{ "version": 1, "id": "Circe-safety-pass", "repo": "/home/abstergo/Programming/Circe", "repoName": "Circe", "scope": "safety-pass", "title": "Circe corrective pass review (PR #1, round 4)", "sinceCommit": "68927499f971d9a6302d1cbe2dd98c39a46184d0", "lastReviewCommit": "ad32c4806123f5cfe19d81e81eb7444ef7825750", "reviewRound": 4, "loc": { "added": 4568, "removed": 454 }, "updatedAt": "2026-09-22T12:12:21.101884+00:00", "htmlPath": "/home/abstergo/Documents/reviews/Circe-safety-pass-abbyview.html", "jsonPath": "/home/abstergo/Documents/reviews/Circe-safety-pass-abbyview.json", "verdict": "APPROVED", "confidence": { "recommendation": "Approve PR #1 within its stated safety scope", "rationale": "202 repository tests, all 30 previous reproductions and four additional completion checks pass. No new blocker found in the latest delta. F17 remains deferred to PR #3. No numeric score, as requested." }, "actionableOpen": 1, "baseline": { "frozenAt": "2026-09-21T23:14:34.371706+00:00", "title": "Circe corrective pass review", "lede": "The corrective pass makes real progress, but execution and evidence boundaries still fail concrete counterexamples.", "walkthrough": { "prose": "The pass introduces typed kernel commands, moves lexical routing into an adapter, adds evidence coverage checks and a journal port, and strengthens frame assembly and perception validation. The 35 new safety tests exercise useful required behavior. The remaining failures cluster around rules implemented separately in multiple entry points.", "bullets": [ "Typed commands now provide a real path around lexicon-based capability routing.", "Proposal, revision, confirmation and classifier ingestion still apply different safety rules.", "A frame ID and accepted decision IDs do not yet carry the exact evidence needed to authorize an effect.", "Recovery remains an in-process mechanism; the journal contract does not yet support reconstructing commands and their outcomes." ] }, "filesChanged": [ { "path": "packages/context/src/assembly.ts", "added": 205, "removed": 87, "delta": "+205 / -87" }, { "path": "packages/context/src/metrics.ts", "added": 4, "removed": 0, "delta": "+4 / -0" }, { "path": "packages/context/src/seeds.ts", "added": 55, "removed": 32, "delta": "+55 / -32" }, { "path": "packages/context/src/store.ts", "added": 187, "removed": 10, "delta": "+187 / -10" }, { "path": "packages/context/src/types.ts", "added": 81, "removed": 1, "delta": "+81 / -1" }, { "path": "packages/core/src/identity.ts", "added": 58, "removed": 2, "delta": "+58 / -2" }, { "path": "packages/core/src/index.ts", "added": 1, "removed": 0, "delta": "+1 / -0" }, { "path": "packages/core/src/runtime.ts", "added": 955, "removed": 242, "delta": "+955 / -242" }, { "path": "packages/core/src/types.ts", "added": 117, "removed": 1, "delta": "+117 / -1" }, { "path": "packages/evals/src/deps.ts", "added": 2, "removed": 1, "delta": "+2 / -1" }, { "path": "packages/evals/src/expectations.ts", "added": 2, "removed": 3, "delta": "+2 / -3" }, { "path": "packages/evals/src/perception-workflow.test.ts", "added": 8, "removed": 4, "delta": "+8 / -4" }, { "path": "packages/evals/src/policy.test.ts", "added": 5, "removed": 0, "delta": "+5 / -0" }, { "path": "packages/evals/src/replay.ts", "added": 3, "removed": 3, "delta": "+3 / -3" }, { "path": "packages/evals/src/test-frame.ts", "added": 5, "removed": 0, "delta": "+5 / -0" }, { "path": "packages/perception/src/index.ts", "added": 1, "removed": 0, "delta": "+1 / -0" }, { "path": "packages/perception/src/orchestrator.ts", "added": 148, "removed": 17, "delta": "+148 / -17" }, { "path": "packages/perception/src/policy.ts", "added": 29, "removed": 0, "delta": "+29 / -0" }, { "path": "packages/perception/src/trace.ts", "added": 3, "removed": 0, "delta": "+3 / -0" }, { "path": "packages/perception/src/types.ts", "added": 13, "removed": 0, "delta": "+13 / -0" }, { "path": "packages/perception/src/validation.ts", "added": 251, "removed": 17, "delta": "+251 / -17" }, { "path": "packages/resolvers-deterministic/src/index.ts", "added": 1, "removed": 0, "delta": "+1 / -0" }, { "path": "packages/core/src/journal.ts", "added": 19, "removed": 0, "delta": "+19 / -0" }, { "path": "packages/evals/src/safety-fixes.test.ts", "added": 848, "removed": 0, "delta": "+848 / -0" }, { "path": "packages/perception/src/proposals.ts", "added": 36, "removed": 0, "delta": "+36 / -0" }, { "path": "packages/resolvers-deterministic/src/adapter.ts", "added": 114, "removed": 0, "delta": "+114 / -0" } ], "flowDiagram": null, "sinceCommit": "68927499f971d9a6302d1cbe2dd98c39a46184d0", "loc": { "added": 3151, "removed": 420 } }, "roundDeltas": [ { "round": 2, "at": "2026-09-22T06:39:10.183552+00:00", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "pr": "https://github.com/Absterrg0/circe/pull/1", "filesChanged": [ { "path": "packages/context/src/assembly.ts", "added": 236, "removed": 87, "delta": "+236 / -87" }, { "path": "packages/context/src/metrics.ts", "added": 4, "removed": 0, "delta": "+4 / -0" }, { "path": "packages/context/src/seeds.ts", "added": 55, "removed": 32, "delta": "+55 / -32" }, { "path": "packages/context/src/store.ts", "added": 225, "removed": 22, "delta": "+225 / -22" }, { "path": "packages/context/src/types.ts", "added": 81, "removed": 1, "delta": "+81 / -1" }, { "path": "packages/core/src/identity.ts", "added": 58, "removed": 2, "delta": "+58 / -2" }, { "path": "packages/core/src/index.ts", "added": 1, "removed": 0, "delta": "+1 / -0" }, { "path": "packages/core/src/journal.ts", "added": 19, "removed": 0, "delta": "+19 / -0" }, { "path": "packages/core/src/runtime.ts", "added": 1242, "removed": 254, "delta": "+1242 / -254" }, { "path": "packages/core/src/types.ts", "added": 119, "removed": 1, "delta": "+119 / -1" }, { "path": "packages/evals/src/deps.ts", "added": 2, "removed": 1, "delta": "+2 / -1" }, { "path": "packages/evals/src/expectations.ts", "added": 2, "removed": 3, "delta": "+2 / -3" }, { "path": "packages/evals/src/perception-workflow.test.ts", "added": 8, "removed": 4, "delta": "+8 / -4" }, { "path": "packages/evals/src/policy.test.ts", "added": 5, "removed": 0, "delta": "+5 / -0" }, { "path": "packages/evals/src/replay.ts", "added": 15, "removed": 3, "delta": "+15 / -3" }, { "path": "packages/evals/src/safety-adversarial.test.ts", "added": 442, "removed": 0, "delta": "+442 / -0" }, { "path": "packages/evals/src/safety-fixes.test.ts", "added": 848, "removed": 0, "delta": "+848 / -0" }, { "path": "packages/evals/src/safety-pass-contracts.test.ts", "added": 164, "removed": 0, "delta": "+164 / -0" }, { "path": "packages/evals/src/test-frame.ts", "added": 5, "removed": 0, "delta": "+5 / -0" }, { "path": "packages/perception/src/index.ts", "added": 1, "removed": 0, "delta": "+1 / -0" }, { "path": "packages/perception/src/orchestrator.ts", "added": 171, "removed": 17, "delta": "+171 / -17" }, { "path": "packages/perception/src/policy.ts", "added": 29, "removed": 0, "delta": "+29 / -0" }, { "path": "packages/perception/src/proposals.ts", "added": 111, "removed": 0, "delta": "+111 / -0" }, { "path": "packages/perception/src/trace.ts", "added": 3, "removed": 0, "delta": "+3 / -0" }, { "path": "packages/perception/src/types.ts", "added": 13, "removed": 0, "delta": "+13 / -0" }, { "path": "packages/perception/src/validation.ts", "added": 251, "removed": 17, "delta": "+251 / -17" }, { "path": "packages/resolvers-deterministic/src/adapter.ts", "added": 114, "removed": 0, "delta": "+114 / -0" }, { "path": "packages/resolvers-deterministic/src/index.ts", "added": 1, "removed": 0, "delta": "+1 / -0" } ], "prose": "PR #1 introduces shared command, transition and intent validation helpers, snapshots typed commands, propagates explicit evidence and fixes all 18 earlier reproduction cases. Nine additional tests expose remaining bypasses and asynchronous interleavings. Review was performed in an isolated worktree because the main workspace contains later stacked feature work.", "bullets": [ "190 baseline tests and typecheck pass.", "All 18 independent original reproductions pass.", "Nine new desired-behavior tests fail: eight P1 and one P2.", "Original journal recovery finding remains deferred; it is not a reason to block this safety-only PR." ] }, { "round": 3, "at": "2026-09-22T07:01:04.087528+00:00", "commit": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "pr": "https://github.com/Absterrg0/circe/pull/1", "filesChanged": [ { "path": "packages/core/src/runtime.ts", "added": 120, "removed": 42, "delta": "+120 / -42" }, { "path": "packages/evals/src/anti-corruption.test.ts", "added": 2, "removed": 2, "delta": "+2 / -2" }, { "path": "packages/evals/src/safety-pass-round2.test.ts", "added": 119, "removed": 0, "delta": "+119 / -0" }, { "path": "packages/perception/src/proposals.ts", "added": 31, "removed": 2, "delta": "+31 / -2" }, { "path": "packages/perception/src/types.ts", "added": 2, "removed": 0, "delta": "+2 / -0" } ], "loc": { "added": 274, "removed": 46 }, "prose": "Verified the fixes to all nine round-2 reproductions at exact PR head 5b165b5. The new effect and dispatch checks work on those paths. Targeted checks found three remaining paths: concurrent reconciliation, pausing during dispatch, and ambiguous clarification completing a request.", "bullets": [ "199 repository tests and typecheck pass.", "All 27 independent earlier reproductions pass.", "Three additional desired-behavior tests fail.", "PRs #2-#6 were not audited in this round; F17 remains correctly scoped to recovery work." ] }, { "round": 4, "at": "2026-09-22T12:12:21.101884+00:00", "commit": "ad32c4806123f5cfe19d81e81eb7444ef7825750", "pr": "https://github.com/Absterrg0/circe/pull/1", "filesChanged": [ { "path": "packages/core/src/runtime.ts", "added": 53, "removed": 21, "delta": "+53 / -21" }, { "path": "packages/evals/src/safety-pass-round3.test.ts", "added": 73, "removed": 0, "delta": "+73 / -0" } ], "loc": { "added": 126, "removed": 21 }, "prose": "Verified F28-F30 and the touched runtime paths at exact PR #1 head ad32c48. No new blocking findings. Added successful completion and retry checks alongside the safety regressions.", "bullets": [ "202 PR #1 tests and typecheck pass.", "All 30 independent previous reproductions and four additional completion checks pass.", "Stack tip 3a7b60e passes 261 tests, typecheck and all 30 earlier reproductions.", "All six PRs are open with correct bases; recovered PR #2 is patch-equivalent to 9fde66a.", "PRs #2-#6 have not received a full code review in this round; F17 remains deferred to PR #3." ] } ], "findings": [ { "id": "f1", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Concurrent duplicate proposals still execute twice", "file": "packages/core/src/runtime.ts", "lines": "1478-1484", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before effects", "bodyParagraphs": [ "`command()` checks only completed `commandResults`; it does not reserve an in-flight command ID. Two deliveries of the same proposal each create a transaction before either finishes. The per-transaction commit flag cannot deduplicate them.", "The required-behavior test submits the same command twice while validation is deferred. Both validations complete and two invokes occur. Sequential duplicate delivery is fixed, but concurrent delivery remains unsafe." ], "fix": "Reserve a command identity before the first await and share its in-flight result. Check that repeats have identical content; clear or record failures under a defined retry policy.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1478-1484, `command()` checks only completed `commandResults`; it does not reserve an in-flight command ID. Two deliveries of the same proposal each create a transaction before either finishes. The per-transaction commit flag cannot deduplicate them. The required-behavior test submits the same command twice while validation is deferred. Both validations complete and two invokes occur. Sequential duplicate delivery is fixed, but concurrent delivery remains unsafe. Reserve a command identity before the first await and share its in-flight result. Check that repeats have identical content; clear or record failures under a defined retry policy. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "1478: async function command(command: KernelCommand): Promise {\n1479: const cached = state.commandResults.get(command.commandId);\n1480: if (cached) return structuredClone(cached);\n1481: const ctx = newCtx(clock(), command.commandId, command.commandId);\n1482: pruneScopes(ctx.now);\n1483: switch (command.kind) {\n1484: case \"propose\": {", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f2", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Confirming a running transaction creates another effect", "file": "packages/core/src/runtime.ts", "lines": "480-486", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before effects", "bodyParagraphs": [ "`commit()` rejects terminal states and an active validation, but allows COMMITTED and DISPATCHED transactions. The pending revision flag is cleared before invocation completes, and existing frozen effects are not checked.", "After an executor returns RUNNING, a typed confirmation with a new command ID for the same transaction and revision validates, freezes and invokes again. The reproduction records two invokes for one intent revision." ], "fix": "Restrict confirmation to explicitly committable states and atomically associate one frozen effect set with an intent revision. Repeated confirmation of that revision must never create another set.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 480-486, `commit()` rejects terminal states and an active validation, but allows COMMITTED and DISPATCHED transactions. The pending revision flag is cleared before invocation completes, and existing frozen effects are not checked. After an executor returns RUNNING, a typed confirmation with a new command ID for the same transaction and revision validates, freezes and invokes again. The reproduction records two invokes for one intent revision. Restrict confirmation to explicitly committable states and atomically associate one frozen effect set with an intent revision. Repeated confirmation of that revision must never create another set. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "480: async function commit(ctx: TurnCtx, tx: Transaction): Promise {\n481: const intent = state.intents.get(tx.intentId);\n482: if (!intent) return;\n483: if (isTerminal(tx)) return;\n484: // A commit for this revision is already in flight: a duplicate\n485: // confirmation must not start a second authority validation.\n486: if (tx.pendingCommitRevision !== undefined) return;", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f3", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "An unknown transaction ID targets unrelated live work", "file": "packages/core/src/runtime.ts", "lines": "1491-1498", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before effects", "bodyParagraphs": [ "`transactionById(command.transactionId) ?? gateTransaction() ?? liveTransaction()` treats an explicit but missing ID as if no ID was supplied. Revision, cancellation and resumption have similar fallback behavior.", "The reproduction creates one pending transaction, then confirms `tx:missing`. The existing transaction executes. A stale or mistyped reference therefore authorizes different work, contrary to the no-substitution rule." ], "fix": "Use fallback selection only when the command omits transactionId. Reject any explicit ID that is missing, and apply the same rule consistently to confirm, revise, cancel and resume.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1491-1498, `transactionById(command.transactionId) ?? gateTransaction() ?? liveTransaction()` treats an explicit but missing ID as if no ID was supplied. Revision, cancellation and resumption have similar fallback behavior. The reproduction creates one pending transaction, then confirms `tx:missing`. The existing transaction executes. A stale or mistyped reference therefore authorizes different work, contrary to the no-substitution rule. Use fallback selection only when the command omits transactionId. Reject any explicit ID that is missing, and apply the same rule consistently to confirm, revise, cancel and resume. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "1491: }\n1492: case \"confirm\": {\n1493: const tx = transactionById(command.transactionId) ?? gateTransaction() ?? liveTransaction();\n1494: if (!tx) {\n1495: ctx.reply = \"none\";\n1496: break;\n1497: }\n1498: const intent = state.intents.get(tx.intentId);", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f4", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Revision can resurrect a cancelled transaction", "file": "packages/core/src/runtime.ts", "lines": "861-888", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before effects", "bodyParagraphs": [ "`applyRevision()` rejects transactions with effects but never rejects a terminal transaction addressed by ID. Cancellation before dispatch leaves no effects, so the revision is accepted and replaces CANCELLED with a new gate state.", "The test cancels a transaction, revises its unchanged revision by explicit ID, then confirms revision 2. The cancelled action executes. This violates the transaction lifecycle even without concurrency." ], "fix": "Validate the transition state before applying a revision. Terminal transactions stay terminal; further work must create an explicit new intent.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 861-888, `applyRevision()` rejects transactions with effects but never rejects a terminal transaction addressed by ID. Cancellation before dispatch leaves no effects, so the revision is accepted and replaces CANCELLED with a new gate state. The test cancels a transaction, revises its unchanged revision by explicit ID, then confirms revision 2. The cancelled action executes. This violates the transaction lifecycle even without concurrency. Validate the transition state before applying a revision. Terminal transactions stay terminal; further work must create an explicit new intent. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "861: async function applyRevision(ctx: TurnCtx, command: ReviseCommand): Promise {\n862: const tx = transactionById(command.transactionId) ?? liveTransaction();\n863: if (!tx) {\n864: ctx.errors.push(\"STALE_INTENT\");\n865: ctx.reply = \"none\";\n866: return;\n867: }\n868: if (tx.effects.length > 0) {\n869: // frozen effects are immutable; a revision after dispatch is a new intent\n870: ctx.errors.push(\"STALE_INTENT\");\n871: ctx.reply = \"none\";\n872: return;\n873: }\n874: const intent = state.intents.get(tx.intentId);\n875: if (!intent) {\n876: ctx.errors.push(\"STALE_INTENT\");\n877: ctx.reply = \"none\";\n878: return;\n879: }\n880: if (intent.revision !== command.expectedIntentRevision) {\n881: ctx.errors.push(\"STALE_INTENT\");\n882: ctx.reply = \"none\";\n883: return;\n884: }\n885: const descriptor = descriptorFor(intent.capability);\n886: if (!descriptor) {\n887: ctx.errors.push(\"UNSUPPORTED_CAPABILITY\");\n888: ctx.reply = \"question\";", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f5", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Mutable command objects can change the target after validation starts", "file": "packages/core/src/runtime.ts", "lines": "289-309", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before effects", "bodyParagraphs": [ "`makeSlotBinding()` copies arrays and precondition wrappers but shares nested refs and tokens with the caller. Arguments and other proposal fields also receive only shallow copies.", "The test starts validation of A, changes `command.slots[0].refs[0].id` to B, then releases validation. The adapter recorded A as the checked target, but the executor receives B. Returning a detached `state()` snapshot does not protect this input boundary." ], "fix": "Snapshot and validate the entire incoming command before storing it or awaiting anything. Freeze immutable intent/effect inputs and avoid sharing mutable nested objects with caller or adapter code.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 289-309, `makeSlotBinding()` copies arrays and precondition wrappers but shares nested refs and tokens with the caller. Arguments and other proposal fields also receive only shallow copies. The test starts validation of A, changes `command.slots[0].refs[0].id` to B, then releases validation. The adapter recorded A as the checked target, but the executor receives B. Returning a detached `state()` snapshot does not protect this input boundary. Snapshot and validate the entire incoming command before storing it or awaiting anything. Freeze immutable intent/effect inputs and avoid sharing mutable nested objects with caller or adapter code. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "289: function makeSlotBinding(\n290: slot: string,\n291: refs: EntityRef[],\n292: references: ResolvedReference[],\n293: now: string,\n294: expectations?: FrozenPrecondition[],\n295: origins?: SlotBinding[\"origins\"],\n296: ): SlotBinding {\n297: let frozen: FrozenPrecondition[];\n298: if (expectations && expectations.length > 0) {\n299: frozen = expectations.map((precondition) => ({ ...precondition }));\n300: } else {\n301: const observed = latestSnapshots(refs);\n302: frozen = [];\n303: for (const ref of refs) {\n304: const snapshot = observed.get(entityRefKey(ref));\n305: if (snapshot && snapshot.version.authority === ref.authority) {\n306: frozen.push({ ref, token: snapshot.version });\n307: }\n308: }\n309: }", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f6", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Effect identities still collide across runtime instances", "file": "packages/core/src/runtime.ts", "lines": "185-191", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before shared executors", "bodyParagraphs": [ "`nextEffectId()` includes `state.interactionId`, but every runtime initializes that value to the literal `interaction:1`. There is no RuntimeDeps option to assign a distinct interaction identity.", "Two independently created runtimes both send `effect:interaction:1:1` as their first idempotency key. A shared idempotent executor can suppress legitimate work or return another operation's result. Restart also resets the counters." ], "fix": "Require an injected, stable interaction identity and persist operation identity allocation. Test two concurrent interactions against the same executor and recovery against an existing journal.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 185-191, `nextEffectId()` includes `state.interactionId`, but every runtime initializes that value to the literal `interaction:1`. There is no RuntimeDeps option to assign a distinct interaction identity. Two independently created runtimes both send `effect:interaction:1:1` as their first idempotency key. A shared idempotent executor can suppress legitimate work or return another operation's result. Restart also resets the counters. Require an injected, stable interaction identity and persist operation identity allocation. Test two concurrent interactions against the same executor and recovery against an existing journal. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "185: \n186: export function createRuntime(deps: RuntimeDeps): SemanticRuntime {\n187: const clock = deps.clock ?? (() => new Date().toISOString());\n188: const state: MutableState = {\n189: interactionId: \"interaction:1\",\n190: scopes: new Map(),\n191: scopeStack: [],", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f7", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Explicitly incomplete evidence silently falls back to newer snapshots", "file": "packages/core/src/runtime.ts", "lines": "801-820", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before effects", "bodyParagraphs": [ "`applyProposal()` filters supplied expectedVersions for each slot, then passes an empty array to `makeSlotBinding()`. That helper treats an empty array as absent and fills in versions from current kernel views. This contradicts the comment saying incomplete declared evidence will be rejected.", "The test supplies evidence for an unrelated ref while A exists in a version-2 view. Instead of rejecting missing evidence for A, the kernel validates A at version 2 and invokes." ], "fix": "Distinguish absent evidence from explicitly supplied empty or non-covering evidence. Never fill holes in a supplied read set with current snapshots; reject incomplete coverage.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 801-820, `applyProposal()` filters supplied expectedVersions for each slot, then passes an empty array to `makeSlotBinding()`. That helper treats an empty array as absent and fills in versions from current kernel views. This contradicts the comment saying incomplete declared evidence will be rejected. The test supplies evidence for an unrelated ref while A exists in a version-2 view. Instead of rejecting missing evidence for A, the kernel validates A at version 2 and invokes. Distinguish absent evidence from explicitly supplied empty or non-covering evidence. Never fill holes in a supplied read set with current snapshots; reject incomplete coverage. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "801: // Evidence the interpretation declared wins over a kernel snapshot: if\n802: // expected versions were supplied but do not cover a ref, that ref has\n803: // incomplete evidence and commit will refuse it.\n804: const declaredEvidence =\n805: proposed.expectations && proposed.expectations.length > 0\n806: ? proposed.expectations\n807: : command.expectedVersions && command.expectedVersions.length > 0\n808: ? command.expectedVersions.filter((precondition) =>\n809: proposed.refs.some((ref) => entityRefKey(ref) === entityRefKey(precondition.ref)),\n810: )\n811: : undefined;\n812: return makeSlotBinding(\n813: proposed.slot,\n814: proposed.refs,\n815: references,\n816: ctx.now,\n817: declaredEvidence,\n818: proposed.origins,\n819: );\n820: });", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f8", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Semantic proposals lose the versions that supported the decision", "file": "packages/perception/src/proposals.ts", "lines": "19-34", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before connecting perception to effects", "bodyParagraphs": [ "`propositionCommand()` accepts a frame ID and decision ID set but receives no frame/read set and emits no expectedVersions. SemanticProposition has no observation-version field. Neither acceptance nor dependency freshness is checked against the store here.", "The test interprets A from a version-1 ContextFrame, updates the kernel view to version 2, then builds a command with this helper. The kernel silently binds and validates version 2. It never tests the version that supported the model's judgment." ], "fix": "Build proposals from an accepted interpretation plus its immutable frame/read set. Carry exact observation versions and captured knowledge generations; reject stale support rather than reinterpreting it as current.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/perception/src/proposals.ts` around lines 19-34, `propositionCommand()` accepts a frame ID and decision ID set but receives no frame/read set and emits no expectedVersions. SemanticProposition has no observation-version field. Neither acceptance nor dependency freshness is checked against the store here. The test interprets A from a version-1 ContextFrame, updates the kernel view to version 2, then builds a command with this helper. The kernel silently binds and validates version 2. It never tests the version that supported the model's judgment. Build proposals from an accepted interpretation plus its immutable frame/read set. Carry exact observation versions and captured knowledge generations; reject stale support rather than reinterpreting it as current. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "19: if (proposition.polarity === \"exclude\") return undefined;\n20: const slots =\n21: proposition.slots && proposition.slots.length > 0\n22: ? proposition.slots.map((slot) => ({ slot: slot.slot, refs: [...slot.refs] }))\n23: : [{ slot: \"targets\", refs: [...proposition.refs] }];\n24: return {\n25: kind: \"propose\",\n26: commandId: options.commandId,\n27: capability: proposition.capability,\n28: slots,\n29: ...(proposition.arguments ? { arguments: proposition.arguments } : {}),\n30: ...(proposition.constraints ? { constraints: proposition.constraints } : {}),\n31: ...(proposition.targetIntentRevision !== undefined\n32: ? { expectedIntentRevision: proposition.targetIntentRevision }\n33: : {}),\n34: decisions: [...proposition.decisions],", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f9", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "The proposition consumer turns queries into execution proposals", "file": "packages/perception/src/proposals.ts", "lines": "14-25", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before connecting perception to effects", "bodyParagraphs": [ "The new consumer only checks turn status, a capability, accepted decision IDs and include polarity. It ignores proposition.act, operation and relations, and always returns kind `propose`. Empty decision lists also pass its `every()` check.", "A query/inspect proposition naming `task.resume` returns an executable proposal in the required-behavior test. The helper cannot distinguish asking about an operation from requesting it. Exclusion/dependency relationships between propositions are likewise not compiled." ], "fix": "Validate allowed act/operation combinations and compile the turn as a whole, preserving prohibitions and dependencies. Emit no executable command for unsupported or incomplete semantic structures.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/perception/src/proposals.ts` around lines 14-25, The new consumer only checks turn status, a capability, accepted decision IDs and include polarity. It ignores proposition.act, operation and relations, and always returns kind `propose`. Empty decision lists also pass its `every()` check. A query/inspect proposition naming `task.resume` returns an executable proposal in the required-behavior test. The helper cannot distinguish asking about an operation from requesting it. Exclusion/dependency relationships between propositions are likewise not compiled. Validate allowed act/operation combinations and compile the turn as a whole, preserving prohibitions and dependencies. Emit no executable command for unsupported or incomplete semantic structures. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "14: if (turn.status !== \"RESOLVED\") return undefined;\n15: if (!proposition.capability) return undefined;\n16: if (!proposition.decisions.every((decision) => options.acceptedDecisions.has(decision))) {\n17: return undefined;\n18: }\n19: if (proposition.polarity === \"exclude\") return undefined;\n20: const slots =\n21: proposition.slots && proposition.slots.length > 0\n22: ? proposition.slots.map((slot) => ({ slot: slot.slot, refs: [...slot.refs] }))\n23: : [{ slot: \"targets\", refs: [...proposition.refs] }];\n24: return {\n25: kind: \"propose\",", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f10", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "The classifier-frame path bypasses the ambiguity guard", "file": "packages/core/src/runtime.ts", "lines": "1053-1089", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before semantic ingest", "bodyParagraphs": [ "`proposalFromFrame()` returns a proposal even when `classification.ambiguous` is true. It adds pendingCapability as extra metadata, but request handling executes the proposal first. This path bypasses the accepted-decision guard in the separate proposition helper.", "The test supplies an ambiguous classification with capability, slots and complete version evidence. `ingest()` invokes the executor. This reproduces an actual effect path, not merely an ambiguous answer being exposed to a later stage." ], "fix": "Reject ambiguous classifications before building or applying executable commands. Prefer one validated semantic-command path so frame-based ingestion cannot bypass the acceptance rules.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1053-1089, `proposalFromFrame()` returns a proposal even when `classification.ambiguous` is true. It adds pendingCapability as extra metadata, but request handling executes the proposal first. This path bypasses the accepted-decision guard in the separate proposition helper. The test supplies an ambiguous classification with capability, slots and complete version evidence. `ingest()` invokes the executor. This reproduces an actual effect path, not merely an ambiguous answer being exposed to a later stage. Reject ambiguous classifications before building or applying executable commands. Prefer one validated semantic-command path so frame-based ingestion cannot bypass the acceptance rules. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "1053: function proposalFromFrame(\n1054: classification: ClassificationResult,\n1055: observation: Observation,\n1056: ): AdaptedClassification | undefined {\n1057: const frame = classification.frame as SemanticFrame;\n1058: if (typeof frame.capability !== \"string\" || frame.capability.length === 0) return undefined;\n1059: const descriptor = descriptorFor(frame.capability);\n1060: const slot = descriptor ? targetSlotFor(descriptor) : \"targets\";\n1061: let slots = parseProposedSlots(frame.slots);\n1062: if (!slots) {\n1063: slots = [];\n1064: }\n1065: if (slots.length === 0) {\n1066: const refs = targetRefsFrom(classification.references);\n1067: if (refs.length > 0) slots = [{ slot, refs }];\n1068: }\n1069: const expectedVersions = parseExpectedVersions(frame.expectedVersions);\n1070: const command: ProposeCommand = {\n1071: kind: \"propose\",\n1072: commandId: observation.id,\n1073: observationId: observation.id,\n1074: capability: frame.capability,\n1075: slots,\n1076: ...(isRecord(frame.arguments) ? { arguments: { ...frame.arguments } } : {}),\n1077: ...(Array.isArray(frame.decisions)\n1078: ? { decisions: frame.decisions.filter((decision): decision is string => typeof decision === \"string\") }\n1079: : {}),\n1080: ...(expectedVersions ? { expectedVersions } : {}),\n1081: ...(typeof frame.expectedIntentRevision === \"number\"\n1082: ? { expectedIntentRevision: frame.expectedIntentRevision }\n1083: : {}),\n1084: provenance: classification.provenance,\n1085: };\n1086: return {\n1087: command,\n1088: ...(classification.ambiguous ? { pendingCapability: frame.capability } : {}),\n1089: };", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f11", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Oversized pinned frames are reported as within budget", "file": "packages/context/src/assembly.ts", "lines": "558-590", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before model evaluation", "bodyParagraphs": [ "`frameSizeExceeded` becomes true only after a soft candidate is removed. If all remaining candidates are pinned, `dropIndex < 0` breaks the loop while leaving the flag false. The size calculation also counts JavaScript code units rather than UTF-8 bytes.", "One explicitly pinned candidate with a 300,000-character attribute exceeds the default 262,144 budget, remains fully included, and reports frameSizeExceeded=false. This can send an oversized request without the promised explicit failure signal." ], "fix": "Calculate whether the final complete serialized request exceeds the budget independently of whether anything was dropped. Preserve pins but return an explicit unusable/needs-expansion outcome. Measure the documented byte unit.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/context/src/assembly.ts` around lines 558-590, `frameSizeExceeded` becomes true only after a soft candidate is removed. If all remaining candidates are pinned, `dropIndex < 0` breaks the loop while leaving the flag false. The size calculation also counts JavaScript code units rather than UTF-8 bytes. One explicitly pinned candidate with a 300,000-character attribute exceeds the default 262,144 budget, remains fully included, and reports frameSizeExceeded=false. This can send an oversized request without the promised explicit failure signal. Calculate whether the final complete serialized request exceeds the budget independently of whether anything was dropped. Preserve pins but return an explicit unusable/needs-expansion outcome. Measure the documented byte unit. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "558: let frameSizeExceeded = false;\n559: const maxFrameBytes = budget.maxFrameBytes;\n560: while (stableStringify(payload).length > maxFrameBytes) {\n561: // Drop the weakest soft candidate first; required (pinned) context is\n562: // never silently discarded, it is reported instead.\n563: let dropIndex = -1;\n564: let dropScore = Number.POSITIVE_INFINITY;\n565: candidates.forEach((candidate, index) => {\n566: const key = entityRefKey(candidate.ref);\n567: if (seedClasses.get(key) === \"pinned\") return;\n568: const score = scores.get(key) ?? 0;\n569: if (score < dropScore) {\n570: dropScore = score;\n571: dropIndex = index;\n572: }\n573: });\n574: if (dropIndex < 0) break;\n575: candidates.splice(dropIndex, 1);\n576: payload = buildPayload(candidates);\n577: frameSizeExceeded = true;\n578: }\n579: \n580: const completeness: AssemblyCompleteness = {\n581: seedTruncated: seedCollection.truncated,\n582: traversalTruncated,\n583: candidateTruncated: selectedNonPinned.length < nonPinned.length || frameSizeExceeded,\n584: evidenceTruncated: candidates.some(\n585: (candidate) =>\n586: candidate.omitted.relations > 0 ||\n587: candidate.omitted.events > 0 ||\n588: candidate.omitted.annotations > 0,\n589: ),\n590: frameSizeExceeded,", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f12", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "The exact-input hash omits coverage metadata", "file": "packages/context/src/assembly.ts", "lines": "535-553", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before model evaluation", "bodyParagraphs": [ "The hash payload is built before completeness and excludes it. It also differs from the full ContextFrame passed to the backend. The capability-order case is fixed, but exact-input provenance is not.", "Two providers return identical seeds and different truncated flags. The resulting frames have different completeness and can trigger different acceptance policy, yet their hashes are equal. With the same store version, their frame IDs also coincide; recordFrame treats the second as the already stored first frame because only hashes are compared." ], "fix": "Define and persist one canonical model request, including coverage and relevant policy metadata, then hash that representation. Keep semantic cache keys separate from exact request identity.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/context/src/assembly.ts` around lines 535-553, The hash payload is built before completeness and excludes it. It also differs from the full ContextFrame passed to the backend. The capability-order case is fixed, but exact-input provenance is not. Two providers return identical seeds and different truncated flags. The resulting frames have different completeness and can trigger different acceptance policy, yet their hashes are equal. With the same store version, their frame IDs also coincide; recordFrame treats the second as the already stored first frame because only hashes are compared. Define and persist one canonical model request, including coverage and relevant policy metadata, then hash that representation. Keep semantic cache keys separate from exact request identity. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "535: const buildPayload = (candidates: ContextCandidate[]) => ({\n536: interactionId: request.interactionId,\n537: observationId: request.observationId,\n538: utterance: request.utterance,\n539: interaction: request.interaction,\n540: policy: policy.version,\n541: expansionLevel: level,\n542: // Capability order is caller order: the hash must cover the exact bytes\n543: // the backend will receive, not a canonicalized subset.\n544: capabilities: [...(request.capabilities ?? [])].map((capability) => ({\n545: capabilityId: capability.capabilityId,\n546: description: capability.description,\n547: semanticEffects: capability.semanticEffects,\n548: slots: capability.slots,\n549: })),\n550: candidates: candidates.map((candidate) => ({\n551: ...candidate,\n552: reasons: [...candidate.reasons].sort(),\n553: })),", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f13", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Late neighborhood judgments capture the new generation at publication", "file": "packages/context/src/store.ts", "lines": "278-290", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before reusable semantic beliefs", "bodyParagraphs": [ "Annotations implicitly depend on each subject's current generation at insertion time, not the generation read during inference. Only explicit dependsOn values are checked for staleness. The helper does not derive the read generations from the recorded context frame.", "The test assembles a frame, adds a new blockedBy relation while its interpretation is outstanding, then inserts an annotation depending on the unchanged observation. It remains active because the new generation is attached after the change. Capturing the old generation explicitly can avoid this, but the default claimed guarantee does not." ], "fix": "Capture generations in the interpretation's read set and require them when publishing a belief. Validate those captured values atomically; do not infer freshness from the publication-time generation.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/context/src/store.ts` around lines 278-290, Annotations implicitly depend on each subject's current generation at insertion time, not the generation read during inference. Only explicit dependsOn values are checked for staleness. The helper does not derive the read generations from the recorded context frame. The test assembles a frame, adds a new blockedBy relation while its interpretation is outstanding, then inserts an annotation depending on the unchanged observation. It remains active because the new generation is attached after the change. Capturing the old generation explicitly can avoid this, but the default claimed guarantee does not. Capture generations in the interpretation's read set and require them when publishing a belief. Validate those captured values atomically; do not infer freshness from the publication-time generation. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "278: addAnnotation(input: Omit): AnnotationId {\n279: const id = `annotation:${++this.counters.annotation}`;\n280: const record = snapshot({ ...input, id } as SemanticAnnotation);\n281: this.annotationRecords.set(id, record);\n282: for (const ref of record.refs) this.push(this.annotationsByRef, entityRefKey(ref), id);\n283: const generations = record.refs.map((ref) => this.currentGeneration(ref));\n284: this.linkDependencies(id, [...record.dependsOn, ...generations]);\n285: // A result published after its evidence changed is stale on arrival; keep\n286: // it as history but never let it masquerade as current.\n287: if (!this.dependenciesFresh(record.dependsOn)) {\n288: this.annotationRecords.set(id, snapshot({ ...record, invalidatedAt: record.createdAt }));\n289: }\n290: this.bump();", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f14", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "New obligation events do not invalidate prior judgments", "file": "packages/context/src/store.ts", "lines": "255-263", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before reusable semantic beliefs", "bodyParagraphs": [ "Knowledge generations advance on observation and relation changes, but `recordEvent()` only appends and bumps the store version. Existing beliefs depending on a subject generation remain active.", "The test creates a belief from current knowledge and then records a new obligation-opened event for the same entity. The belief remains valid. This directly affects questions such as 'which one needs me?' where obligations are material evidence." ], "fix": "Declare and advance event/obligation read generations, or a broader subject generation where appropriate. Test event additions, resolutions, removals and temporal expiry against dependent beliefs.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/context/src/store.ts` around lines 255-263, Knowledge generations advance on observation and relation changes, but `recordEvent()` only appends and bumps the store version. Existing beliefs depending on a subject generation remain active. The test creates a belief from current knowledge and then records a new obligation-opened event for the same entity. The belief remains valid. This directly affects questions such as 'which one needs me?' where obligations are material evidence. Declare and advance event/obligation read generations, or a broader subject generation where appropriate. Test event additions, resolutions, removals and temporal expiry against dependent beliefs. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "255: recordEvent(input: Omit): EventRecordId {\n256: const id = `event:${++this.counters.event}`;\n257: const record = snapshot({ ...input, id } as TemporalEventRecord);\n258: this.eventRecords.set(id, record);\n259: for (const ref of record.refs) this.push(this.eventsByRef, entityRefKey(ref), id);\n260: this.bump();\n261: return id;\n262: }\n263: ", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f15", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "A rejected retry can leave the old answer in accepted state", "file": "packages/perception/src/orchestrator.ts", "lines": "331-335", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before model evaluation", "bodyParagraphs": [ "Spec IDs are checked for duplicates only inside each stage. If a later stage reuses an ID, raw answers and outcomes are replaced, but accepted is updated only for auto-bind and never cleared when the new answer is rejected.", "The test asks spec x twice. The first result is accepted at .99; the second requires clarification at .55. `choiceOf(state, 'x')` still returns the first accepted answer. The aggregate run stays AMBIGUOUS, but accepted-value access and further dependencies contradict the latest outcome." ], "fix": "Either reject reused spec IDs across the workflow or define explicit attempts and clear/recompute accepted values and dependent decisions when an attempt changes the outcome.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/perception/src/orchestrator.ts` around lines 331-335, Spec IDs are checked for duplicates only inside each stage. If a later stage reuses an ID, raw answers and outcomes are replaced, but accepted is updated only for auto-bind and never cleared when the new answer is rejected. The test asks spec x twice. The first result is accepted at .99; the second requires clarification at .55. `choiceOf(state, 'x')` still returns the first accepted answer. The aggregate run stays AMBIGUOUS, but accepted-value access and further dependencies contradict the latest outcome. Either reject reused spec IDs across the workflow or define explicit attempts and clear/recompute accepted values and dependent decisions when an attempt changes the outcome. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "331: state.answers.set(spec.id, answer);\n332: if (outcome.bindingAction === \"auto-bind\") state.accepted.set(spec.id, answer);\n333: state.outcomes.set(spec.id, outcome);\n334: state.traces.push(trace);\n335: answers.push(answer);", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f16", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Revision skips slot arity validation", "file": "packages/core/src/runtime.ts", "lines": "890-908", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before effects", "bodyParagraphs": [ "`applyProposal()` checks arity-one slots, but `applyRevision()` checks only that slot names exist. `missingRequired()` and commit do not enforce arity later.", "The test creates a one-target intent, revises the targets slot to contain A and B, then confirms. Both targets reach execution despite the descriptor allowing one." ], "fix": "Use a shared intent/binding validator on proposal, revision and precommit. Validate arity, duplicate slot names, required values and supported argument schemas consistently.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 890-908, `applyProposal()` checks arity-one slots, but `applyRevision()` checks only that slot names exist. `missingRequired()` and commit do not enforce arity later. The test creates a one-target intent, revises the targets slot to contain A and B, then confirms. Both targets reach execution despite the descriptor allowing one. Use a shared intent/binding validator on proposal, revision and precommit. Validate arity, duplicate slot names, required values and supported argument schemas consistently. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "890: }\n891: const declared = new Map(descriptor.slots.map((slot) => [slot.name, slot]));\n892: for (const proposed of command.slots) {\n893: if (!declared.has(proposed.slot)) {\n894: ctx.errors.push(\"INVALID_SLOT\");\n895: ctx.reply = \"question\";\n896: return;\n897: }\n898: }\n899: const replaced = new Set(command.slots.map((slot) => slot.slot));\n900: const bindings = [\n901: ...intent.bindings.filter((binding) => !replaced.has(binding.slot)),\n902: ...command.slots.map((proposed) =>\n903: makeSlotBinding(proposed.slot, proposed.refs, [], ctx.now, proposed.expectations, proposed.origins),\n904: ),\n905: ];\n906: const updated: Intent = {\n907: ...intent,\n908: revision: intent.revision + 1,", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f17", "status": "open", "fixedAt": null, "reviewRound": 1, "title": "The journal omits typed commands and their deduplication identities", "file": "packages/core/src/runtime.ts", "lines": "1478-1488", "severity": "minor", "pBadge": "P2", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before durability claims", "bodyParagraphs": [ "`command()` does not append the command. InteractionLogEntry has no typed-command record, and intent-revised stores only an ID and revision. The runtime neither reads an existing journal nor reconstructs commandResults. A persistent append implementation alone cannot add those missing semantics.", "After a typed proposal with commandId unique-command-123 completes, that command ID appears nowhere in the journal. The test fails even before attempting restart. Deferring a disk-backed implementation is reasonable; this is a separate missing recovery contract." ], "fix": "Record the full accepted command and identity, reconstructible intent/transaction transitions, and command results or sufficient replay events. Add a recovery entry point and crash-boundary tests before claiming durability.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1478-1488, `command()` does not append the command. InteractionLogEntry has no typed-command record, and intent-revised stores only an ID and revision. The runtime neither reads an existing journal nor reconstructs commandResults. A persistent append implementation alone cannot add those missing semantics. After a typed proposal with commandId unique-command-123 completes, that command ID appears nowhere in the journal. The test fails even before attempting restart. Deferring a disk-backed implementation is reasonable; this is a separate missing recovery contract. Record the full accepted command and identity, reconstructible intent/transaction transitions, and command results or sufficient replay events. Add a recovery entry point and crash-boundary tests before claiming durability. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": true, "source": "1478: async function command(command: KernelCommand): Promise {\n1479: const cached = state.commandResults.get(command.commandId);\n1480: if (cached) return structuredClone(cached);\n1481: const ctx = newCtx(clock(), command.commandId, command.commandId);\n1482: pruneScopes(ctx.now);\n1483: switch (command.kind) {\n1484: case \"propose\": {\n1485: await applyProposal(ctx, command, []);\n1486: break;\n1487: }\n1488: case \"revise\": {", "resolutionNote": "PR #1 records command identity and passes the narrow reproduction. Reconstruction and cross-restart recovery remain explicitly deferred to the stacked branch; this finding stays open as a tracked follow-up, not a new PR #1 blocker." }, { "id": "f18", "status": "fixed", "fixedAt": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "reviewRound": 1, "title": "Clear-selection without refs leaves the selection active", "file": "packages/core/src/runtime.ts", "lines": "1004-1041", "severity": "minor", "pBadge": "P2", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before UI use", "bodyParagraphs": [ "`clear-selection` handling is nested inside `if (event.refs && event.refs.length > 0)`. A clear event naturally needs no refs, so it bypasses that branch.", "The test selects A and then sends `{ action: 'clear-selection' }`. currentReferentId still points at A. Subsequent deictic interpretation can continue using a selection the user cleared." ], "fix": "Handle clear-selection independently of supplied refs, and explicitly define which focus, scope and referent records should be cleared.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1004-1041, `clear-selection` handling is nested inside `if (event.refs && event.refs.length > 0)`. A clear event naturally needs no refs, so it bypasses that branch. The test selects A and then sends `{ action: 'clear-selection' }`. currentReferentId still points at A. Subsequent deictic interpretation can continue using a selection the user cleared. Handle clear-selection independently of supplied refs, and explicitly define which focus, scope and referent records should be cleared. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.", "followUp": false, "source": "1004: const event = observation.event;\n1005: if (event.view) state.views.set(event.view.id, event.view);\n1006: if (event.refs && event.refs.length > 0) {\n1007: if (event.action === \"select\" || event.action === \"focus\") {\n1008: const scope: Scope = {\n1009: id: `scope:${String(++state.counters.scope).padStart(2, \"0\")}`,\n1010: refs: [...event.refs],\n1011: origin: { kind: \"focus\", refs: [...event.refs] },\n1012: lifetime: { kind: \"until-replaced\" },\n1013: createdAt: ctx.now,\n1014: };\n1015: state.scopes.set(scope.id, scope);\n1016: state.scopeStack.push(scope.id);\n1017: state.retainedScopes.unshift(scope.id);\n1018: state.retainedScopes = state.retainedScopes.slice(0, 8);\n1019: const kind: Referent[\"kind\"] = event.refs.length > 1 ? \"plural\" : \"singular\";\n1020: const referent: Referent = {\n1021: id: `referent:${++state.counters.referent}`,\n1022: role: kind === \"singular\" ? \"current\" : \"set\",\n1023: kind,\n1024: refs: [...event.refs],\n1025: scopeId: scope.id,\n1026: provenance: { rule: \"ui.selection.v1\", inputs: [], conclusion: event.refs.map(entityRefKey).join(\",\"), confidence: 1, at: ctx.now },\n1027: createdAt: ctx.now,\n1028: updatedAt: ctx.now,\n1029: };\n1030: state.referents.set(referent.id, referent);\n1031: state.recentReferentIds.unshift(referent.id);\n1032: if (kind === \"singular\") state.currentReferentId = referent.id;\n1033: ctx.reply = \"ack\";\n1034: return;\n1035: }\n1036: if (event.action === \"clear-selection\") {\n1037: state.currentReferentId = undefined;\n1038: ctx.reply = \"ack\";\n1039: return;\n1040: }\n1041: }", "resolutionNote": "Original required-behavior reproduction passes at PR #1 head. This closes the reproduced case; related remaining boundary failures are recorded as new round-2 findings." }, { "id": "f19", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Rejected revision does not revoke an in-flight confirmation", "file": "packages/core/src/runtime.ts", "lines": "1098-1103", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before approval of PR #1", "bodyParagraphs": [ "`applyRevision()` marks an invalid revision FAILED but leaves `pendingCommitRevision` and the old intent revision intact. After authority validation completes, `commit()` checks only cancellation and revision identity at lines 802-806, so it proceeds from the FAILED state.", "The test starts confirmation, submits an invalid two-target revision to an arity-one slot, verifies the transaction is FAILED, then releases validation. The old action still invokes once. The newer user instruction was rejected, but the old authorization survived it." ], "fix": "Revoke the pending commit on every intent-invalidating transition. After every await, require both the original reservation identity and a still-committable transaction state before freezing effects.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1098-1103, `applyRevision()` marks an invalid revision FAILED but leaves `pendingCommitRevision` and the old intent revision intact. After authority validation completes, `commit()` checks only cancellation and revision identity at lines 802-806, so it proceeds from the FAILED state. The test starts confirmation, submits an invalid two-target revision to an arity-one slot, verifies the transaction is FAILED, then releases validation. The old action still invokes once. The newer user instruction was rejected, but the old authorization survived it. Revoke the pending commit on every intent-invalidating transition. After every await, require both the original reservation identity and a still-committable transaction state before freezing effects. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "1098: if (!validateProposedSlots(ctx, descriptor, command.slots)) {\n1099: // The user's latest expressed intent is unexecutable. Never silently\n1100: // fall back to the revision they were replacing.\n1101: tx.state = \"FAILED\";\n1102: touchedTx(ctx, tx);\n1103: return;", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f20", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Overlapping dispatch loops invoke the same frozen effect twice", "file": "packages/core/src/runtime.ts", "lines": "677-679", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before approval of PR #1", "bodyParagraphs": [ "`dispatch()` captures a list of PENDING effects once, then awaits each invocation without rechecking an effect's state before starting it. Another resume call can dispatch an effect that remains in the first loop's captured list.", "With concurrency set to two, the test holds invocation A, resumes the transaction so B starts, then releases A. The original loop starts B again. Two frozen effects produce three executor calls. The test uses a low-risk capability whose executor declares idempotency unsupported, so a duplicate can repeat the operation." ], "fix": "Reserve each effect synchronously with a PENDING-to-RUNNING transition immediately before dispatch. Recheck eligibility after every await and share a transaction dispatch coordinator or otherwise prevent overlapping ownership.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 677-679, `dispatch()` captures a list of PENDING effects once, then awaits each invocation without rechecking an effect's state before starting it. Another resume call can dispatch an effect that remains in the first loop's captured list. With concurrency set to two, the test holds invocation A, resumes the transaction so B starts, then releases A. The original loop starts B again. Two frozen effects produce three executor calls. The test uses a low-risk capability whose executor declares idempotency unsupported, so a duplicate can repeat the operation. Reserve each effect synchronously with a PENDING-to-RUNNING transition immediately before dispatch. Recheck eligibility after every await and share a transaction dispatch coordinator or otherwise prevent overlapping ownership. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "677: for (const effect of pendingEffects) {\n678: if (runningCount() >= max) break;\n679: await invokeBatch(ctx, [effect], descriptor);", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f21", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Ambiguous affirmations still authorize execution", "file": "packages/core/src/runtime.ts", "lines": "1482-1487", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before approval of PR #1", "bodyParagraphs": [ "The new ambiguity guard lives in `proposalFromFrame()`. The affirmation branch ignores that guard and calls `commit()` directly. An ambiguous interpretation of a confirmation therefore still carries execution authority.", "The reproduction first creates a transaction requiring affirmative confirmation. Its classifier then returns act=affirm, ambiguous=true and confidence=.51. One invocation occurs. The earlier ambiguous-request regression passes because it exercises a different branch." ], "fix": "Gate every consequence-bearing semantic act on acceptance before entering act-specific handling. Route accepted confirm, revise, cancel and resume commands through the same validated command mechanism as accepted proposals.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1482-1487, The new ambiguity guard lives in `proposalFromFrame()`. The affirmation branch ignores that guard and calls `commit()` directly. An ambiguous interpretation of a confirmation therefore still carries execution authority. The reproduction first creates a transaction requiring affirmative confirmation. Its classifier then returns act=affirm, ambiguous=true and confidence=.51. One invocation occurs. The earlier ambiguous-request regression passes because it exercises a different branch. Gate every consequence-bearing semantic act on acceptance before entering act-specific handling. Route accepted confirm, revise, cancel and resume commands through the same validated command mechanism as accepted proposals. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "1482: case \"affirm\": {\n1483: if (event.operations.includes(\"correction\")) {\n1484: applyCorrection(ctx, references);\n1485: } else if (gateTransaction()) {\n1486: const tx = gateTransaction()!;\n1487: await commit(ctx, tx);", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f22", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Classifier-produced commands bypass the immutable input boundary", "file": "packages/core/src/runtime.ts", "lines": "1681-1685", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before approval of PR #1", "bodyParagraphs": [ "The public `command()` method snapshots and freezes its input, but `ingestReserved()` calls `applyProposal()` or `applyRevision()` directly with the adapter result. The classification object remains owned by the classifier, and nested argument objects are shared through shallow copies.", "The test returns a classification with a nested message argument, pauses authority validation, changes that argument through the classifier's retained object, then releases validation. The executor receives the changed message. The snapshot passed into the classifier protects kernel state in one direction; the returned result needs the same treatment." ], "fix": "Snapshot and validate the adapted command before any application or await. Use a common internal command entry point for typed and semantic inputs so both receive identical isolation and transition checks.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1681-1685, The public `command()` method snapshots and freezes its input, but `ingestReserved()` calls `applyProposal()` or `applyRevision()` directly with the adapter result. The classification object remains owned by the classifier, and nested argument objects are shared through shallow copies. The test returns a classification with a nested message argument, pauses authority validation, changes that argument through the classifier's retained object, then releases validation. The executor receives the changed message. The snapshot passed into the classifier protects kernel state in one direction; the returned result needs the same treatment. Snapshot and validate the adapted command before any application or await. Use a common internal command entry point for typed and semantic inputs so both receive identical isolation and transition checks. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "1681: if (command?.kind === \"propose\" || command?.kind === \"revise\") {\n1682: if (command.kind === \"revise\") {\n1683: await applyRevision(ctx, command);\n1684: } else {\n1685: await applyProposal(ctx, command, references);", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f23", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Late executor acknowledgements overwrite terminal outcomes", "file": "packages/core/src/runtime.ts", "lines": "625-634", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before approval of PR #1", "bodyParagraphs": [ "`applyEffectObservation()` protects terminal effects only from later observations. `invokeBatch()` assigns status directly after its await, without checking whether an observation already settled the effect.", "The test holds an invocation response, ingests a SUCCEEDED effect observation, then releases the earlier response with status RUNNING. The effect regresses to RUNNING and the transaction loses its completed state. A late transport exception can similarly overwrite a known outcome with UNKNOWN." ], "fix": "Apply one monotonic effect-transition rule to observations, invoke responses, exceptions and reconciliation results. Accept receipt metadata separately from status so a late acknowledgement cannot undo a terminal result.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 625-634, `applyEffectObservation()` protects terminal effects only from later observations. `invokeBatch()` assigns status directly after its await, without checking whether an observation already settled the effect. The test holds an invocation response, ingests a SUCCEEDED effect observation, then releases the earlier response with status RUNNING. The effect regresses to RUNNING and the transaction loses its completed state. A late transport exception can similarly overwrite a known outcome with UNKNOWN. Apply one monotonic effect-transition rule to observations, invoke responses, exceptions and reconciliation results. Accept receipt metadata separately from status so a late acknowledgement cannot undo a terminal result. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "625: log({ kind: \"dispatch-acknowledged\", receipt: effect.receipt, at: ctx.now });\n626: if (!result.ok) {\n627: effect.status = \"FAILED\";\n628: effect.failure = result.failure ?? { kind: \"EXECUTION_ERROR\" };\n629: } else if (result.status === \"RUNNING\") {\n630: effect.status = \"RUNNING\";\n631: } else {\n632: effect.status = \"SUCCEEDED\";\n633: effect.result = result.result;\n634: effect.endedAt = ctx.now;", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f24", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Batch reconciliation uses keys that were never dispatched", "file": "packages/core/src/runtime.ts", "lines": "642-647", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before approval of PR #1", "bodyParagraphs": [ "`invokeBatch()` sends one idempotency key, the first effect ID, for the entire invocation. If the response is lost, its synthesized receipts use each individual effect ID as the idempotency key. All but the first receipt therefore refer to an operation the executor never saw. The no-receipt acknowledgement branch has the same mismatch.", "The fake executor records the actual batch key, applies the batch, then throws to simulate a lost response. Reconciliation succeeds for the first effect but returns UNKNOWN for the second. The batch was applied, yet the runtime cannot resolve all of it using its own receipts." ], "fix": "Record a stable dispatch-operation identity shared by the batch and preserve its actual key in every member receipt. Keep per-effect identity separate. Define whether reconciliation returns a batch result or per-member results and test the lost-response path.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 642-647, `invokeBatch()` sends one idempotency key, the first effect ID, for the entire invocation. If the response is lost, its synthesized receipts use each individual effect ID as the idempotency key. All but the first receipt therefore refer to an operation the executor never saw. The no-receipt acknowledgement branch has the same mismatch. The fake executor records the actual batch key, applies the batch, then throws to simulate a lost response. Reconciliation succeeds for the first effect but returns UNKNOWN for the second. The batch was applied, yet the runtime cannot resolve all of it using its own receipts. Record a stable dispatch-operation identity shared by the batch and preserve its actual key in every member receipt. Keep per-effect identity separate. Define whether reconciliation returns a batch result or per-member results and test the lost-response path. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "642: for (const effect of effects) {\n643: effect.receipt ??= {\n644: effectId: effect.id,\n645: executor: executor.id,\n646: idempotencyKey: effect.id,\n647: dispatchedAt: at,", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f25", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Semantic turns can borrow evidence from the wrong frame", "file": "packages/perception/src/proposals.ts", "lines": "94-96", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before approval of PR #1", "bodyParagraphs": [ "`propositionCommand()` now extracts versions from `options.frame`, but never checks that this is the frame identified by `turn.frameId`. An accepted decision set is still just a set of strings; the helper does not establish a connection between those decisions and that frame.", "The test builds a turn against frame A@1, creates a later frame A@2, and passes the later frame to the helper. It returns an executable proposal carrying version 2. This recreates the evidence substitution problem even though the old missing-frame test now correctly refuses execution." ], "fix": "Reject mismatched frame identity before constructing a command. Pass a validated accepted interpretation containing its immutable frame and decision provenance together, and verify the provenance belongs to that frame.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/perception/src/proposals.ts` around lines 94-96, `propositionCommand()` now extracts versions from `options.frame`, but never checks that this is the frame identified by `turn.frameId`. An accepted decision set is still just a set of strings; the helper does not establish a connection between those decisions and that frame. The test builds a turn against frame A@1, creates a later frame A@2, and passes the later frame to the helper. It returns an executable proposal carrying version 2. This recreates the evidence substitution problem even though the old missing-frame test now correctly refuses execution. Reject mismatched frame identity before constructing a command. Pass a validated accepted interpretation containing its immutable frame and decision provenance together, and verify the provenance belongs to that frame. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "94: // Presence is meaningful: an absent frame means \"no declared read set\", so\n95: // the command carries an explicit empty one and cannot execute.\n96: const expectedVersions = expectedVersionsFromFrame(options.frame, slots) ?? [];", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f26", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Exclusions check summary refs but execute slot refs", "file": "packages/perception/src/proposals.ts", "lines": "82-91", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before approval of PR #1", "bodyParagraphs": [ "Turn exclusion checks compare `proposition.refs`, while command construction prefers `proposition.slots`. These can name different entities, and the helper neither validates their consistency nor applies exclusions to the executable bindings.", "The test prohibits B, then supplies an action whose summary refs contain A but whose targets slot contains B. The action explicitly relates to the prohibition through excludes. The check passes and the helper emits a proposal for B with valid version evidence. A contradictory model output is sufficient to bypass the prohibition." ], "fix": "Normalize executable bindings before checking prohibitions. Either reject contradictions between summary refs and slots or define one canonical source of targets, then enforce all turn-level exclusions against every relevant executable binding.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/perception/src/proposals.ts` around lines 82-91, Turn exclusion checks compare `proposition.refs`, while command construction prefers `proposition.slots`. These can name different entities, and the helper neither validates their consistency nor applies exclusions to the executable bindings. The test prohibits B, then supplies an action whose summary refs contain A but whose targets slot contains B. The action explicitly relates to the prohibition through excludes. The check passes and the helper emits a proposal for B with valid version evidence. A contradictory model output is sufficient to bypass the prohibition. Normalize executable bindings before checking prohibitions. Either reject contradictions between summary refs and slots or define one canonical source of targets, then enforce all turn-level exclusions against every relevant executable binding. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "82: if (relation.kind === \"excludes\") {\n83: const excluded = new Set(related.refs.map(entityRefKey));\n84: if (proposition.refs.some((ref) => excluded.has(entityRefKey(ref)))) return undefined;\n85: }\n86: }\n87: \n88: const slots =\n89: proposition.slots && proposition.slots.length > 0\n90: ? proposition.slots.map((slot) => ({ slot: slot.slot, refs: [...slot.refs] }))\n91: : [{ slot: \"targets\", refs: [...proposition.refs] }];", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f27", "status": "fixed", "fixedAt": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "reviewRound": 2, "title": "Completed command IDs skip payload conflict detection", "file": "packages/core/src/runtime.ts", "lines": "449-454", "severity": "minor", "pBadge": "P2", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Command identity contract", "bodyParagraphs": [ "`runReserved()` returns a completed cached result before comparing content fingerprints. Payload conflict detection therefore works only while the original command is still in flight.", "After command same completes for A, the test resubmits same for B. Instead of rejecting the conflicting payload, the runtime returns A's successful result. B does not execute, but the caller receives success for a different request and the documented identity contract is violated." ], "fix": "Compute and compare the accepted fingerprint before either completed-result or in-flight lookup. Use the same conflict response for both states and retain tests for identical replay and conflicting replay.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 449-454, `runReserved()` returns a completed cached result before comparing content fingerprints. Payload conflict detection therefore works only while the original command is still in flight. After command same completes for A, the test resubmits same for B. Instead of rejecting the conflicting payload, the runtime returns A's successful result. B does not execute, but the caller receives success for a different request and the documented identity contract is violated. Compute and compare the accepted fingerprint before either completed-result or in-flight lookup. Use the same conflict response for both states and retain tests for identical replay and conflicting replay. Reproduce against PR #1 at 5afb2757db227cd3c50e539d61e53f23b12e8ed7 using `/tmp/circe-pr1-evidence/additional.test.ts`; then add the desired-behavior test to the repository and run the full test suite and typecheck. Preserve the typed semantic boundary and avoid English routing rules.", "followUp": false, "source": "449: const completed = state.commandResults.get(key);\n450: if (completed) return structuredClone(completed);\n451: const fingerprint = fingerprintOf(content);\n452: const previous = state.commandFingerprints.get(key);\n453: if (previous !== undefined && previous !== fingerprint) {\n454: throw new Error(`command identity ${key} was reused with different content`);", "commit": "5afb2757db227cd3c50e539d61e53f23b12e8ed7", "resolutionNote": "The original round-2 reproduction passes independently at 5b165b5. Remaining adjacent paths are documented in F28-F30 without changing the original finding body." }, { "id": "f28", "status": "fixed", "fixedAt": "ad32c4806123f5cfe19d81e81eb7444ef7825750", "reviewRound": 3, "title": "Concurrent reconciliation bypasses the monotonic outcome rule", "file": "packages/core/src/runtime.ts", "lines": "1894-1903", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "data-integrity", "gate": "Before approval of PR #1", "relatedFinding": "f23", "bodyParagraphs": [ "`canAdvanceEffect()` is used by invocation responses, invocation exceptions and observations, but never by `reconcile()`. Reconciliation checks UNKNOWN before calling the executor, then writes the result after an await without reserving the operation or rechecking the effect state.", "The reproduction starts two reconciliations of one UNKNOWN effect. The first resolves SUCCEEDED; a delayed result from the second reports UNKNOWN and overwrites that completed outcome. Both the effect and transaction regress. This contradicts the claimed shared rule for every writer, even though the original late-invocation acknowledgement test now passes." ], "fix": "Deduplicate concurrent reconciliation per effect and apply the same terminal-state guard after the adapter await. Recheck the current effect or reservation before recording any state transition; a late result must not overwrite a terminal outcome.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1894-1903, `canAdvanceEffect()` is used by invocation responses, invocation exceptions and observations, but never by `reconcile()`. Reconciliation checks UNKNOWN before calling the executor, then writes the result after an await without reserving the operation or rechecking the effect state. The reproduction starts two reconciliations of one UNKNOWN effect. The first resolves SUCCEEDED; a delayed result from the second reports UNKNOWN and overwrites that completed outcome. Both the effect and transaction regress. This contradicts the claimed shared rule for every writer, even though the original late-invocation acknowledgement test now passes. Deduplicate concurrent reconciliation per effect and apply the same terminal-state guard after the adapter await. Recheck the current effect or reservation before recording any state transition; a late result must not overwrite a terminal outcome. Reproduce using `/tmp/circe-round3-evidence/round3.test.ts` against PR #1 at 5b165b5cb9d319c4503fe675b6bf811fd6851da1. Retain the required-behavior test in the repository and run the full suite and typecheck. Keep the earlier 27 reproductions passing; this is a remaining path related to F23, not a failure of its original reproduction.", "followUp": false, "source": "1894: if (result.status === \"SUCCEEDED\") {\n1895: effect.status = \"SUCCEEDED\";\n1896: effect.result = result.result;\n1897: effect.endedAt = ctx.now;\n1898: } else if (result.status === \"FAILED\") {\n1899: effect.status = \"FAILED\";\n1900: effect.failure = result.failure ?? { kind: \"EXECUTION_ERROR\" };\n1901: effect.endedAt = ctx.now;\n1902: } else {\n1903: effect.status = \"UNKNOWN\";", "commit": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "resolutionNote": "Concurrent reconciliation now shares one adapter call per effect and rechecks canAdvanceEffect after the await. The original regression passes, as do transient-error retry and detached-result checks." }, { "id": "f29", "status": "fixed", "fixedAt": "ad32c4806123f5cfe19d81e81eb7444ef7825750", "reviewRound": 3, "title": "An interrupted dispatch loop starts its next pending effect", "file": "packages/core/src/runtime.ts", "lines": "695-700", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before approval of PR #1", "relatedFinding": "f20", "bodyParagraphs": [ "The revised dispatch loop rechecks whether each effect is still PENDING, but checks `tx.paused` only once at function entry. An interrupt received while `invokeBatch()` is awaiting does not stop the loop from dispatching its next pending effect.", "With concurrency set to one, the test starts A and holds its invoke response. It sends an interrupt and verifies that the transaction is paused. Once A returns SUCCEEDED, B invokes without any resume command. The fix prevents duplicate ownership, but the loop still fails to recheck whether dispatch is currently authorized." ], "fix": "Before claiming every pending effect, recheck transaction pause and lifecycle eligibility as well as effect status and available capacity. Stop the active loop when paused and leave the remaining effects pending for an explicit resume.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 695-700, The revised dispatch loop rechecks whether each effect is still PENDING, but checks `tx.paused` only once at function entry. An interrupt received while `invokeBatch()` is awaiting does not stop the loop from dispatching its next pending effect. With concurrency set to one, the test starts A and holds its invoke response. It sends an interrupt and verifies that the transaction is paused. Once A returns SUCCEEDED, B invokes without any resume command. The fix prevents duplicate ownership, but the loop still fails to recheck whether dispatch is currently authorized. Before claiming every pending effect, recheck transaction pause and lifecycle eligibility as well as effect status and available capacity. Stop the active loop when paused and leave the remaining effects pending for an explicit resume. Reproduce using `/tmp/circe-round3-evidence/round3.test.ts` against PR #1 at 5b165b5cb9d319c4503fe675b6bf811fd6851da1. Retain the required-behavior test in the repository and run the full suite and typecheck. Keep the earlier 27 reproductions passing; this is a remaining path related to F20, not a failure of its original reproduction.", "followUp": false, "source": "695: for (const effect of pendingEffects) {\n696: // Another dispatch loop (resume, observation) may have claimed this\n697: // effect while this loop was awaiting; never start it twice.\n698: if (!stillPending(effect)) continue;\n699: if (runningCount() >= max) break;\n700: await invokeBatch(ctx, [effect], descriptor);", "commit": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "resolutionNote": "Each dispatch claim rechecks transaction pause and lifecycle authorization. The original regression passes; explicit resume subsequently invokes the retained pending effect exactly once." }, { "id": "f30", "status": "fixed", "fixedAt": "ad32c4806123f5cfe19d81e81eb7444ef7825750", "reviewRound": 3, "title": "Ambiguous clarification can complete a request into execution", "file": "packages/core/src/runtime.ts", "lines": "1606-1616", "severity": "major", "pBadge": "P1", "type": "logic", "section": "actionable", "category": "correctness", "gate": "Before approval of PR #1", "relatedFinding": "f21", "bodyParagraphs": [ "Ambiguity checks cover affirm, reject and request, while the fragment/clarify branch still accepts references without checking `classification.ambiguous`. That branch can consume `pendingFrame` and call `applyProposal()`, so it is also a consequence-bearing entry point.", "The test first sends an ambiguous unresolved request for task.resume. The runtime asks for a reference. The next classification is an ambiguous clarification naming A at .51 confidence. With a current UI observation and a capability whose commit policy is none, the clarification produces an invocation. No accepted referent decision or affirmative confirmation intervenes." ], "fix": "Apply semantic acceptance before consuming a clarification into an intent or command. Preserve the pending question on an ambiguous answer, and route accepted clarification-generated proposals and revisions through the same validated consequence boundary.", "prompt": "Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.\n\nIn `packages/core/src/runtime.ts` around lines 1606-1616, Ambiguity checks cover affirm, reject and request, while the fragment/clarify branch still accepts references without checking `classification.ambiguous`. That branch can consume `pendingFrame` and call `applyProposal()`, so it is also a consequence-bearing entry point. The test first sends an ambiguous unresolved request for task.resume. The runtime asks for a reference. The next classification is an ambiguous clarification naming A at .51 confidence. With a current UI observation and a capability whose commit policy is none, the clarification produces an invocation. No accepted referent decision or affirmative confirmation intervenes. Apply semantic acceptance before consuming a clarification into an intent or command. Preserve the pending question on an ambiguous answer, and route accepted clarification-generated proposals and revisions through the same validated consequence boundary. Reproduce using `/tmp/circe-round3-evidence/round3.test.ts` against PR #1 at 5b165b5cb9d319c4503fe675b6bf811fd6851da1. Retain the required-behavior test in the repository and run the full suite and typecheck. Keep the earlier 27 reproductions passing; this is a remaining path related to F21, not a failure of its original reproduction.", "followUp": false, "source": "1606: case \"fragment\":\n1607: case \"clarify\": {\n1608: if (references.length > 0) {\n1609: setCurrentReferent(ctx, references, ctx.now);\n1610: if (state.pendingQuestion?.awaiting === \"reference\") {\n1611: const pendingTx = state.pendingQuestion.transactionId\n1612: ? state.transactions.get(state.pendingQuestion.transactionId)\n1613: : undefined;\n1614: const capability = state.pendingFrame?.capability;\n1615: state.pendingQuestion = undefined;\n1616: state.pendingFrame = undefined;", "commit": "5b165b5cb9d319c4503fe675b6bf811fd6851da1", "resolutionNote": "Ambiguous fragments and clarifications return a question before consuming pending context or references. The original regression passes; the pending question survives and a later unambiguous answer completes successfully." } ], "history": [ { "round": 1, "at": "2026-09-21T23:14:34.371706+00:00", "actionableOpen": 18, "note": "Targeted follow-up to the original architecture review; original report preserved separately." }, { "round": 2, "at": "2026-09-22T06:39:10.183552+00:00", "actionableOpen": 10, "verdict": "CHANGES_REQUESTED", "note": "PR #1 review at exact head; 17 prior reproduced cases closed, f17 partially addressed and deferred, nine new findings appended." }, { "round": 3, "at": "2026-09-22T07:01:04.087528+00:00", "actionableOpen": 4, "verdict": "CHANGES_REQUESTED", "note": "F19-F27 original cases verified fixed. Appended F28-F30 for remaining paths. No source edits." }, { "round": 4, "at": "2026-09-22T12:12:21.101884+00:00", "actionableOpen": 1, "currentBlockingFindings": 0, "deferredOpen": 1, "verdict": "APPROVED", "note": "F28-F30 verified fixed. No new findings. Approve scoped PR #1; retain F17 as a recovery follow-up. No Circe source edits." } ], "syncMeta": { "instructions": "Preserve baseline and finding prose. Review exact PR heads; update finding status only after validation. Approval applies to PR #1 safety scope, with F17 recovery deferred." }, "currentBlockingFindings": 0, "currentAdditionalFindings": 0, "deferredOpen": 1, "verdictScope": "PR #1 safety pass only; F17 recovery remains deferred to PR #3" }