Patrol

high · high confidence · architecture-templates-builtins

The isolation boundary passes the requested command as an argv vector after the image name, but the image entrypoint is `bash -lc`. Docker therefore invokes `bash -lc <argv[0]> <argv[1]> ...`; Bash treats only `argv[0]` as the command string and assigns the remaining elements to shell positional parameters instead of executing them. A gate request such as `bundle exec rake test` consequently runs only `bundle`, while `sh -c '...'` runs only `sh`.

medium · high confidence · architecture-templates-builtins-part-7

Pipeline.call checks a planner result only for provider-limit text and then treats any non-empty plan file as success. If a planner times out or exits non-zero after writing a partial plan, the executor still runs and its successful diff is returned with status generated, so the benchmark can score a candidate whose required planning phase failed.

PR #1015 · 6 fix · 7 discuss · 0 pending actions

Job completion does not mean every proposed fix shipped; the recorded action outcomes and selected theses below are the captured evidence. The available evidence includes 3 selected theses from 76 inspected features.

• fix the ad-hoc review command compensates for a lossy Worktree boundary by classifying pointer failures itself and independently mirroring Babysitter's orphan-worktree cleanup policy
  Inspect proposal and evidence

  Proposed refactor: make Hive::Worktree's internal lifecycle API authoritative for typed pointer inspection and idempotent orphan cleanup with residue reporting, then have AdhocReview and Babysitter delegate while preserving CLI output, warnings, cleanup order, error envelopes, and pinned reuse behavior

  Cost of the current design: worktree lifecycle decisions must be synchronized across the command, Worktree, and Babysitter boundaries; the resulting caller branching distinguishes collapsed pointer states, while comments document prior wrong-cause diagnostics and a cleanup gap that wedged the first retry

  Recorded confidence: medium

  lib/hive/commands/adhoc_review.rb

  elsif File.exist?(File.join(folder, "worktree.yml"))

  after Hive::Worktree.read_pointer returns nil, this caller probes the filesystem to distinguish a missing pointer from an unreadable or pathless pointer

  lib/hive/commands/adhoc_review.rb:250

  mirrors Hive::Babysitter::Worktree#remove_existing!

  the command explicitly mirrors another boundary's cleanup policy, and the adjacent comment records that incomplete cleanup previously caused the first retry to fail

  lib/hive/commands/adhoc_review.rb:299

  def remove_orphan_worktree!(project_root, slug, pr_number)

  the command directly owns the sequence for worktree removal, pruning, branch deletion, ref deletion, and directory cleanup

  Expected architecture effects

  • AdhocReview no longer decides whether a nil pointer result means missing, unreadable, or pathless; Hive::Worktree owns that classification
  • one Worktree-owned cleanup policy replaces independent command and Babysitter decisions about removing worktree registration, branch, fetch ref, and directory residue

  Required validation: run the configured test command with focused coverage for missing, unreadable, and pathless pointers; orphan cleanup residue; rollback preserving the original error; JSON envelopes; and unchanged pinned task reuse

• fix ProviderRouting::Router selects a candidate, but Attempts::Dispatcher repeats the first-eligible search from the decision's diagnostic candidate collection to recover the selected health evaluation
  Inspect proposal and evidence

  Proposed refactor: have Router attach its chosen Candidate to Decision as internal selected-candidate state and make Dispatcher consume that state, while preserving Decision#to_h, persisted records, statuses, reasons, and dispatch outcomes

  Cost of the current design: the admission boundary depends on candidate ordering and eligibility internals, so changes to routing selection require synchronized edits in both Router and Dispatcher

  Recorded confidence: high

  lib/hive/provider_routing/router.rb:19

  selected = candidates.find(&:eligible?)

  Router makes the authoritative first-eligible candidate selection

  lib/hive/attempts/dispatcher.rb:265

  selected = route_decision.candidates.find(&:eligible?)

  the admission caller repeats Router's selection against a diagnostic collection before performing health admission

  Expected architecture effects

  • removes Attempts admission's ownership of the first-eligible candidate choice so Router is the sole selection owner
  • removes Attempts admission's dependency on the ordering and eligibility semantics of Decision#candidates

  Required validation: run the configured provider-routing admission, recovery, and replay checks and verify persisted decision hashes and attempt routing payloads remain identical

• fix the reviewer adapter, review orchestrator, triage, and browser-test boundaries independently decide whether a provider requires Claude-specific session-aware launching
  Inspect proposal and evidence

  Proposed refactor: make a provider-neutral review-session capability and launch strategy authoritative beside AgentProfile, then have reviewer execution, orchestration, triage, and browser testing delegate to it while preserving existing Claude tmux behavior, non-Claude headless behavior, errors, timeouts, and output contracts

  Cost of the current design: the provider-to-launch-mode policy is repeated across four boundaries, so changing session support or admitting another session-capable provider requires synchronized edits and keeps generic review code dependent on Claude-specific behavior

  Recorded confidence: high

  lib/hive/reviewers/agent.rb:57

  unless profile.name == :claude

  the generic reviewer adapter directly owns the decision that only the Claude profile may use a shared reviewer session

  lib/hive/stages/review/triage.rb:124

  if profile.name == :claude

  triage independently maps the same provider identity to the Claude-specific launcher instead of delegating launch-mode selection

  lib/hive/stages/review/browser_test.rb:142

  if profile.name == :claude

  browser testing repeats the provider-specific launcher decision in a third boundary

  lib/hive/stages/review.rb:1522

  claude_specs, other_specs = specs.partition { |spec| claude_tmux_reviewer?(cfg, spec) }

  the review orchestrator separately classifies reviewers by Claude-specific session behavior before dispatch

  Expected architecture effects

  • one profile-owned capability decision replaces four mappings from concrete provider identity to review launch mode
  • review-stage callers stop owning Claude-specific launch selection and depend only on the provider-neutral session and launch contract

  Required validation: run the configured tests covering reviewer shared-session rejection and deadlines, mixed-provider partitioning, triage launching, browser-test launching, status handling, and expected-output behavior