Development record
the adversarial-review floor assumes below-the-line artefacts are covered by their gates, and today they were not
the adversarial-review floor assumes below-the-line artefacts are covered by their gates, and today they were not
adversarial-review-scales-with-blast-radius draws a floor, and gives a reason for it:
Artefacts below that line — ledger captures, comments, routine pull requests — are never blocked on adversarial review: they are covered by the gates they already have, and capture in particular must stay frictionless.
Two clauses, and they are doing different work. "Capture must stay frictionless" is a cost argument and it is sound. "They are covered by the gates they already have" is an empirical claim, and it is false.
The counter-evidence
Four errors on 2026-08-22/23, every one in a below-the-line artefact, every one
passing record-lint, docs-lint and lint-reviews:
- A capture filed as a standalone process observation when it refines iss-213, which is what gives it its weight. Routing, not form.
- A proposed new principle that
one-canonical-primitiveforbids, becauseenforcement-claims-are-factsalready owned the ground. - Two ADR links in an issue body resolving to nothing, because
links_resolvedoes not run over.abcd/work/(iss-2608230752354927). - Record repairs and a capture written into a shared checkout another session was about to branch from (iss-2608230847432285).
The first two are the interesting pair. Both are errors of routing and relation — which record this belongs to, which existing record already owns it — and no deterministic gate can see them, because both artefacts were perfectly well-formed. A linter checks whether a record is shaped correctly. It cannot check whether it is the right record.
What follows, and what does not
The floor should stay where it is. Its own argument for the placement is correct and this changes none of it: mandatory review on captures would suppress the ledger, recording a finding must cost less than fixing it, and reviewers trained on mandatory verdicts over trivia skim the one that matters.
What should change is the stated reason. Below-the-line artefacts are unblocked because the friction would cost more than the errors do — not because their gates cover them. Keeping the false clause is itself an instance of the class recorded in iss-2608230847432286: a reader who believes the gates cover these artefacts stops compensating, which is the precise harm that record describes.
The bound, offered weakly
A peer session already present and already communicating is a reviewer at near-zero friction, so the cost argument the floor rests on does not apply to it. That suggests a standing convention: announce what you are working on to concurrent peers and engage with what they announce.
This is offered as a proposal, not a finding, and the evidence for it is thin. iss-2608230847432286 records why: four concurrent sessions of one model in one repository is not the independence evaluator-outside-the-loop asks for, a shared blind spot would have been invisible to all four, two of the catches were a peer naming a record the author had not read (recall, not review), and at least one was luck. Peers also produced errors — a record-merge proposal that did not survive scrutiny, a threshold that collapsed on a wider sweep, a misidentified record owner.
A second reading is available and the record should not suppress it. Today's coordination ran entirely on a convention with no mechanism behind it: four sessions wrote in one repository, nobody lost work, and what held was "a diff you did not make is a peer's work" — a sentence in AGENTS.md that nothing enforces. That supports either conclusion. The convention is sufficient and needs no machinery, or the convention got lucky four times and the sample is too small to tell which. The isolation property the same document claims did fail on the day (iss-2608230847432285), and the convention is what absorbed it, so at minimum the two are not independently reliable.
Routing, per itd-84: the capability half is already owned by itd-33 (coordination contract) and iss-2608220750029993 (presence detection), so a second intent beside itd-33 would be the third copy. The stance half is a principle bound plus a line in AGENTS.md § Concurrent sessions, whose five existing concurrent-session records are all hazard-framed and none of which treats a peer as a resource. Verdict SPLIT, HOLD on the intent.
Promotion trigger, per recurrence-is-signal: if this recurs among sessions that are not coincidentally co-present, the convention has earned more than a caveat.
Grounds
- pursued: a principle whose stated reason matches its evidence keeps readers compensating for the gates' routing blind spot; shown wrong if a later reading of the principle again infers that record-lint or docs-lint vouch for a capture's routing
Frontmatter
| id | iss-2608230847432287 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608230847432287-the-adversarial-review-floor-assumes.md
open on GitHub ↗ · commit history ↗
mentions8
- adversarial-review-scales-with-blast-radiusAdversarial review scales with blast radius
- iss-213Several agents sharing ONE git worktree silently invalidated a verification result and came close to losing committed work. Observed repeatedly during the 2026-08-11 install-test round, in a repo that is about to run more agents, not fewer.
- iss-2608220750029993Session-presence detection for shared checkouts: each live session leases a marker (session id, intended branch, started-at) in the checkout, and the pre-commit gate warns when another live session's lease is present — the armed-detector rung of the AGENTS.md concurrent-session conventions, which are vigilance-only until this ships. Lease home needs thought: the local tier is per-worktree by design, and the hazard is precisely two sessions in ONE worktree, so the lease belongs to the checkout, not the branch.
- iss-2608230752354927relative links under .abcd/work/ are checked by no lint root
- iss-2608230847432285Per-agent worktrees do not isolate a session whose shell cwd reverts to the shared checkout, so the mitigation iss-213 recommended has a hole. This refines iss-213, which recorded several agents sharing one git worktree silently invalidating a verification result, and whose recommended direction was to give each agent its own worktree so the whole class disappears. That direction is now in force via the AGENTS.md Concurrent sessions section, and on 2026-08-23 three concurrent sessions demonstrated it does not hold. A session's shell cwd can be silently reset from its worktree back to the primary working directory, and the notice arrives on the tool result AFTER the command that caused it, so the contamination lands on the NEXT command. It fails toward the shared tree, which is the wrong direction: two sessions wrote into the main checkout while believing they were in their own worktree. One appended to two Go test files, the other filed a capture and edited three record files, and both discovered it only when a third session read git status in the main checkout and asked who owned the diffs. Nobody lost work, because the convention that a diff you did not make is a peer's work held and the owners were asked rather than the files committed. The isolation property did not hold; the coordination convention compensated for it. Two details generalise beyond this instance. First, the failure is silent in BOTH directions: nothing warns the writer, and nothing would have warned a committer using git add -A, because the misplaced files are indistinguishable from that session's own in git status. What stood between this and a bad commit was one session committing with explicit paths and another happening to run git status for an unrelated reason. Detection was not mechanical in any of the three cases. Second, this is the write-side twin of iss-213 rather than a restatement of it: iss-213's dangerous member was a verification result that described no tree in particular, on the read side, while this is work landing in a tree whose HEAD another session is preparing to move. Same root cause, that the checkout is the unit of isolation and nothing enforces which checkout a session is in, on opposite sides of the read/write boundary. The mechanical mitigation is to address the tree explicitly on every git invocation, git -C <abs-path>, and to use absolute paths for file writes, rather than relying on a persisted cd: a cd is a session-global mutation with no scope and no expiry, which is the wrong shape for the mechanism that is supposed to provide isolation. AGENTS.md states that the checkout is the unit of isolation without saying what makes a session stay in its checkout, and that gap is what let three sessions make the same mistake in one day. Decide the routing: an AGENTS.md line under Concurrent sessions is the cheapest rung and matches how the sequential-id caveat was handled, while the durable form is whatever makes a session's tree unambiguous rather than remembered.
- iss-2608230847432286a gate that validates a proxy for a claim switches off the vigilance an absent gate would have preserved
- itd-33Multiple Agents Coordinate On Intent And Spec Work Without Duplicating Effort Or Producing Competing Artefacts
- itd-84An Intent Is Decomposed Before It Is Filed, And A Reversal Is Only Ever Flagged