From e019d04f83aa10da0c1fce21467464e96fb5a00d Mon Sep 17 00:00:00 2001 From: Brummel Date: Fri, 29 May 2026 14:35:38 +0200 Subject: [PATCH] feat: plan-recon content-pin blast radius (issue #1 Fix 3) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit plan-recon already had a Non-compile-checked sweep, but it was gated behind signature/variant/removal scopes (omittable otherwise). The raw-buf.2 failure was a module addition that shifted a workspace-listing hash pinned in two test files — no signature change — so the sweep was legitimately skipped and the twin pin was missed. Adds "Content-pin-perturbing scopes" to Step 5: when the iteration shifts a content-addressed/hashed/snapshot value a test pins, the Non-compile-checked sweep is MANDATORY and must enumerate EVERY test file that grep-matches the perturbed constant — not just the first. Updates the omission clause accordingly, leans on the CLAUDE.md lockstep-invariant pairs (no new profile slot), and adds a Common Rationalisation plus two Red Flags. Embedded in the agent's own file so the discipline does not depend on orchestrator memory. refs #1 Co-Authored-By: Claude Opus 4.8 (1M context) --- planner/agents/plan-recon.md | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-) diff --git a/planner/agents/plan-recon.md b/planner/agents/plan-recon.md index 647470b..3a2266f 100644 --- a/planner/agents/plan-recon.md +++ b/planner/agents/plan-recon.md @@ -126,6 +126,22 @@ never to fix or write. missing the second is a known failure mode the project's past audits have flagged. + **Content-pin-perturbing scopes.** A change need not touch a + signature, variant, or symbol to break a test: if + `iteration_scope` adds, removes, or renames anything that + shifts a content-addressed or hashed value a test pins — a + workspace / package listing, a content digest, a generated + manifest, a snapshot — the Non-compile-checked sweep above is + MANDATORY for this scope too, independent of any compile-driven + set. Enumerate EVERY test file under the project's test roots + that grep-matches the load-bearing constant, fixture name, or + assertion shape the change perturbs — not just the first hit. + The recurring failure here is a hash pinned in two test files + where the recon found one and missed the twin; a module + addition that shifts a workspace listing is the canonical case. + Start from the lockstep-invariant pairs in the project's + `CLAUDE.md` — a content-pin is a lockstep invariant. + 6. **Spec-named-path existence table.** Before recording anything under "Anchors not yet present", `ls`-verify every path the spec names. `git ls-files ` or @@ -210,9 +226,12 @@ answer. For iterations where `iteration_scope` does NOT involve a signature change / variant addition or removal / public-symbol -removal, the "Compile-driven site set" and -"Non-compile-checked sites" sections MAY be omitted; the -"Spec-named-path existence table" is always required. +removal AND does not perturb a content-addressed pin (see +"Content-pin-perturbing scopes" above), the "Compile-driven site +set" and "Non-compile-checked sites" sections MAY be omitted; the +"Spec-named-path existence table" is always required. A +content-pin-perturbing scope requires the "Non-compile-checked +sites" section even when no compile-driven set applies. ## Status protocol @@ -235,6 +254,7 @@ removal, the "Compile-driven site set" and | "Hand-listing every match arm gives me the site set — the compiler would say the same" | Multiple documented misses in this project's history say otherwise — each missed a different site type. For signature / variant / removal scopes, the compile-driven enumeration is authoritative; the hand-list is advisory. Run the type-checker after a stub, report the broken site set verbatim. | | "The spec says path X does not exist, so I don't need to verify it" | An existence claim feeding a recon is itself load-bearing. `git ls-files ` or `test -e ` is the authoritative check; an orchestrator-time grep of a sibling directory is not. The existence table makes this unmissable. | | "Compile-driven enumeration covers everything that matters" | It covers compile-checked sites only. Drift pins, fixtures, design-doc anchors, prose references — none of these break the build. Run a separate `git grep` sweep and report it under "Non-compile-checked sites". | +| "The change only adds a module, it touches no signature — no blast radius" | A pure addition can still shift a content-addressed value (a workspace listing, a hash, a snapshot) that tests pin. Enumerate every test that grep-matches the perturbed constant; the canonical miss is a hash pinned in two files where one was found and the twin missed. | ## Red Flags — STOP @@ -253,3 +273,8 @@ removal, the "Compile-driven site set" and - About to return only the compile-driven set without sweeping for non-compile-checked sites (drift pins, fixtures, doc references) +- About to treat a content-pin-perturbing scope (module + add / remove / rename, listing or hash change) as having no + blast radius because it changes no signature +- About to report one content-pin test site without grepping + for its twins under the project's test roots