fix(goal_plan): exclude ephemeral tool caches from verifier purity check by kenotron-ms · Pull Request #33 · kenotron-ms/attractor-pipelines

kenotron-ms · 2026-08-26T03:57:37Z

The parent-verifier envelope classified any worktree mutation during verification as INFRA regardless of exit code. A passing pytest verifier writes __pycache__/.pytest_cache/.hypothesis, so every real (pytest-based) lane verifier was misread as tree-mutating -> INFRA_FAILURE, no PR (root-caused from L0-L4 evidence: exit_code 0, '6 passed', pre/post manifest differ only by caches). Excludes ephemeral tool caches from snapshot_worktree_manifest; tamper detection for real source changes stays intact. Verified: repro + python_check clean + runtime tests 104 passed.

The parent-verifier envelope snapshots the whole worktree filesystem before and after running the verifier and discards the verdict as INFRA on ANY mutation, regardless of exit code. A passing `pytest` verifier legitimately writes __pycache__/.pytest_cache/.hypothesis, which changed the manifest -> every real (pytest-based) lane verifier was misread as tree-mutating and routed to INFRA_FAILURE with no PR, even though the tests passed (exit 0). Exclude ephemeral tool caches (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, *.pyc/*.pyo) from snapshot_worktree_manifest. Tamper detection for real tracked-source changes stays intact. Verified: repro shows pytest cache writes no longer change the manifest while a real source edit still does; python_check clean; runtime tests 104 passed. 🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier) Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>

github-actions · 2026-08-26T04:13:07Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:15:07Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:17:09Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

[CRITICAL — Correctness (component of above)] `goal_plan_runtime.py:269–270` — Unconditional basename exclusion at every walk depth

Ephemeral-dir exclusion is applied unconditionally by basename at every depth of the os.walk. A repo that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture) will have its entire subtree silently dropped from the manifest, causing the purity check to miss real source mutations inside it — a false-negative in tamper detection. The exclusion should be scoped (e.g. only when the directory is not git-tracked, or only at specific depths) rather than applied globally by name alone.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:19:10Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:21:10Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:23:00Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:25:02Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

CHANGES_REQUESTED — CRITICAL: Python-specific exclusions baked into a generic snapshot primitive create a false-negative tamper-detection blind spot and violate the design contract's envelope containment layer; the correct fix is to redirect caches via env vars in run_child_attempt_verifier_envelope.

This review found 5 findings across correctness, architecture, patterns, and pedantic lanes: 1 CRITICAL (multi-lane elevation), 1 HIGH, 1 MEDIUM, and 2 LOW. The CRITICAL finding at lines 261–264 is flagged independently by three lanes (Architecture, Correctness, Patterns) and concerns language-specific exclusions placed inside a generic primitive rather than in the envelope's environment-setup layer where the design contract requires them. The HIGH finding at lines 821–823 identifies the four missing env-var assignments in run_child_attempt_verifier_envelope that would fix the root cause. The tests lane produced no findings this cycle.

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:28:45Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:31:01Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:33:08Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:35:52Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:37:52Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:39:55Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:41:53Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:43:50Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:45:44Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:47:32Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T04:49:22Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:51:13Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:53:10Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:55:07Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:56:57Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T04:58:46Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:00:40Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:03:49Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:32:16Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:34:13Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:36:06Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:37:55Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:39:48Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:41:39Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:43:32Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:45:25Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:47:17Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:50:17Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:52:12Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T05:54:28Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T05:56:45Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T05:58:37Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:00:34Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:02:47Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

CHANGES_REQUESTED — CRITICAL: Python-specific exclusions baked into a generic snapshot primitive create a false-negative tamper-detection blind spot and violate the design contract's envelope containment layer; the correct fix is to redirect caches via env vars in run_child_attempt_verifier_envelope.

6 findings across 5 lanes (correctness, architecture, patterns, tests, pedantic): 1 CRITICAL (3-lane convergence on lines 261–264), 1 HIGH, 1 MEDIUM, 2 LOW, 0 from tests lane. The CRITICAL finding is that _EPHEMERAL_DIR_NAMES / _EPHEMERAL_FILE_SUFFIXES belong in the envelope's env-setup layer, not in the language-agnostic snapshot primitive. The HIGH finding is the missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE assignments in run_child_attempt_verifier_envelope.

Full details in the inline comments on Files Changed.

VERDICT: CHANGES_REQUESTED

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:04:50Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:06:42Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:08:32Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:10:28Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:12:27Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

CHANGES_REQUESTED — CRITICAL: Python-specific exclusions baked into a generic snapshot primitive create a false-negative tamper-detection blind spot and violate the design contract's envelope containment layer; the correct fix is to redirect caches via env vars in run_child_attempt_verifier_envelope. 5 findings total (2 CRITICAL, 1 HIGH, 1 MEDIUM, 2 LOW) across architecture, correctness, and pedantic lanes; tests lane produced no findings this cycle. Full details in the inline comments on Files Changed.

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T06:14:25Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T06:16:48Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:18:40Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:20:35Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:22:33Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:25:04Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T06:26:57Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

VERDICT: CHANGES_REQUESTED

github-actions · 2026-08-26T06:28:52Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

github-actions · 2026-08-26T06:30:39Z

Synthesized PR Review

Verdict: CHANGES_REQUESTED

PR: fix(goal_plan): exclude ephemeral tool caches from verifier purity check

Elevation Table

File:Lines	Lanes	Raw Severity	Elevated To	Reason
`goal_plan_runtime.py:261-264`	Architecture + Correctness + Patterns	HIGH (×2) + MEDIUM	CRITICAL	3 independent lanes flag the same file:lines; Architecture+Correctness both HIGH → elevate to CRITICAL
`goal_plan_runtime.py:821-823`	Architecture	HIGH	HIGH	single lane, no elevation
`goal_plan_runtime.py:274-275`	Correctness	MEDIUM	MEDIUM	single lane
`goal_plan_runtime.py:255-258`	Pedantic	LOW	LOW	single lane
`goal_plan_runtime.py:271-272`	Pedantic	LOW	LOW	single lane
Tests lane	Tests	—	—	Placeholder `$tests_findings` / `$tests_comments` — no findings present in this cycle

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

Architecture dimension: _EPHEMERAL_DIR_NAMES and _EPHEMERAL_FILE_SUFFIXES are Python-ecosystem-specific constants (__pycache__, .pytest_cache, .hypothesis, .ruff_cache, .mypy_cache, .pyc, .pyo) embedded inside snapshot_worktree_manifest, which is a generic worktree-filesystem primitive consumed by all verifier types regardless of language. The design contract (docs/plans/2026-08-22-goal-plan-attractor-design.md, lines 1930–1933 §VerifierExecutionEnvelope) already specifies the correct fix for this class of problem: run_child_attempt_verifier_envelope must set PYTHONPYCACHEPREFIX, XDG_CACHE_HOME, TMPDIR, and COVERAGE_FILE to paths beneath output_root so tool caches are redirected out of the worktree entirely rather than excluded by name in the snapshot primitive. Baking language-specific names into a generic primitive (a) couples it to Python tooling, (b) silently widens the tamper-detection blind spot for any file whose name matches the exclusion list, and (c) diverges from the specified envelope containment contract.

Correctness dimension: The exclusion is applied unconditionally at every depth of the os.walk, keyed only on the directory's basename. A repository that legitimately tracks a directory named __pycache__ or .hypothesis (e.g. as a test fixture or golden-file store) will have its entire subtree silently dropped from the manifest. The verifier would then miss real source mutations inside that subtree — a false-negative in tamper detection, which is exactly what the purity check exists to prevent. Additionally, a malicious or buggy verifier that writes a file named .pytest_cache or ending in .pyc anywhere in the tree will be invisible to the check. The exclusion should be restricted by full relative path, git-tracked status, or depth rather than applied globally by basename alone.

Patterns dimension: Both new constants use a leading underscore (_EPHEMERAL_DIR_NAMES, _EPHEMERAL_FILE_SUFFIXES), but every other module-level constant in this file is public (no leading underscore): SCHEMA_ADMISSION, SCHEMA_RUN_OWNED_WORKTREES, SCHEMA_RUN_BUDGET, SCHEMA_CHILD_ENVELOPE, SCHEMA_INTEGRATION_JOURNAL, SCHEMA_CANDIDATE_EVIDENCE, SCHEMA_CLEANUP, WORKTREE_STATES, AUTHORITY_FULL, AUTHORITY_EXTERNAL_ONLY, AUTHORITY_NONE, DEFAULT_GIT_ARGV_PREFIX. The underscore prefix breaks the module's established naming convention.

Recommended fix: Implement the four missing env-var assignments in run_child_attempt_verifier_envelope (lines 821–822) and revert snapshot_worktree_manifest to its original form, keeping the snapshot primitive language-agnostic and the tamper-detection blind spot closed. If the exclusion approach is retained as a fallback, scope it by full path or git-tracked status, and rename constants to drop the leading underscores.

HIGH

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

The envelope currently sets only GOAL_PLAN_VERIFIER_OUTPUT_ROOT. The design contract requires TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, and COVERAGE_FILE to also be set to paths beneath output_root. Implementing these four assignments in the envelope's environment-setup layer is the correct fix for the purity false-positive and makes the snapshot-primitive exclusions unnecessary.

Suggested fix:

    run_env = dict(env if env is not None else os.environ)
    run_env["GOAL_PLAN_VERIFIER_OUTPUT_ROOT"] = output_root
    run_env["TMPDIR"] = os.path.join(output_root, "tmp")
    run_env["XDG_CACHE_HOME"] = os.path.join(output_root, "xdg-cache")
    run_env["PYTHONPYCACHEPREFIX"] = os.path.join(output_root, "pycache")
    run_env["COVERAGE_FILE"] = os.path.join(output_root, "coverage", ".coverage")

MEDIUM

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

After the patch, filenames is rebound to the filtered list on the same variable name. The names = sorted(filenames) + dirnames line immediately after is correct as written, but any future edit that moves the filter line below the names = ... assignment would silently reintroduce .pyc files into the manifest without any error or warning. Using a distinct name (e.g. filtered_filenames) makes the data-flow explicit and prevents accidental regression.

Suggested fix:

        filtered_filenames = [f for f in filenames if not f.endswith(_EPHEMERAL_FILE_SUFFIXES)]
        names = sorted(filtered_filenames) + dirnames

LOW

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

The comment reads: "Ephemeral tool caches a read-only verifier may legitimately create" — without the word "that", "caches" reads as a verb, making this a garden-path sentence. Should be: "Ephemeral tool caches that a read-only verifier may legitimately create".

Suggested fix:

# Ephemeral tool caches that a read-only verifier may legitimately create (pytest,
# hypothesis, bytecode, linters). These are NOT source mutations, so the purity
# check must ignore them -- otherwise a passing `pytest` verifier that writes
# __pycache__/.pytest_cache is misread as a tree-mutating verifier and its

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

The docstring wraps the slash separator onto its own line with leading whitespace (`_EPHEMERAL_DIR_NAMES`\n / `_EPHEMERAL_FILE_SUFFIXES`), which renders oddly in most doc viewers. Placing the slash inline is cleaner.

Suggested fix:

    ignored, excluding `.git` and ephemeral tool caches (`_EPHEMERAL_DIR_NAMES` / `_EPHEMERAL_FILE_SUFFIXES`). Returns entries plus a canonical hash."""

Tests Lane

The Tests lane input was an unresolved template placeholder ($tests_findings / $tests_comments). No test findings were present in this review cycle. This lane produced no findings to include.

Summary of all findings

Severity	Location	Lanes	Issue
CRITICAL	`goal_plan_runtime.py:261–264`	Architecture + Correctness + Patterns	Wrong layer (snapshot primitive vs. envelope env setup); unconditional basename exclusion creates false-negative tamper-detection blind spot; naming convention break
HIGH	`goal_plan_runtime.py:821–823`	Architecture	Envelope missing TMPDIR, XDG_CACHE_HOME, PYTHONPYCACHEPREFIX, COVERAGE_FILE assignments
MEDIUM	`goal_plan_runtime.py:274–275`	Correctness	Filtered filenames rebound to same variable — fragile data-flow
LOW	`goal_plan_runtime.py:255–258`	Pedantic	Missing relative pronoun "that" — ambiguous noun phrase
LOW	`goal_plan_runtime.py:271–272`	Pedantic	Docstring slash on its own line renders oddly
—	Tests lane	Tests	No findings (unresolved template placeholder)

kenotron-ms merged commit 3b44d55 into main Aug 26, 2026

kenotron-ms deleted the fix/verifier-cache-purity branch August 26, 2026 03:57

github-actions Bot added reviewed changes-requested labels Aug 26, 2026

Conversation

kenotron-ms commented Aug 26, 2026

Uh oh!

github-actions Bot commented Aug 26, 2026

Synthesized PR Review

Elevation Table

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] goal_plan_runtime.py:261–264 — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

HIGH

[HIGH — Architecture] goal_plan_runtime.py:821–823 — run_child_attempt_verifier_envelope missing four required env-var assignments

MEDIUM

[MEDIUM — Correctness] goal_plan_runtime.py:274–275 — Filtered filenames rebound to the same variable name, fragile data-flow

LOW

[LOW — Pedantic] goal_plan_runtime.py:255–258 — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] goal_plan_runtime.py:271–272 — Docstring slash wraps to its own line, renders oddly

Tests Lane

Summary of all findings

Uh oh!

github-actions Bot commented Aug 26, 2026

Synthesized PR Review

Elevation Table

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] goal_plan_runtime.py:261–264 — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

HIGH

[HIGH — Architecture] goal_plan_runtime.py:821–823 — run_child_attempt_verifier_envelope missing four required env-var assignments

MEDIUM

[MEDIUM — Correctness] goal_plan_runtime.py:274–275 — Filtered filenames rebound to the same variable name, fragile data-flow

LOW

[LOW — Pedantic] goal_plan_runtime.py:255–258 — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] goal_plan_runtime.py:271–272 — Docstring slash wraps to its own line, renders oddly

Tests Lane

Summary of all findings

Uh oh!

github-actions Bot commented Aug 26, 2026

Synthesized PR Review

Elevation Table

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] goal_plan_runtime.py:261–264 — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[CRITICAL — Correctness (component of above)] goal_plan_runtime.py:269–270 — Unconditional basename exclusion at every walk depth

HIGH

[HIGH — Architecture] goal_plan_runtime.py:821–823 — run_child_attempt_verifier_envelope missing four required env-var assignments

MEDIUM

[MEDIUM — Correctness] goal_plan_runtime.py:274–275 — Filtered filenames rebound to the same variable name, fragile data-flow

LOW

[LOW — Pedantic] goal_plan_runtime.py:255–258 — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] goal_plan_runtime.py:271–272 — Docstring slash wraps to its own line, renders oddly

Tests Lane

Summary of all findings

Uh oh!

github-actions Bot commented Aug 26, 2026

Synthesized PR Review

Elevation Table

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] goal_plan_runtime.py:261–264 — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

HIGH

[HIGH — Architecture] goal_plan_runtime.py:821–823 — run_child_attempt_verifier_envelope missing four required env-var assignments

MEDIUM

[MEDIUM — Correctness] goal_plan_runtime.py:274–275 — Filtered filenames rebound to the same variable name, fragile data-flow

LOW

[LOW — Pedantic] goal_plan_runtime.py:255–258 — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] goal_plan_runtime.py:271–272 — Docstring slash wraps to its own line, renders oddly

Tests Lane

Summary of all findings

Uh oh!

github-actions Bot commented Aug 26, 2026

Synthesized PR Review

Elevation Table

CRITICAL

[CRITICAL — Architecture + Correctness + Patterns] goal_plan_runtime.py:261–264 — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

HIGH

[HIGH — Architecture] goal_plan_runtime.py:821–823 — run_child_attempt_verifier_envelope missing four required env-var assignments

MEDIUM

[MEDIUM — Correctness] goal_plan_runtime.py:274–275 — Filtered filenames rebound to the same variable name, fragile data-flow

LOW

[LOW — Pedantic] goal_plan_runtime.py:255–258 — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] goal_plan_runtime.py:271–272 — Docstring slash wraps to its own line, renders oddly

Tests Lane

Summary of all findings

Uh oh!

github-actions Bot commented Aug 26, 2026

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[CRITICAL — Correctness (component of above)] `goal_plan_runtime.py:269–270` — Unconditional basename exclusion at every walk depth

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments

[MEDIUM — Correctness] `goal_plan_runtime.py:274–275` — Filtered filenames rebound to the same variable name, fragile data-flow

[LOW — Pedantic] `goal_plan_runtime.py:255–258` — Missing relative pronoun "that" creates ambiguous noun phrase

[LOW — Pedantic] `goal_plan_runtime.py:271–272` — Docstring slash wraps to its own line, renders oddly

[CRITICAL — Architecture + Correctness + Patterns] `goal_plan_runtime.py:261–264` — Wrong layer, false-negative tamper-detection blind spot, and naming convention break

[HIGH — Architecture] `goal_plan_runtime.py:821–823` — `run_child_attempt_verifier_envelope` missing four required env-var assignments