A rebuild started one git process per trailer paragraph (#776)

[MongLong0214]

Blocked only on CI. Nothing else is outstanding — all three items from the #776 audit are in, measured, and negative-controlled. Merge when green; that closes #776.

Closes #776. The 23-second rebuild was not a floor — it was 4,329 git process spawns.

Not closing #776: this removes the reason the number was large, and the remaining product question (below) is unchanged in shape but much smaller.

What one rebuild actually did

4329  git interpret-trailers --parse --no-divider     ← essentially all of the time
   3  git log --name-only                             (paths)
   2  git log %(trailers:only,unfold)                 (the batch reader)
   2  git log %B                                      (the re-read)
   ...
4345  total

The batch reader already avoids one process per commit, and the module says so in its own header:

"One git log per batch of commits replaces one process per commit, which is the difference between indexing 100k commits and not finishing."

explodeRecordBlocks went around it. %(trailers) returns only a message's last paragraph, so recovering a squashed earlier block means re-reading the message — and that pass parsed every earlier paragraph to find the ones carrying a second record. On this repository: 3,900 parses to keep 33.

Both changes move a cheap test in front of an expensive one already being discarded

parseRecordBlocks ran asIsolatedBlock on each earlier paragraph and then dropped any result without a Record-Id. The raw-text test now runs first — a trailer key is always at the start of a line in the source and folding continues values, so a paragraph that never names the key cannot yield one.

explodeRecordBlocks skips the parse entirely for messages the atom pass already covers.

The gate was wrong the first time, and how is worth reading

ADR-0014 says "a message with at most one Record-Id anywhere has exactly one block", so the first gate counted occurrences and skipped at ≤1.

That is a statement about how many record blocks exist, not about whether the one git handed the atom pass is it. A commit whose final paragraph is Co-authored-by: has its record one paragraph earlier — %(trailers) returns the conventional block, and the real record is only reachable through the explode pass. The count-only gate dropped nine rows from exactly such a commit here.

The gate now checks position as well as count. The boundary is four tests.

Measured

	Before	After
rebuild, 1122 commits	45 s	6.8 s
trailers rows	7250	7250

Identical, not merely smaller — every row of trailers dumped before and after and compared field by field. That check is what caught the first gate; the timing alone looked like a win.

Negative control: reverting to the count-only gate reproduces the nine missing rows.

What is left on #776

The product question does not go away, it shrinks: what first-use delay is acceptable in a freshly cloned repository, now against ~7 s rather than ~23 s, with CONSUMER_SCAN_BUDGET_MS = 3_000 still the consumer budget.

Two further reductions are identified and not taken here:

• %G? in the rebuild's git log format costs 2.7 s on this tree and is only needed in signature mode.
• The 3-second consumer budget still spends itself on explode for the first slice of commits, which is the wrong thing to spend it on.

[github-actions]

CommitLore — record lint

Trailers: clean — 4 commits in origin/main..d9b4807c2bac25048131f2885b513c753ee482a5
Active constraints: 251 limits · 384 ruled-out · 88 warnings — from 315 records over 11 changed paths

Active constraints for the paths this PR touches

Limits (251)

• - d9b4807 — an entry that appears and disappears entirely between the two snapshots is invisible to this test, and was before -- the snapshot compares two points in time and never claimed to see between them
• r-growingbudgetbatch bcfb255 — the deadline is still only checked between batches and before the expensive half of one, so a single late batch of 1024 commits can overshoot by whatever that batch costs. The overshoot is bounded by one batch rather than by the whole scan, which is what it was before 64 existed
• r-signatureatomoffbydefault a4276d3 — this makes an unsigned-mode index carry '' where it used to carry git's verdict, so a reader that wanted the cached status without turning signature mode on no longer gets it. None exists today, and the honest signal for the difference is the missing meta key rather than the column
• r-rebuildprocesscost bb3d391 — this removes process startup, not work. A repository whose commits genuinely carry multiple record blocks still pays one parse each, and the remaining seconds are the batched git logs and the inserts. %G? in the rebuild format is another 2.7s on this tree and is not touched here
• - 1ca0ac9 — the other tracked dist files auto-merged rather than conflicting, and a line-wise merge of generated JavaScript is not something to trust on its own -- the canonical rebuild is what makes them correct, not git's resolution
• r-rebuildopensdamaged 70dc155 — this covers a full-text table that will not rebuild. Damage that makes createSchema or the first meta read fail still surfaces through the open's own catch, which is where it belonged already; nothing here widens that
• r-initsayswhatitpinned c7de40d — the report names the pinned version and the newer one, but not whether the pinned checkout is intact -- doctor compares the running build against the pinned one and is where that question belongs
• r-upgradeperforms b1e75c9 — nothing here can tell a current that resolves to the right tag over a checkout whose contents are wrong. install.sh verifies a reused checkout's manifest and tag, and doctor compares the running build against the pinned one; step 4's failure text names doctor for exactly that reason
• r-doctorreleasefreshness 174e120 — latestReleaseSync cannot signal a process group, so a git that spawns an SSH client which then hangs is bounded by spawnSync's timeout on the child alone. The async path exists because the notice cannot afford that and this report can
• r-passiveupdatenotice a783a95 — the notice speaks only when a check has already landed, so on a cold cache the first invocation says nothing however out of date it is. That is the trade the zero-latency property buys, and the answer arrives on the next command rather than the first
• r-upgradereadonly ccc634c — upgrade accepts --check but performs no upgrade in this build, and --check is therefore the only behaviour. T-1606 makes the bare form act; until then the command names the install line rather than running it
• r-integrityoffread 2584678 — commitlore index --rebuild still cannot open a structurally damaged index -- openIndex rebuilds the FTS table on open and throws first (commitlore index --rebuild cannot open the index it is meant to rebuild #785). That predates this change and the documented remedy has never run in that state; test/index-corruption.test.ts opens the database directly to work around it and says so
• r-pluginawaredelivery 46c4169 — this does not clean up dual installs already on disk -- somebody in that state keeps paying twice until they remove one by hand. It also reads Claude Code's private state, which has already changed shape once (the registry is on version: 2); when that breaks, it breaks toward writing the hook, which is the direction chosen on purpose
• r-hookmatcherunify fa4373d — neither installer knows the other exists -- init writes the settings.json hook unconditionally, so a user who follows the README to the plugin and then runs commitlore init carries two PreToolUse hooks running the same command. Unifying does not create that double fire, but it widens the overlap from Edit and Write to all five; the partial overlap it replaces was worse to diagnose, because the same user saw records twice on an edit and once on a read
• r-rebuildschema a6d577e — this recreates the file whenever the recorded version differs, so a downgrade discards an index a newer build wrote rather than reading what it can from it
• r-partialsilence 9553e2c — this says the scan was cut short, not which records were missed -- the payload cannot name what it never read
• r-rel114 9692b6d — the README restructure and the mobile hero redesign are not in this release, so the four READMEs remain long and the hero's labels remain small at 375px
• r-builderpin cb1515f — nothing checks that the pinned digest still exists upstream, so a digest deleted from the registry surfaces as a build failure rather than as a clear message
• r-canonmerge761 6a88f2f — this proves the bundle matches this tree; whether this tree is what a reviewer wants is what the pull request is for
• r-rel113 17a1301 — #749 question 1 stays open -- a fix that lives in the hook reaches a repository only on its next visit, and nothing on this machine knows which repositories exist
• r-machinescope e46af2a — this is one check's classification, not a scope field -- another machine-scoped check added later will default to claiming attention again, and nothing here would notice
• r-upgraderebind 49765af — this reaches a repository only when its stub already carries the arm, so one installed before this still needs hooks install once -- the same boundary After an upgrade the hook says "cannot find the CLI" when the CLI is fine and containment refused it #746 recorded, and the reason that command stays the named remedy
• r-746message 5dda01b — the stub is written into .git/hooks at install time, so a repository wired before this keeps the old text and gets the old sentence until hooks install runs there; installing a corrected release is not enough
• r-746narrow 5dda01b — commitlore.node is only tested for -x, so a recorded interpreter that exists but cannot run this bundle still reaches neither arm and falls through to the absence message
• r-rel112 ad6fee3 — the readback confirms the link, not that the interpreter behind it runs -- doctor remains the check for that
• r-rel112 ad6fee3 — this repairs the installer; a machine already upgraded to 1.1.0 or 1.1.1 keeps its stale current until the installer is re-run, which is why the note names the command to check
• r-detectrule728 f1784ce — this records the rule, it does not enforce it -- a new host added with the wrong test still compiles, and Plant a host fixture in Windows CI so this class can't hide behind an empty runner #722's planted fixture is where that could be caught
• r-detectwhy728 f1784ce — still recorded, not enforced -- a new host added with the wrong test compiles
• r-rel111 8c29f5d — Hermes still fails on that machine for a cause that is not this one and is not yet named (Windows: every detected host fails to wire — the temp filename carries the whole path, and hasCommand cannot see a .cmd #716)
• r-rel111 8c29f5d — a zero-byte .cursor/mcp.json on the tester's machine is a user file; the installer read the file it says it reads and reported the true reason
• r-rel111why 8c29f5d — this changes the note, not the behaviour -- the behaviour shipped in the merged branch and is already covered by artifact:verify
• r-canon720 7bf5b82 — this adds no judgement about the Windows behaviour -- it makes the branch buildable, and the live evidence on the pull request is still the only evidence for that path
• r-canon720b 7bf5b82 — this rebuilds, it does not judge -- the Windows behaviour still rests on the live evidence recorded on the pull request, and Hermes and the first-run probe timeout are still open on Windows: every detected host fails to wire — the temp filename carries the whole path, and hasCommand cannot see a .cmd #716
• r-winargv716 7bf5b82 — Does not change executable-only Claude detection or the pre-existing MCP probe shell path; a new canonical dist rebuild is not included from Windows
• r-winexec716 7bf5b82 — Does not change MCP probing or rebuild generated artifacts.
• r-rel110 d9a041f — this release does not make host wiring work on Windows -- detection still cannot see a .cmd and spawn still cannot run one (Windows: every detected host fails to wire — the temp filename carries the whole path, and hasCommand cannot see a .cmd #716)
• r-rel110 d9a041f — 1.0.0 through 1.0.2 have no CHANGELOG entries; a pointer to the releases page stands in rather than reconstructing them
• r-rellock110 d9a041f — nineteen version surfaces was already wrong before this -- the lockfile makes it twenty-one, and the count is only ever known after the gate says so
• r-relmanifest110 d9a041f — this is the release commit's own repair, not a fix -- the next release will need the same regeneration for the same reason
• r-namefile716 f728e69 — only failures name their file; a successful wire still reports no path
• r-namefile716 f728e69 — this makes the cursor question answerable on the next Windows run -- it does not answer it, and the outcome (failed) was never in doubt
• r-overlay709 7e08cbf — unattended is an input to the effective digest but not to the defaults digest -- M-UX: capture leaves the user's workflow #511's exclusion rests on a file's identity being its own bytes, which an overlay breaks
• r-overlay709 7e08cbf — a broken overlay falls back to the built-in defaults, not to the committed file -- layering onto a policy nobody could read states an effective policy no file states
• r-wintmp716 f0ed513 — this fixes the write, not the detection -- codex, hermes and claude-code failed for the second cause and still will
• r-wintmp716 f0ed513 — no Windows machine has run this fix; the guard proves the name, not the install
• r-pend710 b452535 — the wording is checked, not the severity — an abandoned draft still warns
• r-rel102 25c11ed — an installer-boundary fix reaches nobody until it is released
• r-codexok 9021dd9 — a requested integration that failed is not a healthy host
• r-697codx ae6245f — one owner per host step, in the place both installers call
• r-693curr 14909c3 — a hook records a path that does not name a release
• r-693mut2 14909c3 — a rejection test names what does the rejecting
• r-rel101 b65e34f — a distribution-boundary fix reaches nobody until it is released
• r-689host c0e909b — a host is wired or reported undetected, never absent
• r-686skil adbe186 — a permanent config never records a path that belongs to one invocation
• r-682herm 2e64424 — recognition is by field, never by formatting
• r-680ver 47359a1 — an assertion that reads the source it checks proves nothing
• r-rel100 47359a1 — a published install URL must resolve the moment it is published
• r-status550 de514ea — a setting and a behaviour never share one word
• r-590gate 63e48fa — the preregistered verdict is the authority for published M5 figures
• r-g1build 63e48fa — identity travels as version and digest, never as a path
• r-g1e2e1 63e48fa — parity is only measured across process boundaries
• r-gateplan 63e48fa — a plan that lives only in a session is lost at the next compaction
• r-631cov 92c1b37 — coverage describes the index, history describes the sources
• r-638bnd 2607bae — git reports the message's origin, not the commit's
• r-cleanrebuild664 da8948d — the manifest binds dist to committed source, so any uncommitted edit anywhere in src makes a local verification meaningless — this is a property of the check, not of this branch
• r-formatnotmachine661 2cc274d — verified locally only; whether the warning list's numbering also shifts when the check flips is a question only CI answers, because the runners are where the two runs actually diverged
• r-selfscan661 ccab7f4 — ancestry is only knowable while the ancestor lives; a server orphaned by a doctor that has already exited is indistinguishable from any other session's, and is correctly counted as one
• r-liveruntime660 6a221db — ps is the seam, so this reports nothing on win32 and says so rather than claiming a clean machine
• r-committedat650 f077870 — this pins the spelling, not the clock; nothing here makes two gits agree about anything else in %cI
• r-prosetrailer647 30e40c7 — this changes the advice, not the outcome; the commit is still refused, which is correct while git reads the line as a trailer
• r-repointsays629 c7ab87e — this reports the move, it does not verify the new target runs — hooks status owns that check and is unchanged here
• r-childtreediag640 69c98a0 — the diagnosis is printed, not asserted — the next failure explains itself but the step still cannot say which outcome is acceptable
• r-childtreepre640 69c98a0 — windows-latest is the only evidence for this path; nothing here was verified locally
• r-coldstart640 69c98a0 — this measures the launcher's own child; it does not measure when cmd.exe started, so a stall before node is attributed to the same interval
• r-launchernode640 69c98a0 — the earlier commit raising the probe budget to 15s stands on its own measurement — a healthy probe used 4478ms of 5000ms — but its message claimed that budget explained this flakiness, and it did not
• r-launcherwhy640 69c98a0 — the deadline explanation is two independent diagnoses and a margin measurement, not a reproduction — the confirming evidence is the next run's own output
• r-mcpidentity572 69c98a0 — Windows behaviour here rests on windows-latest runs and nothing else; a slower machine than three times the measured passing case will still be told it could not be verified, which is at least true
• r-nodedrive640 69c98a0 — this reproduces the spawn, not the whole probe; a silent result narrows the cause without naming the fix
• r-probefacts572 69c98a0 — the close-stdin outcome is measured, not guaranteed by the shell -- a platform whose shell defers the redirect past the parent's first write would produce the timeout code instead, and this case would then need its own seam rather than a looser assertion
• r-proberace572 69c98a0 — this leaves one outcome unpinned, so a regression that swapped closed-input for timed-out on that fixture would not be caught here -- the four other cases still pin their codes exactly
• r-reclaimnogate640 69c98a0 — windows-latest is the only evidence for this path, and one green run does not settle a race — this needs to hold across runs before The MCP probe's Windows behaviour is unverified: PATHEXT resolution and child-tree cleanup #640 can be called closed
• r-sawinput640 69c98a0 — this records the arrival, not the response; if bytes arrive and nothing comes back, the next question is the probe's reader
• r-slownotbroken640 69c98a0 — fifteen seconds is calibrated against one Windows runner's measurement; a machine slower than three times that will still be told it could not be verified, which is at least now true
• r-mirrorsays632 aafd5ab — this states the retry, it does not verify it — nothing here checks that the following push actually published the note
• r-keyringgen653 8b066c7 — the generation identifies the keys the verifier can list, not every reason git might reach a different verdict; expiry and revocation are outside what this binds
• r-preflight002 0dca998 — MCP capture advertisement requires package manifest, SPEC, and schema to be available in the active runtime
• r-recheck002 0dca998 — a readiness answer is only as fresh as the request that asked for it; nothing here prevents an asset vanishing between the check and the work
• r-canon605 f474cf4 — esbuild resolves a platform-specific binary
• r-epipe595 0d60c75 — the negative control could not be reproduced outside CI -- with the handler removed the suite still passes locally and in a linux container, because the probe reaches its five-second timeout instead of losing the race
• r-hostsay595 0d60c75 — this surfaces what the host command said; it does not diagnose a command that says nothing, and that case is now named as unknown rather than guessed at
• r-prepush617 ec55144 — Notes sync must not block a branch push indefinitely
• r-dupnote1 a73a1bc — preserve attaches only records absent from the merge message
• r-draft615 cd3be7a — this checks shape only -- whether a record is supported by its evidence is still the verifier's judgement and still reported as data rather than as an error
• r-oid613 202913c — a source guard allows core/types.ts and rejects a local length copy anywhere else, so a future reader writing its own regex fails rather than silently reintroducing the class
• r-sha256oid 202913c — git object ids are hex, abbreviation 4, full SHA-1 40 or SHA-256 64
• r-522idx1 b0fa907 — a truncated scan must never render as a complete answer; unreadCommits is the existing channel
• r-522idx1 b0fa907 — --no-index and a filesystem that cannot write to .git still fall back to a scan
• r-provsha1 6d82fcc — is a git object id — 4 hex digits (git's shortest abbreviation) through 64 (a full SHA-256), either case
• r-cap543ex 2197283 — validate's exit codes shipped in v0.8.1 and must not move
• r-answerown1 3547382 — warn distinguishes ours from not-ours by the command string, and does not execute anything -- a wrapper that really is a CommitLore server still reads as unverified, which is the safe direction but not a probe
• r-pretag01 86e0153 — registers_commitlore reads the key, so a config that registers under a different key -- a host with its own naming -- still reads as unregistered and is wired again
• r-readyhosts1 9db3c4d — the new jobs establish that an install runs and answers on those hosts, not that every command behaves identically there
• r-dropfake01 06961d3 — the runtime's presence proves this installer wrote the directory, not that its contents are unmodified since
• r-secondcopy1 01ebee5 — the budget bounds the two scans, not the command -- process startup, path resolution and rendering still sit outside it
• r-staleclaim1 59cb5d9 — withholding uses the same pattern table as every other route, so a payload that trips nothing still passes; this closes a route that had no grading at all, not the heuristic behind it
• r-codexunver1 980d747 — presence is read from the marketplace name, so a Codex that reports neither a source nor a listing this can parse is treated as absent and one is added under a name that may already be taken
• r-mcpproc01 db1363d — this establishes that a host which surfaces MCP instructions can capture without a skill; a host that ignores that field still needs --agents-md, and nothing here detects which kind a host is
• r-observed01 43cfa5e — existence is not identity -- a path that resolves to something other than this tool still reads as a working registration, which is doctor reports a registered MCP command as working without establishing its identity #572
• r-ceiling01 543453b — this bounds the scan and not the command -- process startup, path resolution and rendering are outside it, so a repository whose single cheap pass is slower than the budget still exceeds it by that much
• r-clocktest1 6ac2b44 — the injected clock proves the loop stops and resumes correctly; it does not measure that a real budget corresponds to any particular wall-clock pause, which stays a measurement rather than a test
• r-hookbudget1 e09014c — the budget bounds the wait, not the answer -- a repository large enough to trip it keeps getting a partial view until somebody runs init, and the notice is the only thing that makes that visible
• r-scanall1 62a6fbf — the scanner remains a heuristic, so this closes the exemption and not the gap behind it -- a payload that trips no pattern still reaches the agent
• r-structk1 a7bee10 — this closes the exemption, not the heuristic behind it -- a payload that trips no pattern still passes, and the scanner remains a speed bump rather than a boundary
• r-ownfail01 8de1326 — doctor can say the setting is unreadable and cannot say what its author meant by it, so the repository is held to the stronger mode until a person decides
• r-expwall01 e7ddd92 — the cache cannot notice an expiry that falls between two reads inside the same day -- a record expiring at noon is still delivered until the day rolls over, which is the granularity the determinism is bought with
• r-codexerr1 a6d0fab — the first line of Codex's output is not always the cause -- a wrapper that prints a banner before its error will have the banner reported instead, and the full output is still only visible by running the command directly
• r-authdir01 ae2a66f — in the default mode a directive establishes that the commit's author string matched a configured one, and nothing about who produced the commit
• r-authdir01 ae2a66f — in signature mode a verified signature establishes that a key the verifier trusts signed this commit -- not that its holder has authority over this repository, and not that the record's content is true or safe
• r-mcpdir01 a9886b5 — neither route can tell a caller whether the trusted-author configuration reflects anyone's actual identity -- it reports what the repository decided, and the decision is a local git config value
• r-codexplug e5fe95a — a plugin can put a skill in front of a session; it cannot make the session follow it, and nothing here reports whether one did
• r-hermesx01 2eb8176 — hermes skills inspect resolves remote sources only in this Hermes version, so discovery was verified through hermes skills list --source all in a fresh isolated profile rather than from inside a live conversation; that a session then follows the procedure is not something an installer can establish
• r-codexwire 955f290 — an instruction file is guidance, not enforcement -- a host may ignore it, summarise it away, or never read it, and nothing here can tell whether any session followed the procedure
• r-initmcp1 e601ad3 — this registers for hosts that read a repository-scoped .mcp.json; a host keeping its configuration elsewhere still needs its own installation, and this cannot tell whether any host ever loaded the file
• r-mintid01 1e5f500 — deterministic minting can reserve only identities visible in this repository; independently diverged history can still introduce a collision
• r-notes512a ce937c9 — the observation is as old as the last doctor --fix; a mirror pushed upstream after it is not visible here, and an empty answer will read as a true empty until the next probe
• r-autotrue2 6cc5032 — a host may be registered and never call the tool, or be configured outside the repository entirely, so this distinguishes wired from unwired and never observed from unobserved
• r-autotrue1 70b7e06 — a host integration may still be installed or selected outside the repository, so operators must ensure it supplies the session transcript before committing; the core cannot observe or enforce that host-side action
• r-coldpath1 0412f81 — a genuinely cold fallback still reads the whole history once, because repository-wide lifecycle folding cannot be scoped to a path without changing what the answer means
• r-coldpath1 0412f81 — nothing outside index and init builds the index now, so a repository whose derived file was deleted stays on the scan path until one of them is run
• r-autoswitch b8497b8 — the prompt defaults to yes and a bare Enter takes it, so a reflexive Enter costs a team-wide consent — the file is committed, and every clone captures with nobody in the loop until someone runs auto off
• r-unattshadow b7b532a — together the two features measure how often an unattended pipeline would have written, and remove the asking from the writing -- neither half can say whether what gets written is worth a reader's attention, so shadow's number for an unattended repository is a volume, not a value
• r-unattended511 f6679e1 — with nobody in the loop, the pipeline decides on its own what is worth recording, and every record it keeps spends a future reader's attention without asking anyone first -- the switch is a repository consenting to that cost, and nothing in this change reduces it
• r-shadow511 d093bef — shadow measures commits whose transcripts are gone, so its numbers describe the substitution of a committed message and patch for a transcript -- they say nothing about what capture would record over a live session, and no shadow output may be read as a pipeline baseline
• r-mcpexit506 f1b1fb0 — a process killed with SIGKILL still writes nothing, so the log shows a start with no exit -- that case is inferred from the absence of a line rather than reported, and stays the way MCP tools for commitlore vanish mid-session (ToolSearch returns zero results despite server reported connected) #424's original observation had to be made
• r-demostory505 8016424 — the demo is one scenario, so it shows supersession and not expiry, path scope, or trust grading; a reader who wants those still has to read past the image
• r-filters471 c7572f6 — a filtered run reports honestly about what it ran and says nothing about what it skipped, so a repository whose only failure sits outside the selection reads as healthy-for-the-selection with no hint that the unexamined rows exist
• r-envelope469 0162b73 — installSource is declared and derived per surface only where a test asserts that surface; an unasserted surface reports unknown rather than a guess, so the field is honest and incomplete rather than complete and unverified
• r-effects476 43eb4aa — env and the clock are injected but process.cwd and the filesystem are still reached for directly inside some checks, so a check that reads a path can be pointed at a fixture but not at a purely synthetic tree
• r-headline470 55b810c — init keeps the checks-only renderer, so the headline a doctor run shows is absent from the install path where a first-time user is most likely to meet a finding
• r-budget472 8ea15f1 — 13.2x headroom over the measured baseline is sized to survive a contended shared runner, so it catches an order-of-magnitude regression and would not notice doctor becoming three times slower
• r-dsplit467 b24e371 — the split is by responsibility, not by dependency direction -- runner, registry and renderer all still reach into the model, which is correct for a shared vocabulary and would not catch a model that grew behaviour
• r-collapse466 d24a284 — only two edges are declared -- inject-version on inject-runtime, and the §2.2 checks on the capture chain -- so a dependency nobody wrote down still surfaces as an independent finding
• r-evidence465 e1a3c92 — evidence answers what was observed, not whether the observation was the right one to make -- index ingests any key: value line as a trailer; doctor reports 106 records where git has 0, and context serves commit subjects to the agent #335's wrong count would now be visible in a field rather than prevented
• r-queryroute 4ae1f6f — the sweep covered ?? against an options field in src/commands, which is the shape that produced both defects; an option whose default is consumed some other way would not have shown up
• r-rel071 af8e0ab — 0.7.0 stays published with its notes amended to name the defect at the top; retracting a tag people may already have installed trades a known-bad version for an unknown one
• r-skipreason 85aa8d6 — the union has six members because ten sites needed six, and the next check that skips will need a seventh rather than one of these stretched to fit
• r-registry463 ddf5592 — the registry is data but nothing filters it yet, so the ordering guarantees are tested and unused until the --only ticket
• r-checkmodel 9cbed57 — evidence is {} on every row until the ticket that populates it, so the field exists and proves nothing yet
• r-doctorpend 458bcec — the check reads staleness, so a capture whose base commit is still HEAD reports ok even if it has been waiting long enough that nobody remembers preparing it
• r-trust415 a030e93 — this changes what a fresh install delivers, so M1 and M5 remain measurements of [claim]-graded delivery and their numbers do not transfer to the directive path
• r-mcplife424 8cd3c6d — the tool registration that was lost belongs to the client, so nothing in this repository can detect the loss from inside a session or restore it
• r-capmode30 40818c2 — stage cannot check consent, so auto records what is certainly true -- no prompt was shown -- instead of asserting what it cannot know
• r-drafted30 b126176 — a commit message is immutable, so a drafted record is never upgraded in place -- promotion is a later record that Supersedes it, and that half is not in this change
• r-amendid430 4c450eb — commit-msg gets no argument, environment variable or ref that distinguishes an amend from an ordinary commit
• r-hookver433 a3b92d7 — nothing here can update anything -- the plugin cache is the client's, so the only move available is to say what is true
• r-binx428 b9d1ea8 — the allowlist accepts .mjs/.js paths, which are exactly the files most likely to carry a shebang and no execute bit
• r-recurse422 418734c — git runs pre-push on every push including one a pre-push hook makes, so any push from inside the hook must opt out of hooks explicitly
• r-busy420 9555569 — a full rebuild on a large repository takes longer than any timeout a hook can afford to wait, so the scan fallback stays reachable by design
• r-sync416 deb21d2 — git neither fetches nor pushes notes by default, so a mirror only moves when something configures or invokes it
• r-mention408 ec314cd — paraphrase space is unbounded and this table cannot see semantic rewording, so blocked remains a speed bump and the grade remains the load-bearing control
• r-schema406 22b2c35 — an index is derived state with no migration path, so a meaning change can only be handled by discarding the file
• r-note409 0dff3e4 — the notes ref is an ordinary ref with no signature requirement, so authorship there is a claim about who wrote the text and not proof of it
• r-backfillclosed 00de5fa — the guard reads the mirror state at invocation, so a fetch completing mid-run is not observed
• r-initunfetched 889d191 — it reports the state as it was before init ran, so a mirror fetched between the capture and the report would be named wrongly; that window is the four steps of one command
• r-mirrorunread 8e4bdc5 — the caveat can only fire where notesAvailability returns unfetched, so a refspec added after cloning and never fetched through still builds silently -- the distinction config alone cannot carry, recorded on that function under r-fetchowed
• r-pinskew 007ccbf — the comparison reads the package.json above the recorded path rather than running it with --version, so a pin whose manifest and bundle disagree is reported by its manifest
• r-pipesplit b4fa571 — test/dogfood.test.ts validates every record in this history, so a new violation class is only available if it rejects none of the 620 Ruled-out: values already written
• r-gcunstageable 5cd6b8f — ADR-0021 fixes the pending format and stamps expires_at at stage only, so giving these phases an expiry earlier is a format change rather than a fix
• r-gcunstageable 5cd6b8f — gc runs only when capture gc is invoked -- nothing schedules it, so a leaked file goes at the next run rather than at the 24-hour mark
• r-gcunstageable 5cd6b8f — staleness is derived from base_head against HEAD; a transaction whose staged diff moved while HEAD did not is equally unstageable and is still kept, which is the conservative half of the same test
• r-gcunstageable 5cd6b8f — a staged transaction that is never applied is still kept for ever -- the hook skips it once expires_at passes and gc protects the phase -- which is a separate leak this change deliberately does not touch
• r-secondtie 998bf18 — committed_ts is %ct at one-second resolution and the index stores no ordinal that orders two commits inside one second, so a tie on that path can be made deterministic but never topological
• r-dedupviol 18ad9c1 — the key includes line, so two detectors that locate one finding differently -- one with a line, one without -- would still print it twice; today both resolve the line through the same locateTrailerLines/lineForViolation path
• r-owntmproot 6543870 — the demo still defaults to the shared tmpdir, so concurrent commitlore demo runs still create sibling directories there -- that is deliberate, and it is safe only because nothing now asserts over that namespace
• r-diffdefault 4ac8163 — the test reads the option string out of the source rather than out of --help output, so a change to how commander renders descriptions would not be caught
• r-shallowlast 0913821 — the spawn still happens once per validate that has a dangling ref, which is the case where the answer is actually needed
• r-exitonemeans 89f7af8 — a shallow clone cannot tell a reference that resolves below the boundary from one that resolves nowhere, so neither verdict is available and the check can only name the question it could not answer
• r-failopen abc54ea — with the gate installed and no CLI resolvable, commits are still refused -- that is the one hook holding a verdict back, and this change does not reach it
• r-notereach 1e72a28 — reachability is decided against HEAD alone, so a record mirrored onto a live branch that is not checked out is not served until it is
• r-fetchowed 11f04b4 — config alone cannot separate a refspec that was fetched through from one that was only written, so the availability verdict cannot carry that distinction
• r-guarddisclose 8a4d0c7 — a disclosure asserted by tool name covers the tool that is named, and the ADR's requirement is about every surface that exposes the behaviour
• r-refspecfetch 936d206 — configuring a refspec is not fetching through it, and a state machine that conflates the two turns its own remedy into a way of hiding the problem
• r-actionsleak a6fbb4b — a code path that no test and no first-party workflow exercises is the one an outside adopter takes by default, and its absence from CI is not evidence it is unused
• r-actionsleak a6fbb4b — a trust label the caller must act on is worthless unless the value it describes is actually withheld at the point the data is built
• r-recordgate335 a83ebe3 — a denylist cannot decide whether something is a record, because the keys nobody has claimed are unbounded; that question needs the vocabulary, and the two must not be answered by one filter
• r-recordgate335 a83ebe3 — Verified: in a release note is indistinguishable from Verified: in a record, and no context signal separates them without risking real records
• r-draftfirst329 0506a5d — a usage error that names the wrong input costs an invocation and points the reader away from the fault; ordering is part of the message
• r-uninstall1123 4ddac0d — the installers write five agent configs, not the four the ticket's measured inventory lists; the fifth is Windsurf at .codeium/windsurf/mcp_config.json
• r-uninstall1123 4ddac0d — opencode's entry is shaped differently from the other three -- the command is an array -- so one recogniser cannot serve all of them
• r-uninstall1123 4ddac0d — a checkout is 1366 files at this head, not the 1206 the ticket measured at 6e1d46d; any assertion bound to that count is stale
• r-winpath1127 bdf4ac0 — the stub is written to .git/hooks at install time, so a repository installed before this fix keeps the old text and must re-run commitlore hooks install; installing a corrected release is not enough
• r-winpath1127 bdf4ac0 — ${dir%/*} returns its input unchanged when no separator remains, so a loop that tests for emptiness never terminates at a drive root
• r-winpath1127 bdf4ac0 — neither dirname nor ${var%/*} finds a parent in a backslash-separated path; both answer .
• r-t1110policy 9e7b37a — only a repository-local policy file is read -- PRD-F13 requirement 11 permits either one location or a stated precedence, and an ambiguous precedence is worse than a missing feature
• r-gcwiring f21f28e — the guard against this class is four CLI-level tests; nothing structurally prevents a future subcommand from colliding with a parent option again
• r-flake221fix 2b21ed9 — checkInjectRuntime ENOENT does not block init
• r-lb0xl89a 236229e — the static contract uses explicit placeholder text for TRANSCRIPT and DIFF rather than omitting those sections, because the prompt text references them by name
• r-c44a1edb 71f5197 — src/core/pending-gc.ts -- gc must never remove a staged or applied file regardless of expiry; T-1018 post-commit may still finalise them
• r-0ll5sxk0 2853a22 — consumption happens after commit succeeds, exactly once; consuming earlier loses the record on failed commits, consuming twice lets one record attach to two commits
• r-t1009stage b5fcf4e — the nonce pattern check bounds what a caller can send, but a caller holding a valid nonce for its own repository can stage repeatedly until the record is consumed
• r-t1005gates 15421c0 — policy identity is compared as a hash, so a policy edit that produces the same hash is indistinguishable from no edit
• r-t1006cli d22580b — the command composes the phases in one process, so a crash between verify and stage leaves a verified pending record that only garbage collection will clean up
• r-t1008mcp ab00b54 — src/mcp/server.ts: readOnlyHint must be false for verify_capture — the tool writes verification results to the pending transaction
• r-t1007mcp b6ef112 — commitlore_prepare_capture uses readOnlyHint: false because it writes a pending transaction
• r-t1013verbose205 294ec82 — --verbose only selects the formatter; it does not change runInit logic, step order, exit codes, or --json output
• r-t1022sig e0c641d — the first pushed attempt asserted one header string in the test and built another in the formatter; CI caught the mismatch and the formatter was aligned to the asserted string, which is the one that states the measured figures on the output surface
• r-t1022sig e0c641d — focused-test evidence for this change is CI's, not local; test/guard.test.ts reports zero tests and stalls on this machine at dev with no changes applied
• r-t1024bc 023f6d9 — response shape is exactly five fields per CEO amendments and ADR-0020 confidence-separation constraint | adding a sixth field or letting context inherit guard_confidence violates the acceptance criteria
• r-t1011demo 1c0fc0c — the scene is one fixed pair of decisions, so it demonstrates the mechanism rather than measuring how often it matters
• r-t1020desc dd12b42 — the test asserts on the exact precision and recall figures; a future re-measurement changes both the description and the test
• r-t1020desc dd12b42 — the first attempt's Record-Id used hyphens, which the r-[a-z0-9]{6,} format rejects; both the lint action and the dogfood test caught it
• r-initresult204 ea4a08e — --verbose flag not wired yet (T-1013)
• r-t1030diag 344ada0 — the heuristic uses a regex on the first line of stderr; an error that prints no stack frame and no "not found" string will be reported as cause unclear even if a human could classify it
• r-fix191amb cb94448 — the same-message test still passes by accident of collectRecords returning one record per commit; the divergent-notes test is what exercises the actual suppression path
• r-fix187val 40f2436 — the tip-scan adds one full-history git-log call per range invocation; acceptable for a lint-time check but visible in benchmarks at scale
• r-dupsucceed 6f77fcf — supersession is resolved within one repository's history, so a record superseded in a fork that was never merged still grades as current here
• r-dupsuccorder f46c02d — a successor before a later duplicate cannot resolve that later collision
• r-dupsucc729 5a6b238 — published dev history cannot be rewritten
• r-valdup145 bcb9563 — the same-message check sees only the message, so two commits each declaring the same id separately are still caught by the reference check rather than here
• r-convtrail150 57e89d2 — the denylist answers a different question from isRecordKey's allowlist, so a conventional trailer this protocol later claims would need removing from one and adding to the other
• r-epipe2026 d9ee9ff — spawnSync may report EPIPE after git exits while its input pipe is being written
• r-doctorepipe 0420f5c — the new deterministic tests exercise evaluateInjectRun with a synthetic spawnSync result rather than forcing the live race, because no payload this check sends is large enough to make the write block deterministically the way an artificially large one does in the reproduction above
• r-init107 f485f07 — the generated dist artifacts are rebuilt from TypeScript source
• r-survsplit e73aed5 — path-reachability is measured against git's rename detection, so the figure moves with git's similarity threshold rather than with anything here
• r-probepath 51f6446 — the probe still only runs a command it recognises, so a hand-edited but equivalent hook reports not-checked rather than a verdict
• r-doctorprobe ed94491 — the probe runs only a command it recognises, so a user who hand-edits the hook into an equivalent but different form gets not-checked rather than a verdict
• r-f61a2c 9114cf0 — the matcher remains deterministic and lexical; no embedding or semantic service is available to distinguish paraphrases
• r-init96a 913c7e3 — doctor's own exit-code contract treats warn as non-fatal by design (SPEC §10, commitlore-setup skill) — init deliberately diverges from it for its own summary, and that divergence is the one thing most likely to look like a bug on a future read of this diff
• r-fix92dupid 7f41a6e — cross-references between two blocks declared by the same commit (a Follows:/Supersedes: naming a sibling block's id) are still reported as dangling rather than resolved against the sibling -- unchanged from before this fix, and called out in validate.ts's own comment as future work
• r-parsemulti 6d39d25 — parse has no git-commit context (no sha, no notes mirror) — its identityCollision check is local to the one message being parsed and cannot detect a Record-Id that collides with something already committed elsewhere in history the way context's fold does.
• r-multirec01 92aeb24 — parseRecordBlocks only recognizes a non-final block by its declared Record-Id, so an unidentified inherited record beyond the first stays recoverable in the plan that computed it but not in a later re-parse of stored text; squash-preserve orders unidentified blocks last so the common case (at most one) is unaffected.
• r-multirec01 92aeb24 — multi-block reference checking (Follows:/Supersedes:) does not resolve one block's reference against a sibling block declared by the same commit; each block is still checked against every earlier commit in history.
• r-exit065 e545dee — any new command's exit codes must be drawn from SPEC §10, not invented locally
• r-fix70a1 d707fc7 — one encoding layer and explicit lexical forms in the four published languages; semantic paraphrases, nested encodings, and split payloads remain outside coverage
• r-shwt66 5efa206 — git rev-parse --git-path may return a repository-relative path, so resolve it against cwd
• r-merge66 40e7987 — Generated dist files were resolved only by npm run build and npm run bundle
• r-fix760 fb8ba45 — Git remains the authority on trailer recognition; diagnostics must not loosen the parser
• r-refint74 572f573 — validate cannot perform conservation checks because it has no before state
• r-warn75 24c7cc8 — exit-code semantics remain owned by guard's exit 2 means blocked; everywhere else in the same CLI exit 2 means bad usage #65
• r-shallow66 60a8659 — a depth-1 clone can only inspect its reachable commit history
• r-doctor72 996bcde — generated dist artifacts must come from npm run build and npm run bundle, not a hand merge
• r-fix067 a915af0 — PreToolUse hook failures must always exit 0 and never change stdout's hookSpecificOutput contract
• r-fix063 0b8c496 — doctor performs remote probes; an unreachable remote reports could not verify instead of ok
• r-fix053 ecc4b90 — QueryResult.notes remains repository-level availability and is independent from whether one record was mirrored
• r-fix055 43b40f8 — harvest-verify makes no model call, so semantic entailment is outside its contract
• r-fix054 664d4e2 — notes-only metadata must survive folding; a mirror is one record, not two
• r-fix056 55cb8bc — blocked output may retain only validated structural values that cannot carry prose
• r-7a3e91 cf859e4 — better-sqlite3 stays external because it is native — the bundle degrades to --no-index without it, which only works because r-6f2a08 made that load lazy first
• r-6f2a08 4c2d432 — esbuild cannot follow createRequire(import.meta.url)('x'), so any dependency reached that way stays external no matter what the bundle config says
• r-9a5e17 6d68703 — five workers on one repository share npm test and tsc, so file ownership alone does not prevent one worker from "fixing" another's half-written code -- verification scope had to be split too
• r-5a8c04 c46a577 — git owns the definition of a trailer block, so any behavior we cannot get from interpret-trailers is behavior we must not invent

Ruled out (384)

• r-detectrule728 f1784ce — give claude-code a config-directory fallback for symmetry | it would report a host detected and then perform no wiring, which is the false success this installer exists to avoid
• r-detectwhy728 f1784ce — give claude-code a config-directory fallback for symmetry | it would report failed and set ok false on a machine whose only trace of the host is a leftover config, failing an install that had nothing wrong with it
• r-rel111 8c29f5d — claim Windows host wiring works | two of the four detected hosts wire, and a release note that rounds that up is the false green this release exists to remove
• r-winargv716 7bf5b82 — shell: true | wrapper and user paths would become a shell injection surface
• r-winexec716 7bf5b82 — shell: true | wrapper and config paths must not become unchecked shell input.
• r-rel110 d9a041f — fold the second Windows cause into this release | it arrived as Fix Windows host resolution and batch spawning (#716) #720 with real Windows evidence and needs its own judgement, and holding this back would make the note about what is still broken false in both directions
• r-rellock110 d9a041f — replace the version string throughout the lockfile | it matches four dependencies that are really at 1.0.2, and nothing in the suite would have caught it
• r-namefile716 f728e69 — add a path field to HostResult | the summary schema is pinned at v1 and detail is already the free-text field a human reads
• r-overlay709 7e08cbf — let an overlay only narrow permissions | it solves the contributor who wants less, and the one who wants more still edits the tracked file, which is the reported failure
• r-overlay709 7e08cbf — write a .gitignore entry for the overlay | a tool that hides a file on a repository's behalf has decided for the repository what it may not see
• r-wintmp716 f0ed513 — use basename() | correct on Windows, unfalsifiable on the platform CI actually runs
• r-pend710 b452535 — drop the warning for the non-staged case | a stale draft is still worth surfacing, and doctor reports a consumed capture as never written to history #584 already showed that going quiet on a healthy-looking path is how this check loses its meaning
• r-cleanrebuild664 da8948d — rebuild again and hope | the first rebuild was real; what was wrong was the tree it read, and running it once more from the same tree would have produced the same mismatch
• r-formatnotmachine661 2cc274d — revert Report the MCP servers that are answering, not the ones registered #661 | it would take the check and its regression back out, and rebuilding both costs more than the line this change adds while main stays red
• r-selfscan661 ccab7f4 — mark the probe's child through the environment | ps reports arguments, not environment, so the marker would be invisible exactly where the decision is made
• r-selfscan661 ccab7f4 — exclude by direct parent only | the server is a grandchild of whatever probed it, so one link is not the relationship that matters
• r-liveruntime660 6a221db — rebase the original branch | it predates the probe rewrite and the sidecar, so 29 of its conflicts were in code those changes already resolved differently
• r-liveruntime660 6a221db — compare reported versions between runtimes | a copied or stale install can declare the same version as a current one, so equality there proves nothing about identity
• r-liveruntime660 6a221db — canonicalise the totals line in the snapshot | it would hide a real change in the check set behind a token, which is what that snapshot exists to catch
• r-pinnedreport660 6a221db — canonicalise the totals line as well | it would hide a real change in the check set behind a token, which is the thing that snapshot exists to catch
• r-pinnedreport660 6a221db — leave the check out of the default registry to keep the report stable | a check nobody runs reports nothing, and the stale runtimes it names are on real machines rather than in fixtures
• r-committedat650 f077870 — normalise every timestamp to UTC | an offset carries where the commit happened, and discarding it to gain uniformity loses a fact the record is entitled to keep
• r-committedat650 f077870 — canonicalise at the JSON boundary only | the index stores the same field, so the two routes would then disagree with each other rather than with git
• r-prosetrailer647 30e40c7 — treat sentence-like lines as prose rather than trailers | SPEC §2.1 B3 gives git the trailer boundary, and re-deciding it here would make our parse and git's disagree about the same message
• r-prosetrailer647 30e40c7 — enforce key validity only when every line in the block parses as Key: value | same objection, and it would silently stop validating a mistyped Record-Id sitting beside a prose line
• r-prosetrailer647 30e40c7 — a multi-word value alone as the prose signal | measured against the conformance fixture, which it misclassified — the fixture caught the heuristic, and the heuristic changed rather than the fixture
• r-repointsays629 c7ab87e — drop the word unchanged | the file genuinely is unchanged and that is worth saying; the defect was that it was the only thing said
• r-repointsays629 c7ab87e — report the recorded target on every install | on a first install there is nothing to compare against, and a line that always appears stops carrying information
• r-bundleprobe636 69c98a0 — sidecar MCP helper | it is outside the declared single-file runtime
• r-childtreediag640 69c98a0 — guess between the two suspects and change the fixture again | the previous change was a reasonable guess that did not hold, and a second guess costs another Windows round trip with no more information than the first
• r-childtreepre640 69c98a0 — weaken or delete the failing step | it is the only coverage of Windows child-tree reclamation in the repository, and no unit test touches taskkill
• r-coldstart640 69c98a0 — read the node-spawn driver's silence as proof the spawn loses bytes | it shares the same five-second window, so slowness would make it silent too and I would have read a timing result as a delivery result
• r-initiator636 69c98a0 — asset readiness preflight | F-002 and prepare_capture fails with ENOENT on a dev-hash asset root that is never installed #633/commitlore_prepare_capture fails with ENOENT on a 0.6.0 spec path; the Claude plugin cache only has 0.8.0 and the codex cache has 0.8.2 #635 own that separate runtime check
• r-launchernode640 69c98a0 — keep the hard-coded path and widen the timeout | no budget reaches an interpreter that is not on disk, and three attempts had already shown that
• r-launchernode640 69c98a0 — treat this as the product defect | a registration naming an interpreter that does not exist should be reported unhealthy, and the probe running the registered command verbatim is the behaviour to keep
• r-launcherwhy640 69c98a0 — revert to the hard-coded path | it works on this image and testing against the Node the job installed is still the more honest fixture; the correction here is to the reason, not to the code
• r-mcpid572 69c98a0 — a separate MCP protocol probe | reuse the Both installers still skip a host whose registration cannot run, and exit 0 #595 implementation to prevent drift
• r-mcpidentity572 69c98a0 — widen the budget and keep the wording | the message would still send an operator to repair something that works, just less often
• r-mcpidentity572 69c98a0 — retry the probe | a retry pays another full budget to answer a question the first attempt already answered, and doubles doctor's worst case
• r-mcpidentity572 69c98a0 — gate the child-tree assertion on the server being healthy first | reclamation runs on every probe exit including the timeout, so requiring health made the precondition depend on the behaviour under test and could not tell a broken product from a broken fixture
• r-nodedrive640 69c98a0 — instrument mcp-probe.ts itself | product code should not carry diagnostics for one platform's fixture, and the mechanism is reproducible without touching it
• r-probefacts572 69c98a0 — accepting either code in one case | it makes the regression pass whether or not the probe still separates the two facts, which is the property under test
• r-proberace572 69c98a0 — accepting either code in both fixtures | that is what makes the pair meaningless, since neither would then hold its own fact
• r-proberace572 69c98a0 — forcing determinism by having the fixture signal readiness before closing stdin | the probe writes immediately on spawn, so there is no point at which a fixture could report ready first without changing the protocol
• r-probesync572 69c98a0 — treating stdout as completion | spawnSync waits for helper exit after stdout
• r-reclaimnogate640 69c98a0 — keep gating on probe status and retry the step | the gate races on cmd.exe stdin ownership, so retries would convert a real signal into a slower coin flip
• r-reclaimnogate640 69c98a0 — mark the path unsupported | reclamation is implemented and unconditional in the source; what was missing was a test that could reach it
• r-sawinput640 69c98a0 — drive the wrapper through a pipe instead of a file as the discriminator | PowerShell closes the pipe after writing, so it would test EOF rather than the held-open pipe the probe uses
• r-slownotbroken640 69c98a0 — widen the window and keep the wording | the message would still tell an operator to repair something that works, just less often
• r-slownotbroken640 69c98a0 — retry the probe | a retry pays another full budget to answer a question the first attempt already answered — the server was not reached in time — and doubles doctor's worst case
• r-slownotbroken640 69c98a0 — keep the sidecar's outer bound as a constant | it was 7000ms against a 5000ms budget, so raising one without the other would kill the helper before it could answer and report that death as the server's fault
• r-stub572 69c98a0 — retaining the fixed one-line stub | it is not an MCP server and the new probe correctly rejects it
• r-trimdiag640 69c98a0 — keep the drivers for the next investigation | they are cheap to write again from the pull request comment, and a permanent cost for a question already answered is the wrong trade
• r-winprobe640 69c98a0 — process manager framework | taskkill is a bounded Windows helper
• r-mirrorsays632 aafd5ab — fail the push when the mirror cannot be published | a record that could not be mirrored is not a reason to withhold code, and the hook's contract is that it never blocks
• r-mirrorsays632 aafd5ab — keep one sentence and lengthen it | the two outcomes need opposite actions from the reader, and one sentence covering both is what left it silent on the actionable half
• r-keyringgen653 8b066c7 — memoize the generation per process | a long-running server would keep grading against the keyring it started with, which is the shelf-life defect just removed from the MCP capture gate
• r-keyringgen653 8b066c7 — stop caching signature_status | it is read per graded record, and recomputing it per query costs the git log the index exists to avoid
• r-f002onf001 0dca998 — keep the local packageVersion reader | it is a second answer to a question F-001 now owns, which is the divergence this pair of findings exists to remove
• r-preflight002 0dca998 — code-only tool advertisement | a stale runtime can expose capture after its SPEC is gone
• r-recheck002 0dca998 — keep the startup snapshot and document the limitation | the runtimes this finding came from had all outlived their snapshot, so documenting it would describe the defect rather than remove it
• r-recheck002 0dca998 — a filesystem watcher or a daemon | a stat at the boundary answers the same question without a process to supervise
• r-oneinstall001 31cf0d1 — filename equality | two shipped entrypoints of one install are one runtime
• r-runtime001 31cf0d1 — version-only comparison | equal version strings still allow different entrypoints and package roots
• r-runtime001 31cf0d1 — filename equality | two shipped entrypoints of one install are one runtime
• r-signer597 3dc75e7 — signer email or author header matching | either is commit-controlled metadata and does not bind the verified key to repository authority
• r-canon605 f474cf4 — remove the legacy dist sidecars now | that changes test harnesses and needs a separate reviewed reduction
• r-epipe595 0d60c75 — swallowing the write failure silently | the probe would then wait out its full timeout for a command already known to be gone, and report a timeout rather than the closed input that actually happened
• r-hostsay595 0d60c75 — letting stderr flow straight to the terminal | it interleaves with the wrapper's own output and is lost entirely when a caller captures only stdout, which is how this went unnoticed
• r-install595 0d60c75 — presence-only registration checks | they allow dead commands to report installation success
• r-linuxcwd595 0d60c75 — changing installer runtime verification | Linux evidence showed the smoke-test failure came from the linked-worktree test cwd
• r-prepush617 ec55144 — background sync | notes sync must remain synchronous and bounded
• r-dupnote1 a73a1bc — comparing record body text | provenance is rewritten during inheritance, but Record-Id is the protocol identity
• r-draft615 cd3be7a — reusing parseDraft at the MCP boundary | it re-parses a string the boundary has already decoded, and its per-record rejections are data the repair loop reads rather than caller errors
• r-draft615 cd3be7a — a JSON Schema framework for the decoded shape | the shape is one interface with two arrays, and a second schema dialect would then need its own drift guard against DraftRecord
• r-oid613 202913c — keeping one {4,64} predicate and calling resolveRevision first at every site | the predicate is what persists, and a call-order convention that must hold at eleven sites is a habit rather than a contract
• r-oid613 202913c — tightening the Provenance trailer grammar to full ids here | that invalidates records already written and needs a SPEC and schema revision, which is a different review from a bug fix
• r-sha256oid 202913c — a second full-id regex of 40-or-64 | that is a third definition, and the remaining sites stayed 40-only because they did not share the first one
• r-522idx1 b0fa907 — leave context on the no-build scan fallback | a second call on hermes-agent was 271s and index.db was still absent
• r-provsha1 6d82fcc — generating the schema pattern from types.ts at build time | there is no schema codegen step, and verify.sh reads the JSON file directly; a test that the two strings are identical is the lock this repo already uses for SPEC vs types
• r-provsha1 6d82fcc — making grade.ts load the JSON schema | the hook path must not grow an ajv dependency to answer a question a regex already answers
• r-cap543ex 2197283 — failing the hook when capture returns 3 or 4 | a hook that aborts a commit because the recorder broke is worse than a missed record
• r-cap543ex 2197283 — a custom Error subclass for each kind | the repository forbids class X extends Error; a marker property is the same shape as commitloreMissingInstalledFile
• r-5c84a1 b3eb1b4 — excluding applied alongside consumed | the record hash is stamped before the commit object exists, so an aborted commit leaves an applied transaction whose decision really was lost
• r-past585 f88193f — add higher than and caused to REJECTION_MARKERS | they match a proposal that names a threshold and an investigation that asks what caused the spike, which is the bar this ticket said not to move
• r-mcpproc01 db1363d — keeping AGENTS.md as the default carrier | it reaches only repositories that adopt the convention, and it puts a hundred lines of protocol into a file the repository owns and commits
• r-hookbudget1 e09014c — building the index from the hook | that is the unbounded rebuild the recorded design gives to index and init, and doing it on the edit path would trade a bounded pause for an unbounded one
• r-scanall1 62a6fbf — keeping validateRecord and bundling ajv into the hook path | the hot path should not grow a dependency to answer a question a regex already answers
• r-structk1 a7bee10 — validating whole records at read time and discarding those that fail | history is not editable, and a reader that drops malformed records would silently lose real decisions instead of grading them cautiously
• r-ownfail01 8de1326 — treating a malformed value as an error that stops the command | grading runs on the edit path, and refusing to answer there costs more than answering under the stricter rule and saying so
• r-expwall01 e7ddd92 — documenting that expiry follows repository time | it is honest and it abandons the property, and the property is the reason the field exists
• r-authdir01 ae2a66f — requiring signatures by default | it would demote every existing repository's records for a risk this project is not currently exposed to, and a silent capability removal on upgrade is its own kind of dishonesty
• r-authdir01 ae2a66f — deleting the directive tier to make the claims true | the tier is how a record says it is a constraint, and removing it would resolve the wording by removing the feature
• r-mcpdir01 a9886b5 — having runQuery read the trusted authors itself | it would fix these two call sites and silently change every other one, including tests that mean to grade without trust
• r-hermesx01 2eb8176 — writing the bundle into the profile directory and regenerating its manifest | it would be undone by the next sync and disagree with the manifest until then
• r-codexwire 955f290 — a Codex-specific integration | the instruction surface is shared, and writing one integration per host would leave the same gap open for the next five
• r-initmcp1 e601ad3 — writing into a user's host configuration from init | a repository may describe itself, but reaching into the machine that opened it is not the same act and not one an init should take unasked
• r-mintid01 1e5f500 — random or clock-based identities | a retried capture would give one decision a different identity
• r-notes512a ce937c9 — probing the remote from the query path | context runs before every edit and an edit must not wait on a network round trip
• r-notes512a ce937c9 — treating a covering refspec as evidence the remote was consulted | the refspec says what this clone would fetch, never what a remote has
• r-autotrue1 70b7e06 — initiating capture from a Git hook with the staged diff | a diff cannot supply the host transcript or establish that a decision was made
• r-coldpath1 0412f81 — applying --limit before the lifecycle fold | it would bound the cold work and silently change which records survive supersession
• r-coldpath1 0412f81 — serving a stale index when catching it up is not possible | a fast wrong answer is worse here than a slow right one; the fallback stays fail-closed and git remains the authority
• r-autoswitch b8497b8 — enabling by default where no terminal can answer | the file is committed, so a CI run would hand itself a team-wide flip nobody ever saw asked
• r-autoswitch b8497b8 — rewriting a policy file whose effective setting already matches | the bytes would change while the policy did not, and the identity hash would report a policy change that never happened — the false positive the hash exists to avoid
• r-autoswitch b8497b8 — asking the question when a policy file already exists | the answer cannot change anything, and a yes that does nothing reads as consent being taken rather than given

Truncated: 375 lines omitted — the comment hit GitHub's 65000 character limit.

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}

[MongLong0214]

Second optimisation added: %G? off outside signature mode.

	rebuild, 1122 commits
before either change	45 s
after the process-spawn fix	6.8 s
after this too	2.5 s

%G? makes git verify every commit's signature. Nothing reads the answer unless signature mode is on — grade.ts consults signatureStatus only behind requireSignedDirective, and trusted-authors.ts says as much where the verifier generation is defined:

"Only signature mode pays for it: the setting is opt-in."

The rebuild paid for it always.

Turning the setting on later is already handled, and by the mechanism built for it: signatureVerifierGeneration goes null → hash, healthProblem compares it against meta, the mismatch rebuilds. Same path a changed keyring takes (#653).

The field is emitted empty rather than dropped, so the positional destructure keeps its shape — a shifted field is a silent wrong answer. And '' is outside git's %G? vocabulary (G/B/U/X/Y/R/E/N), so it cannot be misread as "no signature", which is N and a different fact from "not asked". What records that nothing was asked is the absent signature_verifier_generation key in meta.

Verified the same way

Every trailers row dumped before and after on the same HEAD: 7258 rows both times, identical.

One correction to my own test: the first version defined its own copy of signatureAtom inside the test file, so it would have passed with the implementation deleted. It imports the exported function now, and the negative control confirms it.

#776 after this

The product question is now against ~2.5 s, not 23 s. CONSUMER_SCAN_BUDGET_MS is 3 s — so on a repository this size the budget now covers a full rebuild, and the partial-answer problem largely dissolves rather than needing a policy. Whether that holds on a repository ten times larger is the remaining question, and it is a measurement rather than a decision.

The third item from the audit is still not taken: the 3-second consumer budget spends itself on the explode pass for the first slice of commits.

[MongLong0214]

Third and last item from the audit is in: the budgeted scan no longer spends its budget on its own deadline checks.

BUDGETED_LOG_BATCH = 64 exists because LOG_BATCH exceeds most repositories' commit counts, so a budgeted scan using it never reached a second iteration and never stopped. Sound reason — the mistake was holding it there.

A batch is three git log processes however many commits it covers. On 10,000 commits that was 177 of them against 30 for the unbounded path, and the budgeted scan managed about a quarter of the commits per second a full rebuild did. A 2.2 s rebuild did not fit inside a 3 s budget — which is the state #776 is about.

It now doubles to LOG_BATCH: small early so any repository still gets checked often, large later so the process cost is paid a handful of times.

Measured, 10,000 commits, no index

	before	after
git processes	196	58
first answer	3.8 s	2.9 s
incomplete-scan caveat	present	gone

The scan now finishes inside the budget rather than reporting how far it got.

The whole of #776, measured

corpus	before all three	after
this repository, 1122 commits	45 s	2.5 s
synthetic, 10000 commits	>120 s, killed	2.2 s
consumer path, 10000 commits, cold	partial answer	complete, 2.9 s

A correction worth recording

My first attempt at the 10k scaling measurement reported no difference — 2.1 s before, 2.2 s after — and I nearly wrote it up as "the synthetic corpus does not exercise the slow path".

The control never ran. I reverted with git stash push <paths>, but the changes were already committed, so there was nothing to stash and the "before" build was the after build. The tell was interpret-trailers: 0 on a corpus where the real repository makes thousands of those calls. A second attempt was still half-wrong — a quoting error left trailers.ts un-reverted, so the paragraph shortcut was still suppressing spawns.

Two controls that did not fail before one that did.

[MongLong0214]

Closed in favour of #790, which is the same change.

What was wrong: my last commit on this branch carried CommitLore trailers without a Record-Id. test/dogfood.test.ts rejects that — a record without an identity cannot be superseded, chained, or expired, so it is inert (SPEC §3.2). The repository applying its own protocol to itself is what that test is for, and it caught me. Second time today.

I did not amend and force-push; #790 rebuilds the work as one properly-recorded commit on a fresh branch.

The first failure on this branch was a different thing and is fixed rather than re-run: byteSnapshot in the shadow test read a directory and then stat'd each entry, and git removed maintenance.lock in between. That fix is carried into #790.