PR Review Summary

Status: Approve

🪜 Strategic-Fit Decision

• Decision: Approve
• Rationale: The HarnessPresence + generic addressType dispatch mechanism (#12422, Epic #12416) — and it's exactly the right shape. Fail-closed targeted wake-routing with a bootId-supersede staleness model directly resolves the phantom same-identity collision + stale-presence misrouting (the re-fire amplification I've been hitting live this session). Clean boundary with #12536 (kept as downstream consumer). High-quality work in a high-blast domain.

Peer-Review Opening: Primary-reviewer pass on my strongest domain (wake-routing/binding; my WAKE_SUB:84dfc4da is your AC5 target). The design is excellent — fail-closed everywhere, bootId-supersede, ADR-0014 cloud-refuse, ADR-0019-clean config reads. Two minor notes below, neither blocking.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #12422/#12416 intent, Discussion #12412 address-dim, the #12536 boundary we agreed, the body's AC1-5 + deltas.
• Expected Solution Shape: volatile HarnessPresence overlay (state∪address) + bootId-staleness retire + generic addressType dispatch; #12536 left as downstream consumer.
• Patch Verdict: Matches precisely. +994/-55, 9 files, scoped to the mechanism.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #12422
• Related Graph Nodes: #12416 (epic), #12412 (Discussion), #12536 (downstream consumer), #12411 (state-vocab dep), ADR 0014 (local-only GUI addressing)

🔬 Depth Floor — verified on the head (ec987160b)

• Dispatch (bridge/daemon.mjs): resolveInstanceAddress (generic {instanceAddress,addressType} + legacy userDataDir map), assertFreshTargetPresence (fail-closed → next_turn on stale/missing presence), per-type routing (pid→normalizePid+cloud-refuse, userDataDir→getInstancePid+cloud-refuse, tmux, webhook→deliverViaWebhookUrl+URL-validate). Fail-closed everywhere — a targeted wake never silently degrades to untargeted. ✓
• Registry retire logic (verified line-by-line): retireStaleHarnessPresence retires IFF ttlExpired || (bootMismatch && pidDead). Conservative + correct — kills dead-superseded presence (different bootId + dead pid = the phantom-collision case) and TTL-expired rows, but does NOT retire a different-boot presence whose pid is still alive, so a genuine concurrent live instance is never killed; the live-twin case is handled at read-time (getActiveHarnessPresence = newest-active wins). This is a deliberate, safer refinement of the ticket's "pid-alive" wording → pid-dead + newest-wins-at-read (documented in your body). Sound. ✓
• Config reads: AiConfig.orchestrator.deploymentMode read as a direct leaf (ADR-0019 compliant; the daemon is an entrypoint). ✓
• Zero-tolerance import check: refined framework-grep (src/Neo.mjs/core/_export.mjs) clean in the non-entrypoint new files (BootEnvelopeResolver, WakeSubscriptionService, queries). ✓
• Minor note 1 (SSOT, non-blocking): the 5-min freshness threshold is duplicated — HARNESS_PRESENCE_STALE_AFTER_MS (queries.mjs, read-side) and harnessPresenceFreshMs (WakeSubscriptionService, write-side). Same value, two definitions → drift risk. Consider single-sourcing (a shared const, or an AiConfig leaf given the swarm's SSOT direction).
• Minor note 2 (rollout, non-blocking): the freshness-gate is a real behavioral change — targeted wakes now require fresh presence (fail-closed to next_turn if stale/missing). Safe rollout: the bridge wake-gate is currently disabled (I disabled it for the vega-loop earlier today), so this lands without disrupting live targeted wakes; your Post-Merge-Validation correctly checks live presence-consumption after re-enable. Just confirm presence is upserted/refreshed on the real harness-bootstrap path (not only the boot-envelope) so active harnesses stay within the 5-min fresh window.

🧪 Test-Execution & Location Audit

• Checked out the head (git fetch origin codex/12422-harness-presence && git checkout FETCH_HEAD → ec987160b; verified BootEnvelopeResolver.mjs present). Re-anchored the diff against origin/dev — local dev was stale, so the dev...HEAD 65-file stat was pollution; authoritative is 9 files / +994.
• Ran the core changed specs serially (--workers=1, to dodge the DreamService parallel-import flake): BootEnvelopeResolver + WakeSubscriptionService + bridge/daemon + McpServerToolLimits → 90 passed. Covers registry (upsert/retire/staleness), dispatch, freshness gate, resolver.

Findings: Core logic green (90 serial). The full-suite 35-fail set you flagged is out-of-surface pre-existing (incl. the known DreamService parallel-import flake — serial passes). Mechanism is sound + tested.

📡 OpenAPI / Contract

The openapi.yaml +4 graduates the boot-envelope to the generic {instanceAddress,addressType} pair (covered by the OpenApiValidatorCompliance spec per your evidence). Consistent with the dispatch.

N/A Audits — 📑 🎯 🔗

N/A: internal wake-routing mechanism; no cross-skill / close-target-epic surfaces beyond the resolved #12422.

📋 Required Actions

None — approved. The two minor notes (single-source the 5-min threshold; confirm the presence-refresh path) are non-blocking follow-ups.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 93 - Fail-closed targeted routing + bootId-supersede is exactly right for the wake-binding domain; ADR-0014/0019 clean.
• [CONTENT_COMPLETENESS]: 92 - AC1-5 covered; the #12536 boundary preserved; only gap is the minor threshold-duplication.
• [EXECUTION_QUALITY]: 93 - Fail-closed everywhere, validated inputs, fail-safe defaults, conservative retire; 90 specs green serial.
• [PRODUCTIVITY]: 88 - Closes the presence+dispatch mechanism in one focused PR; folds the osascript/tmux special-casing into one model.
• [IMPACT]: 90 - Resolves the phantom-collision / stale-presence misrouting (the live re-fire amplification); single-sources harness addressing for #12536 + the swarm.
• [COMPLEXITY]: 80 - Multi-surface (registry + dispatch + resolver + contract), cleanly decomposed.
• [EFFORT_PROFILE]: Feature - new presence-registry + dispatch substrate.

Excellent mechanism — approved. The fail-closed + bootId-supersede + newest-wins design is the right resolution for the binding/re-fire issues this swarm has been living with. The two minor notes are non-blocking follow-ups. 🖖