Spec gate — cross-vendor adversary review digest (intent-to-completion)
Artifacts: spec.md (rev 10) + goals.md (frozen, G6 amended with operator approval)
Reviewer: skynet_review_diff on model_group dispatch-adversary (adversary class, frontier lane: litellm/gpt-5.6-sol), reasoning_effort high, artifact bytes read server-side.

Rounds (all over the then-current bytes):
  1  FAIL  18 findings (8 P1)  — replay shortcut archived before deploy; non-idempotent deploy replay; goal assessment before deploy evidence; --pushed != merged; waivable deployment; dogfood circularity under installed v9.10.0; prose-only interview ledger; lexical liveness test
  2  FAIL  12 new + 10 residual — conflated complete/incomplete authorizations; output-based probes; merge-sha not proving branch landed; cap exhaustion dead end; rollout outside frozen goals
  3  FAIL  7 — rejection after disposition; base-tip at final boundaries; terminal guard; v9 assessor consumption; Claude surface deferred
  4  FAIL  5 blocking + 1 advisory — content_head semantics; check bypass on success; A15 contradiction; G6 vs pre-finish check; held gate untested
  5  FAIL  4 + 2 — local pre-finish merge emptied the v9 diff; medium critic freshness; authorization before started; group order
  6  FAIL  2 + 3 — medium retry; rehearsal fixtures
  7  FAIL  1 + 2 — draft as latest intent-content event
  8  FAIL  2 + 1 — local main gains state commits (rebase, not ff); absorbing terminal states
  9  FAIL  1 + 1 — stale §11 fast-forward text; per-commit audit
 10  PASS  0 blocking, 1 advisory

Recorded verdict (round 10): PASS.
Open advisory carried into planning: before the gate rebase, require origin/main == the recorded PR-merge sha (not merely ancestry); the unexpected-remote-tip rehearsal case asserts that exact condition.

Every finding and its disposition is tabulated in spec.md §13; operator decisions in the Assumptions table (D1 ledger verbs, D2 both surfaces before archive; mechanism refined from held gate → pre-finish GitHub merge with local-main state-only invariant and gate rebase).

Cross-vendor panel over rev 10 (operator-requested after the round-10 PASS; native Workflow adversarial-review.mjs, run wf_614619d7-a41, standard intensity, bytes embedded verbatim sha256 0b0ae505…):
  lanes: openai/gpt-5.6-sol revise · zhipu/glm-5.2 reject · in-repo lenses approach/failure-case/blast-radius revise · synthesis REVISE
  0 blockers survive verification; 11 should-fix + 6 nits; full record in gate-spec-panel.json
  should-fix: (1) no failure disposition after the first irreversible §10 step; (2) gate rebase on a dirty bundle tree (reproduced exit 1); (3) §7.3 strict tip equality vs state-only commits; (4) this run's archive has no completion class; (5) exhausted-at-cap reachable with zero answers via withdraw; (6) contradictions/misclassified dropped on critic_unavailable → exhausted; (7) done: resolved at seed, stale at deploy; (8) "seeded state field" counts as a knob observable; (9) live_check/G6 never execute the installed binary; (10) tag-push CI run never queried; (11) v2 assessor prompt dispatched by v9 against v1 goals.md
  dropped after in-tree verification: rebase replays unaudited commits (push precedes main_pre_bootstrap); GitHub branch protection (main unprotected, merge commits allowed); "no terminal path after failed final assessment" (waiver → intent_confirm → --intent-rejected exists); §7.3 "livelock" (re-entry never commits)
Spec gate hash unchanged (rev 10 bytes); disposition of the panel findings is pending the operator's choice.
Operator chose: revise to rev 11 and re-gate (G6 amended a second time, approved; goals hash 191978ba…). Rev 11 = ebbe77a, gate hash 05e44a7a….

Cross-vendor panel over rev 11 (run wf_d2251340-1a5, standard, bytes sha256 e6bf34e0…):
  lanes: gpt-5.6-sol revise · glm-5.2 revise · three lenses revise · synthesis REVISE
  2 blockers (the sample release step commits to the base and trips the §7.3 audit / an unbumped version dead-ends; converged reachable with zero intent questions), 7 should-fix, 5 nits; 6 dropped after in-tree verification; record in gate-spec-panel-2.json
  → rev 12 (c5bd17d, gate hash ea71db5a…): release contract + version_not_bumped gate + stage-produced commits; intent floor; audit scope any bundle; step-5 fetch/rejection row; pre-publish review + publish_ack (D2 ordering user-confirmed 2026-09-03); user_only {text, check}; required_successor event + doctor; seed lock; squash by patch-id.

Cross-vendor panel over rev 12 (run wf_75d9951a-7fa, standard, bytes sha256 f65ba7a4…, 103,368 chars):
  lanes: gpt-5.6-sol revise · glm-5.2 revise · three lenses revise · synthesis REVISE
  1 blocker: required-successor doctor FAIL is self-referential through ci.yml (doctor on every push and tag) → main red from the archive push, successor's tag CI red, complete unreachable
  11 should-fix: corrective pass unreviewed + reviewed sha ≠ tagged sha; no deterministic bootstrap driver / rehearsal proves a different executor / "wave" misnamed; done: none unreconciled with mandatory groups; context_watch.focus inert; high cadence in unsealed rounds; stage-produced commits unrestricted; no post-archive push; no corrective-pass event shape; one critic failure licenses exhausted; env-scan escape hatch; host-wide install flip unacknowledged
  4 nits: cache-level Claude proof; sibling push at the gate; assumed rows reviewer-only; context-status not-found vs unsupported
  4 dropped: CI job-skip (again), seed-lock TOCTOU (already disclosed), WORKLOG PR conflict (branch is created from local main), removed flags in flight (seed-only)
  → rev 13 (95a4c07, gate hash d99f2fde…): see spec.md §13 (B1, S2–S12, N13–N16) and A31–A34.

Cross-vendor panel over rev 13 (run wf_320af430-a88, standard, bytes sha256 59916386…, 127,697 chars):
  lanes: gpt-5.6-sol revise · glm-5.2 revise · three lenses revise · synthesis REVISE
  2 blockers, both introduced by rev 13: push_archive was an ungated default push for every repo (loose pushed with no AUQ; false fast-forward premise where no install push exists; no non-FF disposition); the per-round critic rule was an event-position predicate one trailing receipt satisfied, and the §11 test certified the bypass
  6 should-fix: deploy_indeterminate "mark done with evidence" reached complete; patch-id --stable is whitespace-blind (reproduced); ask+withdraw rounds padded the round minimum; sibling scan rooted at <MAIN>/../* missed most repos; required-successor soft and slug-bound; step-5 push carries unnamed non-bundle commits
  5 nits: G6 wording on the corrective path; commit_paths could allowlist src/; failed-record vs postcondition; rebase "cannot conflict" unasserted; one-off bootstrap as permanent CLI surface
  7 dropped: seed-lock race (3rd time), receipt provenance (2nd), arm/record attestation (A33), different pre-publish panel + split release (user-confirmed scope), hook-policy hazard (wrong premise), "A21/A28 false"
  → rev 14: see spec.md §13 (B1, B2, S3–S8, N9–N13) and A35–A36. Re-gate mechanism for rev 14 is the operator's call (four panels ≈ 3.6M tokens, each finding what the previous fold introduced).

Recorded 2026-09-03: spec_adversary_review_skipped at gate hash 3a4ff341… (rev 14, commit 6032efa) — operator attestation via AUQ ("Record the gate without another review"). Rev 14 has NOT been reviewed at this hash; the residual risk (fold-introduced defects in the rev 14 deltas: push_archive gating, ask-time critic cadence, attestation class, scripts/ driver) is carried to the plan gate, whose reviewer and alignment audit read the spec.
