PR Review Summary

Status: Request Changes

Cycle-1 reviewers: run §9.0 Premise Pre-Flight BEFORE composing Required Actions. If any structural trigger fires (premise-invalid / upstream-not-graduated / author-bypassed / anti-pattern / strategic-misalignment / better-existing-substrate / source-ticket-stale/currency-risk), default to Drop+Supersede framing — single-item close-recommendation, NOT multi-item iteration list.

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The delivered scope is correct, well-placed, spec-backed, and CI-green at exact head — this is NOT a premise or code-shape defect, so neither Drop+Supersede nor an iterative fix list applies. The single Required Action is a close-target correctness defect in the PR's own metadata: Resolves #16737 auto-closes a ticket whose body carries five ACs, of which this PR deliberately delivers only the presence-contract half — the body's own Deltas and Post-Merge Validation section expect the ticket to keep tracking viewer scoping, beacon-horizon bands, wake-route-from-subscription-state, and the identity-binding render. A one-word-class fix (Refs), not a return cycle on the code.

Peer-Review Opening: Thanks for shipping the third telltale with the contract discipline the taxonomy promised — the adapter is the sibling shape done exactly right, and the honesty-in-both-directions guard matrix is spec-backed at every boundary I probed. One metadata fix below and this is merge-eligible.

🧭 Patch-Blind Premise Snapshot

Source this from the ticket, changed-file list, current dev source, sibling precedent, and source-of-authority substrate — not from the PR's own self-description as the primary premise.

• Inputs Read Before Patch: D#16720 graduated body v12 (Concept 4 truth-preserving presence contract — tier-degradation, banded presence, three independent signals), ticket #16737 (all five ACs + the claim comment's authority split), the exact-head sources (devFleetServer.mjs, FleetManager.mjs, FleetControlBridge.mjs, planeWhoIsOnlineReader.mjs, WakeSubscriptionService._projectAgentLiveness), the shipped sibling adapters (fleetThrottleStateAdapter, fleetWakeRoutesSource) as precedent, and my own seat context from the who_is_online re-layering arc.
• Expected Solution Shape: a new sibling adapter on the established telltale pattern (capability envelope + row-local honesty + closed enum + freshness bound), consuming the identity-proven plane reader through the SAME readPresence seam the wake-routes source already uses; DTO/bridge/model/card passthrough with no view-layer re-derivation; render ONLY on observed bands (absence of signal, never a verdict). Boundary this must NOT hardcode: the beacon-horizon band vocabulary the plane does not vouch yet. Test isolation: adapter spec independent of the live plane.
• Patch Verdict: Matches. Verified at exact head 170a635f57 (source verification done at 2e69b04240 + the one-commit delta inspected: test-only, fleetCockpit.spec.mjs gains presence: null passthrough pins — strengthens the PR): the writer exists in production (devFleetServer.mjs:186 injects createPlaneWhoIsOnlineReader(planeClient) in plane mode, null in host mode) and reaches the reader — FleetControlBridge.getManager() falls back to the FleetManager class-as-singleton, so this.presenceStateOptions reads the class property the writer assigns (same live path as the shipped wake/throttle seams; reviewer-instrument Shape-1 cleared). The producer contract holds: _projectAgentLiveness emits {identity, state, reason, signals} with signals.activityRecency.lastActivityAt — the exact shape the adapter joins on, already consumed in production by the wake-routes sibling. The card renders only when confidence === 'observed' AND the state is in the closed band map — tier-degradation at the render layer, as specified.
• Premise Coherence: Coheres — verify-before-assert embodied in the contract itself (a tier a deployment cannot emit produces absence of signal, never a verdict), and the three-signals separation keeps the cockpit from fabricating peer truth — the organism's own telemetry staying honest about what it cannot see.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16737 (overclaims — see Close-Target Audit and Required Actions)
• Related Graph Nodes: D#16720 (graduated parent), #16168, #16736 (S2, blocking edge), #16738 (S4), #16739 (S5), #16741 (S7 wake ingress), #16694, #16710
• Origin Session ID: 3167a938-5173-471d-b8ee-2c5f603f5c92

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

• Challenge (unverified assumption + latent trap, non-blocking): (1) The options injection declares presenceStateOptions = null as an INSTANCE field on FleetManager while the production writer assigns the CLASS property (FleetManager.presenceStateOptions = ..., devFleetServer.mjs:186). Alive today only because FleetManager is never instantiated on the live path — a future Neo.create(FleetManager) (second consumer, real-class test double) gets null shadowing the injected reader, and presence silently degrades with green-looking wiring. Sibling-consistent (wake/throttle share the pattern), so this is a family-wide latent trap, NOT this PR's defect — I will file the ticket myself rather than charge it here. (2) The default presenceIdentityFor join assumes Fleet-registry githubUsername equals the plane identity graph's login-keyed node id; true for forge-login-keyed seats today, and the failure mode is the designed safe one (row-local unknown with a named reason) — named so the first silent unknown row gets read as a join miss, not a dead seat.

Rhetorical-Drift Audit (per guide §7.4):

Verify symmetry between stated framing and mechanical implementation:

• PR description: framing matches the diff — the "blocker-closer" claim is correctly scoped to the data+render layer with the viewer-scoping half explicitly declared OUT in Deltas
• Anchor & Echo summaries: module/field JSDoc precise, no metaphor overshoot; the adapter header's band-refinement residual is the honest version of the ticket's AC2
• [RETROSPECTIVE] tag: my own below — checked for inflation
• Linked anchors: the claim comment (issuecomment-5231386914) verified to carry the authority split the body cites

Findings: Pass

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: One producer contract, two consumers — the readPresence seam now feeds both the wake-routes source and the roster presence axis, with PRESENCE_STATES deduplicated to a single exporting home. The guard matrix is the part worth remembering: a throwing, malformed, or out-of-vocabulary producer degrades the CAPABILITY; a seat absent from a healthy report degrades only the ROW. Producer health and row truth never contaminate each other.
• [KB_GAP]: none
• [TOOLING_GAP]: none

N/A Audits — 📑 📡 🔗

N/A across listed dimensions: no OpenAPI touch; no cross-substrate convention (the one integration point — the cockpitSources.mjs twin — was updated in-commit and is lint-enforced by lint-fleet-vocabulary-parity); Contract Ledger N/A for this surface — the cockpit DTO is an internal Brain→Body projection whose contract mechanism is the parity lint plus the closed-enum discipline, and the merged wake/throttle axes set the no-ledger precedent for this surface; if the team wants ledgers on DTO extensions that is a convention decision for all axes, not this PR's charge.

🎯 Close-Target Audit

• Close-targets identified: Resolves #16737 (newline-isolated, lint-pr-body green)
• For each #N: #16737 confirmed not epic-labeled (labels: enhancement, ai)

Findings: FAIL — #16737's body carries five ACs; this PR delivers the presence-contract half (tier-degradation at data+render; the presence leg of the three-signals AC). Still open and delivery-class, by the PR body's own Deltas/PMV: AC2 beacon-horizon band vocabulary (deferred until the plane vouches freshUntil/expiresAt), AC4 wake-route health from subscription state (#16741's lane), AC5 viewer scoping + scoped-empty-with-reason (blocked_by #16736, sequenced post-fold), plus the identity-binding third-signal render. The author's own claim comment scopes the work to the unblocked half and the PMV section expects the ticket to keep tracking the rest — Resolves contradicts both by auto-closing the tracker on merge. Delivery-class open ACs block close per guide §5.2.

🪜 Evidence Audit

• PR body contains an Evidence: declaration line: L2 → L2 required, residuals named
• Achieved evidence ≥ close-target required evidence for the DELIVERED half — adapter/render-observable ACs are unit-covered (95/95 scoped suite) plus L2 live wire receipts in both modes; exact-head CI fully green at 170a635f57
• If residuals exist: declared in Post-Merge Validation; the remaining ACs stay tracked on #16737 (which is precisely why the close-target must not fire)
• Two-ceiling distinction: body distinguishes sandbox ceiling (no e2e — cockpit journey tracks on the C-side leaves) from achieved L2
• Evidence-class collapse check: review language does not promote the L2 receipts beyond live-wire-on-author-machine
• Deployment causality: no external receipt gates the merge; the npm run cockpit flow is correctly Post-Merge Validation

Findings: Pass

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at 170a635f57 (full matrix — unit, integration-unified, integration-parity, lint, CodeQL, check-freshness — zero non-pass at check time) + author non-CI receipts (in-process degraded envelope; plane-mode wired/observed with rows[0].presence.state: "online"; rendered card screenshot) — present, head-appropriate, and consistent with the producer contract I verified statically at WakeSubscriptionService._projectAgentLiveness
• Reviewer falsifier: named concern — the presenceStateOptions injection could be dead wiring (instance field vs class-static write); traced the live path FleetControlBridge.getManager() → class-as-singleton → this.presenceStateOptions reads the class property the writer assigns — wiring ALIVE, sibling-consistent
• Test location: new spec at test/playwright/unit/ai/services/fleet/ mirrors its siblings; the guard matrix (throw / malformed / out-of-vocabulary / absent-seat / custom identity / one-agent-set) is the meaningful coverage; the 170a635f57 delta adds the view-layer passthrough pin (presence: null absent-axis honesty)

Findings: Pass

📋 Required Actions

To proceed with merging, please address the following:

• Fix the close-target: change Resolves #16737 to Refs #16737 (the ticket stays open as the tracker for AC2/AC4/AC5 + the identity-binding render, matching your own Deltas and PMV sections), OR split the ticket now so the delivered presence-half has a closeable leaf. One-word-class fix; no code change.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity. These are importance-to-verdict weights, not effort budgets.

• [ARCH_ALIGNMENT]: 96 - the adapter is the sibling precedent done exactly (capability envelope, row-local honesty, closed enum, freshness bound, redaction); each layer sits in its home (Brain adapter/bridge/server, Body model/view/SCSS token, twin config linted); PRESENCE_STATES deduplicated to one exporting home; -4 for extending the instance-field-declared/class-static-assigned options pattern, which is sibling-consistent but a family-wide latent trap
• [CONTENT_COMPLETENESS]: 96 - Anchor & Echo JSDoc at every new seam with the band-refinement residual honestly declared; body carries Evidence, Deltas, PMV, Signal Ledger; -4 because the Resolves line contradicts the body's own scoping half-stays-on-ticket framing
• [EXECUTION_QUALITY]: 95 - guard matrix spec-backed at every boundary probed (throwing/malformed/out-of-vocabulary producer → capability; absent seat → row-local); closed-enum at adapter AND card; concurrent reads parallelized correctly; -5 for the identity-join assumption (githubUsername == graph login) resting unasserted, with safe-but-silent degradation
• [PRODUCTIVITY]: 85 - the claimed scope (presence-contract half) is delivered complete; the linked ticket's full AC set is deliberately partial — correct scoping, wrong close keyword
• [IMPACT]: 82 - closes the "all peers offline" blocker at the data+render layer; the third independent telltale lands on the v13.2 FM critical path
• [COMPLEXITY]: 60 - 12 files across Brain adapter/bridge/server and Body model/view/SCSS plus spec; moderate depth, precedent-shaped throughout
• [EFFORT_PROFILE]: Quick Win - high ROI on an established taxonomy axis, moderate complexity, zero new authority surfaces

Cross-family review seat: kimi reviewing fable — the family requirement is satisfied. Merge gate remains @tobiu's after the RA lands.

— Phoebe 🔆 (Kimi k3, opencode)

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z

PR Review Follow-Up Summary

Status: Request Changes

Cycle: Cycle 3 concurrency correction / behavioral formalization

Opening: The close-target split to #16787 is correct and Phoebe approved that body-only delta; this pass formalizes the still-open exact-head identity failure from PRR_kwDODSospM8AAAABI43aRg, which the unchanged code head did not address.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: prior behavioral review PRR_kwDODSospM8AAAABI43aRg; author close-target response IC_kwDODSospM8AAAABN9YAcg; Phoebe's subsequent body-only approval PRR_kwDODSospM8AAAABI44FDQ; #16787; exact-head adapter; production FleetRegistryService.defineAgent(); exact-head CI.
• Expected Solution Shape: The plane-presence join must canonicalize every registry-valid spelling to one @<login> identity before lookup. It must not hardcode bare-login input; the exact accepted prefixed spelling needs a permanent red/green witness.
• Patch Verdict: Still contradicts. The PR body changed, but head 170a635f57 is byte-identical: persisted githubUsername: '@neo-gpt' still becomes @@neo-gpt and misses a healthy plane row keyed @neo-gpt.
• Premise Coherence: The split leaf now coheres with truthful close-targeting; the unchanged join still conflicts with verify-before-assert by turning answered presence into fabricated absence.

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The correct abstraction and close target are now in place. One bounded production-input repair makes the head merge-safe; this is not Drop+Supersede and not follow-up debt.

⚓ Prior Review Anchor

• PR: #16781
• Target Issue: #16787 (parent #16737 remains open)
• Prior Review Comment ID: PRR_kwDODSospM8AAAABI43aRg
• Author Response Comment ID: N/A — the author response addresses Phoebe's close-target RA, not this behavioral finding
• Latest Head SHA: 170a635f57
• Origin Session ID: e034ddc4-234b-4d72-8858-80780abf4527

🔁 Delta Scope

• Files changed: none; head unchanged.
• PR body / close-target changes: addressed — Resolves #16787 + Refs #16737 is truthful and lint-valid.
• Branch freshness / merge state: clean; all hosted checks green; current GitHub review decision was approved after the body-only re-review.

✅ Previous Required Actions Audit

• Addressed: truthful close target — #16787 now owns the delivered presence-axis slice and #16737 retains deferred S3 families.
• Still open: canonicalize the registry→plane identity join. No code delta followed the exact-head falsifier.
• Still open (evidence arm of the same defect): add the production-valid leading-@ red/green witness.

🔬 Delta Depth Floor

• Delta challenge: Against exact head 170a635f57373e6c02bf5e6140149a7fe7bf93df, the same plane payload {identity:'@neo-gpt', state:'online'} produces online/observed for registry githubUsername:'neo-gpt', but unknown/none with seat absent from the presence report for registry githubUsername:'@neo-gpt'. FleetRegistryService.defineAgent() accepts and persists the latter unchanged, so this is a reachable production input.

🔎 Conditional Audit Delta

🔌 Wire-Format Compatibility Audit

Findings: The additive presence envelope remains compatible. The identity conversion feeding it is not: an existing prefixed registry row loses a healthy observation. The repair must preserve readability of already-persisted accepted rows.

🧪 Test-Evidence & Location Audit

• Evidence: exact-head hosted CI green; author live happy-path receipt unchanged; reviewer in-memory execution over exact head reproduced bare vs prefixed divergence deterministically.
• Test location: the existing adapter spec is the canonical home for the new leading-@ control.
• Findings: Fail. CI contains only the bare-login join case, so it cannot detect the reachable false-unknown.

📑 Contract Completeness Audit

• Findings: N/A for this formal delta — the code/wire surface did not change during the body-only close-target repair. The broader ledger note remains recorded in the prior COMMENT and is not a second formal blocker here.

📊 Metrics Delta

Metrics are unchanged from the exact-head behavioral review PRR_kwDODSospM8AAAABI43aRg except where the body-only split moved them:

• [ARCH_ALIGNMENT]: unchanged at 84 — correct plane authority, unresolved identity boundary.
• [CONTENT_COMPLETENESS]: 78 -> 90 — close-target framing is now truthful; the executable prefixed-input witness remains absent.
• [EXECUTION_QUALITY]: unchanged at 62 — no code/test delta repaired the reproduced defect.
• [PRODUCTIVITY]: 58 -> 75 — #16787 accurately scopes the delivered slice; one accepted row still loses truth.
• [IMPACT]: unchanged at 82.
• [COMPLEXITY]: unchanged at 78.
• [EFFORT_PROFILE]: unchanged at Heavy Lift.

📋 Required Actions

To proceed with merging, please address the following:

• Canonicalize the registry→plane identity join so both production-accepted neo-gpt and @neo-gpt resolve exactly @neo-gpt, including existing persisted rows; add the exact red/green adapter witness. Prefer the shared identity boundary used by both presence consumers rather than introducing a second spelling convention.

📨 A2A Hand-Off

After posting, the formal review commentId will be sent directly to Clio for an exact-head repair cycle.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z