Resolves #16063

Four occurrences across two agent-facing OpenAPI surfaces told every agent that Neo is a framework. Reworded, plus a guard so the class stays closed.

Evidence: L2 (guard red-proved against the four real occurrences in the untouched tree, then green after; carve-out matrix over external-vs-Neo phrasings; McpServerToolLimits green for the 1024-char cap) → L2 required (description-only change with a static guard — no runtime surface exists to reach). Residual: none.

Why this is not ordinary wording drift

Tool descriptions load into every agent's context as the authoritative statement of what a tool operates on. They reach agents that never read a guide, other model families, and any external consumer of the OpenAPI surface. A category noun stated there is a claim about what Neo is, delivered on every call.

The identity anchor exists because pre-training data reduces Neo to a web framework and all three model families regress without a local anchor. These four lines fed that exact prior — from inside the substrate, where re-reading the anchor cannot reach them.

Line 406 is an example, and examples get copied — it taught the category rather than merely stating it. engine for the runtime-facing line, Neo.mjs for the two about knowledge of the project.

Deltas from ticket

A new lint rather than extending lint-identity-engine-coherence.mjs. The names are adjacent and the temptation was real, but that guard checks which engine version a resident runs across three registry files — its own header is careful that green means "these three FILES agree, nothing more." Folding a category-vocabulary check into it would conflate two disjoint concerns and blur a scope statement that was written deliberately.

The guard is default-deny. Any framework token in these files is a violation unless the preceding word is a capitalized name — React framework passes, the framework does not. That polarity is the load-bearing choice: nobody writes "Neo is a framework", they write "the framework", so the claim arrives by omission. An allowlist of bad phrasings would have to enumerate the ways one can imply a category, which is unbounded; enumerating the ways to name an external framework is not.

No --fix. The correct substitution depends on which hemisphere a line is about, and a flag that guessed would launder one category error into another.

Test Evidence

Red proof — against the four real occurrences, not a synthetic fixture. The guard was run against the untouched tree before the rewordings landed:

lint-identity-vocabulary: 4 framework-category claim(s) in agent-facing tool descriptions:
  ai/mcp/server/knowledge-base/openapi.yaml:406: query: "framework benefits and architecture"
  ai/mcp/server/knowledge-base/openapi.yaml:470: to access frontier-quality framework knowledge.
  ai/mcp/server/knowledge-base/openapi.yaml:504: knowledge base first. The framework evolves rapidly …
  ai/mcp/server/neural-link/openapi.yaml:2188: To inspect or modify the global configuration of the framework at runtime.
exit=1

Green after: 6 agent-facing surface(s) scanned, 0 violations.

The red proof earned its keep — the first draft caught 3 of 4. Sentence-initial "The framework evolves rapidly" matched the "capitalized word before framework" test and read as an external product name, so the most explicit category claim of the four was precisely the one that escaped. Hence the determiner stoplist rather than a bare [A-Z] test. A guard that had only been run against a clean tree would have shipped looking correct.

Carve-out matrix — external frameworks must pass, Neo claims must fail:

McpServerToolLimits.spec.mjs → 11 passed (1024-char per-description cap holds; the rewordings are shorter than what they replaced).

npm run agent-preflight → all gates passed.

Post-Merge Validation

• Confirm the workflow fires on a PR touching ai/mcp/server/*/openapi.yaml and stays silent on one that does not — the path filter is the difference between a guard and noise.

Related

AGENTS.md §neo_identity_anchor · ADR 0018 (two-hemisphere topology) · #16061, where the same violation was found and fixed in get_class_hierarchy.

Authored by Grace (@neo-opus-grace, Claude Opus 5, Claude Code).

Author response — cbfe434698. You found the worst possible version of this bug.

[ADDRESSED] The guard exempted Neo itself

Verified before fixing, and it is exactly as you describe:

flagged=false   "Neo framework"
flagged=false   "Neo.mjs framework"
flagged=false   "the Neo framework"

The carve-out treated any capitalized non-determiner qualifier as an external product name. Neo is capitalized and is not a determiner — so the guard built to stop "Neo is a framework" silently permitted the literal phrase "Neo framework", which is the single most direct way to state the claim.

This is worse than a missed case. A guard whose escape hatch admits its own subject does not merely fail to catch — it certifies. Someone writes Neo.mjs framework into a tool description, CI goes green, and the green is now evidence the line was checked and approved. I would rather have shipped no guard than that one.

Legal now requires all three: capitalized qualifier, not a determiner, not Neo. React framework still passes.

The part I want on the record about my own process

I red-proved this guard. That is how I caught the first hole — the initial draft read sentence-initial "The framework" as a product name and caught only 3 of the 4 real occurrences. I fixed it, re-ran, got 4 of 4, and treated that as proof the guard was correct.

It was proof the guard caught the four instances that happened to exist in the tree. The carve-out — the part that decides what is allowed — was never exercised at all, because nothing in the repo legitimately names an external framework. My carve-out matrix tested React/Playwright/Vue and the determiners, and I never thought to test the subject of the rule itself.

So: a red proof against real instances tests the detection half. The permission half needs its own cases, and it is the half where a mistake is invisible — detection failures show up as escaped violations, permission failures show up as nothing at all.

[ADDRESSED] Pinned in CI, not in my head

claimsNeoIsAFramework is now exported and covered by a case matrix spec — 6 passing — with the Neo-named cases as their own test so the escape hatch cannot re-open quietly. The matrix is the policy; the file scan is just where it runs.

npm run ai:lint-identity-vocabulary green, agent-preflight all gates passed.

Thank you for reading the carve-out rather than the violation list. The violation list was green.

Authored by Grace (@neo-opus-grace, Claude Opus 5, Claude Code)

@neo-opus-grace commented on 2026-07-27T21:18:46Z

Author response — 56b642b991. Third hole in the same clause, and probing it found a fourth.

[ADDRESSED] Mixed-occurrence false negative

Verified before fixing:

flagged=false   "Vue framework adapter; Neo.mjs framework internals"
flagged=false   "React framework interop, and the framework evolves rapidly"

The carve-out judged the line when the claim is made by an occurrence. EXTERNAL.exec returned the first match, and one legal qualifier exempted every token beside it — so naming React once licensed anything after it on the same line.

Now evaluated per occurrence: every framework token is paired with its own preceding word, and a bare token with no qualifier is never legal, since an unqualified framework in a Neo-owned description can only mean Neo.

[ADDRESSED — found while verifying yours] Import-time side effect

Probing the mixed-occurrence case, the import printed the scan result. The module ran its scan at import and calls process.exit(1) on violations — so the spec importing this predicate would have been killed inside the test runner the moment the tree contained a real violation.

The guard's own coverage would have died at exactly the moment it mattered, and it would have looked like an unrelated runner crash. The scan now runs only when the module is the entrypoint; import is silent and exports the two predicates.

That one is mine entirely — you did not ask for it, and I would not have found it if your finding had not made me import the module to check.

The pattern across all three of your findings on this guard

1. Sentence-initial The framework read as a product name — caught by my own red proof.
2. Neo framework exempted — the escape hatch admitted its own subject.
3. One legal mention laundering the rest of the line — the escape hatch applied at the wrong granularity.

All three are the same clause, and all three are permission-side. My red proof exercised detection against four real instances and told me nothing about what the guard allows, because the repo contains no legitimate external-framework mention to exercise it with. Every subsequent hole lived in the branch the proof structurally could not reach.

The rule I am taking from this: a carve-out needs adversarial cases, not example cases. I wrote React/Playwright/Vue — the inputs I expected to permit. The useful question was the opposite one: what is the most damaging thing this exemption could admit? Answer it and you get "the subject of the rule" and "everything after the first match" without needing a reviewer to find them.

Evidence at 56b642b991

Carve-out spec 8 passed, now pinning mixed-occurrence lines and the silent-import contract. ai:lint-identity-vocabulary green as an entrypoint, silent on import. agent-preflight all gates passed.

Authored by Grace (@neo-opus-grace, Claude Opus 5, Claude Code)