{ "findings": [ { "evidence": { "candidate_verifier": "exit 1: candidate leaf mismatch at gateway/platforms/nutrition_coaching.py", "canonical_candidate_digest": "c160085a64454c23f789464170b299543324c743a489bac68ed5430fab42d291", "rehearsal_reset_sha256": { "canonical_manifest": "3380309169dc6081fbc772982167ca54980b2bdc5802f47b26191f4656de3851", "current_source": "7dcb0b1e49bb9c94d38c26becd7324570681adce8877c1dbd9e587b664e73250", "retained_wheel": "03b6e6a6ea6561b95a66fcd693f8503536ce54c54b34ac600244d9ca7c614dec" }, "retained_wheel_mode": "0664", "retained_wheel_sha256": "231015faefda6d4d146a02e393b29922a6ecf5d7693d2e71396c184a0ccd491e", "runtime_install": "editable project location points at the dirty execution worktree rather than an immutable retained wheel", "task23_verifier": "exit 1: Task23 source leaf mismatch at gateway/platforms/telegram.py" }, "id": "candidate-identity-not-verifiable", "remediation": "After all fixes, build twice from one sealed source snapshot, compare wheel bytes, retain the 0600 artifact, verify every packaged source leaf against the snapshot, rebuild the canonical manifest/digest, and make both candidate verifiers pass against that same identity.", "severity": "critical", "summary": "Tasks 23-25 changed source after the canonical candidate was sealed; neither verifier accepts the current tree and no retained wheel contains all final source bytes." }, { "id": "regeneration-partial-transition", "location": "gateway/platforms/nutrition_coaching.py:5083-5128", "probe": { "first_accepted": false, "first_error": "regeneration_request_failed", "parent_status_after_failure": "held", "retry_accepted": false, "retry_error": "draft_not_regenerable" }, "remediation": "Make parent hold and child request/generation creation atomic or journal a recoverable transition. Add failing-first tests for request-write and generation-write failure followed by same-input retry, restart, and concurrent retry; assert one child lineage and no stuck parent.", "severity": "high", "summary": "A draft regeneration persistence failure holds the parent before the child request is durable, so a normal retry is rejected." }, { "evidence": { "full_gateway": "8731 passed, 30 failed", "non_hermetic_location": "tests/gateway/test_task23_release_gate_integration.py:18-19,357,690-704", "onboarding_owning_suites": "68 passed, 2 failed; callback replay did not raise after durable transition and restart recovery rejected an absent outbox directory", "onboarding_reconciliation": "20 passed, 1 failed; exact attestation callback does not reach evidence validation", "task23_release_gate": "26 failed; missing required fixture environment and deleted live-profile authorization" }, "id": "final-gateway-gate-red", "remediation": "Remove live-profile and absolute evidence-path dependencies from default tests. Package a sealed sanitized fixture, copy it to tmp_path, and derive all pins from it. Fix the three independent onboarding regressions, then rerun the affected files, Task23 provider-mode matrix, owning onboarding suites, and full Gateway once after cleanup.", "severity": "high", "summary": "The final tree has no green post-cleanup Gateway gate." }, { "evidence": { "examples": [ "gateway/platforms/telegram_nutrition_onboarding_task23_supersession.py", "gateway/platforms/telegram_nutrition_onboarding_supplemental_review.py", "tests/gateway/test_task23_release_gate_integration.py", "tests/gateway/task24_preflight_harness.py", ".omo/evidence/task23-session-recovery/task23-portable-successor-publication-inclusive-gate.json" ], "identifier": "", "source_script_test_file_count": 32, "supporting_evidence_file_count": 47 }, "id": "privacy-redaction-failure", "remediation": "Derive runtime authority from sealed profile/configuration, use synthetic fixture identities in tests, and replace retained identity values with role labels or salted/pinned pseudonyms. Rebuild affected evidence indexes and candidate hashes; scan the final candidate/evidence and require zero raw live identifiers.", "severity": "high", "summary": "A real Telegram identity is hard-coded across shippable runtime/scripts/tests and appears in supporting files named redacted; access mode 0600 does not make content redacted." }, { "id": "timing-dependent-tests", "locations": [ "tests/gateway/test_adaptive_nutrition.py:4126", "tests/gateway/test_adaptive_nutrition.py:4170", "tests/gateway/test_adaptive_nutrition.py:4233", "tests/gateway/test_adaptive_nutrition.py:5282-5310", "tests/gateway/test_adaptive_nutrition.py:5544-5555" ], "remediation": "Replace sleeps/poll loops with pipes, Events, or barriers created before the trigger; await the exact lock-acquired/provider-entered/publication-claimed signal with a bounded timeout, then release it deterministically.", "severity": "moderate", "summary": "Candidate tests use fixed sleeps and polling to manufacture concurrency, including a 50 ms sleep followed by process-state assertion." } ], "recorded_at_utc": "2026-08-14T07:11:41.936234Z", "rerun_order": [ "Add and pass regeneration failure/retry/restart/concurrency regressions.", "Make Task23/default Gateway tests hermetic and pass all affected onboarding/Task23 suites.", "Remove raw live identifiers and deterministic-timing violations; rerun static/scoped type checks.", "Run full Gateway once after Task25-equivalent cleanup and record a green result.", "Seal one final source snapshot; build twice; compare and retain the wheel; rebuild manifest/digest.", "Run both candidate verifiers and wheel-member/source-leaf verifier against that exact identity.", "Recompute behavioral/coverage evidence on the exact final candidate and rerun Task26." ], "schema": "task26-code-quality-oracle-v1", "scope": { "evidence_root": "/home/cube/projects/richard/traning coach", "execution_repository": "/home/cube/projects/richard/hermes-agent", "external_actions": [], "product_edits": [] }, "verdict": "FAIL", "verification": { "diagnostic_limits": { "coverage": "Historical behavioral matrices and suite counts belong to earlier candidate digests. No trustworthy coverage claim can be attached to final bytes while the final identity is unsealed and the full/owning suites are red.", "lsp": "Workspace tool rejected execution-repository paths because request cwd is the evidence repository; Ruff, compileall, and ty were used instead.", "source_wide_ty": "Nonzero broad inventories remain (telegram.py 247 diagnostics; nutrition_coaching.py 799). Historical evidence classifies prior broad debt outside task-local ranges, but final candidate drift prevents transferring that classification to one exact release identity." }, "failed": [ "canonical candidate verifier", "Task23 expiry/supersession verifier", "full Gateway suite", "Task23 release gate integration suite", "onboarding reconciliation suite", "onboarding/callback owning suites", "regeneration injected-failure retry probe" ], "passed": [ "Ruff on Task23-25 relevant source/tests", "compileall on Task23-25 relevant source/tests", "git diff --check", "ty on rehearsal_reset and Task24 harness/test files", "Task24/regeneration/rehearsal-reset focused tests: 86 passed, 1 deselected", "reproducible-wheel integration test: 1 passed" ], "worktree": { "porcelain_entry_count": 186, "porcelain_sha256": "8d26e95525026bd3fe15391b16d129ecc8c7cfdf7811a7843b7137bf88b63fbe", "tracked_deletions": 5550, "tracked_diff_files": 50, "tracked_insertions": 31017, "untracked_files": 136 } } }