[Spec 1280] PR-1: correct the prompt-surface measurement instrument (no prompt surface touched)

codev/projects/1280-prompt-surface-judgment-not-ru/1280-plan-iter1-rebuttals.md

@@ -0,0 +1,113 @@
+# Plan iteration 1 response — Spec 1280
+
+Codex REQUEST_CHANGES (HIGH, 8) · Claude REQUEST_CHANGES (HIGH, 7). **All accepted; no
+disputes.** Both reviewers verified the plan's decision arithmetic independently and both
+reproduced 67 — the accounting held; what failed was the *supporting* work riding alongside the
+decisions, which the first draft under-specified because it drew boundaries purely by inspection
+load.
+
+Two findings were **blocking mechanism gaps** that would have surfaced mid-implementation as
+adopter breakage rather than as clean failures.
+
+---
+
+## Blocking mechanism gaps (both reviewers, verified)
+
+### 1. P6's `protocol.json` reference had no adopter-resolvable mechanism
+
+Verified against source: `protocol.md` is inlined at spawn via `{{protocol_reference}}`
+(`spawn-roles.ts:112-124`); **`protocol.json` is inlined nowhere** — `spawn-roles.ts:267` reads it
+only for validation. In a fresh adopter project `codev/protocols/<p>/protocol.json` does not
+exist on disk. So "read `protocol.json`" is exactly the fetch-by-path of a framework file that
+CLAUDE.md forbids and the spec's own constraint restates — and it was carrying the largest single
+cut in the project.
+
+**Resolved by verifying the resolver rather than guessing**: `resolveCodevIncludes`
+(`skeleton.ts:108-119`) is **extension-agnostic**, so `protocol.md` carries a fenced ```json
+block containing `{{> protocols/<p>/protocol.json}}`. Resolves through all four tiers, works in
+fresh installs, needs **no porch change**, and is the literal expression of P6. Cost stated
+honestly (spir +570 words back) — acceptable because size is reporting-only under the amended
+charter. New **T18** tests both **strict** and **soft** mode, because the asymmetry is real:
+strict-mode builders get checks/gates as porch tasks, soft-mode builders have only the prompt.
+
+### 2. Skill relocation is a FOUR-tree sync the instrument could only see one quarter of
+
+Claude's finding, verified: skills exist in `.claude/skills` (10), `.codex/skills` (10,
+**byte-identical**), `codev-skeleton/.claude/skills` (7), `codev-skeleton/.codex/skills` (7) —
+with **existing drift** (`afx`, `porch` differ repo-vs-skeleton; `forge`, `skill-creator`, `team`
+skeleton-absent). M0(g) counted only `.claude/skills`, so relocating content there would have
+left Codex agents and adopters without it **and reported it as deleted** by M0c/T15 — inverting
+the project's honesty artifact.
+
+Fixed: Phase 0 widens M0(g) to all four trees; Phase 1 adds **T17** (skills parity) and treats
+every relocation as a four-copy write. Pre-existing drift is recorded as known state rather than
+silently "fixed" — with the scope question raised for the architect at the gate.
+
+---
+
+## Codex
+
+**Pre-rewrite capability inventory never created — ACCEPTED.** Phase 2 asserted T5 while Phase 9
+first extracted the inventory. M5 requires a *committed pre-rewrite* baseline. Moved into Phase 0
+(PR-1) and frozen there; every later phase asserts against it.
+
+**Post-merge work has no executable home — ACCEPTED.** Added an explicit **verify phase**
+section covering M7, M8, M12, T13, T14, `1280-ab-results.md`, and the SHIP/HOLD/ROLLBACK verdict.
+
+**T3, T13, T14, T16 unhomed — ACCEPTED.** T3 and **T16** into Phase 0 — T16 especially, since it
+is the mechanical guard on M11 and must exist *before* Phase 1 produces the first manifest. T13
+and T14 into verify. Manifest format and location now specified.
+
+**"≤12 batches" didn't count supporting changes — ACCEPTED, and it would have broken the
+architect's own mandate.** Added an explicit definition: a **review batch** is every distinct file
+the architect reads, including tests, registry and retirements. Phases 4 and 9 now declare **two
+batches each**.
+
+**Scar-test sequencing contradictory — ACCEPTED.** Phase 1 asserted T4 while Phase 8 created it.
+Phase 1 now verifies the eight canonicals byte-for-byte against the ratified
+`builder/spir-1252:scar-rules.yaml` directly; T4 is created in Phase 9 and applies from there.
+
+**Grouped rollback not achievable from the proposed commits — ACCEPTED** (Claude found the same
+from the mapping side). Resolved with a commit-level invariant: **every commit is group-pure**;
+phases may span groups and now declare them. M6's dead-tree deletion assigned to **G4**. T10
+rehearses **every** group touched, not a sample.
+
+**PR-1 mechanics unstated — ACCEPTED.** Added: branch cut, merge wait, re-branch via
+`git fetch origin main && git checkout -b … origin/main` (never `git checkout main` from a
+worktree), `porch done --pr` / `--merged` recording, and a duplicate-commit check.
+
+---
+
+## Claude
+
+**Rollback mapping contradicted the spec — ACCEPTED.** Phase 1 claimed G2/G6 while rewriting
+`roles/builder.md` (spec G3) and `roles/consultant.md` (spec G5); a G3 revert would have pulled
+Phase 1 work out and T10 would have rehearsed the wrong map. Roles now live in their own phase
+with **three group-pure commits** (G6/G3/G5).
+
+**M10 concentrated in one phase but collisions are spread — one misassigned — ACCEPTED,
+verified.** `spec-1273-wait-discipline-docs.test.ts:26` targets `codev/roles/builder.md` + its
+skeleton twin → breaks in the **roles** phase, not the builder-prompt phase; line 31 targets
+`.claude`/`.codex` `afx/SKILL.md` → breaks in **Phase 1** on relocation.
+`bugfix-742-consult-templates.test.ts:25-28` pins spir *and* bugfix consult-types → Phases 7 and
+8. M10 is now a per-phase deliverable, assigned where each collision actually lands.
+
+**No per-phase green-suite requirement — ACCEPTED.** The branch could have sat red across eight
+review batches while the architect inspected diffs on a broken tree. Every phase now ends green,
+and it is in Success Metrics.
+
+**Reconcile "~66" vs 67 — ACCEPTED.** The plan states 67 is correct and notes both reviewers
+reproduced it.
+
+**Phase 9 folded review-phase deliverables into an implement phase — ACCEPTED.** Review document
+and PR moved out to porch's `review` phase, which would otherwise re-run over them.
+
+---
+
+## Net
+
+Fifteen findings, none disputed. The plan's decision accounting survived both reviews intact;
+everything that failed was work that *accompanies* the decisions — tests, inventories, group
+purity, sync obligations — which is exactly what a plan drawn by inspection load will
+under-specify if nobody checks. Phase count 10 → 11, with two phases now carrying explicit
+double batches.

codev/projects/1280-prompt-surface-judgment-not-ru/1280-specify-iter1-rebuttals.md

@@ -0,0 +1,174 @@
+# Iteration 1 response — Spec 1280
+
+**No disputes filed.** Every REQUEST_CHANGES point from both reviewers was verified against
+source and accepted. This document records what changed and where, so round 2 can check the
+fixes rather than re-derive the findings.
+
+Two of the findings were factual errors in my own Current State. Both are the exact class
+this spec's principle 7 ("the instrument is part of the deliverable") exists to catch, and
+both are recorded in the spec rather than quietly patched.
+
+---
+
+## Codex findings
+
+### 1. Scar-rule accounting contradicts M1/M2 — ACCEPTED
+
+Iteration 1 declared per-surface targets as served-word ceilings *and* said "targets above
+are net of this [scar carriage]." Incompatible, and Claude independently computed the
+consequence: gross landing 50.2–51.4%, so **M1 would have failed while every per-surface row
+passed**.
+
+**Changed**: all ceilings restated **gross**, with a per-row "scar carriage inside" column.
+Arithmetic rebuilt (`Desired State`). Carriage is now *exempt from rewriting but counted in
+ceilings* — with the corollary stated explicitly: a ceiling a surface cannot meet while
+carrying its scar rules is a wrong ceiling, raised deliberately, never met by trimming scar
+text. Margin disclosed (3.2 points) and M2 made binding with M1 derived; a 50–52% landing is
+a HOLD with named further-cut candidates.
+
+### 2. M0 does not match the runtime resolver — ACCEPTED
+
+Correct: `loadPromptFile` resolves each file independently through the four-tier chain, while
+the script does two-tier, directory-level selection. Fixing the directory alone would
+reproduce the same defect class one layer down.
+
+**Changed**: M0 now requires per-file four-tier resolution matching `resolveCodevFile`, and
+**T1b** is a new test using a fixture with a `.codex`/`.codev/` override of *one* prompt while
+others resolve from the skeleton. M0 also now names the hot-tier transclusion and the
+segment reporting the architect's directive requires.
+
+### 3. "Gate friction" unchecked under Critical while the A/B assumes it — ACCEPTED
+
+**Changed**: resolved and moved out of Critical. O1 is scored prospectively by the architect
+on a 3-item rubric with an explicit 0/1/2 scale, recorded in a committed results artifact at
+scoring time, and **demoted to advisory-with-a-tripwire** rather than a SHIP gate. If scoring
+is incomplete for any pair, O1 reports incomplete and SHIP rests on O2/O3/O4. (Claude raised
+the same single-point-of-failure concern independently and suggested exactly this demotion.)
+
+### 4. A/B contamination controls — ACCEPTED
+
+**Changed**: new **Contamination controls** subsection — model ids/efforts and consult
+backend versions pinned and recorded; arm isolation (second arm must not see the first arm's
+branch, PR, or thread; sequential-with-unpushed-branch or isolated concurrent, recorded per
+pair); alternating arm order; and a committed results artifact
+(`codev/resources/1280-ab-results.md`) with one row per run including base commit, isolation
+mode, every outcome, and any exclusion with its reason.
+
+### 5. Per-surface rollback independence overstated — ACCEPTED
+
+Correct — prompts, included templates, registry mappings and integrity tests are coupled.
+
+**Changed**: rollback restated as **seven groups** (instrument / shared / builder-spawn /
+phase / consultant / architect / scar-registry), each internally consistent, with an explicit
+dependency rule: reverting G7 requires reverting every group carrying scar text. T10 rehearses
+by group.
+
+### 6. M5's inventory diff not deterministic — ACCEPTED
+
+**Changed**: M5 now specifies a committed pre-rewrite `capability-inventory.json` with
+explicit recognition rules per element type (artifact paths, gate names from `protocol.json`,
+`<signal>` tags, check ids, `afx send architect` call sites) and normalization (lowercase,
+strip backticks/punctuation, dedupe). Post-rewrite must be a superset; removals fail and must
+be justified as deliberate retirements.
+
+### 7. Future-dated provenance — ACCEPTED
+
+The architect's instructions carried UTC timestamps (`2026-08-01T02:50Z`, `02:59Z`); local
+time was 19:50/19:59 on 2026-07-31.
+
+**Changed**: all dates normalized to **2026-07-31**, with the UTC/local explanation recorded
+in the consultation log so the provenance is auditable rather than merely corrected.
+
+---
+
+## Claude findings
+
+### 1. "All existing tests pass" is unsatisfiable — ACCEPTED (highest-value finding)
+
+Verified: `agent-farm/__tests__/baked-decisions.test.ts:143-148` enforces a pure-addition
+diff against committed baselines for `protocols/{spir,aspir,air}/builder-prompt.md`, which
+the cut plan takes 824 → ≤420. Also verified the shape across
+`bugfix-744-spir-pr-strategy.test.ts`, `spec-1273-wait-discipline-docs.test.ts`,
+`bugfix-619-aspir-prompt.test.ts`, `template-delivery.test.ts`, `framework-ref-audit.test.ts`,
+`governance-sweep.test.ts`, `review-prompt-routing.test.ts`.
+
+The framing is the important part and I have adopted it verbatim in intent: **each assertion
+is a prior spec's protection encoded as a grep, so retiring one is a governance act, not a
+test fix.**
+
+**Changed**: new criterion **M10** — every modified or retired assertion listed in the review
+with (i) the originating spec, (ii) whether the protected behaviour survives in the rewritten
+prose, (iii) the replacement assertion or an explicit architect-visible retirement.
+Pure-addition re-baselining only with the originating spec named and the new baseline
+committed in the same commit. Silent deletion to go green is declared a project failure. Also
+added as a Risks row (High/High) and a Dependencies entry.
+
+### 2. M1 and M2 stated on different bases — ACCEPTED
+
+Same as Codex 1; see above. Claude's gross computation (50.2–51.4%) is what made the severity
+concrete, and the thin-margin warning is now in the spec as a HOLD rule.
+
+### 3. Two factual errors in Current State — ACCEPTED, both verified
+
+**(a) Hot tier is `@import`ed, not inlined.** Verified `CLAUDE.md:14-15` and
+`managed-block.ts:59-67`: #1119 replaced Spec 987's verbatim inlining with `@import` lines
+that Claude Code transcludes at session launch. So `wc -w CLAUDE.md` = 5,815 **excludes** the
+736 hot-tier words the session actually loads. Baseline corrected **33,519 → 34,255**.
+
+Worth stating plainly: I inherited this from the measurement script's own stale comment
+(lines 44–47) while writing a spec whose headline principle is that instruments get audited
+against their claims. M0(d) now requires fixing that comment, and the incident is written
+into the Problem Statement as principle 7 applied to this spec itself.
+
+**(b) "No code reads `porch/prompts`" is false.** Verified
+`review-prompt-routing.test.ts:29` pushes `codev-skeleton/porch/prompts/review.md` onto its
+assertion list (Spec 987 hot/cold routing). My cause: I ran `grep -rn … | head -20` and drew
+a conclusion from truncated output — the full result is 48 lines. The tree remains dead as
+*prompt surface* (no runtime consumer), but M6's stated verification method was wrong.
+
+**Changed**: Current State carries the retraction and its cause; M6 now requires an
+untruncated search reconciled against the full hit list, and routes the test consumer through
+M10 naming Spec 987. Recorded in the thread as a sweep-scope failure — the class 1252
+identified as its dominant review-iteration cost.
+
+### 4. O1 single point of failure — ACCEPTED
+
+See Codex 3. Adopted Claude's suggested demotion.
+
+### 5. A/B arms not as clean as "two checkouts" — ACCEPTED
+
+Sharp catch: for issues touching Codev's own prompt surface, the treatment arm's CLAUDE.md is
+simultaneously instrument and subject.
+
+**Changed**: eligibility rule added — an issue is ineligible for the A/B if it modifies any
+surface under test.
+
+### 6. Template pressure conflated — ACCEPTED
+
+Verified `checks.ts:149-154`: `REQUIRED_SPEC_SECTIONS` is four headings (Problem Statement,
+Current State, Desired State, Success Criteria), not the template's 20; the 20-heading
+pressure is the `spec-review` consult type, advisorily.
+
+**Changed**: named as two separate constraints in Current State, so the plan does not
+over-preserve template surface for a check that does not require it.
+
+### 7. T3-vs-CI contradiction — ACCEPTED
+
+**Changed**: the Nice-to-Know open question withdrawn; T3 stands and is stated as the
+anti-re-growth guard that runs in CI.
+
+---
+
+## Also incorporated this iteration (not from review)
+
+**Architect scope directive** (2026-07-31): scope is the entire prompt surface — architect
+role prompts, builder roles and spawn wrappers, consultant/CMAP prompts, phase prompts and
+their template includes, `protocol.md` texts — and the instrument must **segment by audience**
+so a cut concentrated in one segment while another grows is visible rather than averaged away.
+
+**Changed**: Current State now carries a full inventory of every prompt-bearing surface with
+its resolver path and served word count, grouped SHARED / ARCHITECT / BUILDER / PHASE /
+CONSULTANT / DEAD. Per-segment ceilings and post-rewrite figures added (builder −53.2%,
+architect −61.2%, consultant −33.8%, no segment growing), M0(f) requires per-segment
+subtotals, and **T11** proves with a fixture that one segment growing while another shrinks
+is not netted to zero.