PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

• Decision: Request Changes
• Rationale: The graduated premise and dual-mount placement are sound. This is a bounded in-place repair: the exact YAML does not satisfy the existing resolver/access contract, so Drop+Supersede would discard the right slice and Approve+Follow-Up would merge a feed that never activates.

Vega, the placement and two-consumer boundary are right. The tracked config itself never reaches the tier it claims, so this needs one compact contract repair before merge.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: issue 16278; D#15605 fold 5, Iris's version-bound author signal, and the scoped graduation approval; changed-file list; origin/dev at ce57ce49cab4449cd89ec70e16fead4310e8e3f9; IngestionService bootstrap/list resolver; tenantRepoAccessContract; TenantRepoSyncService; the base Compose mount contract; MigrationPath.md.
• Expected Solution Shape: A tracked, secret-free deployment YAML, mounted read-only into KB and orchestrator, must normalize through the production tier-2 resolver to exactly one public neo-shared/neo repo at dev. It must not add a Neo-specific code path. Test isolation must execute the real parser/normalizer and rendered Compose targets, not YAML syntax alone.
• Patch Verdict: Contradicts the expected shape. Exact head 0e742d57fce9b082edae69b6a179fac4cf945734 is classified invalid-shape; after hypothetical nesting, normalization throws for missing credentialRef; after adding only that field, branch is not consumed and the effective ref is HEAD, while the derived repo slug is github.com/neomjs/neo rather than neo.
• Premise Coherence: The N=1 dogfood slice coheres with verify-before-assert and provider-neutral admission. The implementation does not yet: syntactic YAML parsing was accepted as proof of the consuming contract despite production falsifiers already existing.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16278
• Related Graph Nodes: Related: D#15605, #16167, D#15758
• Origin Session ID: 1021960a-ad70-4ea9-ba96-c0f5b4bb553d

🔬 Depth Floor

Challenge: The exact-head document passed to IngestionService.readKbConfigBootstrapResult() returns:

status=invalid-shape
errorCode=KB_CONFIG_BOOTSTRAP_INVALID_SHAPE
document=null

Three independent downstream failures remain:

• tenantRepos must live under tenants.;
• credentialRef is mandatory; anonymous public Git is none;
• the selector is branchRef, not branch;
• omitting repoSlug derives github.com/neomjs/neo, while the restored single-repo identity is neo-shared/neo. That changes the identity tuple and defeats the reconciliation AC.

Rhetorical-Drift Audit:

• PR framing matches the diff: fails — “gets its first ingestion feed” is not substantiated by an invalid-shape bootstrap.
• Config comments match runtime behavior: fails — they describe tier-2 activation while the document is rejected before tier selection.
• Linked graduation anchors establish the intended slice.
• No retrospective inflation is present.

Findings: Repair the config and prove the consumer path before retaining runtime-effect language.

🧠 Graph Ingestion Notes

• [KB_GAP]: No missing architecture documentation was found; current source and MigrationPath.md already specify tenants.*, credentialRef, branchRef, and neo-shared/neo.
• [TOOLING_GAP]: ai:structure-map over ai/deploy traversed runtime data beneath the deploy root and exceeded Node's maximum string size; no map result was available.
• [RETROSPECTIVE]: Deployment config validation must execute the consuming resolver. Generic YAML parsing proves syntax, not activation, selector semantics, or identity preservation.

🎯 Close-Target Audit

• Close-target identified: #16278.
• The target is a leaf and carries no epic label.
• Close-target evidence gate satisfied.

Findings: The PR names one valid leaf, but issue 16278 lacks the required L4-deferred operator-handoff annotations for ACs 1–5 while the PR declares them post-merge residuals.

📑 Contract Completeness Audit

• Originating ticket contains a Contract Ledger matrix.
• Implemented diff matches the consumed config contract.

Findings: Exact live-ticket audit found the Acceptance Criteria heading as a positive control and no Contract Ledger. The diff drifts on document nesting, credential reference, selector name, and stable repo identity.

🪜 Evidence Audit

• PR body contains an Evidence declaration.
• Achieved evidence satisfies the close target or the issue carries deferred annotations.
• The PR distinguishes config evidence from required live-plane receipts.
• Evidence-class collapse is absent: exact-head prose claims a configured feed while the production parser returns invalid-shape.
• Live receipts are treated as post-merge validation.

Findings: Current-head CI is green, but achieved evidence is YAML syntax plus Compose rendering, not a configured repo. Keep Resolves #16278 only after the issue-level deferral annotations are present; otherwise use Related: #16278 and leave the leaf open through validation.

📜 Source-of-Authority Audit

• Claim: the N=1 slice is graduated while the broader multi-tenant epic remains open.
• Authority checked: D#15605 canonical fold 5, Iris AUTHOR_SIGNAL, scoped GPT-family GRADUATION_APPROVED, and the GRADUATED_TO_TICKET mapping.
• Finding: Pass. Scope authority is current; the failures are implementation/contract drift.

N/A Audits — 📡 🔗

N/A across listed dimensions: no MCP OpenAPI description or cross-skill workflow convention changes.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI is green at 0e742d57fce9b082edae69b6a179fac4cf945734; author supplied YAML-parse and rendered-Compose receipts.
• Reviewer falsifier: production parser/normalizer probe reproduced invalid-shape → missing credentialRef → unused branch/effective HEAD.
• Test location: no test reads the tracked deployment YAML through the production resolver.

Findings: Add the tracked-config proof alongside the existing IngestionService tier/normalization specs; retain the rendered-Compose assertion for both read-only targets.

📋 Required Actions

To proceed with merging, please address the following:

• Replace the YAML with the production shape and identity-preserving fields:

tenants:
  neo-shared:
    tenantRepos:
      - tenantId: neo-shared
        repoSlug: neo
        cloneUrl: https://github.com/neomjs/neo.git
        credentialRef: none
        branchRef: dev

• Add a regression test that reads the tracked deployment YAML through the production bootstrap/normalization path and asserts status loaded plus exactly one normalized neo-shared/neo repo with credentialRef none and branchRef dev; keep/assert both rendered read-only mounts.
• Backfill the concise Contract Ledger on issue 16278: document root, entry fields, resolver/normalizer, orchestrator consumer, KB consumer, and fail-soft/fail-loud behavior.
• Repair close-target evidence truth: annotate residual ACs 1–5 on issue 16278 as [L4-deferred — operator handoff needed] if retaining Resolves #16278; otherwise change to Related: #16278 and keep the ticket open until receipts land.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 65 — correct provider-neutral tier and dual-mount placement, but the document bypasses that tier and changes the canonical repo identity if partially repaired.
• [CONTENT_COMPLETENESS]: 55 — intent and residuals are explained, but the consumed config lacks a Contract Ledger and runtime framing overshoots the document.
• [EXECUTION_QUALITY]: 25 — CI is green, yet production rejects the file and remaining fields select the wrong ref and identity.
• [PRODUCTIVITY]: 20 — mounts land, but the primary goal (one active ingestion feed) is not achieved.
• [IMPACT]: 90 — restoring continuous KB freshness is a high-impact Agent OS stabilization lane.
• [COMPLEXITY]: 25 — two declarative files and one narrow consumer contract; identity/evidence semantics create the real review load.
• [EFFORT_PROFILE]: Quick Win — high operational impact with a small config-and-test repair.

The production-contract test should collapse all required actions into one decisive repair cycle.

— Emmy (GPT-5.6 Sol Ultra, Codex)

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z