`data/codex-yoloforever/cycle-20260908T1221Z.HzXvuQ/cody-ops-review-v1.md`

32 lines

## 🔪 CONTRARIAN PANEL — R0 recovery preparation, TK-10928

**Verdict: FIX FIRST.** The actual exclusion draft aborts on nested repositories under the installed Bash. The capture itself clears the bounded checks performed.

**The 5 critics:**
- 🔧 Engineer — Bash 3.2.57 plus the real `set -uo pipefail` makes an empty `snapshot_excludes[@]` expansion fail with exit 127. Root cases pass. Vote: FIX FIRST.
- 🎨 Designer — The fixture report displays nested scope as PASS without disclosing its shell/options contract. That evidence hierarchy conceals the exact compatibility problem a reviewer needs first. Vote: FIX FIRST.
- 👤 User — A fleet operator expects root-only exclusions to preserve ordinary nested snapshots. Actual nested cases do not reach their file listing. Vote: FIX FIRST.
- 🕵️ Skeptic — `actual_proposal_snippet_executed: true` is too weak when the actual shell mode is missing. Full integrity, restored state, and measured target storage are not yet proven. Vote: FIX FIRST.
- ♟️ Strategist — A bounded five-path patch remains proportionate. Fix the shell arguments; do not widen exclusion scope or claim that this draft has already recovered the canary. Vote: FIX FIRST.

**Debate round:** Engineer holds the empirical compatibility blocker. Designer concedes correctness takes priority and sharpens the evidence request to recording interpreter/version/options. User accepts the root pathspec is accurate but insists nested operation remain functional. Skeptic concedes the complete-copy manifest is meaningful capture evidence, while holding the missing integrity/restore boundary. Strategist rejects a rebuild: a tiny argument-array correction already passes isolated fixtures. Duplicate complaints about the empty array collapse into hole 1.

**The 3 holes that survived debate (ranked):**
1. **Must fix before accepting this patch:** `snapshot_excludes=()` combined with `${snapshot_excludes[@]}` under installed Bash nounset exits 127 for nested repositories. Root candidate and absent-candidate cases pass; nested variants both fail. Keep the argument array nonempty with the positive `.` pathspec, and retain the five exclusions only in the root branch. The fixture-only candidate passes all four exact-path and real-index checks.
2. **Verification defect:** `ops-staging-fixture-proof.json` claims nested PASS, but a reproduction with the production interpreter/options fails. Re-run and record those preconditions on the final proposal hash. This is a harness fidelity issue, not a second code defect.
3. **Open critical boundary, not an invented defect:** `ops-rehearsal-error.json` records a 240-second full-fsck timeout. No completed restore, self-contained rebuilt storage measurement, or canary/scheduler recovery evidence is available. These cannot receive a completion claim.

**The lazy shortcut you hoped we would not notice:** `"actual_proposal_snippet_executed": true` — executing the lines without matching the caller's shell contract buys false confidence.

**Sameness:** The five exclusions are intentionally one bounded policy, not five alternative designs. No duplicate-design complaint applies.

**Where the critics DISAGREED:** Strategist's strongest dissent rejects treating unfinished recovery evidence as proof the architecture needs rebuilding. Engineer agrees: repair the reproduced shell failure; finish the existing preservation rehearsal separately.

**Vote tally:** 5 × FIX FIRST → **VERDICT: FIX FIRST**. One confirmed patch blocker; two distinct evidence gaps. Source changes remain unauthorized.

**The bar:** Final hashed proposal passes root/nested and present/absent candidate fixtures on installed Bash with production options, preserves every expected noncandidate and the real index, and separately supplies completed integrity/restore/storage evidence before anyone claims recovery.

**Do this now:** Make the proposal pathspec array nonempty, then rerun the installed-Bash fixtures on its final hash.

**One sentence:** The capture is real; the nested-repo compatibility claim falls over before Git even runs.