Skip to content

findings: F41-F43 Cobrust corroboration (source-surface-leak + device-name-redact + SPOF-build)#2

Draft
Hakureirm wants to merge 16 commits into
mainfrom
adsd-cobrust-f41-f43
Draft

findings: F41-F43 Cobrust corroboration (source-surface-leak + device-name-redact + SPOF-build)#2
Hakureirm wants to merge 16 commits into
mainfrom
adsd-cobrust-f41-f43

Conversation

@Hakureirm
Copy link
Copy Markdown
Member

Summary

3 new failure-mode findings (F41-F43) empirically corroborated by Cobrust Phase G/J
sprints (2026-05-19/20). Follow-up to PR #1 (cobrust-f31-f39, F31-F40 batch, open).

  • F41 — Source-surface leakage of codegen-internal primitive (Cobrust local F38)
  • F42 — Device-identifying names leaked into public artifacts via sub-agent memory read-through (Cobrust local F39)
  • F43 — Single-point-of-failure heavy-build host (Cobrust local F40)

Empirical anchors

Finding Cobrust local Incident date Ratified SHA Resolution
F41 F38 2026-05-19/20 46c0946 ADR-0064 print-monomorphization + CI lint
F42 F39 2026-05-19 d012df9 git filter-repo Option-A force-rewrite + opsec-lint CI gate
F43 F40 2026-05-19/20 9cb84b5 DG abandonment — GH Actions CI as sole heavy-gate verifier

All three SHAs are reachable on Cobrust-lang/Cobrust main branch.

Pattern families

  • F41 extends the LLM-first design principle (CLAUDE.md §2.5) as a new sub-form:
    "type-suffix source-face names violate training-data-overlap rule." New family: design-surface contamination.
  • F42 extends F1-Sediment as a new sub-form: "opsec-boundary: agent memory read-through
    propagates private literals to publishable artifacts without enforcement gate."
  • F43 introduces infrastructure-resilience (SPOF sub-form): SSH-gated single host
    as sole verification path; adjacent to F29 (runner-pool) but at the sprint-verification layer.

Slot rationale

PR #1 claims upstream F31-F40 for different patterns (Cobrust local F27-F34 + stream-watchdog).
Upstream catalogue currently ends at F30 (on main). F41-F43 are the next free slots.

Files

plugins/adsd/skills/agent-driven-development/reference/cobrust-f41-f43/
  README.md                                           (batch index, ~60 lines)
  F41-source-surface-leakage-codegen-primitive.md    (~155 lines)
  F42-device-name-leakage-public-artifacts.md         (~150 lines)
  F43-spof-heavy-build-host.md                       (~145 lines)

Checklist

  • 3 finding files match upstream catalogue shape (frontmatter + Pattern + Root cause + Empirical + Detection rule + Resolution path + Related findings)
  • All Cobrust SHAs verified reachable on main
  • No impl/test/ADR changes — outreach finding files only
  • F43 SHA corrected to 9cb84b5 (DG abandonment doc commit, distinct from d012df9 F42 CI-rename)
  • No opsec-sensitive strings embedded (device names use neutral placeholders per F42 going-forward rule)

Drafted as DRAFT — user action required to gh pr create or promote to ready-for-review.

Hakureirm and others added 16 commits May 11, 2026 20:42
…kflow) + F21 (identity overload)

Three new failure modes promoted from CANDIDATE to confirmed entries:

F19 — Public-facing onboarding text written but never independently install-tested.
  Founding evidence: Cobrust v0.1.0 (M10 hallucinated SHAs, 13/14 CI red),
  v0.1.1 (cargo install + curl URL 404), v0.1.2 (release-readiness audit
  catching -fsSL flag friction, back-ported to v0.1.1 — first validated
  closure cycle BLOCK → fix → GO).

F20 — Constitution mandate written but workflow never aligned.
  Founding evidence: CLAUDE.md §6 test-first declared, fact-violated for 9
  days (P7 wrote impl+test same commit). Owner-spotted 2026-05-11. Resolution:
  D0-D5 difficulty matrix + dev/test pair workflow codified same-day into
  cto_operations_runbook.md + ADSD dispatch-prompt-p9.md template + memory.
  Validation: W2 sprint executed with TDD step 1 / dev step ordering in
  commit log (commits ca4c37c → 2eb4fca + d337cf0 → 0145e8b).

F21 — Cross-session AI agent identity overload.
  Founding evidence: Cobrust 2026-05-11 — claude-desktop drafted Cobrust
  Studio handoff signing "— review-claude" while a separate Claude Code
  session (4bb35f43) was concurrently active under the same handle. Audit
  trail collapsed across sessions. Recovery: session-ID attribution
  convention adopted (e.g. "review-claude (session 4bb35f43, 2026-05-11)").

All three are F1 Sediment Family sub-forms — declared-without-enforcement
applied to install-tests / constitution-mandates / agent-handles.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…nAI guidance

Distills 5 of 12 v1.2.0 gap candidates identified by review-claude
self-audit. Adopts established industry practices into ADSD discipline:

1. reference/evals-first-development.md — Anthropic "evals are the moat"
   applied to ADSD. 6th gate (eval delta non-regression) closes F20
   systemically. Highest-leverage v1.2.0 addition.

2. reference/context-window-strategy.md — Positive practices for long
   agent sessions, complementing F16 negative form. Three-tier model
   (persistent/session-scoped/transient) + bootstrap-from-cold template.

3. reference/cross-session-memory-architecture.md — Four-layer storage
   model + decision tree for "where does this go?". Codifies ADSD's
   memory file discipline that was previously implicit.

4. reference/prompt-engineering-patterns.md — 9 patterns (P1-P5 core,
   PT1-PT9 specific) from Anthropic + OpenAI prompt guides, adapted to
   ADSD sub-agent dispatch. Cross-references F13/F17/F19/F21.

5. reference/cost-monitoring-discipline.md — Three-tier budget model
   (per-sprint/per-release/per-project) + cost as diagnostic signal +
   Anthropic caching + OpenAI structured outputs as cost levers.

SKILL.md cross-references section updated to include all 5 with
explicit Anthropic+OpenAI provenance + remaining-7-gaps notice for
v1.3.0 planning.

Remaining v1.3.0 candidates: skills architecture, agent specialization
roles, HITL decision tree, RCA/post-mortem template, MCP integration
patterns, calibrated confidence, structured-output schema enforcement.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
….2.0 menu)

Adds explicit menu pointing at the 5 new reference files
(evals-first-development, context-window-strategy,
cross-session-memory-architecture, prompt-engineering-patterns,
cost-monitoring-discipline) with Anthropic+OpenAI provenance noted
and remaining-7-gaps-for-v1.3.0 forward-pointer.

This was the SKILL.md menu update intended in a8d6a0f; landed
separately because Edit-after-Bash-tail-read precondition required
explicit Read pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ADSD §3 documentation mandate: every public item gets zh+en+agent
docs. ADSD repo previously fact-violated its own §3 mandate by
shipping SKILL.md (agent-facing) without docs/human/{zh,en}/
user-facing docs. This commit closes that F20 dogfood instance.

New artifacts:

1. docs/human/{zh,en}/getting-started.md — 30-min onboarding, parallel
   zh+en, 5-step practice section from CLAUDE.md scaffold through
   first sub-agent dispatch with D-matrix.

2. docs/human/{zh,en}/concept-map.md — 6 mermaid diagrams covering
   top-level flow / 3-layer abstraction / F1 Sediment Family /
   4-layer storage / dev-test pair sequence / release closure with
   release-readiness. Parallel zh+en.

3. docs/agent/conventions.md — meta-conventions for THIS repo:
   binding repo structure, frontmatter contracts, bilingual mandate
   enforcement scope, commit message format, F21 identity hygiene.

4. scripts/doc-coverage.sh — machine-enforces ADSD §3 mandate:
   - Inv 1: zh ⟺ en parity (parallel filenames)
   - Inv 2: reference/*.md have YAML frontmatter
   - Inv 3: ADR files zero-padded monotonic

Bug caught by Inv 2 on first run: failure-modes-catalogue.md was
using markdown heading frontmatter (`# Title`) instead of YAML
(`---`). Fixed in same commit — F20 systemic prevention worked
immediately (one of those rare moments where the gate catches its
target on commit 1, validating the enforcement layer).

README.md updated with §Documentation section pointing at new docs
+ §"F1–F18" reference updated to "F1–F21" matching current catalogue.

Co-Authored-By: Claude Opus 4.7 (session 4bb35f43) <noreply@anthropic.com>
…d) + F23-A (oracle-without-verify confirmed) + F23-B (distribution drift candidate)

Three new F-pattern entries codified from Cobrust LC-100 Tier A
stress sweep empirical evidence (2026-05-12):

F22 — Coverage drive without bug-fix cadence (F1 family, suppression
  sub-form). ADR-0047 LeetCode coverage strategy was authored as the
  explicit F22 mitigation. Empirical validation: P9 + review-claude
  recommended Option H (fix-pack first) at 77/100 rather than ramping
  to Tier B 500-题 with the same defect distribution. Option H closed
  at 99/100 stable; ADR-0047 SKIP-at-90% triggered. F22 NOT fired
  because the mitigation existed and was followed — reverse-evidence
  case.

F23-A — Oracle authorship without independent verification (F1 family,
  oracle-verify sub-form, confirmed). LC-100 Tier A surfaced 23
  initial failures; 15/23 = 65% were test corpus oracle defects (not
  language gaps): coin-change DP mistraces, BFS level off-by-one,
  Roman-to-int arithmetic errors, climbing-stairs base-case off-by-one.
  All derivable by running reference Python implementations. Codified
  mitigation: ADR-0047a verify.py mandate (every Tier B program ships
  verify.py reference impl that runs against test.toml before DEV phase).

F23-B — Synthetic stress test distribution drift from real-world
  (F1 family, distribution-coverage sub-form, candidate UNMEASURED).
  Predicted but awaits empirical measurement post-T1.1 real-LLM E2E
  on msgpack/dateutil/requests/click. Hypothesis: pattern overlap
  between LC-100 synthetic distribution and real Python lib
  translation will be < 60%. Promotion to confirmed when overlap
  measurement lands.

Catalogue now F1-F23 (23 entries; F1 Sediment Family has 9+ sub-forms).

Co-Authored-By: Claude Opus 4.7 (session 4bb35f43) <noreply@anthropic.com>
…amily coverage-fidelity sub-form)

Discovered 2026-05-12 by user audit-by-skepticism of Cobrust LC-100
Tier A 99/100 pass rate. user observation: linked-list / tree / set
problems all use list[i64] flat-array simulation; Cobrust has no
source-level recursive struct support nor exposed stdlib generics
for LinkedList/TreeNode/Set.

F24 codifies the systemic anti-pattern: a stress-test corpus's pass
rate measures algorithmic correctness on whatever data structure the
implementation chose, not whether the implementation actually
exercised the feature category claimed by the corpus design.

Founding evidence:
- examples/leetcode-stress/045-linked-list-palindrome/solution.cb —
  "store all values in an array, then two-pointer compare"
- examples/leetcode-stress/047-merge-k-sorted-lists/solution.cb —
  "store all lists in a flat array, then selection-sort via K pointers"
- examples/leetcode-stress/050-rotate-linked-list/solution.cb —
  "values in array, rotate by index"

Mitigation: type-asserting pass condition + feature-category audit at
P9 Phase 3 triage + counterfactual sample (1-2 programs deliberately
using the claimed type per category to confirm it actually compiles).

Recovery: explicit tech debt with pre-tag blocker codified in a
follow-up ADR — pattern parallel to ADR-0045 user-traction milestone
gate but at the per-category coverage surface.

Catalogue now F1-F24 (24 entries; F1 Sediment Family has 10+ sub-forms).
Composes with F19 (install-not-tested) — both are gaps between
artifact claim and verified reality.

Co-Authored-By: Claude Opus 4.7 (session 4bb35f43) <noreply@anthropic.com>
…ock (F8 closure)

User audit-by-skepticism 2026-05-12 caught the F8 instance: ADSD repo
described Cobrust as "9-week multi-agent Rust compiler project" across
6 public surfaces + 1 GitHub About. Empirical verification:

  git log first commit: 2026-04-30 16:23:41 (M0 bootstrap)
  git log HEAD:         2026-05-12 11:19:10 (ADR-0048 supplement)
  Wall-clock:           11 days = 1.6 weeks (rounded to "12 days")
  Commit count:         278 (was claimed as ~178 in SKILL.md origin section — also stale)

Overclaim factor: ~5.6× (9 weeks claimed vs 1.6 weeks actual). Codified
as F8 (marketing overreach without citation) — ADSD repo's own
description committed F8 about its own founding project's duration.

Honest framing landed in 6 surfaces + SKILL.md origin section + GitHub
About (separate gh repo edit command queued):

  - README.md L3 (top hero)
  - README.md L137 (Origin section): "9-week run" → "10-day intensive
    run (first commit 2026-04-30 → v0.1.0 tag 2026-05-10)"
  - SKILL.md L11 (Distilled from): "~178 commits, ~24 hours" → "12 days
    wall-clock (2026-04-30 → 2026-05-12), ~278 commits, 48+ ADRs,
    24+ findings, v0.1.0 + v0.1.1 + v0.1.2 shipped + α Phase F.2 in flight"
  - SKILL.md L898 (cross-references): "Cobrust 9-week run" → "Cobrust
    12-day intensive run"
  - SKILL.md L923 (lineage): "~178 commits" → "~278 commits over 12
    wall-clock days, 48+ ADRs, 24+ findings"
  - reference/failure-modes-catalogue.md F20 entry: "9 weeks of
    constitution mandate" → "12 days of constitution mandate fact-violated"
  - docs/human/en/getting-started.md L16: "9 weeks of Cobrust project" →
    "12 days of intensive Cobrust development (2026-04-30 → 2026-05-12,
    ~278 commits)"
  - docs/human/zh/getting-started.md L16 (parallel)

GitHub About description update (separate `gh repo edit` step, queued).

Lesson: ADSD's own description must dogfood F8 (cite or admit). The
overclaim was likely a human-frame intuition ("feels like 9 weeks of
work"; ADSD §3 reference for agent-velocity calibration codifies the
inverse error — underclaiming agent time as 6-8 weeks). Both directions
of the same anti-pattern: time framing without empirical anchor.

Co-Authored-By: Claude Opus 4.7 (session 4bb35f43) <noreply@anthropic.com>
Post v1.2.4 (9-week→12-day F8 closure), 3 sub-agent audits identified
27 total defects across ADSD repo. This fix-pack closes all empirically-
fixable items in one atomic commit.

=== A1 empirical-anchor audit (opus, 18 mismatches) ===

README.md:
- L13 "~178 commits, 43 ADRs, 19 findings, 21 documented failure modes"
  → "~278 commits, 49 ADRs (0001..0048 + 0047a), 27 findings,
     24 documented failure modes" (Cobrust ground truth at HEAD a2b3eab)
- L137 v0.1.0-beta (05-10) vs v0.1.0 stable (05-11) disambiguated;
  "10-day intensive run" → "11-day intensive run (first commit
  04-30 → v0.1.0 stable 05-11; v0.1.2 + α Phase F.2 followed)"
- L77 directory tree "plugins/agent-driven-development/" → "plugins/adsd/"
- L84 "F1-F21" → "F1-F24"

case-study/cobrust-multi-agent-experience.md (heavily stale):
- Frontmatter case_study_id terminal date 2026-05-10 → 2026-05-12
- duration: 11 days → 12 days wall-clock
- title "11-day multi-agent build-up" → "12-day"
- "~178 commits / 39 ADRs / 14 findings" → "~278 / 49 / 27"
  (3 sites: frontmatter L7 + §Project shape L32-34 + Numbers table L376-380)

SKILL.md:
- L920 "(2026-04-30 to 2026-05-10)" → "(2026-04-30 to 2026-05-12)"
  (resolved self-contradiction with L11)
- L921 "~278 commits over 12 wall-clock days, 48+ ADRs, 24+ findings"
  → "~278 commits over 12 wall-clock days, 49 ADRs (0001..0048 + 0047a),
     27 findings" (exact counts vs lower bounds)
- L920 "AI-native compiler" → "LLM-driven translation pipeline"
  (consistent with ADR-0048 framing reframe applied to lineage description)

=== A2 F-pattern evidence audit (opus, 3 stale citations of 24 entries) ===

reference/failure-modes-catalogue.md:
- F1.2 (L122-125): "0 hits" empirical claim time-stamped at 11th review
  (HEAD ~06df4b4, 2026-05-10) + 2026-05-12 note that specific grep is now
  stale but systemic pattern remains the F1.2 instance — recursive F1.2
- F18 (L1024-1033): direct quote not literally present; reframed as
  pattern description anchored to actual file (review-claude-handoff/
  README.md §"Attribution policy") with paraphrase rather than verbatim
- F21 (L1253-1257): "~2,800-line Cobrust Studio handoff" + §0.5.1/§12.8
  unfindable; reframed to actual locatable artifacts (claude-desktop-
  integrated-handoff.md + docs/agent/conventions.md §"Identity hygiene")

21/24 F-pattern entries cleanly verified.

=== A3 mechanical audit (sonnet, 8 defects) ===

- 4 SKILL.md cross-reference broken links removed (role-topology.md,
  two-phase-dispatch.md, snapshot-discipline.md were referenced but
  never created — honest framing > placeholder pretense)
- 2 docs/human/{zh,en}/getting-started.md L131 broken refs to
  why-adsd.md removed (file never created)
- reference/evals-first-development.md L150,210 templates/eval-template.md
  references reframed as inline guidance (file split out deferred to v1.3.0)
- reference/cost-monitoring-discipline.md L246 stale URL
  docs.anthropic.com/claude/docs/prompt-caching →
  platform.claude.com/docs/en/prompt-caching (HTTP 301 follow)

zh+en parity (A3.2): CLEAN per scripts/doc-coverage.sh ✓

External URL audit (A3.3): 4/5 HTTP 200, 1 stale-but-redirecting URL
fixed above; OpenAI platform.openai.com 403 inconclusive (Cloudflare bot
block, DNS resolves — not flagged as broken).

=== Verification ===

- bash scripts/doc-coverage.sh → PASS (Inv 1+2+3 all OK)
- grep "178 commits" → 0 hits
- grep "39 ADRs" → 0 hits
- grep "14 findings" → 0 hits
- intentional residual: "11-day intensive run" in README L137 (correctly
  describes 04-30 → v0.1.0 stable 05-11 span)

3 audit findings preserved at review-claude-handoff/findings/:
- 2026-05-12-adsd-empirical-mismatch-audit-A1.md (audit-A1 opus)
- 2026-05-12-adsd-f-pattern-evidence-audit-A2.md (audit-A2 opus)
- 2026-05-12-adsd-mechanical-audit-A3.md (audit-A3 sonnet)

review-claude own #21: a824d77 fix was scope-incomplete (caught
9-week phrase but missed numeric drift + case-study frozen snapshot
+ self-contradictions + broken refs). v1.2.5 closes the residue via
3-agent parallel audit + atomic synthesis. Pattern: empirical audit
> manual phrase-grep.

Co-Authored-By: Claude Opus 4.7 (session 4bb35f43) <noreply@anthropic.com>
…extended ADSD v1.2.1

Land case-study/cobrust-studio-experience.md as the second ADSD case
study. Where Cobrust (N=1) generated the methodology from its own
12-day intensive, Studio (N=2) is the first project to consume ADSD
v1.2.1 as input rather than co-evolving with it — a 2-day MVP run
applying the methodology under acceleration.

Concrete catalogue evidence surfaced:

- 2× F1.0 catches (BSD-sed silent failure in M0 doc-coverage.sh;
  CTO 守闸 grep leak swallowing 9 failed integration tests at A4 merge)
- 2× F19 catches (M4 SPA fallback Path<String> regression on
  Router::fallback in v0.1.0; v0.1.1 Cargo.lock stale on --locked)
- 2× F20 catches (last_verified_commit: HEAD placeholder shipped 2×
  before doc-coverage.sh §5 SHA-shape + git-reachability enforcement
  landed; doc-coverage.sh §6 paired exit-code + FAILED-grep gate
  hardened in v0.1.2 — the "recursive F20 closure" pattern)
- 1× prospective F21 validation (zero macOS Full-Name leak across
  125 commits; explicit session-handle attribution on every dispatch)

Methodology extensions surfaced for v1.2.2+ back-port:

- "Tag → audit → patch" as a RELEASE PATTERN, not a one-shot gate
  (v0.1.0 broken → v0.1.1 broken → v0.1.2 usable in 6 hours
  wall-clock; each tag is the experimental cycle)
- Recursive F20 closure (every enforcement layer needs its own
  orthogonal-failure paired review)
- Continuous persona testing executed in-sprint with persona-output
  → PR mapping (Mei/Aleksandr/Sarah dispatches drove the M5 README
  rewrite + F-05 dead-deps removal + CI matrix landing)
- AI velocity confirmed ~2.5× on a 5-day plan, but multiplier buys
  experimental cycles, not shippable-first-try
- 4-layer "constitution → ADR → finding → script" stack as the
  right F20 abstraction (each layer's gaps map cleanly to the next
  layer's enforcement)

The case study is structured symmetrically to cobrust-multi-agent-
experience.md: project meta + topology, what ADSD validated, what
ADSD stressed (broken catches with file:line evidence), what ADSD
extended, numbers, patterns to carry forward/reconsider.

Signed-off: studio-p7-adsd-backport-opus47

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…& lineage update

Hook the new case-study/cobrust-studio-experience.md into SKILL.md
at four touch-points:

- YAML frontmatter description: extend "pull case-study/... on demand"
  to enumerate both N=1 and N=2 case studies with one-line motivators
- §"Distilled from" header: add N=2-validated-against line summarising
  the Studio run (125 commits, 21 hours, v0.1.0/v0.1.1/v0.1.2 patch
  dance) and the first F20 closure in a non-origin project
- Part 7 §"Templates & Examples": list both case studies under
  case-study/ with N=1 / N=2 designation
- §"Cross-references" (within this skill): same dual entry under
  "Originals (distilled from Cobrust 12-day intensive run)"
- §"Origin & lineage": full N=2 paragraph describing what Studio
  added (first F20 systemic closure in a non-origin project; first
  "tag → audit → patch" release pattern documentation; first
  recursive F20 closure)

No methodology changes; this is reference-update only. The N=2
findings themselves are documented in the case-study file landed in
the prior commit.

Signed-off: studio-p7-adsd-backport-opus47

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… promoted to first-class entries

Six Studio-surfaced patterns from cobrust-studio-experience.md
promoted from case-study-only learnings to first-class catalogue
entries. Bumps catalogue version 1.2.0 -> 1.2.6.

New main entries:
- F25 — Tag -> audit -> patch as a release pattern under AI velocity
  (discipline entry; legitimate-and-disciplined under three preconditions:
  honest CHANGELOG, audit-as-experiment, K-bound convergence)
- F26 — Recursive enforcement-script closure required (F1 Sediment Family,
  orthogonal-failure sub-form; doc-coverage.sh §6 evolution + §5b
  paired-gate as empirical substrate)
- F27 — Continuous persona testing as dev-loop primitive (discipline
  entry; persona -> PR -> land -> re-spawn loop with five preconditions
  for legitimate use)
- F28 — Persona-simulation-as-validation epistemic risk (closed-feedback-
  loop sub-form; names the failure mode F27 regresses into without
  external grounding; mitigation = N=3 independent adoption / external
  user contact)

New F1 Sediment Family sub-forms:
- F1.3 — Local-vs-CI gate definition drift (sub-form of F1.2; M5.8
  cargo fmt drift evidence)
- F1.4 — Doc-coverage script enforces what it knows; README-vs-release-tag
  drifts silently (sub-form of F1.0; Sarah-v2 R9 evidence)

F1 parent block upgraded from "6 sub-forms confirmed" to "8 sub-forms
confirmed". Catalogue maintenance trailer updated F1-F11 -> F1-F28.

Source citations (case study §§):
- F25: §3.4 + §3.5 + §4.1 (tag dance)
- F26: §3.5 + §4.2 (recursive closure)
- F27: §4.3 + §4.5 (continuous persona)
- F28: §4.5 + §10 (Sarah-v2 R8 closed-feedback-loop risk)
- F1.3: §M5.8 (local vs CI fmt drift)
- F1.4: §M5.8 Sarah-v2 R9 (README vs latest tag drift)

Signed-off: studio-p7-adsd-catalogue-augment-opus47

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… + F1.3/F1.4

Description: extend the failure-mode keyword list with the four
Studio-surfaced patterns (tag->audit->patch release; recursive
enforcement-script closure; continuous persona testing dev-loop;
persona-simulation closed-feedback-loop epistemic risk), bump
catalogue reference from F1-F18 to F1-F28, and split provenance
(Cobrust N=1 surfaced F1.0-F1.2 + F2-F24; Cobrust Studio N=2
surfaced F1.3, F1.4, F25-F28).

Origin & lineage: add §"Catalogue v1.2.6" subparagraph naming the
six new entries and their case-study source.

Signed-off: studio-p7-adsd-catalogue-augment-opus47

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…3.0)

Append §11 to cobrust-studio-experience.md covering the M6 (ADR-0007 AEAD
round-trip) and M7 (ADR-0008 multi-provider /login) cycles completed on
2026-05-12 evening. Sections document: two-phase SOP applied twice
consecutively with measurable cadence improvement (120→90 min), Sarah
persona 4-cycle verdict path v1→v4 ("6+ months out" → "pilot-ready NOW"),
F1.0 seal-salt P9 implementation bug caught by E2E but invisible to 6 unit
tests, macos-13 runner-pool stall as infrastructure-not-code release
regression, and the autonomous-vs-confirm boundary derived from 4 user
restatements across the project history.

Update failure-modes-catalogue.md to v1.2.7: add candidate F1.5
(test-corpus structural blind spot on re-derive paths, surfaced by M6
seal-salt bug) and candidate F29 (cross-platform runner-pool dependency as
release-infra failure mode, surfaced by macos-13 stalls at v0.1.3+v0.2.0
closed by v0.2.1). Update F1 Sediment Family header to 9 sub-forms.

Signed-off: adsd-case-study-update-m6m7-sonnet46
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ce-name-redact + SPOF-build)

F41 (Cobrust F38): source-surface leakage of codegen-internal primitive
  - print_int/str/bool/float leaked into source-face PRELUDE; 333 LOC cleanup
  - Ratified Cobrust@46c0946 (ADR-0064); violates LLM-first §2.5 training-data-overlap rule

F42 (Cobrust F39): device-identifying names in git history via sub-agent memory read-through
  - 31 commit messages + 18 repo files; filter-repo Option-A force-rewrite
  - Ratified Cobrust@d012df9; adds opsec-boundary sub-form to F1-Sediment family

F43 (Cobrust F40): single-point-of-failure heavy-build host (DG abandonment)
  - SSH-gated workstation died; 8+ hr sprint blocked; sub-agents retried silently
  - Ratified Cobrust@d012df9; resolution = GH Actions as sole authoritative heavy-gate verifier
@Hakureirm Hakureirm force-pushed the adsd-cobrust-f41-f43 branch from 4ba9801 to 9f1b459 Compare May 25, 2026 09:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant