PR Review Summary

Status: Approve+Follow-Up

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve+Follow-Up
• Rationale: The delivered contract is right and the parity gate is materially stronger than what it replaced — it went from a name census to differential execution of every new helper across both realms, including negative cases and a trust-leak probe. The one finding is about the gate's completeness, not this diff's correctness: all five pairs added here are correctly bound, and the gap only bites the next pair. Blocking a correct 34-file wire contract on a guard-hardening that touches one file would be disproportionate, and I do not want to hold merge on it — but it is a real, demonstrated hole and I would rather record it here with a reproduction than let it read as covered.

Peer-Review Opening: Emmy — this is the strongest parity work I have reviewed. Extending compareFleetVocabulary from constant deep-equality to executing every new helper over a shared input table, with 'invented-state', versions: '1', version-0 and an ownerPrincipal: 'must-never-cross' probe in the table, is differential testing rather than a checklist. One finding below, demonstrated by mutation rather than argued.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16743 including its 2026-08-09 live-dependency correction; origin/dev state of both fleetWireMethods.mjs realms and lint-fleet-vocabulary-parity.mjs; the changed-file shape (34 files, the two vocabulary files carrying 645 of the additions); D#16720 Concept 6 framing. Not the PR body as premise.
• Expected Solution Shape: One dependency-free authority plus an operable-cold twin that imports nothing from the server realm, with a mechanical gate that makes the duplication safe. The gate must not hardcode which members it compares in a way that lets a new member ship uncompared, and the twin must stay import-free rather than merely happen to be.
• Patch Verdict: Improves on the expected shape for what it covers, with one gap. The twin remains import-free (0 imports), and the gate now proves behavioral equivalence rather than name equality — better than I expected. The gap: the comparison tables are hand-written arrays with no completeness check, while the module docblock claims "every constant is deep-equaled and every shared pure helper is executed over."
• Premise Coherence: Coheres with verify-before-assert — the gate executes both realms rather than asserting they agree. The finding is precisely where that value is claimed in prose but not mechanized.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16743
• Related Graph Nodes: #13015, #16747, D#16720 Concept 6, #16746 (C5, retires the harness half after this)
• Origin Session ID: 64844d03-6d7e-429c-acd7-428cce239367

🔬 Depth Floor

Challenge: The parity gate cannot detect a new vocabulary pair that diverges. compareFleetVocabulary compares a hand-written list of constants and a hand-written list of helpers; nothing asserts that list covers the modules' exports. Demonstrated at 42fc7a769e:

baseline                                        → OK, exit 0
+ export const FLEET_WIRE_PARITY_PROBE = {realm: 'authority'}      (authority)
+ export const FLEET_WIRE_PARITY_PROBE = {realm: 'TWIN-DIVERGED'}  (twin)
                                                → OK, exit 0

A wire constant whose two realms disagree ships green. Worktree restored, nothing left behind.

Bound, stated so this is not over-read: this does not affect the five pairs this PR adds — you added all five to the table correctly, and I verified the behavioral rows execute. The exposure is the next one, and this PR is itself the evidence that adding pairs is routine work on this surface. It matters more here than it would elsewhere because the ticket names the parity gate as "the publication mechanism" binding the realms: the gate is load-bearing for the whole zero-trust argument.

The docblock's "every constant is deep-equaled and every shared pure helper is executed over" is the part I would change regardless of whether the guard lands — as written it describes a mechanism that does not exist, and a future reader will trust it.

Rhetorical-Drift Audit:

• PR description: framing matches the diff; the packaged-shell ownership-mismatch delta is described accurately and not inflated
• Anchor & Echo: the lint-fleet-vocabulary-parity.mjs docblock overshoots — it claims exhaustive coverage the implementation does not provide (Required Action below)
• [RETROSPECTIVE]: none claimed
• Linked anchors: the #16710 / PR #16728 correction in the ticket is accurate — I authored that PR, and the barrel indeed exports no Fleet vocabulary

Findings: One drift flagged, carried into Required Actions.

🧠 Graph Ingestion Notes

• [KB_GAP]: The reusable distinction this surfaces — a gate can be behaviorally thorough (executing helpers over negative cases) and still be structurally incomplete (unable to see a member nobody listed). Depth of comparison and coverage of comparison are independent axes, and passing one reads like passing both.
• [TOOLING_GAP]: None; the lint runs standalone and its output is legible.
• [RETROSPECTIVE]: The ownerPrincipal: 'must-never-cross' row is the detail I would most like copied elsewhere — encoding a trust-leak probe as a parity case means the boundary is tested by the same mechanism that tests the vocabulary, instead of relying on a reviewer to remember it.

🎯 Close-Target Audit

• Close-targets identified: #16743
• Confirmed not epic-labeled — #16743 is enhancement, ai

Findings: Pass.

🔌 Wire-Format Compatibility Audit

(Triggered: the PR introduces a versioned wire envelope, response states, and capability negotiation.)

• Version negotiation is explicit — selectFleetWireContract is executed in the parity table against version-0, unsupported-version and malformed (versions: '1') inputs
• Finite response states — FLEET_WIRE_RESPONSE_STATES is deep-equaled across realms, and 'invented-state' is a negative parity case
• Envelope validation — inspectFleetWireResponse is executed over stamped, mismatched-version, extra-capability and leaked-field envelopes
• Trust direction — the twin carries 0 imports; no server primitive crosses into the client realm
• Forward compatibility of the gate itself — a new envelope field or vocabulary member added later is not compared (the Depth-Floor finding)

Findings: The wire format itself is sound; the gate protecting it has the completeness gap.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head CI green at 42fc7a769e (18/18 pass, verified live), MERGEABLE/CLEAN; author's 194-test receipt is consistent with the hosted matrix
• Reviewer falsifier: concern — "the parity gate cannot see a member nobody listed"; command — appended a divergent FLEET_WIRE_PARITY_PROBE export to both realms at 42fc7a769e and ran node ai/scripts/lint/lint-fleet-vocabulary-parity.mjs; result — OK / exit 0, concern CONFIRMED
• Test location: pass — specs sit beside their subjects in test/playwright/unit/ai/services/fleet/, .../apps/agentos/, .../harness/

Findings: Pass, with the falsifier result carried into Required Actions.

📋 Required Actions

Neither blocks merge; I am approving. Both are small and I would rather they land as a follow-up than delay a correct contract.

• Correct the docblock now. lint-fleet-vocabulary-parity.mjs line 8 claims "every constant is deep-equaled and every shared pure helper is executed over". Until a completeness check exists, that sentence describes a mechanism the file does not have, and it is exactly the sentence a future author will rely on when adding the sixth pair.
• Follow-up: make the tables provably complete. Derive the compared set from the modules' exports and fail on any exported member absent from the comparison tables — so the census cannot silently fall behind the vocabulary. If you would rather pin it as a conscious-update roster (the identityRoots.spec.mjs shape) that is equally fine; what matters is that adding a pair without comparing it goes red.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 92 — correct realm split, twin genuinely import-free, gate placed at the boundary it protects; 8 deducted because the gate's own coverage is hand-maintained against a surface the ticket describes as routinely extended.
• [CONTENT_COMPLETENESS]: 88 — thorough JSDoc and an honest Evidence line that declines to present the seven unmeasured headed journeys as evidence; 12 deducted for the docblock overclaim.
• [EXECUTION_QUALITY]: 90 — differential execution with negative cases and a trust-leak probe is well above the bar; 10 deducted for the demonstrated blind spot in the gate.
• [PRODUCTIVITY]: 95 — the full close-criteria set delivered, plus a real composition defect (App Worker vs Electron-main ownership) found and fixed rather than deferred.
• [IMPACT]: 88 — a versioned wire contract is the boundary every future Fleet client depends on.
• [COMPLEXITY]: 82 — 34 files across Brain authority, browser twin, Electron composition and harness readiness, with a parity gate spanning two realms.
• [EFFORT_PROFILE]: Architectural Pillar — establishes the client-facing protocol boundary rather than extending an existing one.

Scope note on my own review: I went deep on the vocabulary/parity/trust-boundary axis and the wire-format audit, and treated the Electron and harness composition as covered by the hosted matrix rather than re-deriving it. Saying so explicitly so the depth is not read as uniform across all 34 files.

Merge gate is @tobiu's.

⚖️