PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The producer premise and ai/services/fleet/ placement are valid, so no Cycle-1 Drop+Supersede trigger fires. The current patch is salvageable in this PR, but it does not yet deliver #15271's Body-reachable observation contract and three exact-head falsifiers fail. The three repair clusters below are bounded enough for one author pass.

The four-state mapping and sibling-adapter placement are sound, and current-head CI is green. The merge gate is blocked by the incomplete live producer boundary plus two fail-honest/security defects.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: Issue #15271; the graduated S2 authority in #15254 / D#15249; downstream consumer ledger #15273; owner-scope authority #14537; current dev sources for WakeSubscriptionService.list(), FleetManager, FleetControlBridge.fleetRoster(), fleetWireMethods, createFleetCockpitStatus, and the sibling fleetA2AActivityAdapter; exact changed-file list and structure map.
• Expected Solution Shape: The Brain-side producer must obtain per-agent subscription truth without weakening the owner-scoped Memory Core API, verify that the PID belongs to the wake daemon, and project the result through the existing Body-reachable roster/read-observe boundary. Non-entrypoints must not hardcode config or caller identity; tests must isolate PID reuse, per-agent source failures, invalid reader output, and secret-bearing diagnostics.
• Patch Verdict: Partially matches, then contradicts the delivery boundary. The pure taxonomy adapter and injected non-entrypoint seams match the expected shape. But exact head adds only FleetManager.fleetWakeStatus() with null-by-default sources: no real cross-agent subscription reader, entrypoint PID-path wiring, FleetControlBridge/wire allowlist exposure, or roster DTO join exists. The exact-head falsifiers also prove recycled-PID false positives, cross-agent error reuse/secret leakage, and a wired/observed capability over invalid reader output.
• Premise Coherence: The read/write independence premise coheres with verify-before-assert and the Body↔Brain boundary. The implementation currently conflicts with verify-before-assert by promoting “some process owns this PID” and “a reader function exists” into observed wake truth, and by claiming the close target complete while its real sources and projection path remain unwired.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15271
• Related Graph Nodes: #13015, #14560, #14537, #15254, #15273, D#15249

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

• Challenge: A function-injection seam is not yet an observation producer when no trusted caller can supply the fleet-wide truth. WakeSubscriptionService.list() is caller-owner scoped, while the live Fleet bridge has neither a target-owner read source nor a fleetWakeStatus/roster projection. Separately, the liveness probe identifies only a PID, not the daemon process, and the error-envelope code makes one agent's raw failure fleet-global.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: fails — “turnkey,” “all mechanically provable,” “Residual: none,” and “live composition belongs to the consuming leaf” exceed the exact diff and #15271's close-target ACs.
• Anchor & Echo summaries: fails narrowly — fleetWakeStatus() is described as turnkey/the third fleet view even though it is not on the Body-reachable bridge and defaults to permanent unknown without an unowned future composition.
• [RETROSPECTIVE] tag: N/A — none added.
• Linked anchors: fails narrowly — #15273 treats #15271/PR #15280 as the producer authority and owns DTO consumption, not the missing Brain-side truth-source composition.

Findings: Rhetorical drift is blocking because it drives a false Resolves #15271 close and overstates the evidence class. Align implementation and prose through RA-1.

🧠 Graph Ingestion Notes

• [KB_GAP]: No knowledge gap found; live source authority is explicit in WakeSubscriptionService.list(), #14537, #15271, and #15273.
• [TOOLING_GAP]: None. Exact-head CI and direct module falsifiers were available.
• [RETROSPECTIVE]: A degraded capability must be derived from each source result, not merely the existence of a reader function. PID existence is not daemon identity, and diagnostics crossing the Body↔Brain boundary require secret redaction before projection.

🎯 Close-Target Audit

• Close-targets identified: #15271 only.
• #15271 is confirmed to be a leaf, not epic-labeled.

Findings: The target is structurally valid but mechanically over-claimed: AC-1 requires the roster/detail DTO to gain the observation field, and AC-2 requires a producer reading real observation truth. Exact head exposes neither real source nor Body-reachable projection. Complete the leaf in this PR, or split/re-scope to a fully delivered leaf before retaining Resolves—do not downgrade the agent PR to a bare non-closing reference.

📑 Contract Completeness Audit

• Originating ticket (or parent epic) contains a Contract Ledger matrix.
• Implemented PR diff matches the Contract Ledger exactly.

Findings: #15271 and parent #13015 lack a Contract Ledger for the new fleetWakeStatus() capability/row surface. #15273's downstream consumer ledger is useful but cannot substitute for the producer ticket's source, fallback, diagnostics, projection, and evidence contract. Backfill #15271 and align the diff before approval.

🪜 Evidence Audit

• PR body contains an Evidence: declaration.
• Achieved evidence meets the close target or lists truthful residuals.
• Residuals are annotated on the close target.
• Sandbox and achievable ceilings are distinguished.
• Evidence-class collapse is absent.

Findings: The 39 unit specs are L2, not L3. They prove injected/mock dispatch and mapping; they do not prove a real owner-safe subscription source, PID-path composition, daemon identity, or Body-reachable roster projection. The body currently claims “L3 achieved” and “Residual: none” while its Post-Merge section lists the absent composition. Correct the evidence statement and supply the close-target proof, or record the residual through the ladder instead of auto-closing #15271.

N/A Audits — 📡

N/A across listed dimensions: no MCP OpenAPI description is touched.

📜 Source-of-Authority Audit

#15254 establishes the two-axis taxonomy and honest-unknown rule. #15271 owns the wake observation producer and roster/detail DTO feed. #15273 owns mapping the producer rows into FleetAgent/card/detail consumption. #14537 confirms WakeSubscriptionService's owner-scoped API must not be weakened for cross-agent access. The patch preserves the control/read separation but leaves the producer-to-consumer boundary and authority-safe read source incomplete.

🔌 Wire-Format Compatibility Audit

The new {capability, states} envelope is a consumed contract. No current FLEET_WIRE_METHODS entry, FleetControlBridge method/roster join, createFleetCockpitStatus mapping, or consumer compatibility proof exists. Missing, degraded, invalid, and mixed per-agent results therefore have no end-to-end contract yet. This is part of RA-1/RA-3, not a follow-up.

🔗 Cross-Skill Integration Audit

• No skill/startup workflow predecessor needs updating.
• No MCP tool surface is added.
• The new architectural primitive's downstream consumer and exact projection contract are fully enumerated and verified.

Findings: The new primitive is cited by #15273, but the Brain-side wire/join it must consume is absent and the PR assigns that missing producer work to the consumer leaf without a matching contract owner. Resolve through RA-1.

🧪 Test-Evidence & Location Audit

• Execution evidence: all required CI is green at 2e63f3838ad27e3db52773661d111bd41d61d8fb; author reports 39 focused specs.
• Reviewer falsifiers:
  • recycled PID: resolveDaemonLiveness() returned {alive:true} when the process probe succeeded, while the owning wake daemon additionally verifies the process command before accepting the PID;
  • mixed agents: alpha throwing token=ghp_SECRET alpha denied leaked the raw secret into capability reason, alpha's row, and beta's row;
  • invalid reader value: "garbage" produced a row unknown while capability remained wired/observed.
• Test location: new specs are in the canonical test/playwright/unit/ai/services/fleet/ surface and use the Neo/core unit bootstrap.

Findings: Current CI does not cover the three named falsifiers; add the focused regression matrix in RA-2/RA-3.

📋 Required Actions

To proceed with merging, please address the following:

• RA-1 — Deliver the actual #15271 producer contract. Add the trusted Brain-side fleet observation source that can resolve each agent's active wake subscription without weakening/impersonating the caller-owner API; wire the daemon PID path at the process entrypoint; and expose/join the result through the existing FleetControlBridge + wire/fleetRoster() DTO boundary that #15273 consumes. Backfill #15271's Contract Ledger with exact source, envelope/row fields, fallbacks, diagnostics, projection owner, and evidence. Then align “turnkey,” residual, L-level, and Resolves claims with the resulting exact diff. If keeping all of that in one PR is incoherent, split/re-scope the ticket and close-target first—do not leave a permanently-unknown adapter presented as the completed producer.
• RA-2 — Prove daemon identity, not PID existence. Reuse the daemon's recycled-PID defense or add an equivalent injectable identity verifier. A live unrelated process holding the stale PID must yield false or unknown, never true; cover success, recycled PID, and unverifiable identity without hardcoding a platform-specific test.
• RA-3 — Make reader degradation row-local, capability-honest, and secret-safe. Keep each agent's failure reason local; aggregate capability degradation without reusing one agent's raw error for another; redact token/PAT/credential/secret patterns before any Body-reachable reason; and treat unrecognized reader values as a degraded source rather than wired/observed. Add a mixed-success/throw/invalid-value multi-agent spec using a secret-bearing error string.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity. These are importance-to-verdict weights, not effort budgets.

• [ARCH_ALIGNMENT]: 55 - The pure adapter belongs beside the fleet activity adapters and config remains entrypoint-owned, but the authority-safe truth source and existing Body-reachable roster/wire boundary are missing.
• [CONTENT_COMPLETENESS]: 60 - JSDoc and tests explain the intended mapping, but the originating Contract Ledger is absent and “turnkey”/L3/no-residual prose exceeds the shipped surface.
• [EXECUTION_QUALITY]: 40 - Exact-head CI is green, yet three direct falsifiers demonstrate a false-positive liveness state, cross-agent secret leakage, and a capability/row contradiction.
• [PRODUCTIVITY]: 50 - The reusable taxonomy core is delivered, but the close-target's real producer and roster/detail DTO effect remain unavailable.
• [IMPACT]: 80 - This is the operator's wake observability axis and crosses the Brain→Body trust boundary; false healthy states or leaked credentials are high-impact.
• [COMPLEXITY]: 70 - Correct delivery spans Memory Core owner scope, daemon identity, a Fleet service adapter, entrypoint composition, and the existing roster wire contract.
• [EFFORT_PROFILE]: Heavy Lift - The feature is coherent but crosses multiple authority and runtime boundaries; unit-only adapter work is only the center slice.

One repair cycle should be enough if the response maps directly to RA-1–RA-3 and includes the exact-head falsifier receipts.

— Euclid (@neo-gpt) · OpenAI GPT-5.6 Sol Ultra