🆗 Overseer Kit — overseer-kit

Public product name: 🆗 Overseer Kit — overseer-kit is the repo slug only, not the public brand.

Living relay for 🆗 Overseer Kit. Paste the Paste-ready prompt fence into a fresh chat.

NEXT SESSION — FRV-b Freeze-review verdict integrity build

Date: 2026-09-12
Current position: FRV-a DONE (freeze pass, FRV-r5) → FRV-b (Auto, one build)
Model: Auto

What just landed

THE ONE NEXT STEP — Model: Auto

Build FRV-b exactly to the frozen artifact, as ONE build. F1–F7 share the same functions (tools/freeze_reviewer/stamp.py:27-101, tools/governance_hygiene/next_regen.py:395-524), so splitting them would land a tree where the stamp is relabelled but still authorizing, or where authorization moved but a prose fallback still bypasses it.

What the freeze fixes, in one line: a verdict record must not live inside the artifact it judges. Today a four-regex keyword scan writes a hardcoded verdict: pass into the document it graded, signs a reviewer_model that never ran, erases a human downgrade on the next run, and that field authorizes a mechanical build session.

Three things in the freeze that are easy to miss and are load-bearing:

1. §FRV.6.5.1 — the gate must cover plain Auto, not just Thinking → Auto. FRV-r4 caught this as BLOCKER-class: only 4 of 103 live roadmap rows carry the split label (all long DONE) against 43 plain Auto, so a gate wired to the split label alone is dead code here.
2. §FRV.6.4.1 — one phase_id derivation for both readers. governance_gates/scan.py:121 uses display strings while next_regen.py:512 uses compact_step_id; left alone they would query the ledger under different keys and assert opposite things about one slice.
3. §FRV.6.6 — mechanical_only is an advisory, never a reason. Any non-None reason short-circuits plan_next_regen to ambiguity (next_regen.py:556-557), which would suppress NEXT regeneration instead of emitting Thinking.

Live dogfood irony to preserve, not fix: the stamp now on the freeze artifact reads verdict: pass, reviewer_model: thinking-high, reviewer_provider: local — the exact false claim the artifact indicts (P6/P9). Leave it. FRV-b's own first ok review --freeze run will rewrite it to the fourteen-key shape once, and that single rewrite is the per-document migration (§FRV.9.3 step 2). It must not change artifact_digest.

Paste-ready prompt — FRV-b

FRV-b — Freeze-review verdict integrity build (overseer-kit).

Model: Auto
Repo: overseer-kit
Branch: feat/freeze-review-verdict-integrity
Step: FRV-b
Authority: authoritative

Read first: docs/archive/phases/PHASE-FRV-FREEZE-REVIEW-VERDICT-INTEGRITY.md (frozen,
FRV-r5 pass); docs/ROADMAP.md (FRV-a + FRV-b rows); docs/OVERSEER-HANDOVER.md.

Build exactly to the frozen artifact as ONE build. Do not redesign. Do not re-derive
§FRV.1 — every problem claim is already verified with a file+line citation. Do not split
F1-F7: they touch the same functions (tools/freeze_reviewer/stamp.py:27-101,
tools/governance_hygiene/next_regen.py:395-524), so a partial landing leaves the stamp
relabelled but still authorizing, or authorization moved while a prose fallback bypasses it.

Deliverables:
- F1 (§FRV.3) Fourteen-key stamp: `gate: mechanical` + `mechanical_verdict`; `verdict`
  reserved and never written. §FRV.3.4 legacy resolver (six branches,
  ACCEPT_LEGACY_VERDICT_STAMP) implemented ONCE in the new shared module and used by all
  three readers. Serializer key-order contract (serializer.py:10-31) untouched.
- F2 (§FRV.4) produced_by / provider_kind / checklist_ids / checklist_source /
  findings_count. New producer_identity() on the ReviewProvider Protocol, called AFTER
  provider.review() returns; a provider double lacking it resolves ("unknown",
  "rule_engine"). reviewer_model MUST be null whenever provider_kind is rule_engine.
- F3 (§FRV.5) Merge unknown keys instead of replacing; refuse to escalate a non-pass
  record; flag --override-non-pass-stamp; EXIT_STAMP_ESCALATION_REFUSED = 39 in
  tools/freeze_reviewer/engine.py; reason name stamp_escalation_refused; precedence
  2 > 4 > 5 > 39 > 8 > 7 > 0; no 39 under --dry-run / --no-stamp; four-condition true
  no-op. Pass the flag through cli/commands/check_ok.py:82-92.
- F4 (§FRV.6) Additive ENTRY_KINDS value freeze_review + validate_append_body branch +
  genesis forbid-list + find_matching_freeze_review beside the existing three. New module
  tools/freeze_authorization/ as the single reader shared by next_regen and
  governance_gates/scan. Gate BOTH `Thinking → Auto` and plain `Auto`; exclude
  `Operator + Auto`; add REASON_FREEZE_NOT_SUBSTANTIVE. mechanical_only travels as an
  `advisory` field, never as `reason`.
- F5 (§FRV.7) Delete BOTH prose fallbacks: next_regen.py:415-436 (remove _freeze_pass_state
  entirely) and governance_gates/scan.py:236-241 (_narrative_freeze_pass). No opt-in knob.
- F6 (§FRV.8) Honor auto_may_start: false as a real block, including the malformed
  fail-closed case. The CLI never writes, removes, or normalizes it.
- F7 (§FRV.9) Reconciliation only. No archived phase doc is rewritten.
- Seven-tier §FRV.12, test file prefix test_frv_.
- Update tests/unit/test_gs_paste_next_regen.py:78 and :94 to the new
  decide_split_emission signature (4-tuple, keyword-only config).
- Doc touchpoints: docs/CHECK-OK.md, tools/freeze_reviewer/README.md, SPEC §6 pointer.

Three easy-to-miss, load-bearing items:
1. §FRV.6.5.1 — plain `Auto` must gate. Only 4 of 103 live roadmap rows use
   `Thinking → Auto` (all DONE) vs 43 plain `Auto`; split-label-only is dead code here.
2. §FRV.6.4.1 — one phase_id derivation (compact_step_id) for BOTH readers, or the gate
   scan and the emission path query the ledger under different keys.
3. §FRV.6.6 — any non-None `reason` suppresses NEXT regeneration (next_regen.py:556-557).

Do NOT: rewrite archived phase docs; renumber any exit code; break the v1 ledger chain;
change honesty Mode A/B/C/D; add a config knob for the prose fallback or the legacy
window; dispatch a review model; change consumer defaults; roll out to consumers.

Hard stops: No merge to main without Tier 3 · no secrets · no live posture flips ·
 not DONE on green tests alone — /build-verification-review must pass FROM A SECOND CHAT
 with an independent_second_review ledger entry appended first (require per
 .overseer/config.yaml:57).

Governance sync: update roadmap + handover together on completion.

Shared context (canonical — prepend only when paste fence omits it)

Verified snapshot

VCS (verified 2026-09-05)

Hard stops (unchanged)

• No merge to main without Tier 3 authorization
• No live capability / posture gate flips without Tier 3 authorization
• No secrets in commits, adapters, logs, or governance docs
• Governance sync is mandatory before session end (SD-17)

• 2026-09-12 — FRV-a DONE (Thinking freeze). docs/archive/phases/PHASE-FRV-FREEZE-REVIEW-VERDICT-INTEGRITY.md → pass (FRV-r5), mechanical stamp sha256:c113efa3…. Froze the repair of the freeze gate itself. Verified by source inspection, not assumed: the default reviewer is a four-regex keyword scan (tools/freeze_reviewer/providers/base.py:15-19, :51-125) that accepts a reviewer argument and never reads it (:145-160); its result is written as the hardcoded string pass (tools/freeze_reviewer/stamp.py:33-42) under the same key and vocabulary a substantive review uses (tools/freeze_reviewer/types.py:18, :82-91), asserting a reviewer_model with no causal role — all 31 stamped archive docs carry that identical false claim. Because pre_stamp_canonical_bytes excises review_stamp before hashing (tools/freeze_reviewer/artifact.py:119-147) and the no-op guard requires an existing pass (tools/freeze_reviewer/stamp.py:45-52), a human downgrade fails the guard and the write proceeds as a wholesale replacement (:55-58) — sticky when pass, self-healing back to pass when a human objects. That field authorizes a mechanical build session (tools/governance_hygiene/next_regen.py:517-524), and with no stamp a bold **pass** in a prose table suffices (:415-436). Two readers and two prose fallbacks found, not one: tools/governance_gates/scan.py:133 + :236-241 were unenumerated in the brief and are now in scope; the reader set is closed at three modules. Root cause frozen: a verdict record must not live inside the artifact it judges — reusing the ISR ledger machinery rather than inventing a parallel mechanism. F1 vocabulary split (fourteen-key stamp, legacy window, all 31 digests provably stable since the stamp is excised pre-hash); F2 self-describing stamp with reviewer_model null under a rule engine; F3 merge-not-replace + escalation refusal + --override-non-pass-stamp + exit 39; F4 additive hash-chained freeze_review kind matched on phase_id + frozen_spec + artifact_digest; F5 both prose fallbacks deleted, no opt-in; F6 auto_may_start: false honored, its locus outside review_stamp chosen so flipping it invalidates any bound entry; F7 reconciliation over the enumerated archive (40 docs: 31 mechanical, 5 prose-only, 4 already inert) with no bulk rewrite and no retro-failed DONE row. Narrowly revisits the PHASE-ISR-INDEPENDENT-SECOND-REVIEWER.md:182 rejection for the freeze gate only — ledger record required, session independence not imported. Five rounds; FRV-r4 caught a BLOCKER-class reachability defect: the gate was wired only to Thinking → Auto, which is 4 of 103 live roadmap rows (all long DONE) against 43 plain Auto, so it would have been dead code under this repo's own two-row convention → §FRV.6.5.1 extends it via the existing §GSP.4.3 ambiguity channel. FRV-r3 also caught a fourteen-vs-thirteen key-count error and a phase_id divergence between the two readers (§FRV.6.4.1). Seven-tier §FRV.12, prefix test_frv_. No FRV-b Auto code, no test file, no CLI edit this session. NEXT → FRV-b (Auto, one build) on feat/freeze-review-verdict-integrity.

• 2026-09-05 — NXP → main DONE (land-b). GitHub PR #78 merged @ c921bf1 (NXP-a freeze + NXP-b build). Muse FF sha256:c07f2f34… → muse-bridge → squash. Post-merge sync; N5 backlog unblocked (§NXP.7). NEXT → queue-idle.

• 2026-09-04 — NXP-b DONE — BV-r2 pass + ISR pass from independent verifier 2869c11a… (≠ producer 3a3eda52…, who was BV-r1 verifier then NXP-b-FIX producer). V1–V8 over 940c3b4..HEAD, covering both the build commit 410ddc1 and the test fix 6c35b72. BV-r1's findings were re-derived by mutation rather than trusted: 12 targeted mutations run against the NXP tiers, 10 killed. The rewritten §NXP.8 e2e row fails (2 ≠ 0) when N4 is folded into --exit-code while the pre-fix 410ddc1 row passes under the identical mutation; the rewritten data-integrity row fails on a newline-only fence-body change while the pre-fix row passes (content-byte changes are caught by both) — BV1 and BV2 confirmed real, and confirmed genuinely closed. Verified live: twelve-step layout with heading byte-exact on line 1, four · U+00B7 separators, stdout minus provenance+blank reproducing pre-NXP nine-step bytes exactly, check-next unconfigured at exit 0 naming bare basename and compliant target, board-naming advisory printing while ok status --exit-code returns 0. Exit precedence 2 > 6 > 35 > 3 > 0, CURRENT_NEXT_HEADING, and extract_paste_fence_body untouched. §NXP.8 54 green; suite 1343 pass / 16 pre-existing, failure set identical to parent 940c3b4 in matched worktree environments. Ledger: verification_evidence bv_verdict: pass round 2 (test_output sha256:d4c5e0ae…) + independent_second_review isr_verdict: pass (8e5e49d9…); ok ledger verify → 0; Mode B and Mode D → 0. Two non-blocking observations recorded in NEXT (unasserted check-next --json payload fields; unreachable is_absolute() guard) plus a frozen-spec factual slip in §NXP.1 V6. No merge to main — NEXT → NXP-land-a (Tier 3).

• 2026-09-04 — NXP-b-FIX applied @ 6c35b72 (producer 3a3eda52… — same session as BV-r1, so it cannot verify this). Made the two vacuous §NXP.8 rows real: BV1 e2e now uses an initialized fixture that exits 0 on all pre-existing conditions and asserts the N4 advisory fires and exit stays 0; BV2 reconstructs pre-NXP nine-step stdout and asserts byte-for-byte equality after removing exactly the provenance line + blank. BV4 adds §NXP.3.6 refusal (exit 2, reason token, message, empty stdout), the absolute_repo_root failure predicate, and §NXP.4 failure-shape keys; dropped the discarded first read_at_now(); restored tools/workspace/__init__.py trailing newline. No N1–N4 behavior change. All three original mutations now fail the correct tier. Suite 1343 pass / 16 pre-existing. NEXT → NXP-b-BV-r2 in a fresh chat (ISR producer_session_id: 3a3eda52…).

• 2026-09-04 — NXP-b-BV-r1 → findings (second chat, verifier 3a3eda52…; no ISR appended). V1–V8 against frozen PHASE-NXP-NEXT-PROVENANCE.md §NXP.3–§NXP.6: implementation correct — verified live, not just green (twelve-step bytes + U+00B7 separators, N2 keys on both JSON shapes, N3 exit 0, N4 advisory present while ok status --exit-code → 0, no secrets/env/subprocess added, board_name_violation reused not forked). Full suite 1340 pass / 16 fail, byte-identical on parent 940c3b4. Findings are test-honesty, not behavior: BV1 §NXP.8 e2e exit-code row tautological (tests/e2e/test_print_next_e2e.py:132-134) and BV2 data-integrity fence-body golden newline-insensitive (tests/data_integrity/test_print_next_integrity.py:78-88) — both proven vacuous by mutation; BV3 builder producer nonce unrecorded, so actor_session_id ≠ producer_session_id is unassertable; BV4 §NXP.3.6 / §NXP.4 branches untested. verification_evidence bv_verdict: findings, test_output sha256:a1ea596e…. NEXT → NXP-b-FIX then BV-r2 in a third chat.

• 2026-09-04 — NXP-b code complete on feat/nxp-next-provenance (not DONE). N1 twelve-step provenance + clock seam; N2 JSON identity keys; N3 check-next advisory exit 0; N4 status board-name warn. §NXP.8 45 green. Full suite 1340 pass / 16 pre-existing unrelated fails. NEXT → second-chat BV + ISR (require).

• 2026-09-02 — ISR default → require (operator posture). Absent key / shipped default is now require (was off); kit dogfood require (was warn). Opt out: off or warn. PHASE-ISR operator amend recorded. Closed-loop premise.

• 2026-09-02 — ISR → main + MuseHub solidify DONE. Hub → staging; created aaronrene/overseer-kit; pushed 85 commits; PR #74 @ 84db8c8. NEXT → queue-idle.

• 2026-09-02 — MuseHub-first before ISR merge — Gap confirmed: hub localhost:1337 dead; aaronrene/overseer-kit 404 on staging/production. Operator: solidify MuseHub staging then merge PR #74. Handover + paste + MUSE-BRIDGE-WORKFLOW.md retargeted.

• 2026-09-02 — ISR → main land-a — Muse FF feat/isr-independent-second-reviewer → main (sha256:f59d4cc6…) → muse-bridge → GitHub PR #74 OPEN/mergeable. Rebased stale muse-mirror onto main before re-export (LT #72/#73 had bypassed mirror). Merge held for MuseHub-first. require_independent_second_reviewer remains kit dogfood warn.

• 2026-09-02 — ISR-b DONE (Auto + second-chat BV pass, ISR-b-BV-r1). V1–V8 against freeze + branch diff; independent_second_review pass (actor c72e9414… ≠ producer 62762b24…); Mode B verification_evidence (test_output sha256:4a82e963…). test_isr_ 48 green. NEXT → ISR → main (land-a). No merge this session.

• 2026-09-02 — ISR-a DONE (Thinking freeze). docs/archive/phases/PHASE-ISR-INDEPENDENT-SECOND-REVIEWER.md → pass (ISR-r4), stamp sha256:e6284150…. Second-chat / separate-verifier gate before Auto DONE; kit records/gates only; no model dispatch; portable CLI+docs primary; seven-tier §ISR.11 frozen. No ISR-b Auto code this session. NEXT → ISR-b Auto on feat/isr-independent-second-reviewer.

• 2026-09-02 — consumer-lt-rollout DONE. ok sync LT footprint into Knowtation, Scooling, VideoFactory, the-brain, bornfree-hub, ourware, scooling-lab, scooling-sc-brain. Knowtation/Scooling: session_bookends + honesty warn + hooks; VF/the-brain: bookends + hooks (honesty tip deferred). Knowtation/VF used --only to avoid clobbering living docs / consumer-modified policy. All synced repos footprint_coverage: ok. Deferred: MuseHub (no config.yaml), bornfree/ourware/lab bookends, VF full --force on customized tiers/rules, Knowtation origin:kit living-doc lock hygiene. NEXT → ISR-a (Independent second reviewer Thinking freeze).

• 2026-09-02 — LT → main DONE (land-b). GitHub PR #72 merged @ ff737cc (LT-a freeze + LT-b build). Local main FF; post-merge hygiene; NEXT → consumer-lt-rollout.

• 2026-09-01 — LT-b DONE (Auto build + BV pass, LT-b-BV-r1). Built exactly to frozen docs/archive/phases/PHASE-LT-LOOP-TIGHTENING.md: footprint coverage gate; session_bookends (default off, dogfood enabled + hooks synced); kit honesty warn + active-slice Mode B; ok handover-compact + dogfood compact (88 archived); optional-feature tips on ok status; workspace-root docs; §LT.10 34 green. ok sync --force applied; footprint_coverage: ok. No consumer defaults; no tab-reload claim. NEXT → queue-idle.

• 2026-09-01 — LT-a DONE (Thinking freeze). docs/archive/phases/PHASE-LT-LOOP-TIGHTENING.md → pass (LT-r2), stamp sha256:6a5aafb5…. Slices 1–4 frozen. No LT-b Auto code this session. NEXT → LT-b Auto on feat/loop-tightening.

• 2026-09-01 — LT-a drafted (Thinking freeze, review pending). Slices 1–4 in docs/archive/phases/PHASE-LT-LOOP-TIGHTENING.md on feat/loop-tightening. Backlog captured: independent second reviewer, KH2 remask, session-type bookends, auto-enable hooks, host tab reload. No Auto code.

• Older entries: docs/archive/handover/CHANGE-LOG.md

Handover regeneration rules (SD-3, SD-17)

1. Docs-first: update docs/ROADMAP.md and durable specs before regenerating this file.
2. Model label required: every NEXT block and paste prompt includes Model:.
3. Thinking → Auto split: when NEXT is split, emit {step}a (Thinking) then {step}b (Auto) — never one combined prompt.
4. Build verification (mandatory): after {step}b, run /build-verification-review before ROADMAP status → DONE.
5. Closing commit: the session-ending commit bundles code/tests + docs/ROADMAP.md + docs/OVERSEER-HANDOVER.md.
6. Change log compaction: living change log keeps the newest 15 dated bullets. Older bullets move via ok handover-compact --write to docs/archive/handover/CHANGE-LOG.md.

See docs/ROADMAP.md → Model-split handover protocol (SD-3) and governance sync (SD-17).

What just landed

Change log

• 2026-09-12 — FRV-a DONE (Thinking freeze). PHASE-FRV-FREEZE-REVIEW-VERDICT-INTEGRITY.md → pass (FRV-r5), stamp sha256:c113efa3…. F1–F7 frozen as one Auto build; verdict records move off the artifact and onto the hash-chained ledger. FRV-r4 caught a BLOCKER-class reachability defect (split-label-only gating = dead code; 4 of 103 rows). NEXT → FRV-b.

• 2026-09-05 — governance-sync: drift (D1=drifted, D2=aligned, D3=aligned) @ 8358f96; realign: D2 aligned — skip realign; next_regen=human_authorship_required:zero_open_rows

• 2026-09-05 — governance-sync: drift (D1=drifted, D2=aligned, D3=aligned) @ bdf1f20; realign: D2 aligned — skip realign; next_regen=human_authorship_required:zero_open_rows

• 2026-09-05 — governance-sync: drift (D1=drifted, D2=aligned, D3=aligned) @ 1e1582c; realign: D2 aligned — skip realign; next_regen=human_authorship_required:zero_open_rows

• 2026-09-05 — NXP → main DONE (land-b). PR #78 @ c921bf1. NEXT → queue-idle (N5 backlog unblocked).

• 2026-09-04 — NXP-b DONE. BV-r2 pass + ISR pass (verifier 2869c11a… ≠ producer 3a3eda52…). BV-r1's two findings re-derived by mutation and confirmed closed. NEXT → NXP-land-a (Tier 3, no merge yet).

• 2026-09-04 — NXP-b-BV-r1 → findings (second chat). Implementation matches §NXP.3–§NXP.6; two §NXP.8 matrix rows asserted vacuously (mutation-proven). No ISR, no DONE. NEXT → NXP-b-FIX.

• 2026-09-04 — governance-sync: drift (D1=drifted, D2=aligned, D3=aligned) @ ce16f9b; realign: D2 aligned — skip realign; next_regen=human_authorship_required:zero_open_rows

• 2026-09-02 — governance-sync: drift (D1=drifted, D2=aligned, D3=aligned) @ fc2ecb0; realign: D2 aligned — skip realign; next_regen=human_authorship_required:zero_open_rows

• 2026-09-02 — governance-sync: drift (D1=drifted, D2=aligned, D3=aligned) @ 945d034; realign: D2 aligned — skip realign; next_regen=human_authorship_required:zero_open_rows

• 2026-09-02 — ISR → main + MuseHub solidify DONE. PR #74 @ 84db8c8; staging hub hosts kit. NEXT → queue-idle.

• 2026-09-02 — MuseHub solidify DONE — connected staging.musehub.ai; created public aaronrene/overseer-kit; first push 85 commits.

• 2026-09-02 — ISR-b DONE (Auto + BV pass, ISR-b-BV-r1).

• 2026-09-02 — ISR-a DONE (Thinking freeze). PHASE-ISR → pass (ISR-r4).

• 2026-09-02 — consumer-lt-rollout DONE. LT synced to live consumers.

• 2026-09-02 — LT → main DONE (land-b). PR #72 @ ff737cc.