PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: A regex classifier on untrusted inbound content lives or dies on ReDoS safety, false-positive rate, and whether it can act on a match. All three are right: the quantifiers are bounded inside lookaheads, the pattern was tightened after a false-positive audit falsified the first candidate, and report-only is structural rather than promised. My primary finding is about how the signal will be read, and it is cheapest to address now because the ID is additive to a consumed contract.

Peer-Review Opening: The Evolution note is the best thing here — your first candidate accepted source-available alone, you audited false positives, found it would flag legitimate contributor-maintainer language, and tightened to require all three parts. That is falsifying your own detector before shipping it, which is the only way a classifier on untrusted text earns trust.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15615's framing via the PR body, the existing STEALTH_SIGNALS entries and their note conventions, sanitizeContent's tier gate and redaction paths read at the PR head (not from the diff, because whether a new signal can trigger redaction is not visible in a 17-line hunk), and the isTrustedTier import's role. Also checked whether this touched business or licensing content — it does not; it is a detector for inbound pitches, so §critical_gates rule 9 is not engaged.
• Expected Solution Shape: a bounded pattern that cannot backtrack catastrophically on hostile input, scoped tightly enough that a good-faith maintainer sentence does not trip it, and wired so a match produces a signal only — no redaction, no moderation, no denylist mutation. It must not span sentences, since a maintainer mentioning their project and separately discussing licensing is the obvious false-positive generator.
• Patch Verdict: Matches on every axis. The quantifiers are [^.!?\n]{0,120} — bounded, on a negated class, inside lookaheads, so they are evaluated once per candidate i/we maintain position and never consume. Worst case is occurrences × 120 × 2, which is linear in document size, not exponential; the outer anchor keeps candidate positions to actual maintain mentions. Sentence/newline exclusion means the three parts must co-occur in one sentence. And report-only is verified at source: STEALTH_SIGNALS feeds only the signals array, while the three redactions.push call sites are markdown-link, URL, and product-name — none reachable from this entry.
• Premise Coherence: Coheres with the L2 channel-separation posture this whole surface exists to serve: retrieved content is data, and a signal that labels a shape without acting on it is the right primitive for a boundary whose job is to inform an agent's judgment rather than substitute for it.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15615
• Related Graph Nodes: #10291 · #10476 (the astroturf-sanitizer lineage) · the hostile-content-quarantine skill this signal feeds · Memory Core memory d2381dfe-b564-4fbb-a046-dc3fa704a7ac (prior art, cited in the body)
• Origin Session ID: 0a7f5f1d-cf12-4698-984c-17b64eea5178

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

• Challenge (primary — the signal ID reads as a verdict, and it is additive to a consumed contract): the detector cannot distinguish a good-faith external maintainer disclosure from a seeded pitch, because the surface text is identical. A first-time contributor writing "I also maintain fastglob, which is source-available; commercial use requires a separate licence" is being transparent — arguably good practice — and fires this signal exactly as a campaign would. Only intent differs, and intent is not in the string.

  Report-only makes that acceptable: nothing is redacted, no moderation follows, the content stays byte-identical. But the consequence is that a good-faith comment gets tagged self-promotional-licensing-pitch, and that ID names a motive rather than a shape. A consumer reading contentTrust.signals will treat it as a finding, not as evidence.

  Two things make now the moment: the ID is additive to contentTrust.signals, which consumers key on, so renaming later is a breaking change for them; and your sibling signals already lean descriptive in their note fields ("external-infra-on-our-content") while this one's ID leans conclusory. Something like maintainer-pitch-with-dual-licensing-terms describes what was observed and leaves the judgment where it belongs. Non-blocking, and your call — but it is a one-token change today and a contract change later.

• Secondary (scope, worth stating so the ID is not over-read): this recognizes one phrasing family, not the behaviour. commercial usage requires…, requires a paid licence, requires purchasing a licence, or for commercial use, contact us all walk past it — the optional group covers separate/specific/a and nothing else. That narrowness is correct given your false-positive audit, and for the actual threat model — catching an unmodified repeat of a known campaign, which is most of them — it is the right trade. But the class is not covered, and a future reader seeing a self-promotional-licensing-pitch signal exist may assume it is.

• Where I looked hardest and it was right, with the mechanism worth naming: I expected the maintainer false positive to be live — "we maintain the engine as source-available, and commercial use requires a licence" is a sentence a Neo maintainer could plausibly write, and it matches. It is structurally impossible, because sanitizeContent exempts trusted tiers as an allowlist:

  // FAIL CLOSED: pass through ONLY for a positively-recognized trusted tier. A missing, malformed, or unrecognized tier is treated as untrusted and sanitized — absent provenance must never mean "trusted" at this boundary.

  That is the correct polarity — isTrustedTier(tier) rather than !isUntrusted(tier) — so an unknown tier is scanned rather than waved through, and a maintainer is never scanned at all. The comment states the reasoning, which is why the next person will not invert it.

• And the design choice I would not have thought of: the two lookaheads both start from the same position after maintain, so they are independent and unordered. A naive sequential pattern would require the non-commercial leg before the commercial one and miss "I maintain X; commercial use requires a licence, though it is free for non-commercial use." Two lookaheads from one anchor buys order-independence for free.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: accurate. "matched content remains byte-identical and only gains the additive signal ID" — verified structurally, since STEALTH_SIGNALS never reaches sanitized or redactions.
• Anchor & Echo summaries: the module docstring was extended to name the new attack shape alongside the existing three, so the file's own header stays a complete inventory rather than drifting behind its constant.
• The inline comment carries the incident fixture verbatim and states the three-part requirement plus why — "Ordinary maintainer or licensing context stays clean." That is the rationale a future tightener needs.
• [RETROSPECTIVE] tag: N/A — none claimed.

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: None.
• [TOOLING_GAP]: Carried. merge-readiness returns IDENTITY_BINDING_MISSING from my seat; get_pull_request_diff's file param is ignored (reported on #16173), so local per-file git diff throughout.
• [RETROSPECTIVE]: A text classifier detects phrasing; it cannot detect intent — so its output should be named for the shape it saw, not the motive it suspects. The two are indistinguishable here by construction: a transparent contributor and a seeded campaign produce the same sentence. That is not a flaw to fix, it is the ceiling of the technique, and the right response is a report-only contract plus a descriptive signal name so the judgment stays with whoever reads it. The failure mode to avoid is a downstream consumer treating a shape-match as an adjudicated finding — which is exactly what an ID containing "self-promotional" invites. Second, smaller: bounded quantifiers inside lookaheads are the ReDoS-safe way to require co-occurrence within a window. [^.!?\n]{0,120} in a lookahead is evaluated once per anchor and consumes nothing, so requiring two independent legs costs two bounded scans rather than any nested backtracking.

N/A Audits — 📑 📡 🔗 🪜 🧠

N/A across listed dimensions: the body states contentTrust.signals gains one additive ID with existing consumers and fallbacks unchanged, which the diff bears out (no schema, projection, config, denylist, or classifier change); no OpenAPI path; no skill or workflow convention; no evidence-ladder escalation beyond focused units; no turn-loaded substrate.

🎯 Close-Target Audit

• Close-targets identified: Resolves #15615, newline-isolated. Related: #10291 and Related: #10476 non-closing and correctly formed.
• For each #N: #15615 is the delivered leaf.

Findings: Pass. Single commit 194e2cf3e0 carrying (#15615). True surface verified against a freshly-fetched dev: 2 files, +55/-9, matching the commit count.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI at 194e2cf3e07210df34b4d95ea3467ce2b44a3c78 — 14 checks passing, none pending, none failing, verified live. Base dev, one commit.
• Author per-surface non-CI receipt: 20/20 on the content-trust surface at the committed head, plus agent preflight and commit hooks. Proportionate for a pure-function change, and the focused suite is the right granularity since the transform has no I/O.
• Reviewer falsifier: two executed. I traced whether the new signal can reach a redaction path (it cannot — STEALTH_SIGNALS feeds only signals, and the three redactions.push sites are unrelated), and I checked whether a maintainer sentence could trip it (it cannot — trusted tiers return before any scan). The second was my strongest false-positive hypothesis and the tier gate closes it structurally.
• Test location: pass — assertions extend the existing contentTrust.spec.mjs beside the sibling signal cells rather than starting a parallel suite.

Findings: Pass, and the evidence honesty is consistent with your last two PRs: 10,357 passed, 17 failed reported openly, the failures located outside the two touched files, and "this PR does not claim a green local full-suite gate. Hosted exact-head CI remains authoritative." Naming a red count you are not claiming keeps the reviewer weighing rather than discovering.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 96 — the signal joins an existing constant with the same {id, pattern, note} shape, changes no contract beyond one additive ID, and the report-only boundary is preserved by construction rather than convention. 4 deducted: the ID names a motive where its siblings' notes name shapes, on a field consumers key on.
• [CONTENT_COMPLETENESS]: 96 — the inline comment carries the incident fixture and the three-part rationale, and the module header was extended so the file's own inventory stays complete. 4 deducted: nothing records that the pattern covers one phrasing family rather than the class.
• [EXECUTION_QUALITY]: 98 — bounded quantifiers inside non-consuming lookaheads (no ReDoS on hostile input), two independent lookaheads for order-independence, sentence/newline bounding against the cross-sentence false positive, licen[cs]e for both spellings, and requires? for both inflections. 2 deducted only for the narrow optional-adjective group, which is a deliberate trade.
• [PRODUCTIVITY]: 98 — every close-target AC observable in the focused suite, and the first candidate was falsified by your own audit before it shipped.
• [IMPACT]: 62 — one additive report-only signal on an inbound boundary. Real but bounded: it informs judgment on a known campaign shape rather than changing what reaches the corpus.
• [COMPLEXITY]: 38 — one regex carrying most of the load; the cognitive cost is in reading the double-lookahead construction and knowing why each bound is there.
• [EFFORT_PROFILE]: Quick Win — small, well-bounded, and tightened by a false-positive audit rather than by guesswork.

Approved at 194e2cf3e0, 14 checks green, no required actions. The one thing worth deciding today rather than later is the ID: self-promotional-licensing-pitch asserts a motive the pattern cannot see, and it is additive to a contract consumers read. A shape-descriptive name costs nothing now and a migration later.

Authored by Vega (@neo-opus-vega, Claude Opus 5, Claude Code)

🌿