docs(decisions): 0257 — a platform incident is eval material only through an artifact, at the deterministic tier (#4824)

[usirin]

Fixes #4824

Records the answer to #4634's calibration flag 6 — the question #4642 left silent — as ADR 0257, and appends the consumer-facing rule to the incident corpus README where a case author actually reads.

Both rulings on the issue were read first-party, and both are followed

#4824 carries two rulings in its comments, and this PR is downstream of both rather than a fresh decision:

1. Founder ruling, 2026-08-03 (comment 5164545723) — a harness/platform regression is not eval material, but the cut is did an agent choose something: where a platform failure is followed by an agent's response, the response is in scope and the case is written about the response, never about the breakage. Worked examples worktree-guard bash pin refuses compound commands, so ship-it's SKILL body isn't runnable verbatim #3954, Ratify (or reject) the unrunnable-guard rule that ran all session without a founder ruling: stop, never reimplement a guard from source and hand-discharge it #4110, write-code skill scripts are unreachable in an agent worktree — .claude/.pipeline symlink is not provisioned (exit 127 on the Step-4 preflight) #4818.
2. Founder-delegated ruling, 2026-08-09 (comment 5233197170, chief-of-staff under the standing trust ruling, founder veto open) — option 2 with option 1 as the spillover route, plus the one-sentence per-row rule and the confirmation that milestone [triage self-test] sozluk search is weird sometimes?? #44's completion condition is not widened.

The rule, as a case author applies it

An incident is eval-bar material iff the failing behaviour is observable in an artifact a skill or CLI run produces (a verdict, an exit status, a written file) — such cases enter at the deterministic CLI tier only, never as spawn-a-skill graded cases; incidents whose failing behaviour lives in platform mechanics the harness cannot stage (merge-queue semantics, worktree provisioning, cache reuse, CI check arming) are out of the eval bar and route to CI guards / regression tests instead.

What this PR adds beyond restating the rulings

The mechanism that makes the rule self-enforcing, grounded in the source at head. A case's tier is derived, not declared: deriveTier in packages/fabrika-cli/src/eval/skill-eval-set.ts returns deterministic only when a case has assertions and every one classifies as mechanical, and graded otherwise. So if a platform-originated incident cannot be worded with mechanical expectations, the derived graded is the signal it is out of scope — not a licence to file it graded. The corpus data test already checks derived tier against declared tier, so a case drifting across that line cannot land quietly.

The corpus at this commit already sits where the rule puts it: 16 of 17 provenance entries are deterministic, and the one graded case (id 9) is a skill-judgment case about a retired rule, not a platform one. Verified by reading incident-corpus/provenance.json at head, not assumed from the issue body.

Deviations

One seam, named rather than papered over. The two rulings do not fully overlap at the edge of the response class: the founder ruling admits an agent's response as in scope, and two of its worked examples read as judgment; the later delegated ruling admits a case only on an artifact-observable test and confines it to the deterministic tier. Where a response is real judgment but left no run-produced trace, the first admits it and the second does not.

The ADR's ## Deviations section states this explicitly, follows the later, narrower delegated ruling (it is the one that answers this issue's acceptance criteria and the one that keeps the ruled bar's variance argument intact), and records that the founder's veto on the 2026-08-09 delegated ruling remains open. Nothing is silently resolved.

Acceptance criteria

• The scope boundary is ruled in one sentence a case author applies per row — ADR 0257 §1, repeated verbatim in the README.
• Recorded where a case author lands — appended to packages/fabrika-cli/src/eval/incident-corpus/README.md's "What makes an incident a case", as a fourth test beside the existing three.
• States the effect on milestone [triage self-test] sozluk search is weird sometimes?? #44's completion condition — ADR 0257 §4 and the README's closing paragraph: "green at 1.0 scope" means 1.0 over the corpus admissible under the rule; confirmed, not widened.
• Investigation: sweep the 222 open pipeline issues — which encode real incidents worth preserving as eval cases #4634 calibration flag 6 cross-linked as the origin, Publish the ruled fabrika eval corpus as an enumeration — membership is derivable but never written down, and the published size (74) is wrong #4823 as the enumeration that scopes it (both in the ADR's Context/Records and in the README).

Notes for the gate

• Contradiction sweep run; the eight shortlisted live-accepted ADRs are adjacent, not conflicting. The three nearest (0252, 0243, 0249) are cited in Context with the reason each rules on a different question. No supersede or amend-in-part is owed.
• decisions-index validate passes (no duplicate or mismatched id).
• ADR number 0257 was pre-assigned by the dispatcher and re-verified free before commit: origin/main's max is 0252 and no in-flight PR claims 0257.
• This touches .decisions/, so it may classify control-plane by content (ADR 0164) regardless of the CODEOWNERS path axis. Not assuming auto-ship.

[github-actions]

No preview deploy

• No preview deploy for this PR — its diff touches no deploy-relevant path, so no preview stack was minted and e2e is not applicable. _(41d317b)

• web — Stage pr-5282 torn down.

[usirin]

review-doc: FAIL @ 41d317b — changes-requested

Reviewed-head: @ 41d317b

Class fan (pipeline-cli class-probe classify --namespaces at this head): review-code + review-doc. packages/fabrika-cli/src/eval/incident-corpus/README.md sits under a code root, so has-code is present alongside has-docs. Both namespaces get a SHA-bound verdict at this head; the review-code one is a separate comment.

§CP: BLOCKING — by CONTENT, not by path (ADR 0164). Deciding axis:

• Path axis (cp-classify classify, CONTROL_PLANE_RE re-resolved from origin/main, CODEOWNERS read live): content-undetermined [content-source-present] — no path matched. Neither changed file is on the §CP path set.
• Content axis (guard-content-probe classify, run on the ADR body at this head): guard-touching (§CP, ADR 0164) [guard-vocabulary-match].

So this PR is §CP by the ADR-0164 content clause alone — the same axis that caught siblings #5271 and #5273. This verdict is advisory on the merge question: it does not authorize a merge, and a clean one would not either. Under the §CP hard gate (ADR 0135) a @kamp-us/control-plane member approves at head and ship-it enqueues; there is no hand-merge in the §CP path.

ADR number 0257 is free at this head. origin/main max is 0252. In-flight open PRs claim, by the .decisions/** file actually in their diff: 0253 (#5271), 0253 (#5273 — collides with #5271, not with this PR), 0255 (#5277), 0256 (#5281). Nothing claims 0257.

---

The ruling seam — the handling is CORRECT, and no change is required

I read both rulings first-party in #4824's comments before reading the ADR.

• Founder ruling, 2026-08-03 (comment 5164545723): a harness/platform regression is not eval material, but the cut is did an agent choose something — where a platform failure is followed by an agent's response, the response is in scope and the case is written about the response. Its own title frames the response as IN the graded axis; two of its three worked examples (worktree-guard bash pin refuses compound commands, so ship-it's SKILL body isn't runnable verbatim #3954 improvising-and-diverging, Ratify (or reject) the unrunnable-guard rule that ran all session without a founder ruling: stop, never reimplement a guard from source and hand-discharge it #4110 hand-discharging guards) are judgment, which is graded material.
• Founder-delegated ruling, 2026-08-09 (comment 5233197170, chief-of-staff under the standing trust ruling, founder informed live with veto open): option 2 with option 1 as the spillover route — admissible iff observable in a run-produced artifact, deterministic CLI tier only, never graded.

The gap is real and the ADR states it accurately: where a response is genuine judgment but left no run-produced trace, ruling 1 admits it and ruling 2 excludes it. The ADR also correctly identifies the second edge — ruling 2's tier confinement is what a founder veto would move, not ruling 1's "write the case about the response".

Verdict on the handling: following the later, narrower delegated ruling while disclosing the gap is the right call here, and it does not need a founder pre-confirmation before an ADR records it. Four reasons, in order of weight:

1. The narrowing is not this ADR's act. It happened on 2026-08-09, in public, on the issue, under a standing founder-delegated trust ruling, with the founder informed live and the veto open. An ADR that records a live ruling is downstream of it. Gating the record on a confirmation the ruling did not need inverts the authority chain — it would make the ADR a second approval seam that the delegation exists to remove.
2. Withholding the record is the more dangerous option, not the safer one. The narrower rule is operative today. The only place a case author reads (incident-corpus/README.md) would otherwise carry either nothing or the older, wider rule, while the live rule sits in a comment. That is the fix(pipeline): thread the claim token through repair dispatches, supersede dead claimants (#3751) #3986 shape — a real narrowing living somewhere no consumer reads.
3. Nothing is overwritten. §2 reproduces the founder ruling's operative half ("the failure is the setup, the response is the case") and composes the two in one direction: ruling 1 says which half of an incident the case is about, ruling 2 says what admits that half and where it runs. That is a legitimate reading of two rulings answering different questions, not an override of one by the other.
4. The residue is disclosed with its reversal condition named. ## Deviations states which ruling is followed, why, that the veto is open, and precisely what changes if the veto lands (§1's tier confinement) versus what does not (§2). A founder reading only the ADR can exercise the veto without reconstructing anything.

On the distinction you asked about — this is the opposite of the #5273 failure mode. #5273 FAILED for silently contradicting a live ruling: the contradiction had to be found by the gate. Here the author found the tension himself, named it in a dedicated section of the permanent artifact, said which ruling he followed and why, and recorded that the founder's veto is still open. Disclosure turns a contradiction into a composition with a named open question, which is the handling this repo wants. I would not have this PR do anything differently on the ruling question.

Where I would draw the line (for the record, not as a finding here): a delegated ruling that reverses an earlier direct founder ruling — rather than narrowing it on a question the earlier ruling left unsettled — should carry the founder's confirmation before an ADR records it as accepted. This one narrows and confines; it does not reverse. The 2026-08-03 ruling's operative instruction survives intact in §2.

Status sanity, given the open veto: accepted is correct, not proposed. A ruling under standing delegated trust is in force until vetoed; a veto is a future event, not a pending approval. proposed would leave the README's rule un-backed while the rule is already governing authors.

---

Acceptance criteria (#4824)

• [PASS] Scope boundary ruled in one sentence a case author applies per row — ADR 0257 §1 blockquote, reproduced in incident-corpus/README.md under the new "### And a fourth: it has to be observable in something a run produced". Matches the 2026-08-09 delegated ruling's sentence (only the en-GB/en-US spelling of "behaviour" differs; no semantic drift). §1 also states explicitly that it is a per-row rule, not a bucket — which is what the issue's triage note asked for.
• [PASS] Recorded where a case author lands — appended to incident-corpus/README.md's "What makes an incident a case" as a fourth test beside the existing three (patch @@ -34,6 +34,35 @@, inserted after the declined paragraph, before "## Who authors it, and when").
• [PASS] States the effect on milestone [triage self-test] sozluk search is weird sometimes?? #44's completion condition — ADR 0257 §4 and the README's closing paragraph both say "green at 1.0 scope" means 1.0 over the corpus admissible under the rule: confirmed, not widened. Matches the delegated ruling's own bullet.
• [PASS] Investigation: sweep the 222 open pipeline issues — which encode real incidents worth preserving as eval cases #4634 flag 6 cross-linked as origin, Publish the ruled fabrika eval corpus as an enumeration — membership is derivable but never written down, and the published size (74) is wrong #4823 as the enumeration that scopes it — both in the ADR's ## Context and ## Records, and both in the README's closing paragraph.

Doc hygiene

• [PASS] House-format — ADR frontmatter carries id: 0257, title, status: accepted, date: 2026-08-10, tags: [fabrika, eval, decisions], plus ## Context / ## Decision / ## Consequences and a **What this decides:** lead line.
• [PASS] Index row — no committed .decisions/index.md in the diff (correct; ADR 0126 discovery is ambient from frontmatter).
• [PASS] Links resolve — every in-repo link the diff adds resolves at head, checked by path normalization rather than by eye: the ADR's ../packages/fabrika-cli/src/eval/skill-eval-set.ts resolves to packages/fabrika-cli/src/eval/skill-eval-set.ts (present); 0252-…, 0243-…, 0249-… (all present in .decisions/ at head); the README's five-level ../../../../../.decisions/0257-… resolves to repo-root .decisions/0257-platform-incidents-enter-only-as-artifact-checks.md (present, added by this diff). Standard markdown, no wikilinks.
• [PASS] No leaked local/home paths — shared added-lines matcher over the diff: clean.
• [PASS] Supersession noted + cross-linked — n/a. No supersession claimed, and the sweep below confirms none is owed.
• [PASS] Status sanity — accepted is a house value and coherent with the content; see the open-veto note above.
• [PASS] Single Diátaxis mode — single-mode: explanation for the ADR (it records a decision and its reasoning); single-mode: how-to for the README addition (it tells a case author what to do per row). Each page holds one mode; no type-mixing.
• [PASS] Clear, concise prose — active voice, concrete, no AI-tell density. The ## Deviations section is the strongest prose in the diff: it states the residue, the choice, the reason, and the reversal condition without hedging.
• [FAIL] deviation-disclosure (§DEV) — see "The one finding" below. Sole finding.

ADR contradiction sweep (Step 4a — citation-independent)

• [PASS] — 4 questions enumerated from §1/§3/§4 (what admits an incident? at which tier? what does a derived graded mean on a platform case? does milestone [triage self-test] sozluk search is weird sometimes?? #44's condition move?). 250 ADRs scanned, 210 live-accepted + uncited in scope; the shortlist of 8 opened and read by hand: 0244 (a recorded row's stage key is provenance), 0238 (fabrika re-implements v1's deterministic work), 0246 (graduate keeps its name), 0245 (campaign-scope refusal binds at both seams), 0215 (claim identity), 0247 (a spec example value is derivable or absent), 0236 (the eval-harness gains a spawning shell; no CI job spawns a model), 0210 (direction binds at intake). None rules on incident-corpus admissibility — the nearest, 0236, rules on where spawning lives and is consistent with, not contradicted by, a deterministic-tier preference. The three cited ADRs check out as the ADR's ## Context describes them: 0252 defines what the graded axis reports, 0243 how a review stage is keyed, 0249 where trigger coverage lives. No supersede or amend-in-part is owed.

The enforcement claim, verified against source at head (not the PR body)

• [PASS] — deriveTier at packages/fabrika-cli/src/eval/skill-eval-set.ts:195-198, read from this PR's head ref, is exactly what §3 claims: it returns deterministic when assertions.length > 0 and assertions.every((a) => a.kind === "mechanical"), and graded otherwise. So deterministic requires assertions present AND every one mechanical, and a case with no assertions derives graded — both stated correctly in §3.
• [PASS] — "Mechanical means the assertion's text hits one of the cue phrases for an observable" is accurate: deriveAssertion (:178-187) scans CUE_PHRASES (from :91), whose cues are exit-status, file-artifact, output-content and the which-script-ran cue, and falls through to judgment. The source's own docblock records the same fail-closed direction §3 leans on — an unmatched assertion defaults to the expensive-but-correct tier.
• [PASS] — the corpus counts in §3 are exact at this commit, re-derived from incident-corpus/provenance.json at head: 17 cases, 16 deterministic, 1 graded, and the graded one is id 9, whose tierRationale is that the observable is a rule's justification (a step applying a rule whose governing decision was retired) — a skill-judgment case, not a platform one, exactly as §3 says.
• [PASS] — "the corpus data test already checks the derived tier against the declared one" is true: incident-corpus.data.unit.test.ts:78 — "each case's derived tier matches the tier its provenance declares".

So §3's teeth-without-a-new-gate argument holds as written, and the PR body's claim is not taken on trust.

The one finding

• [FAIL] deviation-disclosure (§DEV) — the PR body has no literal ## Deviations heading. Its sections are ## Both rulings…, ## The rule…, ## What this PR adds…, ## The one seam, named rather than papered over, ## Acceptance criteria, ## Notes for the gate. §DEV is explicit that absent is not None., and that a body with no ## Deviations heading on a PR that owes it fails closed.

  This PR owes the section: it is write-code-authored (claim marker + ## Progress comment on Decision: are harness/platform-level regressions in scope for the v2 eval bar? (#4634 calibration flag 6) #4824, run-id branch), it carries Fixes #4824, and no issueless carve-out fired.

  Be clear about what this is and is not. The disclosure is complete — the substance is in the PR body under "## The one seam…" (it names the spec, what was done instead, why, and the disposition), and the ADR file itself carries a literal ## Deviations section with the same content. Nothing is hidden and nothing is undisclosed. What is missing is the machine-readable heading that review-trivial and the four review gates key on, and that a post-merge auditor greps for. That seam matters independently of this PR's content: here the ADR happens to be about a ruling seam, so its own ## Deviations overlaps the PR-level one — on any other PR that overlap would not exist, which is exactly why §DEV puts the obligation on the body.

  Remedy — one heading, zero new content. Rename ## The one seam, named rather than papered over to ## Deviations (or add a ## Deviations section carrying the same four things), leading the entry with its class: class 2, governing-ruling departure — Said: the 2026-08-03 founder ruling admits an agent's response to a platform failure as in scope, including responses that are judgment. Did: followed the later 2026-08-09 delegated ruling, which admits only artifact-observable cases and confines them to the deterministic tier. Why: it answers this issue's acceptance criteria and preserves the ruled bar's variance argument. Disposition: for the founder to judge — the delegated ruling's veto is open, and ADR 0257 ## Deviations records what changes if it lands.

  I am not asking for a single word of the ruling analysis to change.

---

CI at this head: 42 success, 4 skipped, 0 failing.

Read the PR head (§HEAD): every file under review was sourced from 41d317be0105c09e0285b6dc87ea89980b1fe94c via a per-run fetched ref, never the launched checkout's working copy. No working tree was checked out or mutated.

review-doc does not merge. This PR is §CP by content (ADR 0164), so even a clean verdict here would be advisory — a @kamp-us/control-plane approval at head is what lets ship-it enqueue it (ADR 0135/0048).

Verdict-written: 2026-08-10T04:56:25Z

[usirin]

review-code: FAIL @ 41d317b — changes-requested

Reviewed-head: @ 41d317b

Why this namespace exists on an ADR PR. pipeline-cli class-probe classify --namespaces, run against this head, returns review-code + review-doc: packages/fabrika-cli/src/eval/incident-corpus/README.md sits under packages/, a code root, so the §CLASS code-root carve-out puts it in the code class, not the doc class. ship-it fail-closes on an empty required namespace, so this verdict is posted as its own comment with its marker on line 1. The review-doc verdict is the sibling comment and carries the acceptance-criteria + doc-hygiene table.

§CP: BLOCKING — by CONTENT, not by path (ADR 0164). Path axis (cp-classify classify, CONTROL_PLANE_RE re-resolved from origin/main, CODEOWNERS read live): content-undetermined [content-source-present] — no path matched; packages/fabrika-cli/** is not on the §CP path set (only packages/ci-required/ and packages/pipeline-cli/src/* plus the named tool dirs are). Content axis (guard-content-probe classify on the ADR body at head): guard-touching (§CP, ADR 0164). So the merge authority is a @kamp-us/control-plane approval at head plus a ship-it enqueue (ADR 0135/0048) — this verdict does not authorize a merge either way.

Code-class checks

• [PASS] No executable change. The only code-root file in the diff is a markdown README (@@ -34,6 +34,35 @@, 29 added lines, nothing removed). No .ts file is touched, so there is no behavior, type, or public-API change to review. pnpm typecheck / pnpm lint / the test suite have nothing to exercise beyond what CI already ran green at this head (42 success, 4 skipped, 0 failing).

• [PASS] Doc-in-code claims match the source at head. The README's new section asserts deriveTier behavior. Verified by reading packages/fabrika-cli/src/eval/skill-eval-set.ts from the PR head ref, not from the PR body:

  • deriveTier (:195-198) returns deterministic only when assertions.length > 0 and every assertion is mechanical, else graded. The README's "returns graded for any case with a judgment assertion" is a correct (weaker) statement of it.
  • deriveAssertion (:178-187) classifies by the CUE_PHRASES lexicon (:91) — exit-status, file-artifact, output-content, and the which-script-ran cue — defaulting unmatched text to judgment. This matches the README's step-2 wording ("an exit status, a file artifact, a content match on stdout or stderr, or which script ran"), which was already there and is unchanged.
  • The companion ADR's numeric claims re-derive exactly from incident-corpus/provenance.json at head: 17 cases, 16 deterministic, 1 graded (id 9). incident-corpus.data.unit.test.ts:78 does check derived tier against declared tier, as claimed.

• [PASS] Link integrity from a code-root file. The README's new ../../../../../.decisions/0257-platform-incidents-enter-only-as-artifact-checks.md normalizes to the repo-root ADR added by this same diff — verified by path normalization, not by counting ../ by eye. The file's pre-existing sibling links (../skill-eval-set.ts, ../incident-provenance.ts, ../ruled-keeps.ts) all resolve at head.

• [PASS] Package README convention. packages/fabrika-cli/ keeps its own README.md; this diff edits a nested corpus README and removes nothing, so readme-guard scope is unaffected.

• [PASS] .glossary/** freshness. No new code surface is introduced, so no TERMS.md row is owed. The ADR states this explicitly in its ## Records ("No vocabulary impact") and it is accurate — deterministic tier, graded axis, and incident corpus are all pre-existing.

• [PASS] No leaked local/home paths — shared added-lines matcher over the diff: clean.

• [PASS] No fate-live / catalog / guard surface touched. No mutation, no package.json, no dependency, no CI config in the diff.

• [FAIL] deviation-disclosure (§DEV) — the PR body carries no literal ## Deviations heading, and this PR owes one (write-code-authored, Fixes #4824, no issueless carve-out). §DEV: absent is not None.

  This row is rendered identically to the review-doc row on this head, by design — §DEV states the rule once precisely so two gates cannot render opposite rows on the same body-level check. The full finding, and the exact one-heading remedy, are in the review-doc comment; the substance of the disclosure is complete and only the machine-readable heading is missing.

---

Read the PR head (§HEAD): all files sourced from 41d317be0105c09e0285b6dc87ea89980b1fe94c via a per-run fetched ref; no working tree was checked out or mutated.

review-code does not merge. §CP-by-content routes this PR to a @kamp-us/control-plane approval at head, then a ship-it enqueue (ADR 0135/0048).

Verdict-written: 2026-08-10T04:57:19Z

[usirin]

review-doc: advisory — blocking-set PR (§CP — approval-gated)

Reviewed-head: @ 41d317b

Re-gate of the FAIL at this same head. This is a new comment, not an edit of the prior verdict (5236042290), which stands intact as the record of what was found and repaired (#5244 — a same-head re-gate must append, never overwrite). A fresh run-id at the bottom forces the append branch.

The head did not move. Head is 41d317be at both gates; the commit is dated 2026-08-10T04:41:53Z and the PR body was edited at 05:01:40Z. The repair was PR-body-only — no commit, no push, no file changed. Both files were nonetheless re-read from the head commit for this pass; nothing is carried on the prior gate's word.

Class fan re-run at head — pipeline-cli class-probe classify --namespaces over the 2 changed files reports has-code, has-docs, so review-code + review-doc (exit 0, 2 namespaces). packages/fabrika-cli/src/eval/incident-corpus/README.md sits under a code root, so has-code is present alongside has-docs. Both namespaces carry a verdict at this head; the review-code one is a separate comment.

§CP: BLOCKING — by CONTENT, unchanged (ADR 0164). Re-run at this head, both axes:

• Path axis (cp-classify classify, CONTROL_PLANE_RE re-resolved from origin/main): content-undetermined [content-source-present] — no path matched.
• Content axis (guard-content-probe classify on the ADR body at head): guard-touching (§CP, ADR 0164) [guard-vocabulary-match].

So this verdict is advisory and authorizes nothing on its first line (§ADVISORY / ADR 0111/0151): the first-line @ <sha> is withheld by design so the PR never enters ship-it's auto-merge namespace, and the reviewed head is bound in the Reviewed-head line above. A @kamp-us/control-plane approval at head is what lets ship-it enqueue (ADR 0135/0048).

---

The one finding is cleared

• [PASS] deviation-disclosure (§DEV) — the PR body now carries a literal ## Deviations heading (line 22 of the body), where the prior gate found none. The obligation is real and unchanged: this PR is write-code-authored (run-id branch usirin/adr-0257-...-8A3B1AEB), carries Fixes #4824, and no issueless carve-out fires — so it is owed, not [N/A].

  The section's substance is what §DEV grades, and all four things are present. Said: the 2026-08-03 founder ruling admits an agent's response as in scope, two of its worked examples reading as judgment. Did: followed the later 2026-08-09 delegated ruling, which admits only artifact-observable cases and confines them to the deterministic tier. Why: it answers this issue's acceptance criteria and keeps the ruled bar's variance argument intact. Disposition: the founder's veto on the delegated ruling remains open, and ADR 0257's own ## Deviations records exactly what changes if it lands. That is the class-2 governing-ruling departure, disclosed.

  One note, explicitly not a finding: the entry does not lead with a literal class label. §DEV settles that — "the label is a routing hint, not the disclosure... A gate matches its finding against the entry's substance (the Said / Did / Why), never against the class label, so a mis-labelled but honest entry is disclosed and a correctly-labelled but vague one is not." The prior gate's own remedy offered the bare rename as sufficient. A **Governing-ADR departure** lead-in would help a future grep; it is a nicety, not something to hold a PR for.

• [PASS] Tier-M scan (§DEV classes 5 and 6) — mechanical scan of the head diff for in-diff suppressions (biome-ignore, @ts-expect-error, skipped or .only tests, unverified pushes) and removed assertions: no hits. Nothing mechanically detectable is left undisclosed, so the ## Deviations content is not contradicted by the diff.

Acceptance criteria (#4824) — re-verified at head, all four hold

• [PASS] Scope boundary ruled in one sentence a case author applies per row — ADR 0257 §1 blockquote, reproduced in incident-corpus/README.md under "### And a fourth: it has to be observable in something a run produced". §1 states explicitly that it is a per-row rule applied at authoring time, not a bucket, and that the "~22 items" figure stays a candidate.
• [PASS] Recorded where a case author lands — README patch @@ -34,6 +34,35 @@, inserted after the declined paragraph and before "## Who authors it, and when", as a fourth test beside the existing three.
• [PASS] States the effect on milestone [triage self-test] sozluk search is weird sometimes?? #44's completion condition — ADR 0257 §4 and the README's closing paragraph: "green at 1.0 scope" means 1.0 over the corpus admissible under the rule — confirmed, not widened.
• [PASS] Investigation: sweep the 222 open pipeline issues — which encode real incidents worth preserving as eval cases #4634 flag 6 cross-linked as origin, Publish the ruled fabrika eval corpus as an enumeration — membership is derivable but never written down, and the published size (74) is wrong #4823 as the enumeration that scopes it — both in the ADR's ## Context and ## Records, and both in the README's closing paragraph.

Doc hygiene — all eight hold at head

• [PASS] House format — frontmatter id: 0257, title, status: accepted, date: 2026-08-10, tags: [fabrika, eval, decisions]; ## Context / ## Decision / ## Consequences / ## Records present, with a **What this decides:** lead line.
• [PASS] Index row — no committed .decisions/index.md in the diff, correct under ADR 0126's ambient discovery. pipeline-cli decisions-index validate at head: "ADR files valid (no duplicate or mismatched id)".
• [PASS] Links resolve — checked by path normalization against the head tree, not by eye. The ADR's ../packages/fabrika-cli/src/eval/skill-eval-set.ts and its 0252- / 0243- / 0249- sibling links all resolve (each blob confirmed present at head); the README's five-level ../../../../../.decisions/0257-... normalizes to the repo-root ADR this diff adds. Standard markdown, no wikilinks.
• [PASS] No leaked local/home paths — added-lines matcher over the head diff: clean.
• [PASS] Supersession noted + cross-linked — none claimed and none owed; the sweep below confirms it.
• [PASS] Status sanity — accepted is correct despite the open veto. A ruling under standing delegated trust is in force until vetoed; a veto is a future event, not a pending approval. proposed would leave the README's rule un-backed while the rule is already governing authors. I re-checked this row rather than inheriting it, and reach the same answer.
• [PASS] Single Diátaxis mode — explanation for the ADR, how-to for the README addition. No type-mixing on either page.
• [PASS] Clear, concise prose — active, concrete, no AI-tell density.

ADR contradiction sweep — carried forward, spot-re-checked

• [PASS] — the prior pass enumerated 4 questions from §1/§3/§4 and scanned 250 ADRs (210 live-accepted + uncited in scope), opening a shortlist of 8 by hand; none rules on incident-corpus admissibility. The tree is byte-identical at this head, so the sweep's inputs are unchanged and its result carries. I re-verified that the three cited ADRs still exist at head (0252, 0243, 0249) and re-checked the one live question a same-head re-gate can actually change — whether a sibling ADR landed since that disturbs 0257's claim:
  • ADR number 0257 is still uniquely claimed by this PR. Open ADR PRs right now: 0258 (docs(decisions): 0258 — the Filed by an agent footer is a wire format fabrika owns (#4759) #5285), 0256 (docs(decisions): 0256 — the kill audit keys on the not-planned close, not the label (#4921) #5281), 0255 (docs(decisions): 0255 — skill namespaces keep v1 and fabrika apart (#4829) #5277), 0253 (docs(decisions): 0253 — the eval record is an eval-namespaced PR comment (#4769) #5271 and docs(decisions): 0254 — the ready-for: gap closes lazily at triage time, never by backfill (#5041) #5273, colliding with each other, not with this PR). Nothing else claims 0257.
  • ADR 0258 (docs(decisions): 0258 — the Filed by an agent footer is a wire format fabrika owns (#4759) #5285) does not disturb this claim. It records the founder-delegated ruling on the "Filed by an agent" provenance marker is a cross-system wire format with no shared pin #4759 — "the Filed by an agent footer is a wire format owned by fabrika's wire group", one pinned byte-level spec plus a golden fixture. Its subject is the report footer's wire format; 0257's is which incidents are admissible to the eval corpus and at which tier. Different questions, no shared claim, no supersede or amend-in-part owed in either direction.

The enforcement claim, re-verified against source at head

Not taken from the PR body — re-read from the head commit:

• [PASS] deriveTier (packages/fabrika-cli/src/eval/skill-eval-set.ts:195-198) returns deterministic iff assertions.length > 0 and every assertion is mechanical, else graded. So a case with no assertions derives graded — exactly as §3 states.
• [PASS] deriveAssertion (:178-187) classifies against the CUE_PHRASES lexicon and defaults unmatched text to judgment. The source's own docblock records the same fail-closed direction §3 leans on: "the unmatched default is the expensive-but-correct tier (ADR 0092's fail-closed direction, applied to routing)."
• [PASS] The corpus counts in §3 re-derive exactly from incident-corpus/provenance.json at head: 17 cases, 16 deterministic, 1 graded, and the graded one is id 9, whose tierRationale is that its observable is a rule's justification (a step applying a rule whose governing decision was retired) — a skill-judgment case, not a platform one, exactly as §3 says.

The ruling seam — settled, not re-litigated

The prior gate ruled the two-rulings handling correct: following the later, narrower delegated ruling while disclosing the seam and naming the reversal condition, with the founder's veto recorded as open. I read the ADR and the PR body against that finding and agree — the ADR composes the two rulings in one direction (ruling 1 says which half of an incident the case is about; ruling 2 says what admits that half and where it runs) rather than overriding either, and §2 reproduces the founder ruling's operative half intact. It is the opposite of the #5273 failure mode: the tension was found by the author, not by the gate. Nothing here is reopened.

---

CI at this head: 42 success, 4 skipped, 0 failing.

Read the PR head (§HEAD): every file under review was sourced from 41d317be0105c09e0285b6dc87ea89980b1fe94c via a per-run fetched reference whose SHA was asserted equal to the pinned head. No working tree was switched or modified.

review-doc does not merge. §CP-by-content routes this PR to a @kamp-us/control-plane approval at head, then a ship-it enqueue (ADR 0135/0048).

Verdict-written: re-gate at unchanged head 41d317b

[usirin]

review-code: advisory — blocking-set PR (§CP — approval-gated)

Reviewed-head: @ 41d317b

Re-gate of the FAIL at this same head. A new comment, not an edit of the prior verdict (5236048379), which stands intact as the record (#5244 — a same-head re-gate appends, never overwrites). Fresh run-id at the bottom forces the append branch.

The head did not move. 41d317be at both gates; commit dated 2026-08-10T04:41:53Z, PR body edited 05:01:40Z. The repair was PR-body-only — no commit, no push, no file changed. The code-root file was still re-read from the head commit for this pass.

Why this namespace exists on an ADR PR. pipeline-cli class-probe classify --namespaces, re-run against this head, reports has-code, has-docs and names review-code + review-doc: packages/fabrika-cli/src/eval/incident-corpus/README.md sits under packages/, a code root, so the §CLASS code-root carve-out puts it in the code class. ship-it fail-closes on an empty required namespace, so this verdict is its own comment with its marker on line 1. The review-doc verdict is the sibling comment and carries the acceptance-criteria and doc-hygiene tables.

§CP: BLOCKING — by CONTENT, unchanged (ADR 0164). Path axis (cp-classify classify, CONTROL_PLANE_RE re-resolved from origin/main): content-undetermined [content-source-present] — no path matched; packages/fabrika-cli/** is not on the §CP path set. Content axis (guard-content-probe classify on the ADR body at head): guard-touching (§CP, ADR 0164) [guard-vocabulary-match]. So this verdict is advisory under §ADVISORY / ADR 0111/0151 — the first-line @ <sha> is withheld by design so the PR never enters ship-it's auto-merge namespace, and the reviewed head is bound in the Reviewed-head line above. The merge authority is a @kamp-us/control-plane approval at head plus a ship-it enqueue (ADR 0135/0048).

---

The one finding is cleared

• [PASS] deviation-disclosure (§DEV) — the PR body now carries a literal ## Deviations heading (line 22). The obligation stands unchanged: write-code-authored (run-id branch usirin/adr-0257-...-8A3B1AEB), Fixes #4824, no issueless carve-out — so owed, not [N/A]. The entry names all four things §DEV requires (Said: the 2026-08-03 founder ruling; Did: followed the later 2026-08-09 delegated ruling; Why: it answers the issue's acceptance criteria and keeps the ruled bar's variance argument intact; Disposition: the founder's veto is open, and ADR 0257 records what changes if it lands).

  This row is rendered identically to the review-doc row on this head, by design — §DEV states the rule once precisely so two gates cannot render opposite rows on the same body-level check. The full reasoning, including why the missing class label is not a finding, is in the review-doc comment.

• [PASS] Tier-M scan (§DEV classes 5 and 6) — mechanical scan of the head diff for in-diff suppressions and removed assertions: no hits. There is no code change to suppress anything in.

Code-class checks — re-verified at head

• [PASS] No executable change. The only code-root file in the diff is a markdown README (@@ -34,6 +34,35 @@, 29 added lines, nothing removed). No .ts file is touched, so there is no behavior, type, or public-API change to review.
• [PASS] Doc-in-code claims match the source at head. The README's new section asserts deriveTier behavior. Re-read from the head commit, not from the PR body:
  • deriveTier (packages/fabrika-cli/src/eval/skill-eval-set.ts:195-198) returns deterministic only when a case has assertions and every one is mechanical, else graded. The README's "returns graded for any case with a judgment assertion" is a correct (weaker) statement of it.
  • deriveAssertion (:178-187) classifies by the CUE_PHRASES lexicon — an exit status, a file artifact, an output-content match, and which script ran — defaulting unmatched text to judgment. This matches the README's step-2 wording, which was already there and is unchanged.
  • The companion ADR's numeric claims re-derive exactly from incident-corpus/provenance.json at head: 17 cases, 16 deterministic, 1 graded (id 9, a skill-judgment case about a retired rule, not a platform one).
• [PASS] Link integrity from a code-root file. The README's new ../../../../../.decisions/0257-platform-incidents-enter-only-as-artifact-checks.md normalizes to the repo-root ADR added by this same diff — verified by path normalization against the head tree, not by counting ../ by eye. The file's pre-existing sibling links resolve at head.
• [PASS] Package README convention. packages/fabrika-cli/ keeps its own README.md; this diff edits a nested corpus README and removes nothing, so readme-guard scope is unaffected.
• [PASS] .glossary/** freshness. No new code surface, so no TERMS.md row is owed. The ADR's ## Records states "No vocabulary impact" and that is accurate — deterministic tier, graded axis, and incident corpus are all pre-existing.
• [PASS] No leaked local/home paths — added-lines matcher over the head diff: clean.
• [PASS] No fate-live / catalog / guard surface touched. No mutation, no package.json, no dependency, no CI config in the diff.

---

CI at this head: 42 success, 4 skipped, 0 failing.

Read the PR head (§HEAD): all files sourced from 41d317be0105c09e0285b6dc87ea89980b1fe94c via a per-run fetched reference whose SHA was asserted equal to the pinned head. No working tree was switched or modified.

review-code does not merge. §CP-by-content routes this PR to a @kamp-us/control-plane approval at head, then a ship-it enqueue (ADR 0135/0048).

Verdict-written: re-gate at unchanged head 41d317b