open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

docs(linkedin-studio): S17 — C13–C46 triage (0 still-real) closes audit remediation

Browse source 
Cold-read triage of the ~34 uncalibrated baseline-audit findings (C13–C46)
that never got a second hostile pass. An independent Opus reader classified
each against the current code; every disposition was grep-verified in the
main session.

Result: 0 still-real, 23 already-fixed, 1 outdated-drop (24 grouped/sub-claim
entries). No inline code fix needed — the v4.0.0 + S13–S16 remediation had
already closed every still-real item (dead lint, 11 orphan agents, carousel
full-deck clipboard, router tiering, onboarding inline, de-AI gate, video gate,
post-feedback-monitor->Opus, series-path parameterization, SKILL roster).

Deliverable: docs/remediation/c13-c46-triage.md (disposition record) +
docs/remediation/review.md (S17 review, ALLOW). /trekreview: brief-conformance
0 findings; code-correctness 2 MAJOR in the triage doc's own prose (one
overclaim, one line-pointer) FIXED in-session — no false-green disposition.

Gate: test-runner.sh 74/0/0, hooks node --test 98/98, analytics 116/116.
M0 (per-user data-dir migration) deferred to the UI track. Remediation COMPLETE.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-05-31 04:45:11 +02:00
commit 2633d329b2
2 changed files with 194 additions and 93 deletions
Download patch file Download diff file Expand all files Collapse all files

106
plugins/linkedin-studio/docs/remediation/c13-c46-triage.md Normal file
View file

@ -0,0 +1,106 @@
# C13–C46 Triage — disposition of the uncalibrated audit findings
> **Session:** S17 (last finish-plan session). **Source:** the ~34 findings the
> 2026-05-29 baseline audit (`docs/critical-review-2026-05-29.local.md`) flagged in
> §10 as *file-evidenced but uncalibrated* — never put through the second hostile-read
> pass that calibrated C1–C12. **Method:** independent COLD read delegated to an Opus
> Agent (no drafting-session context), every disposition then **grep-verified in the
> main session** against the current code (v4.1.0). Triage only changes state by
> *recording a disposition*; any still-real finding is fixed inline before this file is
> committed.
## How the ~34 canonical findings map here
The audit never persisted a discrete `C13 … C46` list — §10 reports "46 total canonical
findings", of which 12 (C1–C12) were calibrated and remediated in v4.0.0, leaving **~34
uncalibrated (C13–C46)**. The published audit body is the canonical record: it surfaces
the load-bearing uncalibrated ones as `[unverified-major]` / `[unverified-minor]` and
folds the rest into §5 / §6 / §9 prose. The 24 grouped findings below cover that set;
several are multi-sub-claim bundles (F-VIDEO = 3, F-SKILL-ROUTER = 3, F-GENERALIZE = 2),
which expands the count toward ~34 when each sub-claim is counted. The §3/§3b numeric
algorithm-claim rows were the *calibrated* C1–C12 set (carousel 6.6 %/1.92 %, comment
15x/5x, link penalty, 360Brew name/date) — already remediated in v4.0.0 and enforced by
`test-runner.sh` Section 8; not re-triaged here, confirmed green.
## Disposition summary
**0 still-real · 23 already-fixed · 1 outdated-drop (deliberate decision)** across the 24
grouped/sub-claim entries in the table below (the audit bundles F-VIDEO into 3 sub-claims
and F-SKILL-ROUTER into 3; counting bundles as single groups gives "19 already-fixed, 1
outdated-drop", same verdict). No inline fix was required for S17. Gate at triage time:
`test-runner.sh` **74/0/0**, hooks `node --test` **98/98**, analytics `npm test`
**116/116**.
| ID | Finding (short) | Sev | Disposition | Evidence (current code) |
|----|-----------------|-----|-------------|--------------------------|
| **F-LINT** | Dead structural lint (29 failures; stale `linkedin:NAME.md` layout, 14-agent list, deleted `personalization-scorer`, fabricated `auto_discover`) | major | already-fixed | `scripts/test-runner.sh` runs **74 pass / 0 fail / 0 warn, exit 0**; derives counts dynamically + asserts `EXPECT_AGENTS/COMMANDS/REFS/SKILLS = 19/29/25/6` |
| **F-SCHED** | Auto-publish / scheduling boundary never disclosed | major | already-fixed | `README.md` Boundaries §; `commands/calendar.md:92-93` — tool does **not** post on your behalf |
| **F-PROFILE-SEO** | `/linkedin:profile` is a credibility checklist, not an SEO/search surface | minor | already-fixed | `commands/profile.md` Profile-SEO §: headline-as-highest-weight, per-section keyword table, search-index, semantic search |
| **F-VIDEO (a)** | No hard 9:16 (1080×1920) + 3-sec-hook gate | major | **outdated-drop** | Deliberate: `commands/video.md` — 4:5/1:1 for feed, 9:16 = opt-in; "3-sec hook" framed as cross-platform folklore, not a LinkedIn ranking signal |
| **F-VIDEO (b)** | 4:5 "preferred" vs "deprioritized" self-contradiction across files | major | already-fixed | Consistent "preferred" in `commands/video.md`, `references/video-strategy-guide.md`, `references/linkedin-formats.md`; no "deprioritized" string remains |
| **F-VIDEO (c)** | No caption / SRT output | major | already-fixed | `commands/video.md` (SRT upload / native auto-captions + caption block); `references/video-strategy-guide.md` |
| **F-VIDEO-TASK** | `video.md` had no `Task` tool to call its own agent | major | already-fixed | `commands/video.md:15` (`Task` in the allowed-tools block at `:8-16`); `:81` invokes `subagent_type: linkedin-studio:video-scripter` |
| **F-NEWSDIST** | Newsletter *distribution* mechanics omitted (notification leverage, cadence, funnel, cold-start) | minor | already-fixed | Distribution layer in `commands/newsletter.md` (delingstekst + hook gate); mechanics in `references/newsletter-strategy-guide.md`, linked from `strategy.md`/skills |
| **F-OUTREACH** | Templates-without-tracking (no pipeline state) | minor | already-fixed | `commands/outreach.md` pipeline board/tracker (Step 8); `hooks/scripts/state-updater.mjs` `recordOutreachContact()` |
| **F-DEAI** | No short-form de-AI/differentiation gate; `differentiation-checker`+`voice-trainer` orphaned | major | already-fixed | `differentiation-checker` wired in `post/quick/react/carousel/video` (5 cmds); `voice-trainer` in `setup.md` |
| **F-ONBOARD-INLINE** | Onboarding dead-ends at "go run /linkedin:first-post" | major | already-fixed | `commands/onboarding.md` — drafts the first post **inline**; "do NOT hand off to another command" |
| **F-ROUTER** | Flat 22-item router menu | major | already-fixed | `commands/linkedin.md` — five-journey tiering (Start·Create·Engage·Measure·Grow) + front-doors + ~1K soft-gating |
| **F-NEWS-BANNER** | No time/effort expectation atop `/linkedin:newsletter` | major | already-fixed | `commands/newsletter.md:25-28` — "multi-session, multi-gate (16 phases) … ~4–8+ hours" banner |
| **F-CAROUSEL-CLIP** | Only the caption copied, not the full deck | major | already-fixed | `commands/carousel.md:191` — "Assemble the entire deck — every slide's copy … into ONE clipboard payload" |
| **F-PILLAR-COUNT** | `setup.md` (5) vs `onboarding.md` (3-5) pillar disagreement | minor | already-fixed | The named disagreement is closed — both now **declare 5**: `commands/setup.md:312-313`, `commands/onboarding.md:155` (and `profile.md:155,198`). See note¹ — the surviving "3-5 core topics" strings are a distinct focus-discipline heuristic, not the pillar-count declaration. |
| **F-ORPHANS** | 11 of 19 agents never invoked by any command | major | already-fixed | All 11 wired — per-agent map below (each ≥1 command) |
| **F-PFM-MODEL** | `post-feedback-monitor` on Haiku doing numeric reasoning | minor | already-fixed | `agents/post-feedback-monitor.md:15` `model: opus`; lint Section 10 enforces model-consistency |
| **F-PERSONA-LAYER** | v3.1 per-artifact-persona resolution at the wrong layer | judgment | already-fixed | Resolution moved to orchestrator: `commands/newsletter.md` 4-tier fallback (edition-state → series file → plugin library → interactive); agent only documents the library |
| **F-TRIO-OVERLAP** | Measure review-trio overlap before defending the redundancy | major | already-fixed | `docs/remediation/overlap-measurement.md` measured catch-sets on the shared Del 4 edition → NO-TRIM (every gate ≥1 unique catch; the 4 overlaps justified, no subsumption) |
| **F-SKILL-ROUTER (a)** | Router skill still says "thought leadership plugin" | major | already-fixed | `skills/linkedin-studio/SKILL.md` — 0 occurrences of "thought leadership plugin"; named "LinkedIn Studio" |
| **F-SKILL-ROUTER (b)** | Router skill lists 14 agents | major | already-fixed | `skills/linkedin-studio/SKILL.md` "All Agents" table = **19** rows |
| **F-SKILL-ROUTER (c)** | Router skill omits `newsletter`/`headless-review`/`pivot`/`react` | major | already-fixed | `skills/linkedin-studio/SKILL.md` — all four present in the command table |
| **F-GENERALIZE** | Norwegian lock + private series-path default + undocumented env-var + non-shipping contract | major | already-fixed (M0 sub-claim correctly deferred) | Path parameterized `${LTL_SERIES_ROOT:-$HOME/linkedin-series}` (`commands/newsletter.md:46,148-149`, env-var documented); language configurable (`agents/language-reviewer.md`, default `en`); **no `/Users/ktg` or `maskinrommet/serier` in any shipping file**; contract has in-tree fallback (`references/longform-quality-rules.md`) |
| **F-COUNT-STRINGS** | Stale "25 commands"/count strings in onboarding/router/skill | minor | already-fixed | `commands/onboarding.md` says "29 commands"; remaining count strings are version-history prose; lint guards the current declarations |
## F-ORPHANS — per-agent wiring map (all 11 closed)
| Agent | Wired into (`subagent_type: linkedin-studio:<name>`) |
|-------|------------------------------------------------------|
| content-optimizer | `ab-test.md`, `post.md` |
| strategy-advisor | `strategy.md` |
| analytics-interpreter | `report.md`, `analyze.md` |
| engagement-coach | `firsthour.md` |
| content-planner | `pipeline.md`, `batch.md` |
| network-builder | `outreach.md` |
| trend-spotter | `pipeline.md`, `batch.md` |
| voice-trainer | `setup.md` |
| differentiation-checker | `post.md`, `quick.md`, `react.md`, `carousel.md`, `video.md` |
| post-feedback-monitor | `calendar.md`, `firsthour.md` |
| video-scripter | `video.md` |
## Non-findings (cosmetic only — no action; recorded so they aren't re-raised)
- **`agents/language-reviewer.md` description/intro prose** still says "Norwegian", but the
agent *body* resolves the language via the `language` parameter (default `en`), so
behavior is generalized. Legacy wording, not a defect.
- **"LinkedIn thought leadership" phrases** in `commands/linkedin.md`, `onboarding.md`,
`post.md`, `README.md` describe the content *domain*, not the plugin *name* — the rename
to "LinkedIn Studio" is complete. Not stale.
- **¹ "3-5 core topics" in `commands/analyze.md:58,239` and `commands/profile.md:67`** is a
*focus-discipline heuristic* — a diagnostic/health-check tolerance band ("are you staying
within a focused 3-5 range?"), NOT a declaration of the pillar count. The audit's
F-PILLAR-COUNT finding was specifically the **declarative** disagreement between `setup.md`
(define 5) and `onboarding.md` (3-5), which is resolved (both declare 5). The tolerance band
is consistent advice (define 5; don't sprawl past it) and was deliberately left as-is —
editing it would be out-of-scope scope creep on a finding the audit never raised. Recorded
so the precise boundary of the closed finding isn't mistaken for a tree-wide claim.
## Scope boundary recorded
**M0 (move all mutable personal data out of the plugin tree into a per-user data dir)** is
the only audit-adjacent item deliberately **out of S13–S17 scope** — it belongs to the
separate UI/companion track (UI-brief §9b/M0). S16 routed analytics I/O through the
`getAnalyticsRoot()` seam so M0 can relocate the root in one place later. F-GENERALIZE's
*parameterize-the-path / document-the-override* sub-claims are closed here; its
*relocate-all-data* sub-claim is correctly deferred, not dropped.
## Verdict
Every C13–C46 grouping has a recorded disposition; **none is still-real**. With the gate
green, S17 — and the baseline-audit remediation as a whole — is complete.

177
plugins/linkedin-studio/docs/remediation/review.md
View file

@ -1,13 +1,13 @@
--- ---
type: trekreview type: trekreview
review_version: "1.0" review_version: "1.0"
task: "S16 — saves manual-entry surface (lifts the original Non-Goal): optional saves in the analytics data model (types + parser + weekly/monthly + CLI), built location-agnostic for M0 (option c); + S16-pre: close the deferred onboarding Write MAJOR" task: "S17 — triage the ~34 uncalibrated audit findings (C13–C46): classify each still-real / already-fixed / outdated-drop, close every still-real one, record disposition in docs/remediation/c13-c46-triage.md. Last finish-plan session."
slug: remediation slug: remediation
project_dir: docs/remediation/ project_dir: docs/remediation/
brief_path: docs/remediation/brief.md brief_path: docs/remediation/brief.md
scope_sha_start: 8c52bdb scope_sha_start: 55c94ee
scope_sha_end: 8c52bdb scope_sha_end: 55c94ee
reviewed_files_count: 15 reviewed_files_count: 1
verdict: ALLOW verdict: ALLOW
mode: default mode: default
effort: standard effort: standard
@ -15,137 +15,132 @@ profile: premium
findings: [] findings: []
--- ---
# Review — linkedin-studio S16 (saves manual-entry + S16-pre onboarding Write) # Review — linkedin-studio S17 (C13–C46 triage)
## Executive Summary ## Executive Summary
**Verdict: ALLOW** for S16's delivered scope — 0 BLOCKER, 0 MAJOR, 0 MINOR, 0 SUGGESTION **Verdict: ALLOW** for S17's delivered scope — 0 BLOCKER, 0 MAJOR, 0 MINOR, 0 SUGGESTION
**open** against the diff. Two independent reviewers (brief-conformance, code-correctness) **open**. Two independent reviewers (brief-conformance, code-correctness) ran COLD, without
ran COLD, without cross-feeding, on the as-delivered uncommitted working tree (HEAD cross-feeding, on the as-delivered uncommitted working tree (HEAD `55c94ee` + the single new
`8c52bdb` + the S16 delta). file `docs/remediation/c13-c46-triage.md`).
- **brief-conformance-reviewer:** **0 findings.** Every Success Criterion traces to delivered S17 is a **triage session**: an independent Opus cold-reader classified every uncalibrated
code (SC1 saves in types + parser + import/report; SC2 saves in the actionable-signal output; audit finding (C13–C46) against the current code, and the result was **0 still-real, 23
SC3 dwell still explicitly unmeasurable, no fabricated field; SC4 backward-compat + no-crash; already-fixed, 1 outdated-drop** (across 24 grouped/sub-claim entries). Because nothing was
SC5 onboarding `Write`). Every Non-Goal honored: **M0 not built** (I/O still routes through the still-real, **S17 made no code change** — its sole deliverable is the disposition record. Every
unmodified `getAnalyticsRoot()` seam — option (c)), dwell not fabricated, surface counts "already-fixed" disposition was independently grep-verified in the main session before the doc
(29/19/6/9) and version (v4.1.0) unchanged, no not-mine file touched. was written (orphan wiring, lint, carousel deck, SKILL roster, model tier, video-Task,
- **code-correctness-reviewer:** **2 MAJOR — both in S16's own new code, both FIXED in-session** de-AI gate, series-path generalization).
(see Findings). Neither is pre-existing; both are lockstep misses in the saves parser delivered
this session, so per the operator rule ("in-session fix of the session's *own* misses =
completion") they were corrected here, not deferred.
The M0 conflict (UI-brief §9b) was reconciled **before** building, by operator decision = - **brief-conformance-reviewer:** **0 findings.** The S17 success criterion ("every
**option (c): build now, location-agnostic**. The conformance reviewer independently confirmed uncalibrated audit finding C13–C46 has a recorded disposition") is fully met — every
the build honors it (no new hardcoded `assets/analytics` path; `storage.ts` untouched). `[unverified-*]`-tagged finding and every uncalibrated §5/§6/§9 prose finding maps to a
disposition row; each is a valid single classification with cited current-code evidence; M0
is recorded as **deferred** (UI track), not done; the 3 not-mine untracked files are not
referenced; summary counts reconcile with the table rows.
- **code-correctness-reviewer:** **2 MAJOR — both in S17's own deliverable (the triage doc),
both FIXED in-session.** Neither is a false-green disposition: the reviewer independently
re-opened every spot-checked "already-fixed" row (incl. F-LINT, F-ORPHANS ×11,
F-SKILL-ROUTER a/b/c, F-CAROUSEL-CLIP, F-PFM-MODEL, F-DEAI, F-GENERALIZE, F-VIDEO-TASK) and
**every disposition held**. The 2 MAJORs were citation/overclaim defects in the doc's prose
(see Findings) — lockstep misses in the artifact written this session, so per the operator
rule ("in-session fix of the session's *own* misses = completion") they were corrected here.
## Coverage ## Coverage
Scope: HEAD `8c52bdb` (S15's commit) + the **uncommitted S16 working-tree delta** (annotated Scope: HEAD `55c94ee` (S16's commit) + the **uncommitted S17 working-tree delta** — one new
`[uncommitted]` — a brief-level contract; the brief's Assumptions allow uncommitted review). untracked file, `docs/remediation/c13-c46-triage.md` (annotated `[uncommitted]`; the brief's
The 3 untracked not-mine files (`docs/linkedin-studio-persona-brief.md`, `…-ui-brief.md`, Assumptions allow uncommitted review). The 3 untracked not-mine files
`docs/voyage-build/progress.json`) are explicitly excluded from scope and from the commit. (`docs/linkedin-studio-persona-brief.md`, `…-ui-brief.md`, `docs/voyage-build/progress.json`)
**No silent skips.** are explicitly excluded from scope and from the commit. **No silent skips.**
| Treatment | Count | Notes | | Treatment | Count | Notes |
|-----------|-------|-------| |-----------|-------|-------|
| `deep-review` | 0 | nothing under `hooks/**` / `auth/**` / `crypto/**` / `**/security/**` (analytics CLI + one command frontmatter) | | `deep-review` | 0 | nothing under `hooks/**` / `auth/**` / `crypto/**` / `**/security/**` |
| `summary-only` | 15 | analytics src (5) + analytics tests (3) + 2 fixtures + assets/analytics/README.md + README.md + CHANGELOG.md + commands/onboarding.md | | `summary-only` | 1 | `docs/remediation/c13-c46-triage.md` (documentation deliverable; "correctness" = factual accuracy of the disposition claims) |
| `skip` | 0 | no lockfiles / svg / generated / dist | | `skip` | 0 | no lockfiles / svg / generated / dist |
**Execution criteria (orchestrator-run):** **Execution criteria (orchestrator-run, at triage time):**
- `npx tsc --noEmit` (analytics) → **clean** (the new `RankableMetric` type closes the
`metrics[keyof]` widening the optional `saves` would otherwise introduce in `alerts.ts` + `cli.ts`).
- `node --import tsx --test tests/*.test.ts` (analytics) → **116/116**.
- `bash scripts/test-runner.sh` → **74 passed / 0 failed / 0 warnings**, exit 0. - `bash scripts/test-runner.sh` → **74 passed / 0 failed / 0 warnings**, exit 0.
- `node --test hooks/scripts/__tests__/*.test.mjs` → **98/98** (no hook logic changed). - `node --test hooks/scripts/__tests__/*.test.mjs` → **98/98** (no hook logic changed).
- `ls commands/*.md` → **29** (no surface-count change; no version bump — within-v4.1.0 refinement, S11–S13 precedent). - `node --import tsx --test tests/*.test.ts` (analytics) → **116/116** (no analytics code changed).
- **E2E:** import + weekly + monthly with a saves fixture surfaces saves without crashing; - tsc unchanged from S16's clean state (S17 touches no `.ts`).
saves-free fixtures round-trip byte-identical; explicit `"0"` → `0`, blank/`"n/a"` → undefined. - Disposition spot-checks: all ~15 sampled "already-fixed" rows independently confirmed against
current code; **no false-green** found.
## Findings ## Findings
**0 open findings.** Code-correctness raised 2 MAJOR; both are **S16's own** new code (not **0 open findings.** Code-correctness raised 2 MAJOR; both are **S17's own** deliverable (the
pre-existing — the saves parser is new this session), so both were **fixed in-session** as triage doc written this session), so both were **fixed in-session** as completion of the
completion of the delivered work, then re-verified green. Recorded below — not dropped, not delivered work, then re-verified. Recorded below — not dropped, not silenced.
silenced.
### [MAJOR — FIXED in-session] Non-numeric Saves cell silently coerced to 0 (`unknown != 0` contract violated) ### [MAJOR — FIXED in-session] F-PILLAR-COUNT prose overclaimed a tree-wide property
*Raised by code-correctness (`PLAN_EXECUTE_DRIFT`), `scripts/analytics/src/parsers/csv-parser.ts`.* *Raised by code-correctness (`PLAN_EXECUTE_DRIFT`), `docs/remediation/c13-c46-triage.md`.*
The original guard `if (savesRaw && savesRaw.trim() !== "")` then `metrics.saves = The F-PILLAR-COUNT row asserted "*no 3-5 pillar range remains*". The cited locations
parseMetric(savesRaw)` gated only on emptiness; `parseMetric` ends in `parseFloat(...) || 0` (`setup.md:312`, `onboarding.md:155`) are accurate and the audit's actual finding — the
+ `Math.max(0, …)`, so a non-empty non-numeric cell (`"n/a"`, `"~40"`) or a negative value **declarative** disagreement between `setup.md` (define 5) and `onboarding.md` (3-5) — is
flattened to **0** — surfaced as a confident "top engagement signal". This contradicts the genuinely resolved (both declare 5). But the universal clause was false: `analyze.md:58,239`
`unknown != 0` contract stated in the same diff (`types.ts` saves NOTE + the parser comment). and `profile.md:67` still carry "3-5 core topics". In a verification artifact whose value is
citation precision, asserting an unverified tree-wide property is an overclaim.
**Fix (this session):** added a dedicated `parseOptionalCount()` helper returning **Fix (this session):** narrowed the disposition to the named files (the closed finding) and
`number | undefined` — blank / non-numeric / negative → `undefined`; a genuine number added **note¹** recording that the surviving "3-5 core topics" strings are a *focus-discipline
(including explicit `"0"`) → that number; reuses the EU/US separator normalization. The saves heuristic* (a health-check tolerance band), semantically distinct from the pillar-count
parse now routes through it. The blank-cell path is unchanged; the garbage/negative path now declaration, deliberately left as-is (editing them would be out-of-scope on a finding the audit
honors the contract. never raised). The disposition stays `already-fixed` and is now precise.
### [MAJOR — FIXED in-session] No test for the explicit-`0` vs non-numeric Saves boundary ### [MAJOR — FIXED in-session] F-VIDEO-TASK cited the wrong line for the `Task` tool
*Raised by code-correctness (`MISSING_TEST`), `scripts/analytics/tests/csv-parser.test.ts`.* *Raised by code-correctness (`PLAN_EXECUTE_DRIFT`), `docs/remediation/c13-c46-triage.md`.*
The original saves tests covered `42`, blank→undefined, no-column→undefined, and The row cited `commands/video.md:8` for the `Task` allowed-tools entry; `:8` is the
engagement-exclusion — but not the exact boundary where the parser's behavior diverged from `allowed-tools:` block header — the `Task` list item is at `:15`. The disposition is
its intent: a literal `"0"` (genuine zero) vs a non-numeric cell (unknown). substantively correct (`Task` is present; the `video-scripter` invocation at `:81` was cited
exactly), but the pointer landed on the block header.
**Fix (this session):** added `tests/fixtures/saves-edge-export.csv` (a `"0"` row + an `"n/a"` **Fix (this session):** corrected to `commands/video.md:15` (the `Task` list item, in the
row) and two cases pinning `saves === 0` for `"0"` and `saves === undefined` for non-numeric. `:8-16` block). Confirmed by direct read: line 15 is exactly ` - Task`.
The non-numeric case was **red** before the parser fix above and **green** after (TDD), so the
contract boundary is now regression-guarded.
### [MAJOR — CLOSED] (carried from S15) onboarding Phase 2 file-saves need `Write`
*S15's deferred finding.* `commands/onboarding.md` Phase 2 saves voice/user-profile files but
the frontmatter omitted `Write`. **Closed in S16-pre:** `Write` added to `allowed-tools`
(matching `first-post.md:9-14`).
## Remediation Summary ## Remediation Summary
**Gate: ALLOW** for S16's delivered scope. brief-conformance is clean; code-correctness's two **Gate: ALLOW** for S17's delivered scope. brief-conformance is clean; code-correctness's two
MAJORs were S16's own lockstep misses (not pre-existing design findings), so both were fixed MAJORs were S17's own lockstep misses in the triage doc (citation precision / prose overclaim,
in-session and re-verified (tsc clean, analytics 116/116, lint 74/0/0, hooks 98/98) — this is a **not** false-green dispositions — every spot-checked "already-fixed" row held), so both were
genuine ALLOW with **no open finding**, not a WARN-override. The M0 conflict was reconciled fixed in-session and re-verified — a genuine ALLOW with **no open finding**, not a
before building (option c, location-agnostic); the conformance reviewer confirmed M0 was not WARN-override.
built and the data-dir seam (`getAnalyticsRoot()`) is untouched, so the planned migration
relocates the root in one place. The S15-deferred onboarding `Write` MAJOR is closed.
Per Handover 6, this `review.md` is consumable by `/trekplan --brief …`. ALLOW → S16 commits + S17 closes the baseline-audit remediation: every uncalibrated finding C13–C46 now has a
pushes (own files only); the finish-plan continues at **S17** (C13–C46 triage). recorded disposition (0 still-real), the calibrated C1–C12 set was remediated across v4.0.0 +
S13–S16, and the gate (lint 74/0/0, hooks 98/98, analytics 116/116) is green. M0 (per-user
data-dir migration) is the sole audit-adjacent item deliberately deferred to the separate UI
track; S16 left the `getAnalyticsRoot()` seam so it relocates in one place.
Per Handover 6, this `review.md` is consumable by `/trekplan --brief …`. ALLOW → S17 commits +
pushes (own files only) → **remediation COMPLETE**.
```json ```json
{ {
"verdict": "ALLOW", "verdict": "ALLOW",
"verdict_scope": "S16 delivered changes (saves manual-entry + S16-pre onboarding Write); 15 files", "verdict_scope": "S17 delivered changes (C13–C46 triage disposition record); 1 file",
"scope": { "sha_start": "8c52bdb", "sha_end": "8c52bdb", "reviewed_files_count": 15, "uncommitted_delta": true }, "scope": { "sha_start": "55c94ee", "sha_end": "55c94ee", "reviewed_files_count": 1, "uncommitted_delta": true },
"counts": { "BLOCKER": 0, "MAJOR": 0, "MINOR": 0, "SUGGESTION": 0 }, "counts": { "BLOCKER": 0, "MAJOR": 0, "MINOR": 0, "SUGGESTION": 0 },
"findings": [], "findings": [],
"fixed_in_session": [ "fixed_in_session": [
{ {
"severity": "MAJOR", "severity": "MAJOR",
"title": "Non-numeric Saves cell silently coerced to 0 (unknown != 0 contract)", "title": "F-PILLAR-COUNT prose overclaimed 'no 3-5 pillar range remains'",
"file": "scripts/analytics/src/parsers/csv-parser.ts", "file": "docs/remediation/c13-c46-triage.md",
"rule_key": "PLAN_EXECUTE_DRIFT", "rule_key": "PLAN_EXECUTE_DRIFT",
"resolution": "added parseOptionalCount() returning number|undefined (blank/non-numeric/negative -> undefined; genuine 0 kept); saves parse routes through it" "resolution": "narrowed the disposition to the named files (setup.md/onboarding.md, the closed finding) + added note¹ recording analyze.md:58,239 / profile.md:67 as a distinct focus-discipline heuristic, not the pillar-count declaration"
}, },
{ {
"severity": "MAJOR", "severity": "MAJOR",
"title": "No test for explicit-0 vs non-numeric Saves boundary", "title": "F-VIDEO-TASK cited video.md:8 for the Task entry, which is at :15",
"file": "scripts/analytics/tests/csv-parser.test.ts", "file": "docs/remediation/c13-c46-triage.md",
"rule_key": "MISSING_TEST",
"resolution": "added saves-edge-export.csv fixture + 2 cases (0 -> 0, n/a -> undefined); TDD red-before/green-after the parser fix"
},
{
"severity": "MAJOR",
"title": "onboarding Phase 2 file-saves need Write (carried from S15)",
"file": "commands/onboarding.md",
"rule_key": "PLAN_EXECUTE_DRIFT", "rule_key": "PLAN_EXECUTE_DRIFT",
"resolution": "S16-pre: added Write to allowed-tools, matching first-post.md" "resolution": "corrected citation to commands/video.md:15 (the Task list item in the :8-16 block); verified line 15 is exactly ' - Task'"
} }
], ],
"deferred_findings": [], "deferred_findings": [],