Машина 3-C «Машина охвата A/B/C/D» собрана (TDD): coverage-machine.mjs —
A граф зависимостей (buildDependencyGraph/topoOrder/findHoles/decompositionGroups),
B реестр нужды↔решения (coverageRegistry: дыры+сироты), C requestsChecklist,
D ограничения как нужды (effectiveNeeds), хребет readinessChecklist (4 галочки + §).
Независимый верификатор охвата (рычаг E §6.3). 19 новых тестов, регрессия 2158 GREEN.
Сверка 2026-06-04: все 26 назначений «пункт → машина» актуальны и
непротиворечивы (собранное в M2 подтверждено по коду). Внесены 6 пометок
дельты, назначения по машинам не менялись:
- п.15: default-deny уточнён зелёным проходом (finding 9) + узкое Write-
исключение K4 (Вариант А, реализуется в 3-D)
- п.23: D29 как отдельный сверщик растворён → роль у артефакта + закрытой
двери (C-7); якорь «сырая просьба» сохранён в P16-e (M3)
- п.24: добавлен контракт K5 (судья судит план как будущее, «проверено» за
факт не берёт; реальное проверено = рантайм-сентинел M5)
- п.26: routing-tag ещё живой, редизайн escape отложен в M6
- мастер-карта: K5 добавлен в аварийный блок Машины 4 (рядом с K1/K2)
- чертёж M2: условие В синхронизировано с каноном K4 (читаемый .md через
узкое исключение; печать seal — только каналом одобрения)
Стоит на фундаменте Машины 1. 9 задач: freeze/seal плана (HMAC), детерминированный
матч действие-шаг (op+object, без LLM), персист, семена D12/D13, default-deny decide,
runGate+fail-CLOSED, авто-аудит дверей P15-b, сверка план-след P25-d, инварианты.
Проектные решения A-G помечены явно для ревью владельцем.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
composer/npm moved from hard-blacklist to whitelist; git dev-allow (commit/add/branch/switch/checkout/stash/worktree) + push main-guard in shared shell-content-rules; read-only GitHub (get_*/actions_get/actions_list) in mcp-classifier. Prod-safety (deploy/prod-DB/secrets/workflow-triggers/MCP-write), discipline hooks, and main push/merge stay blocked. Spec+plan in docs/superpowers. tools regression 1991 GREEN.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sibling Claude session 2026-05-30 found that lastTurnEntries treats
harness-injected skill bodies as spurious turn boundaries, breaking both
enforce-memory-coverage (can't find user's coverage line) AND
enforce-normative-content-rules::detectLegitSkillActive (can't find the
Skill tool_use that lives in the assistant message BEFORE the body).
Refinement applied here: this session inspected 29 isMeta:true entries
across the live transcript (8f4ba767-...jsonl) via a debug helper and
found isMeta:true is ALSO used for "Continue from where you left off"
auto-resume, Stop hook feedback strings, and <local-command-caveat>
wrappers — those are real user-equivalent boundaries that must remain
visible. Sibling's blanket "skip isMeta" proposal would have broken them.
Discriminator: skip ONLY when isMeta === true AND typeof sourceToolUseID
=== 'string' (tool-spawned content). Skill bodies have the linking field;
the other isMeta sources do not. The sourceToolUseID field is harness-
controlled and not writable by controller from inside a tool call —
cannot be spoofed.
Behaviour after fix:
* Skill body injection → skipped → walk continues back to find user's
real prompt (with coverage line).
* The assistant message containing the Skill tool_use is now inside the
turn → detectLegitSkillActive finds it → normative writes pass when
invoked under an active claude-md-management skill.
* "Continue from where you left off." → still treated as turn boundary.
* Stop hook feedback strings → still treated as turn boundary.
TDD:
* 3 new tests in tools/enforce-hook-helpers.test.mjs under the
"lastTurnEntries / lastUserPromptText / lastAssistantText / turnToolUses"
describe block:
- lastTurnEntries skips skill body injections (isMeta + sourceToolUseID)
- lastTurnEntries does NOT skip "Continue from where you left off"
(isMeta but no sourceToolUseID)
- turnToolUses includes Skill tool_use spawned in same turn as the
injected skill body
* 2/3 RED→GREEN (the "Continue" negative test passed on baseline already
since its string content satisfies the existing string-content branch).
Scope:
* Fixes 2 of the 5 structural quirks documented in the Stream H
completion log (enforce-memory-coverage gap, enforce-normative-
content-rules detectLegitSkillActive gap).
* Does NOT fix: enforce-read-path-deny LEGIT_SKILLS exemption gap
(separate hook, no lastTurnEntries dependency); TDD-gate cross-actor
blindness (different mechanism — actor session boundaries);
detectFullTestRun regex narrowness (command-pattern matching).
Regression: vitest tools 1788/1788 GREEN (was 1785; +3 new tests).
Plan: docs/superpowers/plans/2026-05-30-lastturnentries-skill-body-skip.md
Opt-in live smoke (ROUTER_LLM_LIVE_TEST=1 + ROUTER_LLM_KEY); auto-skips otherwise
so it never pollutes the unit regression in worktrees where undici is unresolved.
Checkpoint-1 live result on owner machine: PASS (2/2) — single Sonnet judge + 3-judge
consensus (Sonnet 4.6 + Haiku 4.5 + Opus 4.7) reach all models with real verdicts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
8 TDD tasks (~день кода): extract shared AuditChainConfig, refactor VerifyAuditChains (regression-safe), failing tests для multi-tenant/BYPASSRLS/single-row, rewrite AuditRebuildChain через LAG OVER (partition_clause ORDER BY id) симметрично verify, активация ADR-018 enforcement rules, Pint/Larastan/Pest --parallel smoke, handoff для прод-cleanup activity_log_y2026_m05 через gh workflow run artisan-run.yml. Self-review GREEN на spec coverage / placeholders / типы. Execution mode: subagent-driven.
Task 4 уточнён: нет миграций (только PHP), fast-fail активируется сразу после
деплоя. Добавлены конкретные gh workflow run команды для cleanup (Steps 3-4 из
sql-runner.yml) и верификации шторма + incidents алерта. Галочки [ ] оставлены
(задача контроллера, не агента).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
5-task plan to close 3 enforcement gaps surfaced by brain-retro #10:
1. Narrow 'recovery' override scope (5→2 categories)
2. Narrow 'ремонт инфраструктуры' override scope (11→3)
3. Per-rate-window in enforce-override-limit (5/10min)
4. Lower classifier-match threshold 0.8→0.6 + inline router-skip
Driver: 679 override events on 2026-05-28 vs 12 baseline on 25.05.
User selected option B (Level 1+2) after brain-retro #10 analysis.
All 4 implementation tasks completed via subagent-driven workflow
(commits f365c830, 5d17847e, e3591a33, eb728a43).
Final regression 1179/1179 GREEN. Plan saved post-implementation.
Also: cspell-words.txt += 'суппрессить' (project term used in plan).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Groups documentation produced during 2026-05-28 brain-retro session:
retro notes 8 (carryover) and 9, self-retrospect 1, sanity check JSON,
three Phase plans for router-hooks fixes. All implementation already
pushed in earlier commits — this commit groups artifact metadata.
Plus typo fixes in self-retrospect (agregatov, seryj) and cspell vocab
extensions for session-specific terms (PAMYATKA / procs / russian verbs).
Pure documentation. No code, no normative drift.
Investigation 2026-05-25: for tenant client1 (tenant_id=2) on prod liderra.ru:
- 205 leads at supplier (info@lkomega.ru, visit=rt) vs 160 deals on portal
- 82 leads lost (76 via 302-redirect from ValidationException, mostly
non-B-prefix projects: client.carmoney.ru, cashmotor.ru, etc.)
- 37 duplicate deals (CSV-recovered SupplierLead vid=null + later
webhook with real vid "create two Deals because supplier_lead_deliveries
locks on supplier_lead_id, not phone+project)
Three independent fixes, three plans, three deploys:
Phase 1 (low risk): Always JSON 422 for webhook ValidationException
Phase 2 (med risk, billing): merge webhook-after-CSV-recovered into
existing deal, no double-charge
Phase 3 (high risk, migration): accept non-B projects as platform=DIRECT
end-to-end (controller + 4 services + migration)
Phase 3 includes new LeadRouter fallback path: DIRECT-supplier_projects
match Liderra projects via signal_type+signal_identifier directly
(no project_supplier_links pivot required, since psl rows don't exist
for auto-created DIRECT supplier_projects).
Refs: docs/superpowers/specs/2026-05-25-supplier-webhook-reliability-design.md
Дмитрий