Skip to content

planner-lane derivation: fenced code blocks in a Files section silently degrade routing to opus (+2 audit-debt follow-ups from the iter-137 evaluation) #581

Description

@sunholo-voight-kampff

Follow-ups from the iteration-137 sprint evaluation of m-planner-codex-lane (PR #580 → squash cd76499c5). Evaluator: sonnet, PASS 84/100, zero blocking. All three items below are NON-BLOCKING; filing so they are not lost.

1. derive-planner-lane.sh parses bullets inside fenced code blocks as real path entries

The awk range extractor matches any ^- line within the ## Files section regardless of whether it sits inside a ``` fence. A design doc that shows an example bullet in its Files section is routed to opus even when every real path bullet is clean infra.

Reproduced first-party by the controller with a discriminating control — the two docs below differ ONLY by the trailing fenced block:

control.md  → codex declared:codex-ok
codeblock.md → opus fail-closed:path-not-in-codex-allowlist

where codeblock.md is control.md plus:

Example of what NOT to touch:

```
- `internal/parser/parser.go`
```

Severity is bounded and the direction matters: this is fail-safe. It can only degrade a codex-eligible doc to opus; it can never grant codex a doc that should have been refused. So it is a cost/engagement defect, not a safety hole.

Two candidate fixes: track fenced-block state in the extractor, or document a convention forbidding example bullets inside a Files section (the evaluator preferred the convention, as the parser fix is fiddly in Bash 3.2 awk). Worth weighing against the measured engagement rate — 40 of 41 planned docs with a Files heading already fail-close for a different reason (planner-lane-field-missing).

2. The sprint plan's AC9 text is still in its vacuous form

The plan's M2 acceptance pins MISSION_PLANNER_MODEL="${MISSION_PLANNER_MODEL:-opus}" and expects planner=opus. Pre-flip, opus was ALSO the built-in default, so that test passes identically whether the env file is sourced or not — it cannot distinguish "the mechanism ran" from "the mechanism was never wired".

The controller caught this in-sprint and exercised the correct three-sided sentinel form (sentinel→sentinel; delete file→opus; env-pin→env-pin), but the fix lives only in the M2 commit message — the plan text in design_docs/implemented/v1_0_0/m-planner-codex-lane-sprint-plan.md still shows the vacuous version. Audit debt for the next reader.

3. diff -q is no longer a usable World-driver drift detector

The design doc named diff -q between the two mission drivers as the drift detector. Iteration 136 deliberately declined the World driver sync, so the drivers now differ by design and diff -q is permanently tripped — there is no automated way left to distinguish intentional from accidental drift.

Suggested replacement: record a last-sync SHA in both driver headers plus a check target, rather than relying on byte-equality of two files that are now expected to differ.

Provenance

Every claim in item 1 was reproduced by the controller outside the codex sandbox before filing. Items 2 and 3 are the evaluator's findings, verified by reading the cited artifacts. Related: #544 (.agents/ skill-copy divergence), #558 (launchd drivers execute from the stale main checkout).

🤖 Generated with Claude Code

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions