Harden four classes from the 0.8.0 cycle and PR #21 by dsnger · Pull Request #22 · dsnger/dev-workflow-kit

dsnger · 2026-08-04T15:31:08Z

Validation evidence — hardening round 0.8.1

Story: docs/superpowers/stories/2026-08-03-hardening-round-0-8-0-and-pr-21-story.md
Branch: harden-0-8-0-and-pr-21

battery

exit status: 0
hook suite under sh: "all passed" (no assertion total, as expected)
hook suite under dash: "all passed" (no assertion total, as expected)
invariants suite: "all passed (123 assertions)"
version-bump suite: "all passed (36 assertions)"
check-invariants.sh: "invariant checks: ok"
check-version-bump.sh main: "version-bump check: ok"
claude plugin validate --strict: "✔ Validation passed"
derived hook-suite assertion count (the suite prints none) — suite exit status captured
separately from the count, so a partial count from a dead suite is not recorded:
HOOK_SH=sh -> status 0, count 467
HOOK_SH=dash -> status 0, count 467

check (named verification), with its counterfactual

§5.2 applied to the four cases in spec §10 — each must FAIL on the wiring half:

$EVIDENCE dry run -> FAIL: the falsifying observation is the commands erroring on an unset variable, and the wiring supplies its own input by assigning $EVIDENCE itself.
single-shell regression -> FAIL: the falsifying observation is a non-zero exit of the : builtin, which occurs under dash; the check runs under macOS sh, where the defect cannot appear.
timed regression row -> FAIL: the falsifying observation is a newline-rich sub-ceiling payload costing far more than measured; single-record fixtures never reach the record accumulator's quadratic branch.
dash release evidence -> FAIL: the falsifying observation is a hook-level dash failure; the hook ran under /bin/sh, so the defect cannot appear in that run.
§5.4 applied to "It bounds the scan, not memory" — must FAIL on exhaustiveness: FAIL: it names the two axes it was checked against (scan, memory) and never states whether that list is exhaustive, which is exactly what the appended clause requires.
counterfactual: all four were reviewed during the 0.8.0 cycle under the §5 text as it
read before this change and each was accepted by at least one review looking for exactly
this; one (the single-shell test) reached the released artifact.

prompt conformance

workflow-init.md (invariant 11 surface) — all 12 items:
1 Target model named — PASS on the naming half: line 9 names Claude via Claude Code and the edit does not touch it. Second half, stated rather than glossed: the check against that model's current prompting page was made against this repo's distilled reading of those pages, docs/prompt-standards.md § "Verified model-specific notes (read 2026-07-04 — re-verify per Revalidation)", not against a live fetch in this cycle. Revalidation's stated trigger is a model generation change, which has not occurred since that read. Two of those notes bear on these additions and both hold: "literal instruction following — state the scope" (the lens sentence enumerates what to name rather than asking generally), and "coverage first, filter later" (unchanged; the additions ask for more coverage, never less). A live re-read was not performed, and this line says so instead of implying one.
2 Success criteria explicit — PASS: each inserted sentence states the artifact the reviewer must produce (the named list plus its grep; the named observation plus the wiring judgement; the settled mechanical facts).
3 Stop conditions defined — PASS: the sentences sit inside existing loops that already carry their stop rules (clean final pass, stop-and-surface); none introduces a new terminal state.
4 Output format with example — PASS: the surrounding finding-line format and the literal NO FINDINGS example are unchanged and are what these questions feed.
5 Structured sections — PASS: each sentence lands inside its existing paragraph; no section boundary moves.
6 Rules carry their why — PASS after a pass-3 fix. The lens sentence carries "because asked as an open question alone this lens missed three such statements in one cycle"; the counterfactual carries "reports success because of how it was wired, not because the thing it checks succeeded". The sweep sentence originally carried a reason only for its subordinate constraint (inspect rather than run, "since a command quoted in a spec may be destructive or an intentional failure") and none for the constraint itself; Gate-B pass 3's quality branch found that, and the sentence now carries "because a read pass spends expensive judgement on what a parser settles in seconds and misses it anyway". This line previously recorded a PASS on the strength of the subordinate clause, which is the item-11 shape this round hardens — noted rather than quietly corrected.
7 No contradictions with CLAUDE.md / AGENTS.md — PASS: the cross-finding conflict check returned none, and mirror parity confirms the template says what CLAUDE.md says.
8 Token-lean — PASS under the exception item 11 states by name: an inline template cannot point at a file the downstream project does not have, so it restates and the copies are kept in sync (invariant 8). Mirror parity is the sync evidence.
9 Positive instructions — PASS, no exception needed: all three are positive imperatives (Name what…, Name the observation…, settle mechanically…).
10 Diagnostic states name their causes — PASS: the edit introduces no failure-state report, so it adds no unresolvable symptom.
11 Enforcement claims name their mechanism — PASS: none of the three claims anything is enforced or caught; they are asks, and the CHANGELOG entry and ledger rows record "none of the three is a check" explicitly rather than leaving the reader to infer coverage.
12 Calibrated emphasis — PASS: bold falls only on the imperative clause, matching the §5 discipline-gate emphasis this template already carries as a deliberate exception.
CLAUDE.md, AGENTS.md (not on invariant 11's list) — items 6,7,8,9,11,12:
6 PASS — each of the three §5 sentences and the AGENTS.md clause carries its reason ("because an enumeration read as complete guarantees the axes it omits").
7 PASS — conflict check verdict: none; the four sites are distinct and no pair weakens another.
8 PASS — CLAUDE.md is the authoritative copy; only the template restates, under invariant 8.
9 PASS by the exemption item 9 states in its own text, cited rather than assumed: §5.4's clause continues an existing prohibition whose subject IS the prohibition ("delete any part of the sentence that outruns it"), and restating it positively would lose the boundary it draws. The three §5 sentences are positive imperatives and need no exemption.
11 PASS — no sentence claims enforcement; each ledger row states STILL INSTRUCTION-BACKED and names what is not done (nothing runs the grep, nothing tests whether a check could have failed, nothing runs or records the sweep).
12 PASS — emphasis limited to the imperative clause, consistent with §5's existing gate language.
five split stories — in-spirit brief review: PASS. Each names its success criteria as acceptance criteria; each carries an explicit stop condition as criterion 1 (design pauses for Daniel's confirmation of the profile); each states what is established versus assumed — the four trigger stories carry a kept/moved/dropped inventory of their source row's conditions, and the unprofiled headers say why no profile was written rather than fabricating one. The fifth (passive metrics over the ledger) was added at Gate-B pass 1 and reviewed on the same terms.

mirror parity

each §5 sentence appears once in CLAUDE.md and once in workflow-init.md: CONFIRMED — all three matched exactly once per file under whitespace normalization (identical word sequences; wrapping differs only), each under the corresponding heading.

gate-b fix record

Pass 1 (both branches, 1 Major each, same subject): the four appended ledger rows take the ledger from 18 to 22 and cross P8's stated 20-row trigger, which the round had not recorded. Validated against the counts (18 at main, 22 after) and against spec D3, whose scope is every trigger THIS ROUND fires and whose rejected alternative excludes only triggers already fired in the backlog. Applied: P8's row marked TRIGGER FIRED, a fifth split story written, and the statements the fix falsified corrected. Found by the standing lens this round adds: the diff changed a count, and a statement keyed to that count sat in a file the diff did not touch.
Pass 2 (spec 6 findings, quality 1; 6 Major, 1 Minor): the pass-1 fix corrected the headline counts and missed the sites that carry the same claim in other words — spec §2's summary, §8's inventory sentence, completion sentence and numbered list, the cited story's acceptance criteria and amendment log, and the plan's Task 5 and Task 6 bodies, step counts and must-be-true checks. All corrected here, and the P8 story is now a numbered item in §8 with the same detail as items 1–4. The quality branch found item 1 of the prompt-standards checklist recorded on its naming half only; the record above now states what was and was not checked. The pass-1 fix record originally claimed every falsified statement had been corrected — pass 2 disproved that claim, which is why this entry names the sites rather than asserting completeness.
Pass 3 (spec 1 Major, quality 2 Major; one raised by both branches): Task 5's heading, file count and classification sentence still said "three" though Step 3b makes it four — the same count-keyed drift a third time, now inside the amendment itself; and the Gate-A sweep sentence carried a reason for its subordinate constraint and none for the constraint itself, which prompt-standards item 6 requires. Both fixed. The sweep fix changed a sentence quoted verbatim in four other places, so ledger row D's ref, spec §5.3's block quote, the plan's Task 1 Step 3 block and the plan's copy of row D were all updated in the same commit; mirror parity re-verified after the rewording (one occurrence per file, identical word sequence). Row D was amended rather than superseded because it is being authored in this cycle and has not landed — the append-only rule protects the committed record, and the absence of a sanctioned move for a landed row is what the ledger-supersession story exists to settle.
Pass 4: NO FINDINGS on both branches, validated on disk (two lines each, NO FINDINGS then END OF FINDINGS (0 total)). Four passes against a floor of three, final pass clean, every fix amended into the WIP commit before the next call so each review read a range containing it.

cross-finding conflict check

Task 0 Step 2 verdict: no conflict. The four hardenings touch four distinct sites and act at different moments on different objects — the lens on a Gate-B diff, the counterfactual on a Gate-B evidence claim, the sweep before a Gate-A read pass, the Don't on prose about mechanisms. No pair asks a reviewer for contradictory behaviour, and §5.3's "inspect rather than run" limits the sweep without exempting anything from §5.1 or §5.2.

Summary by CodeRabbit

Documentation
- Expanded review guidance for mechanical artifact validation, statement tracing, and evidence verification.
- Added hardening guidance for detecting documentation drift, skipped checks, and masked verification failures.
- Added design specifications and follow-up stories covering ledger handling, recurrence analysis, routing, metrics, and version tracking.
- Updated task records with trigger and observation results.
Chores
- Updated the development workflow plugin to version 0.8.1.
- Added changelog notes describing the updated review guidance.

The round drops from seven findings landing in one cycle to four hardenings, four ledger rows, one parked row and four split stories. Two exits fired on evidence rather than judgement: - The harden-finding guard-scope precheck left the round. Four Gate-A findings independently demanded row metadata, a ledger format change and a collision state machine, which is the machinery exit the story names. It becomes its own story carrying six observed failures and their open questions. - The §5 additions were cut back to one sentence each after review found they had grown into paragraphs, one of them a whole procedure. C4 and C5 leave the ledger for a parked row. Both fall inside the 2026-07-19 Don't, whose operative instruction already requires what they omitted, so no textual repair exists to log — a compliance recurrence, not a rule defect. Their placement had moved four times across four passes, which is the count prompt-standards item 11 names for stopping rather than refining again. Version is 0.8.1, not 0.9.0: with the skill change split out the round is #16's shape, and #16 took a patch. The #15 minor precedent applied to a skill's procedure changing, which this round no longer does. Gate A: eight passes, all valid under the file-first protocol, every finding dispositioned in writing under .context/codex-reviews/. Pass 8 was the first where all riders passed — both self-tests (§5.2 rejects its four cases, §5.4 rejects F8) and the per-case precheck audit. The final pass was not clean; its seven findings are fixed and re-verified, and pass 9 runs against these bytes. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.

Five findings, none needing a new decision: - The pass-8 C4/C5 split had reached the ledger-row table and §6.1 but not §2, D6 or §6.2, which still described row B as carrying all three cases with a bot source. Row B is F8 alone, source gate-a; C4/C5 are parked. - §8's inheritance inventories were incomplete in the section that makes completeness acceptance-critical. Finding A gains the durable-handoff constraint and the deferred-minting rule; Finding B gains the wire-format point and the no-schedule-pressure note. - The profile criterion read "before design begins", which these stories cannot satisfy — they exist because design on them was cut short. Now "before design resumes", naming who proposes, who confirms and when the header is written. - The AC 7 amendment had no log entry; added. - The story-path collision rule was check-then-write; classification now happens immediately before each write, failing closed if the path appeared meanwhile. Gate A closes at nine passes, all valid under the file-first protocol, every finding dispositioned in writing under .context/codex-reviews/. Pass 9 returned no finding requiring a decision, which is the pinned exit. All riders passed: §5.2 rejects its four cases, §5.4 rejects F8, and the disposition audit confirms F1→A, F2 evidence→C, F2 claim→parked, F3→C, F4→C, F5→D, F6→C, F8→B with none missing or doubled. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.

Nine tasks over the spec closed at b9111a2. Opens with the deliverables checklist, states decisions without their revision history, and carries the exact text of every artifact it asks for: four ledger rows, four split stories, six todos updates, the CHANGELOG entry. Task ordering follows the dependencies rather than the spec's section order: hardenings first, then the stories, then todos (which cite the story paths), then the ledger rows (which cite the hardenings and the parked row), then the version bump, then validation and Gate B. Two defects found by the plan's own pre-commit sweep, both instances of classes this round hardens: - A mirror-parity check used process substitution, a bashism, in a repo whose invariant 4 is POSIX sh and whose CI runs sh. Replaced with a POSIX loop that also guards against two empty extractions comparing equal — a check that cannot fail is the verification-masks-failure shape. - The sweep itself reported one failure flag for two independent checks, so a shell-syntax failure masked whether the path check had passed. Split. All 23 fenced blocks parse under sh -n. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption; Gate A on the plan runs next.

Nineteen findings, all accepted. The one that mattered most: `${lit:0:60}` is bash-only substring expansion, and the pre-commit sweep passed it because `sh -n` is a parse check while the failure is at runtime — `dash -c` gives `Bad substitution`. Every block now parses under both `sh -n` and `dash -n`, and the sweep greps for the constructs neither parse check catches. Mechanical correctness: - `grep -c` exits 1 on a zero count, so every expected-zero check would have aborted on the correct result. All captured and compared numerically. - The battery includes `check-version-bump.sh main`, which fails on a committed plugins/ change with no bump. The manifest bump moved to Task 1, so Tasks 2-7 no longer assert an exit status the battery cannot produce. - The "only AGENTS.md" grep could never succeed, since the spec and plan both quote the phrase; narrowed to the one operative copy. Structure: the three trigger stories had seven sections against a six-section template — the inheritance inventory is now a subsection. Path collisions are classified immediately before each write, with set -C and a symlink test. The cross-finding conflict check moved ahead of every edit, per the spec. Claims the plan could not support: two `/path/to/` placeholders in a plan asserting it had none, and validation results with no destination — both now `.context/evidence-0.8.1.md`, defined before it is read, with a guard that stops the amend if the template ships unfilled. A split story also claimed §5 would stop on a fabricated profile; it would not, and the wording is corrected in all four. The story's AC 7 still read "before design begins" while the spec and the amendment log read "resumes" — drift from the pass-9 spec fix, corrected here. My first grep for it found nothing, being line-oriented against text wrapped across two lines; the normalized search found it. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.

Eleven findings, all accepted. Ten are one class: a verification block that reports a failure and then exits 0, or that cannot see the failure at all — in a plan whose deliverable includes the verification-masks-failure hardening. Found by the reviewer, not by the sweep run before the previous commit. - Nine blocks printed their verdict and ended on an echo, so shell status was 0 on every mismatch. All now accumulate into rc and exit with it. - The cited-story loop ran in a pipeline subshell, discarding rc=1; it could print MISS and still report success. Reads from a redirected file now, and asserts exactly four distinct paths while rejecting symlinks. - applied() and FIRST_WIP were defined in one fenced block and used in later ones. Agentic workers run each block in a fresh shell, so neither existed. - Marker counts cannot tell "already applied" from "partially applied"; the guard now compares the whole intended block with three explicit branches. - Mirror parity checked equality without cardinality, so duplicates or two empty extractions would have reported equivalence. Path handling: a symlink whose target held identical text was eligible for reuse, which would stage a link rather than the story bytes — now an unconditional stop, tested before -e. Placeholder reservation closed the check-to-create race and opened a create-to-write one; content is now installed atomically with ln. Creation failures no longer all blame a concurrent writer. The plan asked for counts the battery does not print. Established by running it: the hook suite prints "all passed" with no total, the invariants and version-bump suites print their assertion counts, shellcheck prints nothing. The evidence template now asks for terminal lines verbatim and labels the hook-suite count as derived, with the deriving command — itself run before being written down. The no-PR story's inheritance inventory had dropped one of its source row's two trigger alternatives, in the inventory whose purpose is to drop none. Sweep after fixing: 38 blocks, all parse under sh and dash, no bash-isms, no pipeline-subshell accumulation, every failure path exits nonzero. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.

Gate-A plan pass 3 returned two Blockers and a rebound to 19 findings, and the pattern was clear: the plan's content had been stable since pass 1, while the 38 bespoke shell blocks around it were a second implementation generating more defects than they caught. Both Blockers and most Majors lived in that surface. Blocker 1: no step created a feature branch, and the checkout was main, seven commits ahead. `git push -u origin HEAD` would have pushed straight to main, bypassing the version-bump gate that invariant 12's checker only applies on pull requests. Task 0 now creates the branch before any edit, and both the push and the PR refuse main explicitly. Blocker 2: the amend and PR fences read $EVIDENCE in fresh shells without defining it — the self-contained rule added in pass 2, broken in the blocks written while adding it. `cat ""` fails while `git commit --amend` still succeeds, so the evidence would have vanished silently. Every block reading it now defines and validates it first. A third defect came from pass 2's own fix: `tr '\n' ' ' | grep -c` flattens the file to one line, so it returns 0 or 1 and cannot count duplicates. Verified against a two-duplicate fixture. The cardinality checks added to detect duplicates could not detect duplicates. Five checks are kept, each self-contained and each exiting nonzero on failure: branch preflight, battery, ledger precondition, self-tests, <fill guard. Everything else became a one-line must-be-true — Gate B reviews the diff that actually resulted, which is the check the scaffolding was impersonating. 24 blocks now, mostly git add/commit pairs. All parse under sh and dash; no bash-isms; no flatten-then-count; no pipeline-subshell accumulation. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.

Gate-A plan pass 4: one Blocker, ten Majors, eight of eleven inside the git/Gate-B/PR procedure while the hardening content stayed stable for a fourth pass. The Blocker: Task 9 told the executor to stage each Gate-B fix and never to amend it into the WIP commit. mcp__codex__review reads a git range, so a staged-only fix is not in it — every post-fix pass would have re-reviewed the pre-fix commit and reported clean on unreviewed content, while the staged index made the pre-amend clean-tree precondition unsatisfiable. That is the parked "Gate-B fingerprints disk; the reviewer reads history" row, inside the fix loop. The cause was structural: §5 already specifies that protocol, and Task 9 restated it. Every restatement is a copy that can drift, which prompt-standards item 11 says in as many words, and this one drifted by dropping the amend. Task 9 now keeps only the round-specifics — evidence template, the four self-test cases, prompt-conformance scope — and cites §5 for the squash, Gate-B loop, amend and close. One clause names the dropped step, because naming a step is not re-specifying a procedure. Also corrected: the plan claimed five executable checks each exiting nonzero on failure, when the self-tests are prose readings with no oracle. It now says four executable checks plus one recorded reading, and says why — applying a prompt sentence to a case is a judgement, and a script asserting it would assert its author's opinion. An enforcement claim with no mechanism, in the round that hardens that class. The rest: the branch preflight now requires a clean tree; atomic no-clobber story creation is restored per the spec; identical-file reuse skips its commit instead of failing on an empty one; the hook-count derivation uses mktemp and captures the suite's status before counting; push and PR require the exact branch name rather than merely not-main; the PR body is read with an explicit stop so a cat failure cannot open an empty PR; and resumed evidence must be a regular file naming this story and branch. 22 blocks now, from 38 two passes ago. All parse under sh and dash. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.

Nine findings, five Major, no Blockers, none requiring a decision. The sharpest: the plan appended evidence case 3 beneath the scope-blind row's own premise — that the workaround "lives in ledger prose, which agents do not read" — which this round disproved, since harden-finding step 3 does re-read the log. Task 6 now corrects the premise in the same change before appending. Leaving it would have been docs-drift created by the round that hardens it. The rest, in order of consequence: - The branch preflight's resumed path printed an ahead-count while claiming the executor could confirm the range holds only this plan's commits. It now prints the actual main..feature commit list with an explicit stop. - Evidence creation had the classify-then-create race the story paths were already fixed for. Same temp-file-plus-ln treatment; this file is quoted into the commit body and the PR, so foreign content there is worse, not better. - The <fill guard's branch binding was an unanchored grep that "OldBranch: harden-0-8-0-and-pr-21" would satisfy, and it never checked the checked-out branch before a history-mutating amend. Now whole-line -qxF matches for Branch and Story, plus a HEAD equality check in the same block. - The PR block re-read mutable git-ignored evidence after the guard's window with only a nonempty test. The full check set is repeated before the read. - Task 1's first battery runs before its own commit, so check-version-bump compares a range containing neither the edit nor the bump — vacuous, where the plan said "real check". Corrected, naming the first meaningful run. - Task 6's steps named a row but no position within it; every status block now inserts immediately before that row's trigger sentence. - The temp-file recipe specified no cleanup, leaving an untracked story copy on success and scratch on failure — both scanned by check-invariants.sh, which walks the working tree. trap on EXIT. - Nothing compared local HEAD to origin/<branch> before gh pr create. Gate A closes for the plan at five passes, all valid under the file-first protocol, every finding dispositioned under .context/codex-reviews/. Both settled decisions the pass was asked to judge survived: no dropped check whose violation would reach the commit undetected, and nothing round-specific lost in citing §5 rather than restating it. Docs-only (docs/**.md), so Gate B is N/A per CLAUDE.md §5's prose exemption.

# Validation evidence — hardening round 0.8.1 Story: docs/superpowers/stories/2026-08-03-hardening-round-0-8-0-and-pr-21-story.md Branch: harden-0-8-0-and-pr-21 ## battery exit status: 0 hook suite under sh: "all passed" (no assertion total, as expected) hook suite under dash: "all passed" (no assertion total, as expected) invariants suite: "all passed (123 assertions)" version-bump suite: "all passed (36 assertions)" check-invariants.sh: "invariant checks: ok" check-version-bump.sh main: "version-bump check: ok" claude plugin validate --strict: "✔ Validation passed" derived hook-suite assertion count (the suite prints none) — suite exit status captured separately from the count, so a partial count from a dead suite is not recorded: HOOK_SH=sh -> status 0, count 467 HOOK_SH=dash -> status 0, count 467 ## check (named verification), with its counterfactual §5.2 applied to the four cases in spec §10 — each must FAIL on the wiring half: 1. $EVIDENCE dry run -> FAIL: the falsifying observation is the commands erroring on an unset variable, and the wiring supplies its own input by assigning $EVIDENCE itself. 2. single-shell regression -> FAIL: the falsifying observation is a non-zero exit of the `:` builtin, which occurs under dash; the check runs under macOS sh, where the defect cannot appear. 3. timed regression row -> FAIL: the falsifying observation is a newline-rich sub-ceiling payload costing far more than measured; single-record fixtures never reach the record accumulator's quadratic branch. 4. dash release evidence -> FAIL: the falsifying observation is a hook-level dash failure; the hook ran under /bin/sh, so the defect cannot appear in that run. §5.4 applied to "It bounds the scan, not memory" — must FAIL on exhaustiveness: FAIL: it names the two axes it was checked against (scan, memory) and never states whether that list is exhaustive, which is exactly what the appended clause requires. counterfactual: all four were reviewed during the 0.8.0 cycle under the §5 text as it read before this change and each was accepted by at least one review looking for exactly this; one (the single-shell test) reached the released artifact. ## prompt conformance workflow-init.md (invariant 11 surface) — all 12 items: 1 Target model named — PASS on the naming half: line 9 names Claude via Claude Code and the edit does not touch it. Second half, stated rather than glossed: the check against that model's current prompting page was made against this repo's distilled reading of those pages, docs/prompt-standards.md § "Verified model-specific notes (read 2026-07-04 — re-verify per Revalidation)", not against a live fetch in this cycle. Revalidation's stated trigger is a model generation change, which has not occurred since that read. Two of those notes bear on these additions and both hold: "literal instruction following — state the scope" (the lens sentence enumerates what to name rather than asking generally), and "coverage first, filter later" (unchanged; the additions ask for more coverage, never less). A live re-read was not performed, and this line says so instead of implying one. 2 Success criteria explicit — PASS: each inserted sentence states the artifact the reviewer must produce (the named list plus its grep; the named observation plus the wiring judgement; the settled mechanical facts). 3 Stop conditions defined — PASS: the sentences sit inside existing loops that already carry their stop rules (clean final pass, stop-and-surface); none introduces a new terminal state. 4 Output format with example — PASS: the surrounding finding-line format and the literal NO FINDINGS example are unchanged and are what these questions feed. 5 Structured sections — PASS: each sentence lands inside its existing paragraph; no section boundary moves. 6 Rules carry their why — PASS after a pass-3 fix. The lens sentence carries "because asked as an open question alone this lens missed three such statements in one cycle"; the counterfactual carries "reports success because of how it was wired, not because the thing it checks succeeded". The sweep sentence originally carried a reason only for its subordinate constraint (inspect rather than run, "since a command quoted in a spec may be destructive or an intentional failure") and none for the constraint itself; Gate-B pass 3's quality branch found that, and the sentence now carries "because a read pass spends expensive judgement on what a parser settles in seconds and misses it anyway". This line previously recorded a PASS on the strength of the subordinate clause, which is the item-11 shape this round hardens — noted rather than quietly corrected. 7 No contradictions with CLAUDE.md / AGENTS.md — PASS: the cross-finding conflict check returned none, and mirror parity confirms the template says what CLAUDE.md says. 8 Token-lean — PASS under the exception item 11 states by name: an inline template cannot point at a file the downstream project does not have, so it restates and the copies are kept in sync (invariant 8). Mirror parity is the sync evidence. 9 Positive instructions — PASS, no exception needed: all three are positive imperatives (Name what…, Name the observation…, settle mechanically…). 10 Diagnostic states name their causes — PASS: the edit introduces no failure-state report, so it adds no unresolvable symptom. 11 Enforcement claims name their mechanism — PASS: none of the three claims anything is enforced or caught; they are asks, and the CHANGELOG entry and ledger rows record "none of the three is a check" explicitly rather than leaving the reader to infer coverage. 12 Calibrated emphasis — PASS: bold falls only on the imperative clause, matching the §5 discipline-gate emphasis this template already carries as a deliberate exception. CLAUDE.md, AGENTS.md (not on invariant 11's list) — items 6,7,8,9,11,12: 6 PASS — each of the three §5 sentences and the AGENTS.md clause carries its reason ("because an enumeration read as complete guarantees the axes it omits"). 7 PASS — conflict check verdict: none; the four sites are distinct and no pair weakens another. 8 PASS — CLAUDE.md is the authoritative copy; only the template restates, under invariant 8. 9 PASS by the exemption item 9 states in its own text, cited rather than assumed: §5.4's clause continues an existing prohibition whose subject IS the prohibition ("delete any part of the sentence that outruns it"), and restating it positively would lose the boundary it draws. The three §5 sentences are positive imperatives and need no exemption. 11 PASS — no sentence claims enforcement; each ledger row states STILL INSTRUCTION-BACKED and names what is not done (nothing runs the grep, nothing tests whether a check could have failed, nothing runs or records the sweep). 12 PASS — emphasis limited to the imperative clause, consistent with §5's existing gate language. five split stories — in-spirit brief review: PASS. Each names its success criteria as acceptance criteria; each carries an explicit stop condition as criterion 1 (design pauses for Daniel's confirmation of the profile); each states what is established versus assumed — the four trigger stories carry a kept/moved/dropped inventory of their source row's conditions, and the unprofiled headers say why no profile was written rather than fabricating one. The fifth (passive metrics over the ledger) was added at Gate-B pass 1 and reviewed on the same terms. ## mirror parity each §5 sentence appears once in CLAUDE.md and once in workflow-init.md: CONFIRMED — all three matched exactly once per file under whitespace normalization (identical word sequences; wrapping differs only), each under the corresponding heading. ## gate-b fix record Pass 1 (both branches, 1 Major each, same subject): the four appended ledger rows take the ledger from 18 to 22 and cross P8's stated 20-row trigger, which the round had not recorded. Validated against the counts (18 at main, 22 after) and against spec D3, whose scope is every trigger THIS ROUND fires and whose rejected alternative excludes only triggers already fired in the backlog. Applied: P8's row marked TRIGGER FIRED, a fifth split story written, and the statements the fix falsified corrected. Found by the standing lens this round adds: the diff changed a count, and a statement keyed to that count sat in a file the diff did not touch. Pass 2 (spec 6 findings, quality 1; 6 Major, 1 Minor): the pass-1 fix corrected the headline counts and missed the sites that carry the same claim in other words — spec §2's summary, §8's inventory sentence, completion sentence and numbered list, the cited story's acceptance criteria and amendment log, and the plan's Task 5 and Task 6 bodies, step counts and must-be-true checks. All corrected here, and the P8 story is now a numbered item in §8 with the same detail as items 1–4. The quality branch found item 1 of the prompt-standards checklist recorded on its naming half only; the record above now states what was and was not checked. The pass-1 fix record originally claimed every falsified statement had been corrected — pass 2 disproved that claim, which is why this entry names the sites rather than asserting completeness. Pass 3 (spec 1 Major, quality 2 Major; one raised by both branches): Task 5's heading, file count and classification sentence still said "three" though Step 3b makes it four — the same count-keyed drift a third time, now inside the amendment itself; and the Gate-A sweep sentence carried a reason for its subordinate constraint and none for the constraint itself, which prompt-standards item 6 requires. Both fixed. The sweep fix changed a sentence quoted verbatim in four other places, so ledger row D's ref, spec §5.3's block quote, the plan's Task 1 Step 3 block and the plan's copy of row D were all updated in the same commit; mirror parity re-verified after the rewording (one occurrence per file, identical word sequence). Row D was amended rather than superseded because it is being authored in this cycle and has not landed — the append-only rule protects the committed record, and the absence of a sanctioned move for a landed row is what the ledger-supersession story exists to settle. Pass 4: NO FINDINGS on both branches, validated on disk (two lines each, `NO FINDINGS` then `END OF FINDINGS (0 total)`). Four passes against a floor of three, final pass clean, every fix amended into the WIP commit before the next call so each review read a range containing it. ## cross-finding conflict check Task 0 Step 2 verdict: no conflict. The four hardenings touch four distinct sites and act at different moments on different objects — the lens on a Gate-B diff, the counterfactual on a Gate-B evidence claim, the sweep before a Gate-A read pass, the Don't on prose about mechanisms. No pair asks a reviewer for contradictory behaviour, and §5.3's "inspect rather than run" limits the sweep without exempting anything from §5.1 or §5.2.

cursor · 2026-08-04T15:31:13Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

coderabbitai · 2026-08-04T15:32:02Z

📝 Walkthrough

Walkthrough

The PR documents a hardening round for review gates. It updates gate guidance, adds a taxonomy class and ledger records, creates five follow-up stories, updates task tracking, publishes a plan and design, and bumps the plugin to version 0.8.1.

Changes

Hardening round

Layer / File(s)	Summary
Design and round scope `docs/superpowers/specs/...`, `docs/superpowers/stories/2026-08-03-hardening-round-0-8-0-and-pr-21-story.md`	Defines the findings, decisions, acceptance criteria, deliverables, constraints, and non-goals for the hardening round.
Execution plan `docs/superpowers/plans/2026-08-04-hardening-round-0-8-0-and-pr-21.md`	Sequences the documentation edits, story creation, ledger updates, validation steps, and release work.
Gate guidance and release metadata `AGENTS.md`, `CLAUDE.md`, `plugins/dev-workflow/commands/workflow-init.md`, `plugins/dev-workflow/.claude-plugin/plugin.json`, `plugins/dev-workflow/CHANGELOG.md`	Adds mechanical artifact checks, expanded drift tracing, reachable evidence checks, mirrored workflow guidance, and the 0.8.1 release metadata.
Taxonomy, ledger, and task records `docs/hardening-log.md`, `docs/hardening-taxonomy.md`, `todos.md`	Adds the mechanical-check taxonomy class, four ledger entries, and trigger and recurrence observations.
Follow-up story specifications `docs/superpowers/stories/2026-08-04-*.md`	Defines deferred work for guard-scope checks, ledger supersession, no-pull-request routing, passive metrics, and section-5 version stamps.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

dsnger/dev-workflow-kit#8: Extends the same Gate-B documentation and verification-claim guidance.
dsnger/dev-workflow-kit#9: Provides the earlier file-based findings protocol used by these gate-template updates.
dsnger/dev-workflow-kit#21: Introduces the Gate-A and Gate-B workflow guidance that this PR further documents.

Poem

I’m a rabbit with a checklist bright,
Gate facts hop into the light.
Stories sprout and ledgers grow,
Version numbers neatly flow.
Mechanical checks lead the way—
Squeak, review, and ship today!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: hardening four classes from the 0.8.0 cycle and PR `#21`.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps · 2026-08-04T15:35:31Z

Greptile Summary

The PR hardens the repository’s review guidance in response to failures observed during the 0.8.0 cycle and PR #21.

Adds mirrored Gate-A and Gate-B review instructions to the authoritative and scaffolded workflow prompts.
Extends guidance for evaluating claims about mechanism coverage and adds a corresponding hardening taxonomy class.
Records four hardening-ledger entries and splits five triggered follow-up stories from the backlog.
Bumps the dev-workflow plugin to 0.8.1 and documents the release.

Confidence Score: 5/5

The PR appears safe to merge; no concrete changed-code defect or independently actionable non-blocking issue was identified.

The shipped prompt additions are consistently mirrored, the release metadata matches the plugin changes, and the verified ledger and story counts support the documented trigger transitions.

Important Files Changed

Filename	Overview
CLAUDE.md	Adds three review-hardening instructions that are consistently mirrored in the scaffolded workflow template.
plugins/dev-workflow/commands/workflow-init.md	Updates the inline CLAUDE.md template with wording and placement equivalent to the authoritative prompt.
AGENTS.md	Extends the gate-claim guidance to require explicit treatment of coverage axes and exhaustiveness.
docs/hardening-log.md	Appends four well-scoped hardening records, bringing the ledger from 18 to 22 rows.
docs/hardening-taxonomy.md	Adds the mechanical-check-skipped-before-review class and distinguishes it from checks that run but cannot expose failure.
todos.md	Records fired and unfired triggers and links the resulting split stories consistently with the verified counts.
plugins/dev-workflow/.claude-plugin/plugin.json	Correctly advances the plugin patch version to 0.8.1 for the shipped prompt changes.
plugins/dev-workflow/CHANGELOG.md	Accurately summarizes the three prompt hardenings, their instruction-only enforcement level, and the deferred skill change.

_{Reviews (1): Last reviewed commit: "Harden four classes from the 0.8.0 cycle..." | Re-trigger Greptile}

coderabbitai

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/superpowers/plans/2026-08-04-hardening-round-0-8-0-and-pr-21.md`:
- Around line 841-849: Update the expected counts in the ledger verification
command near the occurrence-count pairs and the corresponding section around
rows A and B: change docs-drift and unverified-enforcement-claim from 5 to 4 so
the precondition reflects four existing occurrences and the current round
produces occurrence five. Keep verification-enforcement-claim at 1 and
mechanical-check-skipped-before-review at 0 unchanged.

In
`@docs/superpowers/stories/2026-08-04-harden-finding-guard-scope-precheck-story.md`:
- Around line 21-22: Remove the named reviewer reference and replace it with
neutral wording while preserving the confirmation requirement. Apply this in
docs/superpowers/stories/2026-08-04-harden-finding-guard-scope-precheck-story.md
at lines 21-22 and 35,
docs/superpowers/stories/2026-08-04-hardening-ledger-supersession-story.md at
line 41,
docs/superpowers/stories/2026-08-04-ledger-route-without-pull-requests-story.md
at line 40,
docs/superpowers/stories/2026-08-04-passive-metrics-over-the-ledger-story.md at
line 42, and
docs/superpowers/stories/2026-08-04-section-5-version-stamp-story.md at line 38;
use wording such as “the designated approver” and ensure no review canary
remains.
- Around line 45-46: Update criterion 6 in the story to reference `AGENTS.md` →
`## Don'ts` and add an auditable disposition table covering every condition from
current steps 3 and 7, marking each as kept, moved, or deliberately dropped
before design resumes.
- Around line 34-36: Update the profile-confirmation criteria to require a
profile-log entry and invalidation of prior overrides whenever axes change.
Apply this to
docs/superpowers/stories/2026-08-04-harden-finding-guard-scope-precheck-story.md
lines 34-36,
docs/superpowers/stories/2026-08-04-hardening-ledger-supersession-story.md lines
40-42,
docs/superpowers/stories/2026-08-04-ledger-route-without-pull-requests-story.md
lines 39-41,
docs/superpowers/stories/2026-08-04-passive-metrics-over-the-ledger-story.md
lines 41-43, and
docs/superpowers/stories/2026-08-04-section-5-version-stamp-story.md lines
37-39, preserving the existing confirmation and header-update requirements.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b8d9d6b8-fe39-43f4-9b07-75c1f948212e

📥 Commits

Reviewing files that changed from the base of the PR and between bd510ef and a4332c8.

📒 Files selected for processing (16)

AGENTS.md
CLAUDE.md
docs/hardening-log.md
docs/hardening-taxonomy.md
docs/superpowers/plans/2026-08-04-hardening-round-0-8-0-and-pr-21.md
docs/superpowers/specs/2026-08-03-hardening-round-0-8-0-and-pr-21-design.md
docs/superpowers/stories/2026-08-03-hardening-round-0-8-0-and-pr-21-story.md
docs/superpowers/stories/2026-08-04-harden-finding-guard-scope-precheck-story.md
docs/superpowers/stories/2026-08-04-hardening-ledger-supersession-story.md
docs/superpowers/stories/2026-08-04-ledger-route-without-pull-requests-story.md
docs/superpowers/stories/2026-08-04-passive-metrics-over-the-ledger-story.md
docs/superpowers/stories/2026-08-04-section-5-version-stamp-story.md
plugins/dev-workflow/.claude-plugin/plugin.json
plugins/dev-workflow/CHANGELOG.md
plugins/dev-workflow/commands/workflow-init.md
todos.md

dsnger added 11 commits August 3, 2026 17:41

docs(intake): add hardening-round-0-8-0-and-pr-21 story

bdc81b5

docs(spec): hardening round over the 0.8.0 cycle and PR #21

9f1c092

coderabbitai Bot reviewed Aug 4, 2026

View reviewed changes

dsnger merged commit 6405406 into main Aug 5, 2026
3 checks passed

Navigation Menu

Harden four classes from the 0.8.0 cycle and PR #21 - #22

Harden four classes from the 0.8.0 cycle and PR #21#22
dsnger merged 11 commits into
mainfrom
harden-0-8-0-and-pr-21

dsnger commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

cursor Bot commented Aug 4, 2026

Uh oh!

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

greptile-apps Bot commented Aug 4, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dsnger commented Aug 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Validation evidence — hardening round 0.8.1

battery

check (named verification), with its counterfactual

prompt conformance

mirror parity

gate-b fix record

cross-finding conflict check

Summary by CodeRabbit

Uh oh!

cursor Bot commented Aug 4, 2026

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

greptile-apps Bot commented Aug 4, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dsnger commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading