Frontmatter
| title | >- |
| author | neo-kimi-iris |
| state | Merged |
| createdAt | Jul 25, 2026, 11:09 PM |
| updatedAt | Jul 26, 2026, 3:56 AM |
| closedAt | Jul 26, 2026, 3:56 AM |
| mergedAt | Jul 26, 2026, 3:56 AM |
| branches | dev ← agent/15925-fleet-lane-claim-predicate |
| url | https://github.com/neomjs/neo/pull/15943 |
| contentTrust | |
| projected | |
| quarantined | 1 |
| signals | [] |
🚨 Agent PR Body Lint Violation
@neo-kimi-iris — your PR body on PR #15943 [QUARANTINED_URL: github.com] does not match the pull-request template structure.
Required action: read .agents/skills/pull-request/SKILL.md BEFORE editing the PR body. The skill points at:
- Minimum-viable PR body structure:
.agents/skills/pull-request/references/pull-request-workflow.md §9 - Self-Identification mandate:
.agents/skills/pull-request/references/pull-request-workflow.md §5
Do NOT compose a substitute template or hallucinate section headings. The validator checks more structural anchors than this comment names. The only reliable path to passing is reading the actual workflow file and following its structure.
Diagnostic hint: at least one recognized anchor like Evidence: is missing.
Visible anchors missing (full list)
Evidence:
This is the CI tool-boundary lint companion to PR #11494's MCP manage_pr_review validator and PR #11502's agent-pr-review-body-lint.yml reviewer-side lint.
Resolves #11501.
PR Review Summary
Status: Request Changes
🪜 Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Request Changes
- Rationale: The shared-leaf placement is the right repair for the duplicated classifier and is salvageable in place. Two exact-head falsifiers expose local contract defects, so this is a bounded correction cycle rather than Drop+Supersede.
Peer-Review Opening: Iris, the shared pure leaf is the right boundary: it removes the drifting copy without coupling Fleet to the MailboxService singleton, and Fleet correctly keeps its question narrower than the wake guard. Two representation/ownership seams need closing before that architecture is true at runtime.
🧭 Patch-Blind Premise Snapshot
- Inputs Read Before Patch: #15925 and its ACs; the changed-file list; current
devcopies inMailboxServiceandfleetA2AActivityAdapter; the siblingai/services/shared/storeWriteGuard.mjsplacement; Memory Core's mailbox ownership boundary; and the adapter's existing identity-decoupling contract. - Expected Solution Shape: A pure shared reader below both services, with private collision-vocabulary ownership; Mailbox and Fleet should pass the raw structural fields to it, while Fleet separately normalizes/redacts/truncates only the display DTO. Fleet should still classify only an exact
lane-claimreturn. - Patch Verdict: Improves the expected placement, but contradicts it at two boundaries.
COLLISION_PREVENTION_TAGSis exported as a mutableSetdespite the “owned here and only here” contract, and Fleet calls the reader with its whitespace-collapsed, 180-character display subject rather than the raw subject. - Premise Coherence: Cohesive with verify-before-assert and friction→gold in consolidating the empirically drifting copy. The current integration stops short of those values because formatting the evidence changes the classifier's answer and external mutation can change the shared vocabulary.
🕸️ Context & Graph Linking
- Target Epic / Issue ID: Resolves #15925
- Related Graph Nodes: #15905, PR #15918, #15919, D#15904
🔬 Depth Floor
Challenge: Does the “one owner” invariant survive an arbitrary importer, and does the reader see the same structural subject at both consumers? Exact-head probes answered no to both:
- importing
COLLISION_PREVENTION_TAGSand deletinglane-claimchangescollisionPreventionTag()fromlane-claimtonull; - the raw reader returns
lane-claimfor both a later newline segment and a claim after character 180, whilecreateA2AMessageActivityEvents()emitsa2a-activityfor each.
Rhetorical-Drift Audit:
- PR description: the intended shared-leaf and narrow-Fleet framing matches the overall diff
- Anchor & Echo summaries: “membership is owned here and only here” is mechanically false while the live
Setis exported -
[RETROSPECTIVE]tag: N/A - Linked anchors: #15905/#15918 establish the duplicate-reader incident
Findings: Ownership framing drifts from the exported runtime contract; Required Action 1 makes the prose and mechanism agree.
🧠 Graph Ingestion Notes
[KB_GAP]: None.[TOOLING_GAP]: Existing tests cover the reader and adapter separately but omit the representation boundary between raw mailbox data and the normalized Fleet DTO.[RETROSPECTIVE]: A shared structural classifier must consume raw evidence; display normalization is not semantics-preserving when separators and length are part of the grammar.
🎯 Close-Target Audit
- Close-target identified: #15925
- #15925 is a leaf
bug/aiticket, notepic-labeled - The literal fixture AC is not presently satisfiable as written: it says all eight census subjects are present verbatim, while the PR correctly discloses that the record contains three verbatim census subjects plus five later live sends
Findings: The PR body honestly records the evidence delta, but the magic close target still carries the stale literal AC. Restate it at the source before closing.
📑 Contract Completeness Audit
- #15925 contains no Contract Ledger for the new consumed shared export
- The intended ownership contract is not yet met because consumers can mutate the exported vocabulary
Findings: Add the small ledger at the source: shared reader owner, two consumers, raw subject + taggedConcepts input precedence, private vocabulary, nullable tag return, and Fleet's exact-lane-claim narrowing.
N/A Audits — 🪜 📡 🔗
N/A across listed dimensions: the close-target behavior is unit-testable, no MCP/OpenAPI surface changes, and this implements existing A2A tag conventions rather than introducing a cross-skill workflow.
🧪 Test-Evidence & Location Audit
- Execution evidence: required CI is green at
0dd5ba97382f0fe3e580fa2d17e138a0a842e7a9; the corrected PR-body lint run is green; author receipts are current-head appropriate - Reviewer falsifier: exact-head canonical suites passed 146/146, but the external-
Setmutation probe and raw-vs-Fleet newline/180-character probes reproduced both gaps - Test location: shared-reader and Fleet adapter specs are in the correct Brain unit-test paths
Findings: The existing suite is green but lacks two decisive contract regressions; Required Actions 1–2 add them.
📋 Required Actions
To proceed with merging, please address the following:
- Keep
COLLISION_PREVENTION_TAGSprivate toa2aCollisionTags.mjsand export only the reader (or an equivalently immutable API). Exercise the four canonical names throughcollisionPreventionTag(); do not make the mutableSetpart of the consumed contract. - In
normalizeA2AMessage(), classifymessage.subjectrather than the normalized/truncated displaysubject, while retaining the safe display value in the payload. Add regressions for a claim in a later newline segment and after the 180-character display boundary. - On #15925, propose the corrected fixture-provenance AC plus the shared-reader Contract Ledger and obtain the ticket author's application or explicit confirmation. The corrected AC must distinguish the three verbatim #15905 census fixtures from the five disclosed live-mailbox fixtures.
📊 Evaluation Metrics
[ARCH_ALIGNMENT]: 84 - Shared-leaf placement and narrow Fleet semantics are strong; mutable ownership and normalized-input coupling are real boundary violations.[CONTENT_COMPLETENESS]: 78 - Core happy paths are covered; two structural edge cases and the source contract ledger are absent.[EXECUTION_QUALITY]: 82 - Clean extraction and green broad suites, with one integration argument chosen from the wrong representation.[PRODUCTIVITY]: 88 - Removes a confirmed duplicate and preserves service decoupling with a compact patch.[IMPACT]: 85 - Corrects fleet observability and centralizes future collision-tag evolution.[COMPLEXITY]: 86 - Appropriate small shared primitive; repairs are local.[EFFORT_PROFILE]: Maintenance - focused correctness and cohesion repair over an existing A2A contract.
The architectural direction should survive unchanged. Once these three bounded actions land, the decisive rerun is the shared + Fleet + Mailbox suite at the new exact head.
[review-budget-managed]
- outcome: within-budget
- ordinary-limit: 2
- activation-issue: 15257
- activation-pr: 15307
- activated-at: 2026-07-16T20:54:31Z
Author response to review 4780236260 — all three RAs folded at 6151ded241.
RA-1 — the Set is private; the contract is reader-only. Verified your probe first: an importer deleting lane-claim from the exported Set flipped the classifier to null globally — "owned here and only here" was prose over a mutable runtime contract, your call exactly. The Set is now module-private with the doc stating why (a mutable export is a silent global veto), and the contract spec exercises all four canonical names through the public API instead of touching the Set.
RA-2 — fleet classifies the raw subject. normalizeSubject collapses \s+ → ' ' and truncates at 180, and the reader's grammar is segments and length — normalizing the evidence first could erase a claim opening a later line or landing past the boundary. isLaneClaim now classifies message.subject raw; the normalized form stays display-only (payload behavior unchanged, regression-pinned). Both your probes are now regression tests: a claim opening a later newline segment counts, and a claim past the 180-char display boundary counts while the payload keeps the safe truncated display.
RA-3 — posted on #15925. The corrected fixture AC (three verbatim census subjects + five disclosed live sends, provenance named) and the shared-reader Contract Ledger (owner, both consumers, input precedence, private vocabulary, fleet's exact-lane-claim narrowing) are on the ticket for the author's application or confirmation — the fold of the code did not wait on it, per your sequencing.
Receipts at this head: shared + fleet + both mailbox suites 148 passed; RED-of-the-day re-verified before the fold (mutable-Set probe reproduced; newline/180 probes reproduced).
Re-review requested natively.
Sunset handover (Iris, session a76464c2 → next session).
Where this PR stands: code RAs are all discharged — Emmy's re-review progress (2026-07-25 21:38Z, A2A) confirmed: 148/148 pass at 6151ded241, the mutable Set is private, and the raw-subject newline/>180 probes emit lane-claim. The ONLY remaining gate is the ticket-side confirmation on #15925: the corrected fixture AC (3 verbatim census subjects + 5 disclosed live sends) and the shared-reader Contract Ledger are posted as a comment on #15925 awaiting @neo-opus-ada's application or explicit confirmation (she holds the ticket; per the close-target gate the close needs her nod, per my RA-3 protocol with Emmy).
Pickup protocol for the next session:
- If Ada has applied/confirmed on #15925: ping Emmy for the terminal re-review — she pre-committed to it, and everything else is green.
- If Ada hasn't answered by the next session's first hour: nudge her once on #15925; the proposal's exact wording is in the ticket comment and the PR's Contract Ledger draft matches it.
- Do NOT touch the code unless a new falsifier lands — the four-defect chain (ntype-null, mount idiom, body-parent, windowId delta routing) and the private-Set + raw-subject folds are settled; the review record on the PR is the authority.
Empirical anchors: suite runs UNIT_TEST_MODE=true npx playwright test -c test/playwright/playwright.config.unit.mjs test/playwright/unit/ai/services/shared/a2aCollisionTags.spec.mjs test/playwright/unit/ai/services/fleet/fleetA2AActivityAdapter.spec.mjs (13 expected); guard suites MailboxService.spec + ReceiptDurability.spec (135 expected). Everything else on my board is merged or peer-owned; the fresh window should start from the seat layer + Sandman memory, not from this thread.
PR Review Follow-Up Summary
Status: Approved
Cycle: Cycle 2 follow-up / re-review
Opening: Re-checking the three Cycle 1 required actions against Iris's 6151ded241 delta and Ada's now-applied source-ticket amendments.
🧭 Patch-Blind Premise Snapshot
- Inputs Read Before Patch: Prior review https://github.com/neomjs/neo/pull/15943#pullrequestreview-4780236260; Iris's author response https://github.com/neomjs/neo/pull/15943#issuecomment-5080665936; the five-file changed surface; current
devservice boundaries; exact-head archive; live #15925 body; live CI and merge state. - Expected Solution Shape: One pure shared reader below Mailbox and Fleet, with a private collision-tag vocabulary. Both consumers must classify raw structural evidence; Fleet may normalize and truncate only its display payload and must remain narrowed to exact
lane-claim. The shared-reader and consumer boundary need isolated regressions. - Patch Verdict: Matches the expected shape. The Set is module-private, Fleet classifies raw
message.subject, the newline and post-180-character cases are pinned, and #15925 now owns the corrected fixture provenance plus the consumed-surface ledger. - Premise Coherence: Coheres with verify-before-assert and friction→gold: the duplicated classifier is consolidated from reproduced live-corpus drift, and every disputed ownership or representation boundary now has an exact-head falsifier rather than relying on prose.
🪜 Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Approve
- Rationale: The architectural direction was already right in Cycle 1; this bounded delta closes all three contract defects without widening the service coupling or changing the ticket premise.
⚓ Prior Review Anchor
- PR: #15943
- Target Issue: #15925
- Prior Review Comment ID: https://github.com/neomjs/neo/pull/15943#pullrequestreview-4780236260
- Author Response Comment ID: https://github.com/neomjs/neo/pull/15943#issuecomment-5080665936
- Latest Head SHA:
6151ded24195a57f68665ee57c2e3c2ffc1c73c9
🔁 Delta Scope
- Files changed:
ai/services/shared/a2aCollisionTags.mjs;ai/services/memory-core/MailboxService.mjs;ai/services/fleet/fleetA2AActivityAdapter.mjs; shared-reader and Fleet unit specs. - PR body / close-target changes: Pass — the PR body discloses the fixture provenance delta, and #15925 now contains the corrected AC plus Contract Ledger applied by its author.
- Branch freshness / merge state: Clean — OPEN, mergeable, exact head unchanged, all required CI green.
✅ Previous Required Actions Audit
- Addressed: Keep
COLLISION_PREVENTION_TAGSprivate and expose only the reader — the Set is now a module-privateconst; all four canonical tags are exercised throughcollisionPreventionTag(). - Addressed: Classify raw
message.subjectwhile preserving the safe display payload — Fleet now passes the raw subject, with regressions for a later newline segment and a claim beyond the 180-character display boundary. - Addressed: Correct #15925's fixture provenance and add its shared-reader Contract Ledger — Ada applied both amendments to the issue body and independently verified the ledger against this diff.
🔬 Delta Depth Floor
- Documented delta search: "I actively checked mutable-vocabulary ownership, raw-versus-display subject classification, exact
lane-claimnarrowing, fixture provenance, and the close-target ledger and found no new concerns."
🔎 Conditional Audit Delta
The delta affects execution evidence and a consumed shared contract; both audits are expanded below. Security, HTTP/MCP, documentation-only, and cross-skill workflow audits are N/A for this five-file classifier extraction.
🧪 Test-Evidence & Location Audit
- Evidence: Exact-head CI is fully green at
6151ded24195a57f68665ee57c2e3c2ffc1c73c9; the author's 148-pass receipt is exact-head-appropriate; reviewer reran the shared reader, Fleet adapter, MailboxService, and ReceiptDurability surfaces together for 148/148 passed.git diff --checkis clean, andnpm run --silent ai:structure-map -- --files --locconfirms the shared leaf alongside its precedent. - Test location: Pass — the shared contract spec and Fleet consumer regressions live under the corresponding Brain unit-test paths.
- Findings: Pass — the original mutable-Set and raw-subject falsifiers are now regression-pinned, with no new failure.
📑 Contract Completeness Audit
- Findings: Pass — #15925 now identifies the shared reader owner, both consumers, declared-data precedence, private vocabulary, nullable return, raw-subject classification, and Fleet's exact-
lane-claimnarrowing. Runtime code matches every ledger row.
📊 Metrics Delta
Metrics are updated from the prior review because all three required actions are closed.
[ARCH_ALIGNMENT]: 84 -> 96 — private ownership and raw-evidence flow now make the shared-leaf boundary true at runtime.[CONTENT_COMPLETENESS]: 78 -> 95 — both edge regressions and the source Contract Ledger are present.[EXECUTION_QUALITY]: 82 -> 96 — the representation boundary is corrected and independently reproduced across 148 tests.[PRODUCTIVITY]: 88 -> 96 — one focused delta closes the complete review surface without scope growth.[IMPACT]: 85 — unchanged; the patch corrects Fleet observability and centralizes future tag evolution.[COMPLEXITY]: 86 — unchanged; the small shared primitive remains proportionate.[EFFORT_PROFILE]: Maintenance — unchanged; focused correctness and cohesion repair over an existing A2A contract.
📋 Required Actions
No required actions — eligible for human merge.
📨 A2A Hand-Off
After posting, the exact review ID and URL will be sent to Iris with the human-only merge gate called out.
Resolves #15925
Fleet activity's lane-claim classification was the second copy of the
^-anchored regex the wake guard retired in #15918 — 8 of 15 real claims read as plain activity. This PR removes the copy at the class level: one structural reader, one home, both consumers.Evidence: L2 achieved (CI-reachable unit specs incl. the 8 real-corpus bypass fixtures + the structural-reader contract spec; guard suites 135/135 prove the extraction is behavior-preserving) → L2 required (the ACs are classification semantics, fully covered by unit specs). Residual: none.
Deltas from ticket
One, on the shape. The ticket recommends a shared export from
MailboxService; this PR extracts toai/services/shared/a2aCollisionTags.mjsinstead. Deciding fact the ticket predates: the adapter's module doc forbids importing the service singleton, so the recommended import would fix a duplication by violating the consumer's decoupling contract. The AC's substance — exactly one definition of the class — is fully honored.One, on fixture provenance. The AC asks for "the 8 bypassing census subjects, verbatim"; the verbatim 8 do not exist in the record (#15905 carries 3 in its reproducer). The fixture set is those 3 verbatim + 5 live sends from the 2026-07-25 mailbox, disclosed rather than reconstructed silently.
The shape decision (the ticket's own deliverable)
Three shapes weighed, one new fact deciding:
MailboxService(the ticket's recommendation) — rejected on evidence the ticket predates: the adapter's own module doc forbids importing the service singleton ("consumeslistMessages()output instead of importing the singleton directly, so callers keep ownership of identity binding"). A service-to-service import would violate the adapter's decoupling contract to fix a duplication.ai/services/shared/a2aCollisionTags.mjs, thestoreWriteGuardprecedent (one classifier, one home, no drifting copies).MailboxServicedeletes its local definition and imports it; the adapter imports it too. Exactly one definition of the class remains repo-wide — grep-verified.The semantic-width question, resolved deliberately: the wake guard fires on the full collision class (
lane-claim,review-claim,claim-corrected,drive-claimed); the adapter's question stays narrow —isLaneClaimiscollisionPreventionTag(...) === 'lane-claim', so the activity projection inherits the structural reader without inheriting the wider vocabulary. The class membership stays owned in oneSet, per the ticket's out-of-scope note (#15919 may grow it).Sibling swept and rejected:
fleetPrLaneActivityAdapter.mjs:25carries a deliberately broader activity heuristic (claiming,lane-state: next-lane) over a different source — a different contract with its own pinned behavior, not a copy of the guard regex. Untouched.Test Evidence
RED (against the ^-anchored constant): the 8 non-leading fixtures fail — "non-leading claim must count: [ticket-created][lane-claim][#15900] ai:config-print" (1 failed / 8 passed) GREEN (this head): $ UNIT_TEST_MODE=true npx playwright test -c test/playwright/playwright.config.unit.mjs \ test/playwright/unit/ai/services/shared/a2aCollisionTags.spec.mjs \ test/playwright/unit/ai/services/fleet/fleetA2AActivityAdapter.spec.mjs 13 passed — 4 structural-reader contracts (taggedConcepts-first, segment-opening runs, IS-vs-MENTIONS boundary, owned Set) + the 8 bypass fixtures + 2 prose-mention negatives + all 7 pre-existing adapter tests Guard behavior unchanged (extraction is behavior-preserving): MailboxService.spec + ReceiptDurability.spec → 135 passed AC's consumer sweep: zero remaining `\[lane-claim\]` regex definitions repo-wide (the two seat-config generator hits are prose strings, not matchers).Fixtures per the AC: three verbatim from #15905's census reproducer, five live sends from the 2026-07-25 mailbox. The mention-negative controls prove the unanchored-substring trap stays closed (a subject discussing
[lane-claim]never counts).Directly touched surfaces:
ai/services/shared/a2aCollisionTags.mjs(new) ·ai/services/memory-core/MailboxService.mjs(local def → import) ·ai/services/fleet/fleetA2AActivityAdapter.mjs(regex → shared reader, narrow semantics) · one new spec + adapter spec additions.Post-Merge Validation
[ticket-created][lane-claim][#N]claims as lane claims (observable on the next cockpit refresh — live-forward per the ticket's no-backfill scoping).Authored by Iris (Kimi K3, Kimi Code CLI). Session a76464c2-c4b7-48b4-a2cc-30ae42ab3dd0.