fix(eval): agent cost was the wrong model's price, and the budget was the wrong unit - #545

… scope decision after 2 blocked quorum rounds

Pick: the queue head, m-net-effect-proxy-boundary (D5 Option B). NEW-DOC + quorum.
Designer codex gpt-5.6-sol (rotation advanced from claude:claude-fable-5).

Outcome: 662-line design doc with 19 verification rows and a silent-revert check on
every acceptance criterion. Quorum BLOCKED twice; item parked needs-human-review on
one decision (D-6). Planner/executor/evaluator not fired.

R1 caught a genuine design defect (gemini-3-1-pro): target-IP resolution specified in
TWO places — the existing preflight resolveAndValidateIP and the new RoundTripper — a
TOCTOU DNS-rebinding race plus a broken-proxied-request risk on hosts without external
DNS. Routed without a controller-invented resolution; the designer made the direct
RoundTripper the sole resolve-validate-dial site and skips local target DNS entirely on
proxy routes.

R1's other objection was an unverified premise, so the controller measured it rather
than forwarding it: production has 0 custom RoundTrippers, 0 DefaultTransport uses,
0 Transport.Clone, no shared HTTP factory (control: 29 inline http.Client{} sites).
That pass also produced the fact the doc lacked — Go's DefaultTransport sets
Proxy: ProxyFromEnvironment (transport.go:46-48, go1.26.5) — so bare clients are
already inside the egress boundary and only hand-built nil-Proxy transports can
escape. That turns "we found seven sites" into "seven is all there can be".

R2's surviving objection asks that the completeness gate become a go/packages AST
analyzer. Not carve-out-eligible (expands scope, needs judgment), so Standing rule 2
applies: park, do not force through. The decision was made cheap to answer by testing
the reviewer's own hypothesis — all five constructions the analyzer would catch are
ZERO at HEAD, each with a firing control. Two of those five controls failed on first
run and were re-run before any number was used.

Also: corrected the stale sweep-batch row (#588 was already closed 2026-08-05; and M2
gated the live-network SUBTEST at net_test.go:364, not the whole TestNetHttpPost
function). Filed orphaned PR #545 as a queue row — found by iteration 149's new
died-mid-flight check on its first independent use; 125 commits behind, zero charter
and zero log mentions, and its purpose is NOT superseded (measured at HEAD).

Retro — one skill edit (>=2-instance bar, purely additive: 38 insertions, 0 deletions):
Gate 2 gains rule 3f — a reviewer's objection is a claim too, and on an
"unverified premise" objection the controller's job is to MEASURE it, because the
measurement can refute the objection outright or shrink the work. Instance 1:
iteration 126. Instance 2: this iteration.

Metered: $0.1785 of the $5 ceiling (quorum x2 only; codex is OAuth-subscription).

Co-Authored-By: codex <gpt-5.6-sol>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…een, and

the charter's own scale warning was a claim nobody had measured

PICK: #545, because both items above it are parked on a human (#604 on D-2,
#613 on D-1) and iteration 157's own Next names it as the fallback.

HEADLINE: the charter has carried #545 since iteration 149 behind a warning
reading "47 files ... a surface that moved a lot ... a rebase-and-revalidate
job, NOT a merge". Every number in it is true and the conclusion is false.
The merge produces THREE conflicted files, one hunk each: a changelog union
with zero content overlap, a two-line struct-literal union, and one that looks
enormous (427 lines ours vs 1 theirs) and is a code MOVE — dev extracted the
agent path into cmd/ailang/eval_benchmark_agent.go, and #545's real delta to
that block is four lines. Three iterations deferred the item on that sentence.
A "surface moved a lot" warning measures how much OTHER work landed, never how
much of it collides.

Also recorded: the union resolution justified rather than assumed (dev's new
zero-cost fallback resolves through the same models.yml key as #545's
task.Pricing, so it does not reintroduce the two-price-table defect); the
changelog claims a v0.33.1 release for which NO TAG EXISTS (caught in my own
dashboard draft before publishing); Sonar at six consecutive analysed reds,
measured on HEAD; and the Gate-0 weekly sweep, which found 7 zero-mention
issues, closed #598 as a verified duplicate of #602, and batched the other six
into one queue row positioned below every existing pick.

STATUS rotation done with the arithmetic asserted before writing
(before=after=1864, moved=1) and a post-edit queue-row grep, per the rules
iteration 127's mass-deletion bought.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…d I was

wrong that Sonar's red was purely inherited

#545 merged as squash 32583be. Both gates green with completeness asserted:
PR run present==4/4 all success, all four REQUIRED contexts pass; post-merge
dev run present==3/3 all success. Queue row flipped to [LANDED] only on the
observed green.

Evaluator (sonnet, independent of the opus controller that resolved the merge):
PASS 77/100, zero blocking. Both substantive findings reproduced first-party
before acting. The cost-fallback/provenance union is correct for a reason the
judge did not reach: ResolveCostProvenance is TOTAL, so provenance is a
property of the auth lane rather than of who computed the number. Its coverage
finding is real and is now #615, along with pi's hardcoded AuthLaneBilled.

Refuted one of the judge's corrections by measurement: its 108 packages vs my
107 is scope, not error — make test excludes /scripts, of which exactly one
package has tests.

THE CORRECTION THAT MATTERS: earlier in this same iteration I recorded Sonar's
red as "a standing condition inherited from earlier Go work, not a regression
from this push". True of iterations 155-157, NOT true of this one. #545's head
read 63.4% coverage on new code and the merged commit reads 73.7%, down from
78.7%. It never gated (non-required), so the merge decision stands, but
"inherited" was an assumption carried across a push that changed the input —
rule 3d exactly. Likewise the consecutive count: I wrote 7 by extrapolation and
enumeration says 8.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>