Review · grok-ce-code-review-02 · Installable Patrol modules

High

[x] RESOLVED/NO-FIX: Detached module hooks cannot start under durable attempt context (bin/hive:17-58, lib/hive/attempts/context.rb:106-122): install_from_env! always binds argv[1]/argv[2] as a task-stage verb/target, so __module-hook fails task resolution before execution; even if that passed, scrubbed HIVE_ATTEMPT_INTERNAL makes the private-route gate reject every admitted worker.
[x] RESOLVED/NO-FIX: Packaged workflow hook targets remain execution-disabled (lib/hive/modules/target_executor.rb:46-47,276-278): the production default workflow_runner always raises WorkflowAdmissionUnavailable, so a plan-required declarative target kind cannot complete after activation.
[x] RESOLVED/NO-FIX: Legacy hive patrol / hive refactor-patrol still invoke engines directly (lib/hive/commands/patrol.rb:49, lib/hive/commands/refactor_patrol.rb:128): public aliases never enter module admission, ownership mode, or grant snapshots, violating U7/U8/R13 post-cutover forwarding.
[x] RESOLVED/NO-FIX: First-party capability grants are preflight-only (lib/hive/modules/adapters/patrol.rb:83-98, architecture_patrol.rb:73-95): after a few CapabilityContext#require_* checks, unrestricted legacy engines and gateways run without sink-level grant enforcement (R5).
[x] RESOLVED/NO-FIX: External-command sandboxing does not implement the grant model (lib/hive/modules/target_executor.rb:20-31): bwrap bind-mounts the entire host read-only and always disables network, so ungranted files are readable and approved write/network grants cannot work.
[x] RESOLVED/NO-FIX: Granted command secrets can be persisted in attempt logs (lib/hive/modules/target_executor.rb:144-155 + supervisor stdio capture): secret bindings enter the child environment while stdout/stderr are copied unredacted into durable attempt log references.
[x] RESOLVED/NO-FIX: Production shadow evidence has no legacy producer (lib/hive/modules/adapters/patrol.rb:158-166, daemon schedulers): adapters only consume payload.legacy_mutator_capture, and no scheduler/reconciler publishes it, so comparable counts stay zero and KTD8/R15 evidence can never accumulate.
[x] RESOLVED/NO-FIX: Module admission can race migration ownership transitions (lib/hive/modules/migration/coordinator.rb:28-54, lib/hive/modules/dispatcher.rb:47): quiescence uses a precomputed attempt snapshot and module dispatch holds only the modules lock, not migration admission, allowing a newly admitted attempt to cross cutover/rollback epochs.
[x] RESOLVED/NO-FIX: Rollback permits immediate recutover on stale shadow evidence (lib/hive/modules/migration/patrols.rb:199,234-262,343-359): rolled_back is a valid cutover source without resetting shadow_started_at or purging prior comparable records, so old eligible evidence can re-authorize a restored generation.
[x] RESOLVED/NO-FIX: CLI reinstall is impossible after uninstall (lib/hive/commands/module/lifecycle.rb:51-68): install loads tombstones via include_tombstone: true and treats any truthy selection as “already installed,” blocking AE6 reinstall despite store-layer reinstall support.
[x] RESOLVED/NO-FIX: Activation finalization is not crash-atomic across git commit and cleanup (lib/hive/module_package/managed_store.rb:66-79, lib/hive/commands/module/base.rb:124-135): transaction.commit! then commit_state then cleanup; a post-commit cleanup failure rolls disk selection back via @committed_snapshot after hive-state was already committed.
[x] RESOLVED/NO-FIX: Attempt admission and launch-decision persistence are not crash-atomic (lib/hive/modules/dispatcher.rb:71-86): a crash after dispatch_module_hook accepts work but before persist_decision recovers the real launch as duplicate/terminal_replay instead of an immutable launch receipt (R10).
[x] RESOLVED/NO-FIX: Required R15 rollout proof is absent (docs/dogfood-reports/installable-patrol-modules.md): status is blocked-not-delivery-evidence with 0 comparable decisions, no seven-day window, no cutover/rollback drill, and no hosted exact-head merge-ready proof required by DoD.
[x] AUTO-FIX: Module E2E acceptance still bypasses the private worker path (test/e2e/lib/module_scenario_support.rb): scenarios use ManagedStore/Preview helpers and RecordingLauncher, never exercising catalog consent, CLI/Web apply, authenticated __module-hook, or first-party adapters end-to-end (AE1–AE8).
[x] RESOLVED/NO-FIX: Reviewed head is behind origin/main by three commits while carrying this feature stack: exact-head green hosted gates and current-base merge-readiness required by R15/AE8 cannot hold on the present tip.

Medium

[x] RESOLVED/NO-FIX: Catalog rejection deletes caller-owned destination contents (lib/hive/module_package/catalog_client.rb:40-69): the broad rescue rm_rfs destination even when the failure was a pre-existing non-empty directory rejected before materialization.
[x] RESOLVED/NO-FIX: Migration JSON failures are labeled with success-only schemas (lib/hive/commands/module.rb:47-54,126-134): error envelopes use hive-module-migration / hive-module-migration-report, which require success fields clients cannot treat as error contracts.
[x] RESOLVED/NO-FIX: Every daemon tick rescans full event and decision histories (lib/hive/modules/daemon_runtime.rb:69-91): idle dispatch work grows as events × modules × hooks × journal lookups over unbounded retained ledgers.
[x] RESOLVED/NO-FIX: Command-bearing modules activate without validating sandbox runtime (lib/hive/modules/target_executor.rb:55-70): health checks accept command targets without requiring bwrap/platform support, so activation succeeds and first execution hard-fails later.
[x] RESOLVED/NO-FIX: Operator docs still claim the reserve-to-spawn ownership barrier is missing (docs/modules.md:157-158): pass-1 code already holds migration admission through reservation and child registration, so the stated blocker is stale and can mislead cutover operators.

Nit

[x] RESOLVED/NO-FIX: Canonical agent guidance does not pin the structured migration diagnostic (skills/hive/references/workflow-actions.md): hive module migration status --json is not listed with the other read-only module --json surfaces used for agent recovery.