Review · grok-ce-code-review-01 · Installable Patrol modules

High

[x] RESOLVED/NO-FIX: R15 rollout proof is absent (docs/dogfood-reports/installable-patrol-modules.md): committed report is collecting with 0/0 comparable decisions, no seven-day window, no cutover/rollback drill, and no hosted exact-head merge-ready proof required by R15 / DoD.
[x] RESOLVED/NO-FIX: Shadow parity is self-comparison only (lib/hive/modules/adapters/patrol.rb, architecture_patrol.rb): adapters record the same rationale as both legacy_decision and module_decision and never consume an immutable legacy-mutator capture, so independent parity evidence cannot accumulate.
[x] RESOLVED/NO-FIX: shadow_mode=false without migration state dual-mutates (lib/hive/modules/migration/patrols.rb module_mode): missing migration state returns :mutator when configured shadow is false, while legacy admission still allows :legacy, permitting two external mutators.
[x] RESOLVED/NO-FIX: Cutover ownership is not rechecked at reserve/spawn (lib/hive/daemon/patrol_scheduler.rb candidates/reserve): migration admission is checked only while enumerating candidates, so a pre-cutover reservation can still spawn after module ownership advances.
[x] RESOLVED/NO-FIX: Cutover trusts a saved eligible report without re-scoring evidence (lib/hive/modules/migration/patrols.rb cutover!): only configuration digests are rechecked, so later unexplained differences or duplicate-effect records cannot block an already-marked-eligible report.
[x] RESOLVED/NO-FIX: Multi-module rollback is not atomic/resumable (lib/hive/modules/migration/patrols.rb restore_previous_selections): sequential restore_previous CAS means a partial success plus later failure leaves one module restored and retry rejects the already-restored CAS, fencing both products.
[x] RESOLVED/NO-FIX: Packaged workflow hook execution is unimplemented (lib/hive/modules/target_executor.rb): default workflow_runner always raises module-pinned workflow task admission is unavailable, so a plan-required target kind cannot run in production.
[x] RESOLVED/NO-FIX: Legacy hive patrol / hive refactor-patrol never enter module admission (lib/hive/commands/patrol.rb, refactor_patrol.rb): aliases still invoke legacy engines directly, so post-cutover ownership and grant enforcement are bypassed by the public command surface.
[x] RESOLVED/NO-FIX: First-party adapters re-read live project config outside the reviewed snapshot (lib/hive/modules/adapters/patrol.rb effective_config, architecture adapter same): Config.load merges ambient patrol.* / refactor_patrol.* values, so runtime behavior can change without a new module digest, receipt, or status projection.
[x] RESOLVED/NO-FIX: Capability grants are preflight-only around unrestricted engines (lib/hive/modules/adapters/patrol.rb run_cycle): after a few require_* checks the legacy Patrol/Architecture engines run full side-effect gateways without sink-level grant enforcement.
[x] RESOLVED/NO-FIX: Module command targets inherit ambient secrets and network authority (lib/hive/modules/target_executor.rb CommandRunner): Process.spawn uses the ambient environment with no secret filtering or host confinement despite separate secret/network grant atoms.
[x] RESOLVED/NO-FIX: Private __module-hook worker is unauthenticated (bin/hive, lib/hive/commands/module_hook.rb): unlike attempt supervise, it does not require HIVE_ATTEMPT_INTERNAL, so a persisted run snapshot can be re-executed outside durable supervisor admission.
[x] RESOLVED/NO-FIX: Disable/uninstall races hook admission (lib/hive/modules/dispatcher.rb vs ManagedStore): lifecycle mutation uses the modules mutation lock while dispatch holds only a per-hook lock, so a stale enabled context can admit an attempt after disable/uninstall returns.
[x] RESOLVED/NO-FIX: Activation prunes generations before durable commit completes (lib/hive/module_package/managed_store.rb apply): cleanup_generations_unlocked! runs before transaction.commit!; crash/reconcile after prune restores prior pointers whose previous executable may already be deleted.
[x] RESOLVED/NO-FIX: Same-source configuration updates drop the restore target (lib/hive/module_package/managed_store.rb activation_selection): previous only updates when source_commit changes, so a config-only update cleans up the prior configuration digest that R6 rollback must restore.
[x] RESOLVED/NO-FIX: Reinstall can admit the uninstall interval (lib/hive/module_package/managed_store.rb activation_selection + TriggerEvaluator#stale?): reinstall preserves the tombstone high_water_at from uninstall time, so later occurrences after that watermark become newly admissible.
[x] RESOLVED/NO-FIX: New/changed hooks retain stale cursors and install-time watermark (lib/hive/module_package/managed_store.rb activation_hooks): updates keep old cursors and do not advance high-water for new/changed binding digests, replaying pre-update occurrences against new bindings.
[x] RESOLVED/NO-FIX: Project identity synthesis and daemon backfill disagree (lib/hive/config.rb registry_project_id vs ensure_project_identities!): reads can mint a deterministic UUID while backfill persists a random one, stranding pre-daemon events/outboxes behind project-identity checks.
[x] RESOLVED/NO-FIX: Archive no-op republish conflicts with its durable event (lib/hive/modules/event_publisher.rb task_completed + EventLedger#equivalent?): retries reuse the idempotency key but mint a fresh occurred_at, which the ledger treats as a conflicting payload.
[x] RESOLVED/NO-FIX: Evidence-closure terminal transitions never emit task.completed (lib/hive/commands/stage_action.rb close_with_receipt): successful receipt-backed archive paths return without publish_task_completed, so Patrol's required named-event trigger is skipped.
[x] RESOLVED/NO-FIX: Launch handoff failure advances the cursor as a non-retryable skip (lib/hive/modules/dispatcher.rb evaluation_for_attempt): :deferred/launch_handoff_failed is remapped to concurrency_blocked, cursor advances, and daemon retry reconciliation will not re-admit the occurrence.
[x] RESOLVED/NO-FIX: Module E2E acceptance bypasses production lifecycle and worker paths (test/e2e/lib/module_scenario_support.rb): scenarios call ManagedStore/Preview helpers and a recording launcher, never exercising catalog consent, CLI/Web apply, __module-hook, first-party adapters, retries, or terminal receipts required by AE1–AE8.

Medium

[x] RESOLVED/NO-FIX: Event drain is O(events × modules × hooks × decisions) per tick (lib/hive/modules/daemon_runtime.rb drain_events): every daemon tick rescans the full ledger and re-queries the decision journal for each tuple, so retained history will nonlinearly delay autonomous dispatch.
[x] RESOLVED/NO-FIX: Migration fencing is invisible to status/doctor (lib/hive/modules/doctor.rb, status.rb): corrupt or pending migration state can stop both patrol mutators while the shared operational surfaces still report modules active/healthy.
[x] RESOLVED/NO-FIX: Noninteractive install can bind an empty grant set into a valid receipt (lib/hive/commands/module/lifecycle.rb parse_grants): without --grant choices, install intersects requested permissions with empty current grants, and only interactive mode confirms permission atoms.
[x] AUTO-FIX: Architecture adapter forces daemon/refactor enabled on every load (lib/hive/modules/adapters/architecture_patrol.rb effective_config): ambient disable flags are overridden in-process, diverging from the reviewed module settings and operator project config.

Nit

[x] AUTO-FIX: Dogfood report documents the three cutover blockers but is still present as delivery evidence (docs/dogfood-reports/installable-patrol-modules.md): consider failing machine eligibility hard-closed until live capture, capability sinks, and reserve barriers land, to prevent accidental cutover use of a known-incomplete report.
[x] AUTO-FIX: Workflow target failure message is operator-facing but not mapped to a typed decision reason (lib/hive/modules/target_executor.rb): a health-validated generation can still hard-fail at first hook run with only a generic ConfigError.