Task: 11.4
Policy: eve.engineering-review.v1 / 1.0.0
Prepared: 2026-09-12
Admission: BLOCKED BY TASK 4.8
Decision#
The repository now has an executable, fail-closed preparation contract for an independent engineering review and verification lane. It does not close Task 11.4 and it does not claim that a live independent service reviewed this change. The task's declared security dependency, Task 4.8, remains open. Task 11.11 separately owns authenticated persistence and binding this contract into the real fleet lifecycle.
The policy composes with the canonical ReviewPackageSchema; it does not
replace that shared review workflow. The lane projection must reference an
approved evidence_pack review package and the review, security, privacy,
accessibility, and release-gate stages. A TypeScript integration test resolves
the actual @oshun/contracts/common exports, accepts the projected vocabulary,
and proves that the small projection cannot masquerade as a complete canonical
review package.
Attributed separation#
Three signed statements are required:
- the implementer binds completion to the exact subject and evidence manifest;
- an independent reviewer binds an approved eight-dimension review to that completion and the canonical review-package projection; and
- an independent verifier recomputes direct results for every requirement and plan row, then binds those results to the subject, evidence, and review.
All statements use Ed25519. Actor IDs, key IDs, and normalized public-key
fingerprints must be pairwise distinct. Reusing the implementer's identity or
key is refused even if the resulting signature is cryptographically valid. A
reviewer may approve the review but cannot grant verified; only the separate
verifier statement carries that outcome. Private keys are generated only in
ephemeral test/probe processes and are never written to retained evidence.
The subject digest covers repository, base and candidate commits, tree and diff digests, goal and plan revisions, changed paths, requirement IDs, plan-row IDs, and impact classification. The review and verification signatures therefore cannot be replayed onto a later commit, narrower scope, or different plan.
Eight review dimensions#
Every review has exactly these ordered dimensions:
| Dimension | Minimum rule |
|---|---|
| behavior | Direct automated behavior evidence; always applicable |
| code quality | Source inspection, static contract, and measured quality evidence; always applicable |
| security | Adversarial attack plus a benign twin sharing one pair ID; always applicable |
| privacy | Data-rights and secret-minimization evidence; always applicable |
| accessibility | Direct evidence, or an evidenced no-UI-impact classification |
| test strength | A red negative control plus its green regression; always applicable |
| migration/backward compatibility | Direct evidence, or an evidenced no-API/no-persistence-impact classification |
| fabricated success | Attack and benign evidence for success-claim substitution; always applicable |
The fabricated-success dimension is source-bound to the existing six-shape
scanner in libs/oshun/workbench-kit/src/success-fabrication.ts. The lane also
rejects machine evidence that claims a pass after a nonzero or unobserved
command, reports a negative control as green, uses a shell string instead of
structured argv, mismatches an artifact digest, retains detected secret
material, or substitutes an earlier dispatch/status/absence for an observed
outcome.
not-machine-checkable is a visible gap, not a successful result. Missing or
indirect evidence leaves its requirement or plan row open. An unresolved
critical or high finding refuses approval.
Proof and controls#
The retained policy defines seven proof classes: source inspection, static contract, automated behavior, security adversarial, privacy/data rights, performance quality, and independent verification. The evaluator's conformance suite uses ephemeral signed fixtures and includes a passing preparation plus negative cases for:
- implementer/reviewer/verifier identity collisions and aliased public keys;
- a missing dimension, requirement, or plan row;
- unpaired security and test controls;
- retained secret material and artifact-digest mismatch;
- accessibility or compatibility scope evasion;
- nonzero success, an unobserved earlier event, and shell-command substitution;
- stale subject binding and rebound review signature;
not-machine-checkablepresented as verified;- an unresolved high finding; and
- bypass of the canonical review-package contract.
The performance receipt measures the complete evaluator, including three Ed25519 signature verifications per evaluation. Its frozen floor is 1,000 evaluations, 100% conformance detection, p95 for a 25-evaluation batch no more than 250 ms, and RSS growth no more than 64 MiB.
Honest boundary#
Passing this preparation proves that the local evaluator, signed fixture protocol, source bindings, schema, and adversarial controls agree. It does not prove that a live independent reviewer made a production decision, that the current workbench persists or authorizes these statements, or that expert human judgment was sound. Those claims remain unavailable until the dependency and lifecycle tasks close. No Task 11.4 closure evidence manifest or gap-matrix artifact mapping is created while admission is blocked.
The preparation evidence also retains and rechecks SHA-256 digests for every source, policy, schema, measurement, audit, and verifier file used by its 62 executions. A log from an earlier implementation therefore cannot be presented as evidence for later source bytes.