Review History¶
Reviews¶
| Date | Branch | Gate | Critical | High | Medium | Low | Agents |
|---|---|---|---|---|---|---|---|
| 2026-08-10 | feature/spec-170-response-output-clarity-standard (pass 12 — INDEPENDENT, authored none of the code under review) | FAIL | 0 | 2 | 4 | 0 | Solo orchestrator, no reviewer subagents dispatched; two throwaway clones verified content-identical to the worktree first, and the live worktree never written to. Scope OPEN by instruction. Every one of the four commits since pass 11 held up under re-mutation — all seven named mutations redden exactly their named assertions, all nine pytest attacks REFUSE with the clean tree still ALLOWing (the negative control that makes the other nine mean anything), all eight settings.json attacks caught, and the BM-3 boundary proven END TO END with a canary in BOTH directions (parent-dir payload fires without the boundary file, does not fire with it) — a proof no test in the repo had taken. Two Highs block PASS, both PRE-EXISTING and both already IN the record at the wrong severity. P12-1: overwriting the CONTENT of any tracked .py under a pytest dir was ALLOW and the payload EXECUTED — one Write, no new file, no symlink, no config trick. That is P11-1's defect (a MERGE BLOCKER) in the same words, re-filed as P11-7 at LOW as a naming problem after P11-1's fix content-graded exactly one file. P12-2: the ELEVENTH non-discriminating guard — run-tests.sh's "a tracked root pytest.ini bounds the config search" asserted only git ls-files --error-unmatch, and was shown GREEN while a parent-dir payload executed. P11-4 had quoted that exact assertion; the commit closing P11-4 restored two probes and left this third one, so P11-4 read FIXED with a third of it live. 4 Mediums, all record-integrity: "ZERO PENDING Highs" was false of the file it named (H4-1 PENDING for three passes, invisible to any grep for the word "High" because its line carries only an ID prefix); count drift instance 14 inside the bullet claiming the count is guarded; THIS FILE four passes stale; P7-M7 stale. — All fixed in-session at the user's direction, which disqualifies pass 12 from clearing the gate. A pass 13 that authored neither the code nor the repair is required. Mutation caught a gap in pass 12's OWN fix: the autoload-chain half of P12-1 was pinned by nothing while the subtree assertion stayed green — the P11-M1 shape, inside the fix for P12-1. |
| 2026-08-10 | feature/spec-168-project-stack-descriptor (pass 4 — HEAD 241fbcac, clean tree, scope main...HEAD) | FAIL | 0 | 2 | 13 | 7 | performance-oracle (FULL), code-simplicity-reviewer (FULL), security-sentinel (ADDENDUM ONLY — verdict on record, full finding list lost), spec-compliance-reviewer (NO RETURN), pattern-recognition-specialist (NO RETURN), tdd-compliance-reviewer (NO RETURN) — 3 of 6 returned. Built-in /security-review RAN for the first time (NOT_RUN in pass 3) and returned zero findings — recorded as an INSTRUMENT result, not a clearance: its hard exclusions cover races, and it never surfaced the SIGPIPE defect at all. Two of pass-3's three Highs properly CLOSED and verified by execution: H1 (.beads/issues.jsonl byte-identical to main, 25 lines / 8 open, spec-032-7ib p1 restored) and SEC-1+SEC-4. The tools: fix matters more than the commit realised — the compensating block-writes hook was re-executed and prints to stdout exiting 1 where PreToolUse requires exit 2 on stderr, so it is inert and the allowlist is now the ONLY containment. The gate fails on the same finding for the third revision running: BUG-045.md:77 asserts "1000 long paths (~28 KB) passed 20/20" inside a bullet headed "No path count is safe"; measured by THREE independent observers at 87,000 bytes → 0/20, deterministic. Traceable error — "~28 KB" is 1000 × the file's own wrong 28-byte figure (measured 8). Second High: the regression test the same file prescribes (">2000 paths") reproduces only 6/20, so it would false-green ~30% of runs. Two findings no earlier pass made — ORCH-9: deleting tools: leaves BOTH suites green (51/0, 9/9) while T9 pins the inert hook, so the SEC-1 fix has no regression test; ORCH-5: the count reconciliation missed a FOURTH mirror (.claude-checkpoint.md still read 2 High), count-reconciliation-single-source recurring inside the review record for the second time in one spec. Three reviewer reports lost to the general-purpose reply-address defect (agent type, not a routable address) — five pass-3 reviewers hit it too. Suites re-measured at HEAD: 51/0 targeted, 9/9 bats, tree clean after two restored mutation experiments. |
| 2026-08-09 | feature/spec-170-response-output-clarity-standard (pass 11 — @ c52cd6b6) |
FAIL | 0 | 4 | 5 | 2 | 2 of 3 reviewers returned; the mutation reviewer stalled 11h with a mutation still applied and was killed, so nothing from it was usable and its four outstanding mutations were re-run by the orchestrator. The pass-10 security redesign is DEFEATED and the instrument used to close BM-3 opened three new problems. Five of seven pass-10 findings ARE genuinely closed — the orchestrator's earlier "my fix made it worse" was too strong and was corrected to: better on five axes, worse on one. P11-1 (blocker): the tracked root pytest.ini is a permanently-approved injection point, because tracked_and_reviewed decides on the git INDEX, so OVERWRITING it is prompt-free and still ALLOW. P11-2 (blocker): find -type f does not match symlinks and pytest follows them — a symlinked test file AND a symlinked DIRECTORY both executed. P11-3 (blocker): DELETING the boundary file silently reopens BM-3, because absent chain members were skipped and absence read as safety. P11-4: the BM-3 fix permanently DISABLED two self-test probes, one of them P9-H1's only behavioural guard, and their replacement grades TRACKING rather than bounding — eighth vacuous guard, shipped by the commit meant to stop shipping them. — Stale-record instance THIRTEEN, the worst yet: BM-1..BM-5, P10-B1 and P10-C1 existed ONLY in .review-gate.md, with zero occurrences in review-triage.md, so the triage counts reconciled perfectly while describing a corpus that excluded seven findings and pass 10's own "zero PENDING Highs" was true of the file and false of the branch. Also P11-R1: the fix commit's "all 19 live rules satisfy the pin" — 18 do; the 19th is the exempt wildcard, which fails it directly. Recommended direction (NOT implemented, three wrong calls being enough): stop enumerating what pytest reads and refuse the pytest group unless the subtree is clean. |
| 2026-08-09 | feature/spec-168-project-stack-descriptor (pass 3 — HEAD 4d399ac6, clean tree, scope main...HEAD) | FAIL | 0 | 3 | 17 | 10 | spec-compliance-reviewer (FAIL), security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist, performance-oracle, tdd-compliance-reviewer — 6 of 6 returned. security-sentinel's report was first recorded as lost and its rows written from orchestrator substitutes; it was RECOVERED on a later resume, corroborated all three carried-over findings, added SEC-4, and raised SEC-1 Medium→High on two executed measurements the substitute lacked (the tools: rule is a documented MUST; the compensating hook exits 1 where PreToolUse requires 2). That promotion reached review-triage.md but not the three mirrors, which all still read 2 High until corrected on 2026-08-10 — the count-reconciliation-single-source drift, occurring inside the review record itself. H-E (pass 2's only High) VERIFIED FIXED by four independent sweeps (176/192/408/49 cells) agreeing on zero drops and +php-reviewer as the only delta; PERF-2 resolved by the same fix. None of the 3 Highs is in the PHP reviewer's selection logic: deleted SPEC-170 beads rows, BUG-045.md's threshold stated in the unsafe direction, and the missing tools: allowlist. Suites re-measured at HEAD: 51/0 targeted, 9/9 bats. |
| 2026-08-08 | feature/spec-170-response-output-clarity-standard (pass 10 — INCOMPLETE, 3 of 4 reviewers returned) | FAIL | 0 | 6 | 1 | 0 | The WORST pass on this branch by findings, and the first where the deliverable's own SECURITY FIXES were shown to be DEFEATED rather than merely unguarded. An independent reviewer got five prompt-free execution paths past the pass-9 hardening: BM-1/BM-2 — the gate walked the conftest chain UP but never DOWN, so an untracked tests/spec-130/<sub>/conftest.py and untracked collected test files executed while the gate answered ALLOW; BM-3 — pytest searches for config UPWARD to the filesystem root and --confcutdir bounds conftest discovery only, so an ini in the repo's PARENT was read; BM-4/BM-5 — the settings detector examined only rules starting Bash( and decided danger by SHAPE, so Read(~/.ssh/**), Write(~/.claude/**), WebFetch(domain:…), mcp__…_Gmail__*, Bash(env bash:*) and Bash(sh -c:*) all passed while every suite stayed green. Write(~/.claude/**) is the sharpest: it does not CONTAIN a hooks block, it grants write access to the file that DEFINES hooks. P10-B1: the P9-H1 availability-probe assertion RE-IMPLEMENTED the probe instead of calling it, so reverting the production probe left it green. Nothing was fixed in this pass except the record and one guard-anchoring; both security fixes recorded UNFIXED. |
| 2026-08-08 | feature/spec-170-response-output-clarity-standard (pass 9 — INCOMPLETE, 1 of 4 reviewers returned) | FAIL | 0 | 3 | 2 | 0 | Four reviewers dispatched against private clones; ONE returned by write time, three still running at 9h. Late returns added Highs for the EIGHTH time out of eight. P9-H1 (merge blocker): the pytest auto-load gate was an allow-list of FILENAMES and pytest decides that list — pytest.ini/pyproject.toml/tox.ini/setup.cfg all carry addopts = -p <mod>, which imports an arbitrary module at STARTUP, earlier than conftest and outside --confcutdir entirely; and the availability probe ran python3 -m pytest --version with the repo as cwd, BEFORE and INDEPENDENT of every gate, so the payload executed even when all six directories had been refused. Reproduced end to end: bash scripts/run-tests.sh executed attacker code as the user while reporting PASS=94 FAIL=2 SKIPPED=0. P9-H2: .claude/settings.json was guarded on exactly two properties, so a hooks.PreToolUse block piping curl output straight into bash plus defaultMode: bypassPermissions and Bash(bash:*) left this suite at 127/0 AND test-security-baseline at 117/0 — the file is TRACKED, so git pull would have distributed either. Second batch added P9-R5-H1: pass 8 had RETRACTED a finding on false reasoning, and the retraction talked the branch out of a real coverage gap — the suite was green with a WEAKER unlink_md swapped in, so nothing pinned the shipped implementation at all. |
| 2026-08-07 | feature/spec-170-response-output-clarity-standard (pass 8 — the INDEPENDENT pass over pass 7's six fixes) | FAIL | 0 | 2 | 3 | 1 | Wrote none of pass 7's fixes and COULD flip the gate; did not. All six fixes are real and behaviourally correct — but one shipped a guard that CANNOT FAIL, and five of the six left the durable record still saying they were never made. P8-H1: the suppressed-harness disclosure was guarded by grep -c '<the message>' "$0" with a -ge 1 threshold — the literal also appears in the assertion line itself, so the assertion matched its own source and could not fail; deleting the entire else branch, restoring the exact silent-disable primitive P7-H3 was filed for, left the self-test 25 of 25 green. FOURTH vacuous guard on this branch, and its sibling twelve lines above escaped only because its needle carries backslash escapes the matched text does not. P8-H2: nine findings fixed on disk and still tagged open. ⚠ Two of pass 8's own claims were later REFUTED (CORR-1..CORR-5), one of which had talked the branch out of a real gap — see pass 9. Full-suite flakiness characterised here: four runs at a2e81388 gave 91/5, 91/5 with a DIFFERENT failing set, 87/2/3, and 94/2/0 — filed as BUG-040/041. |
| 2026-08-07 | feature/spec-170-response-output-clarity-standard (pass 7 — the INDEPENDENT pass, @ 9a2c31e1) |
FAIL | 0 | 4 | 9 | 6 | 5 reviewers (mutation/TDD, detector, security, spec-compliance, python; an earlier batch of 6 was killed mid-flight by a session interruption and produced nothing). persona-select bypassed, both BUG-031 drops added by hand for the 7th pass running. Gate written at 2 of 5 returns, then AMENDED twice — never rewritten — and the prediction held for the SEVENTH time: the late returns added three Highs, one a merge blocker. ⚠ Reviewers ran against ISOLATED CLONES, so the live worktree stayed clean through every measurement — but the first two SHARED a clone and one seeded output_contract: single-fact into git-worktree/SKILL.md, which the other then measured and reported as HEAD's baseline, producing two false findings. The pass-4 confound generalises: reviewers confound EACH OTHER, not just the orchestrator. Later reviewers got private clones. — P7-H2 (MERGE BLOCKER, reproduced independently by reviewer AND orchestrator): an untracked repo-root conftest.py EXECUTES during the allow-listed bash scripts/run-tests.sh. pytest imports conftest from rootdir down, but group 4 gates only the test directory's own conftest; --check-gate conftest.py correctly says REFUSE and is never asked. Canary written. Both steps prompt-free, inside the very commit (7b338faa) written to close that class — so SEC6-1/SEC6-2 are NOT closed, and the untracked gate cannot be leaned on as mitigation for the still-open P6-H2. P7-H3: one untracked file silently suppresses run-all.sh AND its 19 tracked scenarios with no else branch and no summary line — a silent-disable primitive that defeats "confirm the skip count is zero". P7-H4: FR-3's named checker is still unwired in spec.md and decisions.md — M4-5 fixed 1 of 3 sites, the signature defect for the third pass running. P7-H1: a placeholder written as a markdown LINK passes the gate ([TODO](docs/next.md) → PASS), third recurrence of the class whose two prior members were merge blockers; LATENT (0 live instances, not scaffolder-reachable). — The DELIVERABLE held up under adversarial testing, and that is the counterweight: 14 of 16 mutations red with NO vacuous guard found; P6-H1 properly closed with a BEHAVIOURAL guard (deleting validate_markers → 116/1); DERIVED_MIRRORS genuinely per-row; suite 117/0 reaching its Result line; full suite re-measured PASS=94 FAIL=2 with ZERO skips and a byte-identical tree; all THREE BUG-007 assertions now proven pre-existing (.test-gate.md documented 2 — the third is absent from main too, and main's own change-ledger says the same 3 fail there); triage counts exact; and the ratchet survives a test-merge with a main that has moved 61 commits (⚠ the branch no longer fast-forwards — pass 4's scope note is stale). Three reviewer findings REFUTED on measurement and one briefing premise corrected (init_skill.py rejection tests exist and are live). Every High is in the SCAFFOLDING — permissions, the test runner, the spec's prose — not in what SPEC-170 built. |
| 2026-08-06 | feature/spec-170-response-output-clarity-standard (pass 6 — @ 84fdd843) |
FAIL | 0 | 2 | 6 | 3 | Same 8 (persona-select dropped document-quality + kieran-python again — BUG-031, 5th pass running; both added by hand) — 0 returned at gate-writing time, the SIXTH consecutive pass. Gate NOT flipped by the session that wrote the pass-5 fixes. ⚠ Orchestrator COULD execute; all 11 findings reproduced by execution in a SHADOW copy, live worktree clean before and after. The pass-5 fix pass is VINDICATED on every claim pass 6 could re-measure: suite 110/0; full suite PASS=94 FAIL=2 with a clean tree (re-measured independently, the 2 reds being exactly BUG-007 and BUG-008); 24 of 26 single-rule detector mutants killed; the SIM-M3 no-op label is honest (zero delta); LATE5-H5 proven correct AND load-bearing (removing it collapses toolkit-internal 12 → 0 and not-evaluable 98 → 110 while still exiting 0); scaffold/check pairing holds end to end; all 13 enforced PASSes substantive, so NO false positives on the enforced set; PY-M3 closed on disk. The pass-5 reviewer's WRONG claim about heading-parenthetical-only.md was re-tested, not repeated. — Two NEW Highs block PASS, neither in the detector. P6-H1: the LATE5-H5 fail-loud fix has ZERO regression coverage — no test names validate_markers, and deleting it leaves --tsv byte-identical across all 132 rows, so no output-comparing test can see a regression either. P6-H2: .claude/settings.json allows Bash(bash plugins/*/tests/test-*.sh:*) — an interpreter against a WILDCARD path over an agent-writable tree, the exact rule the file adopts for itself after pass 4's proven RCE — and the §6e guard written to forbid it exempts that string by hardcoded literal. 6 Mediums: exemption-parser uncovered (4 mutants survive incl. the frontmatter boundary, mirroring the fixed frontmatter-anchor defect); .test-gate.md enumerates 2 of 3 failing assertions for BUG-007; the agent-glob defect RECURRED as plugins/*/commands/**.md (matches 35, prose says 36) in a spelling §7c cannot see; singular ## Next Step rejected with 3 grandfathered skills using it, unrecorded in the calibration follow-up; generate-skill-audit.sh WARNs on an unknown arg then WRITES two tracked files, newly prompt-free via this branch's own allowlist (reproduced accidentally, reverted); PY-M3 stale as PENDING. |
| 2026-08-05 | feature/spec-170-response-output-clarity-standard (pass 5 — @ 544f6d4f) |
FAIL | 0 | 5 | 6 | 5 | Same 8 — 0 returned at gate-writing time, the FIFTH consecutive pass, and the fifth to be vindicated: the late returns added FIVE Highs the orchestrator missed. Treat a no-return pass as INCOMPLETE, always. ⚠ The execution permissions INVERTED this pass — reviewers were refused all script execution while the amending session could run everything, so all eight reports are static reads. Every load-bearing claim was therefore re-run before being accepted, and two reviewer figures were corrected by measurement (agent count 62, not the reported 68 or the spec's 68; malformed-row cell count 9, not 10). — LATE5-H1/H2/H3: three guards were VACUOUS — each graded source text rather than behaviour, and each stayed green under a straight revert of the fix it guarded (the wildcard-interpreter guard's fail arm was unreachable because both its greps matched the same line; the other two grepped identifiers that occur 3× in the file). LATE5-H4: the LATE-H5 conditional was closed at 1 of 3 sites and its mirror greps a string a revert preserves — third consecutive pass with a "fixed 1 of N sites" finding. LATE5-H5: the LATE-M7 pre-filter conflated grep exit 2 with "no match", silently collapsing the whole auto-keep set (private-data 19 → 0) while exiting 0. Count drift recurred as instances 7 and 8 (21 vs 33 fixtures in SHIPPED CODE; 68 vs 62 agents), so the gate's "the class is clean" claim was retracted. — FIX PASS 2026-08-05: all 5 Highs CLOSED and mutation-proven; both count-drift instances swept. Suite 93 → 100 pass / 0 fail. §8 generalised from one pinned number to six DERIVED_MIRRORS computed from disk, which is the remedy this branch's own triage prescribed and never built. ⚠ TWO defects were introduced BY this fix pass and caught by mutation-testing it: an errexit pipeline that killed the suite mid-run on the very defect it detects, and a fail-loud check placed inside a command substitution, where exit 1 killed only the subshell — the ERROR printed, the collapse still happened, and the script still exited 0. Gate NOT flipped by the author of the fixes — pass 6 decides. Open: 3 doc defects, the triage record gap, still_open_not_blocking. |
| 2026-08-05 | feature/spec-170-response-output-clarity-standard (pass 4 — @ e0cc65cf) |
FAIL | 0 | 8 | 19 | 12 | Same 8 (persona-select again dropped document-quality + kieran-python — BUG-031, 4th pass running; both added manually) — 0 returned at gate-writing time, the FOURTH consecutive pass. All 11 findings REPRODUCED by execution, none by reading. H4-1: three gate-CERTIFIED skills render worktree-open instructions contradicting the rule this spec authored, at 5 sites, each falsely labelled "(opens new window…)" — 56497f2c claims this was fixed and fixed 1 of 5. ⚠ Test gate UNVERIFIED, not PASS: reviewers can now execute (e0cc65cf) and were caught MUTATING the worktree mid-measurement (an untracked test-ocdebug.sh appeared inside the run-tests.sh glob, then deleted itself); full-suite 93/3 is confounded and must be re-measured quiet. test-output-contract.sh is sound — 49/0 standalone — ⚠ AMENDED 2026-08-05 — all 8 returned AFTER the gate was written, the FOURTH consecutive pass, and added SEVEN Highs including TWO MERGE BLOCKERS. LATE-H1 (security): this branch's own .claude/settings.json:39 Bash(python3 plugins/*/skills/*/scripts/*.py:*) matches 48 scripts, one of which (with_server.py:71) pipes an unvalidated --server string into Popen(shell=True) — reviewer executed a payload and got uid=501; the global PreToolUse hook is a 22-pattern denylist and a tar … && nc exfil payload passed it unescalated. LATE-H2 (simplicity, orchestrator-reproduced): **Next actions:** [TODO: …] PASSES the gate while the identical placeholder under a heading FAILS — a scaffolded, unfilled skill ships certified. LATE-H3: count drift 4th recurrence, live in the file P3-2 named as the sweep priority (12/12/12 vs 13/13/13, 125 vs 124, "37 assertions" vs 49, ".test-gate.md 44" vs 49). LATE-H4: the pass-3 row above was never amended. LATE-H5: CLAUDE.defaults grants a conditional the gate does not honour, trapping authors with no conforming exit. LATE-H6/H7: init_skill.py misdirects to a validator that green-lights gate-failing skills, and disagrees with its own sibling on name rules. spec_compliance flipped to PASS — no requirement is unmet. Gate is FAIL on defects now, not INCOMPLETE on coverage. — FIX PASS 2026-08-05 (e5c1997d.., 9 commits): all 8 Highs CLOSED, 14/19 Mediums CLOSED. Suite 49 -> 93 pass / 0 fail; fixtures 19 -> 33; full suite PASS=94 FAIL=2 (the two documented exceptions only), tree clean. Every fix mutation-verified. ⚠ THREE defects were introduced BY the fix pass and caught by its own new guards — the declared-count guard drifted four times as sections were added below it, the HTML-comment fix reproduced the unpaired-delimiter false-FAIL twice, and --help broke the moment a new comment pushed the header past its hardcoded line 36. That is the strongest evidence on this branch that the structural guards are worth more than the individual fixes. Gate NOT flipped by the author of the fixes — pass 5 decides. Open, none blocking: SIM-M5, SEC-M1, SEC-M2, PY-M3, L4-4. |
| 2026-08-04 | feature/spec-170-response-output-clarity-standard (pass 3 — first pass on committed code) | INCOMPLETE | 0 | 0 | 2 | 3 | 8 dispatched (security-sentinel, spec-compliance, code-simplicity, pattern-recognition, tdd-compliance, document-quality, kieran-python, performance-oracle) — 0 returned at gate-writing time. Gate is INCOMPLETE on coverage, not on defects: every pass-1/2 High verified closed on disk, no detector defect found. Both Mediums are stale-count drift (P3-1 triage counts, P3-2 corpus counts in prose) — ⚠ AMENDED 2026-08-05 (pass 4, LATE-H4): the "no detector defect found" clause was WRONG and was never corrected when the late returns arrived. The next commit is 56497f2c "close five reproduced detector defects found by pass 3" (indented-code anchor · indented fence closing early · unpaired fence suppressing a real block · frontmatter anchor · non-bracket (TODO)/TBD placeholders), plus two defects in prior fixes. Real pass-3 totals after late returns: 0C / 5H+ / 2M / 3L. This row read as vindication of the zero-return pattern for a full pass. |
| 2026-08-04 | feature/spec-170-response-output-clarity-standard (pass 2, amended after late returns) | FAIL | 0 | 7 | 15 | 9 | Same 8; 0 returned at gate-writing time, 7 returned late and added 3 High — R2H-1 ordered-list placeholder bypass and R2H-2 fence parity toggle both REPRODUCED; R2H-3 rejected on evidence |
| 2026-08-04 | feature/spec-170-response-output-clarity-standard (pass 1, amended after late returns) | FAIL | 0 | 6 | 21 | 13 | Same 8; 0 returned at gate-writing time, 7 returned late and added 4 High the orchestrator had missed |
| 2026-07-06 | feature/spec-138-architecture-as-theory-evaluation (pass 3 — verification after "fix all") | PASS | 0 | 0 | 0 | 2 | security-sentinel, spec-compliance-reviewer, research-quality-reviewer, document-quality-reviewer — 18/18 prior findings verified resolved; 2 new LOW optional-polish (RES-12, DOC-9) |
| 2026-07-06 | feature/spec-138-architecture-as-theory-evaluation (pass 2 — all 18 findings resolved, owner "fix all") | PASS | 0 | 0 | 0 | 0 | authorial edits by owner directive; verdict unchanged (Defer, recommendation-for-ratification) |
| 2026-07-06 | feature/spec-138-architecture-as-theory-evaluation (pass 2) | PASS (w/ recs) | 0 | 2 | 7 | 8 | spec-compliance-reviewer, research-quality-reviewer, document-quality-reviewer |
| 2026-07-06 | feature/spec-138-architecture-as-theory-evaluation | PASS (w/ recs) | 0 | 1 | 5 | 6 | spec-compliance-reviewer, research-quality-reviewer, document-quality-reviewer |
| 2026-05-18 | feature/spec-120-domain-dashboard-pm-meetings (Pass 2 / post-simplify) | PASS | 0 | 0 | 2 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-05-18 | feature/spec-120-domain-dashboard-pm-meetings | PASS | 0 | 0 | 2 | 4 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-05-15 | feature/spec-139-supply-chain-security-hook | PASS | 0 | 0 | 2 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-19 | feature/spec-002-security-review-enforcement | PASS | 0 | 0 | 2 | 3 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-19 | feature/spec-002-security-review-enforcement | PASS | 0 | 0 | 2 | 2 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-19 | feature/spec-004-scaffold-template-patterns | PASS | 0 | 0 | 2 | 3 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-20 | feature/spec-008-knowledge-inbox-pipeline | PASS | 0 | 0 | 4 | 2 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-21 | feature/vt-c-content-evaluate-skill | PASS | 0 | 0 | 3 | 3 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-21 | feature/spec-006-workflow-sequence-enforcement | PASS | 0 | 0 | 3 | 5 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-21 | feature/spec-010-web-capture | PASS | 0 | 0 | 3 | 2 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-22 | feature/spec-014-unified-init | PASS | 0 | 0 | 4 | 3 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-25 | feature/spec-021-ims-plugin-extraction | PASS | 0 | 0 | 1 | 2 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-25 | feature/spec-022-session-start-notifications | PASS | 0 | 0 | 3 | 5 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-26 | feature/spec-023-deploy-gate-integration | PASS | 0 | 0 | 4 | 9 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-26 | feature/spec-024-review-autofix-loop | PASS | 0 | 0 | 2 | 4 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-28 | feature/spec-025-mcp-configuration-patterns | PASS | 0 | 0 | 1 | 2 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-28 | main (11 merged branches post-SPEC-025) | PASS | 0 | 1 | 3 | 4 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-28 | fix/cli-import-pipeline-data-root | PASS | 0 | 0 | 4 | 3 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-02-28 | fix/cli-import-pipeline-data-root (re-review) | PASS | 0 | 0 | 4 | 5 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-01 | feature/spec-032-agent-worktree-isolation | PASS | 0 | 0 | 2 | 4 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-01 | feature/spec-032-agent-worktree-isolation (re-review) | PASS | 0 | 0 | 1 | 2 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-02 | feature/spec-030-intelligent-skill-activation | PASS | 0 | 0 | 3 | 2 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-02 | feature/spec-029-skill-permission-governance | PASS | 0 | 1 | 2 | 5 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-02 | feature/spec-029-skill-permission-governance (re-review) | PASS | 0 | 1 | 3 | 5 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-02 | feature/spec-029-skill-permission-governance (re-review 2) | PASS | 0 | 1 | 3 | 8 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-03 | feature/spec-039-ufi-country-enrichment | PASS | 0 | 0 | 1 | 0 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-04 | feature/spec-46-config-drift-audit | PASS | 0 | 0 | 1 | 3 | security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-08 | feature/spec-028-security-review-pipeline | PASS | 0 | 0 | 2 | 5 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-09 | feature/spec-054-wave-dependency-execution | PASS | 0 | 0 | 2 | 3 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-09 | feature/spec-049-workflow-merger | PASS | 0 | 0 | 0 | 2 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-09 | feature/spec-033-claudemd-lifecycle | PASS | 0 | 0 | 2 | 3 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-09 | feature/spec-051-spec-from-requirements | PASS | 0 | 0 | 1 | 2 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-09 | feature/spec-045-commit-documentation-traceability | PASS | 0 | 0 | 1 | 1 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-09 | feature/spec-041-adversarial-review-framing | PASS | 0 | 0 | 1 | 1 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-17 | feature/spec-058-mcp-config-governance | PASS | 0 | 0 | 1 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-17 | feature/knowledge-index | PASS | 0 | 0 | 5 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-17 | feature/knowledge-index (re-review) | PASS | 0 | 0 | 5 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-17 | feature/v000-projektupdates | PASS | 0 | 1 | 3 | 2 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist, document-quality-reviewer |
| 2026-03-17 | feature/spec-072-cross-file-impact-analysis | PASS | 0 | 0 | 2 | 1 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-18 | feature/spec-078-state-documentation-standard | PASS | 0 | 0 | 4 | 1 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-18 | feature/spec-075-strategic-mentor-agent | PASS | 0 | 0 | 2 | 1 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-18 | feature/spec-079-repo-evaluation-safety | PASS | 0 | 0 | 3 | 2 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-18 | feature/spec-081-simplify-skill-enhancement | PASS | 0 | 0 | 2 | 2 | document-quality-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-18 | feature/spec-081-simplify-skill-enhancement (pass 2) | PASS | 0 | 0 | 2 | 4 | spec-compliance-reviewer, document-quality-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, accessibility-reviewer |
| 2026-03-19 | feature/spec-076-ims-audit-extensions | PASS | 0 | 0 | 3 | 4 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-19 | feature/spec-077-advanced-diagram-generation | PASS | 0 | 0 | 2 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, accessibility-reviewer |
| 2026-03-19 | claude/review-next-spec-BvgfC (SPEC-054 re-review) | PASS | 0 | 0 | 3 | 2 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-19 | claude/review-next-spec-BvgfC (SPEC-075) | PASS | 0 | 0 | 1 | 2 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-19 | claude/review-next-spec-BvgfC (SPEC-076) | PASS | 0 | 0 | 0 | 0 | 29 tests pass, 0 regressions |
| 2026-03-19 | claude/review-next-spec-BvgfC (SPEC-078) | PASS | 0 | 0 | 0 | 0 | Plan validated in 2 iterations, all 6 FRs covered |
| 2026-03-23 | feature/spec-93-worktree-activate-integration | PASS | 0 | 0 | 0 | 2 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-23 | feature/spec-86-brownfield-repo-onboarding | PASS | 0 | 0 | 3 | 7 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-23 | feature/spec-88-secret-detection-hooks | PASS | 0 | 1 | 1 | 8 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-23 | feature/spec-83-adr-workflow | PASS | 0 | 0 | 1 | 3 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-23 | feature/spec-84-garbage-collection-agent | PASS | 0 | 0 | 2 | 2 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-23 | feature/spec-87-diagram-auto-validation | PASS | 0 | 0 | 2 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-24 | feature/spec-090-user-manual-generation | PASS | 0 | 0 | 2 | 4 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, accessibility-reviewer |
| 2026-03-24 | feature/spec-091-user-manual-update | PASS | 0 | 0 | 3 | 5 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-24 | feature/spec-095-workflow-gate-enforcement | PASS | 0 | 0 | 2 | 3 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-24 | feature/spec-096-ims-cross-file-gaps | PASS | 0 | 0 | 2 | 4 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-03-28 | feature/spec-097-ims-to-vms-rename | FAIL | 1 | 5 | 1 | 0 | spec-compliance-reviewer, security-sentinel, pattern-recognition-specialist, code-simplicity-reviewer |
| 2026-03-28 | feature/spec-097-ims-to-vms-rename (pass 2) | PASS | 0 | 2 | 2 | 0 | spec-compliance-reviewer, security-sentinel, pattern-recognition-specialist, code-simplicity-reviewer |
| 2026-03-27 | feature/spec-097-ims-to-vms-rename (pass 3) | PASS | 0 | 2 | 4 | 1 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-28 | feature/spec-097-ims-to-vms-rename (pass 4) | PASS | 0 | 1 | 2 | 1 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-27 | feature/spec-097-ims-to-vms-rename (pass 5) | PASS | 0 | 0 | 1 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-29 | feature/spec-098-skill-testing-framework | PASS | 0 | 2 | 5 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-30 | feature/spec-100-designmd-pattern-evaluation | PASS | 0 | 0 | 4 | 1 | spec-compliance-reviewer, research-quality-reviewer |
| 2026-03-27 | feature/spec-101-design-system-infrastructure | PASS | 0 | 3 | 3 | 2 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-27 | feature/spec-101-design-system-infrastructure (pass 2) | FAIL | 1 | 1 | 3 | 4 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-27 | feature/spec-101-design-system-infrastructure (pass 3) | PASS | 0 | 0 | 3 | 4 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-30 | feature/spec-102-memory-consolidation | PASS | 0 | 0 | 2 | 2 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-03-30 | feature/spec-099-remotion-video-skill | PASS | 0 | 0 | 3 | 3 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-30 | feature/spec-103-security-hardening | PASS | 0 | 0 | 4 | 6 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-03-31 | feature/spec-104-memory-consolidation-dream | PASS | 0 | 0 | 2 | 3 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-30 | feature/spec-105-recursive-criticism-improvement | PASS | 0 | 0 | 3 | 2 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-31 | feature/spec-106-autoresearch-optimization-agent | PASS | 0 | 0 | 0 | 4 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-03-31 | feature/spec-107-dream-open-brain | PASS | 0 | 0 | 2 | 4 | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-04-20 | feature/spec-114-security-baseline-hardening | PASS | 0 | 1 | 3 | 9 | security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-04-20 | feature/spec-114-security-baseline-hardening (pass 2) | PASS | 0 | 0 | 0 | 6 | security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-05-06 | feature/spec-69-cross-referenz-handling | PASS | 0 | 0 | 0 | 6 (auto-fixed) | spec-compliance-reviewer, security-sentinel, kieran-typescript-reviewer, julik-frontend-races-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-05-11 | feature/spec-124-toolkit-install-defensive | PASS | 0 | 0 | 0 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-05-13 | feature/spec-123-repo-scoped-vs-global-skills | FAIL | 1 | 1 | 2 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-05-13 | feature/spec-123-repo-scoped-vs-global-skills (pass 2) | FAIL | 1 | 1 | 1 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-05-13 | feature/spec-123-repo-scoped-vs-global-skills (pass 3) | PASS | 0 | 0 | 1 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-05-14 | feature/spec-125-skill-orchestration-map | PASS | 0 | 0 | 2 | 4 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-05-14 | feature/spec-133-quick-fix-intake-path | PASS | 0 | 0 | 1 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist, kieran-typescript-reviewer |
| 2026-05-14 | feature/spec-133-quick-fix-intake-path (pass 2) | PASS | 0 | 0 | 2 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-05-18 | feature/spec-120-domain-dashboard-pm-meetings | PASS | 0 | 0 | 2 | 4 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist |
| 2026-05-19 | feature/spec-126-worktree-env-propagation | PASS | 0 | 0 | 1 | 1 | spec-compliance-reviewer, document-quality-reviewer, pattern-recognition-specialist |
| 2026-05-19 | feature/spec-122-prioritisierbare-spec-task-pipeline | PASS | 0 | 0 | 1 | 14 | spec-compliance (manual), security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, data-integrity-guardian |
| 2026-05-20 | feature/spec-142-pm-bugs-detail-skill | PASS | 0 | 0 | 0 | 5 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, constitution-compliance |
| 2026-05-21 | feature/spec-137-smart-shape-prompt | PASS | 0 | 0 | 0 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-07-02 | feature/spec-145-compound-engineering-pattern-adoption | PASS | 0 | 0 | 4 | 10 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist, performance-oracle, document-quality-reviewer, built-in /security-review |
| 2026-07-04 | feature/spec-129-claude-code-otel-monitoring | PASS | 0 | 1 | 6 | 14 | spec-compliance-reviewer, security-sentinel, kieran-python-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-07-05 | feature/spec-129-claude-code-otel-monitoring (pass 2) | PASS | 0 | 0 | 3 | 12 | security-sentinel, kieran-python-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, document-quality-reviewer |
| 2026-07-05 | feature/spec-150-registration-check-entry-points | PASS (w/ recs) | 0 | 1 | 1 | 6 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-07-05 | feature/spec-150-registration-check-entry-points (pass 2) | PASS | 0 | 0 | 0 | 7 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, pattern-recognition-specialist |
| 2026-07-06 | feature/spec-134-pd-prototype-refinement-loop | PASS (w/ recs) | 0 | 1 | 1 | 6 | spec-compliance-reviewer (manual), security-sentinel, document-quality-reviewer, code-simplicity-reviewer |
| 2026-07-06 | feature/spec-134-pd-prototype-refinement-loop (pass 2) | PASS | 0 | 0 | 0 | 6 | spec-compliance-reviewer (manual), document-quality-reviewer |
| 2026-07-06 | feature/spec-135-pd-prototype-decision-log-backflow | PASS | 0 | 0 | 0 | 1 (6 auto-fixed) | spec-compliance-reviewer (manual), document-quality-reviewer, code-simplicity-reviewer |
| 2026-07-21 | feature/spec-157-theme-polarity | FAIL | 5 | 10 | 18 | 15 | security-sentinel, spec-compliance-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, julik-frontend-races-reviewer, accessibility-reviewer, design-implementation-reviewer, document-quality-reviewer |
| 2026-07-21 | feature/spec-157-theme-polarity (pass 2) | FAIL | 4 | 15 | 27 | 17 | security-sentinel, spec-compliance-reviewer, accessibility-reviewer, design-implementation-reviewer, julik-frontend-races-reviewer, document-quality-reviewer, pattern-recognition-specialist, code-simplicity-reviewer |
| 2026-07-24 | feature/spec-161-proactive-openbrain-capture | PASS (w/ recs) | 0 | 2 | 6 | 3 | spec-compliance-reviewer, security-sentinel, code-simplicity-reviewer, document-quality-reviewer, pattern-recognition-specialist, performance-oracle, tdd-compliance-reviewer — 2H = sanitizer strips less than its §10a claim (SEC-1: lowercase bearer/Google/JWT/hex/client_secret= survive) + SEC-2: --check narrower than sanitizer masks it; PAT-1: secret-scanner "reuse" is a diverged copy |
| 2026-07-27 | feature/spec-165-concurrency-safe-spec-numbering | FAIL | 0 | 6 | 14 | 19 | spec-compliance-reviewer (PASS), security-sentinel, kieran-python-reviewer, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, tdd-compliance-reviewer, accessibility-reviewer (0 findings), julik-frontend-races-reviewer — architecture unchallenged; 3 of 6 H reintroduce duplicate IDs by independent routes (PY-1 scan_refs anchored on cwd so the prefix-relative ls-tree floor returns 0 from a subdirectory; PY-2/3 non-atomic write_counter + read_counter collapsing absent-vs-corrupt into a silent 0; RACE-1/2 degraded path reserves nothing across the whole Step-0→Step-5 window). Plus SPEC-1 (EC-3 probe disabled — no --specs-dir), PAT-1 (T11 whole-file greps defeat the R4 anti-bypass guard), SEC-1 (strict decode escapes unguarded → exit 1, defeats NFR-1). Tests NOT_RUN (permission system refused bash/python3 in the fork). kieran-python-reviewer added manually — persona-select.sh selected NO language reviewer for an all-Python deliverable. Disposition 2026-07-28: all 39 findings closed — 37 fixed, 2 accepted with measurement (PERF-1's content-OID dedupe was implemented and measured WORSE, 26 vs 20 git spawns, then reverted; PERF-2 declined because hoisting the scans collapses the window T5's negative control depends on). Suite 29 → 62 assertions, tests PASS (the fork's refusal did not recur). Reviewer-selection defect filed as intake/pending/bugs/2026-07-28-persona-select-python-marker-blind-to-plugin-scripts.md. Awaiting pass 2. |
| 2026-07-28 | feature/spec-165-concurrency-safe-spec-numbering | PASS | 0 | 6 | 24 | ~35 | Pass 2, ten reviewers (nine returned; kieran-python-reviewer completed late after repeated permission denials — the persona-select Python-marker defect from pass 1 is still open). The architectural finding: pass 1's own RACE-1/RACE-2 fix was one-directional. It gave the degraded path an O_EXCL marker but left the locked path reserving via the counter alone — two media, and a counter write is not atomic against a marker create, so a locked and a timed-out claimant could return the same ID (RACE-10, independently found as K2-1). Fixed by making the marker the arbiter on BOTH paths; the counter is demoted to a floor hint. Severity corrected: kieran's determinism argument is logically inverted (D − D_B < 5 means the loser reads the POST-write counter); measured 0 duplicates in 20 mixed-mode rounds pre-fix, so it is a ~1 ms window, not a certainty — fixed on code inspection, asserted structurally (T7c), not reproduced. Other Highs: RACE-11 (unlocked counter lift could LOWER the counter and destroy a locked claimant's only record — deleted), S2-1/S2-4 (unquoted --specs-dir shell interpolation from repo-tracked .design-state.yaml, the class this same file documents 280 lines further down), K2-2 (counter validated for syntax but not plausibility → one date +%s poisons the clone forever), K2-3 (docstring asserted three-source parity that never existed; live mismatch in-repo). T5's negative control had to be rebuilt: --no-lock alone no longer duplicates because O_EXCL is atomic without the lock — the lock is no longer the duplicate-prevention mechanism, so the control was re-pointed at the marker via a test-only VT_SPEC_NO_MARKER. Suite 62 → 84, 84/84 green over five runs. 5 findings accepted with rationale (SIMP-9 counter now arguably redundant, K2-10 dataclass, PERF2-5 cat-file --batch, SIMP-11, PAT2-17). |
| 2026-08-09 | feature/spec-168-project-stack-descriptor | FAIL | 0 | 4 | 13 | 24 | Pass 1 — security-sentinel, code-simplicity-reviewer, performance-oracle, pattern-recognition-specialist, tdd-compliance-reviewer. spec-compliance-reviewer was NOT dispatched, so spec_compliance was recorded N/A rather than papered over as PASS. Two branch-owned Highs: H-B, a repo marker over-selecting two language reviewers on a code-free diff, pinned as intended behaviour by the branch's own test case T8(f); and H-C, the Python branch still carrying the identical defect the PHP branch was written to fix, disclosed in rci.not_actioned but unfiled, untested and unmarked in source. Two inherited toolkit-wide Highs filed rather than fixed: BUG-044 (the read-only PreToolUse hook exits 1 on stdout where the contract is exit 2 on stderr, so it never blocks for any of the 21 review agents) and BUG-045 (files_match pipes into grep -q under pipefail). The suite was 43/0 because the defect was pinned as a requirement — a green suite was not evidence. Remediation applied same session but left UNCOMMITTED; gate correctly held at FAIL because no reviewer had seen the fixed code. |
| 2026-08-09 | feature/spec-168-project-stack-descriptor (pass 2) | FAIL | 0 | 1 | 12 | 8 | Six reviewers incl. the spec-compliance gate pass 1 skipped — spec_compliance: PASS, with FR-4, FR-6, EC-1, EC-2 (nested visifair-files/composer.json), EC-5 (four depth-1 manifests) and SC-1 all verified by execution against purpose-built fixtures. Pass-1 H-B/H-C confirmed fixed; not re-found. Reviewed against the working tree, not main...HEAD, because the remediation was still uncommitted — reviewers were told so explicitly. One High, H-E: want_lang is now openable by the PHP marker and the angular.json/nest-cli.json branches inside it carry no diff guard, so the branch newly dispatches an Angular/NestJS specialist to diffs proven to contain no TypeScript (verified vs git show main:: angular.json-only + src/a.php → angular-reviewer, where main selected no language reviewer). Found independently by five reviewers. Third appearance of one category error in this spec — v1 let a marker suppress, v2 let it conjure the TS default, v3 fixed both for TS and Python and left the same shape unguarded three lines above. FAIL chosen over PASS-with-recs (1 High) because it is a regression the branch introduces and it leaves the changeset shipping documentation its own code falsifies. Notable non-findings recorded to prevent re-investigation: the constitutional floor is unreachable by any input (survived hostile-input fuzzing incl. the SIGPIPE roster collapse); no command execution, path traversal or secrets; the find probe is depth-bounded at 11 ms against a 5 000-package node_modules; the 9→13 unknown-diff roster correction is CORRECT and root-invariant. BUG-044/042 both CONFIRMED by execution (they had been filed on reading) — but BUG-045's filed repro does not reproduce (onset ~800–1200 paths, a probabilistic race not a cliff, nullglob sub-claim invalid). Auto-fix deliberately skipped: all findings HUMAN-REQUIRED. 13 beads issues filed. |
Recurring Findings¶
| Finding Type | Frequency | First Seen | Agent | Action Taken |
|---|---|---|---|---|
| Reviewers return ZERO at gate-writing time, then land High findings after the gate is written | 7 | 2026-08-04 | orchestrator (all 8 reviewers) | 4x on SPEC-170 alone — passes 1, 2, 3 and 4. Pass 1's late returns added 4 High, pass 2's added 3 (two REPRODUCED detector defects). Pass 3 dispatched them first, before any orchestrator work, and still got 0 returns. Guard now applied: a no-return pass is recorded INCOMPLETE, never PASS, and the gate is amended on return rather than rewritten. Updated 2026-08-07: now SIX — passes 1-6. Pass 5's late returns added FIVE Highs, three of them VACUOUS GUARDS (assertions that graded source text and stayed green under a straight revert of the fix they guarded). Pass 6's added four more, including a prompt-free arbitrary-execution grant via scripts/run-tests.sh's discovery globs, reproduced twice. Six for six: a no-return pass has NEVER once turned out to be complete. Pass 4 is the first pass where the amendment actually happened — pass 3 instructed itself to amend three times and never did (see the pass-3 row). Pass 4 amendment: 1 High -> 8, two of them merge blockers, one a prompt-free RCE in the branch's own diff. This is a harness/timing problem, not a reviewer-quality one, and it is the single most consequential recurring finding in this file — it is the mechanism by which a green-looking gate twice concealed live defects. Candidate for docs/solutions/patterns/. Updated 2026-08-10 — now ELEVEN, and the streak is unbroken across every pass of this spec that dispatched reviewers at all. Passes 8-11 each ran partial: pass 9 wrote its gate at 1 of 4 returns, pass 10 at 3 of 4, pass 11 at 2 of 3 with the third stalled 11h and killed WITH A MUTATION STILL APPLIED. Pass 12 dispatched none and is not counted. Eleven for eleven, a no-return-or-partial-return gate has NEVER once turned out to be complete. Updated 2026-08-07 — now SEVEN, and the streak is unbroken across every pass of this spec. Pass 7 was the INDEPENDENT pass and deliberately tried to break the pattern: it dispatched reviewers FIRST, before any orchestrator work, and against isolated clones. It still wrote its gate at 2 of 5 returns, and the late returns still added three Highs — including P7-H2, a prompt-free arbitrary-execution path (an untracked repo-root conftest.py executing during the allow-listed run-tests.sh). That is the SECOND time a prompt-free execution finding has arrived by late return on this branch; LATE-H1 was the first. Seven for seven, a no-return-or-partial-return gate has NEVER once turned out to be complete. New sub-lesson from pass 7: reviewers confound EACH OTHER. Two reviewers sharing one clone produced two false findings — one seeded output_contract: single-fact to test a hypothesis, the other measured the mutated tree and reported it as HEAD's baseline. Isolating reviewers from the LIVE tree is necessary but not sufficient; they need isolating from each other. The workflow fix remains unbuilt: the gate should not be writable until returns are in, or the skill should block on them. |
| Derived counts asserted instead of re-derived, and stale within one fix pass | 9 | 2026-08-04 | orchestrator, spec-compliance-reviewer | 4x on SPEC-170 — PAT-3 (decisions.md 96 vs 125), PASS2-3 (triage 27/13 vs 26/14), P3-1 (triage 53/10/1/6/1 vs 58/7/2/8/1). The third recurrence evaded notice because the total was correct: a total is invariant under a PENDING→RESOLVED retag, so it is the one number that cannot detect the drift. Guard: check the breakdown, never the total. Existing pattern docs count-reconciliation-single-source.md and fix-commentary-drift.md both apply; neither was enough on its own. 4th (2026-08-05, LATE-H3): the fix commit 56497f2c claimed four files reconciled; the calibration follow-up — the site P3-2 explicitly prioritised — was not among them, and still says 12/12/12 and 125 against a runtime 13/13/13 and 124. Independently, THREE shipped surfaces carry three different wrong assertion counts (CHANGELOG 37, change-ledger 37, .test-gate.md 44; runtime 49), and "All 15 fixtures are purposeful" is asserted in three files about a set that is now 19. Conclusion after four recurrences: this class cannot be held by discipline. Structural remedy required — the suite prints a line the gate files quote verbatim, and a test asserts the quote. Updated 2026-08-07 — now EIGHT, and the remedy is BUILT. Instances 5-8: plan.md's goal capsule (12/125 vs 13/124), check-output-contract.sh saying "the 21 fixtures" in SHIPPED CODE against 33 on disk, "68 agent files" against 62 (the 68 counted six SYMLINKS to siblings already counted), and a commands glob matching 35 of 36. Section 8 of test-output-contract.sh now carries DERIVED_MIRRORS: each row pins a quoted number to a derivation computed from disk at run time, so a mirror that drifts reddens the suite in the same run that moved it. Two lessons the earlier entries missed. First, a guard that pins ONE number reads as if it certifies the class — the pass-5 gate declared the class clean while three other counts were stale. Second, a DERIVATION is not a MEASUREMENT: pass = skills - baseline agreed with the gate only by accident, and tagging any skill single-fact made it silently wrong (measured: gate 12, model 13). It now parses the gate's own summary line. Updated 2026-08-10 — now FOURTEEN. Instances 10-13 were swept during passes 9-11; instance 14 (pass 12) is the sharpest answer yet to the open question this row ends on. plugins/vt-base/CHANGELOG.md declared a "137-assertion test suite" in the SHIPPING 6.1.0 entry against a live 143 — and the very next sentence of that same bullet read "the count is mirrored into three shipped surfaces by DERIVED_MIRRORS, which reddens the suite in the same run that moves the number". All THREE pinned surfaces were correct; this was a FOURTH, in the same plugin as the suite, that nothing pinned. The open question below — how to make adding a new quoted count require adding its pin — is no longer hypothetical, and the interim answer is that a quoted count in a plugin CHANGELOG is a mirror like any other and now has a COUNT_MIRRORS entry. Updated 2026-08-07 — now NINE, and instance 9 is the most pointed yet: it is inside a finding ABOUT calibration counts. P6-M4 was recorded in review-triage.md as "three live grandfathered skills use the singular ## Next Step". Measured by pass 7: three OCCURRENCES in ONE skill (phase-checkpoint/SKILL.md at :71, :408, :457). The class is real and still unrecorded in the calibration follow-up; only the magnitude was wrong, overstated 3x. A second live instance sits at decisions.md:74 ("Agents (68)") against 62 at :70 and :79 — §8 pins two agent-count sites and not that one, which is the DERIVED_MIRRORS remedy's own coverage boundary showing itself. The remedy works where it is pointed and nowhere else, so the open question is no longer whether to build it but how to make adding a new quoted count require adding its pin. |
| A correction that reproduces the defect it corrects | 3 | 2026-08-10 | performance-oracle, vt-d-4-review orchestrator | 3x within one spec (SPEC-168), all in pass 4, and each instance was written by someone who had just read the defect they then repeated. (1) BUG-045.md's failure threshold has been stated three times and all three stated a path count as safe — v1 "~300–1200", v2 "below 1000 is safe", v3 "1000 long paths (~28 KB) passed 20/20" — the last sitting inside a bullet headed "No path count is safe", and measured 0/20 at 87,000 bytes by three independent observers. (2) .test-gate.md's commit_tested was stale at 5acec0d3; commit 241fbcac fixed it to 4d399ac6 and added a note complaining the pin "was one commit behind" — while itself being 241fbcac, so the new pin was stale on arrival. (3) The pass-3 count reconciliation pinned three mirrors to one source and wrote a note naming exactly those three — missing .claude-checkpoint.md, the fourth, which is the surface the next phase reads first. The generalisable guard: a correction to a stated fact must be verified by the same method that detected the error, not by re-reading the prose. For (1) that means re-measuring, not re-wording; for (2) it means a field that cannot be correct at write time must pin something that exists at write time (tree hash, git describe --dirty) or be amended after commit; for (3) it means deriving the mirror list mechanically rather than enumerating it by hand. Note the shared shape with count-reconciliation-single-source.md — this is its prose sibling, where the "count" is any asserted measurement. Strong candidate for docs/solutions/patterns/, but see the caveat: critical-patterns.md P-004 is already 119 lines against 30–49 for P-001..P-003, so this should be authored as a NEW short entry, not appended to an existing one. |
| A feature branch silently deletes tracked issue rows belonging to another spec | 2 | 2026-08-04 | spec-compliance-reviewer, vt-d-4-review orchestrator | 2x — SPEC-168 pass 3 (2026-08-09): commit 4d399ac6 dropped 7 of main's 8 open .beads/issues.jsonl rows, all SPEC-170's, one priority-1, unmentioned in the commit message. Prior: main's c1cc77c8 "restore project registration and beads issues after the SPEC-169 merge" repaired the identical damage. Root cause is structural, not carelessness: .beads/beads.db is gitignored and per-worktree, while .beads/issues.jsonl is the tracked export — so any bd sync run from a worktree rewrites the shared export from a partial local view. The aggravating detail is that /vt-d-4-review's own Step 5.5 instructs bd create + bd sync whenever .beads/ exists, making the review skill the vector; pass 3 refused to run it for that reason. At 2x and already-repaired-once, this needs tooling, not vigilance: gate Step 5.5 on beads.db being present, or make the export merge rather than overwrite. Strong candidate for docs/solutions/patterns/. |
| A repo-scoped fact leaking into a diff-scoped decision | 3 | 2026-08-09 | pattern-recognition-specialist, code-simplicity-reviewer, performance-oracle, tdd-compliance-reviewer, spec-compliance-reviewer | 3x within a single spec (SPEC-168), each time green. v1: a composer.json marker suppressed kieran-typescript-reviewer on every .md/.sql/.yaml-only diff. v2: the fix stopped suppression but let the marker conjure the TS default onto code-free diffs. v3 (pass 2, H-E): the one-rule fix was applied to TypeScript and Python and left unapplied to the angular.json/nest-cli.json branches three lines above, which this spec newly made reachable. The generalisable guard: when a fix establishes a rule, enumerate every sibling branch the rule governs and assert the rule on each — a rule applied to 3 of 5 branches is a rule that will be rediscovered as a bug. Note the test pathology that let it recur: T8(f) asserted the current behaviour each time, so the suite ratified whichever answer was live. Strong candidate for docs/solutions/patterns/ — it is the diff-scope sibling of the existing suppression-mirrors-detection.md. |
| A fix that resolves a duplication finding by adding another copy | 2 | 2026-07-21 | pattern-recognition-specialist, design-implementation-reviewer, code-simplicity-reviewer | 2x — SPEC-157 Pass 1 C1 said the canonical PrimeNG preset lacked dark mode; the Pass-2 fix (18770f6d) resolved it by copying a 145-line preset into bootstrap/SKILL.md rather than pointing at the generator, taking the anthracite ramp from three unlinked copies to five and shipping the wrong brand orange in the new copy (P2-C3). Guard: when a finding names a pointer as broken, the fix must repair the pointer, not clone the target. Candidate for docs/solutions/patterns/. |
| A documented pattern meant to be copied ships with a defect, multiplying it | 2 | 2026-07-21 | julik-frontend-races-reviewer | 2x — SPEC-157 P2-C1/P2-C2: the theme switcher in visitrans-design-system/SKILL.md captures its toggle with an unguarded querySelector and never applies color-scheme at load, and pd-3-prototype/SKILL.md:311 was changed in the same branch to mandate copying it into every Angular product UI. Guard: a snippet a skill tells agents to copy is a distribution channel — review it at the severity of the fleet, not of the page. |
| Unrelated changes bundled in feature branch | 17 | 2026-02-19 | code-simplicity-reviewer, pattern-recognition-specialist, security-sentinel | Recurring 17x — promoted to critical-patterns.md at 3x. Still occurring. Consider tooling enforcement. |
| argument-hint in new SKILL.md despite documentation saying not to | 9 | 2026-02-20 | pattern-recognition-specialist, code-simplicity-reviewer | 9x — SPEC-104 dream skill also includes argument-hint. Pre-existing from SPEC-102 creation. Documented as "harmlessly ignored" in vt-base-rules.md. |
| plugin.json description inconsistent with constitution | 4 | 2026-02-21 | code-simplicity-reviewer, pattern-recognition-specialist | 4x — SPEC-120 PAT-1: description claims "54 agents, 123 skills" / components: { agents: 55, skills: 123 } while actual manifests have 49 agents + 119 skills. SPEC-120 incremented 122→123 correctly (one new skill); drift was pre-existing. P-003 pattern already documented. Recurrence shows the pattern is not self-healing — needs tooling (pre-commit gate that asserts components.* match manifest line count). |
| Stale test gate from different branch | 22 | 2026-02-25 | code-simplicity-reviewer, vt-c-4-review | 22x -- SPEC-165 review (2026-07-27) found BOTH .test-gate.md (feature/spec-161-*, PASS 59/59) and .review-gate.md (SPEC-161, PASS) forked into this worktree; both replaced. Note the compounding hazard this time: the review could not execute tests, so had the stale PASS been trusted, finalize would have read a 59/59 PASS belonging to another spec entirely. Prior: SPEC-161 review (2026-07-24) found BOTH .test-gate.md and .review-gate.md carrying BUG-003 (fix/bug-003-visimatch-contrast) content, forked into this worktree; refreshed to current branch + PASS. Prior: SPEC-129 review found gates carrying SPEC-149 content; SPEC-150 review (2026-07-05) then found BOTH .test-gate.md and .review-gate.md carrying feature/spec-151-multi-worktree-conventions content; SPEC-134 review (2026-07-06) found .test-gate.md carrying spec-150 content and .review-gate.md carrying spec-131 content; SPEC-135 review (2026-07-06) found BOTH gates still carrying SPEC-134 content — refreshed again. Same root cause: ephemeral gates persist across worktree switches. ≥3 threshold long surpassed — auto-invalidation hook still does not fire on worktree switch. Strong candidate for tooling enforcement (assert gate branch: == current branch before finalize reads it). |
| Fork-unsafe interactive prompt (AskUserQuestion in context:fork skill) | 1 | 2026-07-05 | pattern-recognition-specialist | 1x -- SPEC-150 PAT-1: single-source Step 0.5 block (byte-identical across 11 stubs) names AskUserQuestion, but 2 of the 11 hosts (4-review, 5-finalize) are context:fork and forbid it. Root cause: a byte-identical shared block cannot be fork-aware. RESOLVED Pass 2 (2026-07-05): fork variants forked to a non-interactive report-only branch (no AskUserQuestion, no --record-skip); verified by pattern-recognition-specialist. Monitor when shared prose blocks are injected into mixed fork/non-fork skills. |
| Hardcoded Airtable infrastructure IDs | 3 | 2026-02-28 | security-sentinel, pattern-recognition-specialist | 3x -- main review flagged table IDs and hierarchy record IDs; first fix review flagged hierarchy IDs moved to config without env-var override; re-review confirms same. Promote to critical-patterns.md when file is created. |
| Incomplete bulk rename (directory renamed but body references not updated) | 1 | 2026-03-28 | spec-compliance-reviewer, pattern-recognition-specialist | 1x -- SPEC-097 renamed directories and frontmatter but left 72+ body references unchanged. Auto-fixed in Pass 2. |
| Hardcoded user path in committed settings | 1 | 2026-03-28 | security-sentinel | 1x -- .claude/settings.json committed with /Users/rolf/ path. Related to P-002. |
| Test asserts substring-on-whole-file instead of structural location | 3 | 2026-05-13 | pattern-recognition-specialist, code-simplicity-reviewer, tdd-compliance-reviewer | 3x — SPEC-165 (2026-07-27, PAT-1 HIGH): T11's five structural assertions are all grep -qF <needle> <whole SKILL.md>, exactly what structural-test-assertions.md forbids. Moving the pinned invocation into an ## Examples section and deleting Step 0 item 5 leaves every assertion green and the feature dead — and grep -qF being a prefix match means --no-lock could be appended to the invocation undetected (TDD-8). The spec's plan names this the top risk (R4, "one prompt line from silent bypass") and cites this very pattern as reused. Third occurrence in an implementation that CLAIMED the pattern — the pattern doc is not preventing the defect it documents; the reusable extract_* helper at structural-test-assertions.md:89-110 is being read as illustration rather than as required API. Recommend a mechanical guard: flag any grep -qF in tests/ whose target is a bare *.md path. SPEC-165 disposition (2026-07-28): T11 rebuilt correctly — step0_region() extracts the region first and every positive is paired with a mutated copy that must fail the identical check (invocation relocated out of Step 0; notice deleted), plus a new assertion forbidding --no-lock/--no-shared on the pinned line, closing the prefix-match hole. The instance is fixed; the mechanical guard is still unbuilt and is the actual remedy for a 3x recurrence in implementations that each claimed the pattern. It is a cross-cutting test-lint affecting every suite in the repo, so it needs its own spec rather than a ride-along. Prior — SPEC-123 PAT-1: T2/T11/T12 used grep -qF over whole SKILL.md to verify generated paths: block; tests passed even when block landed in document body (Critical SPEC-1 not caught). Fixed in Pass 2 with frontmatter-assertions.sh + extract_frontmatter helper. SPEC-135 (2026-07-06, TEST-1 HIGH): the decision-log drift-guard asserted frontmatter keys with unanchored grep -q "$key" over the extracted block — a dropped YAML key (iteration:/rationale:) survived as a prose word (false-green). Auto-fixed by anchoring to ^[[:space:]]*${key}: and proven to reddens on a perturbed block. Same anti-false-green class as SPEC-131 M1 / structural-test-assertions.md — anchor to the structural line, don't substring the region. |
Agent Effectiveness¶
| Agent | Reviews Run | Findings | Critical Catches |
|---|---|---|---|
| security-sentinel | 83 | 101 | 0 |
| kieran-typescript-reviewer | 43 | 7 | 0 |
| kieran-python-reviewer | 3 | 20 | 0 |
| julik-frontend-races-reviewer | 46 | 37 | 2 |
| code-simplicity-reviewer | 87 | 217 | 0 |
| performance-oracle | 72 | 54 | 0 |
| pattern-recognition-specialist | 84 | 208 | 1 |
| spec-compliance-reviewer | 57 | 39 | 1 |
| document-quality-reviewer | 18 | 64 | 2 |
| accessibility-reviewer | 6 | 31 | 2 |
| design-implementation-reviewer | 2 | 23 | 1 |
| research-quality-reviewer | 2 | 10 | 0 |
| data-integrity-guardian | 1 | 3 | 0 |
| tdd-compliance-reviewer | 4 | 18 | 0 |
Notes on selection (SPEC-165, 2026-07-27)¶
kieran-python-reviewerwas the highest-yield reviewer of the review (2 of 6 High) and would not have been selected:persona-select.sh:93gateshas_pyonpyproject.toml/setup.py/requirements.txtinPROJECT_ROOT, and this repo has none (onlyrequirements-docs.txt) despite shipping 47.pyfiles underplugins/*/skills/*/scripts/. Withdiff_known && !has_ts && !has_py,want_langis false and no language reviewer is selected at all. Same silent-drop class as BUG-004. Fix: add a.py-in-diff signal tohas_py.julik-frontend-races-reviewerandaccessibility-reviewerwere selected only because an inherited staticdocs/evaluations/vtd-vs-v025.htmlmatched the frontend pattern — yet julik, re-aimed at process/file races rather than DOM races, produced 2 of the 6 High. Worth remembering that the races specialist generalises beyond the browser.
SPEC-168 attribution note (2026-08-09). The two SPEC-168 rows above add 2 review runs each for the five pass-1 reviewers, 1 for
spec-compliance-reviewer(pass 2 only), and only the pass-2 finding counts (spec-compliance 3, security-sentinel 3, code-simplicity 5, pattern-recognition 6, performance-oracle 3, tdd-compliance 6). Pass 1's 41 findings are not attributed per agent, because pass 1 never wrote a review-history row and no per-agent breakdown survives. The totals are therefore a floor, not a reconciliation — recorded this way rather than back-filled with an estimate.SPEC-168 pass-4 attribution note (2026-08-10). The pass-4 row above adds 1 review run each to only the three reviewers that actually returned —
performance-oracle(+6 findings),code-simplicity-reviewer(+6), andsecurity-sentinel(+1, an addendum and a reconciliation rather than a finding list).spec-compliance-reviewer,pattern-recognition-specialistandtdd-compliance-reviewerare credited with nothing: they were dispatched, but no report reached the orchestrator, so counting them would inflate the effectiveness table with work whose output does not exist. Much of their ground was covered by direct orchestrator execution instead (the documentation-surface reconciliation, and thetools:-deletion mutation), and that is recorded inreview-triage.mdunderORCH-*ids — deliberately NOT attributed to the personas that did not run it. The totals remain a floor, not a reconciliation.The non-returns are a measurement, not noise. Three reports were lost to the
general-purposereply-address defect — an agent type, not a routable address — which five pass-3 reviewers also hit. Across passes 3 and 4 that is a review process losing reviewer output on more than half its dispatches. It is filed only in the tail of BUG-046 and is recommended for escalation into its own fix, on the grounds that a gate which silently drops findings fails in the same direction as the very defect it is reviewing: quietly, and toward less review.