[overlordxrz-source]

Latest remediation — independent re-review requested

Current exact head: 207aa92ba79273664f12bd68ce36a6ee86a42d4e.

OpenCode's remaining P2 finding at e30c1e58e93a27f55a99fa3857aac354693a5463 is corrected on this existing branch. The legacy alias is now keyed by (ADR identity, normalized status); only (ADR-004, accepted research policy) maps to accepted. ADR-007, synthetic ADR-010 and every other identity reject that spelling.

• a662a8d: committed the regressions before the fix; 4 failed, 31 passed, independently reproducing parser and generator/checker acceptance for the wrong identities.
• 5b4b120ad0f14c5afa788bdaccf00d15b65863fa: identity-scoped parser, exact governing grammar, regression/probe cases and protected process hash. Also rejects a blank status line consuming the next line, caught by a further failing grammar control.
• 4dd2c3d4299f88ba4f2b19b1c557d09c421dde01: derived Brief regenerated from committed sources.
• 207aa92ba79273664f12bd68ce36a6ee86a42d4e: durable remediation evidence and branch-safe handoff.

Verification observed locally on the corrected head:

• 46 context tests passed; 291 offline tests passed, 1 hardware test deselected.
• Architecture PASS; context/provenance/freshness PASS (23 sources, 18 protected documents, 9 accepted decisions).
• All 12 before/after disposable mutation cases inspected. ADR-004 legacy spelling remains valid (generator/checker 0/0). ADR-007 and synthetic ADR-010 now fail (1/1), rather than passing (0/0) at the old head. Existing integrity negative controls stay blocked.
• Standard accepted/proposed/superseded states, malformed/pending variants, identity scoping and shared generator/checker behavior are covered. Both use context_brief.parse_adrs.

Hosted CI: SUCCESS at this exact head: run 40147822894. The offline suite and persistent-context integrity steps completed successfully.

Exact allowable grammar and the sole exception are in DECISION_CHANGE. Metadata after the first middle dot is informational; CI still cannot authenticate owner consent.

Remediation report and commands · Saved failing controls / before-after evidence.

For independent re-review, check out this exact correction head in a separate clone and run:

PYTHONDONTWRITEBYTECODE=1 python -m pytest -q -p no:cacheprovider tests/test_context_protocol.py tests/test_context_review.py
PYTHONDONTWRITEBYTECODE=1 python -m pytest -q -p no:cacheprovider -m 'not hardware'
PYTHONDONTWRITEBYTECODE=1 python tools/check_context.py
PYTHONDONTWRITEBYTECODE=1 python tools/check_architecture.py
review_out=$(mktemp -d)
python tools/review_context_probes.py --ref e30c1e58e93a27f55a99fa3857aac354693a5463 --out "$review_out/before"
python tools/review_context_probes.py --ref 207aa92ba79273664f12bd68ce36a6ee86a42d4e --out "$review_out/after"

Inspect individual result codes, not just the driver's exit. All mutations happen in disposable clones. No accepted ADR, architectural intent, sensor application, firmware, hardware, CI settings or frozen Alpha evidence changed. No Context Autopilot was started; no PR was merged. The historical 322-test PR10 rehearsal below is separate, not incorporated or rerun for this fix.

OpenCode: please independently re-review exact head 207aa92ba79273664f12bd68ce36a6ee86a42d4e, including identity scoping and the grammar's negative controls. Existing REQUEST CHANGES remains until independent verification.

---

Historical original publication — earlier head and test counts, superseded by the update above

This corrects two governance-integrity defects independently reproduced in PR #11 at b58c96ef998e68e841b12d9ad671325053c009e4: omitted protected sources could change without invalidating the Brief, and ADR status prefixes could promote pending approval to active accepted. This draft targets docs/persistent-context-protocol, not main. Independent re-review requested; do not merge either PR as part of verification.

Exact correction head: e30c1e58e93a27f55a99fa3857aac354693a5463.
Original PR #11 history is preserved. This head adds four commits without rewriting it:

• 3f9c647: regressions first (7 failed, 1 passed before fixes).
• 2a5b7489330d4c0dd4c57717d5192c1a02e2a382: enforce all 18 protected sources; exact ADR statuses, explicit legacy alias, and preserve full decision maturity wording.
• bd3433c8410dd0d3ac51de6f1a64760a00fd4521: regenerate the derived Brief from the corrected source configuration.
• e30c1e58e93a27f55a99fa3857aac354693a5463: report, machine-readable evidence, branch-safe handoff and reproducible disposable-clone probes.

No owner-approved architecture, protected canonical document, firmware, sensor application, frozen Alpha evidence or CI configuration changed. The old Brief source commit 71a54ede… was valid at the original final head: all declared/protected source bytes still matched. The freshness defect concerns later changes to the six omitted governance sources.

Exact before/after reproduction

Use a separate clone; do not check out or reset OpenCode's active worktree. Fetch full history, check out this correction branch, create a local environment and install the CI dependencies. Commands below use python3; adapt the interpreter to the existing project environment if preferred.

git clone https://github.com/overlordxrz-source/specter-x.git specter-x-pr11-independent
cd specter-x-pr11-independent
git fetch origin review/pr11-context-audit docs/persistent-context-protocol
git checkout --detach e30c1e58e93a27f55a99fa3857aac354693a5463
python3 -m venv .venv
. .venv/bin/activate
python -m pip install -r requirements-ci.txt
review_out=$(mktemp -d)
PYTHONDONTWRITEBYTECODE=1 python tools/review_context_probes.py --ref b58c96ef998e68e841b12d9ad671325053c009e4 --out "$review_out/before"
PYTHONDONTWRITEBYTECODE=1 python tools/review_context_probes.py --ref e30c1e58e93a27f55a99fa3857aac354693a5463 --out "$review_out/after"
cat "$review_out/before/results.json" "$review_out/after/results.json"
PYTHONDONTWRITEBYTECODE=1 python -m pytest -q -p no:cacheprovider -m 'not hardware'
PYTHONDONTWRITEBYTECODE=1 python tools/check_context.py
PYTHONDONTWRITEBYTECODE=1 python tools/check_architecture.py

Both mutation suites operate in disposable clones; the source checkout is not mutated. Their process exit is not the aggregate assertion: inspect each case's exit_code in results.json.

Exact case / mutation	Before	After
governance_refreshed_without_brief: append to DECISION_CHANGE, update protected manifest, synthetic commit, leave Brief untouched	checker 0 / PASS (bug)	checker 1 / FAIL
invalid_status_prefix: set ADR-007 to accepted_pending_owner_approval, refresh manifest, synthetic commit, attempt Brief generation	generator 0, checker 0 / PASS (bug)	generator 1, checker 1 / FAIL
Missing source, tampered hash, stale state, nonexistent ADR reference, unrefreshed protected change	all checker 1	all checker 1
Baseline	checker 0	checker 0
unauthorized_all_refreshed: no owner approval, content + hashes + Brief all refreshed	checker 0	checker 0; explicit authorization limitation

The eight regression cases also cover invalid accepted/proposed/superseded suffixes, a valid proposed ADR staying inactive, missing protected-source coverage and preserving owner-directed/draft-implementation maturity. No accepted architecture intent was changed.

Fresh verification at the published SHA

• Corrected branch: 263 passed, 1 hardware test deselected; context PASS (23 sources, 18 protected, 9 accepted); architecture PASS; whitespace check clean.
• Original PR11 baseline from the independent audit: 255 passed, 1 deselected.
• Fresh disposable integration rehearsal with approved PR Bench foundation: bounded NODE recording, IMU validity and review handoff #10 at 8a84369941c74d5f884c9ec6cc33d10395223597: 322 passed, 1 deselected, context/architecture PASS, all 24 noncombined PR10 changed paths byte-preserved.
• These are local offline results, not a claim that the new hosted CI run has completed. No browser or live acquisition verification is claimed.

PR #10 integration is separate and unmerged

This correction PR contains no PR10 application changes. The 322 count belongs only to a temporary combined tree, not to this PR's own suite. Main/base for the rehearsal is f2ef96b0cfe48e2e47c9d4ac02b3ac8e3376a2a2.

To reproduce separately from the same checkout/environment:

git fetch origin pull/10/head
PYTHONDONTWRITEBYTECODE=1 python tools/review_pr11_integration.py --corrections-ref e30c1e58e93a27f55a99fa3857aac354693a5463 --out "$review_out/integration"
cat "$review_out/integration/summary.json" "$review_out/integration/python.log"

If PR10 has moved, obtain its exact approved SHA above before running; the script deliberately uses fixed reviewed heads.

Exact reconciliation strategy for the one content conflict, docs/handbook/agent-handoff.md:

1. Preserve PR11's canonical context handoff.
2. Preserve PR10's added historical evidence as docs/context/handoffs/approved-pr10-bench-evidence.md, with a canonical pointer; do not choose either entire handoff as a wholesale replacement.
3. Adjust relocated relative links from ../ to ../../. Initial rehearsal caught six broken links before this correction; retain that failure in the audit record.
4. Keep the automatically combined docs index. Verify the other 24 PR10 changed files byte-for-byte against approved PR10.
5. Refresh the reconciled protected manifest, record a source commit, regenerate the Brief and rerun context, architecture and combined offline tests. Any eventual real integration needs independent review at its resulting SHA.

The script only creates virtual Git tree objects and a disposable clone. It does not merge or move either PR branch.

Owner approval: explicit limit and proposed enforceable controls

CI checks hashes and grammar; it cannot independently authenticate owner approval. Refreshing every manifest and the Brief can still pass without consent, exactly as AUTOMATION_LIMITS and DECISION_CHANGE document. A receipt, accepted-status string, passing test or automated reviewer is not owner architectural approval.

Proposals only — not configured by this PR and not asserted to be enabled:

• Protect main and the governance integration branch with required pull requests and an independent approving review; require approval after the most recent reviewable push or dismiss stale approvals.
• Use CODEOWNERS to designate an authorized human maintainer for governance documents, both manifests, checker/generator, AGENTS and CI workflows; require code-owner approval. Review ownership of the ownership/configuration files too.
• Require the observed offline/context checks, restrict bypass permissions and prohibit force pushes/deletion on protected integration branches. Verify exact check names, permissions and plan support when configuring.
• Record an explicit owner decision tied to the proposed architecture change and commit. Repository review controls can require a GitHub account's approval; they still do not prove off-platform consent or semantic truth.

These options are supported by GitHub's protected-branch documentation and ruleset documentation. No repository settings were changed here.

Durable review artifacts / request

• Independent report
• Machine-readable evidence
• Branch-safe handoff

The checked-in report's “local / no remote changes” statements describe the completed original audit; this PR publishes that exact immutable checkpoint under the owner's subsequent authorization. Fresh results above repeat the controls at the published SHA.

OpenCode: independently re-review this exact head and both before/after mutation cases. PR11's original head remains REQUEST CHANGES until corrections are adopted and its resulting head is reviewed. Do not merge this correction PR, PR11 or PR10, change architecture intent, open devices or touch frozen experiments as part of verification.

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.