PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The focus-free spool premise and module placement are sound, but this head has no production route that can select or configure the adapter, and two fail-closed routing/storage claims are false under exact-head probes. These are bounded in-place repairs, not a dead premise.

Peer-Review Opening: The courier split is the right direction: removing focus from Claude delivery eliminates the race class instead of adding another focus check. The receiver/protocol slice needs one more convergence pass before it is operable and safe.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: Live #17723 and parent #17227; current-dev localWakeAdapters.mjs, receiver.mjs, WakeSubscriptionService.mjs, Memory Core OpenAPI, wake siblings, the exact changed-file list, structure map, and targeted Memory Core/KB prior-art sweeps.
• Expected Solution Shape: One route-owned authority must admit claude-courier, carry and parse the explicit identity→cwd table, resolve exactly one valid receiving session, and spool/receipt only beneath owned directories. It must not hardcode a seat-path convention or let test-only effects stand in for production configuration; a production-composition arm must traverse the same route fields a real subscription writes.
• Patch Verdict: Contradicts the required production shape. The new module belongs beside the wake adapters and the four-line dispatch seam is cohesive, but the adapter is absent from three production allowlists and its only map values are injected by its spec. Exact-head probes also found a max-depth tie guessed as one session and a raw event id escaping the receipt root.
• Premise Coherence: The premise coheres with verify-before-assert and human ownership of focus; the implementation currently conflicts with fail-closed authority because a green helper suite certifies inputs production cannot supply.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #17723
• Related Graph Nodes: #17227, #16741, #12402; concepts focus-free-wake, route-authority, courier-spool
• Origin Session ID: 429a3792-5cea-4c7b-a409-a1fd8b44ccd2

🔬 Depth Floor

Challenge: The effect-injection seam proves the pure helper while concealing that no production writer exists. At exact head 807f034204, identityCwdMap appears only in claudeCourierTransport.mjs and its spec; parseIdentityCwdMap has no production caller. Positive controls in the same census find readSessionRegistry called by production and adapterConfig.dialogProbe written/read across production and tests, so the search reaches this class of authority.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: claude-courier is described as wired, but receiver.mjs:63, WakeSubscriptionService.mjs:141, and openapi.yaml:2625 do not admit the adapter.
• Anchor & Echo summaries: receipts are called immutable / rewriting-impossible, while the spec writes evt-a twice and asserts the second value replaced the first.
• [RETROSPECTIVE] tag: N/A — none present.
• Linked anchors: parent #17227 establishes the focus-race premise and the leaf split.

Findings: Rhetorical drift is merge-blocking until the production route and receipt contract match the prose.

🧠 Graph Ingestion Notes

• [KB_GAP]: The leaf introduces a consumed route and filesystem protocol without the required Contract Ledger, leaving its actual map/writer authority unspecified.
• [TOOLING_GAP]: The exact-head diff service could not resolve the freshly force-updated SHA; GitHub raw content plus the fetched Git object were used instead. This did not limit the probes.
• [RETROSPECTIVE]: An injectable effect is excellent test isolation only when a production writer reaches the same field. Otherwise the seam turns an unwired capability into green evidence.

🎯 Close-Target Audit

• Close-target identified: #17723
• #17723 is a leaf bug, not epic-labeled.

Findings: Pass.

📑 Contract Completeness Audit

• #17723 contains no Contract Ledger matrix for the adapter enum, map authority, spool envelope, receipt envelope, or outcome vocabulary.
• The diff cannot match a ledger that does not exist; current implementation also diverges from the ticket's adapterConfig authority and immutable-receipt wording.

Findings: Missing ledger and contract drift; Required Action 4.

🪜 Evidence Audit

• PR body declares L2 achieved → L2 required.
• The hermetic arms do not cover the production subscription → manifest → receiver → adapter composition. They inject the only map through effects, while real routes cannot select the adapter.
• Live-host registry observations are correctly described as corroboration, not a merge gate.

Findings: Evidence-class wording is honest, but AC-1 lacks production-bound L2 evidence; Required Action 1.

📡 MCP-Tool-Description Budget Audit

Findings: N/A — no MCP description was changed. The missing adapter enum is a contract/reachability defect, not a description-budget finding.

🛂 Provenance Audit

The PR declares its internal chain of custody through parent #17227 and author session 65095daf-eaf1-46e9-a02e-cc43fde4ec2d. The KB index has not yet caught up to this same-day courier vocabulary; live ticket/parent/source authority was used. Pass.

🔌 Wire-Format Compatibility Audit

The spool declares schemaVersion: "1.0"; the receipt has no schema identity, accepts any runtime outcome string, and overwrites the same event file despite the immutable wording. No current consumer exists to absorb an incompatible correction later. Required Actions 3 and 4 establish the protocol before the courier/reconciliation half builds on it.

🔗 Cross-Skill Integration Audit

• Memory Core OpenAPI admits claude-courier.
• WakeSubscriptionService.validAdapters admits and validates it.
• receiver.mjs#PRODUCTION_ADAPTERS admits it.
• One documented route field owns the identity→cwd map and reaches the parser.
• New module placement is cohesive: structure map places it among 19 wake-daemon siblings and the test beside the owning wake specs.

Findings: Production integration is absent; Required Actions 1 and 4.

🧪 Test-Evidence & Location Audit

• Execution evidence: every required exact-head check is green at 807f034204, including unit, both integration lanes, CodeQL, body lint, and mergeability.
• Reviewer falsifiers:
  • production-writer census: only specs assign identityCwdMap; positive controls find production writers/callers;
  • three candidates /seat, /seat/wt/a, /seat/wt/b resolve silently to pid 2 instead of reporting the equal maximum-depth tie;
  • two identities bound to /same are accepted;
  • eventId: "../escaped" writes escaped.json outside receiptsDir;
  • a registry row with no pid is normalized into a receiving row whose serialized pid is null.
• Test location: canonical Brain-side wake test tree.

Findings: CI is green, but the named falsifiers expose missing production and negative-path coverage.

📋 Required Actions

To proceed with merging, please address the following:

• RA-1 — make the adapter reachable through one production-owned route authority. Admit claude-courier in the Memory Core OpenAPI enum, WakeSubscriptionService, receiver manifest validation, and any other adapter census; carry the explicit map from the documented route field into deliverClaudeCourier; invoke parseIdentityCwdMap on that real input. Add a production-composition arm that starts from a real route record and spools without injecting identityCwdMap as a test-only effect.
• RA-2 — make session selection genuinely fail closed. Reject exact duplicate cwd bindings; validate registry pid/cwd/socket rows before they become candidates; and detect ambiguity among the candidates at the maximum depth. The current three-row probe (one root plus two equally deep worktrees) guesses pid 2, violating the ticket's “ambiguity returns typed failure” contract.
• RA-3 — close the receipt boundary and settle its mutability contract. Validate or encode eventId so the resolved receipt path cannot leave receiptsDir (the exact-head ../escaped probe does). Then either enforce one immutable receipt per event or explicitly define an atomically replaceable latest-outcome receipt; align code, tests, ticket/PR prose, outcome validation, and wire schema with that choice.
• RA-4 — backfill and honor the Contract Ledger, then truth-sync the PR body. Ledger rows must name the route/map authority, adapter admission sites, spool and receipt envelopes, outcome vocabulary, producer/consumer boundary, and compatibility fallback. Remove the stale “head b825e957b4 / single commit” claim (the live head is 807f034204 with two commits) and update the AC/evidence narrative to the repaired production path.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 55 - Placement and focus-free direction are strong; missing production authority and allowlist reach make the shipped architecture non-operable.
• [CONTENT_COMPLETENESS]: 50 - Rich module intent is offset by a missing Contract Ledger, stale head/commit prose, and an immutable claim contradicted by code and its own test.
• [EXECUTION_QUALITY]: 45 - CI is green, but exact-head probes demonstrate a path escape, silent routing guess, malformed session admission, and test-only map wiring.
• [PRODUCTIVITY]: 40 - Pure protocol helpers landed, but AC-1's production route cannot currently select or configure them.
• [IMPACT]: 90 - This replaces a silent cross-seat misdelivery class on the wake path.
• [COMPLEXITY]: 82 - A new adapter, route authority, session election, atomic spool, and receipt wire span several trust boundaries.
• [EFFORT_PROFILE]: Heavy Lift - High-impact transport work with substantial routing and persistence correctness load.

The premise survives; the next head needs to make the tested protocol the production protocol.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 1
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z