the-lifeboat-verdict-says-what-it-is-disembark-oracle-become

Frontmatter

.abcd/development/specs/closed/spc-30-the-lifeboat-verdict-says-what-it-is.md
open on GitHub ↗ · commit history ↗

References1

• itd-125The Lifeboat Verdict Says What It Isimplements

mentions9

• adr-25The LLM is host-delegated by default; oracles are opt-in adapters
• adr-40Review, audit, lint, and gate are four buckets, separated by what each compares
• dcn-26081600000000032026-08-16 — the assessment vocabulary settled at a maintainer grill and filed as adr-40 (proposed): **four buckets — lint / review / audit / gate — separated by what each compares**, not by determinism, not by trigger. The rule was already half-recorded (05-internals/01-agents.md rules the two verdict families disjoint: "reviews assess a change, criterion verdicts assess a promise vs reality") and three shipped surfaces contradict it — `intent review` emits family 2 so it is an audit, `abcd audit` is deterministic rule-checking so it is a lint (and it consumed the `/abcd:audit` name 02-constraints/04-naming.md reserves for itd-16), and `disembark oracle` emits family 1 while the brief calls its output an audit. Grill rulings: **one surface performs exactly one act** (multi-act surfaces split at design time — cheap, because every multi-act surface abcd has is unbuilt, so they are specified rather than refactored); the buckets are a **closed list extended by PR, not a criterion** (an autonomous run given a criterion interprets it; a table lookup matches or fails); `intent ready` survives as the fourth bucket **gate** because it names a decision rather than a comparison, preserving itd-94's exit-code contract; determinism is orthogonal (itd-16's hash-chain check is a deterministic *audit*; itd-85's conformance check is a *lint* however built); automatic-vs-manual never enters a verb name (the trigger is the facilitator's, per itd-97); the oracle is the model-access seam beneath review and audit, never a bucket. **Clean break, no aliases** — pre-1.0.0, `--impact breaking` drives version derivation (iss-171 precedent), users re-download; an alias would additionally collide with the documentation discipline's ban on change-narration, leaving an undocumented silent forward. The role mapping is the operational reason the split earns its cost: product thinker reads `audit` and essentially nothing else, which makes itd-99's "never hand a product thinker a technical decision" mechanically checkable. Same grill corrected a wrong finding: iss-246 was filed claiming abcd's record documents a surface far larger than the binary with no gate catching it; **false** — the `Status` column in 04-surfaces/README.md is machine-checked by `surface_coverage` (iss-35), the brief carries ~100 inline `design target` markers, and adr-5 makes the brief aspirational by design. The real defect is narrower: `surface_coverage` is blind *inside* a row, so six of twenty rows read `shipped` then qualify themselves in prose, and documents outside the registry cite those sub-verbs as live (all three citing **predecessor-store** spec ids spc-29/spc-30, whose prose survived the migration to the native store). Fix per adr-40 §6: sub-verb tables carrying two facts per verb — bucket and existence — with `surface_coverage` extended to registered cobra sub-commands, one table serving both disciplines. Also established: the twelve-step record walk completes at ten steps; step 2 (`capture promote`) has no verb and step 12 (`capture resolve`) cannot write `resolved_by`, so **walkability is sequenced before coherence** — renaming ~90 files across a process nobody can walk is polish before function. Plan at plans/2026-08-16-process-coherence-and-walkability.md; six intents to plan, none plannable unattended. Rejected: one polymorphic `review <id>` verb (merges the disjoint families, erases the role signal), classifying acts rather than surfaces (makes the bucket a statement of intent rather than a guarantee, and hands product thinkers lint findings), three buckets without `gate` (forces `intent ready` to become `intent lint`), and adding `verify`/`validate` (itd-109's verification suite is a packaging of lints and audits, not a fifth kind).
• dcn-26081600000000052026-08-16 — adr-40 §5 REVERSED at the process-planning interview (amendment recorded in-place in adr-40): `disembark oracle` renames to `disembark review` (itd-125, breaking) instead of keeping the verb and fixing prose. The investigation finding that turned it: the binary verb never invokes the oracle seam — it is a compute-or-ingest verdict endpoint (deterministic manifest+coverage mapping, or validate-and-ingest of a host-produced verdict), so the seam name claims transport the verb does not touch and collides with the `/abcd:oracle ask` design target, the seam's real surface. The sweep carries the artefact (`audit/oracle-<manifest12>.*` → `review/review-<manifest12>.*`, clean-replacement across the rename so one manifest never holds two verdicts) and the agent (`lifeboat-oracle` → `lifeboat-reviewer`). Naming convention ruled in the same session: assessment agents are target-grain + role (`intent-auditor`, `lifeboat-reviewer`). adr-25 and the seam name `oracle` stand unchanged. Rejected: prose-only fix (leaves the artefact contradicting the vocabulary), renaming the seam itself (adr-25 is correct), a superseding mini-ADR (same-day clause amendment suffices).
• iss-246`surface_coverage` is blind inside a row, so `shipped` means "the top-level verb exists" and every unbuilt sub-verb hides behind it.
• iss-250Brief-surface drift found by the v0.5.0 release gate: the full-tier crosscheck (22 checkers, both directions) returned 28 unique discrepancies between the brief's surface prose and the shipped binary — 14 false-claim, 8 undocumented-surface, 2 criterion-violation, 2 stale-count, 2 fictional-layout. Dominant clusters: the vintage/staleness surfaces (bare 'abcd version' three-line render, version --json four fields, version --check, --allow-stale-binary, uninstall --bin-dir) landed without their brief rows; the citation-baseline dry-run gate and render line are undocumented in 04-launch.md; 01-ahoy.md's envelope shape omits the banlist key and guard.detail; 05-intent.md:335 claims gap_audit is deferred (shipped) and an MG004 check ships (does not exist); 07-memory.md's spec-count claim is stale (spc-2..spc-27 exist); the agents/ plugin surface has no registry row and surface_coverage does not check it; skills/-era phrasing survives in 02-constraints/04-naming.md, 06-delivery/01-build-sequence.md and 02-verification-matrix.md. Full list with file:line, claim, reality and class: the iss35-brief-surface-crosscheck receipt for content commit d1afd2c under .abcd/work/reviews/. Not release-blocking (design-record drift, no user-facing doc affected) — same class and disposition as iss-192 at v0.4.2.
• iss-266cobra parents with no RunE are not Runnable, so cobra prints help and exits 0 WITHOUT validating args: an unknown sub-verb reads as success to a script. Confirmed on 'abcd docs nonsense' and 'abcd guard nonsense' (both exit 0); 'abcd memory nonsense' and 'abcd history nonsense' exit 1 because those parents have a RunE. spc-30 fixed the disembark parent (a retired sub-verb spelling must refuse, not silently succeed) by giving it a RunE that prints help, so cobra.NoArgs then refuses a stray token at exit 2. The same one-line fix is owed to every other RunE-less parent — sweep them so no unknown sub-verb anywhere exits 0.
• iss-2610262033205781itd-48 calls the lifeboat review agent `lifeboat-oracle`; 02-disembark calls it `lifeboat-reviewer`
• spc-27the-registry-cannot-wave-its-hands-every-surface-file-carrie