{
  "original_filename": "old-delivered-context.txt",
  "sha256": "e82b9439acdde649099d2c4900be37006b735eef268c39e2a415c5e9210e2d21",
  "text": "### Rationalization Prevention\n\nThese thoughts mean STOP \u2014 you are about to break the pipeline:\n\n| Thought | Reality |\n|---------|---------|\n| \"Implementation/tests done, let me summarize\" | You are between stages. The pipeline runs to Stage 5. Proceed. |\n| \"No plan receipt exists \u2014 the brief is clear enough to skip planning\" | The plan-audit handoff is a governance checkpoint. Invoke `/gz-plan-audit <OBPI-ID>` in this same turn (see \u00a7 The Plan-Mode Gate); do not end the turn to ask permission. |\n| \"The hook blocked me, I'll work around it\" | Hook blocks are signals. Diagnose the cause. NEVER create marker files manually to bypass. |\n| \"`gz obpi complete` needs a TTY, so I'll ask the operator to run it themselves\" | No. There is no TTY gate. A plain non-TTY `uv run gz obpi complete ... --attestation-text \"<operator's verbatim attestation>\"` call completes the brief for every lane / kind / sensitivity. The operator already attested in Stage 4 \u2014 relay that phrase, never hand the invocation back. |\n| \"The operator said `attest completed` \u2014 maybe they want me to explain what to do next\" | No. `attest completed` IS the attestation. Run `gz obpi complete` immediately with that phrase (enriched per \u00a7 Attestation) in `--attestation-text`. Do not produce runbook-style instructions for the operator to execute. |\n| \"My Step 4a evidence is green \u2014 tests pass, REQs covered \u2014 so I can present it and await attestation\" | STOP. Green-on-your-own-evidence is the EXACT state Step 4b exists to distrust. You authored that evidence; you are the GHI #643 fabrication surface. You may NOT print \"Awaiting attestation\" until the independent adversary's verdict is in this same turn. Confidence from the authoring agent is worth zero at this gate. |\n| \"Step 4b is probably overkill for this small/authoring-only/obviously-correct OBPI\" | There is no size, lane, or kind exception to Step 4b. \"Obviously correct\" is the precise feeling that precedes a hollow-test or fabricated-evidence skip. Dispatch the adversary. You are not the exception. |\n| \"I'll present Step 4a now and run the adversary after the operator responds / in the next turn\" | Sequence violation. The adversary runs BEFORE attestation, not after \u2014 the operator attests holding the adversary's verdict. Presenting 4a as the terminal step of the turn, with 4b deferred, is the skip this gate forbids. Dispatch 4b in the same turn as 4a. |\n| \"An independent Claude subagent is fine for 4b \u2014 I don't need Codex\" | Tier-order bypass (GHI #678). A Claude validating Claude shares this agent's blind spots \u2014 the exact failure Step 4b exists to break. Codex (tier 1) is REQUIRED first; tier 2 is permitted ONLY after a checked `ready: false`. Run `codex:setup`; if `ready: true`, the Claude subagent is forbidden. \"It was convenient\" is not a fallback reason. |\n| \"The adversary is there to find problems, so a round that confirms the feature works is a soft round\" | Inverted. A second model CONFIRMING the first model's implementation is correct is the entire point of Step 4b; probing is how that confirmation is earned. A round that only lists what it broke, and never demonstrates the feature doing its job, has not done the job. |\n| \"The adversary refuted again, so I'll fix these findings and re-run\" | Check its `Weakest point` against the previous round FIRST. If it names the same root, another fix cycle surfaces it one layer deeper \u2014 that is three rounds and ~9 hours in the measured case. Stop and put the design to the operator. |\n| \"I'll tell the adversary to REFUTE the claim \u2014 that's what adversarial means\" | It is not, and this exact wording cost OBPI-0.35.0-04 six rounds. A model told \"your job is to REFUTE this, not to confirm it\" will escalate until something falls, and its best available outcome is \"I could not refute it\" \u2014 absence of evidence, never confirmation. Prompt for independent confirmation, with probing as the method. |\n| \"This is a security property, so the claim should be absolute\" | An absolute claim cannot be refuted in bounded time: the adversary escalates the attacker until something falls. Declare the threat model in the brief FIRST, state it in the prompt, and forbid out-of-scope findings \u2014 otherwise the gate never converges. |\n| \"The adversary found something, so the OBPI cannot pass\" | Apply the September 5 independent-closure rule below: every finding against the agreed requirements or their required proof needs a disposition and independent closure. Severity alone does not clear it. Track independent discoveries without silently making them acceptance prerequisites; never dismiss a relevant finding merely because it arose in an auxiliary audit. |\n| \"The round refuted, but I fixed everything it found \u2014 I'll complete with `--adversary-verdict refuted` and explain the fixes in the resolution\" | **Refused, and a resolution string does not change that (GHI #960).** *\"refuted is an outcome, but it is an input into if(4a && 4b) pass; else: loop\"* (operator, 2026-09-04). If your fixes are real, a re-run returns `not-refuted` \u2014 go get that verdict. Completing on the refuted one records the completion against a tree that no longer exists. |\n| \"The block says refuted can't complete, so I'll pass `not-refuted` since the findings are fixed anyway\" | A caller-supplied word cannot close a finding. Import the independent review's actual executed output with its original finding IDs and current proof IDs. `gz obpi acceptance ... status --stage stage4` derives readiness; historical verdicts remain unchanged. |\n\n\n\n> ### \ud83d\uded1 HARD BARRIER \u2014 Step 4a does NOT end the turn\n>\n> Printing the Step 4a packet and the line **\"Awaiting attestation\"** is NOT a\n> valid stopping point. Between authoring Step 4a and soliciting attestation,\n> Step 4b (the independent adversary) MUST run **in this same turn**. If you are\n> about to end your turn with a 4a evidence table and no adversary verdict, you\n> are committing the GHI #643 skip \u2014 the exact failure this gate exists to\n> prevent. The sequence is non-negotiable and admits no size/lane/kind/\"obviously\n> correct\" exception:\n>\n> ```\n> Step 4a (author evidence)  \u2192  Step 4b (dispatch adversary, get verdict)  \u2192  present BOTH  \u2192  await attestation\n> ```\n>\n> You do not get to skip 4b because your own evidence looks green. Your evidence\n> looking green is *why* 4b exists. You are not the exception.\n\n\n\n**Clean means no unresolved in-scope findings, not absence of all limitations.** Accepted residual risks and future ADR-wide obligations remain disclosed separately; they are not failed present-tense OBPI requirements. Filing a GHI alone does not discharge an unmet requirement. A newly proposed boundary change requires operator ruling and independent revalidation; the implementing agent cannot move a finding outside scope to clear the gate. The latest independent review must explicitly confirm closure on the corrected artifacts and return `not-refuted` before soliciting attestation. Scope-boundary disclosures may remain, provided the adversary distinguishes them from unresolved findings.\n\nDo not redispatch merely to remove harmless caveat wording after independent\nclosure is established. If a follow-up exposes the same root cause again, use\nthe design-escalation rule below. The runtime checks proof identities, current\ninput digests, and explicit closure links. Whether an oracle or control fulfills\nthe requirement remains the independent reviewer's judgment.\n\n**When a round repeats the prior round's ROOT, stop dispatching and escalate the DESIGN (operator ruling 2026-09-03).** Compare each round's `Weakest point` against the last. If it names the same root cause at a different surface, another fix cycle will surface it again one layer deeper: stop, and put the design decision to the operator (\u00a7 Behavior Rules \u2014 Always #9). Measured: rounds 2, 3 and 4 each patched a different surfacing of one root cause \u2014 provenance inferred from a witness's self-consistent claims rather than chained to prior ledger state \u2014 at roughly 3h per cycle; the operator ruled the design in a single exchange and it closed in one pass. Round 4's fix also INTRODUCED round 5's critical, which is the signature of patching a surfacing rather than the design.\n\n**Act on the verdict before attestation.** `REFUTED` \u2192 return to Stage 2. `REFUTED-WITH-CAVEATS` naming a real gap (e.g. a missing regression test, an injected-only test that wouldn't catch a production regression) \u2192 FIX it now, then re-validate. Never hand the operator an unresolved finding dressed as clean. Apply the independent-closure rule above to fixes after ANY verdict, including `not-refuted` with caveats; present the latest independent verdict and closure evidence alongside Step 4a.\n\n**The gate consumes current closure (GHI #985).** A resolution string or new\ncaller-supplied verdict cannot discharge an open finding. Repair its obligation,\nexecute current proof, and import independent closure before soliciting\nattestation. Historical refutations do not block a correctly closed current\nstate merely because their original words remain in the brief.\n\n\n\n## Parallel Execution\n\nMultiple independent OBPIs within the same ADR can run this pipeline concurrently\nin separate agent sessions. Requirements:\n\n1. OBPIs have non-overlapping allowed paths\n2. Each session claims its OBPI via `uv run gz obpi lock claim`\n3. Sync operations (Stage 5) are atomic per-brief\n\nAll OBPIs require per-OBPI human attestation (universal per ADR-0.0.36).\n\n---\n\n"
}