Plan gate — cross-vendor adversarial review digest (intent-to-completion)
Artifacts: spec.md (rev 14) + plan.md + plan.index.json (48 tasks / 11 waves) — bytes embedded verbatim, sha256 78e845665b165e36a1355fd2609720f9afb5d6d03e9dfe256d2396d8ef843a7f, 256705 chars
Workflow: adversarial-review (wf_eca58e83-c62), intensity standard; cross-vendor lanes: openai/gpt-5.6-sol, zhipu/glm-5.2; degraded: none
Provenance: dispatch-adversary → litellm/gpt-5.6-sol, 564 output tokens; dispatch-adversary → litellm/gpt-5.6-sol, 12673 output tokens; dispatch-multi-agent-orchestration → litellm/glm-5.2, 2387 output tokens; dispatch-multi-agent-orchestration → litellm/glm-5.2, 568 output tokens; dispatch-multi-agent-orchestration → litellm/glm-5.2, 7537 output tokens
Verdict: revise; findings 12 (1 blocker, 8 should-fix, 3 nit); disagreements 6; dropped 7

Summary: The plan is structurally coherent (goal coverage complete, no same-wave file collisions, every spec §11 suite owned) and most cross-vendor blockers did not survive in-tree verification. One blocker does: scripts/bootstrap-v10.mjs is written by Task 44 (wave 2) but its ~40 failure-path scenarios are proven by test-only Tasks 45–48 in waves 3–6, and masterplan's D6 scope check (docs/internals/task-verification.md:67-87, verified) reverts any out-of-scope edit and leaves the task pending — so the first real defect in the 14-step driver has no task that can fix it. The same single-owner/later-tester shape recurs at should-fix severity for lib/config.mjs, bin/masterplan.mjs, and lib/retro-goals.mjs (the finish-step chain, by contrast, co-owns its lib file in every test task). Eight should-fix items follow: Task 2's stale diagnosis (goals-choice is already in KNOWN_FLAGS at bin/masterplan.mjs:574 and threaded at :3712; the failing test 6 is an ENOENT/exit-2 collision in die()), the missing plan.md bootstrap marker the spec requires (stated only in index.meta and WORKLOG.md:414, with a waivable v9 goals_unmet as backstop), no producer for push_archive's "install step pushed the base" signal, Task 7 handing the critic a budget summary rather than a verbatim ledger, Task 45's rehearsal omitting the §10.3 failure fixtures, Task 30 regressing test/retro-goals.test.mjs without owning it, the CLAUDE_CODE_SESSION_ID read at bin/masterplan.mjs:626 unnamed in any contract list, and Task 3(e)'s `pushed: no` line verified by nothing. Revise the ownership model and the named gaps; the remaining reviewer claims were dropped as re-litigating spec decisions or misreading the plan.

Findings (severity-first):
 1. [blocker] scripts/bootstrap-v10.mjs is owned only by Task 44 (wave 2) while Tasks 45/46/47/48 (waves 3-6) exhaustively test it with no write scope, and D6 scope verification reverts out-of-scope edits and leaves the task pending, so a driver defect found by those suites has no fix path in the plan.
 2. [should-fix] Task 2's description names a defect that no longer exists: --goals-choice is already in KNOWN_FLAGS and threaded to finishStep, and the currently failing test fails because die() uses exit 2 for the ENOENT on the missing state file, colliding with the unknown-flag exit code the test rules out.
 3. [should-fix] The spec requires plan.md to list the bootstrap stage as a marker after its last wave (spec §10.1), but plan.md ends at Wave 10 with no marker; the stage lives only in plan.index.json meta.solution and WORKLOG.md, and plan.md is regenerated from the index by renderPlanMd so a hand-added marker cannot persist under the installed v9 renderer.
 4. [should-fix] push_archive's trigger ('an install-group deploy_step receipt pushed the base' with `pushed_base`) has no producer anywhere in the plan: Task 16's done: step schema is {run, check?}, Task 23's receipts carry exit/check_exit/digest/source, and Task 29 only consumes the signal.
 5. [should-fix] Task 7's exact dispatch contract hands the critic 'the interview ledger replay from `mp interview status`', but spec §5.1 step 2 defines status as a budget/state summary ({asked, answered, floor, cap, active_design_picks, critic, state}) and no task (11, 12, or 3) commits any op to emitting the verbatim question/answer text.
 6. [should-fix] Spec §10.1.1 requires the rehearsal script itself to show every §10.3 failure row against fixtures, but Task 45's script and test cover only the successful walk plus gh-shim cleanup; the failure rows are exercised solely by Task 48's driver unit suite, which never runs scripts/rehearse-v9-finish.sh.
 7. [should-fix] Task 30 changes renderRetroGoals in lib/retro-goals.mjs (its only render export) but neither owns nor runs test/retro-goals.test.mjs, which asserts `''` for goalsEnabled:false and no trailing newline.
 8. [should-fix] The pre-existing Guard D session-identity read `process.env.CLAUDE_CODE_SESSION_ID` at bin/masterplan.mjs:626 (and its --session/--host flag companions) is swept into the readEnv migration by Task 3 and the knob inventory by Task 20, but is named in no contract list (Task 19), no documented environment list (Task 8), and none of the four metadata exemptions.
 9. [should-fix] Task 3 contract item (e) — `mp runs list` and `mp status` print `pushed: no` until archive_pushed — has no task whose verify would fail if it shipped wrong.
10. [nit] Task 3 defers its exhaustive behavioural matrix to 'orchestration-integration.cli-contract', a parallel-draft subsystem label that matches no task id; Task 6 (wave 6) is the evident target.
11. [nit] The grep-alternation verify lines in Tasks 1 and 8 are satisfied by any single term (e.g. the word 'complete' anywhere in README.md) and so prove nothing on their own.
12. [nit] Tasks 38-40 (wave 1 doctor checks) can only be tested against hand-built fixture bundles because their real writers (Task 28, the bootstrap stage) land waves later, and no later task re-verifies them against writer-produced bundles; Task 16 (config) and Task 7 (sequencer) are similarly large single-sitting tasks whose only verification is prose-pattern presence in Task 7's case.
