The Trilogy Times

## Summary

- Make the revamp the operator-first destination while preserving the current Console fallback.

- Add repository-profile-aware intake, health/conflict visibility, bounded 100-batch collection, Resume, remediation, Mercy review, all-event timeline access, and stronger state semantics.

- Improve color hierarchy, action emphasis, identifier presentation, and objective/acceptance formatting.

## Verification

- pnpm test (80 files, 1,282 tests)

- pnpm test:browser (10 tests)

- pnpm build

- pnpm lint

- pnpm format:check

- git diff --check

## Migration

- Current Console remains at #/ and #/legacy.

- Revamp is available at #/revamp.

- No pagination or workflow-state changes were introduced.

## The bug

#123 shipped dead code. It added the module, the blocking predicate, the ledger recording, carry-forward preservation and eight tests — and never called any of it. Nothing in the pipeline set deferred. Every consumer would have taken the plumbing and seen zero behaviour change.

Caught while checking what moving the v1 tag would actually ship.

## The fix

decide_review gains --repo / --pr-number, and between extracting findings and deciding the event it asks the second opinion about every finding that *would* gate and is eligible.

No repo needs a new secret. It reuses AGENT_OPENAI_API_KEY — already declared as a workflow input, already exported as OPENAI_API_KEY for the review step, and already passed by all five consumer callers (Surtr, Klair, Aerie, trilogy-drones, Sindri), since they all run luna.

## Verified end to end

Against a real PR, with a deliberately fabricated finding:

no key   →                                   event=REQUEST_CHANGES
with key →  [gate] eligible=1 deferred=1     event=APPROVE
ledger deferred : true
ledger reason   : "The cited file only contains x=1 and y=2; no retry loop
or attempts budget exists to exhibit the claimed behavior."
body mentions a second reviewer? False

It caught that the finding was fabricated, deferred it, recorded why, and left no trace in the review body.

## Fail-safe paths, all exercised

No key, no PR context, an exception mid-call, an unparseable answer — each leaves every finding blocking and logs a line. A review that cannot get a second opinion is still a valid review.

## The contract test earned its place

It caught a real bug in this change before it shipped: ${PR_NUMBER} was read by the decide step without being declared in its own env:. Under set -u that is the HEAD_SHA regression that once failed every review with an error indistinguishable from a real finding.

397 tests pass.

## Business Value

Without this, #123 is inert and the measured 30% clearance on stuck PRs is worth nothing. This is the commit that makes it real.

## Manual Effort Estimate

~1 hour (proposed — Keval to confirm).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## What & why

Keys the enrollment report's offering-kind axis on the SIS program_type enum instead of the free-text program name.

- int_school_year_offering.sql: WHERE po.program_name = 'School Year' → WHERE po.program_type = 'MAIN'. Header rewritten to describe selection by the source enum and to note SIS expresses MAIN under two naming conventions (the shared School Year program and per-campus <Campus> Main Program); both now reach the axis. program_type is carried in the CTE and published as a documented constant column (mirroring int_campus.delivery_mode); its domain is guarded by the source-side test rather than a tautological model-level accepted_values.

- int_program_offering.sql: carries program_type through from stg_sis_program (already selected there, previously unused downstream). Header + _int_enrollment__models.yml updated to document it.

- tests/assert_sis_program_type_domain.sql: new source-side value-domain test mirroring assert_sis_campus_delivery_mode_domain.sql. Reads source('sis','programs'), non-deleted rows, fails when program_type IS NULL or NOT IN (MAIN, SUMMER_CAMP) — a future EXTENDED_DAY/AFTER_SCHOOL surfaces for review instead of being silently dropped.

- seeds/sis_campus_program_map.csv: eight Alpha School campuses added (alphabetical by campus_name) so assert_sis_campus_program_map_covers_axis stays green.

- Stale name = 'School Year' scope references in stg_sis_program.sql and _sis__sources.yml updated to the current program_type = 'MAIN' shape (rule 22).

Why: program_type is SIS's own enum for the MAIN-vs-SUMMER_CAMP distinction. The name predicate only expressed "the year-long main program" as a side effect of the old one-shared-School Year-program convention; when SIS began provisioning per-campus <Campus> Main Program records, the label changed and eight active, PHYSICAL Alpha School campuses silently fell off the axis. The #1268 staging campus filter (not the name) is what keeps the 11 out-of-scope Main Program campuses out — the name predicate's only live effect was dropping these eight.

Closes #1279.

## Verification — real Redshift build (green)

Full dbt build --select path:models path:seeds --vars '{pr_number: 1279}' against sandbox_education: PASS=284, ERROR=0, SKIP=0, one pre-existing unrelated WARN (assert_admissions_pipeline_tenant_coverage, admissions-pipeline domain, present on main).

Acceptance tests passing: assert_sis_program_type_domain, assert_sis_campus_program_map_covers_axis, assert_sis_campus_program_map_hubspot_resolves, unique_int_school_year_offering_id, dbt_utils_unique_combination_of_columns_mart_enrollment_dtl_campus_id__cohort_id__session_school_year (has_fact grid uniqueness), assert_sis_enrollment_has_fact_consistency, assert_sis_enrollment_qualified_is_fact (qualified → has_fact completeness).

- The eight campuses now produce 10 campus×year axis rows (Anywhere Center - Founders & Greenwich - Armonk: 2026+2027; the other six: 2026). None were on the axis before.

- Axis grain unchanged: campus×year has no group > 1 before or after; unique_int_school_year_offering_id passes.

- SELECT DISTINCT program_type FROM int_school_year_offering → only MAIN; Summer Camp contributes zero axis rows (Port Chester's Summer Camp 2026 offering is correctly excluded).

- The four zero-enrollment campuses (Bethesda, Miami Beach (Biarritz), San Juan, Virtual) each form 13 factless grid rows (0 facts).

## Before/after cohort counts — SY2024–SY2027 (post-#1258 spine)

Measured on the same source snapshot: main's code and this branch both built fresh (pr9000_ baseline vs pr1279_), so the delta reflects only this change, not the hourly-refresh drift in the production tables. Counts are on the #1258-filtered spine (test records dropped), so they differ from the issue's raw-spine figures by design.

Distinct fact enrollments:

| School year | Before | After | Δ |

|---|---|---|---|

| SY2024 | 284 | 284 | 0 |

| SY2025 | 757 | 757 | 0 |

| SY2026 | 1621 | 1667 | +46 |

| SY2027 | 22 | 23 | +1 |

| Total | 2752 | 2799 | +47 |

Fact rows (cohort fan-out): SY2026 3735→3818, SY2027 25→26. Total mart rows incl. factless grid: SY2026 4255→4429, SY2027 542→569.

Delta attribution — confined to the eight new campuses + one explained re-enrollment. The +46 SY2026/SY2027 distinct fact enrollments are the four enrolled new campuses: Alpha Greenwich - Armonk 24, Alpha Anywhere Center - Founders 17, Alpha Austin - Founders 3, Alpha Lexington 2. (Bethesda, Biarritz, San Juan, Virtual add 0.)

The +1 at the existing campus Alpha Greenwich - Port Chester (SY2027, 10→11) is a correct second-order effect, not a predicate re-resolution — Port Chester's axis offering IDs are byte-identical before/after. One student transferred from the newly-admitted Alpha Greenwich - Armonk (2026) and holds an ON_HOLD 2027 enrollment at Port Chester. With Armonk now visible on the axis, that prior-year enrollment is seen, so the 2027 enrollment's is_returning flips FALSE→TRUE and it joins the re-enrollment-other cohort. The report is now correctly recognizing a returning student whose prior enrollment was previously invisible. No source drift (staging stg_sis_enrollment identical at 18,169 rows across both builds).

## Founders SIS-vs-HubSpot on-campus parity (#1216 restated)

Alpha Anywhere Center - Founders — the reported symptom (14 on-campus students in HubSpot, zero rows in SIS before this change) — now resolves. SIS cohort split (SY2026): on-campus 16, first-day 16, re-enrolled 1, re-enrollment-other 1 (17 distinct enrollments; the 16 PENDING_REVIEW land on-campus, plus one re-enrollment). SIS on-campus 16 vs HubSpot's reported 14 — this change closes the parity gap (SIS was showing 0) rather than opening a new one; the small SIS/HubSpot residual is the pending-review timing the issue describes. Full #1216 cross-system parity reconciliation (HubSpot-side models) is out of scope for this dbt change.

## Alpha Virtual — explicit decision

Alpha Virtual is admitted despite its name because SIS records it as delivery_mode = 'PHYSICAL', so the #1268 mode filter does not hold it back and the type-keyed axis includes it. It has zero enrollments today (factless grid rows only), so it costs nothing numerically. Correcting the SIS delivery_mode at source is Out of Scope — worth raising with the SIS team, but the report is not special-casing one campus while the source disagrees (same resolution as the Alpha World School case in #1268: SIS is the spine).

## Seed mappings — two reviewed decisions + build-driven corrections

- Alpha Miami Beach (Biarritz) → has_hubspot_program = false. The one HubSpot Alpha Miami Beach program is already mapped to the distinct SIS campus Alpha Miami Beach (a34e72b4); pointing Biarritz at it too would double-count it in any SIS↔HubSpot parity comparison. (Whether Biarritz is a genuinely separate site vs a rename is an admissions data question — Out of Scope.)

Two corrections vs the issue's verbatim "Seed rows required" block, both required to pass existing seed tests and both following the seed's own documented conventions (caught by the mandatory local build):

1. program_name populated for Biarritz and Virtual with their identity name (= program_code: Alpha Miami Beach Biarritz, Alpha Virtual) instead of an empty field. The seed's not_null test on program_name (unchanged by this PR) rejects an empty CSV cell, which dbt loads as NULL. This matches the established SIS-only-campus convention — campuses HubSpot has no program for publish their own campus name as an identity program (e.g. Alpha Carrollton, Alpha Anywhere Center Port Chester). The identity name is distinct from Alpha Miami Beach, so the Biarritz no-double-count intent is preserved.

2. Alpha Austin - Founders and Alpha San Juan set has_hubspot_program = false (not true). Their HubSpot programs exist in EduCRM (26 and 39 rows) but carry zero real enrollment facts yet (has_fact = false throughout) — assert_sis_campus_program_map_hubspot_resolves requires a true mapping to resolve to a real fact. This is exactly the seed's documented "valid campuses whose HubSpot program carries no enrollment facts yet (SIS leads HubSpot for newly onboarded campuses)" case. The four campuses that do resolve to real facts (Anywhere Center - Founders, Bethesda, Greenwich - Armonk, Lexington) stay true.

The seed yml description counts are updated to the current shape (rule 22): has_hubspot_program TRUE 48→52, FALSE 10→14 (6 SIS-only + 8 no-facts-yet).

## Rule notes

Rule 8 preserved — the offering-kind filter stays in exactly one place (int_school_year_offering); only the column it reads changed. No new rule-5 exception taken. All descriptions/comments state the current shape (rule 22); no name = 'School Year' scope reference remains.

Closes #1290.

Reduces mart_enrollment_dtl to what SIS actually knows. This is a dbt-only change — the enrollment consumer (#1216) is still open, so nothing in production reads this mart yet.

## What changed

Identity — SIS only

- Removed HubSpot contact_id and deal_id from mart_enrollment_dtl, int_enrollment_cohort, int_enrollment, and int_student, and dropped the now-orphaned stg_sis_student_external_id / stg_sis_enrollment_external_id joins plus their two hubspot_* scoped-uniqueness tests.

- Renamed student_key → student_id, unaliased from sis_enrollments.student_id through the intermediates to the mart. Removed the unused student_number projection entirely (grep -r student_number dbt/ returns nothing).

Deposit — drop the EduCRM overlay, publish the SIS signal

- Deleted int_deposit_overlay.sql, stg_educrm_enrollment_deposit.sql, and the two overlay singular tests. No dbt model reads EduCRM enrollment data any more; the educrm.enrollment_dtl source declaration is retained (read only by the parity_sis_vs_hubspot_enrollment_2026 analysis, per Out-of-Scope #9).

- deposit_paid_date is now published as CAST(NULL AS TIMESTAMP) on both arms — reserved, documented, appearing the day SIS grows a native paid-at.

- Added finalsite_deposit_state / finalsite_deposit_source to stg_sis_enrollment and carried them through int_enrollment and int_enrollment_cohort. The mart publishes:

- deposit_state — three-valued paid / unpaid / NULL (NULL = unknown, not "No"; every pre-2026 row is NULL).

- deposit_signal — SIS's own evidence vocabulary (AMOUNT, CHECKLIST, ADVANCE_DEPOSIT_CHECKLIST, ADVANCE_DEPOSIT_ATTRIBUTE), carried verbatim and not relabelled into the Admissions Pipeline macro's vocabulary; NULL whenever the deposit is not paid.

- New singular test assert_sis_enrollment_deposit_signal_requires_paid pins deposit_signal IS NULL whenever deposit_state is not paid. Added accepted_values on deposit_state (error) and deposit_signal (warn).

Docs — model yml, source yml, staging headers, and the rule-14 dual-identity paragraph updated to describe a single SIS identity; the removed EduCRM overlay docs deleted.

## Verification

- dbt build --select +mart_enrollment_dtl+ (isolated pr1290_* relations): clean (PASS, 0 errors; the only WARN is the pre-existing assert_sis_campus_unresolved_hubspot_program, unrelated to this change).

- Parity (projection/rename only): total rows (8,606), per-year distribution, and 2026 per-cohort fact counts are byte-identical to the pre-change build. Column count stays 34.

- Deposit cross-check: 2026 distinct-enrollment deposit_state totals — paid 1,576 / unpaid 32 / NULL 45 (= 1,653) — match sis_enrollments directly. deposit_paid_date is NULL on all 8,606 rows.

- Built the independent mart_admissions_pipeline_dtl in isolation and ran assert_admissions_pipeline_reconciles → PASS (deleting the EduCRM deposit staging model did not break the admissions pipeline).

- pnpm typecheck passes; pnpm biome check is a no-op (dbt is ignored).

## Notes on stale ticket references

The issue named assert_sis_campus_program_map_hubspot_resolves.sql and docs/enrollment-cohort-parity.md; neither exists in the current repo (superseded by #1286's int_school_identity work / never created). The only consumers of stg_educrm_enrollment_deposit were the overlay and its two tests (all deleted), so no test needed repointing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

- remove ExecutionMode from the CAPEX BatchExecuteStatement request

- retain atomicity through the Data API batch operation's transaction contract

- validate fake-client requests against botocore's real BatchExecuteStatement input shape

- add a regression proving unsupported request fields are rejected instead of silently accepted

## Why

The released installer passes ExecutionMode="TRANSACTION". The deployed botocore service model rejects that field during client-side parameter validation, before any DDL is submitted. BatchExecuteStatement already executes its Sqls as one transaction, so the option is unnecessary.

The prior fake accepted arbitrary keyword arguments and asserted the same invalid request. The replacement validates every submitted request through botocore while keeping the exact-request assertion. The installer omits ExecutionMode for compatibility with deployed SDK service models, including models that predate the optional field.

## Validation

- PYTHONPATH=src uv run pytest -q tests/ — 36 passed

- ruff==0.15.22 check — passed

- ruff==0.15.22 format --check — passed

- git diff --check — passed

## Rollout

This PR changes source only. It does not apply Redshift DDL, start a pipeline execution, enable on-demand execution, or enable the schedule. After a separate production promotion, the existing authorized fail-closed preflight and controlled installation can proceed.

Linear: [SURTR-648](https://linear.app/builder-team/issue/SURTR-648)

## Summary

This PR completes Gate 2 local-only maturity hardening for the Factory Console and coordinator.

- Adds Factory Health, startup reconciliation, and operator conflict visibility.

- Adds SQLite schema versioning, integrity checks, backup, and restore operations.

- Adds dry-run-first artifact and workspace lifecycle scanning with evidence-safe cleanup classification.

- Makes initial PR creation idempotent across configured-token and local-gh publication paths.

- Preserves uncertain Git push outcomes as non-retryable operator-recovery states.

- Closes the startup publication window so requested publication cannot be silently finalized as success before publication begins.

- Adds runbook documentation and a Gate 2 local evidence closure record.

## Local verification

- 77 test files, 1,225 tests passed.

- Browser regression: 10/10 passed.

- Console UI smoke: 7 routes passed.

- Build, lint, formatting, and diff checks passed.

- Representative local KLAIR-3383 batch completed successfully with 3/3 validations passed and publication evidence recorded.

## Scope and boundaries

- Local filesystem and loopback Console only.

- No hosted execution, remote deployment, merge automation, release, or cleanup was performed by this PR.

- Lifecycle cleanup remains review-first; no historical artifacts were deleted.

- Uncertain external outcomes remain explicitly operator-recovery states.

## Summary

- Add restart-safe SQLite reconciliation coverage, including the requested-publication window.

- Preserve completed publication during reconciliation after PR metadata is persisted.

- Classify workspace bootstrap failures as WORKSPACE_BOOTSTRAP_FAILED while continuing sibling work.

- Add representative Console evidence for successful, validation-failed, publication-failed, and partial-batch outcomes.

- Document the local resilience coverage matrix and evidence.

## Verification

- pnpm test — 77 files, 1,229 tests passed.

- pnpm build passed.

- pnpm lint passed.

- pnpm format:check passed.

- Console UI smoke passed — 7 routes.

- Browser checks passed — 10/10.

- git diff --check passed.

- Live local KLAIR-3383 batch completed successfully with validation passed and publish:false.

## Scope

Local execution and Console resilience only. GitHub credential redesign and remote deployment are out of scope.

## Summary

- Add bounded App Server protocol/session metadata, interruption, checkpoint, and explicit CLI/Console resume support.

- Reuse the original workspace safely and continue with a bounded recovery instruction instead of blindly replaying the coding prompt.

- Make Factory context and skill policy explicit, keep target skills disabled by default, and add structured-output recovery.

- Reconcile workspace evidence, validation, patch integrity, and publication boundaries.

- Return an actionable Console error when GitHub publication credentials are unavailable.

## Verification

- pnpm test — 79 files, 1,257 tests passed

- pnpm build

- pnpm lint

- pnpm format:check

- git diff --check

## Live validation

- KLAIR-3383: cancellation, turn/interrupt, Console restart, same-run App Server resume, and successful no-publication completion.

- KLAIR-3476: clarification flow succeeded; validation repair was exercised and stopped after its bounded limit when client-format continued failing.

- KLAIR-3389/KLAIR-3390: representative no-publication runs completed with success and preflight-blocked outcomes respectively.

- Disposable publication proof created PR #3747; it was intentionally closed afterward.

## Scope boundary

No merge, deployment, automatic supervisor, or automatic merge behavior is included. Publication, merge, and deployment remain separate explicit gates.

## Follow-up

- Run a post-merge publish:false smoke test.

- Continue measured no-publication pilots.

- Diagnose whether the observed client-format repair failure is ticket-specific or a broader repair-harness issue.

## Summary

- Add deterministic validation failure fingerprints to receipts and repair events.

- Stop early when the same validation failure repeats unchanged instead of consuming another blind repair attempt.

- Include the exact validation working directory and command line in repair prompts.

- Record failed command IDs, categories, changed-file counts, and repair fingerprints in bounded evidence.

## Verification

- pnpm test — 79 files, 1,258 tests passed

- pnpm build

- pnpm lint

- pnpm format:check

- git diff --check

- Live publish:false KLAIR-3476 run: initial client-format failure, one repair attempt, final validation passed, Ready to publish.

## Scope

Publication policy is unchanged. No merge, deployment, or automatic publication behavior is added.

## Summary

- Add flushable durable App Server event persistence.

- Record bounded protocol checkpoints with process, thread, turn, and protocol identity.

- Persist richer notification/response metadata and typed failure categories.

- Fail closed on malformed JSONL, preserve cancellation evidence, clean up owned Codex homes when evidence flushing fails, and clear stale recovery state.

## Verification

- pnpm test — 79 files, 1,263 tests passed

- pnpm build passed

- pnpm lint passed

- pnpm format:check passed

- git diff --check passed

## Scope

This PR does not add App Server supervision, automatic compaction, publication, merge, or deployment behavior.

## Summary

- Add a controllable App Server fault-injection harness.

- Cover malformed JSONL, stream/process failures, authentication, missing IDs, workspace mutation before process loss, invalid output, context failure, unexpected requests, timeout, and cancellation.

- Pin timeout and cancellation faults to the turn phase and assert the interrupt request.

- Add a runTicket boundary case proving failed receipt creation, persisted protocol evidence, validation suppression, and preservation of partial workspace state.

## Verification

- pnpm test — 80 files, 1,276 tests passed

- pnpm build passed

- pnpm lint passed

- pnpm format:check passed

- git diff --check passed

## Scope

This PR adds deterministic local fault coverage only. It does not add App Server supervision, automatic compaction, publication, merge, or deployment behavior.

## What

The reviewer decides whether a finding is real. Nothing decides whether a real finding must be fixed before merge or can land as a follow-up — and that second question governs how many rounds a PR takes.

This adds it. For each finding that would gate, a pass over the PR description, the full diff, the whole of every file the findings cite, and the reviews and comments posted before this round. One question per finding: *does merging this unfixed break production?* Two possible answers: keep blocking, or ship as a follow-up.

## Measured

Replayed 63 PRs whose review was already at round 4 or later — five repos, six weeks:

PRs blocked      63
clear the gate 19   (30%)
findings judged 126   (27 more never eligible)
deferred       63   (50%)

What it defers is dominated by guards against input the system does not produce (34%) and findings the code already handles (19%).

## Then read by hand

Every contested call — all 17 where the reviewer raised the same file:line again on a later round:

| | |

|---|---|

| Reviewer stuck or wrong | 11 |

| Genuinely arguable | 3 |

| Unjudgeable (anchor problem, below) | 3 |

| A defect that would have broken production | 0 |

Five of the eleven are one PR whose own file header reads *"Hidden experimental comparison endpoint… not part of any production read path"* — production-blocking standards applied to an internal dashboard. Two describe code that had been deleted.

## Three properties held on purpose

It can only defer. Never promote, never invent a finding, never raise a severity. The worst it can do is fail to block.

It is invisible. Nothing it decides is named in the review body, in an inline comment, or anywhere a reader of the PR would see. A deferred finding is reported exactly as before — it simply stops counting toward the gate. The ledger records the deferral unattributed: the PR gains no second reviewer's voice.

Every failure makes the reviewer stricter. No key, network error, no JSON, malformed JSON, unknown verdict, missing id — all resolve to "this blocks", which is today's behaviour. security and anything marked critical are never submitted at all.

## Whole files, not a window

The reviewer's line anchors drift. Three findings in the audit described receipt deletion while pointing at a daily-counter function 400 lines away — a window around the anchor showed the pass code the finding was not about.

Switching to whole files moved 22 of 125 verdicts, 13 of them back to BLOCKING. The narrow window had been hiding what made them real. It also produces grounded reasoning: *"isValidIsoInstant() reconstructs the UTC calendar date and compares it to the timestamp's local date"* rather than *"the documented producers write UTC."*

## Known, and deliberately not mitigated

A wrongly deferred finding stays deferred on every subsequent round — same evidence, same answer. The obvious guard, block after N repeat deferrals, was considered and rejected: it lets a reviewer win by repetition rather than by being right, which is the exact failure this exists to end. The ledger record is the mitigation, and it relies on a human noticing. Worth knowing before this gates anything.

## Testing

397 tests. Nine mutations, nine killed:

| mutation | |

|---|---|

| deferral ignored | killed |

| a truthy value accepted as a deferral | killed |

| ledger drops the flag | killed |

| ledger drops the reason | killed |

| carry-forward drops the deferral | killed |

| security made eligible | killed |

| critical made eligible | killed |

| an unusable answer defaulting to defer | killed |

| apply() promoting instead of demoting | killed |

## Business Value

Targets the 14% of PRs that consume 42% of all review runs. On the replay it clears the gate on 19 of 63 already-stuck PRs without, on hand audit, shipping a single production defect — and it does it invisibly, so the PR reads exactly as it does today.

## Manual Effort Estimate

~6 hours (proposed — Keval to confirm). Most of it was building the backtest honestly: three separate measurement bugs of my own (a lookahead leak, drifted anchors, and same-line-different-finding) each inflated the result before being found and fixed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Measured — 112 PRs, one blocking review each, all at round 4+, five repos

| | old prompt | new prompt |

|---|---|---|

| PRs cleared | 45 (40%) | 40 (36%) |

| Findings deferred | 101 (60%) | 90 (54%) |

| Stricter | — | 31 |

| Looser | — | 20 |

Stricter, and stricter in the right places. Of the 31 findings it newly keeps blocking, the samples are money and data bugs the old prompt was shipping:

> *"discards _cost_malformed, so malformed Cost cells are silently reported as $0.00 and understate the spend-audit totals"*

> *"maps persistence failure to terminal FAILED without freeing the dedupe row, making a transient outage permanent"*

> *"retains a school with a blank display_name in the production refresh"*

19 of the 31 are money / data-integrity / observability, against a 52% base rate.

## What changed, and why each

Restructured, not appended. An earlier attempt that appended a single rule made the prompt *looser* overall. This keeps the same length with more structure.

Blast radius is question one. Five of the eleven confirmed-wrong blocks in the hand audit were on internal experimental tools, dev launchers, or routes behind a privileged flag — held to production standards.

"Removed is not fixed." The one case my own hand audit got wrong: version machinery was deleted, but the !existing branch still permitted the bad publish.

Evidence rules for the two dominant buckets.

- *"Nothing produces this input"* — 34% of deferrals, the riskiest — must point at what rules it out: a schema, an upstream validator, the sole writer. Absence of evidence is not evidence.

- *"The code already handles it"* — 19% — must quote the line.

- Author rebuttals count only with a file:line, a test, or a contract.

Per-repo "wrong result", one line each. Klair money and Surtr warehouse rows named rather than inferred.

Uncertainty made concrete. A reason needing *could / may / might / probably* is a prod_breaking.

## The trade-off to know about

| repo | old | new |

|---|---|---|

| Aerie | 20/44 | 22/44 |

| Klair | 13/24 | 13/24 |

| trilogy-drones | 4/12 | 4/12 |

| Sindri | 1/6 | 1/6 |

| Surtr | 7/26 | 0/26 |

On Surtr the gate now defers nothing. The per-repo line describes nearly every Surtr finding, and combined with "the reviewer is reliably right about silent data corruption" it closes the door. That is the correct default for a warehouse repo — data correctness *is* the product — but it means zero relief there. Recorded so it can be narrowed with two weeks of live evidence rather than a guess.

## Honest caveats

- 20 findings went looser for reasons the prompt does not explain. That is the sampling variance documented on #125; one run per prompt cannot separate it from effect. The stricter side is supported by the samples. The looser side is not claimed.

- Re-raise rate ~38% on both arms — mostly measurement artifact per the earlier hand audit, not read as an error rate.

## Testing

Prompt-only change; 397 harness tests pass unchanged. A prompt change is a model-behaviour change and is not unit-testable — the A/B above is the test.

## Business Value

This is the gate that decides whether a real finding must block a merge or can ship as a follow-up. Getting it wrong in one direction ships bugs; in the other it recreates the deathloop the team is angry about. The rewrite makes it measurably safer than the version currently live on Surtr and Klair — it catches money and data-loss bugs the old prompt was waving through — while still clearing roughly a third of PRs already stuck at round 4+. It also unblocks moving v1, which carries the deathloop bug fixes to Aerie, trilogy-drones and Sindri, who are still running the pre-fix reviewer.

## Manual Effort Estimate

~2 hours (proposed — Keval to confirm). The prompt itself is an hour; the rest was profiling how mercy blocks per repo and running the 112-PR A/B to make the change evidence-led rather than intuition-led.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

Remove the retired getPortfolioHealth aggregate from every Aerie-owned product surface: Convex, MCP discovery, Worker/stdio registration, agent contracts and policies, UI rendering, Flue output handling, public API metadata, documentation, fixtures, and tests. The supported v2 Insights list/detail workflow remains available, while proactive Worker guidance now uses bounded status-filtered site rosters plus factual overdue-milestone evidence.

### Changes

- chat/convex/rhodes/mcp.ts and chat/rhodes-worker/mcp-server/tools/views.ts — Delete the public Convex query and MCP registration; add an explicit bounded listSites path for status-filtered rosters.

- packages/contracts/src/agent-run-protocol.ts, packages/contracts/src/agent-tool-registry.ts, and chat/convex/agentRuns/runs.ts — Remove the tool from agent names, schemas, descriptions, public policies, and capability routing; bump the public tool-policy version to invalidate stale runs.

- chat/lib/rhodes-mcp-contract.ts and UI/Flue renderers — Remove in-app advertisement, the dedicated portfolio-health card, and the obsolete nested gateway fixture; keep listSites milestone progress visible with DTO-shaped coverage.

- chat/rhodes-worker/lib/mcp-instructions.ts and mcp-server/tools/sites.ts — Replace the retired proactive workflow with capped active/paused site reads and factual overdue reporting.

- chat/lib/public-api/v2/domains/insights.ts, parity guard, docs, and feature history — Preserve the supported v2 Insights contract, document the later cleanup, and allow the intentional cross-repository MCP removal during parity checks.

- Tests — Remove obsolete behavior fixtures and add negative registry coverage, bounded roster coverage, forwarding/schema coverage, and UI DTO coverage.

### Design Decisions

- The v2 Insights list/detail API is retained because it is a supported bounded public workflow, not the retired MCP aggregate.

- listSites remains generally compatible for existing callers; only explicit status-filtered calls with limit use the bounded roster path used by proactive guidance.

- The replacement instructions report only returned milestone progress and overdue evidence; they do not infer health labels from missing evidence or the absence of overdue items.

- The public Agent tool-policy version is incremented so durable runs created under the prior tool catalog fail closed rather than appearing compatible with a changed policy.

## Business value

Eliminates a retired, misleading aggregate health surface and prevents agents or UI clients from presenting stale readiness scores, ratings, blocker rankings, or unsupported portfolio judgments. Users retain factual, bounded milestone and overdue evidence through the supported workflows.

## Estimated manual effort

Estimated time to complete this work without AI: 1 working day.

## Test Plan

- [x] Full Rhodes Worker test suite.

- [x] Focused Convex parity, public-agent, contract, site-tool, and Rhodes card tests.

- [x] Chat, Worker, and contracts typechecks.

- [x] Biome, architecture-boundary, Convex-path, read-bound, test-architecture, and git diff --check validation.

- [x] Read-only seven-lane adversarial review with independent verification of accepted findings.

- [ ] Run deployed MCP discovery/parity checks after the normal release deployment; no deployment or external mutation was performed for this PR.

## Summary

Remove the retired getPortfolioHealth aggregate from every Aerie-owned product surface: Convex, MCP discovery, Worker/stdio registration, agent contracts and policies, UI rendering, Flue output handling, public API metadata, documentation, fixtures, and tests. The supported v2 Insights list/detail workflow remains available, while proactive Worker guidance now uses bounded status-filtered site rosters plus factual overdue-milestone evidence.

### Changes

- chat/convex/rhodes/mcp.ts and chat/rhodes-worker/mcp-server/tools/views.ts — Delete the public Convex query and MCP registration; add an explicit bounded listSites path for status-filtered rosters.

- packages/contracts/src/agent-run-protocol.ts, packages/contracts/src/agent-tool-registry.ts, and chat/convex/agentRuns/runs.ts — Remove the tool from agent names, schemas, descriptions, public policies, and capability routing; bump the public tool-policy version to invalidate stale runs.

- chat/lib/rhodes-mcp-contract.ts and UI/Flue renderers — Remove in-app advertisement, the dedicated portfolio-health card, and the obsolete nested gateway fixture; keep listSites milestone progress visible with DTO-shaped coverage.

- chat/rhodes-worker/lib/mcp-instructions.ts and mcp-server/tools/sites.ts — Replace the retired proactive workflow with capped active/paused site reads and factual overdue reporting.

- chat/lib/public-api/v2/domains/insights.ts, parity guard, docs, and feature history — Preserve the supported v2 Insights contract, document the later cleanup, and allow the intentional cross-repository MCP removal during parity checks.

- Tests — Remove obsolete behavior fixtures and add negative registry coverage, bounded roster coverage, forwarding/schema coverage, and UI DTO coverage.

### Design Decisions

- The v2 Insights list/detail API is retained because it is a supported bounded public workflow, not the retired MCP aggregate.

- listSites remains generally compatible for existing callers; only explicit status-filtered calls with limit use the bounded roster path used by proactive guidance.

- The replacement instructions report only returned milestone progress and overdue evidence; they do not infer health labels from missing evidence or the absence of overdue items.

- The public Agent tool-policy version is incremented so durable runs created under the prior tool catalog fail closed rather than appearing compatible with a changed policy.

## Business value

Eliminates a retired, misleading aggregate health surface and prevents agents or UI clients from presenting stale readiness scores, ratings, blocker rankings, or unsupported portfolio judgments. Users retain factual, bounded milestone and overdue evidence through the supported workflows.

## Estimated manual effort

Estimated time to complete this work without AI: 1 working day.

## Test Plan

- [x] Full Rhodes Worker test suite.

- [x] Focused Convex parity, public-agent, contract, site-tool, and Rhodes card tests.

- [x] Chat, Worker, and contracts typechecks.

- [x] Biome, architecture-boundary, Convex-path, read-bound, test-architecture, and git diff --check validation.

- [x] Read-only seven-lane adversarial review with independent verification of accepted findings.

- [ ] Run deployed MCP discovery/parity checks after the normal release deployment; no deployment or external mutation was performed for this PR.

## Summary

Splits the dbt GitHub Action (.github/workflows/dbt.yml) so the two credentialed writers run different command shapes per environment, per issue #1283. Today both jobs issue the identical dbt build --select path:models path:seeds, interleaving all tests into the DAG in both environments — wrong in opposite directions.

## Changes

- scheduled-build (production) — added --exclude-resource-type test to the existing dbt build step. The hourly refresh now runs models and seeds only, zero tests, so a tripped data-quality assertion never stops the refresh. Kept build (not run) so seeds stay ordered ahead of the models that select from them.

- pr-build (dev) — split the single dbt step into two steps against the same resolved secret: a models/seeds build --exclude-resource-type test step, then a distinct, required dbt test step. Both pass --vars "{pr_number: N}" so tests read the pr<N>_-prefixed objects the build just wrote. No continue-on-error — a failing test fails the check, and the pr<N>_ objects still exist for inspection.

- dbt/Dockerfile.dbt — updated CMD to the production shape (build … --exclude-resource-type test).

- Docs — refreshed the workflow header comment and added a CI section to dbt/README.md, both stating plainly that production runs no tests.

- Untouched: pr-parse-only (fork PRs) and pr-cleanup.

## Verification

- .github/workflows/dbt.yml parses (yaml.safe_load).

- Dockerfile CMD is valid JSON exec-form.

- Diff re-read against every Acceptance Criterion in #1283.

Closes #1283

## Summary

Replaces the hand-maintained sis_campus_program_map.csv seed with a derived dimension, int_school_identity (one row per HubSpot program), that maps every system's school identity — SIS campus_id, Finalsite site, HubSpot program object id, HubSpot program_code — to one user-friendly label (display_name, the HubSpot program display name). Both the Enrollments report (mart_enrollment_dtl) and the Admissions Pipeline report (mart_admissions_pipeline_dtl) consume it, so the two reports name the same school identically. The mapping is read from SIS, so the report self-heals: adding a hubspot_program external id in SIS admits a campus on the next run with no repo change.

Closes #1284.

## What changed (following the issue's 8 steps)

1. all_program declared as an educrm source; new stg_educrm_all_program (pure 1:1 projection, equal_rowcount test).

2. campus_external_ids declared as a sis source; new stg_sis_campus_external_id (soft-delete filter, casts, no joins) with a (campus_id, system) uniqueness test. The source envelope has no surrogate id, so the grain is keyed on (campus_id, system).

3. int_school_identity in the new intermediate/shared/ folder. Grain: one row per HubSpot program; resolves display_name from all_program.program_name on the numeric hubspot_program_id, never on a name. Columns: hubspot_program_id (bigint), hubspot_program_code, sis_campus_id, finalsite_site, display_name — only display_name is unprefixed.

4. Drop rule in stg_sis_campus — an EXISTS semi-join so a campus that resolves to no HubSpot program never reaches int_campus/axis/grid/mart. Documented in the header as a second knowing rule-5 exception with the removal trigger named (the SIS-name cutover).

5. mart_enrollment_dtl repointed at the dimension: the program_map CTE reads int_school_identity, the LEFT JOINs become INNER (every campus reaching the mart resolves by construction), and has_hubspot_program is gone.

6. mart_admissions_pipeline_dtl — all three arms publish program_name from the dimension. The Finalsite arm INNER-joins on finalsite_site (drops unresolvable tenants, symmetric with the enrollment drop); the EduCRM arms LEFT-join on hubspot_program_code (null-tenant pre-launch leads are kept). Existing campus_name/campus_long_name/program_code are unchanged — the label is added, not renamed.

7. Deleted sis_campus_program_map.csv, assert_sis_campus_program_map_covers_axis.sql, assert_sis_campus_program_map_hubspot_resolves.sql. Repointed assert_sis_deposit_overlay_unmatched_within_threshold.sql's Alpha-program bound at the dimension.

8. New WARN test assert_sis_campus_unresolved_hubspot_program.sql (dropped-campus visibility, shape modelled on assert_admissions_pipeline_tenant_coverage). Updated assert_admissions_pipeline_reconciles.sql so the Finalsite expected arm applies the same drop filter.

The published mart column names (program_code, program_name) are unchanged — the frozen contract with the sync and Convex. Only the internal derivation changed.

### One extra change: connect_timeout 30 → 120

redshift_connector applies connect_timeout as the socket read timeout, so it bounds every query. Removing the covers_axis blocker re-enables mart_enrollment_dtl, whose dense factless anti-join over the int_enrollment_cohort view chain legitimately runs ~40s against current data — so a 30s timeout left it red on a timeout (proven locally: it builds in ~36–39s with the timeout raised; the query is not a SQL error). Raised to 120s in profiles.yml.docker (CI) and profiles.yml.example (local). This is pre-existing cost, not a regression from this PR — the change *reduces* the grid from 67 to 53 campuses.

## Verification

Full dbt build --select path:models path:seeds --vars '{pr_number: N}' run against the real Redshift warehouse: PASS=289, WARN=2, ERROR=0, SKIP=0.

- The 2 WARNs are the new assert_sis_campus_unresolved_hubspot_program (14 dropped campuses) and the pre-existing assert_admissions_pipeline_tenant_coverage (6, data drift — both its inputs are untouched by this PR).

- Acceptance checks against the built objects: enrollment mart has 0 null program_code/program_name across 53 campuses (was 67); Nova Academy Austin → Nova Austin, Nova Academy Bastrop → Nova Bastrop; cross-mart program_name consistency = 0 mismatches; all three pipeline arms 100% labelled; the Finalsite arm drops exactly the two founders tenants (32 rows).

- pnpm typecheck, pnpm biome check, pnpm lint:boundaries: all clean (no TS files touched).

## Open question for sign-off (from the issue, unchanged by this PR)

Dropping unresolvable campuses removes real enrollments at a few campuses (the issue's "22 students", chiefly the two Founders entities and Alpha Orlando). This is by design and surfaced by the new WARN test; adding the eight hubspot_program bindings in SIS (an out-of-repo action listed in the issue) returns those campuses automatically on the next run. Not a code dependency.

🤖 Generated with [Claude Code](https://claude.com/claude-code)