Narrow the cloud implement completion gate to a --completion-gate mode on the parallel coordinator

[The01Geek]

Problem Statement

As a maintainer of this repository, I want the cloud implement run's completion gate to run a small set of checks instead of the whole test suite, so that runs finish sooner and use less of the shared GitHub Actions capacity.

Today every cloud /prflow:implement run must produce a whole-suite result before it is allowed to write Status: Complete. The whole-suite command is the parallel coordinator lib/test/run-parallel.sh, which runs the tested partition of five CI shards inside one checkout. That single command dominates the run, and its cloud elapsed time sits close to the tier's per-command execution ceiling, so a run that trips the ceiling has to decompose the suite into shards and recombine them. The cost gap is re-derivable in this repository by timing the coordinator against the eight commands named below.

The gate also buys little. The catch rate behind this change was measured during drafting rather than read from a tracked artifact: over the cloud implement runs of the two weeks ending 2026-08-28, read from their GitHub Actions job logs with the maintainer's local implement-timeline reader, the in-run whole-suite gate caught nothing that the same commit's CI did not also catch. That measurement is recorded here as a drafting-time observation and is not re-derivable from this repository. CI remains the required check that gates the human merge, so the expensive in-run pass is mostly re-proving what CI proves again minutes later.

Current Behavior

The implement prompt extension makes Phase 4.3 responsible for one whole-suite result per run.

• Verified: .prflow/prompt-extensions/implement.md states "Phase 4.3 owns this run's whole-suite obligation, exactly once".

The shipped skill body does not hardcode which command that is. It reads the scope from this repository's own prompt extension and falls back to the full suite when the extension sets no scope.

• Verified: skills/implement/phases/phase-4-documentation.md says the run establishes its evidence "or the full whole-suite command when it sets none".

That fallback is the seam this change uses. It also means a change that only adds a pointer to the extension, without an operative scope statement, would silently keep the old behavior.

Desired Behavior

lib/test/run-parallel.sh gains a second mode, --completion-gate. The mode runs eight checks in a fixed order inside the current checkout, stops at the first one that fails, retains a log, prints the path of that log, reports each check and its status on its own output, and exits with a single status. A cloud implement run discharges its Phase 4.3 obligation by running that one command.

The eight checks are the coordinator's own read-only pre-launch checks, the internal-documentation long-line lint, the pin-corpus classifier suite, the four parts of the Python script suite, and the module that owns the coordinator's own behavior.

Because the whole gate is one command with one exit status, the run records one honest suite_summary.command, and the single flight coordinates one command, exactly as it does today for the coordinator.

The local and interactive tier is untouched. It continues to discharge its completion gate by reading CI for the commit it pushed.

User Impact

The maintainer of this repository benefits, and so do the cloud implement runs this repository starts. Runs finish sooner and hold an Actions concurrency slot for less time. Nobody else changes how they work: nothing in this change reaches a consumer repository, because lib/test/ is pruned from the vendor slice and neither CLAUDE.md nor the prompt extension is installed into a consumer checkout.

The trade is stated plainly, in terms of what stops running. The narrowed gate does not run four of the five tested CI shards — monolith, modules-pin, modules-large and modules-rest — nor lib/test/test_module_runner.py from python-pool. It runs only the coordinator's read-only pre-launch checks, lib/test/lint-internal-docs.py, lib/test/test_pin_corpus_classifier.py, the four test_python_scripts parts, and the parallel-suite-runner module. In particular the whole of lib/test/run.sh, and every lint that file alone drives, moves out of the in-run gate. A defect that only the dropped population catches now surfaces on CI after the pull request is marked ready, instead of inside the run. That is the accepted cost of the change.

Technical Context

Scope note: The files and details below are the known starting points, not the full list. Before implementing, trace the change through the codebase to find every affected call site, consumer, and layer — this issue maps the work, it does not bound it.

This builds on #2123, merged as pull request #2124, which added the three tool grants the narrowed recipe needs. All eight commands are already present in prflow_implement.allowed_tools on the default branch, so this change ships no grant and no acceptance criterion here depends on trigger-time-resolved configuration. The new mode needs no grant of its own: the existing entry is a prefix grant over lib/test/run-parallel.sh, so it already covers the script invoked with a new flag, and the invocation keeps the bare-leading-token shape the cloud matcher requires.

• Relevant Classes/Files — lib/test/run-parallel.sh holds the existing --preflight mode and the two check helpers the new mode reuses. lib/test/modules/parallel-suite-runner.sh is the module that owns this script's behavior, and it is one of the eight checks. .prflow/prompt-extensions/implement.md sets the Phase 4.3 scope. CLAUDE.md describes the tier ladder and the record a completion gate writes.
• Architecture Alignment — the argument case block that already carries the bare invocation and --preflight gains a third arm, and the mode it selects reuses _artifact_preflight and _cheap_lint_preflight rather than re-invoking the script.
• Dependencies — none beyond what lib/test/run-parallel.sh already uses.
• Data/Schema Considerations — the completion-evidence record format is unchanged, and the command it names changes. The fields a Verification evidence: marker carries for this path change with it, because the mode runs no shard and so reports no aggregate line and no shard tally.
• Cross-layer Impact — one test-harness script, its owning test module, one repo-local prompt extension, CLAUDE.md, and the internal documentation pages that describe the gate.

Three facts the design rests on:

• Verified: the completion-evidence validator checks only that the recorded command is a nonempty string — scripts/check-completion-evidence.py rejects a record only with the message "suite_summary.command is missing or not a nonempty string", so narrowing the gate needs no validator change.
• Verified: the fourth part of the Python script suite already runs the install-state checker, which is why lib/generate-install-state.py is absent from the recipe — lib/test/test_python_scripts_part4.py introduces that assertion with the comment "Drift gate: the generator's --check must pass".
• Verified: the pooled Python shard is a more expensive route to the same four parts, because lib/test/run-python-pool.sh describes its membership as "test_module_runner.py and the four parts test_python_scripts.py".

One ordering constraint the design rests on: the helper that makes a run root for the retained log is defined below the argument block, and between the two sit the reentrancy guard, the shard-dispatcher readability check, the shard-population derivation, and the coordinator's own pre-launch invocation. The mode therefore dispatches from a new point this change creates, immediately after the run-root layout exists, with those four steps placed behind a guard that skips them in this mode, so the mode neither aborts on a shard dispatcher it does not use nor runs its own pre-launch checks twice.

• Verified: lib/test/run-parallel.sh defines the run-root helper with the comment "parent -> prints a fresh writable run root", and that definition sits below the argument-handling block that the existing read-only mode exits from.

One asymmetry the failure arms must respect:

• Verified: a zero exit from the pre-launch checks does not prove they ran — lib/test/run-parallel.sh documents that the mode "exits 0 to proceed (clean, or a fail-open inconclusive result)" and non-zero on an attributed finding.

Acceptance Criteria

Every enumeration below that names the recipe's checks is the same closed set: lib/test/run-parallel.sh --preflight's own read-only pre-launch checks, lib/test/lint-internal-docs.py, lib/test/test_pin_corpus_classifier.py, lib/test/test_python_scripts.py, lib/test/test_python_scripts_part2.py, lib/test/test_python_scripts_part3.py, lib/test/test_python_scripts_part4.py, and lib/test/run-module.sh parallel-suite-runner — exactly these eight, complete by construction.

• Running lib/test/run-parallel.sh --completion-gate on a checkout where all eight checks pass exits with status 0 and launches no suite shard.
• Running lib/test/run-parallel.sh --completion-gate on a checkout where one of the eight checks fails exits non-zero, names the failing check on the command's own output, and does not run the checks ordered after it.
• On a passing run, lib/test/run-parallel.sh --completion-gate prints one line per check naming that check and its status, and one final line carrying the mode's own elapsed wall-clock seconds, so a run composes its Verification evidence: marker from the mode's own output.
• lib/test/run-parallel.sh --completion-gate exits non-zero and names the disabled check when any of the eight checks was disabled by an empty environment override, so a gate run never reports success over fewer than eight checks.
• lib/test/run-parallel.sh --completion-gate writes the retained log of the checks it ran and prints that log's absolute path on its own output, so a run can record it as the retained-log root in its Verification evidence: marker.
• On a checkout where no writable run root can be allocated, lib/test/run-parallel.sh --completion-gate still runs all eight checks, states on its own output that no log was retained, and exits with the checks' own combined status rather than the run-root allocation failure.
• lib/test/run-parallel.sh --completion-gate treats a zero exit from the read-only pre-launch checks as permission to continue, matching the fail-open posture the coordinator's existing pre-launch check already applies.
• Running lib/test/run-parallel.sh with --completion-gate twice in a row on an unchanged checkout produces the same exit status both times.
• .prflow/prompt-extensions/implement.md states that a cloud implement run's Phase 4.3 whole-suite obligation is discharged by lib/test/run-parallel.sh --completion-gate, naming that command.
• After the change, .prflow/prompt-extensions/implement.md is the only file stating which command discharges the cloud implement tier's Phase 4.3 gate; CLAUDE.md and each page under docs/internal/ that describes the gate reach it by pointer, and the <!-- canonical: docs/internal/implement-skill.md --> marker on CLAUDE.md's cloud-tier ladder entry is removed, that page having ceased to be the canonical home of this rule.
• After the change, no bullet in CLAUDE.md's The whole-suite gate section states that the cloud implement tier's completion gate is discharged only by a lib/test/run-parallel.sh whole-suite coordinator result, and none states it is discharged only by a recombined complete shard partition; that section instead states that the cloud implement tier's Phase 4.3 gate command is set by .prflow/prompt-extensions/implement.md, and the issue-Single-source the flight scope that discharges the Phase 4.3 completion-evidence gate #1132 execution-ceiling decomposition bullet and the issue-An environment-only fix after a RED completion-gate pass re-pays the whole ~16-minute coordinator; permit a fingerprint-gated failed-shard-only relaunch #2008 same-tree relaunch bullet each state which obligation they still serve after the narrowing.
• After the change, CLAUDE.md's record-contents bullet states which fields a Verification evidence: marker carries for a gate discharged by lib/test/run-parallel.sh --completion-gate, and no longer requires any of a coordinator aggregate line, a shard tally, and a coordinator elapsed line on that path.
• After the change, prflow_implement.allowed_tools in .prflow/config.json contains the same entries in the same order as before the change.
• After the change, lib/capability-profiles.json, lib/review-profile.tokens, and the manifest_version value are byte-identical to their state before the change.
• After the change, scripts/check-completion-evidence.py, scripts/verification-flight.py, and scripts/workpad.py are byte-identical to their state before the change.
• After the change, lib/test/run.sh contains no occurrence of the string pin-corpus-classifier.py, so lib/test/modules/harness-python-guards.sh's assertion #798 pin-corpus classifier remains maintainer-run (no run.sh invocation) continues to pass.
• After the change, CLAUDE.md still states that the local and interactive tier discharges a whole-suite completion gate by reading CI for the commit the run pushed.
• No page under docs/internal/ states that the cloud implement tier's Phase 4.3 gate is discharged by the whole-suite coordinator.

Implementation Notes

• Approach — add a --completion-gate arm to the argument case block in lib/test/run-parallel.sh, and split it in two. The arm in that block records the requested mode and passes the argument-count guard; the mode itself runs from a new dispatch point this change creates, immediately after the run-root layout exists. Between the argument block and that point sit four steps the mode does not use — the reentrancy guard, the shard-dispatcher readability check, the shard-population derivation, and the coordinator's own pre-launch invocation — so this change places all four behind a guard that skips them in this mode. The mode then calls the two pre-launch helpers itself, runs the remaining checks in order, short-circuits on the first non-zero status, names the check that failed, and reports each check and the elapsed seconds on its own output. Each check is invoked through an environment seam with a bundled default, the same idiom the script already uses for its preflight helpers, so the module can drive the mode's arms from a synthetic tree without running the real suites; because that seam also makes a check disable-able, the mode refuses a run in which any seam resolved empty. Update the argument guard's message and the help block, which both enumerate the accepted arguments. Then replace the scope sentence in the implement prompt extension with one that names the new command, and reduce the matching statements in CLAUDE.md to pointers at that extension.

• Relevant files — this touches lib/test/run-parallel.sh (the argument case block, the help-start block, the argument-count guard, a new runner function beside _cheap_lint_preflight, the guard around the four skipped steps, and the new dispatch point after the run-root layout), lib/test/modules/parallel-suite-runner.sh (new assertions beside the existing #1288 preflight block), .prflow/prompt-extensions/implement.md, and CLAUDE.md (the tier-2 ladder entry, the whole-suite-gate section, and the record-contents bullet). It plausibly also touches docs/internal/implement-skill.md, docs/internal/claude-md-tiered-suite-rationale.md, and docs/internal/DEVFLOW_SYSTEM_OVERVIEW.md.

• Code Patterns — mirror _cheap_lint_run in lib/test/run-parallel.sh: a labelled helper that takes a command string from an environment variable with a bundled default, uses - rather than :- so an explicitly empty override disables that step, and short-circuits so the step that fired is the one reported. Decide whether each step passed with bash builtins, in the while IFS= read -r and case shape that file already uses, rather than through a tool the preflight does not guarantee, because a missing tr command would fail open and let a failing check read as a pass. Keep the new code free of flags that only GNU tools accept, since the runners this repository uses include a Windows host. Mirror the existing #1288 preflight assertions in lib/test/modules/parallel-suite-runner.sh for the test shape, including its use of a synthetic tree.

• Testing Strategy — the tests live in lib/test/modules/parallel-suite-runner.sh, driven through the module runner, and they use the environment seams so the tests do not run the real Python suites. That module is itself one of the eight checks, so the gate this change installs runs its own covering tests. Write them before the mode exists, and confirm each fails against today's script, which has no --completion-gate arm at all.

  The cases, beyond what the criteria already pin: a run where a check is made to exit 2 rather than 1, asserting the mode still treats it as a failure, which covers the risk that the arm keys on a single expected status; a run where the pre-launch checks return zero from a fail-open inconclusive result, asserting the mode continues, which protects the documented fail-open posture; a run on a tree whose shard dispatcher is unreadable, asserting the mode still completes, which protects the guard around the four skipped steps; and an invocation passing --completion-gate together with a second argument, asserting the existing argument-count guard still refuses it, which protects the message the module already pins.

  The guarantee-class residual case: the mode is the deterministic replacement for a recipe an agent would otherwise run by hand, so one case asserts that invoking the mode runs every one of the eight checks even when an earlier phase of the run already ran some of them by hand, rather than skipping work it believes is done.

  governing conventions consulted: CLAUDE.md, CONTRIBUTING.md, docs/internal/.

• Documentation Needed — docs/internal/implement-skill.md, docs/internal/claude-md-tiered-suite-rationale.md, and docs/internal/DEVFLOW_SYSTEM_OVERVIEW.md each describe the cloud implement tier's completion gate and reach the new command by pointer at the implement prompt extension.

• Potential Gotchas — one nearby page is deliberately not a deliverable: docs/internal/architecture/execution-model.md needs no change, because its statement is about focused tests rather than about which command discharges the gate. This change ships no changeset. Nothing in it reaches a consumer repository: lib/test/ is pruned from the vendor slice, and both CLAUDE.md and .prflow/prompt-extensions/ are repo-local. The CLAUDE.md edits are made directly by the implementing run under the standing carve-out for a required CLAUDE.md edit, recorded in the workpad, rather than by invoking an interactive revision skill mid-run. The mode must be dispatched after the run-root layout exists, so an implementer who puts the whole mode inside the argument block will find no run root and no retained log. The argument-count guard's message and the help-start block both enumerate the accepted arguments and must be updated together; lib/test/modules/parallel-suite-runner.sh pins only the substring at most one argument, so it will not catch a stale enumeration, and this change adds an assertion that the rendered --help output and the guard message both name --completion-gate. The mode dispatches before the coordinator records its checkout fingerprint, so a --completion-gate run root carries no fingerprint.json, and the issue-An environment-only fix after a RED completion-gate pass re-pays the whole ~16-minute coordinator; permit a fingerprint-gated failed-shard-only relaunch #2008 same-tree failed-shard-only relaunch route reads none from it; that route continues to serve coordinator runs only, and this change states so where issue An environment-only fix after a RED completion-gate pass re-pays the whole ~16-minute coordinator; permit a fingerprint-gated failed-shard-only relaunch #2008 is documented. The #798 assertion counts the string pin-corpus-classifier.py across the whole of lib/test/run.sh, and its subject is the census instrument rather than the focused test the gate runs, so adding lib/test/test_pin_corpus_classifier.py to the eight checks leaves it green. Finally, the prompt extension is read live from the working tree during a run, so an implementing run that lands this change will itself read the new rule at its own Phase 4.3.

Generated via /prflow:create-issue (v2.36.15, claude-opus-5, medium)

[The01Geek]

Investigation record

The reasoning behind the brief. This is not part of the implementation contract — the issue body is.

How the recipe was chosen

Three mechanism classes were priced before the approach was settled:

• A prose recipe in the prflow-implement prompt extension — the extension lists the commands and the agent runs them. Cheapest to build. Rejected because it cannot produce an honest single-command completion record: the seven (later eight) commands have that many exit statuses, while the completion-evidence record carries one suite_summary.command string and the single flight coordinates one command. A record naming one command while seven others were owed would validate cleanly, because the validator never compares the command's value to anything.
• A --completion-gate mode on the already-granted coordinator — chosen. One command, one exit status, one honest record, and zero new tool grants because the existing allowlist entry is a prefix grant.
• The monolith shard alone — one existing granted command and zero new code, but ~434s instead of ~162s, and it misses the pooled Python population entirely, which is exactly where the completion-evidence and install-state assertions live.

Considered-and-rejected: 2 heavier candidate(s) — a CI-relay listener and a cloud push-and-poll gate. The relay's completion-evidence family requires a local tier value plus a HEAD match, which a default-branch relay cannot satisfy; and a headless cloud run cannot suspend to wait on an external workflow.

Measurements taken during drafting (local checkout)

Command	Result	Elapsed
lib/test/run-parallel.sh --preflight	rc 0	0.78s
lib/test/lint-internal-docs.py	rc 0, audited 124 docs files, 0 new violations	0.12s
lib/test/test_pin_corpus_classifier.py	rc 0	10.57s
lib/test/test_python_scripts.py	rc 0, 3404 passed	27.2s
lib/test/test_python_scripts_part2.py	rc 0, 1484 passed	48.0s
lib/test/test_python_scripts_part3.py	rc 1, 955 passed 6 failed	21.6s
lib/test/test_python_scripts_part4.py	rc 1, 561 passed 23 failed	21.1s
lib/test/run-module.sh parallel-suite-runner	rc 0, 276 passed	32.7s
lib/test/run-shard.sh python-pool (rejected route)	rc 1, 6408 passed 30 failed	378.1s

The 29 failures in parts 3 and 4 are the known environment-only local failures; CI is green on the same commit. The pooled shard was rejected as a route to the four parts because its membership is the module-runner suite plus those four parts, so it is strictly more expensive for the same population.

Two commands were dropped from the recipe during drafting:

• lib/generate-install-state.py --check — redundant, because the fourth part of the Python script suite already runs it as a subprocess.
• lib/test/run-shard.sh python-pool — the more expensive route to the same four parts, as above.

What the fresh-context audit changed

Round 1 returned VERDICT: REVISE with 12 findings. All 12 were verified against the code before any was acted on; 10 were graded must-revise and 2 advisory, and all 12 were fixed. One auditor sub-claim was rejected on verification: it argued the #798 fixed-substring count would also be tripped by mentions inside the underscored focused-test filename, which is false, because that filename does not contain the hyphenated census-instrument string. The core defect behind that finding was real — the criterion named the wrong artifact — and was fixed.

The finding that changed the design was the Quiet Killer: the test module that owns the coordinator's own behaviour is a member of a shard the narrowed gate does not run, so an implementing run would have written the new mode's tests and then discharged its completion gate with a command that never executes them. The recipe moved from seven checks to eight to put that module inside the gate it installs.

Two figures were removed from a load-bearing position because neither is re-derivable from this repository: a percentage of Phase 4 attributed to the gate, and a catch-rate over a run cohort. The surviving cost claim is stated as re-derivable in-repo by timing the named commands, and the surviving catch-rate claim names its instrument and window and is explicitly marked a drafting-time observation.

Decision blocks folded from the run's derivation artifact

The three blocks below are copied from this run's derivation record so a later reader can check why each criterion exists. The raw derivation prose, the revision-delta record, and the run's verified-claims ledger were deleted by the run's closing cleanup and did not survive.

Criterion disposition record

Thirteen criteria added; merge arm taken zero times; omit arm taken twice.

1. clean run exits 0, launches no shard -> add; merge test: no existing criterion shares its evidence; origin: the request named this guarantee.
2. a failing check exits non-zero and is named -> add; distinct evidence (a failing tree); origin: the request named it.
3. retains a log and prints its path -> add; origin: a failure the change introduces requires it — the Verification evidence: marker requires a retained-log root, which no narrowed recipe would otherwise produce.
4. a zero exit from the pre-launch checks is permission to continue -> add; origin: a failure the change introduces requires it — the fail-open posture is asymmetric and the obvious wrong move is to treat exit 0 as proof the check ran.
5. running it twice yields the same exit status -> add; origin: a failure the change introduces requires it — the guarantee-class idempotency obligation.
6. the extension names the command operatively -> add; origin: a failure the change introduces requires it — a pointer-only extension silently reverts to the full suite via the phase-4 fallback.
7. CLAUDE.md points, carries no second copy -> add; origin: the request named the placement.
8. prflow_implement.allowed_tools unchanged, same order -> add; untouched-surface; origin: a failure the change introduces requires it — protects the #480 ordered-list equality and the Document the grant-timing bootstrap (in-PR tool grants are post-merge-only) and make the create-issue mirror-sweep scope repo-wide #593 inertness property.
9. capability-profiles / review-profile.tokens / manifest_version byte-identical -> add; untouched-surface; origin: the wrong channel is the obvious mistake.
10. the three validator scripts byte-identical -> add; untouched-surface; origin: the natural wrong move is to enforce the new scope in code.
11. no run.sh invocation of the pin-corpus classifier -> add; untouched-surface; origin: a failure the change introduces requires it — #798.
12. the local tier's CI-reading rung intact -> add; untouched-surface; origin: the request named the tier scope.
13. no docs/internal page asserts the superseded rule -> add; origin: the request named the reconciliation.

Omitted: a wall-clock ceiling criterion (neither origin holds; a brittle number, and the
quantitative rule would demand a named counter for a figure nothing depends on). Omitted: a
coverage-map registration criterion (lib/test/run-parallel.sh already has an owning module, so
no new entry is owed).

Steelman record

pass 1

Checked: 23 file references (all exist as named), 3 named shell symbols, 7 Verified: premises
(scripts/check-verified-premises.py --body-file reporting total=7 holds=7 refuted=0
unestablished=0, UNGRADED_CLAIMS total=0), and 13 acceptance criteria
(scripts/parse-acs.py --format json reporting acceptance_criteria_unreadable=false, 13 criteria).

projection disposition: represented. Desired Behavior's independently verifiable obligations map to
AC1 (the clean run), AC2 (non-zero exit, naming, and the short-circuit), AC3 (the retained log and
its printed path), AC4 (the fail-open pre-launch posture), AC5 (idempotence), AC6 (the extension
names the command) and AC12 (the local tier is untouched). The sentence about one honest recorded
command and one coordinated flight is a non-obligation — it explains why the one-command shape was
chosen. Unmatched set empty, before and after revision.

Revisions made, 17 across three sweeps:

1. Steelman item 2 found the design's real ordering constraint. lib/test/run-parallel.sh defines
   its run-root helper at line 406 and creates the layout at line 430, both BELOW the argument
   case block at lines 322-350 that the existing read-only mode exits from. A --completion-gate
   arm placed wholly in that block would have no run root and could retain no log. The Approach was
   split in two (the block records the mode; the mode runs after the run-root layout exists), a
   seventh Verified: bullet was added for it, Relevant files gained the dispatch point, and
   Potential Gotchas names the wrong placement an implementer would otherwise choose.
2. AC2 absorbed the short-circuit obligation under the MERGE arm — one failing-tree run is a single
   evidence that establishes the non-zero exit, the naming, and the stopping alike — and the
   Testing-Strategy case that had restated it was removed, keeping that section a residual-risk
   supplement.
3. The universal-quantifier sweep scoped 7 claims. The load-bearing one: the draft asserted the
   completion-evidence validator "never inspects which command ran", which its own quotation does
   not establish (the quoted message proves only what the validator rejects). Rewritten to the
   scoped form the quotation supports — it checks only that the recorded command is a nonempty string.
4. The Step 3.6 dimension self-check found 4 more. cloud-allowlist-skew: the no-new-grant property
   was load-bearing but implicit, so Technical Context now states that the existing entry is a
   PREFIX grant covering the script with a new flag, and that the invocation keeps the bare-leading-token
   matcher shape. non-preflight-path-tool-selection-hazards: Code Patterns now requires the
   pass/fail decision to use bash builtins, naming the fail-open consequence. deployment-variance-silence:
   Code Patterns now bars GNU-only flags, naming the Windows runner. authoring-discipline-defects-devflow
   limb 5: a second unpinned self-referential count ("the five remaining checks") was made count-free.

value-comparison type-semantics check: no acceptance criterion compares a produced value against a
literal on a type-sensitive axis. The comparisons are exit statuses against zero and non-zero, which
are the producing surface's own emitted terms.

unstated-mechanism-dependency hunt: 10 dependencies enumerated, existence determined by reading the
producing surface in each case — _artifact_preflight, _cheap_lint_preflight, _cheap_lint_run
and its - expansion idiom, the argument case block and its die, the help-start/help-end
sentinels, _try_run_root and the RUN_ROOT layout, the parallel-suite-runner module's synthetic-tree
fixture, run-module.sh as the driver, the completion-evidence validator's command-agnosticism, and
the retained-log-root field of the Verification evidence: marker. 10 present, 0 absent, 0 not
established. The _try_run_root determination is what produced revision 1.

Stated-but-unbound inputs: none. Every mechanism input is a named literal command or a named function.

universal-quantifier sweep: 7 scoped as recorded above; every quantifier remaining in the body either
ranges over the closed set of seven checks declared complete by construction in the Acceptance
Criteria grounding block, ranges over files the sentence names individually, sits inside a Verified:
quotation, or is the mandated scope-note boilerplate.

request-origin sweep: every acceptance criterion and every named Testing-Strategy assertion traces to
the request or to a failure the change introduces, per the criterion disposition record above. The
request was established from this run's derivation artifact and the recorded approach election.

Step 3.6 dimension self-check: 9 dimensions judged, 4 findings, 4 revisions (recorded above).
context-compaction does not engage — the mode holds no remembered state across turns.
shallow-clone-safety does not engage — no recipe command reads git history.
coupled-mirror-sites fired and is discharged by the Potential Gotchas entry naming the argument
guard message, the help block, and the module assertion that pins the message.
executable-evidence-for-behavioral-regressions is satisfied: the plan is module assertions at an
executable boundary with a stated RED-first obligation, and it proposes no prose pin.

Evidence bundle coverage: 15 axes evidenced, 2 axes marked N/A with a named check, 0 unestablished.
Effective list not degraded — the pass-time ## Evidence axes re-load returned exit 0 with content.

no-options gate re-run on the revision: passes. Three gate words remain, each inside a Verified:
verbatim quotation, which the rule carves out; zero elsewhere in the body.

pass 2

Run against the post-audit revision, before the canonical overwrite.

Checked: 7 Verified: premises (total=7 holds=7 refuted=0 unestablished=0, UNGRADED_CLAIMS total=0),
18 acceptance criteria (acceptance_criteria_unreadable=false), 3 Documentation Needed deliverables
(extractor output unchanged), and every file reference introduced by the revision.

projection disposition: represented. Desired Behavior's obligations after the revision map to AC1
(the clean run and the single exit status), AC2 (non-zero exit, naming, short-circuit), AC3 (the
per-check pass-path report and the elapsed line), AC5 (the retained log and its printed path), AC9
(the extension names the command) and AC17 (the local tier). Unmatched set empty.

Revisions made: 12 audit findings acted on, all 12 verified against the tree first, plus 3
no-options repairs on the revised text.

• F1: the accepted cost now names the four dropped shards and test_module_runner.py explicitly.
• F2: two criteria added — the pass-path per-check report with an elapsed line, and the CLAUDE.md
  record-contents bullet — closing the success-path-channel gap.
• F3: the CLAUDE.md criterion was replaced with one scoped to the whole-suite-gate section and the
  two route bullets, not the ladder entry alone.
• F4: the pin-corpus criterion now names the string pin-corpus-classifier.py and the assertion it
  protects. ONE AUDITOR SUB-CLAIM REJECTED: the auditor asserted a mention inside
  test_pin_corpus_classifier.py would also trip the count; it would not, because the underscored
  filename does not contain the hyphenated string. Verified with a substring check. The core defect
  was real and is fixed; the rejected rationale was not carried into the draft.
• F5: the ordering constraint now names all four intervening steps and the guard that skips them.
• F6: a criterion was added refusing a run in which any seam resolved empty.
• F7 (advisory): the false coupled-site safety net was replaced with the true statement plus a new
  assertion obligation.
• F8: both unverifiable figures were removed from the load-bearing position. The cost claim is now
  stated as re-derivable in-repo by timing the named commands; the catch-rate claim names its
  instrument and window and is explicitly marked a drafting-time observation that the repository
  cannot re-derive.
• F9: a criterion was added for the no-writable-run-root path.
• F10 (advisory): the missing fingerprint.json on a completion-gate run root is now stated.
• F11: a single-source criterion was added, including removal of the canonical marker.
• F12 (Quiet Killer): lib/test/run-module.sh parallel-suite-runner was added to the recipe, so the
  module owning the coordinator's own behaviour is inside the gate it installs. The closed set moved
  from seven members to eight throughout. Measured: 32.7s, 276 assertions, green.

no-options gate re-run on the revision: passes, zero gate words outside Verified: quotations. Three
were introduced by the revision itself and removed — a disjunctive canonical-marker disposition
(decided: the marker is removed), a disjunctive restatement of the superseded rule, and a
three-item list conjunction.

universal-quantifier sweep on the revised text: every quantifier the revision introduces ranges over
the eight-member closed set declared complete by construction, over files the sentence names
individually, or is pinned by the criterion carrying it.

unstated-mechanism-dependency hunt: 2 new dependencies enumerated — the guard around the four
skipped steps and the seam-empty refusal, both work this change creates and named in the Approach —
plus lib/test/run-module.sh, verified present in prflow_implement.allowed_tools on the default
branch. 3 present, 0 absent, 0 not established.

request-origin sweep: every criterion the revision adds rests on a failure this change introduces,
each one named by a verified audit finding.

Evidence bundle coverage: 15 axes evidenced, 2 axes marked N/A with a named check, 0 unestablished.

Evidence bundle

Entry forms: Verified: (command/file plus what it established); N/A — checked <how>;
unestablished — <why>. Currency triggers: an answer changing the mechanism space; an answer
contradicting an entry; a mechanism class added after this was written.
Effective axis list at pass time = generic floor (producers, consumers, execution environments,
persistence, lifecycle/termination, migration/coexistence, coupled tests and docs) + consumer axes
(per-profile cloud allowlists, install-channel skew, workpad/retrospective lifecycle, the run.sh pin
corpus, grant-timing bootstrap, measurement-command naming, consumers-axis floor, closed-set
complement).

• producers: Verified — map part 3 above; five producing lines read, all present.
• consumers: Verified — map part 2 above; three call sites read with the quoted sentence that reads
  the value.
• execution environments: Verified — the change binds the cloud implement tier only; the seven
  commands were executed locally in this pass (timings in the measurement axis) and every one is
  granted on origin/main ad6da899a.
• persistence: Verified — the record persists as one Verification evidence: workpad marker and one
  completion-evidence marker; neither format changes.
• lifecycle/termination: Verified — the Blocked terminal and the execution-ceiling terminal already
  exist (phase-4-documentation.md line 299); the change adds no terminal.
• migration/coexistence: N/A — checked: neither changed file ships to a consumer; there is no
  deployed copy to coexist with.
• coupled tests and docs: Verified — #480 and #798 enumerated in map part 4;
  docs/internal/architecture/execution-model.md line 25 speaks only of focused tests and needs no edit.
• per-profile cloud allowlists: Verified — all seven commands present in
  prflow_implement.allowed_tools on origin/main; the read-only review profile does not run
  Phase 4.3, so it is not an operand.
• install-channel skew: N/A — checked: install.sh copies only the two workflows, and lib/test/
  is pruned from the vendor slice, so neither half of this change reaches a consumer.
• workpad/retrospective lifecycle: Verified — the note reflection kind and the completion-evidence
  marker families are unchanged; only the command the marker names changes.
• run.sh pin corpus: Verified — #480 unaffected because no grant is added; #798 unaffected
  because no run.sh invocation is added.
• grant-timing bootstrap: Verified — this change ships NO entry in prflow_implement.allowed_tools,
  so no obligation rests on trigger-time-resolved state. The three grants it depends on landed in
  issue Grant three drift-detecting helpers to the cloud implement tier and mirror them into the matcher-probe EXTRAS list #2123 (PR Grant three drift-detecting helpers to the cloud implement tier and mirror them into the matcher-probe EXTRAS list #2124, merged ad6da899a) and are live on the default branch.
• measurement-command naming: Verified — every timing below names the command that produced it.
• consumers-axis floor: Verified — discharged by map part 2's call-site reads.
• closed-set complement: Verified — the recipe is a closed set of seven checks; its complement is
  every other assertion in the suite, and that complement is handled by CI on the pushed commit,
  which remains the required merge gate.

Criterion disposition record — the five criteria added after the audit

The folded block above opens "Thirteen criteria added" and covers the first landed draft. The
post-audit revision took the draft to eighteen criteria. The five it added are graded here under the
same omit/merge/add rule; each took the add arm, and each rests on a failure this change introduces
that a verified audit finding named.

14. the pass-path per-check report plus an elapsed line -> add; origin: a failure the change introduces requires it — audit finding F2, the success-path channel gap: a green gate otherwise reports nothing about which checks ran.
15. a run with any seam resolved empty exits non-zero naming the disabled check -> add; origin: a failure the change introduces requires it — audit finding F6: the dash-expansion idiom makes each check disable-able, and the completion-evidence validator sees an empty skip list.
16. the no-writable-run-root path still runs all eight checks -> add; origin: a failure the change introduces requires it — audit finding F9: every check is read-only, so a run-root allocation failure must not fail a passing tree.
17. the extension is the only file stating the gate command, and the canonical marker is removed -> add; origin: a failure the change introduces requires it — audit finding F11: three files would otherwise state the command against the change's own single-source intent.
18. the whole-suite-gate section no longer states the coordinator-only rule, and the two route bullets each state what they still serve -> add; origin: a failure the change introduces requires it — audit finding F3: the original criterion was unsatisfiable without amending those bullets.

Merge arm taken once after the audit: the short-circuit obligation from finding F2's sibling was
folded into the existing failing-check criterion rather than added separately, because one failing-tree
run is a single evidence establishing the non-zero exit, the naming and the stopping alike. Omit arm
taken zero times after the audit.

[The01Geek]

PRFlow's development has moved to a separate canonical repository, and this repository is now the generated distribution tree that each release is published from. Tracking for this work has moved with it, so this issue is being closed here rather than left as a duplicate.

Nothing about the work itself is dropped — the report was reviewed and kept. This issue also referenced internal paths (the test suite, internal documentation, development CI) that are no longer part of the published tree, so it could not be acted on from here in any case.

Bug reports and feature requests are still very welcome in this tracker; they are read and triaged the same way.