[kikashy]

Retained-column preparation needs to preserve exact input bytes without repeating them for every target. This Draft amendment adds references bound to the original frame occurrence, exclusive exact-text case/response custody, and complete artifact budgets across preparation, storage and export.

The closed role selector is checked against a trusted installed identity before admission. Both prototype readers cover the changed shapes and refusals. Existing conversion/reference cases remain intact. The RFC records the accounting assumptions and the product-boundary evidence still needed.

This is a Draft contract proposal for Judgment-Pack/judgment-pack-agent#171. Normative adoption, actual producer/consumer support and immutable release dependency selection remain separate gates. Independent same-vendor Codex review is complete at ade3914b0b81ef299e5b9a8d6147f37ff3f0976c; its one MEDIUM finding is fixed and confirmed by the original reviewer. The review and disposition record preserves the review limits and explicit same-vendor exception.

Checks

One full local checklist on the frozen eight-file candidate, Python 3.12.11 / Node 22.23.1:

PASS     local-paths              0s
PASS     agent-docs               0s
PASS     diff-check               0s
PASS     repository-tests         89s — 436 tests, OK
PASS     policy-prototype         1s — 38 tests, OK
PASS     policy-contract          2s — 13 tests, OK
PASS     policy-official-draft    2s — 16 tests, OK
== 7 passed, 0 failed, 0 skipped, 0 not run ==

Focused evidence: 195 changed cap/selector cases and callback probes per reader; six intended safeguard-removal failures per reader; 87 schema member/enum controls. The 99 prior reference/producer/lineage case snippets remain byte-identical. Earlier reference/custody controls and complete-artifact accounting evidence are preserved. Encoder/accounting probes are not product boundary tests.

Fix validation: both readers reject seven nonstring profiles before effects and process a following valid request; removing the JavaScript string guard reproduces the defect. The concrete schema-positive collection gaps are repaired, with 16 global enum/138 member assertions and 16 focused reference controls. The initial incomplete runs are retained and are not counted as passes. All 407 prior corpus rows remain unchanged. Local path/whitespace checks pass. Exact-head CI run 40390509187, job 121809966468, passes; the original independent reviewer confirmed the three-file fix diff without repeating the broad review.

[kikashy]

Review record and disposition

The maintainer authorized independent Codex reviews for this release batch and required upstream work, and delegated merges to this coordinator. This is an explicit temporary same-vendor exception; no cross-vendor compliance or second human maintainer review is claimed. The reviewer did not build the candidate. This record covers the Draft amendment only; normative adoption and product release gates remain separate.

Local path strings in the following otherwise unedited review material are reduced for publication.

Initial review brief

Independent clean-room review: Spec PR #271

Repository: Judgment-Pack/judgment-pack-spec. Candidate 81057b5; base be16a0f. Review the complete eight-file diff, the issue in issue171.md, RFC0029 and RFC0000/GOVERNANCE requirements. PR URL is in checks.json.

User authorized full Agent v0.11.0 milestone, necessary Spec/Runtime/Runner upstream, full dialect compatibility, and an explicit temporary independent same-vendor Codex review exception. Record OpenAI / gpt-6.1-sol / high accurately; do not claim cross-vendor review. High effort is for exact retained-input identity, admission/custody and byte-limit contract design. This is an independent reviewer, not a builder session.

The candidate is a Draft amendment, not normative adoption or completed producer/consumer support. Review correctness and honesty of its own proposed contract, schemas, handwritten cases and two prototypes; ensure it preserves the issue's promised compatibility path and documents remaining product/adoption gates. The candidate adds retained frame references, exclusive exact-text source custody, complete artifact caps, and package-bound role selection. Verify exact occurrences/identities, source and result recomputation, byte counting through all enclosing artifacts, conditional role/profile support and pre-effect ordering. Report whether prototype and schema acceptance agree, and whether stated arithmetic/encoding/domain assumptions actually establish the claims. Treat an honest conditional product proof as pending, not as a demonstrated implementation.

Evidence: checks.json binds successful exact-head CI40386720679, repository-conformance job121796832955, plus one full local checklist before commit with matching source bytes. Full local log is sibling ../coordinator/spec171-full-check.log. Focused check logs live in ../spec171-limits-20261026/evidence/limits.stdout and prior ../dialect171-references/evidence as needed; these are check evidence, not reviewer conclusions. Do not read builder handoffs, chat histories or planning/analysis documents. Pinned upstream source snapshots, if required to check a claim, are in ../dialect171-references/accounting/sources with exact identity/hash manifest. Use underlying sources, not prior workers' reasoning. All source and artifacts remain immutable during review.

Read repo AGENTS.md and the session policy at ../../handoff/policy-current-250b07a.md (relative path may resolve from review root; actual batch handoff path is work/v011/handoff). User batch policy: reuse existing verified checks; no broad suites or redundant builds. Run only focused probes of uncovered contracts and meaningful safeguard removals. Both prototype languages must be considered. Use explicit source/build identity, handwritten expectations; compilation/setup failure is not a successful negative control. One bounded review; do not implement fixes. Preserve evidence and return findings with severity, concrete file/line, reproduction/assertion and release implications. Separate required findings from notes and explicitly state no-actionable-findings if appropriate.

Checkout is repo/ under this initialized session-owned root; source must stay clean. Never commit, push, fetch, merge, tag, post, change a tracked file, install globally, delete or seal anything. Scratch probes/evidence only under this review root and tmp/. Heavy probes share /shared-heavy-check.lock and require2576980378 bytes free. Use existing session caches and verified Python3.12.11/Node22.23.1. No descendants. Any actual safeguard refusal: report and stop, no workaround. Parent owns fixes, dispositions, merge, normative adoption and release decisions. Deliver review.md plus exact candidate/evidence hashes and probe commands/results.

Review output

Independent same-vendor review of Spec PR #271

Reviewed candidate 81057b5, base be16a0f, on 2026-10-26. Reviewer: OpenAI / gpt-6.1-sol / high, independent of the builders. High effort was selected for retained-input identity/custody, capability admission and complete-artifact byte contracts. This is the user-authorized same-vendor exception, not cross-vendor or independent implementation evidence.

Result: one actionable MEDIUM finding; no HIGH finding. This reviews the proposed Draft contract, not normative adoption, production support, or completion of Agent #171.

MEDIUM — JavaScript selector coerces a non-string profile into supported selection

Location: rfcs/retained-column-conversion/reader.mjs:309 (effect at line 315).

The new selector checks Object.hasOwn(PROFILE_CAPS,s.profile) without first requiring a string. JavaScript converts an array containing one supported profile to its property key. With the example's installed synthetic identity and roles:["preview"], changing only profile to ["base"] or ["extended"] returns {"selected":true}. Instrumenting the actual select() function's existing callback seam confirms that the malformed array profile executes the effect once. The Python selector refuses capability-unsupported with zero effects, and the structural schema rejects both arrays.

The same missing type guard makes profile:{} terminate the Node process with TypeError: Cannot convert object to primitive value, rather than emitting the ordinary refusal. The custom parser's object has a null prototype, so property-key coercion cannot complete. This is the same root cause, not a second finding.

This contradicts the closed selector's exact base/extended profile contract and its validation-before-larger-read/effect rule (RFC lines 329–350). Although this prototype performs no production acquisition, its advertised guard and two-language agreement are incorrect. Require the profile's string type before property lookup, and add handwritten wrong-type selector cases covering arrays and objects in both readers and the callback checks. Confirm that malformed selectors refuse without effects and that a following request still receives an answer.

Reproduction/evidence: selector-probes.json captures the exact input wires and both process results; focused-probes.json includes schema rejection and actual callback counts (array-selector-effect-javascript: selected/1; Python: refusal/0). focused-probes.py is the preserved probe command source. All process invocations use the candidate's explicit reader paths, Python 3.12.11 and Node v22.23.1. The object-profile process failure is the observed defect, not a successful safeguard-removal check or a failed environment/setup gate.

Scope and passing evidence

Read the complete eight-file change, issue171.md, RFC0029, RFC0000, GOVERNANCE, repository AGENTS and the supplied current policy. Case changes were examined by section and stable IDs: the 72 conversion cases, seven boundaries and seven shortest-decimal expectations are byte-equivalent as parsed data to the base. Existing interface/producer updates change the affected capacities and reference-shaped lineage; no conversion expectation was silently narrowed. The 35 new reference/custody and 112 cap/selection cases were considered with their check harness and schema changes. No builder reasoning, handoffs or chat histories were used.

Reused the supplied exact-head green CI run 40386720679, repository-conformance job 121796832955. The recorded local full checklist has seven passing steps and 436 repository tests. Independently hashed the actual complete base-to-candidate diff: be8b6b06448172118d8d9c5e56adc1483749af0bb961fba7f65c586f8e52927c, exactly matching checks.json's precommit source-diff identity. The full local log SHA256 is bab396b1cceae60964cec4e78d67cfc9ec177e4b8399be67adc07becfb53cb5d. No broad suite or build was repeated.

Additional independent handwritten probes passed in both readers for an escaped frame member name and exact raw frame digest, escaped surrogate-pair/solidus input resolution, rejection of a whitespace-changed token under the old digest, changed result, extra reference member, and exact sole-text case custody of retained numeric spellings. An escaped lone surrogate is refused in the initial decoded object form and retained opaquely in the text form. These are fragment checks; they grant no source or receipt authority. The published Base/Extended growth, carrier, response, combined, preparation and record arithmetic totals were independently recomputed and match the stated formulas.

The schema and prototypes are not generally identical acceptance functions: the schema cannot check embedded JSON spelling/semantics, and the custody probe only checks the envelope slot and object containers rather than performing full acquisition/carrier verification. Those limits are disclosed. The selector type discrepancy above is outside those disclosed limits.

The proposed byte caps remain conditional. The ledger counts the sole-text escape layer, separate documents and retained input/preparation copies, per-target results/basis, storage/export and raw-audit base64. Its encoder/domain and aggregate prepared-value assumptions still require actual producer/Runtime/Runner boundary evidence. The RFC explicitly keeps those production proofs, full original-history admission, offline source binding/recomputation, complete Extended support, immutable identity selection, review dispositions and normative adoption pending. That honesty is appropriate for this Draft; it is not proof of compatibility or support. Equal frame hashes do not authorize exchanging source occurrences, and the local probes correctly disclaim authentication.

Probe command and integrity

Environment: source work/handoff/env.sh, then work/v011/handoff/env.sh; override JPDEV_SCRATCH to this initialized review root and TMPDIR to its tmp/. Run the preserved focused-probes.py with the verified builder venv's explicit Python path. The run held <scratch>/shared-heavy-check.lock, checked the 2576980378-byte reserve, and observed 3005632512 available bytes. It completed in under one second: independent raw-token/custody/ledger assertions passed, selector mismatch/effect evidence captured.

review-evidence.json records exact candidate tree, diff, eight source SHA256s and evidence SHA256s. Candidate HEAD and tracked/untracked status were checked clean after probes. No source/Git edits, fetch, network, posts, commits, pushes, merges, installs, cleanup or sealing occurred. No environmental safeguard refused this review. Parent owns the finding's disposition, fixes, adoption and release decisions.

Finding-specific confirmation brief

Fix confirmation after exact-head green CI. Same independent reviewer/launch Solhigh. Parent advanced your clean detached repo to ade3914; fix-checks.json records successful run40390509187/job121809966468 and focused evidence. Inspect only81057..ade three-file diff and verify R1 nonstring profile refusal+zeroeffects+followingvalidrequest. New related check.py coverage fix adds existing positive custody/selection examples to global schema collector, and existing producerConsistency transformation to reference collector independent of reader replay; no dropped controls. Builder handoff ../spec171-limits-20261026/r1/handoff.md and14hashedartifacts; reuse verified passes, targeted independent probes only. Confirm R1 disposition and assess uncovered new coverage changes. Do not repeat whole review/broadsuite; no source/Git/network/install/cleanup writes, scratchonly. Use existingroot/TMPDIR and resource policy; heavy Go compilation currently Runner so lightweight targetedprobe okay, no blockedlockwait required unless heavy. Write fix-confirmation.md with exacthead and disposition; no normative adoption/product release approval.

Finding-specific confirmation

R1 fix confirmation — Spec PR #271

Candidate: ade3914. Prior reviewed head: 81057b5. Reviewer: OpenAI / gpt-6.1-sol / high, the same independent review session, under the authorized same-vendor exception. Date: 2026-10-26.

R1 disposition: fixed. No actionable findings in the three-file fix diff or its related coverage changes. This is finding-specific confirmation, not a repeated broad review, normative adoption, product-support or release approval.

The new string check at rfcs/retained-column-conversion/reader.mjs:309 runs before property-key lookup. Independent tests supplied nine non-string profiles: ["base"], ["extended"], [], {}, null, 0, true, [["base"]], and {"toString":"base"}. Every malformed request was immediately followed by a valid Base/preview selector in the same reader process. Both actual line protocols returned capability-unsupported, then selected:true, with clean exits and all answers present. Instrumenting each actual selector's existing effect seam independently confirmed zero callbacks for every malformed request and one for every following valid request. The former object-profile crash and array-profile acceptance are both closed.

The seven new handwritten corpus cases agree with that contract. The existing builder evidence also demonstrates the meaningful negative control: removing only the JavaScript string guard restores selected:true for the array-Base case, at the intended assertion. No setup failure is treated as a successful control.

The check.py changes repair positive-fixture coverage rather than weakening validation. The default all-definition collector now includes the existing custody and selector examples plus the object case alternative. The reference collector always includes the existing producer transformation, including when producer-reader replay is disabled. I independently executed only the candidate global collector assignments: all ten fragments validate, and removing signedResponseFragment.result invalidates its carried positive example. The producer transformation validates, while removing the research-value reference location invalidates it. Existing mutation loops remain in the default path; the new early exits only scope explicitly requested focused commands. All 407 prior corpus rows remain unchanged; seven wrong-type selector rows are appended.

Reused exact-head successful CI run 40390509187, job 121809966468 (repository-conformance), as recorded in fix-checks.json. The actual three-file binary diff hashes to e78c28145219900d14fdd4f055e0a3fa56410c7a68568fa0e68a092ecc7a3126, matching both the check record and builder evidence. Verified all eight candidate source hashes and all fourteen evidence artifact hashes against actual bytes. Builder records explicitly distinguish the earlier incomplete/default and first global-schema runs from passing evidence; those incomplete runs are not counted as passes. The final candidate's green CI supplies the exact-head deterministic gate.

Independent command: source the two existing session environment files, override this initialized review root and its tmp/, then run fix-probes.py with the explicit verified Python 3.12.11 venv. Reader dependency: explicit Node v22.23.1. The lightweight probe completed in 0.30 seconds; it ran no broad suite, build or heavy compilation and did not wait on the shared heavy-check lock.

Evidence SHA256:

• fix-checks.json: 23ccbdd99355522557390efe71a0afb692b040322ad995c664ac462e6362ef94
• fix-probes.py: e470d2748ec4685c1f3646f729896d5b2c6addc897a73c753ef3145a310b8e08
• fix-probes.json: d901ca544f1977f8bdf27dc9a396e2cc3b17a162ddcef5c2953500790fc49925

Candidate HEAD and working tree remain clean. No source/Git/network/install/cleanup changes were made; only this review root received probe/evidence/report files. No environmental safeguard refused this confirmation. Original review limits and the RFC's pending production/adoption gates remain in force; parent owns disposition and further integration decisions.

Dispositions

Finding	Disposition	Evidence
R1 — nonstring selector profiles	Accepted and fixed in this PR at ade3914b0b81ef299e5b9a8d6147f37ff3f0976c; original independent reviewer confirmed closure.	Both readers reject malformed profiles before effects, continue processing valid requests, and the removed guard reproduces the defect.

The same fix commit repairs concrete schema-positive collection gaps without weakening controls. The reviewer inspected these changes and confirmed the relevant member/enum witnesses. Exact-head CI run40390509187, job121809966468, is green. The original full local checklist is retained; focused fix checks were run without repeating broad suites. Draft production/adoption limits remain explicit.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation