[verified] Separate rework intake from publication counter checks

2026-10-13 08:27:25 +00:00
parent e1be0dd526
commit 31ac634585
5 changed files with 194 additions and 23 deletions
@@ -26,7 +26,15 @@ The target file is exactly schema `gitea-agent.rework-input/v1`:

 Use the independently verified current PR head and SHA-256 of the exact fresh Source Issue UTF-8 body. Names/positive integer IDs/digests/field sets are strict; Issue and PR differ. No selected review ID, final rework head, rendered comment, or `expected.json` is required. The schema and explicit provider contract are validated before credentials or network access.

-Two authenticated GET-only captures reuse identity-first native metadata, repository/PR/Issue/author binding, complete bounded pagination, Link provenance, per-review inline/count capability fallback and drift checks. The initial phase also requires the repository's native default branch to match PR base ref, the exact discovery-draft/v2 first line, and exact Source Issue digest. Discovery structural approval, unresolved-question checks and edit authorization are independent upstream requirements, not claims made by this gate.
+Two authenticated GET-only captures reuse identity-first native metadata, repository/PR/Issue/author binding, complete bounded pagination, Link provenance, per-review inline record counts and drift checks. Initial intake requires every review's real inline endpoint; 404/405 counter-only fallback is not allowed, even with a `per_review_or_pr_count` provider declaration. The initial phase also requires the repository's native default branch to match PR base ref, the exact discovery-draft/v2 first line, and exact Source Issue digest. Discovery structural approval, unresolved-question checks and edit authorization are independent upstream requirements, not claims made by this gate.
+
+## Initial collection checks versus publication counter checks
+
+Initial intake validates collected rows, endpoint/pagination provenance, duplicate IDs (including cross-review inline IDs), review-level `comments_count`, record cardinality and the Source Issue comment collection. These remain blocking checks. PR-wide `comments` and `review_comments` projection crosschecks are separate diagnostics, not evidence that a complete collection is missing records and not initial decision blockers. Source Issue `comments` crosschecking is unchanged.
+
+The receipt adds `counter_diagnostics`, with keys `inline`, `pr` and `pr_issue`. Each entry records the declared `field`/`components`, unmodified `observed` value, collection-derived `expected` value, and `status`: `match`, `mismatch`, or `unverified` (missing, negative or non-integer observed counter, including booleans). A match means only that the explicitly declared formula matches this observation; it does not attest deployed-provider semantics or counter freshness. Diagnostics never auto-select a projection, modify raw counts, or grant edit/publication permission. Missing/malformed PR counters do not bypass malformed native records, failed GETs, incomplete lists or drift checks.
+
+Provider schema/version binding and explicit declarations are still required. Rework/no-op/blocked decisions retain their role/head/contract/state rules regardless of diagnostics. `snapshot`/`verify-live` publication readback continues to require strict provider counter crosschecks and its existing explicitly declared fallback; an initial receipt cannot substitute for that verification.

 ## Derived decisions

@@ -69,8 +69,13 @@ automatically detect a mode or choose one to fit observed counters. Both
 policy; per-review counters, complete collection pagination, duplicate IDs and
 record cardinality remain checked.

-`per_review` requires every exact-review comment endpoint. Only the explicit
-`per_review_or_pr_count` capability permits endpoint-unavailable 404/405 fallback.
+`per_review` requires every exact-review comment endpoint. Only publication
+`snapshot`/`verify-live` with an explicit `per_review_or_pr_count` capability
+permits endpoint-unavailable 404/405 fallback. Initial `input-gate` instead requires
+real inline records and rejects this fallback; its PR-wide counter projections are
+recorded as non-blocking `counter_diagnostics`, not used to establish collection
+completeness. See [input-gate.md](input-gate.md) for the phase boundary. Publication
+counter crosschecks, Source Issue protection and review decision rules are unchanged.
 Permission errors, redirects, malformed JSON and conflicting metadata never
 trigger fallback. Fallback uses a fresh PR count, the declared review/inline
 components and complete review `comments_count` records; disagreement is BLOCK.