Skip to content

Release 0.39.0-beta1: Continuous Co-Review (Feature 197)#2907

Merged
alonf merged 269 commits into
mainfrom
197-continuous-co-review
Jul 9, 2026
Merged

Release 0.39.0-beta1: Continuous Co-Review (Feature 197)#2907
alonf merged 269 commits into
mainfrom
197-continuous-co-review

Conversation

@alonf

@alonf alonf commented Jul 1, 2026

Copy link
Copy Markdown
Owner

0.39.0-beta1 prerelease

Flagship: Feature 197 — Continuous Co-Review. A Stop-hook navigator fires an independent, human-authorized reviewer (codex / a second Claude / copilot) in an ephemeral read-only git worktree at each implement checkpoint, producing a schema-conformant findings verdict. The reviewer is host-neutral and code-writer-independent; the review-signoff gate fails closed until real co-review evidence exists, so a self-review cannot satisfy it. A round ceiling bounds non-convergence and a ceiling-halt emits a visible escalation (never a 0-findings false-green). specrew review --live runs an on-demand review of the working change-set.

This prerelease also bundles Feature 185 (host-neutral lifecycle gate enforcement) and the accumulated 0.39.0 base (Features 174 / 182 / 183 / 184).

Validated end-to-end

Continuous co-review was dogfood-validated across three fresh projects, including the Stop-hook auto-fire producing a real independent codex review with genuine findings, and — notably — the co-review catching a real reachability bug in its own D-014 fix (an inert code path that parse/unit checks missed).

Known beta characteristics (honest)

  • Reviewer authorization is a one-time per-project step: specrew review --host codex --authorization-ref <ref>. The recommended auto-select preference does not auto-authorize; an unauthorized first checkpoint now surfaces an actionable "authorize a reviewer" message instead of failing silently. (drift-log D-014)
  • Codex reviewer reliability: codex intermittently returns empty exit-0 output → no review produced (~50% of runs this session); re-fire to retry. This always fails loudly (status=failed), never as a false pass. (drift-log D-015)
  • Dev-trial version-split: the SPECREW_MODULE_PATH dev-trial override reaches the hooks/gates but not the specrew CLI, so validating a CLI-enabled feature requires an installed build. (drift-log D-013)

Scope

Large accumulated release PR. Full detail in CHANGELOG.md ([0.39.0-beta1]) and specs/197-continuous-co-review/iterations/009/drift-log.md (D-001..D-015).

🤖 Generated with Claude Code

alonf and others added 30 commits June 18, 2026 01:51
Record lifecycle repair validation and resolve GOV-197-001 in the Iteration 001 review artifact.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Trace: T051-T057, FR-017-FR-023, SC-013-SC-018

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- scaffold Iteration 002 plan/state/drift artifacts
- classify planning-only contract edits outside runtime task completion
- remove branch-local refocus runtime artifact before implementation gate

Trace: T051-T057, FR-017-FR-023, SC-013-SC-018

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Refs: T051, SC-006, SC-011

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Trace: FR-023, IMPL-011, TG-013, SC-006, SC-011. Rules: specs/197-continuous-co-review/implementation-rules.yml. Treats pushed f31e0c7 sync evidence as satisfying T051 after fresh status verified HEAD equals origin/197-continuous-co-review and no protected-surface drift. Includes project setup ignore verification for detected Dockerfile surface.
Trace: FR-017, SEC-007, IMPL-008, SC-013, TG-013. Rules: specs/197-continuous-co-review/implementation-rules.yml. Adds scripts/internal/continuous-co-review/code-review-agent.md and deterministic contract fixture/tests proving Proposal 145 rubric phases, workshop-decision conformance, claim/design trace, report-falsification, per-lens validation, visibility policy, do-policy, round protocol, and FindingsResult.v1 output contract.
Trace: FR-018, FR-019, INT-010, INT-013, OBS-010, IMPL-009, SC-014, SC-015, TG-013, TG-014.

Tests: Invoke-Pester reviewer-contracts, review-request-builder, review-prompt-composer (16 passed, 0 failed).
Trace: FR-020, SEC-008, SEC-009, OBS-012, SC-016, TG-013.

Tests: Invoke-Pester reviewer-contracts, reviewer-execution-engine, codex/claude adapters, workspace-mutation-guard (23 passed, 0 failed).
Trace: FR-018, FR-022, INT-011, INT-012, SC-017, SC-018, TG-014.

Tests: Invoke-Pester -Path tests/continuous-co-review/unit/host-agent-mirror.Tests.ps1 (3 passed).
Trace: FR-021, OBS-011, IMPL-010, SC-014, SC-017, SC-018, TG-013.

Tests: Invoke-Pester -Path review-prompt-adapter-seam, reviewer-host-adapter-claude-prompt, reviewer-host-adapter-codex-exec (10 passed).
Trace: FR-021, FR-023, INT-013, OBS-011, SC-006, SC-011, SC-014, SC-015, SC-016, TG-013.

Tests: Iteration 002 validation Pester set passed 45/45; traceability rows T051-T057 mapped to FR/SC with required refs present.
Trace: FR-018, FR-020, FR-021, FR-022, SC-012, SC-014, SC-016.

Repair B-197-I002-001 by resolving Windows codex.ps1 shims through a safe PowerShell argv path, preserving codex exec --sandbox read-only, capturing Codex last-message JSON, and embedding FindingsResult.v1 schema in the adapter-bound prompt.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Expose specrew review --live as the runtime-backed reviewer entry point, deploy continuous co-review runtime/contracts to downstream hosts, and document live evidence expectations across the specrew-review skill surfaces.

Tighten reviewer execution so mutation detection guards the reviewed project's changed paths, not only Specrew runtime paths, and cover normal target-source mutation with regression tests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- rank top reviewer harnesses per code-writer independence policy
- capture code-lens reviewer preference as schema-valid implementation rules
- persist requested reviewer effort in live review evidence

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The single real-process spawn (Invoke-ContinuousCoReviewAdapterProcess) wrote stdin synchronously before WaitForExit, so a child stalling on a full pipe bypassed the timeout and was left running; the exception path only Disposed (no Kill). Now reads stdin before Start, writes stdin on a deadline-bounded background task, bounds the output drain, and kills the process tree in finally if still alive. Dedicated regression test tracked as T063. Verified: claude/codex adapter tests incl. the real-process shim.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…o-review

Amend the spec with FR-024..FR-032 and SC-019..SC-023 for always-on co-review at every implement checkpoint: a deterministic gate floor at the non-protected boundary-sync chokepoint keyed on diff_hash freshness (baseline advances only on a pass), a 197-owned gate-review dispatcher with a gate-keyed registry (sole registrant code@implement), and a Phase B Stop-hook navigator via the host abstraction (Iteration 004). Plan Iteration 003 = Phase A (T058-T064, 9.5/20 SP, no protected files) with design-analysis and the before-implement drift-log scaffold.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ast passing review state

Lift diff_hash and reviewed_ref onto the durable review-run.json record and add Get-ContinuousCoReviewLastPassingReviewState, the single .specrew/review/inline evidence source the gate floor (FR-025) and incremental baseline (FR-027) both key on. review-run-index-writer.Tests.ps1 5/5; spine regression 4/4. Remaining T058: orchestrator rebaseline and reviewed_ref=HEAD population.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ed_ref (FR-027)

The orchestrator now rebaselines each co-review to the last passing reviewed point (opt-in -RebaselineToLastPass, resolved from .specrew/review/inline evidence) so each checkpoint reviews only its incremental diff, and records reviewed_ref = HEAD plus diff_hash on the run index. The baseline advances only on a pass, so a missed/blocked checkpoint keeps it pinned and the next review re-covers that span. Git-fixture integration test 1/1; run-index-writer 5/5; spine regression 4/4. Records the maintainer-approved resequence (D-197-I003-002): Stop-hook trigger pulled onto the critical path ahead of the gate floor.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… deferred to post-185

Add Get-ContinuousCoReviewSignoffGateDecision + Assert-ContinuousCoReviewSignoffGate: the deterministic 'no signoff on un-reviewed state' gate floor, keyed on diff_hash freshness recomputed from the last passing run's baseline_ref to the current working tree (no-evidence -> block, fresh -> allow, drift -> block-stale). Because the baseline advances only on a pass, this single current-state check transitively covers every prior increment. 197-owned + conflict-free; the one-line wiring into Invoke-SpecrewBoundaryStateSync is deferred until F-185's host-neutral gate-enforcement branch merges (185-first per the cross-crew coordination). Tests 4/4.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ness)

Fresh-context 145 review found the gate did not deliver FR-025. Fixes: F1 untracked-file false-allow (gate now blocks unreviewed-working-tree via git status, excluding Specrew runtime trees); F2 missing feature/iteration scoping (new scope field + exact-match filter threaded through resolver/gate/orchestrator so 'last passing' cannot be a different feature's run); F3 reviewed_ref provenance comment; F4 corrected SC-019/SC-020 overclaim in trace tags; F5 falsifying tests (gate 4 -> 8: untracked-block, real non-empty fresh, malformed, baseline-unresolvable, cross-scope, assert-stale); F6 robust DateTime sort; F7 diff_hash over the reviewable (post-exclusion) change-set. Full continuous-co-review suite 148/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ial/learning close)

Iteration 003 (Phase A) did not achieve full scope: T058 + the spawn-orphan robustness fix delivered and sound; T061 gate-floor delivered but its model was invalidated by the feature's own Proposal 145 co-review (HOLE A gitignored-blindness live in e8493b8, HOLE B unanchored operator baseline); T059/T060/T062/T063/T064 + the gate re-architecture deferred to Iteration 004. The dogfood loop catching its own gate unsound IS the iteration's key learning. Also cleaned probe pollution (a stray probe/app.txt commit + untracked artifacts written by the adversarial reviewer sub-agents) off the branch tip.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ture (maintainer direction)

Reverse the premature review-signoff partial-close (b14fb8fb): 003's FR-024/025/027 scope is unchanged, so the content-addressed + anchored gate re-architecture is continued implementation toward 003's gate goal, not a new iteration. Remove the premature review.md; reset state to executing; record D-197-I003-005. Iteration 004 stays reserved for Phase B (Stop-hook). Capacity split only if the re-planned remainder exceeds the 20 SP cap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…-style error

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ent-addressed + anchored)

Revise the Phase-A gate design after the dogfooded co-reviews found HOLE A (gitignored blindness) + HOLE B (unanchored operator baseline). New model: content-addressed reviewed-state tree-id (includes gitignored source minus secrets/ambient per maintainer A-decision + SEC-002), lineage chain anchored to merge-base with main, producer auto-anchor + gate chain-verification + human-authorized recorded override (maintainer B-decision), fail-closed git handling. Sized to the raised 25 SP cap; stays in iteration 003.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…-addressed digest

write-tree over a temp index validated in an isolated repo: deterministic same-checkout, gitignored source included via add -f (HOLE A drift detected), secret excluded, empty-tree guard id confirmed. Manifest fallback dropped (cross-platform is a non-issue: the gate recomputes on the producing checkout).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…4.00/25 SP)

Re-architecture task set (D-197-I003-004/005): T058 done; T061 superseded by T067; T065 reviewed-state digest helper, T066 tree-id record + lineage/anchor resolver, T067 re-architected gate, T068 producer auto-anchor + trunk config, T069 retire diff-hash path; T059/T060 dispatcher, T062 auth/escalation, T063 spawn regression test carried; T064 revised closeout incl. HOLE A/B repros must block. Cap raised 20->25 (maintainer-authorized); total 24.00/25.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…per (FR-025/SEC-002)

reviewed-state-digest.ps1: a git tree-id over the exact worktree (tracked + untracked + gitignored-SOURCE) via a temp GIT_INDEX_FILE so the real index/HEAD are untouched; secret/ambient denylist (.env, keys, node_modules, build, Specrew runtime trees) excluded per SEC-002 + the maintainer decision; empty-tree no-content guard. Tests 8/8: determinism, gitignored-source-in, secret-out, tracked-drift, gitignored-drift (HOLE A closed), secret-stable, empty-tree, denylist matching.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
alonf and others added 24 commits July 9, 2026 00:44
…ose parenthetical after "reviewer"

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…allback-chain made explicit

Maintainer-directed durable-home copy of the session ledger (2026-07-09):
- 203 Reviewer Containment + Identity Hardening: DEFER-197-I010-003 (observed
  worktree escape), the machinery digest/worktree asymmetry + stripped-paths
  prompt teaching (NOTE-197-I010-004 addendum), and the T111 standing-practice
  decision, bundled with effort/risks/open questions.
- 204 Consumer CI Methodology Gateway + Distribution Workflow Hygiene: the
  NOTE-197-I010-004 field findings (F-019-era self-host CI bundled by F-031
  into every consumer deploy), full lane inventory + split-and-consumer-ize
  design answering the maintainer methodology-gateway question.
- 102 Pillar 5 addendum: the Q4 opt-in pre-authorized cross-host fallback
  chain (co_review_auto_fallback, default OFF) + failure-classification
  vocabulary made explicit.
- INDEX rows for 203/204.
GitHub issues filed: #2908 (main public-readiness suite fully red +
reconciliation), #2909 (broken deployed workflows -> Proposal 204).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tion

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ire dedup (D-197-I010-005)

Codex auto-fire finding (run 20260708T225439577 - the navigator fired
unprompted on the proposals checkpoint and caught its own dedup defect):
dedup keyed on HEAD^{tree}, so uncommitted edits after a fired commit kept
the old key and were deduped as "already reviewed" - the auto path bypassed
the D-197-I010-004 identity fix (gate digest-freshness backstop held;
coverage gap, not a certification hole). The HEAD-tree choice guarded a 50s
digest cost that no longer exists (~0.2-2s post-batching).

- Get-ContinuousCoReviewCheckpointIdentity: certified digest first,
  HEAD-subtree fallback on digest failure; keys the navigator dedup AND the
  service pending-entry registration - one identity for dedup,
  materialization, and the gate.
- checkpoint-identity.Tests.ps1: dirty tree CHANGES the key (the bypass
  regression), clean key equals the digest, key is content-addressed (no
  double-fire committing identical content). CCR suite 257/257 (2 env
  skips).
- Bookkeeping: drift D-197-I010-005, decision DEC-197-I010-006, review.md
  gap row, state.md, CHANGELOG.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ecord (evidence for 203)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…006 two-doors drift)

Downstream-found (tesr197local, the first-ever default-budget --live use):
the manual door kept iteration-002's hardcoded 120s that the auto path had
already raised to 300s + co_review_timeout_seconds config. Every consumer
reviewer attempt was cut at ~130s (agy mid-review, claude mid-answer).

- specrew-review.ps1: parsed default 120 -> 0 (unset marker); the door
  resolves explicit --timeout-seconds -> co_review_timeout_seconds config ->
  300s baseline via Get-ContinuousCoReviewNavigatorTimeoutSeconds (identical
  to the auto path); dead else{900} removed.
- review-command.ps1 Test 5: the refused run's status envelope must carry
  timeout_seconds=300 (regression pin). Suite fully PASS.
- Bookkeeping: drift D-197-I010-006, DEC-197-I010-007, review.md gap row +
  counts, state.md, CHANGELOG. Per-host budget floors -> Proposal 102.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…s restored) + heading blank line

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…x f1-f3 to Proposal 203 W8-W10

Maintainer decision DEC-197-I010-008 ("go"): the beta ships loud-and-honest;
the three verified-true codex auto-fire findings (run 20260708T235143936 -
the first properly-budgeted auto review) defer to the 203 hardening bundle
with the run as evidence.

- Slim prompt (interim W8, shipped): IMPLEMENTER-recorded (never
  machine-observed); recorded suites are strong prior evidence for budget
  purposes; spot-checks armed as forgery detection - any record mismatch is
  itself a BLOCKING honesty finding. Prompt tests updated (7/7).
- Proposal 203: W8 runner-observed recorder wrapper, W9 per-checkpoint
  incremental baselines for the auto path, W10 fire-time digest freeze
  through the detached chain.
- Proposal 204: W5b - init creates/offers the bootstrap scaffold commit
  (the tesr197local zero-baseline saga).
- review.md Gap Ledger: three deferred rows + copilot probe note;
  decisions.md DEC-197-I010-008.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…findings can converge (DEC-197-I010-009)

The deferral path's first exercise exposed the gap: the round-4 reviewer
read DEC-197-I010-008 and still escalated (no deferral vocabulary in the
round teaching; D5 makes full+independent blocks non-overridable ->
human-deferred findings could never converge). The round prompt now teaches
resolved-by-deferral with in-tree record verification (a deferral claim
without a verifiable record is itself blocking); final-round escalation
applies only to non-deferred findings. Tests 17/17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…never self-perpetuate

Round-5 residual (run 20260709T003533602): the reviewer echoed the prior
ESCALATION item verbatim (blocking copy -> no promotion, round 6), and a
fresh round-1 review would rediscover deferred findings with no deferral
teaching at all (the RESOLVED-BY-DEFERRAL block rendered only on rounds>1).

- Base prompt gains RECORDED HUMAN DEFERRALS (every round): deferral-covered
  issues report as ADVISORY with the decision id cited, never blocking;
  in-tree record verification required (a claim without a record is itself
  blocking); an escalation item is RESOLVED once everything under it is
  fixed or deferral-covered - never copied forward.
- Prompt contract tests updated (round-1 coverage + escalation clause).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… + retro

Maintainer verdict "1" = approved for review-signoff (Stop-hook captured,
auth commit 4e71103; evidence run 20260709T005739948 full/independent/pass
over the exact head). retro.md written from the live session record:
recursive self-validation (4 machinery defects found by the machinery),
the two-doors drift class, identity-as-one-object, deferral convergence
semantics, probe hygiene, evidence honesty; 26.00/26 SP; 6 drift events
100% resolved; fast-follow map (203/204/102 + copilot row + #2908/#2909).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…, 26.00/26 SP, 6 drift events resolved

state.md: phase iteration-closeout, status complete, closeout record (both
verdicts, evidence run, fast-follow map); plan.md: Status complete +
Completed 2026-07-09; stale machine-observed phrase corrected to the 203-W8
honesty wording.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ex for iter-010

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…-I010-003 -> 203-W9)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…to bare FR-027 (validator exact-match)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ime evidence recorded (5/5 concerns)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…e-evidence (pairs with recorded per the enum contract)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
closeout.md: full-feature record (10-iteration delivered scope, machine-
recorded validation, cross-host reality, downstream consumer validation,
known non-blocking warnings with dispositions, branch hygiene incl. the
9-behind main reconciliation note, the explicit not-authorized list, and
the named follow-up map). Versions: Specrew.psd1 + config.yml + README to
0.40.0 (prerelease stamped at publish per house pattern).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ree test-portability fixes

Maintainer-requested WSL validation at the feature-closeout gate: the full
CCR suite on WSL Ubuntu (Pester 6.0.0) against the final tree. Initial run
exposed three TEST-file Windows-isms (raw Start-Process -WindowStyle in
continuous-co-review-navigator.Tests.ps1 + human-gated-status-notes.tests.ps1
- both missed by the iter-010 IsWindows-splat sweep - and a null $env:TEMP
in boundary-reader-conformance.Tests.ps1). Fixed with the established
portable patterns; Windows re-verified (22/22 on the three files); WSL
rerun fully green. Product code untouched. closeout.md validation section
carries the WSL evidence.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…closeout date

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…door (P1) + field-hardening batch

Downstream field bug (tesr197local): scripts/specrew.ps1's arg whitelist
predated --ack-degraded/--ack-reason/--remediate/--scope, so every
remediation/ack command the product itself prints was rejected as
'Unsupported argument' - the sanctioned unblock mechanisms were unreachable
through the public CLI. Invisible in self-host (dev invocations bypassed
the front door).

- specrew.ps1: quartet whitelisted (+ why-comment).
- slash-command-arg-whitelist.tests.ps1: Test 6b proves the quartet passes
  the whitelist side-effect-free (bare flag -> missing-value error, never
  'Unsupported'); Test 7 made deterministic against a pristine scratch
  project (it previously fired REAL live reviews on machines with an
  authorized reviewer and asserted pre-cutover refusal text).
- specrew-review.ps1: --ack-degraded rejects a flag-shaped run-id with
  precise usage (the exact downstream stumble).
- worktree-reviewer.ps1: deferral records must be WORKTREE-VISIBLE
  (drift-log/specs/proposals; .squad is machinery-stripped - mirror rule);
  prompt contract tests updated.
- review-command.ps1: Test 6 exercises the ack guard THROUGH the public
  front door (whitelist + parser end-to-end).

Suites: CCR 258/0, unit 10/0, review-command 7/7, whitelist all-pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…I Lint lane parity)

The CI lint lane checks every branch-changed .md; the iter-010 scaffolded
reviewer artifacts (code-map, coverage-evidence, current-architecture, etc.)
predate the session's edit-scoped linting. MD009/MD032/MD047 auto-fixes only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@alonf

alonf commented Jul 9, 2026

Copy link
Copy Markdown
Owner Author

Copilot review findings — disposition (all 7 addressed on the branch)

The seven review comments date from 2026-07-01 (the pre-vacation round); the iteration-010 work resolved each — several with in-code credits:

Finding Status
reader-tolerance.tests.ps1:37/:78 BeforeAll helpers not script:-scoped Fixed — both New-TestWorkspace (line 36) and Invoke-ValidatorScript (line 77) are script:-scoped
Specrew.psm1:19 weak SPECREW_MODULE_PATH validity check Fixed — requires BOTH Specrew.psd1 and scripts/specrew.ps1 (lines 13–18, comment credits this review)
.specify mirror of deploy-squad-runtime.ps1 missing fire-path deps Fixed — the mirror carries the agent-tasks/** + atomic-write.ps1 copy blocks (parity-verified)
P1 exploratory --baseline-ref runs promoted as signoff evidence Fixed — promotion is gated on -not $scopedExploratoryReview with an explicit exploratory message (specrew-review.ps1 ~787–810, comment credits the codex round's P1)
P2 auto-review provider ignores co_review_timeout_seconds Fixed — the provider reads the config key into navParams (specrew-co-review-navigator-provider.ps1 ~152–162, comment credits this P2)
P2 authorizing a second host drops earlier authorizations Preserved in practice — field-verified this week: a downstream project authorized codex, then copilot, then antigravity, and all three persisted in reviewer-hosts.json

Additional hardening landed since these comments: the public CLI whitelist fix for the remediation/ack flags (P1, found downstream), checkpoint-identity dedup, config-aware --live budgets, and resolved-by-deferral round semantics — see the PR body's "Late field fixes" section.

alonf and others added 4 commits July 9, 2026 13:08
…leteness catch)

The T106 escalation latch was wired into _load.ps1 but never added to the
manifest FileList - installed copies would silently ship without it (the
loader skips missing files), making the latch inert in deployments: the
exact D-197-I009-016 green-but-inert class, caught by the bidirectional
FileList completeness lane.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ogfood (target 0.40.0-beta2)

W11: the ceiling-halt message must teach the sanctioned remediation command
(it pointed at state surgery; the downstream agent burned two rounds
rediscovering tribal knowledge). W12: fix-responsive rounds must not burn
the ceiling (progress vs spin - round 2 confirmed f1 fixed AND found f2,
and honest onion-peeling got halted). Maintainer: 'Add it to 203 and we
will do it as beta 2'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…o-review + agent-tasks subtrees

The bootstrap provider hard-requires the F-197 signoff-gate wiring (loud by
design); the minimal self-host fixture only copied top-level
scripts/internal/*.ps1 and predated the requirement. Full deterministic
lane verified locally: 25/25 exit 0 (incl. contract lane + FileList
completeness).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…I red since 07-01)

Fail-on-main triage: main green, branch red since 2026-07-01 - all four
pre-date this session and blocked the release gate.

- HandoverStore: committed session-state HOST is read FIRST and the
  canonical boundary-reader call is guarded (a caller that did not co-load
  it threw inside the try, the catch swallowed everything, and env
  detection wrongly overrode the committed host - WorkshopHostDetection d).
- HandoverStore material gate: ':(exclude).specrew' on the scoped status -
  the untracked handover seed itself made every nested PostToolUse
  'material' (self-trigger; WritePathRepoRootGate pin red since the
  iter-007 scoped-scan change). Materiality = USER changes only.
- specrew-hook-dispatcher.ps1: the v2-tolerant cursor block was on the
  module copy only - synced to the extension source + .specify mirror
  (ProviderMirrorParity).
- boundary-sync-atomic.tests.ps1: example boundary review-signoff -> retro
  (the F-197 gate now correctly fail-closes review-signoff without promoted
  evidence; the test's subject is write ATOMICITY, boundary-agnostic).

Full bootstrap suite: all files green. Sc012to015 acceptance green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@alonf alonf merged commit ef551c5 into main Jul 9, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants