).
• Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932 (02773e6): still a textual conflict in docs/guardrails.md. Merge-order note: whichever lands second keeps both paragraphs.

5. CI at fac8555 (measured, not rerun)

Run 39727722361 has head_sha fac8555 and concluded success:

• all 8 test shards and test (22)/(24) pass;
• dco, denylist, push-gate, scan, scope, new-deps, agentshield and desktop pass;
• the real-systemd jobs and bootstrap are skipped.

Nothing is pending, so there was no wait.

Required changes

None.

Follow-ups (not required)

1. Mark the Round 2 section's count line as superseded too. It still reads "The count (corrected in Round 3: 11, ...)" and "I'd use 12 on the scoreboard". It sits under the "Round 2 (head 5d0295f)" heading, and the Round 4 section and the Round 3 line now say "at most 8", so it is scoped history, not a live claim. FOLLOW-UP: a one-line "superseded in Round 4: at most 8" there would stop anyone reading 12 or 11 off it.
2. Merge order with Adversarial suite: attack cases for the agent guards, push guard, push gate, commit scan and redaction (#707) [PROTECTED: owner merges] #932: docs/guardrails.md, keep both paragraphs.
3. Carried from round 3: move tipMoved's tip from a second clone, so the case proves the fetch on its own.