{
  "original_filename": "candidate-delivered-context.txt",
  "sha256": "8c5caaf3c4f304e0899a7ea99a04f46a47e737c3256a3d77aa1819577852a30d",
  "text": "### Rationalization Prevention\n\nThese thoughts mean STOP \u2014 you are about to break the pipeline:\n\n| Thought | Reality |\n|---------|---------|\n| \"Implementation/tests done, let me summarize\" | You are between stages. The pipeline runs to Stage 5. Proceed. |\n| \"No plan receipt exists \u2014 the brief is clear enough to skip planning\" | The plan-audit handoff is a governance checkpoint. Invoke `/gz-plan-audit <OBPI-ID>` in this same turn (see \u00a7 The Plan-Mode Gate); do not end the turn to ask permission. |\n| \"The hook blocked me, I'll work around it\" | Hook blocks are signals. Diagnose the cause. NEVER create marker files manually to bypass. |\n| \"`gz obpi complete` needs a TTY, so I'll ask the operator to run it themselves\" | No. There is no TTY gate. A plain non-TTY `uv run gz obpi complete ... --attestation-text \"<operator's verbatim attestation>\"` call completes the brief for every lane / kind / sensitivity. The operator already attested in Stage 4 \u2014 relay that phrase, never hand the invocation back. |\n| \"The operator said `attest completed` \u2014 maybe they want me to explain what to do next\" | No. `attest completed` IS the attestation. Run `gz obpi complete` immediately with that phrase (enriched per \u00a7 Attestation) in `--attestation-text`. Do not produce runbook-style instructions for the operator to execute. |\n| \"My Step 4a evidence is green \u2014 tests pass, REQs covered \u2014 so I can present it and await attestation\" | STOP. Green-on-your-own-evidence is the EXACT state Step 4b exists to distrust. You authored that evidence; you are the GHI #643 fabrication surface. You may NOT solicit attestation until applicable independent approval and closure have been imported for the current proof claims. Confidence from the authoring agent is worth zero at this gate. |\n| \"Step 4b is probably overkill for this small/authoring-only/obviously-correct OBPI\" | There is no size, lane, or kind exception to Step 4b. \"Obviously correct\" is the precise feeling that precedes a hollow-test or fabricated-evidence skip. Dispatch the adversary. You are not the exception. |\n| \"I'll present Step 4a now and run the adversary after the operator responds / in the next turn\" | Sequence violation. The adversary runs BEFORE attestation, not after \u2014 the operator attests holding the adversary's verdict. Presenting 4a as the terminal step of the turn, with 4b deferred, is the skip this gate forbids. Dispatch any missing required review before soliciting attestation; retain already applicable imported review. |\n| \"An independent Claude subagent is fine for 4b \u2014 I don't need Codex\" | Tier-order bypass (GHI #678). A Claude validating Claude shares this agent's blind spots \u2014 the exact failure Step 4b exists to break. Codex (tier 1) is REQUIRED first; tier 2 is permitted ONLY after a checked `ready: false`. Run `codex:setup`; if `ready: true`, the Claude subagent is forbidden. \"It was convenient\" is not a fallback reason. |\n| \"The adversary is there to find problems, so a round that confirms the feature works is a soft round\" | Inverted. A second model CONFIRMING the first model's implementation is correct is the entire point of Step 4b; probing is how that confirmation is earned. A round that only lists what it broke, and never demonstrates the feature doing its job, has not done the job. |\n| \"The adversary refuted again, so I'll fix these findings and re-run\" | Check its `Weakest point` against the previous round FIRST. If it names the same root, another fix cycle surfaces it one layer deeper \u2014 that is three rounds and ~9 hours in the measured case. Stop and put the design to the operator. |\n| \"I'll tell the adversary to REFUTE the claim \u2014 that's what adversarial means\" | It is not, and this exact wording cost OBPI-0.35.0-04 six rounds. A model told \"your job is to REFUTE this, not to confirm it\" will escalate until something falls, and its best available outcome is \"I could not refute it\" \u2014 absence of evidence, never confirmation. Prompt for independent confirmation, with probing as the method. |\n| \"This is a security property, so the claim should be absolute\" | An absolute claim cannot be refuted in bounded time: the adversary escalates the attacker until something falls. Declare the threat model in the brief FIRST, state it in the prompt, and forbid out-of-scope findings \u2014 otherwise the gate never converges. |\n| \"The adversary found something, so the OBPI cannot pass\" | Apply the September 5 independent-closure rule below: every finding against the agreed requirements or their required proof needs a disposition and independent closure. Severity alone does not clear it. Track independent discoveries without silently making them acceptance prerequisites; never dismiss a relevant finding merely because it arose in an auxiliary audit. |\n| \"The round refuted, but I fixed everything it found \u2014 I'll complete with `--adversary-verdict refuted` and explain the fixes in the resolution\" | **Refused, and a resolution string does not change that (GHI #960).** *\"refuted is an outcome, but it is an input into if(4a && 4b) pass; else: loop\"* (operator, 2026-09-04). Execute proof for the repaired obligation and import explicit independent closure. The current acceptance records determine readiness; preserve the original refutation as history. |\n| \"The block says refuted can't complete, so I'll pass `not-refuted` since the findings are fixed anyway\" | A caller-supplied word cannot close a finding. Import the independent review's actual executed output with its original finding IDs and current proof IDs. `gz obpi acceptance ... status --stage stage4` derives readiness; historical verdicts remain unchanged. |\n\n\n\n> ### \ud83d\uded1 HARD BARRIER \u2014 Step 4a does NOT end the turn\n>\n> Before soliciting attestation, verify that Step 4b supplied applicable imported\n> independent approval and explicit closure for every required finding. Dispatch\n> missing required review now. An earlier turn or equivalent successful execution\n> does not invalidate review by itself; the acceptance consumer decides applicability.\n> The sequence admits no size, lane, or kind exception:\n>\n> ```\n> Step 4a (author evidence)  \u2192  Step 4b (dispatch adversary, get verdict)  \u2192  present BOTH  \u2192  await attestation\n> ```\n>\n> You do not get to skip 4b because your own evidence looks green. Your evidence\n> looking green is *why* 4b exists. You are not the exception.\n\n\n\n**Clean means no unresolved in-scope findings, not absence of all limitations.** Accepted residual risks and future ADR-wide obligations remain disclosed separately; they are not failed present-tense OBPI requirements. Filing a GHI alone does not discharge an unmet requirement. A newly proposed boundary change requires operator ruling and independent revalidation; the implementing agent cannot move a finding outside scope to clear the gate. Before soliciting attestation, the retained independent review set must supply applicable approval and explicit closure on the corrected proof claims. Raw verdict wording alone neither grants approval nor reopens a closed obligation. Scope-boundary disclosures may remain, provided the adversary distinguishes them from unresolved findings.\n\nDo not redispatch merely to remove harmless caveat wording after independent\nclosure is established. If a follow-up exposes the same root cause again, use\nthe design-escalation rule below. The runtime checks proof identities, current\ninput digests, and explicit closure links. Whether an oracle or control fulfills\nthe requirement remains the independent reviewer's judgment.\n\n**When a round repeats the prior round's ROOT, stop dispatching and escalate the DESIGN (operator ruling 2026-09-03).** Compare each round's `Weakest point` against the last. If it names the same root cause at a different surface, another fix cycle will surface it again one layer deeper: stop, and put the design decision to the operator (\u00a7 Behavior Rules \u2014 Always #9). Measured: rounds 2, 3 and 4 each patched a different surfacing of one root cause \u2014 provenance inferred from a witness's self-consistent claims rather than chained to prior ledger state \u2014 at roughly 3h per cycle; the operator ruled the design in a single exchange and it closed in one pass. Round 4's fix also INTRODUCED round 5's critical, which is the signature of patching a surfacing rather than the design.\n\n**Act on mapped findings before attestation.** A current counterexample or missing\nrequired proof returns its obligation to repair, regardless of verdict or severity.\nAfter repair, execute proof and import independent closure. Historical refutations\nand auxiliary commentary with no unmet obligation do not require another repair or\nreview. Retain their provenance and present the applicable review set alongside\nStep 4a; never relabel a required gap as auxiliary to clear acceptance.\n\n**The gate consumes current closure (GHI #985).** A resolution string or new\ncaller-supplied verdict cannot discharge an open finding. Repair its obligation,\nexecute current proof, and import independent closure before soliciting\nattestation. Historical refutations do not block a correctly closed current\nstate merely because their original words remain in the brief.\n\n\n\n## Parallel Execution\n\nUse one writer per governed checkout. Read-only investigation may run independently.\nOnly the operator initiates OBPI work; separate sessions do not grant initiation.\nCapture the contract and input components before review and verify applicability\nbefore consuming it. Sequence shared acceptance/schema writes outside review windows.\nIf another run changes the subject, identify affected evidence before continuing.\nNever stash, pop, reset, revert, or sync another active run's work to clean the tree.\n\nAll OBPIs require per-OBPI human attestation (universal per ADR-0.0.36).\n\n---\n\n"
}