# PR #22 independent review

Reviewer: planner-reviewer-codex-01. Job: fa5cfb00.
Reviewed detached worktree `multi-agent-mux-wt/pr-22` at `4a81d15d95632d54c47b15297549ab28c41006f3`, against main `5611859`; reviewed the nine commits and aggregate diff.

PASS for the scoped implementation of #21 items 1, 2, 3, and 6. I found no additional merge-blocking implementation defect. This is not approval to merge the current tree without the two release corrections already identified in the brief:

- Add the 4.6.0 MINOR lockstep version changes and VERSIONS.md release entry. Passing version-consistency tests on the current 4.5.0 tree does not satisfy this release requirement.
- Remove trailing whitespace in `docs/design/reviews/review-agy-fd384d6b.md` (lines 3–8, 36, 38, 104, 106, 108, 115, 117). `git diff --check 5611859...HEAD` currently fails on those known lines.

## Review findings

1. **Delegation paths and quoting:** The wrapper resolves the registry after entering the requested workdir, then supplies absolute brief/report paths and explicit registry and audit-log locations in injected lifecycle commands. The CLI registry override retains priority over MAM_JOBS_DIR. Executable paths containing a slash are made absolute before changing cwd. Bash quoting and execution from another cwd are exercised by the new tests, including spaces. Single-quote-containing paths remain an explicitly documented limitation.

2. **Loop roots and flags:** The runtime code and control plane remain in the control checkout; diff collection, base/head and creator context use the selected source worktree. Worktree validation checks the repository common directory. An explicit base must resolve to a commit and be an ancestor of source HEAD. Review-only requires a base and skips initial implementation, while later correction/compliance rounds may still dispatch a creator. That behavior is now documented. The empty-change guard accepts documentation changes and fails closed on unknown git state; it includes untracked files, so an unignored preparation symlink such as `.venv` can make an otherwise empty set nonempty. The design explicitly requires excluding that preparation artifact. The legacy shell runtime rejects unsupported options/environment configuration rather than silently ignoring them.

3. **Control-plane bindings:** The new resolver normalizes the four binding fields and persists them on creation. Resume prefers a complete saved binding, warns when the caller differs, and populates legacy rows without a binding. Stop retains both registry and audit-log routing; status checks the new locations alongside legacy candidates. Relative MAM_JOBS_DIR handling is covered. Reconcile's environment precedence has a static regression guard, not full runtime integration coverage. Forwarding paths containing whitespace is explicitly rejected; the legacy external wrapper path warns that propagation is unavailable. These are stated compatibility limits rather than hidden claims of complete support.

4. **Herdr shim:** With environment flags present, session creation bypasses idle-pane reuse and forwards environment through pane/workspace creation. It does not inject `env K=V` into agent arguments. The no-environment reuse path remains covered. The revised h25 assertions pin both environment forwarding and the absence of inappropriate agent arguments; I did not find a weakened contract. `_sks_*` and `send_keys_safe` implementations are unchanged by this diff.

5. **Design corrections and scope:** The revised document addresses my previous design objections: partial support, control/source/runtime roots, test-side writes, pending immutable review identity, and logical ownership rather than assumed database corruption. The first phase permits parallel implementation outside the loop and one review loop, with the base captured before implementation. Deferring preparation/recovery helpers (4), immutable review identity and isolated verification (5), real-herdr acceptance (7), and multi-loop scheduling (8) is reasonable for this bounded prerequisite PR. It must not be presented as completed production support for concurrent loops.

6. **Tests and isolation:** The new worktree tests use temporary repositories or mam_sandbox; the final T2-8 change places shell rejection checks in the sandbox. Static checks and mocked delegation/herdr behavior provide useful bounded coverage but do not establish actual pane environment propagation. The provided `.venv` symlink in the review tree predates this review. No source files, production sessions, monitor configuration, or checkout state were modified by this reviewer.

## Verification

Tests ran from the review worktree with `PYTHONDONTWRITEBYTECODE=1`, its supplied `.venv/bin/python`, and pytest's cache provider disabled.

| Check | Result |
|---|---|
| `test_issue21_worktree_prereqs.py`, `test_herdr_shim_contract.py`, `test_issue5_phase2a_loop.py`, `test_version_consistency.py` | 146 passed in 136.14 s |
| `test_issue18_liveness_contract.py`, `test_issue6_turn_handshake.py` | 43 passed, 2 failed in 250.40 s |
| Isolated stock acknowledgement-test rerun | 1 passed in 4.46 s |
| Remote acceptance rerun with unique UUID4 session and secret | 1 passed in 32.00 s |
| `bash -n` for nine changed shell files | Passed |
| `git diff --check 5611859...HEAD` | Known archived-review trailing whitespace only |

The two initial failures require explicit qualification:

- `tests/test_issue18_liveness_contract.py:512`, `test_send_keys_safe_is_confirmed_by_the_job_started_event`: the command succeeded, but the elapsed-time assertion measured 13.393 s against an 11 s limit. The test joins the publisher thread before checking elapsed time, so publication latency affects that measurement. The isolated unmodified rerun passed. This test and the relevant acknowledgement implementation are unchanged relative to base; the observed result does not demonstrate a deterministic PR regression.
- `tests/test_issue18_liveness_contract.py:1189`, `test_acceptance5_remote_runner_completes_a_job_over_the_broker_only`: the wrapper awaited job `fa85ad57`, but its `--once` runner consumed and completed job `4fd23659`. The stock test uses a fixed `sim-worker` session and shared secret on a wildcard broker subscription, allowing concurrently running suites to collide. I reran the same test with a pytest collection plugin replacing only those session/secret string constants in memory with UUID4 values; all original assertions remained, and it passed. No repository test file was edited. This supports a shared-broker test-isolation diagnosis, not a product-code regression. The stock acceptance test should gain unique identifiers in follow-up work.

I have not independently verified the PR's claim that all 33 full-suite failures are environmental or match base. These focused results should be combined with the orchestrator's separate full-suite evidence; they must not be generalized into a blanket endorsement of that claim.

## Follow-up recommendations

The remaining work is appropriately sequenced as: (1) preparation/teardown and original-cwd recovery helpers, (2) immutable review identity and isolated test execution, (3) real-herdr environment and lifecycle acceptance, (4) explicit reviewer ownership/queueing before multiple loops, and (5) reproducible operational recipes coordinated with the #17 shell-layer reduction. Keep the documented compatibility restrictions until those acceptance cases exist. Additionally, make the broker acceptance test's session and secret unique to avoid cross-suite interference.

Final checkout verification: main remains clean; the review tree remains at the requested detached commit with only its preexisting untracked `.venv` symlink. The two known release gates remain the orchestrator's responsibility before merge.

[VERDICT: PASS]