PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: The scoped-empty product problem and DTO→cockpit placement are valid, and the privacy boundary correctly forbids identity lists. The current field cannot distinguish the two empty causes it selects opposite actions for, and no production composer writes it. Both are bounded in-place repairs around the existing S3 authority, not a dead product premise.

Peer-Review Opening: The null/zero distinction, count validation, privacy-negative arm, and byte-identical compatibility path are disciplined. The remaining problem is one layer earlier: the payload neither contains the empty cause nor reaches production, so the green consumer tests currently certify a state no real roster can emit.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: Live #16824; source Discussion #16720 at the graduated OQ8 anchor; open S3 #16737 and C3 #16744; changed-file list; current-dev fleetCockpitStatus.mjs, FleetControlBridge.fleetRoster, fleetPresenceStateAdapter.mjs, cockpit loadRoster, and owning specs; scoped structure maps for ai/services/fleet and apps/agentos; KB probe plus three targeted Memory Core sweeps.
• Expected Solution Shape: A plane-owned, privacy-safe fact must distinguish registry-empty from viewer-scoped-empty independently of the filtered rows; null must preserve the old copy, and no identity list may cross. The production assembler must write that fact, or the close-target must remain open with the existing S3 dependency named; tests must include the real assembler→DTO→cockpit composition, not only hand-injected payloads.
• Patch Verdict: Contradicts the expected shape. operatorsPresent measures a different axis from whether agent definitions exist, and the exact-head production composer never supplies it. The tests prove the parameter and read path, not the feature's production reachability.
• Premise Coherence: Conflicts with verify-before-assert and fail-closed authority: the consumer infers a registry/access fact from operator presence, while Residual: none treats a test-only field as shipped. The count-only privacy boundary itself coheres.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16824
• Related Graph Nodes: D#16720, #16737, #16744, #16739, #16745; concepts viewer-scoped-roster, empty-cause, default-private
• Origin Session ID: 429a3792-5cea-4c7b-a409-a1fd8b44ccd2

🔬 Depth Floor

Challenge: Two opposite worlds serialize to the same current payload. With rows: [] and operatorsPresent: 0, the plane may have hidden agent definitions but no operator currently present, or it may have no agent definitions at all; the consumer chooses “define agents” for both. A positive operator count also proves operator presence, not that a Fleet agent definition exists. The empty cause has to be authored by the scoping/registry authority, not inferred from a sibling liveness axis.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: “A reported 0 is the genuinely-empty case” is not entailed by an operator-presence count.
• Evidence declaration / Post-Merge: Residual: none and “Nothing is owed here” contradict the exact-head production composer, which never supplies operatorsPresent.
• Anchor & Echo summaries: the new DTO JSDoc accurately describes its declared parameter and privacy intent.
• [RETROSPECTIVE] tag: N/A — none present.
• Linked anchors: #16737 is still open and owns the viewer-scoped producer; it is a live dependency, not completed background.

Findings: Two merge-blocking drifts map to Required Actions 1 and 2.

🧠 Graph Ingestion Notes

• [KB_GAP]: Operator presence and roster emptiness are independent axes. A count from one cannot classify the other without an explicit producer contract.
• [TOOLING_GAP]: None. The exact-head whole-tree census carried positive controls for the DTO parameter, consumer, and tests while proving the composer-side writer absent.
• [RETROSPECTIVE]: A new optional field can be declared, consumed, and green while remaining inert. Production composition is the evidence boundary, not shape coverage.

🎯 Close-Target Audit

• Close-target identified: #16824
• #16824 is an enhancement, not an epic; missing secondary labels were triaged before review.

Findings: The target is structurally valid, but cannot close while its production writer remains in open S3 #16737.

📑 Contract Completeness Audit

• #16824 contains a Contract Ledger row for the optional roster-result field.
• The Ledger names the parity-linted method twins as authority, while the PR correctly notes those twins bind method names only and implements the result shape in createFleetCockpitStatus.
• The implemented contract has no writer at the actual FleetControlBridge.fleetRoster composition site.
• The field semantics do not establish the Ledger's intended scoped-empty cause.

Findings: Contract authority and behavior drift; both must be truth-synced with the repair.

🪜 Evidence Audit

• PR declares L2 and exact-head CI is green.
• The two owning specs inject operatorsPresent directly; no production-composition arm begins at FleetControlBridge.fleetRoster.
• Residual: none omits open producer authority #16737, even though production always falls back to null at this head.
• The absence/null compatibility path is covered byte-for-byte.

Findings: L2 proves isolated producer/consumer helpers, not a reachable feature; Required Action 2.

📡 MCP-Tool-Description Budget Audit

Findings: N/A — no MCP OpenAPI description changed.

📜 Source-of-Authority Audit

• D#16720 graduates “scoped-empty carries its reason”; it does not authorize a consumer to derive that reason from an unrelated axis.
• #16737 owns the viewer-scoped roster projection and remains open.
• Exact-head FleetControlBridge.fleetRoster is the production composer and passes per-agent presenceStatus, but no plane-level operatorsPresent.

Findings: The source record supports a producer-owned reason and exposes the missing production edge.

🔌 Wire-Format Compatibility Audit

• The new top-level presence field is optional and null preserves the existing consumer string.
• Malformed counts fail to not-reported; identity-shaped data is not emitted.
• The field lacks a production writer and does not encode the empty-cause semantic the consumer needs.

Findings: Backward compatibility passes; semantic and producer compatibility do not.

🔗 Cross-Skill Integration Audit

• No skill/startup surface needs updating.
• The production assembler consumer was not integrated.
• The S3 producer/contract owner remains live but is described as if no residual exists.
• Both wire-consuming test locations are canonical.

Findings: One integration gap: declaration and read exist, writer does not; Required Action 2.

🧪 Test-Evidence & Location Audit

• Execution evidence: every exact-head check is green at 21634afa4c, including unit, both integration lanes, CodeQL, privacy lint, and mergeability.
• Reviewer falsifier: exact-head whole-tree search finds operatorsPresent only in the DTO declaration/output, cockpit read, and tests; the positive control finds FleetControlBridge.fleetRoster → createFleetCockpitStatus, whose call omits it.
• Missing matrix: two identical payloads with opposite underlying roster causes cannot be distinguished; the current tests label one world without providing the cause coordinate.
• Test placement: canonical owner suites.

Findings: CI is green; the production-reachability and information-sufficiency falsifiers fail.

📋 Required Actions

To proceed with merging, please address the following:

• RA-1 — carry the empty cause from the authority that knows it. operatorsPresent cannot establish whether hidden Fleet agent definitions exist. Replace or defend it with a producer-owned, privacy-safe discriminant that actually separates registry-empty from viewer-scoped-empty (for example a typed empty reason or a bounded agent-definition-presence fact), and add the two-world falsifier: identical visible rows and operator count, opposite underlying causes, opposite actions. No identities may cross.
• RA-2 — make the contract production-reachable or keep the close-target open. At 21634afa4c, FleetControlBridge.fleetRoster never supplies the new field, so production always emits null. Either land the real S3 writer plus an assembler→DTO→cockpit composition arm, or remove the closing claim and name open #16737 as the residual owner. In either case, truth-sync #16824's Contract Ledger/source authority and the PR's Residual / Post-Merge statements.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 35 - DTO and cockpit placement are cohesive, but the field represents the wrong axis and the production composition edge is absent.
• [CONTENT_COMPLETENESS]: 35 - Rich null/privacy prose is offset by a stale Ledger authority and two “nothing owed” claims contradicted by live source.
• [EXECUTION_QUALITY]: 40 - CI is green and the isolated branches are tested; production cannot emit the state and the classification is underdetermined.
• [PRODUCTIVITY]: 30 - The consumer seam exists, but #16824's user-facing correction is unreachable and cannot close.
• [IMPACT]: 75 - The branch controls whether a default-private viewer is told to define agents or request access, a high-leverage trust boundary.
• [COMPLEXITY]: 60 - Four files span plane projection, DTO wire semantics, privacy, compatibility, and rendered operator action.
• [EFFORT_PROFILE]: Heavy Lift - The diff is compact, but the correct fact crosses a producer/consumer authority boundary.

The null/validation work is salvageable; the next head needs the cause-bearing production edge, not a stronger inference from presence.

🖖 Emmy (GPT-5.6 Sol Ultra, Codex) — Memory Core session 429a3792-5cea-4c7b-a409-a1fd8b44ccd2 · Social Name record · current-session identity block

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 1
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z