Dark-Alex-17
48753eaa46
FIX A: run_checks.py passed no env= to Popen, so verification commands
inherited the live GRAPH_STATE/GRAPH_STATE_FILE. Every suite script's
load_state() prefers GRAPH_STATE_FILE, so when the adversary reviews a repo
whose own tests exec these scripts (this repo's R5 tests) the leaked file
silently overrode the test state -> false failures. Popen now gets an env
with all GRAPH_STATE* keys removed. The five sibling script-test helpers
(review-gauntlet, code-reviewer, finding-verifier, step-runner,
deep-research) gain .env_remove("GRAPH_STATE_FILE") for hermeticity. New
R5 test loads state via GRAPH_STATE_FILE and asserts a shell-neutral
python3 -c probe sees both vars UNSET.
FIX B: the depth check compares the child's absolute depth against the
SPAWNER's own max_agent_depth (root = 0), so under
architect(0)->sisyphus(1)->review-gauntlet(2)->code-reviewer(3) the
code-review lane faulted "Max agent depth exceeded (4/3)". Limits are now
child depth + 1 headroom along the documented chains, with the chain in a
comment next to each key: code-reviewer 3->5, domain-reviewer 2->6,
architecture-reviewer 2->4, step-runner default->4 (explicit),
review-gauntlet stays 4. domain-reviewer's file-reviewer hop is documented
but inert (can_spawn_agents unset) - left unwired by decision; noted in
config and pinned via a DOCUMENTED_BUT_UNWIRED exemption in the new
bundled-config test, which pins every value and asserts per-hop headroom +
reachability along four chains.
Domain Reviewer
A domain-slice review leader. Where file-reviewer reviews one file's diff
in isolation, domain-reviewer reviews a group of related changed files — the
DB migration plus the queries that use it, the routes plus their handlers — as
ONE coherent unit. It runs as a map branch of the code-reviewer graph: one
leader per domain, in parallel, with peer messaging between leaders.
Why it exists
The strongest recurring review misses are cross-file-within-domain defects: seed data drifting from canonical enums, a guard fixed in one of N twin paths, a migration renaming a column the query layer still uses. Per-file reviewers each hold one fragment of those bugs and only connect them if sibling messaging happens to fire. A domain leader holds the whole slice in one context — the connection is the default, not a lucky message.
How it works
- Fetches its slice's diff itself (
get_diff --files <its files>). - Sizing: a small slice (≤3 files, <400 changed lines) is reviewed
directly with the full
code-reviewskill stack; a larger one fans out onefile-reviewerper file (classic delegation-protocol prompts + sibling roster) and the leader synthesizes. - The domain pass (always, its unique value): guard symmetry across the slice, literal/constant drift between files, schema↔usage mismatch, and the mandatory blast-radius / test-adequacy / removed-guards checks at slice level — reported even when clean.
- Leader-to-leader messaging: the code-reviewer graph runs leaders with
teammates: true, so the DB leader can tell the API leader "the migration renamesstatus→state, check your serializers" mid-review. - Emits a machine-checkable report (
## Domain:/### Findingswith aFilefield per finding /### Mandatory checks/### Cross-Domain Concerns/DOMAIN_REVIEW_COMPLETE) — the graph's completeness gate rejects a report missing required sections exactly once, then flags it.
Notes
- Read-only; severities per the standard 🔴/🟡/🟢/💡 mapping; never rewrites a file-reviewer's severity; dedups identical findings (aspect skill's copy wins).
- Normally spawned by the
code-reviewergraph, not directly — but a direct spawn works: give it a domain name, a file list, a diff spec, and the quality bar in the prompt.