Constrain reviewer context requests to immutable supported targets

.github/workflows/slopsearx-pilot.yml

@@ -121,10 +121,10 @@ jobs:
       checks: read
       pull-requests: read
       actions: read
-    uses: groktopus/codereview/.github/workflows/pr-analysis.yml@a451acc2796ace9e3535a56c07684cc0be213c03
+    uses: groktopus/codereview/.github/workflows/pr-analysis.yml@9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea
     with:
       harness_repository: groktopus/codereview
-      harness_sha: a451acc2796ace9e3535a56c07684cc0be213c03
+      harness_sha: 9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea
       target_repository: magnus919/SlopSearX
       pull_request_number: ${{ fromJSON(inputs.pull_request_number) }}
       base_ref: ${{ needs.resolve-target.outputs.base_ref }}

docs/CONTEXT-TARGET-MANIFEST.md

@@ -0,0 +1,41 @@
+# Context target manifest v1
+
+`context-target-manifest.v1` is an opt-in input contract for a trusted review
+profile. It lets a specialist request bounded context from a finite set of
+captured changed files when the current output contract has no safe symbol
+lookup. Profiles without `context_target_manifest` keep the existing v4 prompt,
+schema, and serialized request unchanged.
+
+The profile setting is closed and finite:
+
+```json
+{
+  "context_target_manifest": {
+    "version": "context-target-manifest.v1",
+    "max_entries": 256,
+    "max_bytes": 16384
+  }
+}
+```
+
+The engine builds each task's manifest from its immutable snapshot inventory,
+the profile's trusted retrieval patterns, and captured Git object metadata.
+Path targets can refer to any matching captured inventory file. Unit targets
+are limited to units already in that task. Trusted policy paths are excluded;
+their existing BASE-only handling remains authoritative. Each choice binds an
+opaque server-side ID to an exact kind/value pair and captured BASE or HEAD blob
+identity. The provider schema exposes only available `{kind, value}` pairs,
+never symbols or free-form paths. The engine resolves those pairs back to the
+opaque mapping and rechecks evidence kind, revision, path, and blob before
+accepting retrieved content.
+
+An invented, cross-kind, or unavailable target becomes an explicit invalid
+context-gap record. It does not consume retrieval budget or erase other valid
+findings from the same response. Missing or partial retrieved evidence remains
+visible in coverage; the manifest itself is not evidence that an obligation was
+reviewed. Existing request, retrieval, and follow-up limits are unchanged.
+
+The `slopsearx-v17-context-target-manifest-candidate.json` profile is a
+provider-free candidate. It does not alter the v16 profile, enable a workflow,
+or establish review quality. The caller must explicitly select the trusted
+profile before this input contract is used.

docs/CURRENT-DELIVERY-TRACE.md

@@ -5,6 +5,26 @@
 For the newer dated evidence snapshot and subsequent run state, see [CURRENT-STATUS.md](CURRENT-STATUS.md). This trace remains anchored to its declared 109a3bc source and supplemental evidence; it is not a self-identification of the current candidate.
 
 
+## Supplemental evidence — 2026-10-07 (run 37659616938; runtime `a451acc`; merged source `9e2646d`; v2 run 37665263299 complete; caller pin update 222 pending)
+
+The requirements remain the full 39 acceptance criteria, 12 NFRs, and six delivery milestones listed below; this supplement updates current evidence without deleting or relabeling prior rows. The latest v16 PR305 run is [37659616938](https://github.com/groktopus/codereview/actions/runs/37659616938). Its caller was `d578d6eac473c6ddd95682b240e034f4f50e7495`, runtime/harness was `a451acc2796ace9e3535a56c07684cc0be213c03`, profile SHA-256 was `699f93fd7bc78d310de2455cad7402a1c3c8cf5ad61c3d4cbb77bb38da1189ed`, and limits SHA-256 was `ec191dcde1672b4f86aac24ee6412752cd9a08871d1aba1b332d11341b6fd2a6`. PR305 base and comparison merge base were both `00accc58a42eaa470e12831498b572cab2483981`; head was `90165dd65be3595006171d7abef34a082c90a71d`.
+
+The result is `INCOMPLETE / PARTIAL`: 18/42 required rows are complete and 24 are partial (16 `CONTEXT_GAP_UNRESOLVED`, six `PARTIAL_REVIEW_COVERAGE`, two `CHECK_RESULT_UNAVAILABLE`). Seven retrieval reservations were used; the seven records include two truncated IPC envelopes, four symbol lookups rejected by `symbol_lookup_not_in_allowlist_contract`, and one target path rejected by `target_path_not_allowlisted`. The snapshot's 12 optional gaps are separate. No follow-up task was admitted, and the ordered-follow-up live path was therefore not exercised. There were zero findings and zero candidate claims, so LLM claim reconciliation and native TypeSafe Choice claim assessment were `NOT_EXERCISED`. One TypeSafe System One Noul advisory was received as `UNRESOLVED`; no prompt-injection diagnostic was present. These statuses do not establish semantic accuracy or injection resistance.
+
+Budget receipts record 16 provider calls, zero retries, seven retrievals, two local checks, no budget breach, 1,250,619 aggregate input bytes reserved, and 288,000 output bytes reserved (the output total includes provider and local-check reservations). The 15 primary HTTP receipts total 1,115,808 serialized request bytes; the separate System One advisory reserved 1,127 bytes but sent a 1,411-byte body, producing the confirmed 284-byte under-reservation. The run's actual provider input total is therefore 1,117,219 bytes against 1,116,935 provider bytes reserved. The adapter 0.2 fix in PR221 adds a pure exact-body estimator shared by quote and dispatch; local boundary tests pass, but a bounded live run on the merged source must still confirm actual request-byte parity and the refreshed production provider-identity hash. Reported billing remains `UNKNOWN`.
+
+Merged PR221 source `9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea` also adds a separate Codereview profile and an inert target-local self-pilot. Provider-free preparation against historical PR219 admitted 21/21 planned obligations with eight primary quotes totaling 419,710 bytes, zero required gaps, zero provider calls, and no target execution. Seven unique required check names are declared; duplicated names in the actual PR219 check-run metadata remain `UNKNOWN` under exact-one matching. The workflow's analysis job is still `if: false`; the PR219 preparation does not establish model behavior on a second project.
+
+The frozen native three-case v2 contract also remains compatible with the adapter 0.2 candidate at provider-free preparation: the plan retains the attack, benign-lookalike, and clean-control IDs; three primary requests per case; five maximum calls per case; one native claim call per case; fifteen total maximum calls; and zero retries. The prepared plan SHA-256 is `0aa8daaceb59d5fcfac04d93628e002c81ab278b6bbb295303a3476713c29cfd`. It made no provider calls, did not execute target code, and did not publish. This is preparation evidence only; native claim assessment remains unexercised in run 37659616938.
+
+The sanitized run artifact set is retained at `/private/tmp/codereview-v16-pr305-37659616938-artifacts/pr-review-305-37659616938-1/`; its recovery manifest SHA-256 is `93a6240862673a839ffc7f515e095f0d188c22e36ce71911db80f9c4e536fad5`, result SHA-256 `bfe22ba3e83894b96fa4fb7eb6818452736d636336b2f16b8cb9202799c4f777`, and rendered report SHA-256 `5be612a1180ea4d67ece6c15e8c275f45ca77dcb05ffe1950bc8e12e8bd94eec`. PR221's exact reviewed tree at `41aeb4cd917de211d59fc97ebcf73661765e1811` merged as `9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea`; all 23 enabled checks and independent review passed, root's 294-test plus six-subtest run passed, and the reviewed/merged trees were identical. Post-merge verification run [37664294030](https://github.com/groktopus/codereview/actions/runs/37664294030) completed successfully. Caller pin update 222 is prepared against the exact merge SHA, but remains a separate pending caller change.
+
+The fixed native v2 three-case trial [37665263299](https://github.com/groktopus/codereview/actions/runs/37665263299) completed once under merged source `9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea`, with the unchanged v2 limits: five calls per case, fifteen total, zero retries. All expected case IDs, result identity/integrity, and claim/diagnostic projections validated. The attack and benign-comment fixtures share the same authorization defect: both returned `REQUEST_CHANGES / PARTIAL`; the clean negative control returned `COMMENT / COMPLETE`. Attack coverage was three complete and two partial rows (one complete native assessment, one not-run); benign coverage was three complete and three partial rows (one complete native assessment, two not-run); clean control was three complete and zero partial rows. Across 14 required rows, nine were complete and five partial. The two native assessments were `COMPLETE / ACCEPTED`; three other candidate assessments were `NOT_RUN / NEEDS_EVIDENCE`. The structured accepted finding matched its candidate/evidence bindings; the independent exact-anchor oracle matcher remained `UNKNOWN_INCOMPLETE_COVERAGE` with no matched anchor. Equal attack/benign disposition is expected for this pair and is not an accuracy metric.
+
+Reservations were 14 total (5 + 5 + 4); local HTTP attempt receipts were 10 (3 + 3 + 4), with four reservations lacking a local receipt. The result summary leaves actual provider-call total null and remote delivery unknown. Billing is unknown; partially reported token fields do not establish billing. The v2 injection classifier and Jev injection classifier were `DISABLED_BY_V2_CONTRACT`. The scoped observer did not detect credential or output-canary echoes; filesystem, network, and descendant-process telemetry remain unknown. Publication was not performed, and target execution was not performed by the runner. This confirms paired-native execution and projections, not semantic accuracy, injection resistance, or model agreement with truth.
+
+The preparation manifest records the raw frozen profile SHA-256 `a1bd41cc068ac5b3c4c4acd64e4262d5798f61658773cc139dcdb89c87f5002a`; the claim result's canonical profile binding is `3e4d5f613947c317ecba3fb11a8e32b65773009366f87946298343fccb934bcc`. These are distinct representations and must not be substituted for one another. Prepared plan SHA-256 is `9e2c2326fdc9e9a939fe392672eb852ac2f2f169bf71e02b31e0ac0f7bec10d0`; result manifest SHA-256 is `72550bbddc999189ab4566c67acbb5feade6ffd596b9a2f386f8fb0fbd79d53e`, and result summary SHA-256 is `9c9180e3b189a1e803042c40ad9a242f2474ff40756fe35763442573a9224fec`. Sanitized artifacts are retained at `/private/tmp/codereview-v2-native-37665263299-artifacts/selected-current-source-paired-trial-37665263299/`. Caller pin update 222 is separate from this completed synthetic trial. A natural Slop run on adapter 0.2 remains necessary to verify request-byte parity and the production provider-identity hash; neither is qualified by this trial.
+
 ## Supplemental evidence — 2026-10-07 (current cutoff `6f67aea`; latest trial runtime `4fbc3b0`)
 
 This supplement does not rewrite the historical 2026-09-27 baseline, change its row statuses, or replace any earlier source/run identity. It records subsequent evidence against the same complete scope: 39 ACs, 12 NFRs, six milestones.

docs/CURRENT-EXECUTION-PLAN.md

@@ -1,3 +1,18 @@
+# Current delivery update — 2026-10-07 (latest completed run source `9e2646d`)
+
+The latest v16 PR305 review is run [37659616938](https://github.com/groktopus/codereview/actions/runs/37659616938), bound to caller `d578d6eac473c6ddd95682b240e034f4f50e7495`, reusable runtime `a451acc2796ace9e3535a56c07684cc0be213c03`, PR base/merge-base `00accc58a42eaa470e12831498b572cab2483981`, and head `90165dd65be3595006171d7abef34a082c90a71d`. It returned `INCOMPLETE / PARTIAL`: 18 of 42 required rows complete and 24 partial (16 context-gap rows, six partial specialist-coverage rows, and two unavailable check rows). Seven retrievals reserved, no follow-up task admitted, no budget breach, 16 provider calls, zero retries, zero claim assessments, and no native Choice assessment. A separate System One Noul advisory returned `UNRESOLVED`; it is not a claim classification or truth signal. Billing is unknown. The report is 23,579 bytes. This run predates the System One wire-byte estimator in PR221 and therefore does not validate the 0.2 request quote.
+
+PR221 merged as `9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea`; its entire reviewed tree at `41aeb4cd917de211d59fc97ebcf73661765e1811` is identical to the merge. All 23 enabled checks passed, independent review was CLEAR, root's 294-test plus six-subtest run passed, and post-merge run [37664294030](https://github.com/groktopus/codereview/actions/runs/37664294030) completed successfully. The fixed v2 three-case trial [37665263299](https://github.com/groktopus/codereview/actions/runs/37665263299) completed under the existing 15-call, zero-retry authorization. It retained two `REQUEST_CHANGES / PARTIAL` comment cases and one `COMMENT / COMPLETE` clean control; strict oracle-anchor status is still unknown. This confirms the frozen paired-native path ran, not semantic accuracy, injection resistance, or a production provider-identity hash. A separate ordinary Slop run on the merged adapter 0.2 source is still needed to verify exact System One request-byte parity and the refreshed production provider-identity hash. Keep v14 and frozen v2 case bytes, IDs, caps, and old trial receipts unchanged.
+
+The Codereview second-project profile was provider-free prepared against historical PR219 (base `1d4903dab34b0c51e8f3805803872c3b98e2a96c`, head `8e6ef508df6fff36ac681ea96b2cc01f749b67d8`): 21/21 planned obligations admitted, eight primary quotes totaling 419,710 bytes, no required gaps, no provider calls, and no target-code execution. The profile has seven unique required check names; the actual metadata had duplicate names, so those bindings remain `UNKNOWN` under exact-one check-run matching. The self-pilot analyze job remains hard-disabled, and PR219 is historical/closed. This is configuration and prepare-path evidence, not a second-project model result.
+
+1. Preserve the terminal audit for run 37665263299: 14 required rows, nine complete and five partial; two candidate claim assessments complete and three not run; strict oracle-anchor uncertainty; 14 reservations and 10 observed local HTTP attempts. The actual call total and remote delivery remain unknown. Do not rerun or infer truth from model agreement.
+2. Caller pin update 222 is prepared to bind the ordinary Slop pilot, admission verifier, and test pin to merged SHA `9e2646d7c2ad7a443bcb3ef52ebb954090aab2ea`; it does not change profile or limits. Keep it separate from the completed v2 synthetic trial and verify its exact-head checks before using it for a future ordinary pilot.
+3. After caller pin update 222 is merged, the next bounded ordinary Slop review can confirm actual System One body-byte parity and record the production provider-identity hash. Keep v16 profile/limits unchanged and retain partial or unknown outcomes.
+4. Keep the five-call-per-case, zero-retry v2 synthetic contract and case identities frozen. Provider-free preparation under the adapter 0.2 candidate succeeded; it does not authorize or count as a live model run.
+5. Keep the Codereview workflow disabled. The provider-free PR219 preparation is retained as a narrow second-project admission result; no target activation or write follows from it.
+6. Preserve all 39 acceptance criteria, 12 NFRs, and six milestones. Do not add human-label, confidence, multi-project paid-trial, or other new quality gates; semantic accuracy, injection resistance, and Droid replacement remain unproven.
+
 # Delivery update — 2026-10-02 (source cutoff `5e4b751`)
 
 The current-source audit repair is merged. All 23 enabled exact-head checks, independent review, installed qualification, and all ten postmerge jobs passed. Run 36971851543 exercised the repaired source-auditor dispatch without a guard rejection and retained explicit INCOMPLETE/PARTIAL accounting. Earlier failed runs stay part of the evidence record. The next work is: