[matthewpeterkort]

Summary

Lane-05 (code-comments-20261113-05-final-audit): repository-wide handwritten-comment gate, its fixture matrix, CI wiring, and the unified strip + atomic re-pin wave for the 22 receipt-bearing paths (coordinator ruling: OPTION A ATOMIC, both populations in this one PR).

Machine-path accounting (corrected): 22-path atomic receipt-bearing population = 19 machine-stripped + 3 guard-quoted restored byte-identical (recipe_execution_reader.go, bundle_store.go [net-nil vs #183 pin], internal/catalog/helpers.go — absent from the PR net diff). Residual wave 5f36dbec: 4 runner mjs + helpers.go; stage_sequence_test.go restored in the review wave (attribution back, //nolint removal pre-approved). tests.yaml: 12 prose comments removed + gate step added. Two UI-family ledger rows carried waveBytesChanged=false (listed, not byte-changed).

Coordinator scope authorization (recorded per ruling): scope was extended beyond scripts/ + .github/ to verification/publication-bundle/{FINDINGS.md, OPERATOR_REVIEW_DIGEST.md, SKILL.md, reviewed-sources.json} strictly for md5/sha receipt fields of the wave paths — nothing else in either ledger.

Commits (10)

1. d7e134c4 gate: scripts/check_no_code_comments.py --all-tracked (4-language backends incl. fixed TS scanner template path, nginx quote-aware # lexing), 29→35 fixtures, allowlist classes with evidence, CI step in tests.yaml
2. 5f36dbec strip wave 1: 4 runner mjs + 2 go (token-identical)
3. d5669771 citation-line accuracy enforcement for arango dangle gates (WEAK-CITATION hardening)
4. e4ddaaf1 arango runner cleanup transport-failure audit status (separate identity-proven commit per ruling)
5. ab65fe5b checker policy: ledger pinning never exempts comments (zero-suppression); unresolvable-ledger-key inventory; EXTRACT-sentinel directive class
6. c9ab396e atomic wave: 12 tla + 7 code files stripped (token/AST identity) + scoped re-pin of reviewed-sources.json (25 machine fields, 26 receipt blocks, fix(verification): re-pin 10 comment-sweep-broken digest entries in the publication-bundle ledger [ledger-digest-repair] #183 3040a679 amendment style) + doc amendments
7. 85ab5ace gate-completion strip of .github/workflows/tests.yaml: explicit disclosure — this commit removes 12 handwritten YAML comments that merged commit 7e081f49 (feat(pg): PostgreSQL adapter for ActivateRepositoryGeneration - second CAS of repository publish #184, PostgreSQL repository-publish spine) added to the workflow after this lane's 22-path population was frozen. Removal is required by this PR's own CI step (head must be comment-free), kept as a separate commit so the edit to merged content is auditable without archaeology; comment-only — YAML document-tree equality proven via proof_yaml.mjs (equal: true), all jobs, steps, and ids unchanged, zero logic. Independently confirmed by the coordinator: non-comment lines identical to parent. This is not a feat(pg): PostgreSQL adapter for ActivateRepositoryGeneration - second CAS of repository publish #184 logic edit; job semantics untouched.
8. 1e52b4e5 checker fail-closed fix: unresolvable TypeScript scanner routes ts-family files to gate-red unsupported, never silent pass; fixtures declare skips via ts_available(); new fail-closed fixture
9. bdc036c1 CI-found regression repair + guard-quoted gate class — see dedicated section below
10. d6889e2d batched review wave (T1–T3) — see Review-response section below

Adversarial controls for the fail-closed gate semantics (coordinator condition, head 1e52b4e5)

The 1e52b4e5 fix routes TypeScript-family files to the gate-red unsupported inventory when the scanner cannot resolve. Two controls prove this cannot neuter ts coverage:

• (a) Positive control — ts coverage still bites: planted scripts/positive-control.unit.test.ts with a handwritten comment (scratch branch + scratch commit, since the gate enumerates git ls-tree HEAD; nothing pushed). Gate job invocation (npm ci in ui, then python3 scripts/check_no_code_comments.py --all-tracked, LOOM_TYPESCRIPT_DIR unset): exit 1, VIOLATION scripts/positive-control.unit.test.ts:1 [ts/line] '// handwritten positive-control comment', scanned=2970 violations=1. Scratch branch deleted after the run.
• (b) Mutation control — scanner removal is RED, never a green-skip: ui/node_modules/typescript moved away (mutating the gate job's env), same invocation: exit 1 with 638 UNSUPPORTED rows (every .mjs/.ts/.tsx file in the tracked tree), log retained at /tmp/opencode/lane05-controls/mutation.log. Environment restored; rescan clean.

Fixture-level guards mirror both: test_scanner_absence_routes_ts_family_to_unsupported_fail_closed (bare-runnable) and ts_available()-declared skips for the scanner-dependent suite (scripts/tests discover: 91 OK both bare and with ui/node_modules/typescript present, 11 declared ts skips bare; fixture file itself 43 tests incl. 7 GuardQuotedAnchors).

CI-found regression and guard-quoted retain repair (head bdc036c1)

CI on 1e52b4e5 failed 8 tests: 6 TestFB20* in recipe_execution_reader_authz_e2e_test.go (STEP 0 anchor reader-promise-ids-are-not-credentials quotes the doc-comment prose "themselves authorization credentials.") and 2 in clickhouse (publish_partial_pointer_e2e_test.go quotes bundle_store.go "Prevent the runner from deleting possibly published tables."; pointer_name_nul_ambiguity_e2e_test.go quotes internal/catalog/helpers.go "catalogIdentityDigest hashes a length-prefixed sequence rather than a"). These are claim-source drift guards: the comment prose is a live verification anchor, and this repo's own precedent (lane02, retain commits recorded inside 48783199) is that guard-quoted comments are retained through strip waves. My wave's local verification ran go vet + test-compile but not these package suites — CI is where the gap surfaced; disclosure stands on record here.

Repair (bdc036c1):

• All three files restored byte-identical to their 90267c06 base blobs (git hash-object == base blob verified): recipe_execution_reader.go, internal/dataframe/publication/clickhouse/bundle_store.go, internal/catalog/helpers.go.
• Systematic orphaned-quote sweeps re-run over the whole branch, both directions: forward (every deleted comment line vs full test corpus) and reverse (every ≥25-char prose literal in any tracked test file that is absent from non-test sources at HEAD but was present in pre-strip blobs). Result: 0 remaining orphaned quotes. The only non-restored hits are file-path citations checked against live production files (verified by reading each citation table) and duplicated citation-gate helper code from this branch's own in-test refactor d5669771.
• Gate gets a guard-quoted allowlist class so the retained anchors stay green: a comment block is allowed iff some marker-stripped ≥25-char line appears verbatim in a tracked test-family file other than itself; the corpus is built from the same enumeration as the scan and any corpus-build failure allows nothing (fail closed). The allowance is dynamic: if a test later drops its quote, the comment goes gate-red. Seven GuardQuotedAnchors fixtures pin the semantics (unquoted stays red; sub-threshold quote red; quote outside test files red; self-quoting test file red; quote removal flips back to red).
• Ledger: both affected lane05Repin blocks gain postStrip history + guardQuoteRestore receipts. bundle_store.go sha256 returns to its pre-strip #183 value 1dce5b82c3… (net wave effect nil); recipe_execution_reader.go sha256 set to the true base-blob value b00d64740d…, matching its preExistingDrift live value. helpers.go has no ledger row.
• Verification: go test ok on resolver, clickhouse, catalog, arango (publication/dataset/root), dataframe/published, dataset, server, conformance/compiler; gate scanned=2969 violations=0 unsupported=0 with 7 guard-quoted allows; scripts/tests 91/91; both adversarial controls re-run against the patched gate (positive: planted ts comment → exit 1 VIOLATION, scanned=2970 violations=1; mutation: typescript removed → exit 1, 638 UNSUPPORTED).

C-list evidence (artifact lane05-final-audit-census.json, attached in session)

• C0 per-file ledger-ownership map: 20/21 wave paths publication-bundle-pinned (files{} or model{}), 0 builder-interactions-pinned; UI ts/mjs family class named (PB files{}; tsx live-match, two pre-existing-stale rows restored with waveBytesChanged=false).
• C1 builder-interactions: no wave path is BI-pinned; source-proofs, trace-controls, generated phases re-run offline exit 0 (logs retained); PR builder-formal CI job = ultimate proof.
• C2 exhaustive census: every pre-strip md5/sha256 value grepped repo-wide across all tracked files → hits confined to the 4 authorized files (each with disposition); out-of-scope hits: 0.
• C3 truthfulness: every re-pinned digest recomputed from actual post-strip bytes (git add && md5sum && sha256sum && git hash-object recorded per row); verifier can recompute all 25 rows.
• C4 amendment trail (fix(verification): re-pin 10 comment-sweep-broken digest entries in the publication-bundle ledger [ledger-digest-repair] #183 style): original values retained in lane05Repin blocks; historical prose never rewritten (sibling …Amendment annotations); JSON stays parse-valid (structured round-trip exact). Disclosures: recipe_execution_reader.go pin predates the PR base (corrected); two contentMD5 values traceable to no committed blob (replaced with true values); 46 out-of-scope stale rows + 21/29 no-digest rows inventoried for the deferred hygiene ticket, untouched.
• C5 TLC: 52/52 receipt-cited arms determinate and matching receipts — witness depths baseline 9 / f2 15 / f3 7 (FINDINGS:129 signatures), canonical baseline cfg violates InvariantNoDropUnderPointer per SKILL rule, controls complete at 14,608,028 distinct (documented widening figure); negative controls (each cfg vs foreign model): 0 false executions; per-run -metadir isolation + deadlines. 3 unreferenced .r27-tt-*-ctrl Horizon-8 dotfiles (zero receipt citations) not run to completion — Horizon-3 twins all clean. Canonical probe PASS: disk == git blob == canonicalProbe.expectedMD5 (36c66fb5…).
• C6 unresolvable ledger keys: checker class unresolvable-ledger-key (18) visible in census + {key, git-log --follow candidate} list in artifact for the deferred pubbundle ticket. Not gate-red, not skipped.

Validation

• Gate: scanned=2969 violations=0 unsupported=0 on combined head (post rebase onto 7e081f49); unchanged at bdc036c1 with 7 guard-quoted allows
• Checker fixtures 43/43 (incl. 7 GuardQuotedAnchors); full go test green on the three restored files' packages plus all nine drift-check-holding packages; citation_gate_test.go 8 fixtures; row96 + contracts node suites; go vet + test-compile on touched Go packages; node --check all touched mjs
• TLC matrix + builder-formal logs retained (/tmp/opencode/lane05-tlc, /tmp/opencode/lane05-formal); exhaustive negative-control matrix (605 cells, 0 wrongly-executed) at /tmp/opencode/lane05-tlc-negfull
• Infra rerun disclosure: Source proofs (4/4) failed once on a transient HTTP 429 fetching the pinned tla2tools.jar (4 shards bootstrap in parallel; zero diff relation) — failed job rerun, authorized by coordinator as infra

Risks / follow-ups

• 46 out-of-scope stale ledger rows + no-digest rows → deferred hygiene ticket (listed in artifact c6LedgerHygienePending).
• 3 unreferenced Horizon-8 dotfile cfgs: candidates for the same hygiene ticket (delete or widen budget), not receipt-cited.

AO session: loom-experiment-213.

[matthewpeterkort]

NEEDS CHANGES. Review of head 85ab5ac (35 files, +2226/-1276). Three required changes are filed inline. CI at head is not green: Tests / Python tests fails with 5 errors in the new checker suite, and the overall run 43443590349 was cancelled, so the Go unit and Actual Arango legs produced no head evidence and need a re-run. Source proofs (4/4) failed only at Bootstrap pinned formal tools with curl HTTP 429 from setup-formal-tools.mjs obtain(); shards 1-3 passed, so that reads as an upstream rate limit rather than a change in this PR, but it still needs a green re-run. What is solid: the citation gate is a real strengthening, replacing file-wide contains with line-exact equality plus adversarial cases, and I checked both citation tables against head. The cited files are not line-shifted by this wave, since bundle_store.go is a same-line edit, so the strict checks are consistent. Not verifiable from the review position: the 22 re-pinned md5/sha receipts. No hashing tool is permitted in this review sandbox and nothing under scripts/ reads canonicalProbe or expectedMD5, only the ledger plus prose in FINDINGS.md and SKILL.md, so the digests were not independently recomputed; FINDINGS.md itself already records 42 match / 3 drift across 45 hash-bearing pins. The three publication docs this PR edits keep stale .files pins that had already drifted at base 7e081f4, so that is pre-existing rather than introduced here. Optional, not blocking: checkCitationTableStrict passes vacuously if a citation table is ever emptied, so add a length floor in the house anti-vacuity style; and cleanupOwnedDatabases now leaves evidence.status untouched on transport failure while nothing consumes evidence.cleanupAudit, which is acceptable for an ephemeral CI service but silent for local runs, so consider surfacing leftovers in summary.json.

[matthewpeterkort]

APPROVED - no changes required. Re-review at head d6889e2 (base 492d3f0 after the origin/feature/postgres-backend merge 27f6d1c; 32 files, +2449/-1269). All 21 checks pass at head, including Tests / Python tests, Tests / Go unit tests, Tests / Actual Arango integration, Formal models and generated replays, and Source proofs 1/4 through 4/4, so the earlier red Python job, the cancelled run, and the Source proofs 4/4 curl 429 bootstrap failure at 85ab5ac are all resolved.

Prior threads, all closed. (1) TypeScript scanner resolution. Fixed on both axes. The production gate now fails closed: when detect_ts_family raises, every ts-family file is routed to the unsupported inventory, which the existing unsupported rule already makes gate-red, so ts files can never be silently passed; test_scanner_absence_routes_ts_family_to_unsupported_fail_closed proves that routing by monkeypatching the scanner to raise. Separately, python-unit now installs the ui dependencies and exports LOOM_TYPESCRIPT_DIR (tests.yaml 542-547), so the scanner-dependent assertions actually execute in CI rather than skipping everywhere, which was the anti-vacuity requirement. (2) D-16a attribution. The comment is restored byte-identical, and TestSQL16LawCells no longer satisfies itself: it now searches for the contiguous comment-line form, so the const literal alone cannot pass. The gate class is closed too, via GOVERNANCE_ATTRIBUTION plus a registered GOVERNANCE_DIRECTIVES entry, with forged-negative fixtures for missing D-id, missing dated ruling, and tokens split across lines. I confirmed the check is genuinely non-self-referential, because the searched concatenation does not occur contiguously in the test source. (3) Unresolvable ledger keys. I verified the deferral is legitimate rather than avoidance: the files key set is identical at base and head, 129 keys on both sides with identical names, so all 18 unresolvable keys including internal/backends/postgres/aliases.go, the relocated internal/*/arango paths, and the bracket-suffixed labels are pre-existing debt, not introduced by this wave. Deferring reconciliation to the hygiene ticket is a reasonable coordinator call.

Also checked in the new commits. The three guard-quoted anchor files are now byte-identical to base 492d3f0 and have dropped out of the PR diff entirely, so restoring them to pre-strip blobs did not revert any base work, which was the main regression risk in bdc036c. The guard-quoted corpus is fail closed: an OSError during corpus build yields an empty corpus and the empty corpus allows nothing, self-quoting is excluded, and there is a 25 character floor. The removed nolint govet directive is inert because vet.mjs runs go vet and no golangci-lint configuration exists in the tree, so nothing consumes nolint. Citation tables remain valid, since bundle_store.go is back to its base blob and therefore none of the cited lines shifted.

Not verifiable from the review position, unchanged from last round: the 22 re-pinned md5 and sha receipts. No hashing tool is permitted in this sandbox and nothing under scripts reads canonicalProbe or expectedMD5, so the digests were not independently recomputed; FINDINGS.md still records 42 match and 3 drift across 45 hash-bearing pins, and the three publication docs keep .files pins that had already drifted before this PR.

Optional, not blocking. The guard-quoted test is a substring match over the whole text of any tracked test-family file, so prose of 25 characters or more placed inside a string literal in any test file whitelists the same prose as a production comment; if the class proves load-bearing, consider requiring the match inside a parsed string literal or an explicit anchor-file allowlist. GOVERNANCE_ATTRIBUTION likewise accepts any line carrying a D-id token plus a dated ruling with a free-text tail, so a fabricated id and date could smuggle prose; pinning the set of known D-ids, or requiring the attributed line to be referenced by a law-cell assertion, would close that. guard_quoted depends on the corpus, so a single-file scan invocation cannot use the class at all; harmless for the all-tracked CI gate but surprising for ad-hoc runs. The unresolvable-ledger-key bucket has no count floor fixture, so growth there is silent; worth folding into the hygiene ticket. And if golangci-lint is ever adopted, nolint needs adding to GO_DIRECTIVE.