[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-rust-review":3,"mdc--ord0qm-key":38,"related-repo-trail-of-bits-rust-review":8544,"related-org-trail-of-bits-rust-review":8642},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":33,"sourceUrl":36,"mdContent":37},"rust-review","perform Rust security code reviews","Performs comprehensive Rust security review for safe\u002Funsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly those with `unsafe`, FFI, or concurrent code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Code Review","code-review",{"name":21,"slug":22,"type":16},"Rust","rust",{"name":24,"slug":25,"type":16},"Code Analysis","code-analysis",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:29.56835",null,541,[32],"agent-skills",{"repoUrl":27,"stars":26,"forks":30,"topics":34,"description":35},[32],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Frust-review\u002Fskills\u002Frust-review","---\nname: rust-review\ndescription: Performs comprehensive Rust security review for safe\u002Funsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly those with `unsafe`, FFI, or concurrent code.\nallowed-tools: Agent AskUserQuestion SendMessage TaskCreate TaskUpdate TaskList Read Write Bash\n---\n\n# Rust Security Review\n\nRuns in the main conversation (invoke via `\u002Frust-review:rust-review`). Orchestrator owns the `Task*` ledger as bookkeeping for retries; workers and judges have no Task tools. Workers and judges are named plugin subagents (`rust-review:rust-review-worker`, `rust-review:rust-review-dedup-judge`, `rust-review:rust-review-fp-judge`); tool sets are declared in `plugins\u002Frust-review\u002Fagents\u002F*.md`. Findings are exchanged via markdown-with-YAML files in a shared output directory.\n\n## When to Use\n\nRust application\u002Flibrary security review: safe\u002Funsafe boundary auditing, memory safety in `unsafe` blocks, concurrency hazards, panic-induced DoS on servers, FFI safety, async-runtime mistakes.\n\n## When NOT to Use\n\n- Pure-C \u002F pure-C++ codebases — use `c-review` instead.\n- Smart contracts (Solana programs \u002F NEAR contracts \u002F Ink!) — use `solana-vulnerability-scanner` or the contract-specific skill.\n- Kernel-mode Rust drivers without userspace allocator — coverage is incomplete; flag as advisory only.\n- Secrets\u002Fkey memory hygiene (zeroization, `Zeroize`\u002F`ZeroizeOnDrop`\u002F`secrecy` usage, lingering stack\u002Fheap copies) — use the `zeroize-audit` skill; rust-review does not cover memory zeroization.\n\n## Subagents\n\n| Subagent type | Purpose | Tool set |\n|---|---|---|\n| `rust-review:rust-review-worker` | Run assigned cluster, write findings | Read, Write, Edit, Bash |\n| `rust-review:rust-review-dedup-judge` | Merge duplicates (runs **first**) | Read, Write, Edit, Glob |\n| `rust-review:rust-review-fp-judge` | FP + severity + final reports (runs **second**) | Read, Write, Edit, Bash |\n\nTools come from each agent's frontmatter at spawn time. The orchestrator's `Task*`\u002F`Agent`\u002F`Bash`\u002Fetc. come from this skill's `allowed-tools`. **Search-tool \u002F `Bash` interaction:** in current Claude Code, an agent granted `Bash` is **not** also granted the dedicated `Glob` **or `Grep`** tools (the calls return `No such tool available`; the harness expects `find`\u002F`grep`\u002F`rg` via `Bash` instead). So only the dedup-judge — the one agent that holds **no** `Bash` — uses `Glob`; the worker, fp-judge, and the orchestrator resolve and search paths with `Read` \u002F `Bash` `find` \u002F `rg` \u002F `grep` \u002F `test -f` instead. Because the cluster\u002Ffinder prompt seeds are written in ripgrep regex syntax (`\\s`, `\\d`, `\\b`), `Bash`-holding agents must run them with **`rg`**. If `rg` is not installed its call fails *loudly* (`command not found`) — fall back to `grep -E` with POSIX classes (`\\s`→`[[:space:]]`, `\\d`→`[[:digit:]]`, drop `\\b`), never a raw-`\\s` `grep` whose *silent* empty becomes a bad `cleared`. Do **not** reintroduce `Glob`\u002F`Grep` into a `Bash`-holding agent's protocol.\n\n---\n\n## Architecture\n\n```\ncoordinator: write context.md → build_run_plan.py → TaskCreate × M\n          → spawn primer (foreground) → spawn M workers (parallel)\n          → classify Phase-7 outcomes + write findings-index.txt\n          → dedup-judge → fp-judge → report safety net (SARIF + REPORT.md) → return REPORT.md\n```\n\nOutput directory contains: `context.md`, `plan.json`, `worker-prompts\u002F`, `findings\u002F`, `findings-index.d\u002F` (per-worker shards), `findings-index.txt`, `coverage\u002F` (per-worker coverage-gate files), `run-summary.md`, `dedup-summary.md`, `fp-summary.md`, `REPORT.md`, `REPORT.sarif`.\n\n**Path convention:** every later phase shells out to `${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002F*.py`, so resolve that variable first to the plugin directory that contains `prompts\u002Fclusters\u002Funsafe-boundary.md` (and `scripts\u002Fbuild_run_plan.py`). Try in order, first hit wins:\n\n1. **Native Claude Code** — `${CLAUDE_PLUGIN_ROOT}`, accepted if `Bash: ls \"${CLAUDE_PLUGIN_ROOT}\u002Fprompts\u002Fclusters\u002Funsafe-boundary.md\"` resolves.\n2. **Codex** — `${CODEX_PLUGIN_ROOT}` (set it the same way if that var is present and resolves the marker).\n3. **Fallback search** — covers Codex installs under `~\u002F.codex`, Claude installs under `~\u002F.claude`, and a local checkout \u002F repo run: `Bash: find ~\u002F.claude ~\u002F.codex . -path '*\u002Fplugins\u002Frust-review\u002Fprompts\u002Fclusters\u002Funsafe-boundary.md' -print -quit 2>\u002Fdev\u002Fnull`. Take the match and strip the trailing `\u002Fprompts\u002Fclusters\u002Funsafe-boundary.md` to get the root (the home dirs are searched before `.` so an installed copy wins over any vendored copy in the audited repo).\n\nSet `RUST_REVIEW_PLUGIN_ROOT` to the resolved root. If all three fail, **abort** with a message naming the roots searched — do not enter Phase 4 with an empty variable (every `python3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002F...\"` call would fail with a confusing path error).\n\n**Scope convention:** keep two scopes separate throughout the run:\n\n- `finding_scope_root` — the user-requested audit subtree. Workers may only file findings whose vulnerable location is inside this subtree.\n- `context_roots` — read-only repo roots\u002Ffiles workers and judges may inspect to verify reachability, callers, wrappers, build flags, mitigations, and threat-model details. Default to `.` unless the user explicitly forbids broader context. Reading context outside `finding_scope_root` is allowed; filing findings there is not.\n\n---\n\n## Rationalizations to Reject\n\n- **\"`unsafe` is rare, so hand-skip the memory-safety cluster.\"** Don't edit the cluster list — set `has_unsafe` accurately in Phase 1 and let `build_run_plan.py` decide. Every memory-safety bug class (UAF, double-free, uninitialized reads, `Vec::set_len`, union UB) requires `unsafe`, so the planner runs the **whole** `memory-safety` cluster when `has_unsafe=true` and correctly omits it when `false` — there is no \"run it anyway.\" The **unsafe-boundary** cluster is different: it has no `requires` and always runs (consolidated; its safety-doc and `repr(C)` hygiene apply to FFI declarations even without visible `unsafe { }` blocks).\n- **\"The compiler caught it.\"** The borrow checker proves absence of safe-code data races; it proves nothing about unsafe blocks, panic reachability, ABBA deadlocks, atomic-load\u002Fstore sequencing, or FFI ABI mismatch.\n- **\"`unwrap()` is fine if it's `\u002F\u002F SAFETY: documented infallible`.\"** `\u002F\u002F SAFETY:` documents `unsafe` operations, not infallibility claims. An `unwrap()` on documented-infallible input is still risky if the documentation is wrong — file as low severity and let the FP judge decide.\n- **\"`has_unsafe=false` so skip the run.\"** Pure safe-Rust crates still have panic-DoS, atomic races, drop-panics, and trait-implementation hazards. Run the always-on clusters.\n- **\"Background spawns parallelize the workers.\"** They do not — `Agent` calls in a single assistant message already run concurrently. `run_in_background=true` defeats the Phase 6a primer cache, so every worker pays full cache-creation (`cache_read_input_tokens=0`) and the ~15 K-token primer is wasted M times. Default: omit `run_in_background` from worker spawns.\n- **\"I'll re-derive the cluster list \u002F paths \u002F pass prefixes inline instead of running `build_run_plan.py`.\"** The script is the only authority for selection and rendering. Paraphrasing it drops fields that the worker self-check requires, producing `worker-N abort: spawn prompt malformed`. Always run the script and `Read plan.json`.\n- **\"The run partially succeeded — I'll just write `REPORT.md` from what completed.\"** Hiding partial runs behind a successful report is a correctness bug. If any Phase-5 cluster task is not `completed`, surface it prominently in `run-summary.md` and the final response.\n- **\"Zero findings — skip Phase 8.\"** Always run both judges and Phase 8b: dedup-judge writes a minimal no-op `dedup-summary.md` on an empty index, fp-judge writes empty `REPORT.md`\u002F`REPORT.sarif`, and Phase 8b's SARIF generator emits `results: []` for the empty case. SARIF consumers depend on a stable artifact set.\n- **\"`Bash: ls README*` is fine for the preflight.\"** Under zsh, an unmatched glob aborts the whole compound command before `2>\u002Fdev\u002Fnull` runs. Use `find` (never fails on no-match) — and not `Glob`, which is unavailable to an agent that also holds `Bash`.\n\n---\n\n## Orchestration Workflow\n\nRun these phases **in the main conversation**.\n\n### Phase 0: Parameter Collection\n\n**Entry:** skill invoked. **Exit:** `threat_model`, `worker_model`, `severity_filter` resolved; `scope_subpath` resolved or set to `\".\"`; `finding_scope_root=scope_subpath`; `context_roots` resolved.\n\nThe skill is invoked directly (no command wrapper). Parse any free-text arguments the user passed on the `\u002Frust-review:rust-review` line (e.g. `flamenco only`, `high severity only`, `use haiku`) and pre-fill the answers they imply — then ask for any missing required parameters with **one** `AskUserQuestion` call. Never silently default the required parameters.\n\nRequired parameters:\n\n| Parameter | Values | How to infer from args |\n|---|---|---|\n| `threat_model` | `REMOTE` \u002F `LOCAL_UNPRIVILEGED` \u002F `BOTH` | Words like \"remote\", \"network\", \"attacker\" → `REMOTE`; \"local\", \"unprivileged\" → `LOCAL_UNPRIVILEGED`; otherwise ask. |\n| `worker_model` | `haiku` \u002F `sonnet` \u002F `opus` | Explicit model name in args. Otherwise ask (no silent default). |\n| `severity_filter` | `all` \u002F `medium` \u002F `high` | \"all\", \"every\", \"noisy\" → `all`; \"medium and above\" → `medium`; \"high only\", \"criticals only\" → `high`. Otherwise ask — **no silent default**. |\n| `scope_subpath` | repo-relative directory (optional) | Phrases like \"X only\", \"just audit X\u002F\", \"review subdirectory X\" → `src\u002FX\u002F` or the matching subdir. Apply fuzzy matching against top-level subdirectories of the repo. If absent, set `\".\"`; if ambiguous, ask. |\n\nCall `AskUserQuestion` exactly once with only unresolved required parameters (`threat_model`, `worker_model`, `severity_filter`) plus `scope_subpath` only when the user explicitly requested a narrowed scope but it is ambiguous. If the required parameters were all pre-filled and scope is absent or resolved, skip the question.\n\nAfter resolving `scope_subpath`, set `finding_scope_root=\"${scope_subpath:-.}\"`. Set `context_roots=\".\"` by default so workers can verify callers\u002Fbuild settings outside a narrowed subtree without filing out-of-scope findings. If the user explicitly asks to forbid broader context, set `context_roots=\"${finding_scope_root}\"` and note that reachability confidence may be lower.\n\n### Phase 1: Prerequisites\n\n**Entry:** Phase 0 complete. **Exit:** `has_unsafe`, `has_ffi`, `has_concurrency`, `has_async`, `has_packed_repr`, `has_fs_io` flags determined. Abort with a clear message if no `*.rs` files exist under `${finding_scope_root}`.\n\nProbe within `${finding_scope_root:-.}` with the `Bash` commands below (non-empty output ⇒ flag true). The dedicated `Grep`\u002F`Glob` tools are unavailable to this orchestrator because it holds `Bash` — use `grep`\u002F`rg`\u002F`find` via `Bash`. (The probe regexes use `\\s`\u002F`\\b`; if your `grep` lacks GNU `\\s` support, run them with `rg -uu` — which honors `\\s` and still searches ignored files — or, if `rg` is not installed either, replace `\\s`→`[[:space:]]` and drop `\\b`. Widening is safe here: a false-positive capability flag only adds a harmless extra worker, whereas a missed match would skip a whole pass.)\n\n```bash\n# Rust source presence (precondition)\nfind \"${finding_scope_root:-.}\" -name '*.rs' -print -quit\n\n# has_unsafe\ngrep -rlE '\\bunsafe\\s+(extern|fn|impl|trait)\\b|\\bunsafe\\s*\\{' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_ffi\ngrep -rlE 'extern\\s+\"(C|system|stdcall|cdecl|win64|sysv64|aapcs|fastcall|thiscall|vectorcall|efiapi)(-unwind)?\"|\\bextern\\s+fn\\b|extern\\s+\\{|#\\[repr\\((C|transparent)\\b|\\b(CString|CStr)\\b|use\\s+(libc|core::ffi|std::ffi|std::os::raw|cty)|\\blibc::|\\b(bindgen|cbindgen)\\b|\\bc_void\\b' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_concurrency\ngrep -rlE '\\b(std::(thread|sync)|parking_lot::|crossbeam|rayon::|tokio::sync|core::sync::atomic|std::sync::atomic|Atomic[A-Za-z0-9_]*|UnsafeCell|static\\s+mut|unsafe\\s+impl\\s+(Send|Sync)|memmap2::|Mmap(Options|Mut)?|MAP_SHARED|shm_open|mmap\\s*\\(|memfd_create|shared_memory|raw_sync|CreateFileMapping|MapViewOfFile|once_cell|sigaction|signal_hook|nix::sys::signal|libc::signal|libc::sigaction)' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_async\ngrep -rlE '\\basync\\s+(fn|move|\\{)|\\.await\\b|tokio::|async_std::|futures::' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_packed_repr (outer #[repr(...packed...)] and inner #![repr(...packed...)])\ngrep -rlE '#!?\\[repr\\([^]]*packed' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_fs_io (path types \u002F construction)\ngrep -rlE '\\bPathBuf\\b|\\bPath\\b' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_fs_io (fs module and file APIs)\ngrep -rlE '\\bfs::|\\bFile::(open|create)\\b|OpenOptions|\\.exists\\(\\)|\\.metadata\\(|symlink_metadata|read_dir|read_to_string' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n```\n\nAs with the other flags, non-empty output (from either probe) means the flag is true. These detectors are intentionally conservative: when in doubt they set the flag true, because a false-positive flag only costs a harmless extra worker while a false-negative would skip a real pass. `has_fs_io` keys on path types (`PathBuf`\u002F`Path`, which also covers `&Path` parameters and bare `Path::` calls) and filesystem anchors (`fs::`\u002F`File::`\u002F`OpenOptions`\u002F`read_dir`\u002F…) rather than the bare `.join(`\u002F`.push(` calls — path construction is reached via the path-type anchors, so leaving join\u002Fpush out of the gate avoids matching unrelated iterator\u002F`JoinHandle` joins and `Vec::push` that would make the gate fire on nearly every crate.\n\nNote for `Cargo.toml`: also probe for `[dependencies] tokio`, `async-std`, etc., to set `has_async=true` even if the scope subpath has no `.await` yet (library crates often re-export).\n\nAlso probe `Cargo.toml` presence (informational — note in `run-summary.md` whether the audit was over a Cargo workspace, single crate, or loose `.rs` files):\n\n```bash\n# context_roots may be comma-separated (build_run_plan.py treats it as a list),\n# so probe each root rather than passing \"a,b\" as one (nonexistent) path.\necho \"${context_roots:-.}\" | tr ',' '\\n' | while IFS= read -r root; do\n  find \"${root:-.}\" -name 'Cargo.toml' -print -quit\ndone | head -1\n```\n\n### Phase 2: Output Directory\n\n**Entry:** Phase 1 flags set. **Exit:** absolute `output_dir` resolved; `${output_dir}\u002Ffindings\u002F` and `${output_dir}\u002Fcoverage\u002F` exist.\n\nResolve an absolute path for `output_dir` (default: `$(pwd)\u002F.rust-review-results\u002F$(date -u +%Y%m%dT%H%M%SZ)\u002F`):\n\n```bash\nmkdir -p \"${output_dir}\u002Ffindings\" \"${output_dir}\u002Fcoverage\"\n```\n\nThe `coverage\u002F` subdirectory holds per-worker coverage-gate audit files (`coverage\u002Fworker-{N}.md`). Workers write to it instead of embedding the table in their reply — see `agents\u002Frust-review-worker.md` step 5.\n\n### Phase 3: Codebase Context\n\n**Entry:** `${output_dir}` exists. **Exit:** `${output_dir}\u002Fcontext.md` written.\n\nSkim `README.{md,rst,txt}` and any build\u002Fmanifest file (`Cargo.toml`, `Cargo.lock`, `rust-toolchain.toml`, `build.rs`) — preflight with `find` (via `Bash`) before any `Read` (a `Read` on a missing file aborts the turn; `Glob` is unavailable to this orchestrator because it holds `Bash`). Do **not** use `Bash: ls README*` for the preflight: under zsh, an unmatched glob aborts the whole compound command before `2>\u002Fdev\u002Fnull` runs. Use `find . -maxdepth 2 -name 'README*' -o -name 'Cargo.toml' -o -name 'rust-toolchain.toml' -o -name 'build.rs'`, which never fails on no-match.\n\nWrite `${output_dir}\u002Fcontext.md` with: YAML frontmatter (`threat_model`, `severity_filter`, `scope_subpath`, `finding_scope_root`, `context_roots`, `has_unsafe`, `has_ffi`, `has_concurrency`, `has_async`, `has_packed_repr`, `has_fs_io`, `output_dir`, `cargo_manifest` as `workspace`\u002F`single-crate`\u002F`absent` plus path when present), then a short markdown body with five sections — **Purpose** (1-3 sentences), **Scope** (what's in `finding_scope_root`, and that findings outside it are out of scope), **Entry points** (where untrusted data enters: network, files, CLI, IPC, `serde` deserialization, FFI inputs), **Trust boundaries** (sandboxed vs trusted peers vs arbitrary remote), **Existing hardening** (fuzzing harnesses, MIRI runs, `clippy::pedantic`, `cargo-deny`, `cargo-audit`).\n\n### Phase 4: Build Run Plan (deterministic)\n\n**Entry:** capability flags + `threat_model` known; `${output_dir}\u002Ffindings\u002F` exists. **Exit:** `${output_dir}\u002Fplan.json` and `${output_dir}\u002Fworker-prompts\u002F*.txt` written; `M = worker_count` known.\n\nSelection, filtering, path resolution, and spawn-prompt rendering are **delegated to the script** to keep spawn prompts complete and consistent:\n\n```bash\npython3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fbuild_run_plan.py\" \\\n  --plugin-root \"${RUST_REVIEW_PLUGIN_ROOT}\" --output-dir \"${output_dir}\" \\\n  --threat-model \"${threat_model}\" --severity-filter \"${severity_filter}\" \\\n  --scope-subpath \"${finding_scope_root:-.}\" --context-roots \"${context_roots:-.}\" \\\n  --has-unsafe \"${has_unsafe}\" --has-ffi \"${has_ffi}\" \\\n  --has-concurrency \"${has_concurrency}\" --has-async \"${has_async}\" \\\n  --has-packed-repr \"${has_packed_repr}\" --has-fs-io \"${has_fs_io}\" \\\n  --max-passes-per-worker 4\n```\n\nThe script writes `plan.json` + `worker-prompts\u002Fworker-N.txt` + (if `--cache-primer=true`, the default) `worker-prompts\u002Fcache-primer.txt`, and prints a JSON summary on stdout. Exits non-zero on any missing prompt — surface the message and stop. With the default `--max-passes-per-worker 4` the planner selects ~8 clusters → **M ≈ 13 workers** for pure safe Rust (no FFI \u002F concurrency \u002F async; `info-disclosure` is always on), ~10 clusters → **M ≈ 15** for concurrent safe Rust, and ~15 clusters → **M ≈ 23** for full Rust (unsafe + FFI + concurrency + async, plus `input-os-safety` when `has_fs_io` and `layout-safety` when `has_packed_repr`). M is the post-chunk worker count (`plan.workers.length`), so it runs above the cluster count — chunking splits multi-pass **non-consolidated** clusters (e.g. `panic-dos`, `memory-safety`), while the two **consolidated** clusters (`unsafe-boundary`, `concurrency-locking`) are never chunked: one worker each builds the shared inventory once and runs all its phases. `recursion-dos` is one pass per worker. After it returns, `Read plan.json` for the structured selection — never re-derive filtering or paths.\n\n`--max-passes-per-worker N` caps the per-worker pass count. The planner deterministically splits any **non-consolidated** cluster with more than `N` passes into `ceil(K\u002FN)` contiguous chunks; each chunk becomes its own `rust-review-worker` spawn with a `-{i}`-suffixed `cluster_id` (e.g. `panic-dos-1`, `panic-dos-2`). **Consolidated clusters (`unsafe-boundary`, `concurrency-locking`) are exempt — never chunked, regardless of pass count or override — so one worker builds their shared Phase-A inventory once and runs every phase** (chunking a consolidated cluster would force each chunk to rebuild that inventory, which workers skip in practice). The shared prompt-cache prefix and `Cluster prompt:` path are byte-identical across chunks, so the cache primer still warms every worker. Default 4 is calibrated against the heavy-tail clusters in `manifest.json`. Some output-heavy non-consolidated clusters declare a smaller manifest-level `max_passes_per_worker` override so each expensive pass gets its own worker (e.g. `recursion-dos`). Pass `--max-passes-per-worker 0` to disable all chunking, including manifest overrides (one worker per cluster).\n\n### Phase 5: Create Bookkeeping Tasks (orchestrator-internal)\n\n**Entry:** `${output_dir}\u002Fplan.json` exists; `M = plan.workers.length`. **Exit:** `cluster_task_ids[]` created (1:1 with `plan.workers`), all `pending`.\n\nThe task ledger is **orchestrator bookkeeping only** (TUI visibility + Phase-7 retry tracking) — workers never read or write it. One `TaskCreate` per worker, populating `metadata` with `kind=\"cluster\"`, `worker_n`, `cluster_id`, `spawn_prompt_path`, `pass_prefixes`, `attempt=1` — all values copied verbatim from `plan.workers[i]`. Track `cluster_task_ids[]` in `plan.workers` order.\n\n### Phase 6: Spawn workers (optional cache-primer first, then M in parallel)\n\n**Entry:** `cluster_task_ids[]` populated; per-worker spawn prompt files exist at `${output_dir}\u002Fworker-prompts\u002Fworker-N.txt`. **Exit:** all M `Agent` calls — across every wave — have returned (the parallel spawn block(s) completed).\n\n#### Phase 6a: Cache primer (gated on `plan.run.cache_primer`)\n\nA parallel batch from cold start cannot share cache (all M requests dispatch simultaneously, none has finished writing). To warm the prefix, spawn a tiny primer first — **foreground** (background spawns don't share cache with subsequent foreground spawns).\n\nIf `plan.run.cache_primer == true`, `build_run_plan.py` has written `${output_dir}\u002Fworker-prompts\u002Fcache-primer.txt`. Spawn it in its own assistant message: `Read` the file, pass verbatim as `Agent` `prompt` with `subagent_type=rust-review:rust-review-worker`, `model=${worker_model}`, `description=\"Rust review cache primer\"`, no `run_in_background`. The script wrote the prefix byte-identical to `worker-1.txt` through the `\u003Ccontext>` block — that byte-identity is what gives the parallel workers their cache hit. The primer trailer contains `Cache primer: true`, which the worker system prompt treats as a first-class mode and returns exactly `worker-PRIMER abort: cache primer (no analysis performed)` in one text response with zero tool calls. Discard the abort line — Phase 7 ignores it (no `worker-N` id).\n\nForeground spawn already serializes — no `sleep` needed before Phase 6b. Skip Phase 6a entirely if `plan.run.cache_primer == false`.\n\n#### Phase 6b: Spawn M real workers in parallel (one message per wave of ≤16)\n\n> **STOP — read this before composing the spawn message.**\n>\n> Workers MUST be spawned **foreground** (no `run_in_background` field, or `run_in_background=false`).\n> \"Parallel\" here means *one assistant message containing the wave's `Agent` calls* — that already runs them concurrently. (For large `M`, split into consecutive waves of ≤16 calls, one message per wave — see \"Required spawn shape\" below.) **Background spawns are NOT how you parallelize this skill.**\n>\n> Background spawns defeat Phase 6a's primer cache: every worker pays full cache-creation on its first turn (`cache_read_input_tokens=0`), and the primer's ~15 K tokens are wasted M times over. Two real runs had exactly this symptom — every worker started with `first_cr=0`.\n>\n> Before sending the spawn message, audit your draft: every `Agent` call must have **no** `run_in_background` key. If you wrote `run_in_background=true`, delete it.\n\n**Required spawn shape:** emit a single assistant message containing the wave's `Agent` tool invocations — that one message is what runs them concurrently. Sequential spawning (one `Agent` call per message) serializes the review and is also wrong, but that failure is loud (timing); the background-spawn failure is silent (cost).\n\n**Waves when `M` exceeds the per-message cap.** The harness caps the number of `Agent` calls it will dispatch from a single assistant message (observed: ~20 in Claude Code — a real 25-worker run silently kept only the first 20 and had to spawn the remaining 5 in a second message). So when `M > 16`, **plan the waves up front**: split the workers into consecutive waves of **≤16 `Agent` calls**, each wave its own single assistant message. Rules:\n\n- **Within a wave:** all `Agent` calls in **one** message, **foreground** (no `run_in_background`) — identical shape to a single-wave run.\n- **Across waves:** wave _k+1_ is a **separate** message that can only be sent after wave _k_'s `Agent` calls all return (a tool-use message ends the turn). Waves are therefore serialized with respect to each other — that is correct and loud; accept it. Do **not** try to overlap them.\n- **Never** reach for `run_in_background=true` to fit more workers in one message. More *waves*, never background — background defeats the primer cache (see the STOP box) and is the cardinal error this skill guards against.\n- **Cache across waves:** the primer prefix has a ~5-minute cache TTL that refreshes on every hit, so back-to-back waves keep hitting it (the 25-worker run confirmed `cache_read≈14 K` on its second wave). If a later wave will start more than ~5 minutes after the previous one (very large `M` or slow workers), re-spawn the Phase-6a primer in its own message first to re-warm the prefix before that wave.\n- **Balance the waves** (e.g. `M=25` → 13+12, not 20+5) so no wave hugs the cap and the last wave isn't a tiny straggler.\n- After every wave has returned, proceed to Phase 7 with the **full** set of M worker results.\n\nFor each worker `N ∈ [1..M]` (in its assigned wave):\n\n1. `Read: ${output_dir}\u002Fworker-prompts\u002Fworker-N.txt`\n2. Pass the file contents **verbatim** as the `Agent` tool's `prompt` argument:\n\n| Parameter | Value |\n|-----------|-------|\n| `subagent_type` | `rust-review:rust-review-worker` |\n| `model` | `${worker_model}` (haiku \u002F sonnet \u002F opus) |\n| `description` | `Rust review worker N` |\n| `prompt` | the full text of `worker-N.txt` (no edits) |\n| `run_in_background` | **field MUST be omitted, OR set to `false`.** Never `true`. See the foreground-spawn warning above. |\n\nThe spawn prompt is the single authority. Pass it verbatim — every field is required by the worker's self-check; any deviation triggers `worker-N abort: spawn prompt malformed`.\n\n**Anti-patterns to reject:**\n\n- **Passing `run_in_background=true`** (see warning above).\n- **Cramming more than ~16 `Agent` calls into one message** when `M` is large — the harness silently keeps only the first ~20 and drops the rest. Use balanced waves of ≤16, never background spawns, to cover all M.\n- Hand-typing the spawn prompt instead of reading `worker-N.txt`.\n- Inserting Task-related instructions (\"first call TaskList\", \"Assigned task id: \u003CN>\"). Workers have no Task tools.\n- Editing the rendered prompt before passing it (trimming \"redundant\" fields, collapsing pass lists).\n\n### Phase 7: Wait for Workers and Classify Outcomes\n\n**Entry:** all M Phase-6 `Agent` calls have returned. **Exit:** every cluster has either succeeded or been retried up to the cap; `${output_dir}\u002Ffindings-index.txt` written.\n\nThe Phase-6 `Agent` invocations block until each worker returns. Inspect each worker's return text and apply this classifier in order — first match wins:\n\n| # | Match (in return text) | Outcome | Action |\n|---|---|---|---|\n| 1 | `worker-N complete:` | **provisional success** | Parse the `wrote N finding files` count, then run the artifact validator below before `TaskUpdate` to `completed`. |\n| 2 | `abort: spawn prompt malformed`, `abort: pre-work budget exceeded`, or `abort: TaskList unavailable` (legacy) | **non-retryable orchestrator bug** | Stop the run, surface the abort + spawn-prompt path. Re-running the same prompt repeats the failure — pre-work-budget exhaustion always means the worker couldn't pass its self-check, which a retry won't fix. |\n| 3 | other `worker-N abort:` | **retryable** | Mark `pending`, set `metadata.abort_reason`, `needs_respawn=true`, increment `attempt`. |\n| 4 | `Agent` errored or no `complete:`\u002F`abort:` token | **retryable** | Same as #3 (transient worker crash). |\n\nIf any non-retryable, stop. Otherwise, **before re-spawning, clear each retryable worker's prefix-space on disk** — the Phase-7 index is built from disk, so a crashed attempt's higher-id stragglers (files the replacement never re-emits) would otherwise be resurrected into the report. Loop over the worker's actual `pass_prefixes` (from its task `metadata`), substituting each real prefix for `${pfx}` — do **not** run the command with a literal `PREFIX`:\n\n```bash\n# zsh-safe: `find … -delete` never aborts on no-match (an `rm PREFIX-*.md` glob would).\n# Replace `PREFIX1 PREFIX2` with the worker's actual space-separated pass_prefixes.\nfor pfx in PREFIX1 PREFIX2; do\n  find \"${output_dir}\u002Ffindings\" -maxdepth 1 -type f -name \"${pfx}-*.md\" -delete\ndone\n```\n\nThen re-spawn each `pending` retryable with `attempt \u003C= 2` in one parallel block (cap = 2 attempts per cluster). `attempt` was just incremented to `2` on the first failure, so the guard must admit `2` to allow the single retry — `attempt \u003C 2` would block every retry. A second failure increments to `3`, which fails `\u003C= 2` and ends retries. Replacement workers reuse deterministic finding IDs per prefix, so a cleared prefix-space plus a fresh write yields a consistent shard \u002F coverage \u002F disk set.\n\n#### Sanity-check + write index\n\nFor every provisional `complete:` cluster, validate the worker-owned shard, coverage file, coverage rows, filed IDs, and claimed finding count against `plan.json` before marking the task completed. Run one command per completed worker, or validate multiple workers in one command. Both claimed-count forms below are valid; do not pass bare `worker-N=N` values without either grouping them after a `--claimed-count` flag or repeating the flag.\n\n```bash\npython3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fvalidate_artifacts.py\" \"${output_dir}\u002Fplan.json\" \\\n  --worker worker-N --claimed-count worker-N=\u003Cclaimed_count_from_complete_line>\n```\n\n```bash\npython3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fvalidate_artifacts.py\" \"${output_dir}\u002Fplan.json\" \\\n  --worker worker-1 --worker worker-2 \\\n  --claimed-count worker-1=0 worker-2=3\n```\n\n```bash\npython3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fvalidate_artifacts.py\" \"${output_dir}\u002Fplan.json\" \\\n  --worker worker-1 --worker worker-2 \\\n  --claimed-count worker-1=0 --claimed-count worker-2=3\n```\n\nIf validation exits non-zero, treat the completion as malformed and retryable (classifier row #4): mark the task `pending`, store the validator output in `metadata.abort_reason`, set `needs_respawn=true`, and increment `attempt`. Missing `findings-index.d\u002Fworker-N.txt`, missing `coverage\u002Fworker-N.md`, missing coverage rows, invalid `skipped:` rows, filed IDs absent from the shard or disk, and claimed-count mismatches are all malformed completions. After the retry cap, leave the cluster task incomplete and surface the validator output in `run-summary.md` and the final response. Only validation-clean provisional completions may be `TaskUpdate`d to `completed`.\n\nThen build the index. The canonical index is the set of finding files **actually on disk**, not the shard union — building from disk guarantees that a finding written without a matching shard entry (a worker that crashed between its `Write` and its shard-append, or the single-prefix empty-shard trap the worker prompt warns about) is still picked up by dedup → fp-judge → REPORT\u002FSARIF instead of silently vanishing, and that every index entry resolves to a real file:\n\n```bash\n# Canonical index = every finding file on disk. `find` never fails on no-match\n# (an empty findings\u002F yields an empty index — the unambiguous \"zero findings\"\n# signal). `sort -u` collapses Phase-7 retry duplicates: replacement workers reuse\n# deterministic ids, so the same path appears once.\nfind \"${output_dir}\u002Ffindings\" -maxdepth 1 -type f -name '*.md' 2>\u002Fdev\u002Fnull \\\n  | sort -u > \"${output_dir}\u002Ffindings-index.txt\"\n\n# Reconcile against the per-worker shards: any path on disk but in NO shard is an\n# orphan whose worker failed to record it. It is already in the index above (so it\n# is NOT dropped) — print it so the bookkeeping gap can be surfaced. Non-fatal.\nif [ -d \"${output_dir}\u002Ffindings-index.d\" ]; then\n  # Reconcile by basename (finding ids are unique), so a path-format difference\n  # between the worker `find` and this one (trailing slash, \u002Fvar↔\u002Fprivate\u002Fvar)\n  # cannot manufacture false orphans. Any basename on disk but in no shard is an\n  # orphan whose worker failed to record it.\n  comm -13 \\\n    \u003C(find \"${output_dir}\u002Ffindings-index.d\" -maxdepth 1 -type f -name 'worker-*.txt' -exec awk 1 {} + 2>\u002Fdev\u002Fnull | sed 's#.*\u002F##; \u002F^[[:space:]]*$\u002Fd' | sort -u) \\\n    \u003C(find \"${output_dir}\u002Ffindings\" -maxdepth 1 -type f -name '*.md' 2>\u002Fdev\u002Fnull | sed 's#.*\u002F##' | sort -u)\nfi\n```\n\nThe shards stay the per-worker audit trail (`validate_artifacts.py` checks them) and the dedup-judge's crash-recovery fallback, but they no longer gate what reaches the pipeline. For each orphan basename the reconcile prints, map its `\u003CPREFIX>` to the owning worker via `plan.json` and note in `run-summary.md` that that worker's shard was incomplete — the finding is already in the index (so it is not lost), but the bookkeeping gap should be visible. Still cross-check the index line count against the sum of `wrote N` worker claims; log mismatches but don't abort.\n\nAfter task updates and index creation, run `TaskList` and write `${output_dir}\u002Frun-summary.md` with:\n\n- resolved parameters (`threat_model`, `severity_filter`, `finding_scope_root`, `context_roots`, capability flags `has_unsafe`\u002F`has_ffi`\u002F`has_concurrency`\u002F`has_async`, Cargo manifest status)\n- worker outcome table (`worker_n`, `cluster_id`, claimed finding count, shard line count, coverage-file path (`coverage\u002Fworker-{N}.md`), task status, retry\u002Fabort state)\n- `findings-index.txt` line count and any mismatch against worker claims\n- judge status once Phase 8 finishes, or the reason a judge was skipped\u002Ffailed\n\nIf any Phase-5 cluster task is not `completed` — **or** any worker returned a `complete:` line carrying the `truncated at hard cap` token (it hit the tool-call cap before searching every pass; its coverage file will show one or more `cleared (NOT SEARCHED — truncated at hard cap)` rows) — include it prominently in `run-summary.md` and the final response. A hard-cap-truncated worker is marked `completed` for ledger purposes but is a **partial** result: do not let that `completed` status hide the incomplete coverage behind a successful report.\n\n**Always run Phase 8 even on zero findings** — both judges short-circuit on an empty index: dedup-judge writes a minimal no-op `dedup-summary.md`, and fp-judge writes empty `REPORT.md`\u002F`REPORT.sarif` so SARIF consumers get a stable artifact set.\n\n### Phase 8: Judge Pipeline (sequential, dedup → fp+severity)\n\n**Entry:** `findings-index.txt` exists. **Exit:** dedup-judge and fp-judge have returned; `dedup-summary.md`, `fp-summary.md`, `REPORT.md`, and ideally `REPORT.sarif` are written.\n\nEach judge's full protocol is its system prompt (`agents\u002Frust-review-{dedup,fp}-judge.md`); spawn prompts pass only per-run variables. Do **not** reference `prompts\u002Finternal\u002Fjudges\u002F` — those files don't exist.\n\n> **STOP — these two judges run in SEQUENCE, not in parallel.** Unlike the Phase-6b workers (which you spawn as M `Agent` calls in *one* message precisely because that runs them concurrently), the judges have a hard data dependency: fp-judge must see the `merged_into` \u002F `also_known_as` annotations dedup-judge writes, and it only skips files already carrying `merged_into`. If you emit both `Agent` calls in one message they run concurrently — fp-judge reads findings before any merge annotations exist, judges every duplicate as a separate primary, and (because `dedup-summary.md` doesn't exist yet) trips its \"dedup did not run\" fallback, producing an inflated, duplicated `REPORT.md`\u002FSARIF.\n>\n> Spawn dedup-judge in its **own** assistant message, wait for its `dedup-judge complete:` (or `abort:`) return, **then** spawn fp-judge in a **separate** message. Before composing the fp-judge spawn, confirm dedup finished — `Bash: test -f ${output_dir}\u002Fdedup-summary.md` must succeed (or you saw the dedup `complete:` token). **Never put both judge `Agent` calls in the same message.**\n\n1. **First message** — `Agent(subagent_type=\"rust-review:rust-review-dedup-judge\", description=\"Dedup judge\", prompt=f\"output_dir: {output_dir}\")`. Wait for its return and classify it (below) before continuing.\n2. **Then, in a separate message** — `Agent(subagent_type=\"rust-review:rust-review-fp-judge\", description=\"FP + severity judge\", prompt=f\"output_dir: {output_dir}\\nsarif_generator_path: {sarif_generator_path}\")` — resolve `sarif_generator_path` to `${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fgenerate_sarif.py`.\n\n**Judge failure handling.** Same shape as Phase 7's classifier, applied to judge return text:\n\n- `… complete:` → **success.**\n- `… abort:` → **non-retryable for that judge.** Surface the abort line plus `ls -l ${output_dir}\u002Ffindings-index.txt`, then **still run Phase 8b** (its SARIF + `REPORT.md` safety net guarantees the artifact set even when a judge aborts — see Phase 8b's \"fp-judge returned, or the run aborted early\" entry), and stop without spawning further judges. \"Stop\" means do not continue the judge pipeline — it does **not** mean skip Phase 8b.\n- No `complete:` (help message \u002F error \u002F question) → **retryable once.** `SendMessage(to=\u003CagentId>, …)` rather than a fresh spawn (the agent already paid the protocol-parse cost). Include the explicit finding paths from `findings-index.txt`. If the second try still fails, surface the transcript and continue to Phase 8b.\n\n### Phase 8b: Report safety net (SARIF + REPORT.md)\n\n**Entry:** fp-judge returned, or the run aborted early. **Exit:** `${output_dir}\u002FREPORT.sarif` and `${output_dir}\u002FREPORT.md` both exist.\n\n```bash\ntest -d \"${output_dir}\u002Ffindings\" && python3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fgenerate_sarif.py\" \"${output_dir}\"\n```\n\nRun the SARIF generator unconditionally whenever `findings\u002F` exists — it is idempotent (full overwrite), emits `results: []` for zero-survivor runs, and handles partial runs (findings without `fp_verdict` are emitted as `LIKELY_TP`, **exempt from the `severity_filter`** since their severity was never judge-validated, and marked `unjudged: true` \u002F `severity_validated: false` with an `[UNVALIDATED SEVERITY — not judged]` message prefix — so an inferred severity guess can never silently drop them under a `medium`\u002F`high` filter). Always overwriting protects against an fp-judge that crashed mid-write and left a corrupt `REPORT.sarif` on disk.\n\nIf the generator prints a `WARNING: skipped N …` line on stdout (it also records `invocations[].properties.skipped_findings` in the SARIF and a `warning` notification per dropped file), one or more finding files were unreadable or had no parseable frontmatter and were **excluded from the report**. This is a dropped result — surface it prominently in `run-summary.md` and the final response with the count and paths, the same way a non-`completed` cluster task is surfaced. Do not let the otherwise-clean SARIF hide the loss.\n\nThen guarantee `REPORT.md` exists. Unlike SARIF (mechanical), `REPORT.md` is the fp-judge's **curated** artifact, so do **not** overwrite a judge-written one. (The fp-judge writes `REPORT.md` with a `Bash` heredoc, not the `Write` tool, because the harness blocks the `Write` tool for subagent report files — do not \"fix\" the judge by re-mandating `Write`. The orchestrator is the main agent and is **not** subject to that block, so its own `Write` below works.) Check for it, and if it is missing (the judge crashed, even its `Bash`-heredoc write failed, or it returned the report as chat text instead of writing the file), **the orchestrator writes `REPORT.md` itself** rather than failing the run:\n\n- If the fp-judge returned the report body in its transcript, `Write` that text verbatim to `${output_dir}\u002FREPORT.md`.\n- Otherwise synthesize it from the on-disk findings: take the survivor primaries (`fp_verdict ∈ {TRUE_POSITIVE, LIKELY_TP}`, no `merged_into`; if the judge never ran, treat a finding with no `fp_verdict` as a survivor) listed in `findings-index.txt`, apply `severity_filter` from `context.md` **to judged survivors only** — unjudged findings (no `fp_verdict`) are included regardless of filter and rendered under an `Unvalidated (severity not judged)` section with a `[UNVALIDATED SEVERITY — not judged]` label, mirroring the SARIF behavior so a strict filter never silently drops them — and `Write` a `REPORT.md` mirroring the fp-judge template — YAML frontmatter (`stage: final-report`, `threat_model`, `severity_filter`, `total_primaries`, `reported_findings`), a severity-distribution table, then one section per reported finding grouped by severity (embed the Description \u002F Code \u002F Data flow \u002F Impact \u002F Recommendation body for CRITICAL\u002FHIGH; reference the finding file for MEDIUM\u002FLOW).\n\nEither way, note in `${output_dir}\u002Frun-summary.md` that `REPORT.md` was orchestrator-synthesized (not judge-authored). Skip the SARIF generator and this check only if `${output_dir}\u002Ffindings\u002F` doesn't exist (Phase 2 failed). After this phase, update `${output_dir}\u002Frun-summary.md` with judge \u002F SARIF \u002F report status.\n\n### Phase 9: Return Report\n\n**Entry:** Phase 8b complete. **Exit:** every item in [Success Criteria](#success-criteria) verified true; `REPORT.md` returned to the caller.\n\nBefore composing the response, walk the [Success Criteria](#success-criteria) checklist below and confirm each bullet against on-disk artifacts (`TaskList` for cluster tasks, `ls`\u002F`Read` for the files). If any criterion fails, surface the failure prominently in the response — do **not** hide a partial run behind a successful report.\n\nThen `Read ${output_dir}\u002FREPORT.md` and return its content to the caller. Append an Artifacts list pointing at `findings\u002F`, `findings-index.txt`, `run-summary.md`, `dedup-summary.md`, `fp-summary.md`, `REPORT.md`, `REPORT.sarif`.\n\n---\n\n## Finding file frontmatter — three stages\n\nAuthoritative schema: `agents\u002Frust-review-worker.md` (\"Finding File Format\"). Three-stage write:\n\n1. **Worker** — base fields (`id`, `bug_class`, `title`, `location`, `function`, `confidence`, `worker`) + seven body sections.\n2. **Dedup-judge** — adds `merged_into` on duplicates, or `also_known_as` + `locations` on primaries that absorbed.\n3. **FP+Severity judge** — adds `fp_verdict` + `fp_rationale` on every primary; on survivors (`TRUE_POSITIVE`\u002F`LIKELY_TP`) also adds `severity`, `attack_vector`, `exploitability`, `severity_rationale`.\n\n## Bug classes \u002F clusters\n\nAuthoritative: `prompts\u002Fclusters\u002Fmanifest.json`. 37 bug classes live in `always`-gated clusters (so the cluster always runs); of those, 35 always fire and 2 — `adversarial-trait` (TRAITADV) and `closure-panic` (CLOSUREPANIC) in `logic-correctness` — additionally carry `requires: has_unsafe`, so they only fire when `has_unsafe=true`. 69 bug classes across all clusters when every conditional gate is enabled. The `memory-safety` cluster is gated on `has_unsafe` (all its bug classes require `unsafe`); PATHJOIN and TOCTOU are gated behind `has_fs_io` via `input-os-safety`, and PACKEDREF lives in the conditional `layout-safety` cluster (`has_packed_repr`); PTREXPOSE stays always-on via the `info-disclosure` cluster. `unsafe-boundary` and `concurrency-locking` are fully consolidated (their sub-prompts are not re-read at runtime).\n\n---\n\n## Success Criteria\n\nThe phase exits already cover most of this; the orchestrator-visible end-state is:\n\n- Every Phase-5 cluster task is `completed` (verify via `TaskList`).\n- `${output_dir}\u002Frun-summary.md` exists and records resolved scope\u002Fcontext, Cargo manifest probe result, worker claims vs index count, task status, and judge\u002FSARIF status.\n- Every primary finding (no `merged_into`) has `fp_verdict` + `fp_rationale`; every survivor (`TRUE_POSITIVE`\u002F`LIKELY_TP`) also has `severity`, `attack_vector`, `exploitability`, `severity_rationale`.\n- `REPORT.md` exists, severity-filtered per `severity_filter` (Phase 8b safety net guarantees this even when the fp-judge fails to write it).\n- `REPORT.sarif` exists (Phase 8b safety net guarantees this).\n",{"data":39,"body":41},{"name":4,"description":6,"allowed-tools":40},"Agent AskUserQuestion SendMessage TaskCreate TaskUpdate TaskList Read Write Bash",{"type":42,"children":43},"root",[44,53,107,114,127,133,205,211,320,659,663,669,681,773,807,903,931,941,980,983,989,1361,1364,1370,1381,1388,1456,1504,1509,1730,1768,1804,1810,1881,2015,2737,2840,2884,2911,3115,3121,3159,3179,3243,3271,3277,3306,3416,3601,3607,3657,3669,3986,4152,4283,4289,4339,4431,4437,4472,4486,4498,4614,4634,4640,4755,4779,4830,4990,5003,5041,5185,5196,5204,5272,5278,5307,5319,5555,5603,5748,5812,5818,5853,5956,6068,6176,6252,6272,6793,6836,6857,6955,7024,7054,7060,7106,7133,7268,7319,7329,7426,7432,7461,7544,7633,7683,7784,7928,7961,7967,7998,8036,8091,8094,8100,8112,8271,8277,8405,8408,8413,8418,8538],{"type":45,"tag":46,"props":47,"children":49},"element","h1",{"id":48},"rust-security-review",[50],{"type":51,"value":52},"text","Rust Security Review",{"type":45,"tag":54,"props":55,"children":56},"p",{},[57,59,66,68,74,76,82,84,90,91,97,99,105],{"type":51,"value":58},"Runs in the main conversation (invoke via ",{"type":45,"tag":60,"props":61,"children":63},"code",{"className":62},[],[64],{"type":51,"value":65},"\u002Frust-review:rust-review",{"type":51,"value":67},"). Orchestrator owns the ",{"type":45,"tag":60,"props":69,"children":71},{"className":70},[],[72],{"type":51,"value":73},"Task*",{"type":51,"value":75}," ledger as bookkeeping for retries; workers and judges have no Task tools. Workers and judges are named plugin subagents (",{"type":45,"tag":60,"props":77,"children":79},{"className":78},[],[80],{"type":51,"value":81},"rust-review:rust-review-worker",{"type":51,"value":83},", ",{"type":45,"tag":60,"props":85,"children":87},{"className":86},[],[88],{"type":51,"value":89},"rust-review:rust-review-dedup-judge",{"type":51,"value":83},{"type":45,"tag":60,"props":92,"children":94},{"className":93},[],[95],{"type":51,"value":96},"rust-review:rust-review-fp-judge",{"type":51,"value":98},"); tool sets are declared in ",{"type":45,"tag":60,"props":100,"children":102},{"className":101},[],[103],{"type":51,"value":104},"plugins\u002Frust-review\u002Fagents\u002F*.md",{"type":51,"value":106},". Findings are exchanged via markdown-with-YAML files in a shared output directory.",{"type":45,"tag":108,"props":109,"children":111},"h2",{"id":110},"when-to-use",[112],{"type":51,"value":113},"When to Use",{"type":45,"tag":54,"props":115,"children":116},{},[117,119,125],{"type":51,"value":118},"Rust application\u002Flibrary security review: safe\u002Funsafe boundary auditing, memory safety in ",{"type":45,"tag":60,"props":120,"children":122},{"className":121},[],[123],{"type":51,"value":124},"unsafe",{"type":51,"value":126}," blocks, concurrency hazards, panic-induced DoS on servers, FFI safety, async-runtime mistakes.",{"type":45,"tag":108,"props":128,"children":130},{"id":129},"when-not-to-use",[131],{"type":51,"value":132},"When NOT to Use",{"type":45,"tag":134,"props":135,"children":136},"ul",{},[137,151,164,169],{"type":45,"tag":138,"props":139,"children":140},"li",{},[141,143,149],{"type":51,"value":142},"Pure-C \u002F pure-C++ codebases — use ",{"type":45,"tag":60,"props":144,"children":146},{"className":145},[],[147],{"type":51,"value":148},"c-review",{"type":51,"value":150}," instead.",{"type":45,"tag":138,"props":152,"children":153},{},[154,156,162],{"type":51,"value":155},"Smart contracts (Solana programs \u002F NEAR contracts \u002F Ink!) — use ",{"type":45,"tag":60,"props":157,"children":159},{"className":158},[],[160],{"type":51,"value":161},"solana-vulnerability-scanner",{"type":51,"value":163}," or the contract-specific skill.",{"type":45,"tag":138,"props":165,"children":166},{},[167],{"type":51,"value":168},"Kernel-mode Rust drivers without userspace allocator — coverage is incomplete; flag as advisory only.",{"type":45,"tag":138,"props":170,"children":171},{},[172,174,180,182,188,189,195,197,203],{"type":51,"value":173},"Secrets\u002Fkey memory hygiene (zeroization, ",{"type":45,"tag":60,"props":175,"children":177},{"className":176},[],[178],{"type":51,"value":179},"Zeroize",{"type":51,"value":181},"\u002F",{"type":45,"tag":60,"props":183,"children":185},{"className":184},[],[186],{"type":51,"value":187},"ZeroizeOnDrop",{"type":51,"value":181},{"type":45,"tag":60,"props":190,"children":192},{"className":191},[],[193],{"type":51,"value":194},"secrecy",{"type":51,"value":196}," usage, lingering stack\u002Fheap copies) — use the ",{"type":45,"tag":60,"props":198,"children":200},{"className":199},[],[201],{"type":51,"value":202},"zeroize-audit",{"type":51,"value":204}," skill; rust-review does not cover memory zeroization.",{"type":45,"tag":108,"props":206,"children":208},{"id":207},"subagents",[209],{"type":51,"value":210},"Subagents",{"type":45,"tag":212,"props":213,"children":214},"table",{},[215,239],{"type":45,"tag":216,"props":217,"children":218},"thead",{},[219],{"type":45,"tag":220,"props":221,"children":222},"tr",{},[223,229,234],{"type":45,"tag":224,"props":225,"children":226},"th",{},[227],{"type":51,"value":228},"Subagent type",{"type":45,"tag":224,"props":230,"children":231},{},[232],{"type":51,"value":233},"Purpose",{"type":45,"tag":224,"props":235,"children":236},{},[237],{"type":51,"value":238},"Tool set",{"type":45,"tag":240,"props":241,"children":242},"tbody",{},[243,265,294],{"type":45,"tag":220,"props":244,"children":245},{},[246,255,260],{"type":45,"tag":247,"props":248,"children":249},"td",{},[250],{"type":45,"tag":60,"props":251,"children":253},{"className":252},[],[254],{"type":51,"value":81},{"type":45,"tag":247,"props":256,"children":257},{},[258],{"type":51,"value":259},"Run assigned cluster, write findings",{"type":45,"tag":247,"props":261,"children":262},{},[263],{"type":51,"value":264},"Read, Write, Edit, Bash",{"type":45,"tag":220,"props":266,"children":267},{},[268,276,289],{"type":45,"tag":247,"props":269,"children":270},{},[271],{"type":45,"tag":60,"props":272,"children":274},{"className":273},[],[275],{"type":51,"value":89},{"type":45,"tag":247,"props":277,"children":278},{},[279,281,287],{"type":51,"value":280},"Merge duplicates (runs ",{"type":45,"tag":282,"props":283,"children":284},"strong",{},[285],{"type":51,"value":286},"first",{"type":51,"value":288},")",{"type":45,"tag":247,"props":290,"children":291},{},[292],{"type":51,"value":293},"Read, Write, Edit, Glob",{"type":45,"tag":220,"props":295,"children":296},{},[297,305,316],{"type":45,"tag":247,"props":298,"children":299},{},[300],{"type":45,"tag":60,"props":301,"children":303},{"className":302},[],[304],{"type":51,"value":96},{"type":45,"tag":247,"props":306,"children":307},{},[308,310,315],{"type":51,"value":309},"FP + severity + final reports (runs ",{"type":45,"tag":282,"props":311,"children":312},{},[313],{"type":51,"value":314},"second",{"type":51,"value":288},{"type":45,"tag":247,"props":317,"children":318},{},[319],{"type":51,"value":264},{"type":45,"tag":54,"props":321,"children":322},{},[323,325,330,331,337,338,344,346,352,354,366,368,373,375,380,382,388,390,401,403,409,411,417,418,424,425,431,433,438,440,445,446,451,453,458,460,466,468,473,474,479,480,485,486,491,492,498,500,506,507,513,514,520,522,527,529,537,539,544,546,552,554,560,562,568,570,575,577,583,584,589,590,596,598,603,605,610,611,616,618,623,625,631,633,637,639,644,645,650,652,657],{"type":51,"value":324},"Tools come from each agent's frontmatter at spawn time. The orchestrator's ",{"type":45,"tag":60,"props":326,"children":328},{"className":327},[],[329],{"type":51,"value":73},{"type":51,"value":181},{"type":45,"tag":60,"props":332,"children":334},{"className":333},[],[335],{"type":51,"value":336},"Agent",{"type":51,"value":181},{"type":45,"tag":60,"props":339,"children":341},{"className":340},[],[342],{"type":51,"value":343},"Bash",{"type":51,"value":345},"\u002Fetc. come from this skill's ",{"type":45,"tag":60,"props":347,"children":349},{"className":348},[],[350],{"type":51,"value":351},"allowed-tools",{"type":51,"value":353},". ",{"type":45,"tag":282,"props":355,"children":356},{},[357,359,364],{"type":51,"value":358},"Search-tool \u002F ",{"type":45,"tag":60,"props":360,"children":362},{"className":361},[],[363],{"type":51,"value":343},{"type":51,"value":365}," interaction:",{"type":51,"value":367}," in current Claude Code, an agent granted ",{"type":45,"tag":60,"props":369,"children":371},{"className":370},[],[372],{"type":51,"value":343},{"type":51,"value":374}," is ",{"type":45,"tag":282,"props":376,"children":377},{},[378],{"type":51,"value":379},"not",{"type":51,"value":381}," also granted the dedicated ",{"type":45,"tag":60,"props":383,"children":385},{"className":384},[],[386],{"type":51,"value":387},"Glob",{"type":51,"value":389}," ",{"type":45,"tag":282,"props":391,"children":392},{},[393,395],{"type":51,"value":394},"or ",{"type":45,"tag":60,"props":396,"children":398},{"className":397},[],[399],{"type":51,"value":400},"Grep",{"type":51,"value":402}," tools (the calls return ",{"type":45,"tag":60,"props":404,"children":406},{"className":405},[],[407],{"type":51,"value":408},"No such tool available",{"type":51,"value":410},"; the harness expects ",{"type":45,"tag":60,"props":412,"children":414},{"className":413},[],[415],{"type":51,"value":416},"find",{"type":51,"value":181},{"type":45,"tag":60,"props":419,"children":421},{"className":420},[],[422],{"type":51,"value":423},"grep",{"type":51,"value":181},{"type":45,"tag":60,"props":426,"children":428},{"className":427},[],[429],{"type":51,"value":430},"rg",{"type":51,"value":432}," via ",{"type":45,"tag":60,"props":434,"children":436},{"className":435},[],[437],{"type":51,"value":343},{"type":51,"value":439}," instead). So only the dedup-judge — the one agent that holds ",{"type":45,"tag":282,"props":441,"children":442},{},[443],{"type":51,"value":444},"no",{"type":51,"value":389},{"type":45,"tag":60,"props":447,"children":449},{"className":448},[],[450],{"type":51,"value":343},{"type":51,"value":452}," — uses ",{"type":45,"tag":60,"props":454,"children":456},{"className":455},[],[457],{"type":51,"value":387},{"type":51,"value":459},"; the worker, fp-judge, and the orchestrator resolve and search paths with ",{"type":45,"tag":60,"props":461,"children":463},{"className":462},[],[464],{"type":51,"value":465},"Read",{"type":51,"value":467}," \u002F ",{"type":45,"tag":60,"props":469,"children":471},{"className":470},[],[472],{"type":51,"value":343},{"type":51,"value":389},{"type":45,"tag":60,"props":475,"children":477},{"className":476},[],[478],{"type":51,"value":416},{"type":51,"value":467},{"type":45,"tag":60,"props":481,"children":483},{"className":482},[],[484],{"type":51,"value":430},{"type":51,"value":467},{"type":45,"tag":60,"props":487,"children":489},{"className":488},[],[490],{"type":51,"value":423},{"type":51,"value":467},{"type":45,"tag":60,"props":493,"children":495},{"className":494},[],[496],{"type":51,"value":497},"test -f",{"type":51,"value":499}," instead. Because the cluster\u002Ffinder prompt seeds are written in ripgrep regex syntax (",{"type":45,"tag":60,"props":501,"children":503},{"className":502},[],[504],{"type":51,"value":505},"\\s",{"type":51,"value":83},{"type":45,"tag":60,"props":508,"children":510},{"className":509},[],[511],{"type":51,"value":512},"\\d",{"type":51,"value":83},{"type":45,"tag":60,"props":515,"children":517},{"className":516},[],[518],{"type":51,"value":519},"\\b",{"type":51,"value":521},"), ",{"type":45,"tag":60,"props":523,"children":525},{"className":524},[],[526],{"type":51,"value":343},{"type":51,"value":528},"-holding agents must run them with ",{"type":45,"tag":282,"props":530,"children":531},{},[532],{"type":45,"tag":60,"props":533,"children":535},{"className":534},[],[536],{"type":51,"value":430},{"type":51,"value":538},". If ",{"type":45,"tag":60,"props":540,"children":542},{"className":541},[],[543],{"type":51,"value":430},{"type":51,"value":545}," is not installed its call fails ",{"type":45,"tag":547,"props":548,"children":549},"em",{},[550],{"type":51,"value":551},"loudly",{"type":51,"value":553}," (",{"type":45,"tag":60,"props":555,"children":557},{"className":556},[],[558],{"type":51,"value":559},"command not found",{"type":51,"value":561},") — fall back to ",{"type":45,"tag":60,"props":563,"children":565},{"className":564},[],[566],{"type":51,"value":567},"grep -E",{"type":51,"value":569}," with POSIX classes (",{"type":45,"tag":60,"props":571,"children":573},{"className":572},[],[574],{"type":51,"value":505},{"type":51,"value":576},"→",{"type":45,"tag":60,"props":578,"children":580},{"className":579},[],[581],{"type":51,"value":582},"[[:space:]]",{"type":51,"value":83},{"type":45,"tag":60,"props":585,"children":587},{"className":586},[],[588],{"type":51,"value":512},{"type":51,"value":576},{"type":45,"tag":60,"props":591,"children":593},{"className":592},[],[594],{"type":51,"value":595},"[[:digit:]]",{"type":51,"value":597},", drop ",{"type":45,"tag":60,"props":599,"children":601},{"className":600},[],[602],{"type":51,"value":519},{"type":51,"value":604},"), never a raw-",{"type":45,"tag":60,"props":606,"children":608},{"className":607},[],[609],{"type":51,"value":505},{"type":51,"value":389},{"type":45,"tag":60,"props":612,"children":614},{"className":613},[],[615],{"type":51,"value":423},{"type":51,"value":617}," whose ",{"type":45,"tag":547,"props":619,"children":620},{},[621],{"type":51,"value":622},"silent",{"type":51,"value":624}," empty becomes a bad ",{"type":45,"tag":60,"props":626,"children":628},{"className":627},[],[629],{"type":51,"value":630},"cleared",{"type":51,"value":632},". Do ",{"type":45,"tag":282,"props":634,"children":635},{},[636],{"type":51,"value":379},{"type":51,"value":638}," reintroduce ",{"type":45,"tag":60,"props":640,"children":642},{"className":641},[],[643],{"type":51,"value":387},{"type":51,"value":181},{"type":45,"tag":60,"props":646,"children":648},{"className":647},[],[649],{"type":51,"value":400},{"type":51,"value":651}," into a ",{"type":45,"tag":60,"props":653,"children":655},{"className":654},[],[656],{"type":51,"value":343},{"type":51,"value":658},"-holding agent's protocol.",{"type":45,"tag":660,"props":661,"children":662},"hr",{},[],{"type":45,"tag":108,"props":664,"children":666},{"id":665},"architecture",[667],{"type":51,"value":668},"Architecture",{"type":45,"tag":670,"props":671,"children":675},"pre",{"className":672,"code":674,"language":51},[673],"language-text","coordinator: write context.md → build_run_plan.py → TaskCreate × M\n          → spawn primer (foreground) → spawn M workers (parallel)\n          → classify Phase-7 outcomes + write findings-index.txt\n          → dedup-judge → fp-judge → report safety net (SARIF + REPORT.md) → return REPORT.md\n",[676],{"type":45,"tag":60,"props":677,"children":679},{"__ignoreMap":678},"",[680],{"type":51,"value":674},{"type":45,"tag":54,"props":682,"children":683},{},[684,686,692,693,699,700,706,707,713,714,720,722,728,729,735,737,743,744,750,751,757,758,764,765,771],{"type":51,"value":685},"Output directory contains: ",{"type":45,"tag":60,"props":687,"children":689},{"className":688},[],[690],{"type":51,"value":691},"context.md",{"type":51,"value":83},{"type":45,"tag":60,"props":694,"children":696},{"className":695},[],[697],{"type":51,"value":698},"plan.json",{"type":51,"value":83},{"type":45,"tag":60,"props":701,"children":703},{"className":702},[],[704],{"type":51,"value":705},"worker-prompts\u002F",{"type":51,"value":83},{"type":45,"tag":60,"props":708,"children":710},{"className":709},[],[711],{"type":51,"value":712},"findings\u002F",{"type":51,"value":83},{"type":45,"tag":60,"props":715,"children":717},{"className":716},[],[718],{"type":51,"value":719},"findings-index.d\u002F",{"type":51,"value":721}," (per-worker shards), ",{"type":45,"tag":60,"props":723,"children":725},{"className":724},[],[726],{"type":51,"value":727},"findings-index.txt",{"type":51,"value":83},{"type":45,"tag":60,"props":730,"children":732},{"className":731},[],[733],{"type":51,"value":734},"coverage\u002F",{"type":51,"value":736}," (per-worker coverage-gate files), ",{"type":45,"tag":60,"props":738,"children":740},{"className":739},[],[741],{"type":51,"value":742},"run-summary.md",{"type":51,"value":83},{"type":45,"tag":60,"props":745,"children":747},{"className":746},[],[748],{"type":51,"value":749},"dedup-summary.md",{"type":51,"value":83},{"type":45,"tag":60,"props":752,"children":754},{"className":753},[],[755],{"type":51,"value":756},"fp-summary.md",{"type":51,"value":83},{"type":45,"tag":60,"props":759,"children":761},{"className":760},[],[762],{"type":51,"value":763},"REPORT.md",{"type":51,"value":83},{"type":45,"tag":60,"props":766,"children":768},{"className":767},[],[769],{"type":51,"value":770},"REPORT.sarif",{"type":51,"value":772},".",{"type":45,"tag":54,"props":774,"children":775},{},[776,781,783,789,791,797,799,805],{"type":45,"tag":282,"props":777,"children":778},{},[779],{"type":51,"value":780},"Path convention:",{"type":51,"value":782}," every later phase shells out to ",{"type":45,"tag":60,"props":784,"children":786},{"className":785},[],[787],{"type":51,"value":788},"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002F*.py",{"type":51,"value":790},", so resolve that variable first to the plugin directory that contains ",{"type":45,"tag":60,"props":792,"children":794},{"className":793},[],[795],{"type":51,"value":796},"prompts\u002Fclusters\u002Funsafe-boundary.md",{"type":51,"value":798}," (and ",{"type":45,"tag":60,"props":800,"children":802},{"className":801},[],[803],{"type":51,"value":804},"scripts\u002Fbuild_run_plan.py",{"type":51,"value":806},"). Try in order, first hit wins:",{"type":45,"tag":808,"props":809,"children":810},"ol",{},[811,837,854],{"type":45,"tag":138,"props":812,"children":813},{},[814,819,821,827,829,835],{"type":45,"tag":282,"props":815,"children":816},{},[817],{"type":51,"value":818},"Native Claude Code",{"type":51,"value":820}," — ",{"type":45,"tag":60,"props":822,"children":824},{"className":823},[],[825],{"type":51,"value":826},"${CLAUDE_PLUGIN_ROOT}",{"type":51,"value":828},", accepted if ",{"type":45,"tag":60,"props":830,"children":832},{"className":831},[],[833],{"type":51,"value":834},"Bash: ls \"${CLAUDE_PLUGIN_ROOT}\u002Fprompts\u002Fclusters\u002Funsafe-boundary.md\"",{"type":51,"value":836}," resolves.",{"type":45,"tag":138,"props":838,"children":839},{},[840,845,846,852],{"type":45,"tag":282,"props":841,"children":842},{},[843],{"type":51,"value":844},"Codex",{"type":51,"value":820},{"type":45,"tag":60,"props":847,"children":849},{"className":848},[],[850],{"type":51,"value":851},"${CODEX_PLUGIN_ROOT}",{"type":51,"value":853}," (set it the same way if that var is present and resolves the marker).",{"type":45,"tag":138,"props":855,"children":856},{},[857,862,864,870,872,878,880,886,888,894,896,901],{"type":45,"tag":282,"props":858,"children":859},{},[860],{"type":51,"value":861},"Fallback search",{"type":51,"value":863}," — covers Codex installs under ",{"type":45,"tag":60,"props":865,"children":867},{"className":866},[],[868],{"type":51,"value":869},"~\u002F.codex",{"type":51,"value":871},", Claude installs under ",{"type":45,"tag":60,"props":873,"children":875},{"className":874},[],[876],{"type":51,"value":877},"~\u002F.claude",{"type":51,"value":879},", and a local checkout \u002F repo run: ",{"type":45,"tag":60,"props":881,"children":883},{"className":882},[],[884],{"type":51,"value":885},"Bash: find ~\u002F.claude ~\u002F.codex . -path '*\u002Fplugins\u002Frust-review\u002Fprompts\u002Fclusters\u002Funsafe-boundary.md' -print -quit 2>\u002Fdev\u002Fnull",{"type":51,"value":887},". Take the match and strip the trailing ",{"type":45,"tag":60,"props":889,"children":891},{"className":890},[],[892],{"type":51,"value":893},"\u002Fprompts\u002Fclusters\u002Funsafe-boundary.md",{"type":51,"value":895}," to get the root (the home dirs are searched before ",{"type":45,"tag":60,"props":897,"children":899},{"className":898},[],[900],{"type":51,"value":772},{"type":51,"value":902}," so an installed copy wins over any vendored copy in the audited repo).",{"type":45,"tag":54,"props":904,"children":905},{},[906,908,914,916,921,923,929],{"type":51,"value":907},"Set ",{"type":45,"tag":60,"props":909,"children":911},{"className":910},[],[912],{"type":51,"value":913},"RUST_REVIEW_PLUGIN_ROOT",{"type":51,"value":915}," to the resolved root. If all three fail, ",{"type":45,"tag":282,"props":917,"children":918},{},[919],{"type":51,"value":920},"abort",{"type":51,"value":922}," with a message naming the roots searched — do not enter Phase 4 with an empty variable (every ",{"type":45,"tag":60,"props":924,"children":926},{"className":925},[],[927],{"type":51,"value":928},"python3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002F...\"",{"type":51,"value":930}," call would fail with a confusing path error).",{"type":45,"tag":54,"props":932,"children":933},{},[934,939],{"type":45,"tag":282,"props":935,"children":936},{},[937],{"type":51,"value":938},"Scope convention:",{"type":51,"value":940}," keep two scopes separate throughout the run:",{"type":45,"tag":134,"props":942,"children":943},{},[944,955],{"type":45,"tag":138,"props":945,"children":946},{},[947,953],{"type":45,"tag":60,"props":948,"children":950},{"className":949},[],[951],{"type":51,"value":952},"finding_scope_root",{"type":51,"value":954}," — the user-requested audit subtree. Workers may only file findings whose vulnerable location is inside this subtree.",{"type":45,"tag":138,"props":956,"children":957},{},[958,964,966,971,973,978],{"type":45,"tag":60,"props":959,"children":961},{"className":960},[],[962],{"type":51,"value":963},"context_roots",{"type":51,"value":965}," — read-only repo roots\u002Ffiles workers and judges may inspect to verify reachability, callers, wrappers, build flags, mitigations, and threat-model details. Default to ",{"type":45,"tag":60,"props":967,"children":969},{"className":968},[],[970],{"type":51,"value":772},{"type":51,"value":972}," unless the user explicitly forbids broader context. Reading context outside ",{"type":45,"tag":60,"props":974,"children":976},{"className":975},[],[977],{"type":51,"value":952},{"type":51,"value":979}," is allowed; filing findings there is not.",{"type":45,"tag":660,"props":981,"children":982},{},[],{"type":45,"tag":108,"props":984,"children":986},{"id":985},"rationalizations-to-reject",[987],{"type":51,"value":988},"Rationalizations to Reject",{"type":45,"tag":134,"props":990,"children":991},{},[992,1101,1111,1157,1174,1215,1246,1278,1316],{"type":45,"tag":138,"props":993,"children":994},{},[995,1007,1009,1015,1017,1023,1025,1031,1033,1038,1040,1045,1046,1052,1054,1060,1062,1068,1070,1075,1077,1083,1085,1091,1093,1099],{"type":45,"tag":282,"props":996,"children":997},{},[998,1000,1005],{"type":51,"value":999},"\"",{"type":45,"tag":60,"props":1001,"children":1003},{"className":1002},[],[1004],{"type":51,"value":124},{"type":51,"value":1006}," is rare, so hand-skip the memory-safety cluster.\"",{"type":51,"value":1008}," Don't edit the cluster list — set ",{"type":45,"tag":60,"props":1010,"children":1012},{"className":1011},[],[1013],{"type":51,"value":1014},"has_unsafe",{"type":51,"value":1016}," accurately in Phase 1 and let ",{"type":45,"tag":60,"props":1018,"children":1020},{"className":1019},[],[1021],{"type":51,"value":1022},"build_run_plan.py",{"type":51,"value":1024}," decide. Every memory-safety bug class (UAF, double-free, uninitialized reads, ",{"type":45,"tag":60,"props":1026,"children":1028},{"className":1027},[],[1029],{"type":51,"value":1030},"Vec::set_len",{"type":51,"value":1032},", union UB) requires ",{"type":45,"tag":60,"props":1034,"children":1036},{"className":1035},[],[1037],{"type":51,"value":124},{"type":51,"value":1039},", so the planner runs the ",{"type":45,"tag":282,"props":1041,"children":1042},{},[1043],{"type":51,"value":1044},"whole",{"type":51,"value":389},{"type":45,"tag":60,"props":1047,"children":1049},{"className":1048},[],[1050],{"type":51,"value":1051},"memory-safety",{"type":51,"value":1053}," cluster when ",{"type":45,"tag":60,"props":1055,"children":1057},{"className":1056},[],[1058],{"type":51,"value":1059},"has_unsafe=true",{"type":51,"value":1061}," and correctly omits it when ",{"type":45,"tag":60,"props":1063,"children":1065},{"className":1064},[],[1066],{"type":51,"value":1067},"false",{"type":51,"value":1069}," — there is no \"run it anyway.\" The ",{"type":45,"tag":282,"props":1071,"children":1072},{},[1073],{"type":51,"value":1074},"unsafe-boundary",{"type":51,"value":1076}," cluster is different: it has no ",{"type":45,"tag":60,"props":1078,"children":1080},{"className":1079},[],[1081],{"type":51,"value":1082},"requires",{"type":51,"value":1084}," and always runs (consolidated; its safety-doc and ",{"type":45,"tag":60,"props":1086,"children":1088},{"className":1087},[],[1089],{"type":51,"value":1090},"repr(C)",{"type":51,"value":1092}," hygiene apply to FFI declarations even without visible ",{"type":45,"tag":60,"props":1094,"children":1096},{"className":1095},[],[1097],{"type":51,"value":1098},"unsafe { }",{"type":51,"value":1100}," blocks).",{"type":45,"tag":138,"props":1102,"children":1103},{},[1104,1109],{"type":45,"tag":282,"props":1105,"children":1106},{},[1107],{"type":51,"value":1108},"\"The compiler caught it.\"",{"type":51,"value":1110}," The borrow checker proves absence of safe-code data races; it proves nothing about unsafe blocks, panic reachability, ABBA deadlocks, atomic-load\u002Fstore sequencing, or FFI ABI mismatch.",{"type":45,"tag":138,"props":1112,"children":1113},{},[1114,1134,1135,1141,1143,1148,1150,1155],{"type":45,"tag":282,"props":1115,"children":1116},{},[1117,1118,1124,1126,1132],{"type":51,"value":999},{"type":45,"tag":60,"props":1119,"children":1121},{"className":1120},[],[1122],{"type":51,"value":1123},"unwrap()",{"type":51,"value":1125}," is fine if it's ",{"type":45,"tag":60,"props":1127,"children":1129},{"className":1128},[],[1130],{"type":51,"value":1131},"\u002F\u002F SAFETY: documented infallible",{"type":51,"value":1133},".\"",{"type":51,"value":389},{"type":45,"tag":60,"props":1136,"children":1138},{"className":1137},[],[1139],{"type":51,"value":1140},"\u002F\u002F SAFETY:",{"type":51,"value":1142}," documents ",{"type":45,"tag":60,"props":1144,"children":1146},{"className":1145},[],[1147],{"type":51,"value":124},{"type":51,"value":1149}," operations, not infallibility claims. An ",{"type":45,"tag":60,"props":1151,"children":1153},{"className":1152},[],[1154],{"type":51,"value":1123},{"type":51,"value":1156}," on documented-infallible input is still risky if the documentation is wrong — file as low severity and let the FP judge decide.",{"type":45,"tag":138,"props":1158,"children":1159},{},[1160,1172],{"type":45,"tag":282,"props":1161,"children":1162},{},[1163,1164,1170],{"type":51,"value":999},{"type":45,"tag":60,"props":1165,"children":1167},{"className":1166},[],[1168],{"type":51,"value":1169},"has_unsafe=false",{"type":51,"value":1171}," so skip the run.\"",{"type":51,"value":1173}," Pure safe-Rust crates still have panic-DoS, atomic races, drop-panics, and trait-implementation hazards. Run the always-on clusters.",{"type":45,"tag":138,"props":1175,"children":1176},{},[1177,1182,1184,1189,1191,1197,1199,1205,1207,1213],{"type":45,"tag":282,"props":1178,"children":1179},{},[1180],{"type":51,"value":1181},"\"Background spawns parallelize the workers.\"",{"type":51,"value":1183}," They do not — ",{"type":45,"tag":60,"props":1185,"children":1187},{"className":1186},[],[1188],{"type":51,"value":336},{"type":51,"value":1190}," calls in a single assistant message already run concurrently. ",{"type":45,"tag":60,"props":1192,"children":1194},{"className":1193},[],[1195],{"type":51,"value":1196},"run_in_background=true",{"type":51,"value":1198}," defeats the Phase 6a primer cache, so every worker pays full cache-creation (",{"type":45,"tag":60,"props":1200,"children":1202},{"className":1201},[],[1203],{"type":51,"value":1204},"cache_read_input_tokens=0",{"type":51,"value":1206},") and the ~15 K-token primer is wasted M times. Default: omit ",{"type":45,"tag":60,"props":1208,"children":1210},{"className":1209},[],[1211],{"type":51,"value":1212},"run_in_background",{"type":51,"value":1214}," from worker spawns.",{"type":45,"tag":138,"props":1216,"children":1217},{},[1218,1229,1231,1237,1239,1245],{"type":45,"tag":282,"props":1219,"children":1220},{},[1221,1223,1228],{"type":51,"value":1222},"\"I'll re-derive the cluster list \u002F paths \u002F pass prefixes inline instead of running ",{"type":45,"tag":60,"props":1224,"children":1226},{"className":1225},[],[1227],{"type":51,"value":1022},{"type":51,"value":1133},{"type":51,"value":1230}," The script is the only authority for selection and rendering. Paraphrasing it drops fields that the worker self-check requires, producing ",{"type":45,"tag":60,"props":1232,"children":1234},{"className":1233},[],[1235],{"type":51,"value":1236},"worker-N abort: spawn prompt malformed",{"type":51,"value":1238},". Always run the script and ",{"type":45,"tag":60,"props":1240,"children":1242},{"className":1241},[],[1243],{"type":51,"value":1244},"Read plan.json",{"type":51,"value":772},{"type":45,"tag":138,"props":1247,"children":1248},{},[1249,1261,1263,1269,1271,1276],{"type":45,"tag":282,"props":1250,"children":1251},{},[1252,1254,1259],{"type":51,"value":1253},"\"The run partially succeeded — I'll just write ",{"type":45,"tag":60,"props":1255,"children":1257},{"className":1256},[],[1258],{"type":51,"value":763},{"type":51,"value":1260}," from what completed.\"",{"type":51,"value":1262}," Hiding partial runs behind a successful report is a correctness bug. If any Phase-5 cluster task is not ",{"type":45,"tag":60,"props":1264,"children":1266},{"className":1265},[],[1267],{"type":51,"value":1268},"completed",{"type":51,"value":1270},", surface it prominently in ",{"type":45,"tag":60,"props":1272,"children":1274},{"className":1273},[],[1275],{"type":51,"value":742},{"type":51,"value":1277}," and the final response.",{"type":45,"tag":138,"props":1279,"children":1280},{},[1281,1286,1288,1293,1295,1300,1301,1306,1308,1314],{"type":45,"tag":282,"props":1282,"children":1283},{},[1284],{"type":51,"value":1285},"\"Zero findings — skip Phase 8.\"",{"type":51,"value":1287}," Always run both judges and Phase 8b: dedup-judge writes a minimal no-op ",{"type":45,"tag":60,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":51,"value":749},{"type":51,"value":1294}," on an empty index, fp-judge writes empty ",{"type":45,"tag":60,"props":1296,"children":1298},{"className":1297},[],[1299],{"type":51,"value":763},{"type":51,"value":181},{"type":45,"tag":60,"props":1302,"children":1304},{"className":1303},[],[1305],{"type":51,"value":770},{"type":51,"value":1307},", and Phase 8b's SARIF generator emits ",{"type":45,"tag":60,"props":1309,"children":1311},{"className":1310},[],[1312],{"type":51,"value":1313},"results: []",{"type":51,"value":1315}," for the empty case. SARIF consumers depend on a stable artifact set.",{"type":45,"tag":138,"props":1317,"children":1318},{},[1319,1331,1333,1339,1341,1346,1348,1353,1355,1360],{"type":45,"tag":282,"props":1320,"children":1321},{},[1322,1323,1329],{"type":51,"value":999},{"type":45,"tag":60,"props":1324,"children":1326},{"className":1325},[],[1327],{"type":51,"value":1328},"Bash: ls README*",{"type":51,"value":1330}," is fine for the preflight.\"",{"type":51,"value":1332}," Under zsh, an unmatched glob aborts the whole compound command before ",{"type":45,"tag":60,"props":1334,"children":1336},{"className":1335},[],[1337],{"type":51,"value":1338},"2>\u002Fdev\u002Fnull",{"type":51,"value":1340}," runs. Use ",{"type":45,"tag":60,"props":1342,"children":1344},{"className":1343},[],[1345],{"type":51,"value":416},{"type":51,"value":1347}," (never fails on no-match) — and not ",{"type":45,"tag":60,"props":1349,"children":1351},{"className":1350},[],[1352],{"type":51,"value":387},{"type":51,"value":1354},", which is unavailable to an agent that also holds ",{"type":45,"tag":60,"props":1356,"children":1358},{"className":1357},[],[1359],{"type":51,"value":343},{"type":51,"value":772},{"type":45,"tag":660,"props":1362,"children":1363},{},[],{"type":45,"tag":108,"props":1365,"children":1367},{"id":1366},"orchestration-workflow",[1368],{"type":51,"value":1369},"Orchestration Workflow",{"type":45,"tag":54,"props":1371,"children":1372},{},[1373,1375,1380],{"type":51,"value":1374},"Run these phases ",{"type":45,"tag":282,"props":1376,"children":1377},{},[1378],{"type":51,"value":1379},"in the main conversation",{"type":51,"value":772},{"type":45,"tag":1382,"props":1383,"children":1385},"h3",{"id":1384},"phase-0-parameter-collection",[1386],{"type":51,"value":1387},"Phase 0: Parameter Collection",{"type":45,"tag":54,"props":1389,"children":1390},{},[1391,1396,1398,1403,1404,1410,1411,1417,1418,1424,1426,1432,1434,1440,1442,1448,1449,1454],{"type":45,"tag":282,"props":1392,"children":1393},{},[1394],{"type":51,"value":1395},"Entry:",{"type":51,"value":1397}," skill invoked. ",{"type":45,"tag":282,"props":1399,"children":1400},{},[1401],{"type":51,"value":1402},"Exit:",{"type":51,"value":389},{"type":45,"tag":60,"props":1405,"children":1407},{"className":1406},[],[1408],{"type":51,"value":1409},"threat_model",{"type":51,"value":83},{"type":45,"tag":60,"props":1412,"children":1414},{"className":1413},[],[1415],{"type":51,"value":1416},"worker_model",{"type":51,"value":83},{"type":45,"tag":60,"props":1419,"children":1421},{"className":1420},[],[1422],{"type":51,"value":1423},"severity_filter",{"type":51,"value":1425}," resolved; ",{"type":45,"tag":60,"props":1427,"children":1429},{"className":1428},[],[1430],{"type":51,"value":1431},"scope_subpath",{"type":51,"value":1433}," resolved or set to ",{"type":45,"tag":60,"props":1435,"children":1437},{"className":1436},[],[1438],{"type":51,"value":1439},"\".\"",{"type":51,"value":1441},"; ",{"type":45,"tag":60,"props":1443,"children":1445},{"className":1444},[],[1446],{"type":51,"value":1447},"finding_scope_root=scope_subpath",{"type":51,"value":1441},{"type":45,"tag":60,"props":1450,"children":1452},{"className":1451},[],[1453],{"type":51,"value":963},{"type":51,"value":1455}," resolved.",{"type":45,"tag":54,"props":1457,"children":1458},{},[1459,1461,1466,1468,1474,1475,1481,1482,1488,1490,1495,1496,1502],{"type":51,"value":1460},"The skill is invoked directly (no command wrapper). Parse any free-text arguments the user passed on the ",{"type":45,"tag":60,"props":1462,"children":1464},{"className":1463},[],[1465],{"type":51,"value":65},{"type":51,"value":1467}," line (e.g. ",{"type":45,"tag":60,"props":1469,"children":1471},{"className":1470},[],[1472],{"type":51,"value":1473},"flamenco only",{"type":51,"value":83},{"type":45,"tag":60,"props":1476,"children":1478},{"className":1477},[],[1479],{"type":51,"value":1480},"high severity only",{"type":51,"value":83},{"type":45,"tag":60,"props":1483,"children":1485},{"className":1484},[],[1486],{"type":51,"value":1487},"use haiku",{"type":51,"value":1489},") and pre-fill the answers they imply — then ask for any missing required parameters with ",{"type":45,"tag":282,"props":1491,"children":1492},{},[1493],{"type":51,"value":1494},"one",{"type":51,"value":389},{"type":45,"tag":60,"props":1497,"children":1499},{"className":1498},[],[1500],{"type":51,"value":1501},"AskUserQuestion",{"type":51,"value":1503}," call. Never silently default the required parameters.",{"type":45,"tag":54,"props":1505,"children":1506},{},[1507],{"type":51,"value":1508},"Required parameters:",{"type":45,"tag":212,"props":1510,"children":1511},{},[1512,1533],{"type":45,"tag":216,"props":1513,"children":1514},{},[1515],{"type":45,"tag":220,"props":1516,"children":1517},{},[1518,1523,1528],{"type":45,"tag":224,"props":1519,"children":1520},{},[1521],{"type":51,"value":1522},"Parameter",{"type":45,"tag":224,"props":1524,"children":1525},{},[1526],{"type":51,"value":1527},"Values",{"type":45,"tag":224,"props":1529,"children":1530},{},[1531],{"type":51,"value":1532},"How to infer from args",{"type":45,"tag":240,"props":1534,"children":1535},{},[1536,1589,1628,1694],{"type":45,"tag":220,"props":1537,"children":1538},{},[1539,1547,1570],{"type":45,"tag":247,"props":1540,"children":1541},{},[1542],{"type":45,"tag":60,"props":1543,"children":1545},{"className":1544},[],[1546],{"type":51,"value":1409},{"type":45,"tag":247,"props":1548,"children":1549},{},[1550,1556,1557,1563,1564],{"type":45,"tag":60,"props":1551,"children":1553},{"className":1552},[],[1554],{"type":51,"value":1555},"REMOTE",{"type":51,"value":467},{"type":45,"tag":60,"props":1558,"children":1560},{"className":1559},[],[1561],{"type":51,"value":1562},"LOCAL_UNPRIVILEGED",{"type":51,"value":467},{"type":45,"tag":60,"props":1565,"children":1567},{"className":1566},[],[1568],{"type":51,"value":1569},"BOTH",{"type":45,"tag":247,"props":1571,"children":1572},{},[1573,1575,1580,1582,1587],{"type":51,"value":1574},"Words like \"remote\", \"network\", \"attacker\" → ",{"type":45,"tag":60,"props":1576,"children":1578},{"className":1577},[],[1579],{"type":51,"value":1555},{"type":51,"value":1581},"; \"local\", \"unprivileged\" → ",{"type":45,"tag":60,"props":1583,"children":1585},{"className":1584},[],[1586],{"type":51,"value":1562},{"type":51,"value":1588},"; otherwise ask.",{"type":45,"tag":220,"props":1590,"children":1591},{},[1592,1600,1623],{"type":45,"tag":247,"props":1593,"children":1594},{},[1595],{"type":45,"tag":60,"props":1596,"children":1598},{"className":1597},[],[1599],{"type":51,"value":1416},{"type":45,"tag":247,"props":1601,"children":1602},{},[1603,1609,1610,1616,1617],{"type":45,"tag":60,"props":1604,"children":1606},{"className":1605},[],[1607],{"type":51,"value":1608},"haiku",{"type":51,"value":467},{"type":45,"tag":60,"props":1611,"children":1613},{"className":1612},[],[1614],{"type":51,"value":1615},"sonnet",{"type":51,"value":467},{"type":45,"tag":60,"props":1618,"children":1620},{"className":1619},[],[1621],{"type":51,"value":1622},"opus",{"type":45,"tag":247,"props":1624,"children":1625},{},[1626],{"type":51,"value":1627},"Explicit model name in args. Otherwise ask (no silent default).",{"type":45,"tag":220,"props":1629,"children":1630},{},[1631,1639,1662],{"type":45,"tag":247,"props":1632,"children":1633},{},[1634],{"type":45,"tag":60,"props":1635,"children":1637},{"className":1636},[],[1638],{"type":51,"value":1423},{"type":45,"tag":247,"props":1640,"children":1641},{},[1642,1648,1649,1655,1656],{"type":45,"tag":60,"props":1643,"children":1645},{"className":1644},[],[1646],{"type":51,"value":1647},"all",{"type":51,"value":467},{"type":45,"tag":60,"props":1650,"children":1652},{"className":1651},[],[1653],{"type":51,"value":1654},"medium",{"type":51,"value":467},{"type":45,"tag":60,"props":1657,"children":1659},{"className":1658},[],[1660],{"type":51,"value":1661},"high",{"type":45,"tag":247,"props":1663,"children":1664},{},[1665,1667,1672,1674,1679,1681,1686,1688,1693],{"type":51,"value":1666},"\"all\", \"every\", \"noisy\" → ",{"type":45,"tag":60,"props":1668,"children":1670},{"className":1669},[],[1671],{"type":51,"value":1647},{"type":51,"value":1673},"; \"medium and above\" → ",{"type":45,"tag":60,"props":1675,"children":1677},{"className":1676},[],[1678],{"type":51,"value":1654},{"type":51,"value":1680},"; \"high only\", \"criticals only\" → ",{"type":45,"tag":60,"props":1682,"children":1684},{"className":1683},[],[1685],{"type":51,"value":1661},{"type":51,"value":1687},". Otherwise ask — ",{"type":45,"tag":282,"props":1689,"children":1690},{},[1691],{"type":51,"value":1692},"no silent default",{"type":51,"value":772},{"type":45,"tag":220,"props":1695,"children":1696},{},[1697,1705,1710],{"type":45,"tag":247,"props":1698,"children":1699},{},[1700],{"type":45,"tag":60,"props":1701,"children":1703},{"className":1702},[],[1704],{"type":51,"value":1431},{"type":45,"tag":247,"props":1706,"children":1707},{},[1708],{"type":51,"value":1709},"repo-relative directory (optional)",{"type":45,"tag":247,"props":1711,"children":1712},{},[1713,1715,1721,1723,1728],{"type":51,"value":1714},"Phrases like \"X only\", \"just audit X\u002F\", \"review subdirectory X\" → ",{"type":45,"tag":60,"props":1716,"children":1718},{"className":1717},[],[1719],{"type":51,"value":1720},"src\u002FX\u002F",{"type":51,"value":1722}," or the matching subdir. Apply fuzzy matching against top-level subdirectories of the repo. If absent, set ",{"type":45,"tag":60,"props":1724,"children":1726},{"className":1725},[],[1727],{"type":51,"value":1439},{"type":51,"value":1729},"; if ambiguous, ask.",{"type":45,"tag":54,"props":1731,"children":1732},{},[1733,1735,1740,1742,1747,1748,1753,1754,1759,1761,1766],{"type":51,"value":1734},"Call ",{"type":45,"tag":60,"props":1736,"children":1738},{"className":1737},[],[1739],{"type":51,"value":1501},{"type":51,"value":1741}," exactly once with only unresolved required parameters (",{"type":45,"tag":60,"props":1743,"children":1745},{"className":1744},[],[1746],{"type":51,"value":1409},{"type":51,"value":83},{"type":45,"tag":60,"props":1749,"children":1751},{"className":1750},[],[1752],{"type":51,"value":1416},{"type":51,"value":83},{"type":45,"tag":60,"props":1755,"children":1757},{"className":1756},[],[1758],{"type":51,"value":1423},{"type":51,"value":1760},") plus ",{"type":45,"tag":60,"props":1762,"children":1764},{"className":1763},[],[1765],{"type":51,"value":1431},{"type":51,"value":1767}," only when the user explicitly requested a narrowed scope but it is ambiguous. If the required parameters were all pre-filled and scope is absent or resolved, skip the question.",{"type":45,"tag":54,"props":1769,"children":1770},{},[1771,1773,1778,1780,1786,1788,1794,1796,1802],{"type":51,"value":1772},"After resolving ",{"type":45,"tag":60,"props":1774,"children":1776},{"className":1775},[],[1777],{"type":51,"value":1431},{"type":51,"value":1779},", set ",{"type":45,"tag":60,"props":1781,"children":1783},{"className":1782},[],[1784],{"type":51,"value":1785},"finding_scope_root=\"${scope_subpath:-.}\"",{"type":51,"value":1787},". Set ",{"type":45,"tag":60,"props":1789,"children":1791},{"className":1790},[],[1792],{"type":51,"value":1793},"context_roots=\".\"",{"type":51,"value":1795}," by default so workers can verify callers\u002Fbuild settings outside a narrowed subtree without filing out-of-scope findings. If the user explicitly asks to forbid broader context, set ",{"type":45,"tag":60,"props":1797,"children":1799},{"className":1798},[],[1800],{"type":51,"value":1801},"context_roots=\"${finding_scope_root}\"",{"type":51,"value":1803}," and note that reachability confidence may be lower.",{"type":45,"tag":1382,"props":1805,"children":1807},{"id":1806},"phase-1-prerequisites",[1808],{"type":51,"value":1809},"Phase 1: Prerequisites",{"type":45,"tag":54,"props":1811,"children":1812},{},[1813,1817,1819,1823,1824,1829,1830,1836,1837,1843,1844,1850,1851,1857,1858,1864,1866,1872,1874,1880],{"type":45,"tag":282,"props":1814,"children":1815},{},[1816],{"type":51,"value":1395},{"type":51,"value":1818}," Phase 0 complete. ",{"type":45,"tag":282,"props":1820,"children":1821},{},[1822],{"type":51,"value":1402},{"type":51,"value":389},{"type":45,"tag":60,"props":1825,"children":1827},{"className":1826},[],[1828],{"type":51,"value":1014},{"type":51,"value":83},{"type":45,"tag":60,"props":1831,"children":1833},{"className":1832},[],[1834],{"type":51,"value":1835},"has_ffi",{"type":51,"value":83},{"type":45,"tag":60,"props":1838,"children":1840},{"className":1839},[],[1841],{"type":51,"value":1842},"has_concurrency",{"type":51,"value":83},{"type":45,"tag":60,"props":1845,"children":1847},{"className":1846},[],[1848],{"type":51,"value":1849},"has_async",{"type":51,"value":83},{"type":45,"tag":60,"props":1852,"children":1854},{"className":1853},[],[1855],{"type":51,"value":1856},"has_packed_repr",{"type":51,"value":83},{"type":45,"tag":60,"props":1859,"children":1861},{"className":1860},[],[1862],{"type":51,"value":1863},"has_fs_io",{"type":51,"value":1865}," flags determined. Abort with a clear message if no ",{"type":45,"tag":60,"props":1867,"children":1869},{"className":1868},[],[1870],{"type":51,"value":1871},"*.rs",{"type":51,"value":1873}," files exist under ",{"type":45,"tag":60,"props":1875,"children":1877},{"className":1876},[],[1878],{"type":51,"value":1879},"${finding_scope_root}",{"type":51,"value":772},{"type":45,"tag":54,"props":1882,"children":1883},{},[1884,1886,1892,1894,1899,1901,1906,1907,1912,1914,1919,1921,1926,1927,1932,1933,1938,1939,1944,1946,1951,1952,1957,1959,1964,1966,1971,1973,1979,1981,1986,1988,1993,1995,2000,2001,2006,2008,2013],{"type":51,"value":1885},"Probe within ",{"type":45,"tag":60,"props":1887,"children":1889},{"className":1888},[],[1890],{"type":51,"value":1891},"${finding_scope_root:-.}",{"type":51,"value":1893}," with the ",{"type":45,"tag":60,"props":1895,"children":1897},{"className":1896},[],[1898],{"type":51,"value":343},{"type":51,"value":1900}," commands below (non-empty output ⇒ flag true). The dedicated ",{"type":45,"tag":60,"props":1902,"children":1904},{"className":1903},[],[1905],{"type":51,"value":400},{"type":51,"value":181},{"type":45,"tag":60,"props":1908,"children":1910},{"className":1909},[],[1911],{"type":51,"value":387},{"type":51,"value":1913}," tools are unavailable to this orchestrator because it holds ",{"type":45,"tag":60,"props":1915,"children":1917},{"className":1916},[],[1918],{"type":51,"value":343},{"type":51,"value":1920}," — use ",{"type":45,"tag":60,"props":1922,"children":1924},{"className":1923},[],[1925],{"type":51,"value":423},{"type":51,"value":181},{"type":45,"tag":60,"props":1928,"children":1930},{"className":1929},[],[1931],{"type":51,"value":430},{"type":51,"value":181},{"type":45,"tag":60,"props":1934,"children":1936},{"className":1935},[],[1937],{"type":51,"value":416},{"type":51,"value":432},{"type":45,"tag":60,"props":1940,"children":1942},{"className":1941},[],[1943],{"type":51,"value":343},{"type":51,"value":1945},". (The probe regexes use ",{"type":45,"tag":60,"props":1947,"children":1949},{"className":1948},[],[1950],{"type":51,"value":505},{"type":51,"value":181},{"type":45,"tag":60,"props":1953,"children":1955},{"className":1954},[],[1956],{"type":51,"value":519},{"type":51,"value":1958},"; if your ",{"type":45,"tag":60,"props":1960,"children":1962},{"className":1961},[],[1963],{"type":51,"value":423},{"type":51,"value":1965}," lacks GNU ",{"type":45,"tag":60,"props":1967,"children":1969},{"className":1968},[],[1970],{"type":51,"value":505},{"type":51,"value":1972}," support, run them with ",{"type":45,"tag":60,"props":1974,"children":1976},{"className":1975},[],[1977],{"type":51,"value":1978},"rg -uu",{"type":51,"value":1980}," — which honors ",{"type":45,"tag":60,"props":1982,"children":1984},{"className":1983},[],[1985],{"type":51,"value":505},{"type":51,"value":1987}," and still searches ignored files — or, if ",{"type":45,"tag":60,"props":1989,"children":1991},{"className":1990},[],[1992],{"type":51,"value":430},{"type":51,"value":1994}," is not installed either, replace ",{"type":45,"tag":60,"props":1996,"children":1998},{"className":1997},[],[1999],{"type":51,"value":505},{"type":51,"value":576},{"type":45,"tag":60,"props":2002,"children":2004},{"className":2003},[],[2005],{"type":51,"value":582},{"type":51,"value":2007}," and drop ",{"type":45,"tag":60,"props":2009,"children":2011},{"className":2010},[],[2012],{"type":51,"value":519},{"type":51,"value":2014},". Widening is safe here: a false-positive capability flag only adds a harmless extra worker, whereas a missed match would skip a whole pass.)",{"type":45,"tag":670,"props":2016,"children":2020},{"className":2017,"code":2018,"language":2019,"meta":678,"style":678},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Rust source presence (precondition)\nfind \"${finding_scope_root:-.}\" -name '*.rs' -print -quit\n\n# has_unsafe\ngrep -rlE '\\bunsafe\\s+(extern|fn|impl|trait)\\b|\\bunsafe\\s*\\{' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_ffi\ngrep -rlE 'extern\\s+\"(C|system|stdcall|cdecl|win64|sysv64|aapcs|fastcall|thiscall|vectorcall|efiapi)(-unwind)?\"|\\bextern\\s+fn\\b|extern\\s+\\{|#\\[repr\\((C|transparent)\\b|\\b(CString|CStr)\\b|use\\s+(libc|core::ffi|std::ffi|std::os::raw|cty)|\\blibc::|\\b(bindgen|cbindgen)\\b|\\bc_void\\b' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_concurrency\ngrep -rlE '\\b(std::(thread|sync)|parking_lot::|crossbeam|rayon::|tokio::sync|core::sync::atomic|std::sync::atomic|Atomic[A-Za-z0-9_]*|UnsafeCell|static\\s+mut|unsafe\\s+impl\\s+(Send|Sync)|memmap2::|Mmap(Options|Mut)?|MAP_SHARED|shm_open|mmap\\s*\\(|memfd_create|shared_memory|raw_sync|CreateFileMapping|MapViewOfFile|once_cell|sigaction|signal_hook|nix::sys::signal|libc::signal|libc::sigaction)' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_async\ngrep -rlE '\\basync\\s+(fn|move|\\{)|\\.await\\b|tokio::|async_std::|futures::' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_packed_repr (outer #[repr(...packed...)] and inner #![repr(...packed...)])\ngrep -rlE '#!?\\[repr\\([^]]*packed' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_fs_io (path types \u002F construction)\ngrep -rlE '\\bPathBuf\\b|\\bPath\\b' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n\n# has_fs_io (fs module and file APIs)\ngrep -rlE '\\bfs::|\\bFile::(open|create)\\b|OpenOptions|\\.exists\\(\\)|\\.metadata\\(|symlink_metadata|read_dir|read_to_string' --include='*.rs' \"${finding_scope_root:-.}\" | head -1\n","bash",[2021],{"type":45,"tag":60,"props":2022,"children":2023},{"__ignoreMap":678},[2024,2036,2100,2110,2119,2197,2205,2214,2287,2295,2304,2377,2385,2394,2467,2475,2484,2557,2565,2574,2647,2655,2664],{"type":45,"tag":2025,"props":2026,"children":2029},"span",{"class":2027,"line":2028},"line",1,[2030],{"type":45,"tag":2025,"props":2031,"children":2033},{"style":2032},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[2034],{"type":51,"value":2035},"# Rust source presence (precondition)\n",{"type":45,"tag":2025,"props":2037,"children":2039},{"class":2027,"line":2038},2,[2040,2045,2051,2056,2061,2066,2071,2076,2081,2085,2090,2095],{"type":45,"tag":2025,"props":2041,"children":2043},{"style":2042},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[2044],{"type":51,"value":416},{"type":45,"tag":2025,"props":2046,"children":2048},{"style":2047},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[2049],{"type":51,"value":2050}," \"${",{"type":45,"tag":2025,"props":2052,"children":2054},{"style":2053},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[2055],{"type":51,"value":952},{"type":45,"tag":2025,"props":2057,"children":2058},{"style":2047},[2059],{"type":51,"value":2060},":-",{"type":45,"tag":2025,"props":2062,"children":2064},{"style":2063},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[2065],{"type":51,"value":772},{"type":45,"tag":2025,"props":2067,"children":2068},{"style":2047},[2069],{"type":51,"value":2070},"}\"",{"type":45,"tag":2025,"props":2072,"children":2073},{"style":2063},[2074],{"type":51,"value":2075}," -name",{"type":45,"tag":2025,"props":2077,"children":2078},{"style":2047},[2079],{"type":51,"value":2080}," '",{"type":45,"tag":2025,"props":2082,"children":2083},{"style":2063},[2084],{"type":51,"value":1871},{"type":45,"tag":2025,"props":2086,"children":2087},{"style":2047},[2088],{"type":51,"value":2089},"'",{"type":45,"tag":2025,"props":2091,"children":2092},{"style":2063},[2093],{"type":51,"value":2094}," -print",{"type":45,"tag":2025,"props":2096,"children":2097},{"style":2063},[2098],{"type":51,"value":2099}," -quit\n",{"type":45,"tag":2025,"props":2101,"children":2103},{"class":2027,"line":2102},3,[2104],{"type":45,"tag":2025,"props":2105,"children":2107},{"emptyLinePlaceholder":2106},true,[2108],{"type":51,"value":2109},"\n",{"type":45,"tag":2025,"props":2111,"children":2113},{"class":2027,"line":2112},4,[2114],{"type":45,"tag":2025,"props":2115,"children":2116},{"style":2032},[2117],{"type":51,"value":2118},"# has_unsafe\n",{"type":45,"tag":2025,"props":2120,"children":2122},{"class":2027,"line":2121},5,[2123,2127,2132,2136,2141,2145,2150,2154,2158,2162,2166,2170,2174,2178,2182,2187,2192],{"type":45,"tag":2025,"props":2124,"children":2125},{"style":2042},[2126],{"type":51,"value":423},{"type":45,"tag":2025,"props":2128,"children":2129},{"style":2063},[2130],{"type":51,"value":2131}," -rlE",{"type":45,"tag":2025,"props":2133,"children":2134},{"style":2047},[2135],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2137,"children":2138},{"style":2063},[2139],{"type":51,"value":2140},"\\bunsafe\\s+(extern|fn|impl|trait)\\b|\\bunsafe\\s*\\{",{"type":45,"tag":2025,"props":2142,"children":2143},{"style":2047},[2144],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2146,"children":2147},{"style":2063},[2148],{"type":51,"value":2149}," --include=",{"type":45,"tag":2025,"props":2151,"children":2152},{"style":2047},[2153],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2155,"children":2156},{"style":2063},[2157],{"type":51,"value":1871},{"type":45,"tag":2025,"props":2159,"children":2160},{"style":2047},[2161],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2163,"children":2164},{"style":2047},[2165],{"type":51,"value":2050},{"type":45,"tag":2025,"props":2167,"children":2168},{"style":2053},[2169],{"type":51,"value":952},{"type":45,"tag":2025,"props":2171,"children":2172},{"style":2047},[2173],{"type":51,"value":2060},{"type":45,"tag":2025,"props":2175,"children":2176},{"style":2063},[2177],{"type":51,"value":772},{"type":45,"tag":2025,"props":2179,"children":2180},{"style":2047},[2181],{"type":51,"value":2070},{"type":45,"tag":2025,"props":2183,"children":2184},{"style":2047},[2185],{"type":51,"value":2186}," |",{"type":45,"tag":2025,"props":2188,"children":2189},{"style":2042},[2190],{"type":51,"value":2191}," head",{"type":45,"tag":2025,"props":2193,"children":2194},{"style":2063},[2195],{"type":51,"value":2196}," -1\n",{"type":45,"tag":2025,"props":2198,"children":2200},{"class":2027,"line":2199},6,[2201],{"type":45,"tag":2025,"props":2202,"children":2203},{"emptyLinePlaceholder":2106},[2204],{"type":51,"value":2109},{"type":45,"tag":2025,"props":2206,"children":2208},{"class":2027,"line":2207},7,[2209],{"type":45,"tag":2025,"props":2210,"children":2211},{"style":2032},[2212],{"type":51,"value":2213},"# has_ffi\n",{"type":45,"tag":2025,"props":2215,"children":2217},{"class":2027,"line":2216},8,[2218,2222,2226,2230,2235,2239,2243,2247,2251,2255,2259,2263,2267,2271,2275,2279,2283],{"type":45,"tag":2025,"props":2219,"children":2220},{"style":2042},[2221],{"type":51,"value":423},{"type":45,"tag":2025,"props":2223,"children":2224},{"style":2063},[2225],{"type":51,"value":2131},{"type":45,"tag":2025,"props":2227,"children":2228},{"style":2047},[2229],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2231,"children":2232},{"style":2063},[2233],{"type":51,"value":2234},"extern\\s+\"(C|system|stdcall|cdecl|win64|sysv64|aapcs|fastcall|thiscall|vectorcall|efiapi)(-unwind)?\"|\\bextern\\s+fn\\b|extern\\s+\\{|#\\[repr\\((C|transparent)\\b|\\b(CString|CStr)\\b|use\\s+(libc|core::ffi|std::ffi|std::os::raw|cty)|\\blibc::|\\b(bindgen|cbindgen)\\b|\\bc_void\\b",{"type":45,"tag":2025,"props":2236,"children":2237},{"style":2047},[2238],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2240,"children":2241},{"style":2063},[2242],{"type":51,"value":2149},{"type":45,"tag":2025,"props":2244,"children":2245},{"style":2047},[2246],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2248,"children":2249},{"style":2063},[2250],{"type":51,"value":1871},{"type":45,"tag":2025,"props":2252,"children":2253},{"style":2047},[2254],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2256,"children":2257},{"style":2047},[2258],{"type":51,"value":2050},{"type":45,"tag":2025,"props":2260,"children":2261},{"style":2053},[2262],{"type":51,"value":952},{"type":45,"tag":2025,"props":2264,"children":2265},{"style":2047},[2266],{"type":51,"value":2060},{"type":45,"tag":2025,"props":2268,"children":2269},{"style":2063},[2270],{"type":51,"value":772},{"type":45,"tag":2025,"props":2272,"children":2273},{"style":2047},[2274],{"type":51,"value":2070},{"type":45,"tag":2025,"props":2276,"children":2277},{"style":2047},[2278],{"type":51,"value":2186},{"type":45,"tag":2025,"props":2280,"children":2281},{"style":2042},[2282],{"type":51,"value":2191},{"type":45,"tag":2025,"props":2284,"children":2285},{"style":2063},[2286],{"type":51,"value":2196},{"type":45,"tag":2025,"props":2288,"children":2290},{"class":2027,"line":2289},9,[2291],{"type":45,"tag":2025,"props":2292,"children":2293},{"emptyLinePlaceholder":2106},[2294],{"type":51,"value":2109},{"type":45,"tag":2025,"props":2296,"children":2298},{"class":2027,"line":2297},10,[2299],{"type":45,"tag":2025,"props":2300,"children":2301},{"style":2032},[2302],{"type":51,"value":2303},"# has_concurrency\n",{"type":45,"tag":2025,"props":2305,"children":2307},{"class":2027,"line":2306},11,[2308,2312,2316,2320,2325,2329,2333,2337,2341,2345,2349,2353,2357,2361,2365,2369,2373],{"type":45,"tag":2025,"props":2309,"children":2310},{"style":2042},[2311],{"type":51,"value":423},{"type":45,"tag":2025,"props":2313,"children":2314},{"style":2063},[2315],{"type":51,"value":2131},{"type":45,"tag":2025,"props":2317,"children":2318},{"style":2047},[2319],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2321,"children":2322},{"style":2063},[2323],{"type":51,"value":2324},"\\b(std::(thread|sync)|parking_lot::|crossbeam|rayon::|tokio::sync|core::sync::atomic|std::sync::atomic|Atomic[A-Za-z0-9_]*|UnsafeCell|static\\s+mut|unsafe\\s+impl\\s+(Send|Sync)|memmap2::|Mmap(Options|Mut)?|MAP_SHARED|shm_open|mmap\\s*\\(|memfd_create|shared_memory|raw_sync|CreateFileMapping|MapViewOfFile|once_cell|sigaction|signal_hook|nix::sys::signal|libc::signal|libc::sigaction)",{"type":45,"tag":2025,"props":2326,"children":2327},{"style":2047},[2328],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2330,"children":2331},{"style":2063},[2332],{"type":51,"value":2149},{"type":45,"tag":2025,"props":2334,"children":2335},{"style":2047},[2336],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2338,"children":2339},{"style":2063},[2340],{"type":51,"value":1871},{"type":45,"tag":2025,"props":2342,"children":2343},{"style":2047},[2344],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2346,"children":2347},{"style":2047},[2348],{"type":51,"value":2050},{"type":45,"tag":2025,"props":2350,"children":2351},{"style":2053},[2352],{"type":51,"value":952},{"type":45,"tag":2025,"props":2354,"children":2355},{"style":2047},[2356],{"type":51,"value":2060},{"type":45,"tag":2025,"props":2358,"children":2359},{"style":2063},[2360],{"type":51,"value":772},{"type":45,"tag":2025,"props":2362,"children":2363},{"style":2047},[2364],{"type":51,"value":2070},{"type":45,"tag":2025,"props":2366,"children":2367},{"style":2047},[2368],{"type":51,"value":2186},{"type":45,"tag":2025,"props":2370,"children":2371},{"style":2042},[2372],{"type":51,"value":2191},{"type":45,"tag":2025,"props":2374,"children":2375},{"style":2063},[2376],{"type":51,"value":2196},{"type":45,"tag":2025,"props":2378,"children":2380},{"class":2027,"line":2379},12,[2381],{"type":45,"tag":2025,"props":2382,"children":2383},{"emptyLinePlaceholder":2106},[2384],{"type":51,"value":2109},{"type":45,"tag":2025,"props":2386,"children":2388},{"class":2027,"line":2387},13,[2389],{"type":45,"tag":2025,"props":2390,"children":2391},{"style":2032},[2392],{"type":51,"value":2393},"# has_async\n",{"type":45,"tag":2025,"props":2395,"children":2397},{"class":2027,"line":2396},14,[2398,2402,2406,2410,2415,2419,2423,2427,2431,2435,2439,2443,2447,2451,2455,2459,2463],{"type":45,"tag":2025,"props":2399,"children":2400},{"style":2042},[2401],{"type":51,"value":423},{"type":45,"tag":2025,"props":2403,"children":2404},{"style":2063},[2405],{"type":51,"value":2131},{"type":45,"tag":2025,"props":2407,"children":2408},{"style":2047},[2409],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2411,"children":2412},{"style":2063},[2413],{"type":51,"value":2414},"\\basync\\s+(fn|move|\\{)|\\.await\\b|tokio::|async_std::|futures::",{"type":45,"tag":2025,"props":2416,"children":2417},{"style":2047},[2418],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2420,"children":2421},{"style":2063},[2422],{"type":51,"value":2149},{"type":45,"tag":2025,"props":2424,"children":2425},{"style":2047},[2426],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2428,"children":2429},{"style":2063},[2430],{"type":51,"value":1871},{"type":45,"tag":2025,"props":2432,"children":2433},{"style":2047},[2434],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2436,"children":2437},{"style":2047},[2438],{"type":51,"value":2050},{"type":45,"tag":2025,"props":2440,"children":2441},{"style":2053},[2442],{"type":51,"value":952},{"type":45,"tag":2025,"props":2444,"children":2445},{"style":2047},[2446],{"type":51,"value":2060},{"type":45,"tag":2025,"props":2448,"children":2449},{"style":2063},[2450],{"type":51,"value":772},{"type":45,"tag":2025,"props":2452,"children":2453},{"style":2047},[2454],{"type":51,"value":2070},{"type":45,"tag":2025,"props":2456,"children":2457},{"style":2047},[2458],{"type":51,"value":2186},{"type":45,"tag":2025,"props":2460,"children":2461},{"style":2042},[2462],{"type":51,"value":2191},{"type":45,"tag":2025,"props":2464,"children":2465},{"style":2063},[2466],{"type":51,"value":2196},{"type":45,"tag":2025,"props":2468,"children":2470},{"class":2027,"line":2469},15,[2471],{"type":45,"tag":2025,"props":2472,"children":2473},{"emptyLinePlaceholder":2106},[2474],{"type":51,"value":2109},{"type":45,"tag":2025,"props":2476,"children":2478},{"class":2027,"line":2477},16,[2479],{"type":45,"tag":2025,"props":2480,"children":2481},{"style":2032},[2482],{"type":51,"value":2483},"# has_packed_repr (outer #[repr(...packed...)] and inner #![repr(...packed...)])\n",{"type":45,"tag":2025,"props":2485,"children":2487},{"class":2027,"line":2486},17,[2488,2492,2496,2500,2505,2509,2513,2517,2521,2525,2529,2533,2537,2541,2545,2549,2553],{"type":45,"tag":2025,"props":2489,"children":2490},{"style":2042},[2491],{"type":51,"value":423},{"type":45,"tag":2025,"props":2493,"children":2494},{"style":2063},[2495],{"type":51,"value":2131},{"type":45,"tag":2025,"props":2497,"children":2498},{"style":2047},[2499],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2501,"children":2502},{"style":2063},[2503],{"type":51,"value":2504},"#!?\\[repr\\([^]]*packed",{"type":45,"tag":2025,"props":2506,"children":2507},{"style":2047},[2508],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2510,"children":2511},{"style":2063},[2512],{"type":51,"value":2149},{"type":45,"tag":2025,"props":2514,"children":2515},{"style":2047},[2516],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2518,"children":2519},{"style":2063},[2520],{"type":51,"value":1871},{"type":45,"tag":2025,"props":2522,"children":2523},{"style":2047},[2524],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2526,"children":2527},{"style":2047},[2528],{"type":51,"value":2050},{"type":45,"tag":2025,"props":2530,"children":2531},{"style":2053},[2532],{"type":51,"value":952},{"type":45,"tag":2025,"props":2534,"children":2535},{"style":2047},[2536],{"type":51,"value":2060},{"type":45,"tag":2025,"props":2538,"children":2539},{"style":2063},[2540],{"type":51,"value":772},{"type":45,"tag":2025,"props":2542,"children":2543},{"style":2047},[2544],{"type":51,"value":2070},{"type":45,"tag":2025,"props":2546,"children":2547},{"style":2047},[2548],{"type":51,"value":2186},{"type":45,"tag":2025,"props":2550,"children":2551},{"style":2042},[2552],{"type":51,"value":2191},{"type":45,"tag":2025,"props":2554,"children":2555},{"style":2063},[2556],{"type":51,"value":2196},{"type":45,"tag":2025,"props":2558,"children":2560},{"class":2027,"line":2559},18,[2561],{"type":45,"tag":2025,"props":2562,"children":2563},{"emptyLinePlaceholder":2106},[2564],{"type":51,"value":2109},{"type":45,"tag":2025,"props":2566,"children":2568},{"class":2027,"line":2567},19,[2569],{"type":45,"tag":2025,"props":2570,"children":2571},{"style":2032},[2572],{"type":51,"value":2573},"# has_fs_io (path types \u002F construction)\n",{"type":45,"tag":2025,"props":2575,"children":2577},{"class":2027,"line":2576},20,[2578,2582,2586,2590,2595,2599,2603,2607,2611,2615,2619,2623,2627,2631,2635,2639,2643],{"type":45,"tag":2025,"props":2579,"children":2580},{"style":2042},[2581],{"type":51,"value":423},{"type":45,"tag":2025,"props":2583,"children":2584},{"style":2063},[2585],{"type":51,"value":2131},{"type":45,"tag":2025,"props":2587,"children":2588},{"style":2047},[2589],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2591,"children":2592},{"style":2063},[2593],{"type":51,"value":2594},"\\bPathBuf\\b|\\bPath\\b",{"type":45,"tag":2025,"props":2596,"children":2597},{"style":2047},[2598],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2600,"children":2601},{"style":2063},[2602],{"type":51,"value":2149},{"type":45,"tag":2025,"props":2604,"children":2605},{"style":2047},[2606],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2608,"children":2609},{"style":2063},[2610],{"type":51,"value":1871},{"type":45,"tag":2025,"props":2612,"children":2613},{"style":2047},[2614],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2616,"children":2617},{"style":2047},[2618],{"type":51,"value":2050},{"type":45,"tag":2025,"props":2620,"children":2621},{"style":2053},[2622],{"type":51,"value":952},{"type":45,"tag":2025,"props":2624,"children":2625},{"style":2047},[2626],{"type":51,"value":2060},{"type":45,"tag":2025,"props":2628,"children":2629},{"style":2063},[2630],{"type":51,"value":772},{"type":45,"tag":2025,"props":2632,"children":2633},{"style":2047},[2634],{"type":51,"value":2070},{"type":45,"tag":2025,"props":2636,"children":2637},{"style":2047},[2638],{"type":51,"value":2186},{"type":45,"tag":2025,"props":2640,"children":2641},{"style":2042},[2642],{"type":51,"value":2191},{"type":45,"tag":2025,"props":2644,"children":2645},{"style":2063},[2646],{"type":51,"value":2196},{"type":45,"tag":2025,"props":2648,"children":2650},{"class":2027,"line":2649},21,[2651],{"type":45,"tag":2025,"props":2652,"children":2653},{"emptyLinePlaceholder":2106},[2654],{"type":51,"value":2109},{"type":45,"tag":2025,"props":2656,"children":2658},{"class":2027,"line":2657},22,[2659],{"type":45,"tag":2025,"props":2660,"children":2661},{"style":2032},[2662],{"type":51,"value":2663},"# has_fs_io (fs module and file APIs)\n",{"type":45,"tag":2025,"props":2665,"children":2667},{"class":2027,"line":2666},23,[2668,2672,2676,2680,2685,2689,2693,2697,2701,2705,2709,2713,2717,2721,2725,2729,2733],{"type":45,"tag":2025,"props":2669,"children":2670},{"style":2042},[2671],{"type":51,"value":423},{"type":45,"tag":2025,"props":2673,"children":2674},{"style":2063},[2675],{"type":51,"value":2131},{"type":45,"tag":2025,"props":2677,"children":2678},{"style":2047},[2679],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2681,"children":2682},{"style":2063},[2683],{"type":51,"value":2684},"\\bfs::|\\bFile::(open|create)\\b|OpenOptions|\\.exists\\(\\)|\\.metadata\\(|symlink_metadata|read_dir|read_to_string",{"type":45,"tag":2025,"props":2686,"children":2687},{"style":2047},[2688],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2690,"children":2691},{"style":2063},[2692],{"type":51,"value":2149},{"type":45,"tag":2025,"props":2694,"children":2695},{"style":2047},[2696],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2698,"children":2699},{"style":2063},[2700],{"type":51,"value":1871},{"type":45,"tag":2025,"props":2702,"children":2703},{"style":2047},[2704],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2706,"children":2707},{"style":2047},[2708],{"type":51,"value":2050},{"type":45,"tag":2025,"props":2710,"children":2711},{"style":2053},[2712],{"type":51,"value":952},{"type":45,"tag":2025,"props":2714,"children":2715},{"style":2047},[2716],{"type":51,"value":2060},{"type":45,"tag":2025,"props":2718,"children":2719},{"style":2063},[2720],{"type":51,"value":772},{"type":45,"tag":2025,"props":2722,"children":2723},{"style":2047},[2724],{"type":51,"value":2070},{"type":45,"tag":2025,"props":2726,"children":2727},{"style":2047},[2728],{"type":51,"value":2186},{"type":45,"tag":2025,"props":2730,"children":2731},{"style":2042},[2732],{"type":51,"value":2191},{"type":45,"tag":2025,"props":2734,"children":2735},{"style":2063},[2736],{"type":51,"value":2196},{"type":45,"tag":54,"props":2738,"children":2739},{},[2740,2742,2747,2749,2755,2756,2762,2764,2770,2772,2778,2780,2786,2787,2793,2794,2800,2801,2807,2809,2815,2816,2822,2824,2830,2832,2838],{"type":51,"value":2741},"As with the other flags, non-empty output (from either probe) means the flag is true. These detectors are intentionally conservative: when in doubt they set the flag true, because a false-positive flag only costs a harmless extra worker while a false-negative would skip a real pass. ",{"type":45,"tag":60,"props":2743,"children":2745},{"className":2744},[],[2746],{"type":51,"value":1863},{"type":51,"value":2748}," keys on path types (",{"type":45,"tag":60,"props":2750,"children":2752},{"className":2751},[],[2753],{"type":51,"value":2754},"PathBuf",{"type":51,"value":181},{"type":45,"tag":60,"props":2757,"children":2759},{"className":2758},[],[2760],{"type":51,"value":2761},"Path",{"type":51,"value":2763},", which also covers ",{"type":45,"tag":60,"props":2765,"children":2767},{"className":2766},[],[2768],{"type":51,"value":2769},"&Path",{"type":51,"value":2771}," parameters and bare ",{"type":45,"tag":60,"props":2773,"children":2775},{"className":2774},[],[2776],{"type":51,"value":2777},"Path::",{"type":51,"value":2779}," calls) and filesystem anchors (",{"type":45,"tag":60,"props":2781,"children":2783},{"className":2782},[],[2784],{"type":51,"value":2785},"fs::",{"type":51,"value":181},{"type":45,"tag":60,"props":2788,"children":2790},{"className":2789},[],[2791],{"type":51,"value":2792},"File::",{"type":51,"value":181},{"type":45,"tag":60,"props":2795,"children":2797},{"className":2796},[],[2798],{"type":51,"value":2799},"OpenOptions",{"type":51,"value":181},{"type":45,"tag":60,"props":2802,"children":2804},{"className":2803},[],[2805],{"type":51,"value":2806},"read_dir",{"type":51,"value":2808},"\u002F…) rather than the bare ",{"type":45,"tag":60,"props":2810,"children":2812},{"className":2811},[],[2813],{"type":51,"value":2814},".join(",{"type":51,"value":181},{"type":45,"tag":60,"props":2817,"children":2819},{"className":2818},[],[2820],{"type":51,"value":2821},".push(",{"type":51,"value":2823}," calls — path construction is reached via the path-type anchors, so leaving join\u002Fpush out of the gate avoids matching unrelated iterator\u002F",{"type":45,"tag":60,"props":2825,"children":2827},{"className":2826},[],[2828],{"type":51,"value":2829},"JoinHandle",{"type":51,"value":2831}," joins and ",{"type":45,"tag":60,"props":2833,"children":2835},{"className":2834},[],[2836],{"type":51,"value":2837},"Vec::push",{"type":51,"value":2839}," that would make the gate fire on nearly every crate.",{"type":45,"tag":54,"props":2841,"children":2842},{},[2843,2845,2851,2853,2859,2860,2866,2868,2874,2876,2882],{"type":51,"value":2844},"Note for ",{"type":45,"tag":60,"props":2846,"children":2848},{"className":2847},[],[2849],{"type":51,"value":2850},"Cargo.toml",{"type":51,"value":2852},": also probe for ",{"type":45,"tag":60,"props":2854,"children":2856},{"className":2855},[],[2857],{"type":51,"value":2858},"[dependencies] tokio",{"type":51,"value":83},{"type":45,"tag":60,"props":2861,"children":2863},{"className":2862},[],[2864],{"type":51,"value":2865},"async-std",{"type":51,"value":2867},", etc., to set ",{"type":45,"tag":60,"props":2869,"children":2871},{"className":2870},[],[2872],{"type":51,"value":2873},"has_async=true",{"type":51,"value":2875}," even if the scope subpath has no ",{"type":45,"tag":60,"props":2877,"children":2879},{"className":2878},[],[2880],{"type":51,"value":2881},".await",{"type":51,"value":2883}," yet (library crates often re-export).",{"type":45,"tag":54,"props":2885,"children":2886},{},[2887,2889,2894,2896,2901,2903,2909],{"type":51,"value":2888},"Also probe ",{"type":45,"tag":60,"props":2890,"children":2892},{"className":2891},[],[2893],{"type":51,"value":2850},{"type":51,"value":2895}," presence (informational — note in ",{"type":45,"tag":60,"props":2897,"children":2899},{"className":2898},[],[2900],{"type":51,"value":742},{"type":51,"value":2902}," whether the audit was over a Cargo workspace, single crate, or loose ",{"type":45,"tag":60,"props":2904,"children":2906},{"className":2905},[],[2907],{"type":51,"value":2908},".rs",{"type":51,"value":2910}," files):",{"type":45,"tag":670,"props":2912,"children":2914},{"className":2017,"code":2913,"language":2019,"meta":678,"style":678},"# context_roots may be comma-separated (build_run_plan.py treats it as a list),\n# so probe each root rather than passing \"a,b\" as one (nonexistent) path.\necho \"${context_roots:-.}\" | tr ',' '\\n' | while IFS= read -r root; do\n  find \"${root:-.}\" -name 'Cargo.toml' -print -quit\ndone | head -1\n",[2915],{"type":45,"tag":60,"props":2916,"children":2917},{"__ignoreMap":678},[2918,2926,2934,3043,3095],{"type":45,"tag":2025,"props":2919,"children":2920},{"class":2027,"line":2028},[2921],{"type":45,"tag":2025,"props":2922,"children":2923},{"style":2032},[2924],{"type":51,"value":2925},"# context_roots may be comma-separated (build_run_plan.py treats it as a list),\n",{"type":45,"tag":2025,"props":2927,"children":2928},{"class":2027,"line":2038},[2929],{"type":45,"tag":2025,"props":2930,"children":2931},{"style":2032},[2932],{"type":51,"value":2933},"# so probe each root rather than passing \"a,b\" as one (nonexistent) path.\n",{"type":45,"tag":2025,"props":2935,"children":2936},{"class":2027,"line":2102},[2937,2943,2947,2951,2955,2959,2963,2967,2972,2976,2981,2985,2989,2994,2998,3002,3008,3013,3018,3023,3028,3033,3038],{"type":45,"tag":2025,"props":2938,"children":2940},{"style":2939},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[2941],{"type":51,"value":2942},"echo",{"type":45,"tag":2025,"props":2944,"children":2945},{"style":2047},[2946],{"type":51,"value":2050},{"type":45,"tag":2025,"props":2948,"children":2949},{"style":2053},[2950],{"type":51,"value":963},{"type":45,"tag":2025,"props":2952,"children":2953},{"style":2047},[2954],{"type":51,"value":2060},{"type":45,"tag":2025,"props":2956,"children":2957},{"style":2063},[2958],{"type":51,"value":772},{"type":45,"tag":2025,"props":2960,"children":2961},{"style":2047},[2962],{"type":51,"value":2070},{"type":45,"tag":2025,"props":2964,"children":2965},{"style":2047},[2966],{"type":51,"value":2186},{"type":45,"tag":2025,"props":2968,"children":2969},{"style":2042},[2970],{"type":51,"value":2971}," tr",{"type":45,"tag":2025,"props":2973,"children":2974},{"style":2047},[2975],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2977,"children":2978},{"style":2063},[2979],{"type":51,"value":2980},",",{"type":45,"tag":2025,"props":2982,"children":2983},{"style":2047},[2984],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2986,"children":2987},{"style":2047},[2988],{"type":51,"value":2080},{"type":45,"tag":2025,"props":2990,"children":2991},{"style":2063},[2992],{"type":51,"value":2993},"\\n",{"type":45,"tag":2025,"props":2995,"children":2996},{"style":2047},[2997],{"type":51,"value":2089},{"type":45,"tag":2025,"props":2999,"children":3000},{"style":2047},[3001],{"type":51,"value":2186},{"type":45,"tag":2025,"props":3003,"children":3005},{"style":3004},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[3006],{"type":51,"value":3007}," while",{"type":45,"tag":2025,"props":3009,"children":3010},{"style":2053},[3011],{"type":51,"value":3012}," IFS",{"type":45,"tag":2025,"props":3014,"children":3015},{"style":2047},[3016],{"type":51,"value":3017},"=",{"type":45,"tag":2025,"props":3019,"children":3020},{"style":2939},[3021],{"type":51,"value":3022}," read",{"type":45,"tag":2025,"props":3024,"children":3025},{"style":2063},[3026],{"type":51,"value":3027}," -r",{"type":45,"tag":2025,"props":3029,"children":3030},{"style":2063},[3031],{"type":51,"value":3032}," root",{"type":45,"tag":2025,"props":3034,"children":3035},{"style":2047},[3036],{"type":51,"value":3037},";",{"type":45,"tag":2025,"props":3039,"children":3040},{"style":3004},[3041],{"type":51,"value":3042}," do\n",{"type":45,"tag":2025,"props":3044,"children":3045},{"class":2027,"line":2112},[3046,3051,3055,3059,3063,3067,3071,3075,3079,3083,3087,3091],{"type":45,"tag":2025,"props":3047,"children":3048},{"style":2042},[3049],{"type":51,"value":3050},"  find",{"type":45,"tag":2025,"props":3052,"children":3053},{"style":2047},[3054],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3056,"children":3057},{"style":2053},[3058],{"type":51,"value":42},{"type":45,"tag":2025,"props":3060,"children":3061},{"style":2047},[3062],{"type":51,"value":2060},{"type":45,"tag":2025,"props":3064,"children":3065},{"style":2063},[3066],{"type":51,"value":772},{"type":45,"tag":2025,"props":3068,"children":3069},{"style":2047},[3070],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3072,"children":3073},{"style":2063},[3074],{"type":51,"value":2075},{"type":45,"tag":2025,"props":3076,"children":3077},{"style":2047},[3078],{"type":51,"value":2080},{"type":45,"tag":2025,"props":3080,"children":3081},{"style":2063},[3082],{"type":51,"value":2850},{"type":45,"tag":2025,"props":3084,"children":3085},{"style":2047},[3086],{"type":51,"value":2089},{"type":45,"tag":2025,"props":3088,"children":3089},{"style":2063},[3090],{"type":51,"value":2094},{"type":45,"tag":2025,"props":3092,"children":3093},{"style":2063},[3094],{"type":51,"value":2099},{"type":45,"tag":2025,"props":3096,"children":3097},{"class":2027,"line":2121},[3098,3103,3107,3111],{"type":45,"tag":2025,"props":3099,"children":3100},{"style":3004},[3101],{"type":51,"value":3102},"done",{"type":45,"tag":2025,"props":3104,"children":3105},{"style":2047},[3106],{"type":51,"value":2186},{"type":45,"tag":2025,"props":3108,"children":3109},{"style":2042},[3110],{"type":51,"value":2191},{"type":45,"tag":2025,"props":3112,"children":3113},{"style":2063},[3114],{"type":51,"value":2196},{"type":45,"tag":1382,"props":3116,"children":3118},{"id":3117},"phase-2-output-directory",[3119],{"type":51,"value":3120},"Phase 2: Output Directory",{"type":45,"tag":54,"props":3122,"children":3123},{},[3124,3128,3130,3134,3136,3142,3143,3149,3151,3157],{"type":45,"tag":282,"props":3125,"children":3126},{},[3127],{"type":51,"value":1395},{"type":51,"value":3129}," Phase 1 flags set. ",{"type":45,"tag":282,"props":3131,"children":3132},{},[3133],{"type":51,"value":1402},{"type":51,"value":3135}," absolute ",{"type":45,"tag":60,"props":3137,"children":3139},{"className":3138},[],[3140],{"type":51,"value":3141},"output_dir",{"type":51,"value":1425},{"type":45,"tag":60,"props":3144,"children":3146},{"className":3145},[],[3147],{"type":51,"value":3148},"${output_dir}\u002Ffindings\u002F",{"type":51,"value":3150}," and ",{"type":45,"tag":60,"props":3152,"children":3154},{"className":3153},[],[3155],{"type":51,"value":3156},"${output_dir}\u002Fcoverage\u002F",{"type":51,"value":3158}," exist.",{"type":45,"tag":54,"props":3160,"children":3161},{},[3162,3164,3169,3171,3177],{"type":51,"value":3163},"Resolve an absolute path for ",{"type":45,"tag":60,"props":3165,"children":3167},{"className":3166},[],[3168],{"type":51,"value":3141},{"type":51,"value":3170}," (default: ",{"type":45,"tag":60,"props":3172,"children":3174},{"className":3173},[],[3175],{"type":51,"value":3176},"$(pwd)\u002F.rust-review-results\u002F$(date -u +%Y%m%dT%H%M%SZ)\u002F",{"type":51,"value":3178},"):",{"type":45,"tag":670,"props":3180,"children":3182},{"className":2017,"code":3181,"language":2019,"meta":678,"style":678},"mkdir -p \"${output_dir}\u002Ffindings\" \"${output_dir}\u002Fcoverage\"\n",[3183],{"type":45,"tag":60,"props":3184,"children":3185},{"__ignoreMap":678},[3186],{"type":45,"tag":2025,"props":3187,"children":3188},{"class":2027,"line":2028},[3189,3194,3199,3203,3207,3212,3217,3221,3225,3229,3233,3238],{"type":45,"tag":2025,"props":3190,"children":3191},{"style":2042},[3192],{"type":51,"value":3193},"mkdir",{"type":45,"tag":2025,"props":3195,"children":3196},{"style":2063},[3197],{"type":51,"value":3198}," -p",{"type":45,"tag":2025,"props":3200,"children":3201},{"style":2047},[3202],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3204,"children":3205},{"style":2053},[3206],{"type":51,"value":3141},{"type":45,"tag":2025,"props":3208,"children":3209},{"style":2047},[3210],{"type":51,"value":3211},"}",{"type":45,"tag":2025,"props":3213,"children":3214},{"style":2063},[3215],{"type":51,"value":3216},"\u002Ffindings",{"type":45,"tag":2025,"props":3218,"children":3219},{"style":2047},[3220],{"type":51,"value":999},{"type":45,"tag":2025,"props":3222,"children":3223},{"style":2047},[3224],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3226,"children":3227},{"style":2053},[3228],{"type":51,"value":3141},{"type":45,"tag":2025,"props":3230,"children":3231},{"style":2047},[3232],{"type":51,"value":3211},{"type":45,"tag":2025,"props":3234,"children":3235},{"style":2063},[3236],{"type":51,"value":3237},"\u002Fcoverage",{"type":45,"tag":2025,"props":3239,"children":3240},{"style":2047},[3241],{"type":51,"value":3242},"\"\n",{"type":45,"tag":54,"props":3244,"children":3245},{},[3246,3248,3253,3255,3261,3263,3269],{"type":51,"value":3247},"The ",{"type":45,"tag":60,"props":3249,"children":3251},{"className":3250},[],[3252],{"type":51,"value":734},{"type":51,"value":3254}," subdirectory holds per-worker coverage-gate audit files (",{"type":45,"tag":60,"props":3256,"children":3258},{"className":3257},[],[3259],{"type":51,"value":3260},"coverage\u002Fworker-{N}.md",{"type":51,"value":3262},"). Workers write to it instead of embedding the table in their reply — see ",{"type":45,"tag":60,"props":3264,"children":3266},{"className":3265},[],[3267],{"type":51,"value":3268},"agents\u002Frust-review-worker.md",{"type":51,"value":3270}," step 5.",{"type":45,"tag":1382,"props":3272,"children":3274},{"id":3273},"phase-3-codebase-context",[3275],{"type":51,"value":3276},"Phase 3: Codebase Context",{"type":45,"tag":54,"props":3278,"children":3279},{},[3280,3284,3285,3291,3293,3297,3298,3304],{"type":45,"tag":282,"props":3281,"children":3282},{},[3283],{"type":51,"value":1395},{"type":51,"value":389},{"type":45,"tag":60,"props":3286,"children":3288},{"className":3287},[],[3289],{"type":51,"value":3290},"${output_dir}",{"type":51,"value":3292}," exists. ",{"type":45,"tag":282,"props":3294,"children":3295},{},[3296],{"type":51,"value":1402},{"type":51,"value":389},{"type":45,"tag":60,"props":3299,"children":3301},{"className":3300},[],[3302],{"type":51,"value":3303},"${output_dir}\u002Fcontext.md",{"type":51,"value":3305}," written.",{"type":45,"tag":54,"props":3307,"children":3308},{},[3309,3311,3317,3319,3324,3325,3331,3332,3338,3339,3345,3347,3352,3354,3359,3361,3366,3368,3373,3375,3380,3382,3387,3389,3393,3395,3400,3402,3407,3408,3414],{"type":51,"value":3310},"Skim ",{"type":45,"tag":60,"props":3312,"children":3314},{"className":3313},[],[3315],{"type":51,"value":3316},"README.{md,rst,txt}",{"type":51,"value":3318}," and any build\u002Fmanifest file (",{"type":45,"tag":60,"props":3320,"children":3322},{"className":3321},[],[3323],{"type":51,"value":2850},{"type":51,"value":83},{"type":45,"tag":60,"props":3326,"children":3328},{"className":3327},[],[3329],{"type":51,"value":3330},"Cargo.lock",{"type":51,"value":83},{"type":45,"tag":60,"props":3333,"children":3335},{"className":3334},[],[3336],{"type":51,"value":3337},"rust-toolchain.toml",{"type":51,"value":83},{"type":45,"tag":60,"props":3340,"children":3342},{"className":3341},[],[3343],{"type":51,"value":3344},"build.rs",{"type":51,"value":3346},") — preflight with ",{"type":45,"tag":60,"props":3348,"children":3350},{"className":3349},[],[3351],{"type":51,"value":416},{"type":51,"value":3353}," (via ",{"type":45,"tag":60,"props":3355,"children":3357},{"className":3356},[],[3358],{"type":51,"value":343},{"type":51,"value":3360},") before any ",{"type":45,"tag":60,"props":3362,"children":3364},{"className":3363},[],[3365],{"type":51,"value":465},{"type":51,"value":3367}," (a ",{"type":45,"tag":60,"props":3369,"children":3371},{"className":3370},[],[3372],{"type":51,"value":465},{"type":51,"value":3374}," on a missing file aborts the turn; ",{"type":45,"tag":60,"props":3376,"children":3378},{"className":3377},[],[3379],{"type":51,"value":387},{"type":51,"value":3381}," is unavailable to this orchestrator because it holds ",{"type":45,"tag":60,"props":3383,"children":3385},{"className":3384},[],[3386],{"type":51,"value":343},{"type":51,"value":3388},"). Do ",{"type":45,"tag":282,"props":3390,"children":3391},{},[3392],{"type":51,"value":379},{"type":51,"value":3394}," use ",{"type":45,"tag":60,"props":3396,"children":3398},{"className":3397},[],[3399],{"type":51,"value":1328},{"type":51,"value":3401}," for the preflight: under zsh, an unmatched glob aborts the whole compound command before ",{"type":45,"tag":60,"props":3403,"children":3405},{"className":3404},[],[3406],{"type":51,"value":1338},{"type":51,"value":1340},{"type":45,"tag":60,"props":3409,"children":3411},{"className":3410},[],[3412],{"type":51,"value":3413},"find . -maxdepth 2 -name 'README*' -o -name 'Cargo.toml' -o -name 'rust-toolchain.toml' -o -name 'build.rs'",{"type":51,"value":3415},", which never fails on no-match.",{"type":45,"tag":54,"props":3417,"children":3418},{},[3419,3421,3426,3428,3433,3434,3439,3440,3445,3446,3451,3452,3457,3458,3463,3464,3469,3470,3475,3476,3481,3482,3487,3488,3493,3494,3499,3500,3506,3508,3514,3515,3521,3522,3528,3530,3534,3536,3541,3543,3548,3550,3555,3557,3563,3565,3570,3572,3577,3579,3585,3586,3592,3593,3599],{"type":51,"value":3420},"Write ",{"type":45,"tag":60,"props":3422,"children":3424},{"className":3423},[],[3425],{"type":51,"value":3303},{"type":51,"value":3427}," with: YAML frontmatter (",{"type":45,"tag":60,"props":3429,"children":3431},{"className":3430},[],[3432],{"type":51,"value":1409},{"type":51,"value":83},{"type":45,"tag":60,"props":3435,"children":3437},{"className":3436},[],[3438],{"type":51,"value":1423},{"type":51,"value":83},{"type":45,"tag":60,"props":3441,"children":3443},{"className":3442},[],[3444],{"type":51,"value":1431},{"type":51,"value":83},{"type":45,"tag":60,"props":3447,"children":3449},{"className":3448},[],[3450],{"type":51,"value":952},{"type":51,"value":83},{"type":45,"tag":60,"props":3453,"children":3455},{"className":3454},[],[3456],{"type":51,"value":963},{"type":51,"value":83},{"type":45,"tag":60,"props":3459,"children":3461},{"className":3460},[],[3462],{"type":51,"value":1014},{"type":51,"value":83},{"type":45,"tag":60,"props":3465,"children":3467},{"className":3466},[],[3468],{"type":51,"value":1835},{"type":51,"value":83},{"type":45,"tag":60,"props":3471,"children":3473},{"className":3472},[],[3474],{"type":51,"value":1842},{"type":51,"value":83},{"type":45,"tag":60,"props":3477,"children":3479},{"className":3478},[],[3480],{"type":51,"value":1849},{"type":51,"value":83},{"type":45,"tag":60,"props":3483,"children":3485},{"className":3484},[],[3486],{"type":51,"value":1856},{"type":51,"value":83},{"type":45,"tag":60,"props":3489,"children":3491},{"className":3490},[],[3492],{"type":51,"value":1863},{"type":51,"value":83},{"type":45,"tag":60,"props":3495,"children":3497},{"className":3496},[],[3498],{"type":51,"value":3141},{"type":51,"value":83},{"type":45,"tag":60,"props":3501,"children":3503},{"className":3502},[],[3504],{"type":51,"value":3505},"cargo_manifest",{"type":51,"value":3507}," as ",{"type":45,"tag":60,"props":3509,"children":3511},{"className":3510},[],[3512],{"type":51,"value":3513},"workspace",{"type":51,"value":181},{"type":45,"tag":60,"props":3516,"children":3518},{"className":3517},[],[3519],{"type":51,"value":3520},"single-crate",{"type":51,"value":181},{"type":45,"tag":60,"props":3523,"children":3525},{"className":3524},[],[3526],{"type":51,"value":3527},"absent",{"type":51,"value":3529}," plus path when present), then a short markdown body with five sections — ",{"type":45,"tag":282,"props":3531,"children":3532},{},[3533],{"type":51,"value":233},{"type":51,"value":3535}," (1-3 sentences), ",{"type":45,"tag":282,"props":3537,"children":3538},{},[3539],{"type":51,"value":3540},"Scope",{"type":51,"value":3542}," (what's in ",{"type":45,"tag":60,"props":3544,"children":3546},{"className":3545},[],[3547],{"type":51,"value":952},{"type":51,"value":3549},", and that findings outside it are out of scope), ",{"type":45,"tag":282,"props":3551,"children":3552},{},[3553],{"type":51,"value":3554},"Entry points",{"type":51,"value":3556}," (where untrusted data enters: network, files, CLI, IPC, ",{"type":45,"tag":60,"props":3558,"children":3560},{"className":3559},[],[3561],{"type":51,"value":3562},"serde",{"type":51,"value":3564}," deserialization, FFI inputs), ",{"type":45,"tag":282,"props":3566,"children":3567},{},[3568],{"type":51,"value":3569},"Trust boundaries",{"type":51,"value":3571}," (sandboxed vs trusted peers vs arbitrary remote), ",{"type":45,"tag":282,"props":3573,"children":3574},{},[3575],{"type":51,"value":3576},"Existing hardening",{"type":51,"value":3578}," (fuzzing harnesses, MIRI runs, ",{"type":45,"tag":60,"props":3580,"children":3582},{"className":3581},[],[3583],{"type":51,"value":3584},"clippy::pedantic",{"type":51,"value":83},{"type":45,"tag":60,"props":3587,"children":3589},{"className":3588},[],[3590],{"type":51,"value":3591},"cargo-deny",{"type":51,"value":83},{"type":45,"tag":60,"props":3594,"children":3596},{"className":3595},[],[3597],{"type":51,"value":3598},"cargo-audit",{"type":51,"value":3600},").",{"type":45,"tag":1382,"props":3602,"children":3604},{"id":3603},"phase-4-build-run-plan-deterministic",[3605],{"type":51,"value":3606},"Phase 4: Build Run Plan (deterministic)",{"type":45,"tag":54,"props":3608,"children":3609},{},[3610,3614,3616,3621,3623,3628,3629,3633,3634,3640,3641,3647,3649,3655],{"type":45,"tag":282,"props":3611,"children":3612},{},[3613],{"type":51,"value":1395},{"type":51,"value":3615}," capability flags + ",{"type":45,"tag":60,"props":3617,"children":3619},{"className":3618},[],[3620],{"type":51,"value":1409},{"type":51,"value":3622}," known; ",{"type":45,"tag":60,"props":3624,"children":3626},{"className":3625},[],[3627],{"type":51,"value":3148},{"type":51,"value":3292},{"type":45,"tag":282,"props":3630,"children":3631},{},[3632],{"type":51,"value":1402},{"type":51,"value":389},{"type":45,"tag":60,"props":3635,"children":3637},{"className":3636},[],[3638],{"type":51,"value":3639},"${output_dir}\u002Fplan.json",{"type":51,"value":3150},{"type":45,"tag":60,"props":3642,"children":3644},{"className":3643},[],[3645],{"type":51,"value":3646},"${output_dir}\u002Fworker-prompts\u002F*.txt",{"type":51,"value":3648}," written; ",{"type":45,"tag":60,"props":3650,"children":3652},{"className":3651},[],[3653],{"type":51,"value":3654},"M = worker_count",{"type":51,"value":3656}," known.",{"type":45,"tag":54,"props":3658,"children":3659},{},[3660,3662,3667],{"type":51,"value":3661},"Selection, filtering, path resolution, and spawn-prompt rendering are ",{"type":45,"tag":282,"props":3663,"children":3664},{},[3665],{"type":51,"value":3666},"delegated to the script",{"type":51,"value":3668}," to keep spawn prompts complete and consistent:",{"type":45,"tag":670,"props":3670,"children":3672},{"className":2017,"code":3671,"language":2019,"meta":678,"style":678},"python3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fbuild_run_plan.py\" \\\n  --plugin-root \"${RUST_REVIEW_PLUGIN_ROOT}\" --output-dir \"${output_dir}\" \\\n  --threat-model \"${threat_model}\" --severity-filter \"${severity_filter}\" \\\n  --scope-subpath \"${finding_scope_root:-.}\" --context-roots \"${context_roots:-.}\" \\\n  --has-unsafe \"${has_unsafe}\" --has-ffi \"${has_ffi}\" \\\n  --has-concurrency \"${has_concurrency}\" --has-async \"${has_async}\" \\\n  --has-packed-repr \"${has_packed_repr}\" --has-fs-io \"${has_fs_io}\" \\\n  --max-passes-per-worker 4\n",[3673],{"type":45,"tag":60,"props":3674,"children":3675},{"__ignoreMap":678},[3676,3710,3751,3792,3849,3890,3931,3972],{"type":45,"tag":2025,"props":3677,"children":3678},{"class":2027,"line":2028},[3679,3684,3688,3692,3696,3701,3705],{"type":45,"tag":2025,"props":3680,"children":3681},{"style":2042},[3682],{"type":51,"value":3683},"python3",{"type":45,"tag":2025,"props":3685,"children":3686},{"style":2047},[3687],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3689,"children":3690},{"style":2053},[3691],{"type":51,"value":913},{"type":45,"tag":2025,"props":3693,"children":3694},{"style":2047},[3695],{"type":51,"value":3211},{"type":45,"tag":2025,"props":3697,"children":3698},{"style":2063},[3699],{"type":51,"value":3700},"\u002Fscripts\u002Fbuild_run_plan.py",{"type":45,"tag":2025,"props":3702,"children":3703},{"style":2047},[3704],{"type":51,"value":999},{"type":45,"tag":2025,"props":3706,"children":3707},{"style":2053},[3708],{"type":51,"value":3709}," \\\n",{"type":45,"tag":2025,"props":3711,"children":3712},{"class":2027,"line":2038},[3713,3718,3722,3726,3730,3735,3739,3743,3747],{"type":45,"tag":2025,"props":3714,"children":3715},{"style":2063},[3716],{"type":51,"value":3717},"  --plugin-root",{"type":45,"tag":2025,"props":3719,"children":3720},{"style":2047},[3721],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3723,"children":3724},{"style":2053},[3725],{"type":51,"value":913},{"type":45,"tag":2025,"props":3727,"children":3728},{"style":2047},[3729],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3731,"children":3732},{"style":2063},[3733],{"type":51,"value":3734}," --output-dir",{"type":45,"tag":2025,"props":3736,"children":3737},{"style":2047},[3738],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3740,"children":3741},{"style":2053},[3742],{"type":51,"value":3141},{"type":45,"tag":2025,"props":3744,"children":3745},{"style":2047},[3746],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3748,"children":3749},{"style":2053},[3750],{"type":51,"value":3709},{"type":45,"tag":2025,"props":3752,"children":3753},{"class":2027,"line":2102},[3754,3759,3763,3767,3771,3776,3780,3784,3788],{"type":45,"tag":2025,"props":3755,"children":3756},{"style":2063},[3757],{"type":51,"value":3758},"  --threat-model",{"type":45,"tag":2025,"props":3760,"children":3761},{"style":2047},[3762],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3764,"children":3765},{"style":2053},[3766],{"type":51,"value":1409},{"type":45,"tag":2025,"props":3768,"children":3769},{"style":2047},[3770],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3772,"children":3773},{"style":2063},[3774],{"type":51,"value":3775}," --severity-filter",{"type":45,"tag":2025,"props":3777,"children":3778},{"style":2047},[3779],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3781,"children":3782},{"style":2053},[3783],{"type":51,"value":1423},{"type":45,"tag":2025,"props":3785,"children":3786},{"style":2047},[3787],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3789,"children":3790},{"style":2053},[3791],{"type":51,"value":3709},{"type":45,"tag":2025,"props":3793,"children":3794},{"class":2027,"line":2112},[3795,3800,3804,3808,3812,3816,3820,3825,3829,3833,3837,3841,3845],{"type":45,"tag":2025,"props":3796,"children":3797},{"style":2063},[3798],{"type":51,"value":3799},"  --scope-subpath",{"type":45,"tag":2025,"props":3801,"children":3802},{"style":2047},[3803],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3805,"children":3806},{"style":2053},[3807],{"type":51,"value":952},{"type":45,"tag":2025,"props":3809,"children":3810},{"style":2047},[3811],{"type":51,"value":2060},{"type":45,"tag":2025,"props":3813,"children":3814},{"style":2063},[3815],{"type":51,"value":772},{"type":45,"tag":2025,"props":3817,"children":3818},{"style":2047},[3819],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3821,"children":3822},{"style":2063},[3823],{"type":51,"value":3824}," --context-roots",{"type":45,"tag":2025,"props":3826,"children":3827},{"style":2047},[3828],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3830,"children":3831},{"style":2053},[3832],{"type":51,"value":963},{"type":45,"tag":2025,"props":3834,"children":3835},{"style":2047},[3836],{"type":51,"value":2060},{"type":45,"tag":2025,"props":3838,"children":3839},{"style":2063},[3840],{"type":51,"value":772},{"type":45,"tag":2025,"props":3842,"children":3843},{"style":2047},[3844],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3846,"children":3847},{"style":2053},[3848],{"type":51,"value":3709},{"type":45,"tag":2025,"props":3850,"children":3851},{"class":2027,"line":2121},[3852,3857,3861,3865,3869,3874,3878,3882,3886],{"type":45,"tag":2025,"props":3853,"children":3854},{"style":2063},[3855],{"type":51,"value":3856},"  --has-unsafe",{"type":45,"tag":2025,"props":3858,"children":3859},{"style":2047},[3860],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3862,"children":3863},{"style":2053},[3864],{"type":51,"value":1014},{"type":45,"tag":2025,"props":3866,"children":3867},{"style":2047},[3868],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3870,"children":3871},{"style":2063},[3872],{"type":51,"value":3873}," --has-ffi",{"type":45,"tag":2025,"props":3875,"children":3876},{"style":2047},[3877],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3879,"children":3880},{"style":2053},[3881],{"type":51,"value":1835},{"type":45,"tag":2025,"props":3883,"children":3884},{"style":2047},[3885],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3887,"children":3888},{"style":2053},[3889],{"type":51,"value":3709},{"type":45,"tag":2025,"props":3891,"children":3892},{"class":2027,"line":2199},[3893,3898,3902,3906,3910,3915,3919,3923,3927],{"type":45,"tag":2025,"props":3894,"children":3895},{"style":2063},[3896],{"type":51,"value":3897},"  --has-concurrency",{"type":45,"tag":2025,"props":3899,"children":3900},{"style":2047},[3901],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3903,"children":3904},{"style":2053},[3905],{"type":51,"value":1842},{"type":45,"tag":2025,"props":3907,"children":3908},{"style":2047},[3909],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3911,"children":3912},{"style":2063},[3913],{"type":51,"value":3914}," --has-async",{"type":45,"tag":2025,"props":3916,"children":3917},{"style":2047},[3918],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3920,"children":3921},{"style":2053},[3922],{"type":51,"value":1849},{"type":45,"tag":2025,"props":3924,"children":3925},{"style":2047},[3926],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3928,"children":3929},{"style":2053},[3930],{"type":51,"value":3709},{"type":45,"tag":2025,"props":3932,"children":3933},{"class":2027,"line":2207},[3934,3939,3943,3947,3951,3956,3960,3964,3968],{"type":45,"tag":2025,"props":3935,"children":3936},{"style":2063},[3937],{"type":51,"value":3938},"  --has-packed-repr",{"type":45,"tag":2025,"props":3940,"children":3941},{"style":2047},[3942],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3944,"children":3945},{"style":2053},[3946],{"type":51,"value":1856},{"type":45,"tag":2025,"props":3948,"children":3949},{"style":2047},[3950],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3952,"children":3953},{"style":2063},[3954],{"type":51,"value":3955}," --has-fs-io",{"type":45,"tag":2025,"props":3957,"children":3958},{"style":2047},[3959],{"type":51,"value":2050},{"type":45,"tag":2025,"props":3961,"children":3962},{"style":2053},[3963],{"type":51,"value":1863},{"type":45,"tag":2025,"props":3965,"children":3966},{"style":2047},[3967],{"type":51,"value":2070},{"type":45,"tag":2025,"props":3969,"children":3970},{"style":2053},[3971],{"type":51,"value":3709},{"type":45,"tag":2025,"props":3973,"children":3974},{"class":2027,"line":2216},[3975,3980],{"type":45,"tag":2025,"props":3976,"children":3977},{"style":2063},[3978],{"type":51,"value":3979},"  --max-passes-per-worker",{"type":45,"tag":2025,"props":3981,"children":3983},{"style":3982},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[3984],{"type":51,"value":3985}," 4\n",{"type":45,"tag":54,"props":3987,"children":3988},{},[3989,3991,3996,3998,4004,4006,4012,4014,4020,4022,4028,4030,4035,4037,4043,4045,4050,4052,4057,4059,4065,4067,4072,4073,4079,4080,4085,4087,4093,4095,4100,4102,4108,4109,4114,4116,4121,4123,4128,4129,4135,4137,4143,4145,4150],{"type":51,"value":3990},"The script writes ",{"type":45,"tag":60,"props":3992,"children":3994},{"className":3993},[],[3995],{"type":51,"value":698},{"type":51,"value":3997}," + ",{"type":45,"tag":60,"props":3999,"children":4001},{"className":4000},[],[4002],{"type":51,"value":4003},"worker-prompts\u002Fworker-N.txt",{"type":51,"value":4005}," + (if ",{"type":45,"tag":60,"props":4007,"children":4009},{"className":4008},[],[4010],{"type":51,"value":4011},"--cache-primer=true",{"type":51,"value":4013},", the default) ",{"type":45,"tag":60,"props":4015,"children":4017},{"className":4016},[],[4018],{"type":51,"value":4019},"worker-prompts\u002Fcache-primer.txt",{"type":51,"value":4021},", and prints a JSON summary on stdout. Exits non-zero on any missing prompt — surface the message and stop. With the default ",{"type":45,"tag":60,"props":4023,"children":4025},{"className":4024},[],[4026],{"type":51,"value":4027},"--max-passes-per-worker 4",{"type":51,"value":4029}," the planner selects ~8 clusters → ",{"type":45,"tag":282,"props":4031,"children":4032},{},[4033],{"type":51,"value":4034},"M ≈ 13 workers",{"type":51,"value":4036}," for pure safe Rust (no FFI \u002F concurrency \u002F async; ",{"type":45,"tag":60,"props":4038,"children":4040},{"className":4039},[],[4041],{"type":51,"value":4042},"info-disclosure",{"type":51,"value":4044}," is always on), ~10 clusters → ",{"type":45,"tag":282,"props":4046,"children":4047},{},[4048],{"type":51,"value":4049},"M ≈ 15",{"type":51,"value":4051}," for concurrent safe Rust, and ~15 clusters → ",{"type":45,"tag":282,"props":4053,"children":4054},{},[4055],{"type":51,"value":4056},"M ≈ 23",{"type":51,"value":4058}," for full Rust (unsafe + FFI + concurrency + async, plus ",{"type":45,"tag":60,"props":4060,"children":4062},{"className":4061},[],[4063],{"type":51,"value":4064},"input-os-safety",{"type":51,"value":4066}," when ",{"type":45,"tag":60,"props":4068,"children":4070},{"className":4069},[],[4071],{"type":51,"value":1863},{"type":51,"value":3150},{"type":45,"tag":60,"props":4074,"children":4076},{"className":4075},[],[4077],{"type":51,"value":4078},"layout-safety",{"type":51,"value":4066},{"type":45,"tag":60,"props":4081,"children":4083},{"className":4082},[],[4084],{"type":51,"value":1856},{"type":51,"value":4086},"). M is the post-chunk worker count (",{"type":45,"tag":60,"props":4088,"children":4090},{"className":4089},[],[4091],{"type":51,"value":4092},"plan.workers.length",{"type":51,"value":4094},"), so it runs above the cluster count — chunking splits multi-pass ",{"type":45,"tag":282,"props":4096,"children":4097},{},[4098],{"type":51,"value":4099},"non-consolidated",{"type":51,"value":4101}," clusters (e.g. ",{"type":45,"tag":60,"props":4103,"children":4105},{"className":4104},[],[4106],{"type":51,"value":4107},"panic-dos",{"type":51,"value":83},{"type":45,"tag":60,"props":4110,"children":4112},{"className":4111},[],[4113],{"type":51,"value":1051},{"type":51,"value":4115},"), while the two ",{"type":45,"tag":282,"props":4117,"children":4118},{},[4119],{"type":51,"value":4120},"consolidated",{"type":51,"value":4122}," clusters (",{"type":45,"tag":60,"props":4124,"children":4126},{"className":4125},[],[4127],{"type":51,"value":1074},{"type":51,"value":83},{"type":45,"tag":60,"props":4130,"children":4132},{"className":4131},[],[4133],{"type":51,"value":4134},"concurrency-locking",{"type":51,"value":4136},") are never chunked: one worker each builds the shared inventory once and runs all its phases. ",{"type":45,"tag":60,"props":4138,"children":4140},{"className":4139},[],[4141],{"type":51,"value":4142},"recursion-dos",{"type":51,"value":4144}," is one pass per worker. After it returns, ",{"type":45,"tag":60,"props":4146,"children":4148},{"className":4147},[],[4149],{"type":51,"value":1244},{"type":51,"value":4151}," for the structured selection — never re-derive filtering or paths.",{"type":45,"tag":54,"props":4153,"children":4154},{},[4155,4161,4163,4167,4169,4175,4177,4183,4185,4191,4193,4199,4201,4207,4209,4215,4216,4222,4224,4242,4244,4250,4252,4258,4260,4266,4268,4273,4275,4281],{"type":45,"tag":60,"props":4156,"children":4158},{"className":4157},[],[4159],{"type":51,"value":4160},"--max-passes-per-worker N",{"type":51,"value":4162}," caps the per-worker pass count. The planner deterministically splits any ",{"type":45,"tag":282,"props":4164,"children":4165},{},[4166],{"type":51,"value":4099},{"type":51,"value":4168}," cluster with more than ",{"type":45,"tag":60,"props":4170,"children":4172},{"className":4171},[],[4173],{"type":51,"value":4174},"N",{"type":51,"value":4176}," passes into ",{"type":45,"tag":60,"props":4178,"children":4180},{"className":4179},[],[4181],{"type":51,"value":4182},"ceil(K\u002FN)",{"type":51,"value":4184}," contiguous chunks; each chunk becomes its own ",{"type":45,"tag":60,"props":4186,"children":4188},{"className":4187},[],[4189],{"type":51,"value":4190},"rust-review-worker",{"type":51,"value":4192}," spawn with a ",{"type":45,"tag":60,"props":4194,"children":4196},{"className":4195},[],[4197],{"type":51,"value":4198},"-{i}",{"type":51,"value":4200},"-suffixed ",{"type":45,"tag":60,"props":4202,"children":4204},{"className":4203},[],[4205],{"type":51,"value":4206},"cluster_id",{"type":51,"value":4208}," (e.g. ",{"type":45,"tag":60,"props":4210,"children":4212},{"className":4211},[],[4213],{"type":51,"value":4214},"panic-dos-1",{"type":51,"value":83},{"type":45,"tag":60,"props":4217,"children":4219},{"className":4218},[],[4220],{"type":51,"value":4221},"panic-dos-2",{"type":51,"value":4223},"). ",{"type":45,"tag":282,"props":4225,"children":4226},{},[4227,4229,4234,4235,4240],{"type":51,"value":4228},"Consolidated clusters (",{"type":45,"tag":60,"props":4230,"children":4232},{"className":4231},[],[4233],{"type":51,"value":1074},{"type":51,"value":83},{"type":45,"tag":60,"props":4236,"children":4238},{"className":4237},[],[4239],{"type":51,"value":4134},{"type":51,"value":4241},") are exempt — never chunked, regardless of pass count or override — so one worker builds their shared Phase-A inventory once and runs every phase",{"type":51,"value":4243}," (chunking a consolidated cluster would force each chunk to rebuild that inventory, which workers skip in practice). The shared prompt-cache prefix and ",{"type":45,"tag":60,"props":4245,"children":4247},{"className":4246},[],[4248],{"type":51,"value":4249},"Cluster prompt:",{"type":51,"value":4251}," path are byte-identical across chunks, so the cache primer still warms every worker. Default 4 is calibrated against the heavy-tail clusters in ",{"type":45,"tag":60,"props":4253,"children":4255},{"className":4254},[],[4256],{"type":51,"value":4257},"manifest.json",{"type":51,"value":4259},". Some output-heavy non-consolidated clusters declare a smaller manifest-level ",{"type":45,"tag":60,"props":4261,"children":4263},{"className":4262},[],[4264],{"type":51,"value":4265},"max_passes_per_worker",{"type":51,"value":4267}," override so each expensive pass gets its own worker (e.g. ",{"type":45,"tag":60,"props":4269,"children":4271},{"className":4270},[],[4272],{"type":51,"value":4142},{"type":51,"value":4274},"). Pass ",{"type":45,"tag":60,"props":4276,"children":4278},{"className":4277},[],[4279],{"type":51,"value":4280},"--max-passes-per-worker 0",{"type":51,"value":4282}," to disable all chunking, including manifest overrides (one worker per cluster).",{"type":45,"tag":1382,"props":4284,"children":4286},{"id":4285},"phase-5-create-bookkeeping-tasks-orchestrator-internal",[4287],{"type":51,"value":4288},"Phase 5: Create Bookkeeping Tasks (orchestrator-internal)",{"type":45,"tag":54,"props":4290,"children":4291},{},[4292,4296,4297,4302,4304,4310,4311,4315,4316,4322,4324,4330,4332,4338],{"type":45,"tag":282,"props":4293,"children":4294},{},[4295],{"type":51,"value":1395},{"type":51,"value":389},{"type":45,"tag":60,"props":4298,"children":4300},{"className":4299},[],[4301],{"type":51,"value":3639},{"type":51,"value":4303}," exists; ",{"type":45,"tag":60,"props":4305,"children":4307},{"className":4306},[],[4308],{"type":51,"value":4309},"M = plan.workers.length",{"type":51,"value":353},{"type":45,"tag":282,"props":4312,"children":4313},{},[4314],{"type":51,"value":1402},{"type":51,"value":389},{"type":45,"tag":60,"props":4317,"children":4319},{"className":4318},[],[4320],{"type":51,"value":4321},"cluster_task_ids[]",{"type":51,"value":4323}," created (1:1 with ",{"type":45,"tag":60,"props":4325,"children":4327},{"className":4326},[],[4328],{"type":51,"value":4329},"plan.workers",{"type":51,"value":4331},"), all ",{"type":45,"tag":60,"props":4333,"children":4335},{"className":4334},[],[4336],{"type":51,"value":4337},"pending",{"type":51,"value":772},{"type":45,"tag":54,"props":4340,"children":4341},{},[4342,4344,4349,4351,4357,4359,4365,4367,4373,4374,4380,4381,4386,4387,4393,4394,4400,4401,4407,4409,4415,4417,4422,4424,4429],{"type":51,"value":4343},"The task ledger is ",{"type":45,"tag":282,"props":4345,"children":4346},{},[4347],{"type":51,"value":4348},"orchestrator bookkeeping only",{"type":51,"value":4350}," (TUI visibility + Phase-7 retry tracking) — workers never read or write it. One ",{"type":45,"tag":60,"props":4352,"children":4354},{"className":4353},[],[4355],{"type":51,"value":4356},"TaskCreate",{"type":51,"value":4358}," per worker, populating ",{"type":45,"tag":60,"props":4360,"children":4362},{"className":4361},[],[4363],{"type":51,"value":4364},"metadata",{"type":51,"value":4366}," with ",{"type":45,"tag":60,"props":4368,"children":4370},{"className":4369},[],[4371],{"type":51,"value":4372},"kind=\"cluster\"",{"type":51,"value":83},{"type":45,"tag":60,"props":4375,"children":4377},{"className":4376},[],[4378],{"type":51,"value":4379},"worker_n",{"type":51,"value":83},{"type":45,"tag":60,"props":4382,"children":4384},{"className":4383},[],[4385],{"type":51,"value":4206},{"type":51,"value":83},{"type":45,"tag":60,"props":4388,"children":4390},{"className":4389},[],[4391],{"type":51,"value":4392},"spawn_prompt_path",{"type":51,"value":83},{"type":45,"tag":60,"props":4395,"children":4397},{"className":4396},[],[4398],{"type":51,"value":4399},"pass_prefixes",{"type":51,"value":83},{"type":45,"tag":60,"props":4402,"children":4404},{"className":4403},[],[4405],{"type":51,"value":4406},"attempt=1",{"type":51,"value":4408}," — all values copied verbatim from ",{"type":45,"tag":60,"props":4410,"children":4412},{"className":4411},[],[4413],{"type":51,"value":4414},"plan.workers[i]",{"type":51,"value":4416},". Track ",{"type":45,"tag":60,"props":4418,"children":4420},{"className":4419},[],[4421],{"type":51,"value":4321},{"type":51,"value":4423}," in ",{"type":45,"tag":60,"props":4425,"children":4427},{"className":4426},[],[4428],{"type":51,"value":4329},{"type":51,"value":4430}," order.",{"type":45,"tag":1382,"props":4432,"children":4434},{"id":4433},"phase-6-spawn-workers-optional-cache-primer-first-then-m-in-parallel",[4435],{"type":51,"value":4436},"Phase 6: Spawn workers (optional cache-primer first, then M in parallel)",{"type":45,"tag":54,"props":4438,"children":4439},{},[4440,4444,4445,4450,4452,4458,4459,4463,4465,4470],{"type":45,"tag":282,"props":4441,"children":4442},{},[4443],{"type":51,"value":1395},{"type":51,"value":389},{"type":45,"tag":60,"props":4446,"children":4448},{"className":4447},[],[4449],{"type":51,"value":4321},{"type":51,"value":4451}," populated; per-worker spawn prompt files exist at ",{"type":45,"tag":60,"props":4453,"children":4455},{"className":4454},[],[4456],{"type":51,"value":4457},"${output_dir}\u002Fworker-prompts\u002Fworker-N.txt",{"type":51,"value":353},{"type":45,"tag":282,"props":4460,"children":4461},{},[4462],{"type":51,"value":1402},{"type":51,"value":4464}," all M ",{"type":45,"tag":60,"props":4466,"children":4468},{"className":4467},[],[4469],{"type":51,"value":336},{"type":51,"value":4471}," calls — across every wave — have returned (the parallel spawn block(s) completed).",{"type":45,"tag":4473,"props":4474,"children":4476},"h4",{"id":4475},"phase-6a-cache-primer-gated-on-planruncache_primer",[4477,4479,4485],{"type":51,"value":4478},"Phase 6a: Cache primer (gated on ",{"type":45,"tag":60,"props":4480,"children":4482},{"className":4481},[],[4483],{"type":51,"value":4484},"plan.run.cache_primer",{"type":51,"value":288},{"type":45,"tag":54,"props":4487,"children":4488},{},[4489,4491,4496],{"type":51,"value":4490},"A parallel batch from cold start cannot share cache (all M requests dispatch simultaneously, none has finished writing). To warm the prefix, spawn a tiny primer first — ",{"type":45,"tag":282,"props":4492,"children":4493},{},[4494],{"type":51,"value":4495},"foreground",{"type":51,"value":4497}," (background spawns don't share cache with subsequent foreground spawns).",{"type":45,"tag":54,"props":4499,"children":4500},{},[4501,4503,4509,4510,4515,4517,4523,4525,4530,4532,4537,4538,4544,4545,4551,4552,4558,4559,4565,4567,4572,4574,4580,4582,4588,4590,4596,4598,4604,4606,4612],{"type":51,"value":4502},"If ",{"type":45,"tag":60,"props":4504,"children":4506},{"className":4505},[],[4507],{"type":51,"value":4508},"plan.run.cache_primer == true",{"type":51,"value":83},{"type":45,"tag":60,"props":4511,"children":4513},{"className":4512},[],[4514],{"type":51,"value":1022},{"type":51,"value":4516}," has written ",{"type":45,"tag":60,"props":4518,"children":4520},{"className":4519},[],[4521],{"type":51,"value":4522},"${output_dir}\u002Fworker-prompts\u002Fcache-primer.txt",{"type":51,"value":4524},". Spawn it in its own assistant message: ",{"type":45,"tag":60,"props":4526,"children":4528},{"className":4527},[],[4529],{"type":51,"value":465},{"type":51,"value":4531}," the file, pass verbatim as ",{"type":45,"tag":60,"props":4533,"children":4535},{"className":4534},[],[4536],{"type":51,"value":336},{"type":51,"value":389},{"type":45,"tag":60,"props":4539,"children":4541},{"className":4540},[],[4542],{"type":51,"value":4543},"prompt",{"type":51,"value":4366},{"type":45,"tag":60,"props":4546,"children":4548},{"className":4547},[],[4549],{"type":51,"value":4550},"subagent_type=rust-review:rust-review-worker",{"type":51,"value":83},{"type":45,"tag":60,"props":4553,"children":4555},{"className":4554},[],[4556],{"type":51,"value":4557},"model=${worker_model}",{"type":51,"value":83},{"type":45,"tag":60,"props":4560,"children":4562},{"className":4561},[],[4563],{"type":51,"value":4564},"description=\"Rust review cache primer\"",{"type":51,"value":4566},", no ",{"type":45,"tag":60,"props":4568,"children":4570},{"className":4569},[],[4571],{"type":51,"value":1212},{"type":51,"value":4573},". The script wrote the prefix byte-identical to ",{"type":45,"tag":60,"props":4575,"children":4577},{"className":4576},[],[4578],{"type":51,"value":4579},"worker-1.txt",{"type":51,"value":4581}," through the ",{"type":45,"tag":60,"props":4583,"children":4585},{"className":4584},[],[4586],{"type":51,"value":4587},"\u003Ccontext>",{"type":51,"value":4589}," block — that byte-identity is what gives the parallel workers their cache hit. The primer trailer contains ",{"type":45,"tag":60,"props":4591,"children":4593},{"className":4592},[],[4594],{"type":51,"value":4595},"Cache primer: true",{"type":51,"value":4597},", which the worker system prompt treats as a first-class mode and returns exactly ",{"type":45,"tag":60,"props":4599,"children":4601},{"className":4600},[],[4602],{"type":51,"value":4603},"worker-PRIMER abort: cache primer (no analysis performed)",{"type":51,"value":4605}," in one text response with zero tool calls. Discard the abort line — Phase 7 ignores it (no ",{"type":45,"tag":60,"props":4607,"children":4609},{"className":4608},[],[4610],{"type":51,"value":4611},"worker-N",{"type":51,"value":4613}," id).",{"type":45,"tag":54,"props":4615,"children":4616},{},[4617,4619,4625,4627,4633],{"type":51,"value":4618},"Foreground spawn already serializes — no ",{"type":45,"tag":60,"props":4620,"children":4622},{"className":4621},[],[4623],{"type":51,"value":4624},"sleep",{"type":51,"value":4626}," needed before Phase 6b. Skip Phase 6a entirely if ",{"type":45,"tag":60,"props":4628,"children":4630},{"className":4629},[],[4631],{"type":51,"value":4632},"plan.run.cache_primer == false",{"type":51,"value":772},{"type":45,"tag":4473,"props":4635,"children":4637},{"id":4636},"phase-6b-spawn-m-real-workers-in-parallel-one-message-per-wave-of-16",[4638],{"type":51,"value":4639},"Phase 6b: Spawn M real workers in parallel (one message per wave of ≤16)",{"type":45,"tag":4641,"props":4642,"children":4643},"blockquote",{},[4644,4652,4705,4724],{"type":45,"tag":54,"props":4645,"children":4646},{},[4647],{"type":45,"tag":282,"props":4648,"children":4649},{},[4650],{"type":51,"value":4651},"STOP — read this before composing the spawn message.",{"type":45,"tag":54,"props":4653,"children":4654},{},[4655,4657,4661,4663,4668,4670,4676,4678,4690,4692,4698,4700],{"type":51,"value":4656},"Workers MUST be spawned ",{"type":45,"tag":282,"props":4658,"children":4659},{},[4660],{"type":51,"value":4495},{"type":51,"value":4662}," (no ",{"type":45,"tag":60,"props":4664,"children":4666},{"className":4665},[],[4667],{"type":51,"value":1212},{"type":51,"value":4669}," field, or ",{"type":45,"tag":60,"props":4671,"children":4673},{"className":4672},[],[4674],{"type":51,"value":4675},"run_in_background=false",{"type":51,"value":4677},").\n\"Parallel\" here means ",{"type":45,"tag":547,"props":4679,"children":4680},{},[4681,4683,4688],{"type":51,"value":4682},"one assistant message containing the wave's ",{"type":45,"tag":60,"props":4684,"children":4686},{"className":4685},[],[4687],{"type":51,"value":336},{"type":51,"value":4689}," calls",{"type":51,"value":4691}," — that already runs them concurrently. (For large ",{"type":45,"tag":60,"props":4693,"children":4695},{"className":4694},[],[4696],{"type":51,"value":4697},"M",{"type":51,"value":4699},", split into consecutive waves of ≤16 calls, one message per wave — see \"Required spawn shape\" below.) ",{"type":45,"tag":282,"props":4701,"children":4702},{},[4703],{"type":51,"value":4704},"Background spawns are NOT how you parallelize this skill.",{"type":45,"tag":54,"props":4706,"children":4707},{},[4708,4710,4715,4717,4723],{"type":51,"value":4709},"Background spawns defeat Phase 6a's primer cache: every worker pays full cache-creation on its first turn (",{"type":45,"tag":60,"props":4711,"children":4713},{"className":4712},[],[4714],{"type":51,"value":1204},{"type":51,"value":4716},"), and the primer's ~15 K tokens are wasted M times over. Two real runs had exactly this symptom — every worker started with ",{"type":45,"tag":60,"props":4718,"children":4720},{"className":4719},[],[4721],{"type":51,"value":4722},"first_cr=0",{"type":51,"value":772},{"type":45,"tag":54,"props":4725,"children":4726},{},[4727,4729,4734,4736,4740,4741,4746,4748,4753],{"type":51,"value":4728},"Before sending the spawn message, audit your draft: every ",{"type":45,"tag":60,"props":4730,"children":4732},{"className":4731},[],[4733],{"type":51,"value":336},{"type":51,"value":4735}," call must have ",{"type":45,"tag":282,"props":4737,"children":4738},{},[4739],{"type":51,"value":444},{"type":51,"value":389},{"type":45,"tag":60,"props":4742,"children":4744},{"className":4743},[],[4745],{"type":51,"value":1212},{"type":51,"value":4747}," key. If you wrote ",{"type":45,"tag":60,"props":4749,"children":4751},{"className":4750},[],[4752],{"type":51,"value":1196},{"type":51,"value":4754},", delete it.",{"type":45,"tag":54,"props":4756,"children":4757},{},[4758,4763,4765,4770,4772,4777],{"type":45,"tag":282,"props":4759,"children":4760},{},[4761],{"type":51,"value":4762},"Required spawn shape:",{"type":51,"value":4764}," emit a single assistant message containing the wave's ",{"type":45,"tag":60,"props":4766,"children":4768},{"className":4767},[],[4769],{"type":51,"value":336},{"type":51,"value":4771}," tool invocations — that one message is what runs them concurrently. Sequential spawning (one ",{"type":45,"tag":60,"props":4773,"children":4775},{"className":4774},[],[4776],{"type":51,"value":336},{"type":51,"value":4778}," call per message) serializes the review and is also wrong, but that failure is loud (timing); the background-spawn failure is silent (cost).",{"type":45,"tag":54,"props":4780,"children":4781},{},[4782,4794,4796,4801,4803,4809,4810,4815,4817,4828],{"type":45,"tag":282,"props":4783,"children":4784},{},[4785,4787,4792],{"type":51,"value":4786},"Waves when ",{"type":45,"tag":60,"props":4788,"children":4790},{"className":4789},[],[4791],{"type":51,"value":4697},{"type":51,"value":4793}," exceeds the per-message cap.",{"type":51,"value":4795}," The harness caps the number of ",{"type":45,"tag":60,"props":4797,"children":4799},{"className":4798},[],[4800],{"type":51,"value":336},{"type":51,"value":4802}," calls it will dispatch from a single assistant message (observed: ~20 in Claude Code — a real 25-worker run silently kept only the first 20 and had to spawn the remaining 5 in a second message). So when ",{"type":45,"tag":60,"props":4804,"children":4806},{"className":4805},[],[4807],{"type":51,"value":4808},"M > 16",{"type":51,"value":83},{"type":45,"tag":282,"props":4811,"children":4812},{},[4813],{"type":51,"value":4814},"plan the waves up front",{"type":51,"value":4816},": split the workers into consecutive waves of ",{"type":45,"tag":282,"props":4818,"children":4819},{},[4820,4822,4827],{"type":51,"value":4821},"≤16 ",{"type":45,"tag":60,"props":4823,"children":4825},{"className":4824},[],[4826],{"type":51,"value":336},{"type":51,"value":4689},{"type":51,"value":4829},", each wave its own single assistant message. Rules:",{"type":45,"tag":134,"props":4831,"children":4832},{},[4833,4868,4912,4936,4961,4978],{"type":45,"tag":138,"props":4834,"children":4835},{},[4836,4841,4843,4848,4850,4854,4856,4860,4861,4866],{"type":45,"tag":282,"props":4837,"children":4838},{},[4839],{"type":51,"value":4840},"Within a wave:",{"type":51,"value":4842}," all ",{"type":45,"tag":60,"props":4844,"children":4846},{"className":4845},[],[4847],{"type":51,"value":336},{"type":51,"value":4849}," calls in ",{"type":45,"tag":282,"props":4851,"children":4852},{},[4853],{"type":51,"value":1494},{"type":51,"value":4855}," message, ",{"type":45,"tag":282,"props":4857,"children":4858},{},[4859],{"type":51,"value":4495},{"type":51,"value":4662},{"type":45,"tag":60,"props":4862,"children":4864},{"className":4863},[],[4865],{"type":51,"value":1212},{"type":51,"value":4867},") — identical shape to a single-wave run.",{"type":45,"tag":138,"props":4869,"children":4870},{},[4871,4876,4878,4883,4885,4890,4892,4897,4899,4904,4906,4910],{"type":45,"tag":282,"props":4872,"children":4873},{},[4874],{"type":51,"value":4875},"Across waves:",{"type":51,"value":4877}," wave ",{"type":45,"tag":547,"props":4879,"children":4880},{},[4881],{"type":51,"value":4882},"k+1",{"type":51,"value":4884}," is a ",{"type":45,"tag":282,"props":4886,"children":4887},{},[4888],{"type":51,"value":4889},"separate",{"type":51,"value":4891}," message that can only be sent after wave ",{"type":45,"tag":547,"props":4893,"children":4894},{},[4895],{"type":51,"value":4896},"k",{"type":51,"value":4898},"'s ",{"type":45,"tag":60,"props":4900,"children":4902},{"className":4901},[],[4903],{"type":51,"value":336},{"type":51,"value":4905}," calls all return (a tool-use message ends the turn). Waves are therefore serialized with respect to each other — that is correct and loud; accept it. Do ",{"type":45,"tag":282,"props":4907,"children":4908},{},[4909],{"type":51,"value":379},{"type":51,"value":4911}," try to overlap them.",{"type":45,"tag":138,"props":4913,"children":4914},{},[4915,4920,4922,4927,4929,4934],{"type":45,"tag":282,"props":4916,"children":4917},{},[4918],{"type":51,"value":4919},"Never",{"type":51,"value":4921}," reach for ",{"type":45,"tag":60,"props":4923,"children":4925},{"className":4924},[],[4926],{"type":51,"value":1196},{"type":51,"value":4928}," to fit more workers in one message. More ",{"type":45,"tag":547,"props":4930,"children":4931},{},[4932],{"type":51,"value":4933},"waves",{"type":51,"value":4935},", never background — background defeats the primer cache (see the STOP box) and is the cardinal error this skill guards against.",{"type":45,"tag":138,"props":4937,"children":4938},{},[4939,4944,4946,4952,4954,4959],{"type":45,"tag":282,"props":4940,"children":4941},{},[4942],{"type":51,"value":4943},"Cache across waves:",{"type":51,"value":4945}," the primer prefix has a ~5-minute cache TTL that refreshes on every hit, so back-to-back waves keep hitting it (the 25-worker run confirmed ",{"type":45,"tag":60,"props":4947,"children":4949},{"className":4948},[],[4950],{"type":51,"value":4951},"cache_read≈14 K",{"type":51,"value":4953}," on its second wave). If a later wave will start more than ~5 minutes after the previous one (very large ",{"type":45,"tag":60,"props":4955,"children":4957},{"className":4956},[],[4958],{"type":51,"value":4697},{"type":51,"value":4960}," or slow workers), re-spawn the Phase-6a primer in its own message first to re-warm the prefix before that wave.",{"type":45,"tag":138,"props":4962,"children":4963},{},[4964,4969,4970,4976],{"type":45,"tag":282,"props":4965,"children":4966},{},[4967],{"type":51,"value":4968},"Balance the waves",{"type":51,"value":4208},{"type":45,"tag":60,"props":4971,"children":4973},{"className":4972},[],[4974],{"type":51,"value":4975},"M=25",{"type":51,"value":4977}," → 13+12, not 20+5) so no wave hugs the cap and the last wave isn't a tiny straggler.",{"type":45,"tag":138,"props":4979,"children":4980},{},[4981,4983,4988],{"type":51,"value":4982},"After every wave has returned, proceed to Phase 7 with the ",{"type":45,"tag":282,"props":4984,"children":4985},{},[4986],{"type":51,"value":4987},"full",{"type":51,"value":4989}," set of M worker results.",{"type":45,"tag":54,"props":4991,"children":4992},{},[4993,4995,5001],{"type":51,"value":4994},"For each worker ",{"type":45,"tag":60,"props":4996,"children":4998},{"className":4997},[],[4999],{"type":51,"value":5000},"N ∈ [1..M]",{"type":51,"value":5002}," (in its assigned wave):",{"type":45,"tag":808,"props":5004,"children":5005},{},[5006,5015],{"type":45,"tag":138,"props":5007,"children":5008},{},[5009],{"type":45,"tag":60,"props":5010,"children":5012},{"className":5011},[],[5013],{"type":51,"value":5014},"Read: ${output_dir}\u002Fworker-prompts\u002Fworker-N.txt",{"type":45,"tag":138,"props":5016,"children":5017},{},[5018,5020,5025,5027,5032,5034,5039],{"type":51,"value":5019},"Pass the file contents ",{"type":45,"tag":282,"props":5021,"children":5022},{},[5023],{"type":51,"value":5024},"verbatim",{"type":51,"value":5026}," as the ",{"type":45,"tag":60,"props":5028,"children":5030},{"className":5029},[],[5031],{"type":51,"value":336},{"type":51,"value":5033}," tool's ",{"type":45,"tag":60,"props":5035,"children":5037},{"className":5036},[],[5038],{"type":51,"value":4543},{"type":51,"value":5040}," argument:",{"type":45,"tag":212,"props":5042,"children":5043},{},[5044,5059],{"type":45,"tag":216,"props":5045,"children":5046},{},[5047],{"type":45,"tag":220,"props":5048,"children":5049},{},[5050,5054],{"type":45,"tag":224,"props":5051,"children":5052},{},[5053],{"type":51,"value":1522},{"type":45,"tag":224,"props":5055,"children":5056},{},[5057],{"type":51,"value":5058},"Value",{"type":45,"tag":240,"props":5060,"children":5061},{},[5062,5082,5105,5126,5150],{"type":45,"tag":220,"props":5063,"children":5064},{},[5065,5074],{"type":45,"tag":247,"props":5066,"children":5067},{},[5068],{"type":45,"tag":60,"props":5069,"children":5071},{"className":5070},[],[5072],{"type":51,"value":5073},"subagent_type",{"type":45,"tag":247,"props":5075,"children":5076},{},[5077],{"type":45,"tag":60,"props":5078,"children":5080},{"className":5079},[],[5081],{"type":51,"value":81},{"type":45,"tag":220,"props":5083,"children":5084},{},[5085,5094],{"type":45,"tag":247,"props":5086,"children":5087},{},[5088],{"type":45,"tag":60,"props":5089,"children":5091},{"className":5090},[],[5092],{"type":51,"value":5093},"model",{"type":45,"tag":247,"props":5095,"children":5096},{},[5097,5103],{"type":45,"tag":60,"props":5098,"children":5100},{"className":5099},[],[5101],{"type":51,"value":5102},"${worker_model}",{"type":51,"value":5104}," (haiku \u002F sonnet \u002F opus)",{"type":45,"tag":220,"props":5106,"children":5107},{},[5108,5117],{"type":45,"tag":247,"props":5109,"children":5110},{},[5111],{"type":45,"tag":60,"props":5112,"children":5114},{"className":5113},[],[5115],{"type":51,"value":5116},"description",{"type":45,"tag":247,"props":5118,"children":5119},{},[5120],{"type":45,"tag":60,"props":5121,"children":5123},{"className":5122},[],[5124],{"type":51,"value":5125},"Rust review worker N",{"type":45,"tag":220,"props":5127,"children":5128},{},[5129,5137],{"type":45,"tag":247,"props":5130,"children":5131},{},[5132],{"type":45,"tag":60,"props":5133,"children":5135},{"className":5134},[],[5136],{"type":51,"value":4543},{"type":45,"tag":247,"props":5138,"children":5139},{},[5140,5142,5148],{"type":51,"value":5141},"the full text of ",{"type":45,"tag":60,"props":5143,"children":5145},{"className":5144},[],[5146],{"type":51,"value":5147},"worker-N.txt",{"type":51,"value":5149}," (no edits)",{"type":45,"tag":220,"props":5151,"children":5152},{},[5153,5161],{"type":45,"tag":247,"props":5154,"children":5155},{},[5156],{"type":45,"tag":60,"props":5157,"children":5159},{"className":5158},[],[5160],{"type":51,"value":1212},{"type":45,"tag":247,"props":5162,"children":5163},{},[5164,5175,5177,5183],{"type":45,"tag":282,"props":5165,"children":5166},{},[5167,5169,5174],{"type":51,"value":5168},"field MUST be omitted, OR set to ",{"type":45,"tag":60,"props":5170,"children":5172},{"className":5171},[],[5173],{"type":51,"value":1067},{"type":51,"value":772},{"type":51,"value":5176}," Never ",{"type":45,"tag":60,"props":5178,"children":5180},{"className":5179},[],[5181],{"type":51,"value":5182},"true",{"type":51,"value":5184},". See the foreground-spawn warning above.",{"type":45,"tag":54,"props":5186,"children":5187},{},[5188,5190,5195],{"type":51,"value":5189},"The spawn prompt is the single authority. Pass it verbatim — every field is required by the worker's self-check; any deviation triggers ",{"type":45,"tag":60,"props":5191,"children":5193},{"className":5192},[],[5194],{"type":51,"value":1236},{"type":51,"value":772},{"type":45,"tag":54,"props":5197,"children":5198},{},[5199],{"type":45,"tag":282,"props":5200,"children":5201},{},[5202],{"type":51,"value":5203},"Anti-patterns to reject:",{"type":45,"tag":134,"props":5205,"children":5206},{},[5207,5222,5245,5256,5267],{"type":45,"tag":138,"props":5208,"children":5209},{},[5210,5220],{"type":45,"tag":282,"props":5211,"children":5212},{},[5213,5215],{"type":51,"value":5214},"Passing ",{"type":45,"tag":60,"props":5216,"children":5218},{"className":5217},[],[5219],{"type":51,"value":1196},{"type":51,"value":5221}," (see warning above).",{"type":45,"tag":138,"props":5223,"children":5224},{},[5225,5237,5238,5243],{"type":45,"tag":282,"props":5226,"children":5227},{},[5228,5230,5235],{"type":51,"value":5229},"Cramming more than ~16 ",{"type":45,"tag":60,"props":5231,"children":5233},{"className":5232},[],[5234],{"type":51,"value":336},{"type":51,"value":5236}," calls into one message",{"type":51,"value":4066},{"type":45,"tag":60,"props":5239,"children":5241},{"className":5240},[],[5242],{"type":51,"value":4697},{"type":51,"value":5244}," is large — the harness silently keeps only the first ~20 and drops the rest. Use balanced waves of ≤16, never background spawns, to cover all M.",{"type":45,"tag":138,"props":5246,"children":5247},{},[5248,5250,5255],{"type":51,"value":5249},"Hand-typing the spawn prompt instead of reading ",{"type":45,"tag":60,"props":5251,"children":5253},{"className":5252},[],[5254],{"type":51,"value":5147},{"type":51,"value":772},{"type":45,"tag":138,"props":5257,"children":5258},{},[5259,5261],{"type":51,"value":5260},"Inserting Task-related instructions (\"first call TaskList\", \"Assigned task id: ",{"type":45,"tag":5262,"props":5263,"children":5264},"n",{},[5265],{"type":51,"value":5266},"\"). Workers have no Task tools.",{"type":45,"tag":138,"props":5268,"children":5269},{},[5270],{"type":51,"value":5271},"Editing the rendered prompt before passing it (trimming \"redundant\" fields, collapsing pass lists).",{"type":45,"tag":1382,"props":5273,"children":5275},{"id":5274},"phase-7-wait-for-workers-and-classify-outcomes",[5276],{"type":51,"value":5277},"Phase 7: Wait for Workers and Classify Outcomes",{"type":45,"tag":54,"props":5279,"children":5280},{},[5281,5285,5287,5292,5294,5298,5300,5306],{"type":45,"tag":282,"props":5282,"children":5283},{},[5284],{"type":51,"value":1395},{"type":51,"value":5286}," all M Phase-6 ",{"type":45,"tag":60,"props":5288,"children":5290},{"className":5289},[],[5291],{"type":51,"value":336},{"type":51,"value":5293}," calls have returned. ",{"type":45,"tag":282,"props":5295,"children":5296},{},[5297],{"type":51,"value":1402},{"type":51,"value":5299}," every cluster has either succeeded or been retried up to the cap; ",{"type":45,"tag":60,"props":5301,"children":5303},{"className":5302},[],[5304],{"type":51,"value":5305},"${output_dir}\u002Ffindings-index.txt",{"type":51,"value":3305},{"type":45,"tag":54,"props":5308,"children":5309},{},[5310,5312,5317],{"type":51,"value":5311},"The Phase-6 ",{"type":45,"tag":60,"props":5313,"children":5315},{"className":5314},[],[5316],{"type":51,"value":336},{"type":51,"value":5318}," invocations block until each worker returns. Inspect each worker's return text and apply this classifier in order — first match wins:",{"type":45,"tag":212,"props":5320,"children":5321},{},[5322,5348],{"type":45,"tag":216,"props":5323,"children":5324},{},[5325],{"type":45,"tag":220,"props":5326,"children":5327},{},[5328,5333,5338,5343],{"type":45,"tag":224,"props":5329,"children":5330},{},[5331],{"type":51,"value":5332},"#",{"type":45,"tag":224,"props":5334,"children":5335},{},[5336],{"type":51,"value":5337},"Match (in return text)",{"type":45,"tag":224,"props":5339,"children":5340},{},[5341],{"type":51,"value":5342},"Outcome",{"type":45,"tag":224,"props":5344,"children":5345},{},[5346],{"type":51,"value":5347},"Action",{"type":45,"tag":240,"props":5349,"children":5350},{},[5351,5403,5450,5510],{"type":45,"tag":220,"props":5352,"children":5353},{},[5354,5359,5368,5376],{"type":45,"tag":247,"props":5355,"children":5356},{},[5357],{"type":51,"value":5358},"1",{"type":45,"tag":247,"props":5360,"children":5361},{},[5362],{"type":45,"tag":60,"props":5363,"children":5365},{"className":5364},[],[5366],{"type":51,"value":5367},"worker-N complete:",{"type":45,"tag":247,"props":5369,"children":5370},{},[5371],{"type":45,"tag":282,"props":5372,"children":5373},{},[5374],{"type":51,"value":5375},"provisional success",{"type":45,"tag":247,"props":5377,"children":5378},{},[5379,5381,5387,5389,5395,5397,5402],{"type":51,"value":5380},"Parse the ",{"type":45,"tag":60,"props":5382,"children":5384},{"className":5383},[],[5385],{"type":51,"value":5386},"wrote N finding files",{"type":51,"value":5388}," count, then run the artifact validator below before ",{"type":45,"tag":60,"props":5390,"children":5392},{"className":5391},[],[5393],{"type":51,"value":5394},"TaskUpdate",{"type":51,"value":5396}," to ",{"type":45,"tag":60,"props":5398,"children":5400},{"className":5399},[],[5401],{"type":51,"value":1268},{"type":51,"value":772},{"type":45,"tag":220,"props":5404,"children":5405},{},[5406,5411,5437,5445],{"type":45,"tag":247,"props":5407,"children":5408},{},[5409],{"type":51,"value":5410},"2",{"type":45,"tag":247,"props":5412,"children":5413},{},[5414,5420,5421,5427,5429,5435],{"type":45,"tag":60,"props":5415,"children":5417},{"className":5416},[],[5418],{"type":51,"value":5419},"abort: spawn prompt malformed",{"type":51,"value":83},{"type":45,"tag":60,"props":5422,"children":5424},{"className":5423},[],[5425],{"type":51,"value":5426},"abort: pre-work budget exceeded",{"type":51,"value":5428},", or ",{"type":45,"tag":60,"props":5430,"children":5432},{"className":5431},[],[5433],{"type":51,"value":5434},"abort: TaskList unavailable",{"type":51,"value":5436}," (legacy)",{"type":45,"tag":247,"props":5438,"children":5439},{},[5440],{"type":45,"tag":282,"props":5441,"children":5442},{},[5443],{"type":51,"value":5444},"non-retryable orchestrator bug",{"type":45,"tag":247,"props":5446,"children":5447},{},[5448],{"type":51,"value":5449},"Stop the run, surface the abort + spawn-prompt path. Re-running the same prompt repeats the failure — pre-work-budget exhaustion always means the worker couldn't pass its self-check, which a retry won't fix.",{"type":45,"tag":220,"props":5451,"children":5452},{},[5453,5458,5469,5477],{"type":45,"tag":247,"props":5454,"children":5455},{},[5456],{"type":51,"value":5457},"3",{"type":45,"tag":247,"props":5459,"children":5460},{},[5461,5463],{"type":51,"value":5462},"other ",{"type":45,"tag":60,"props":5464,"children":5466},{"className":5465},[],[5467],{"type":51,"value":5468},"worker-N abort:",{"type":45,"tag":247,"props":5470,"children":5471},{},[5472],{"type":45,"tag":282,"props":5473,"children":5474},{},[5475],{"type":51,"value":5476},"retryable",{"type":45,"tag":247,"props":5478,"children":5479},{},[5480,5482,5487,5488,5494,5495,5501,5503,5509],{"type":51,"value":5481},"Mark ",{"type":45,"tag":60,"props":5483,"children":5485},{"className":5484},[],[5486],{"type":51,"value":4337},{"type":51,"value":1779},{"type":45,"tag":60,"props":5489,"children":5491},{"className":5490},[],[5492],{"type":51,"value":5493},"metadata.abort_reason",{"type":51,"value":83},{"type":45,"tag":60,"props":5496,"children":5498},{"className":5497},[],[5499],{"type":51,"value":5500},"needs_respawn=true",{"type":51,"value":5502},", increment ",{"type":45,"tag":60,"props":5504,"children":5506},{"className":5505},[],[5507],{"type":51,"value":5508},"attempt",{"type":51,"value":772},{"type":45,"tag":220,"props":5511,"children":5512},{},[5513,5518,5543,5550],{"type":45,"tag":247,"props":5514,"children":5515},{},[5516],{"type":51,"value":5517},"4",{"type":45,"tag":247,"props":5519,"children":5520},{},[5521,5526,5528,5534,5535,5541],{"type":45,"tag":60,"props":5522,"children":5524},{"className":5523},[],[5525],{"type":51,"value":336},{"type":51,"value":5527}," errored or no ",{"type":45,"tag":60,"props":5529,"children":5531},{"className":5530},[],[5532],{"type":51,"value":5533},"complete:",{"type":51,"value":181},{"type":45,"tag":60,"props":5536,"children":5538},{"className":5537},[],[5539],{"type":51,"value":5540},"abort:",{"type":51,"value":5542}," token",{"type":45,"tag":247,"props":5544,"children":5545},{},[5546],{"type":45,"tag":282,"props":5547,"children":5548},{},[5549],{"type":51,"value":5476},{"type":45,"tag":247,"props":5551,"children":5552},{},[5553],{"type":51,"value":5554},"Same as #3 (transient worker crash).",{"type":45,"tag":54,"props":5556,"children":5557},{},[5558,5560,5565,5567,5572,5574,5579,5581,5587,5589,5593,5595,5601],{"type":51,"value":5559},"If any non-retryable, stop. Otherwise, ",{"type":45,"tag":282,"props":5561,"children":5562},{},[5563],{"type":51,"value":5564},"before re-spawning, clear each retryable worker's prefix-space on disk",{"type":51,"value":5566}," — the Phase-7 index is built from disk, so a crashed attempt's higher-id stragglers (files the replacement never re-emits) would otherwise be resurrected into the report. Loop over the worker's actual ",{"type":45,"tag":60,"props":5568,"children":5570},{"className":5569},[],[5571],{"type":51,"value":4399},{"type":51,"value":5573}," (from its task ",{"type":45,"tag":60,"props":5575,"children":5577},{"className":5576},[],[5578],{"type":51,"value":4364},{"type":51,"value":5580},"), substituting each real prefix for ",{"type":45,"tag":60,"props":5582,"children":5584},{"className":5583},[],[5585],{"type":51,"value":5586},"${pfx}",{"type":51,"value":5588}," — do ",{"type":45,"tag":282,"props":5590,"children":5591},{},[5592],{"type":51,"value":379},{"type":51,"value":5594}," run the command with a literal ",{"type":45,"tag":60,"props":5596,"children":5598},{"className":5597},[],[5599],{"type":51,"value":5600},"PREFIX",{"type":51,"value":5602},":",{"type":45,"tag":670,"props":5604,"children":5606},{"className":2017,"code":5605,"language":2019,"meta":678,"style":678},"# zsh-safe: `find … -delete` never aborts on no-match (an `rm PREFIX-*.md` glob would).\n# Replace `PREFIX1 PREFIX2` with the worker's actual space-separated pass_prefixes.\nfor pfx in PREFIX1 PREFIX2; do\n  find \"${output_dir}\u002Ffindings\" -maxdepth 1 -type f -name \"${pfx}-*.md\" -delete\ndone\n",[5607],{"type":45,"tag":60,"props":5608,"children":5609},{"__ignoreMap":678},[5610,5618,5626,5662,5740],{"type":45,"tag":2025,"props":5611,"children":5612},{"class":2027,"line":2028},[5613],{"type":45,"tag":2025,"props":5614,"children":5615},{"style":2032},[5616],{"type":51,"value":5617},"# zsh-safe: `find … -delete` never aborts on no-match (an `rm PREFIX-*.md` glob would).\n",{"type":45,"tag":2025,"props":5619,"children":5620},{"class":2027,"line":2038},[5621],{"type":45,"tag":2025,"props":5622,"children":5623},{"style":2032},[5624],{"type":51,"value":5625},"# Replace `PREFIX1 PREFIX2` with the worker's actual space-separated pass_prefixes.\n",{"type":45,"tag":2025,"props":5627,"children":5628},{"class":2027,"line":2102},[5629,5634,5639,5644,5649,5654,5658],{"type":45,"tag":2025,"props":5630,"children":5631},{"style":3004},[5632],{"type":51,"value":5633},"for",{"type":45,"tag":2025,"props":5635,"children":5636},{"style":2053},[5637],{"type":51,"value":5638}," pfx ",{"type":45,"tag":2025,"props":5640,"children":5641},{"style":3004},[5642],{"type":51,"value":5643},"in",{"type":45,"tag":2025,"props":5645,"children":5646},{"style":2063},[5647],{"type":51,"value":5648}," PREFIX1",{"type":45,"tag":2025,"props":5650,"children":5651},{"style":2063},[5652],{"type":51,"value":5653}," PREFIX2",{"type":45,"tag":2025,"props":5655,"children":5656},{"style":2047},[5657],{"type":51,"value":3037},{"type":45,"tag":2025,"props":5659,"children":5660},{"style":3004},[5661],{"type":51,"value":3042},{"type":45,"tag":2025,"props":5663,"children":5664},{"class":2027,"line":2112},[5665,5669,5673,5677,5681,5685,5689,5694,5699,5704,5709,5713,5717,5722,5726,5731,5735],{"type":45,"tag":2025,"props":5666,"children":5667},{"style":2042},[5668],{"type":51,"value":3050},{"type":45,"tag":2025,"props":5670,"children":5671},{"style":2047},[5672],{"type":51,"value":2050},{"type":45,"tag":2025,"props":5674,"children":5675},{"style":2053},[5676],{"type":51,"value":3141},{"type":45,"tag":2025,"props":5678,"children":5679},{"style":2047},[5680],{"type":51,"value":3211},{"type":45,"tag":2025,"props":5682,"children":5683},{"style":2063},[5684],{"type":51,"value":3216},{"type":45,"tag":2025,"props":5686,"children":5687},{"style":2047},[5688],{"type":51,"value":999},{"type":45,"tag":2025,"props":5690,"children":5691},{"style":2063},[5692],{"type":51,"value":5693}," -maxdepth",{"type":45,"tag":2025,"props":5695,"children":5696},{"style":3982},[5697],{"type":51,"value":5698}," 1",{"type":45,"tag":2025,"props":5700,"children":5701},{"style":2063},[5702],{"type":51,"value":5703}," -type",{"type":45,"tag":2025,"props":5705,"children":5706},{"style":2063},[5707],{"type":51,"value":5708}," f",{"type":45,"tag":2025,"props":5710,"children":5711},{"style":2063},[5712],{"type":51,"value":2075},{"type":45,"tag":2025,"props":5714,"children":5715},{"style":2047},[5716],{"type":51,"value":2050},{"type":45,"tag":2025,"props":5718,"children":5719},{"style":2053},[5720],{"type":51,"value":5721},"pfx",{"type":45,"tag":2025,"props":5723,"children":5724},{"style":2047},[5725],{"type":51,"value":3211},{"type":45,"tag":2025,"props":5727,"children":5728},{"style":2063},[5729],{"type":51,"value":5730},"-*.md",{"type":45,"tag":2025,"props":5732,"children":5733},{"style":2047},[5734],{"type":51,"value":999},{"type":45,"tag":2025,"props":5736,"children":5737},{"style":2063},[5738],{"type":51,"value":5739}," -delete\n",{"type":45,"tag":2025,"props":5741,"children":5742},{"class":2027,"line":2121},[5743],{"type":45,"tag":2025,"props":5744,"children":5745},{"style":3004},[5746],{"type":51,"value":5747},"done\n",{"type":45,"tag":54,"props":5749,"children":5750},{},[5751,5753,5758,5760,5766,5768,5773,5775,5780,5782,5787,5789,5795,5797,5802,5804,5810],{"type":51,"value":5752},"Then re-spawn each ",{"type":45,"tag":60,"props":5754,"children":5756},{"className":5755},[],[5757],{"type":51,"value":4337},{"type":51,"value":5759}," retryable with ",{"type":45,"tag":60,"props":5761,"children":5763},{"className":5762},[],[5764],{"type":51,"value":5765},"attempt \u003C= 2",{"type":51,"value":5767}," in one parallel block (cap = 2 attempts per cluster). ",{"type":45,"tag":60,"props":5769,"children":5771},{"className":5770},[],[5772],{"type":51,"value":5508},{"type":51,"value":5774}," was just incremented to ",{"type":45,"tag":60,"props":5776,"children":5778},{"className":5777},[],[5779],{"type":51,"value":5410},{"type":51,"value":5781}," on the first failure, so the guard must admit ",{"type":45,"tag":60,"props":5783,"children":5785},{"className":5784},[],[5786],{"type":51,"value":5410},{"type":51,"value":5788}," to allow the single retry — ",{"type":45,"tag":60,"props":5790,"children":5792},{"className":5791},[],[5793],{"type":51,"value":5794},"attempt \u003C 2",{"type":51,"value":5796}," would block every retry. A second failure increments to ",{"type":45,"tag":60,"props":5798,"children":5800},{"className":5799},[],[5801],{"type":51,"value":5457},{"type":51,"value":5803},", which fails ",{"type":45,"tag":60,"props":5805,"children":5807},{"className":5806},[],[5808],{"type":51,"value":5809},"\u003C= 2",{"type":51,"value":5811}," and ends retries. Replacement workers reuse deterministic finding IDs per prefix, so a cleared prefix-space plus a fresh write yields a consistent shard \u002F coverage \u002F disk set.",{"type":45,"tag":4473,"props":5813,"children":5815},{"id":5814},"sanity-check-write-index",[5816],{"type":51,"value":5817},"Sanity-check + write index",{"type":45,"tag":54,"props":5819,"children":5820},{},[5821,5823,5828,5830,5835,5837,5843,5845,5851],{"type":51,"value":5822},"For every provisional ",{"type":45,"tag":60,"props":5824,"children":5826},{"className":5825},[],[5827],{"type":51,"value":5533},{"type":51,"value":5829}," cluster, validate the worker-owned shard, coverage file, coverage rows, filed IDs, and claimed finding count against ",{"type":45,"tag":60,"props":5831,"children":5833},{"className":5832},[],[5834],{"type":51,"value":698},{"type":51,"value":5836}," before marking the task completed. Run one command per completed worker, or validate multiple workers in one command. Both claimed-count forms below are valid; do not pass bare ",{"type":45,"tag":60,"props":5838,"children":5840},{"className":5839},[],[5841],{"type":51,"value":5842},"worker-N=N",{"type":51,"value":5844}," values without either grouping them after a ",{"type":45,"tag":60,"props":5846,"children":5848},{"className":5847},[],[5849],{"type":51,"value":5850},"--claimed-count",{"type":51,"value":5852}," flag or repeating the flag.",{"type":45,"tag":670,"props":5854,"children":5856},{"className":2017,"code":5855,"language":2019,"meta":678,"style":678},"python3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fvalidate_artifacts.py\" \"${output_dir}\u002Fplan.json\" \\\n  --worker worker-N --claimed-count worker-N=\u003Cclaimed_count_from_complete_line>\n",[5857],{"type":45,"tag":60,"props":5858,"children":5859},{"__ignoreMap":678},[5860,5913],{"type":45,"tag":2025,"props":5861,"children":5862},{"class":2027,"line":2028},[5863,5867,5871,5875,5879,5884,5888,5892,5896,5900,5905,5909],{"type":45,"tag":2025,"props":5864,"children":5865},{"style":2042},[5866],{"type":51,"value":3683},{"type":45,"tag":2025,"props":5868,"children":5869},{"style":2047},[5870],{"type":51,"value":2050},{"type":45,"tag":2025,"props":5872,"children":5873},{"style":2053},[5874],{"type":51,"value":913},{"type":45,"tag":2025,"props":5876,"children":5877},{"style":2047},[5878],{"type":51,"value":3211},{"type":45,"tag":2025,"props":5880,"children":5881},{"style":2063},[5882],{"type":51,"value":5883},"\u002Fscripts\u002Fvalidate_artifacts.py",{"type":45,"tag":2025,"props":5885,"children":5886},{"style":2047},[5887],{"type":51,"value":999},{"type":45,"tag":2025,"props":5889,"children":5890},{"style":2047},[5891],{"type":51,"value":2050},{"type":45,"tag":2025,"props":5893,"children":5894},{"style":2053},[5895],{"type":51,"value":3141},{"type":45,"tag":2025,"props":5897,"children":5898},{"style":2047},[5899],{"type":51,"value":3211},{"type":45,"tag":2025,"props":5901,"children":5902},{"style":2063},[5903],{"type":51,"value":5904},"\u002Fplan.json",{"type":45,"tag":2025,"props":5906,"children":5907},{"style":2047},[5908],{"type":51,"value":999},{"type":45,"tag":2025,"props":5910,"children":5911},{"style":2053},[5912],{"type":51,"value":3709},{"type":45,"tag":2025,"props":5914,"children":5915},{"class":2027,"line":2038},[5916,5921,5926,5931,5936,5941,5946,5951],{"type":45,"tag":2025,"props":5917,"children":5918},{"style":2063},[5919],{"type":51,"value":5920},"  --worker",{"type":45,"tag":2025,"props":5922,"children":5923},{"style":2063},[5924],{"type":51,"value":5925}," worker-N",{"type":45,"tag":2025,"props":5927,"children":5928},{"style":2063},[5929],{"type":51,"value":5930}," --claimed-count",{"type":45,"tag":2025,"props":5932,"children":5933},{"style":2063},[5934],{"type":51,"value":5935}," worker-N=",{"type":45,"tag":2025,"props":5937,"children":5938},{"style":2047},[5939],{"type":51,"value":5940},"\u003C",{"type":45,"tag":2025,"props":5942,"children":5943},{"style":2063},[5944],{"type":51,"value":5945},"claimed_count_from_complete_lin",{"type":45,"tag":2025,"props":5947,"children":5948},{"style":2053},[5949],{"type":51,"value":5950},"e",{"type":45,"tag":2025,"props":5952,"children":5953},{"style":2047},[5954],{"type":51,"value":5955},">\n",{"type":45,"tag":670,"props":5957,"children":5959},{"className":2017,"code":5958,"language":2019,"meta":678,"style":678},"python3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fvalidate_artifacts.py\" \"${output_dir}\u002Fplan.json\" \\\n  --worker worker-1 --worker worker-2 \\\n  --claimed-count worker-1=0 worker-2=3\n",[5960],{"type":45,"tag":60,"props":5961,"children":5962},{"__ignoreMap":678},[5963,6014,6040],{"type":45,"tag":2025,"props":5964,"children":5965},{"class":2027,"line":2028},[5966,5970,5974,5978,5982,5986,5990,5994,5998,6002,6006,6010],{"type":45,"tag":2025,"props":5967,"children":5968},{"style":2042},[5969],{"type":51,"value":3683},{"type":45,"tag":2025,"props":5971,"children":5972},{"style":2047},[5973],{"type":51,"value":2050},{"type":45,"tag":2025,"props":5975,"children":5976},{"style":2053},[5977],{"type":51,"value":913},{"type":45,"tag":2025,"props":5979,"children":5980},{"style":2047},[5981],{"type":51,"value":3211},{"type":45,"tag":2025,"props":5983,"children":5984},{"style":2063},[5985],{"type":51,"value":5883},{"type":45,"tag":2025,"props":5987,"children":5988},{"style":2047},[5989],{"type":51,"value":999},{"type":45,"tag":2025,"props":5991,"children":5992},{"style":2047},[5993],{"type":51,"value":2050},{"type":45,"tag":2025,"props":5995,"children":5996},{"style":2053},[5997],{"type":51,"value":3141},{"type":45,"tag":2025,"props":5999,"children":6000},{"style":2047},[6001],{"type":51,"value":3211},{"type":45,"tag":2025,"props":6003,"children":6004},{"style":2063},[6005],{"type":51,"value":5904},{"type":45,"tag":2025,"props":6007,"children":6008},{"style":2047},[6009],{"type":51,"value":999},{"type":45,"tag":2025,"props":6011,"children":6012},{"style":2053},[6013],{"type":51,"value":3709},{"type":45,"tag":2025,"props":6015,"children":6016},{"class":2027,"line":2038},[6017,6021,6026,6031,6036],{"type":45,"tag":2025,"props":6018,"children":6019},{"style":2063},[6020],{"type":51,"value":5920},{"type":45,"tag":2025,"props":6022,"children":6023},{"style":2063},[6024],{"type":51,"value":6025}," worker-1",{"type":45,"tag":2025,"props":6027,"children":6028},{"style":2063},[6029],{"type":51,"value":6030}," --worker",{"type":45,"tag":2025,"props":6032,"children":6033},{"style":2063},[6034],{"type":51,"value":6035}," worker-2",{"type":45,"tag":2025,"props":6037,"children":6038},{"style":2053},[6039],{"type":51,"value":3709},{"type":45,"tag":2025,"props":6041,"children":6042},{"class":2027,"line":2102},[6043,6048,6053,6058,6063],{"type":45,"tag":2025,"props":6044,"children":6045},{"style":2063},[6046],{"type":51,"value":6047},"  --claimed-count",{"type":45,"tag":2025,"props":6049,"children":6050},{"style":2063},[6051],{"type":51,"value":6052}," worker-1=",{"type":45,"tag":2025,"props":6054,"children":6055},{"style":3982},[6056],{"type":51,"value":6057},"0",{"type":45,"tag":2025,"props":6059,"children":6060},{"style":2063},[6061],{"type":51,"value":6062}," worker-2=",{"type":45,"tag":2025,"props":6064,"children":6065},{"style":3982},[6066],{"type":51,"value":6067},"3\n",{"type":45,"tag":670,"props":6069,"children":6071},{"className":2017,"code":6070,"language":2019,"meta":678,"style":678},"python3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fvalidate_artifacts.py\" \"${output_dir}\u002Fplan.json\" \\\n  --worker worker-1 --worker worker-2 \\\n  --claimed-count worker-1=0 --claimed-count worker-2=3\n",[6072],{"type":45,"tag":60,"props":6073,"children":6074},{"__ignoreMap":678},[6075,6126,6149],{"type":45,"tag":2025,"props":6076,"children":6077},{"class":2027,"line":2028},[6078,6082,6086,6090,6094,6098,6102,6106,6110,6114,6118,6122],{"type":45,"tag":2025,"props":6079,"children":6080},{"style":2042},[6081],{"type":51,"value":3683},{"type":45,"tag":2025,"props":6083,"children":6084},{"style":2047},[6085],{"type":51,"value":2050},{"type":45,"tag":2025,"props":6087,"children":6088},{"style":2053},[6089],{"type":51,"value":913},{"type":45,"tag":2025,"props":6091,"children":6092},{"style":2047},[6093],{"type":51,"value":3211},{"type":45,"tag":2025,"props":6095,"children":6096},{"style":2063},[6097],{"type":51,"value":5883},{"type":45,"tag":2025,"props":6099,"children":6100},{"style":2047},[6101],{"type":51,"value":999},{"type":45,"tag":2025,"props":6103,"children":6104},{"style":2047},[6105],{"type":51,"value":2050},{"type":45,"tag":2025,"props":6107,"children":6108},{"style":2053},[6109],{"type":51,"value":3141},{"type":45,"tag":2025,"props":6111,"children":6112},{"style":2047},[6113],{"type":51,"value":3211},{"type":45,"tag":2025,"props":6115,"children":6116},{"style":2063},[6117],{"type":51,"value":5904},{"type":45,"tag":2025,"props":6119,"children":6120},{"style":2047},[6121],{"type":51,"value":999},{"type":45,"tag":2025,"props":6123,"children":6124},{"style":2053},[6125],{"type":51,"value":3709},{"type":45,"tag":2025,"props":6127,"children":6128},{"class":2027,"line":2038},[6129,6133,6137,6141,6145],{"type":45,"tag":2025,"props":6130,"children":6131},{"style":2063},[6132],{"type":51,"value":5920},{"type":45,"tag":2025,"props":6134,"children":6135},{"style":2063},[6136],{"type":51,"value":6025},{"type":45,"tag":2025,"props":6138,"children":6139},{"style":2063},[6140],{"type":51,"value":6030},{"type":45,"tag":2025,"props":6142,"children":6143},{"style":2063},[6144],{"type":51,"value":6035},{"type":45,"tag":2025,"props":6146,"children":6147},{"style":2053},[6148],{"type":51,"value":3709},{"type":45,"tag":2025,"props":6150,"children":6151},{"class":2027,"line":2102},[6152,6156,6160,6164,6168,6172],{"type":45,"tag":2025,"props":6153,"children":6154},{"style":2063},[6155],{"type":51,"value":6047},{"type":45,"tag":2025,"props":6157,"children":6158},{"style":2063},[6159],{"type":51,"value":6052},{"type":45,"tag":2025,"props":6161,"children":6162},{"style":3982},[6163],{"type":51,"value":6057},{"type":45,"tag":2025,"props":6165,"children":6166},{"style":2063},[6167],{"type":51,"value":5930},{"type":45,"tag":2025,"props":6169,"children":6170},{"style":2063},[6171],{"type":51,"value":6062},{"type":45,"tag":2025,"props":6173,"children":6174},{"style":3982},[6175],{"type":51,"value":6067},{"type":45,"tag":54,"props":6177,"children":6178},{},[6179,6181,6186,6188,6193,6194,6199,6201,6206,6208,6214,6216,6222,6224,6230,6232,6237,6239,6244,6246,6251],{"type":51,"value":6180},"If validation exits non-zero, treat the completion as malformed and retryable (classifier row #4): mark the task ",{"type":45,"tag":60,"props":6182,"children":6184},{"className":6183},[],[6185],{"type":51,"value":4337},{"type":51,"value":6187},", store the validator output in ",{"type":45,"tag":60,"props":6189,"children":6191},{"className":6190},[],[6192],{"type":51,"value":5493},{"type":51,"value":1779},{"type":45,"tag":60,"props":6195,"children":6197},{"className":6196},[],[6198],{"type":51,"value":5500},{"type":51,"value":6200},", and increment ",{"type":45,"tag":60,"props":6202,"children":6204},{"className":6203},[],[6205],{"type":51,"value":5508},{"type":51,"value":6207},". Missing ",{"type":45,"tag":60,"props":6209,"children":6211},{"className":6210},[],[6212],{"type":51,"value":6213},"findings-index.d\u002Fworker-N.txt",{"type":51,"value":6215},", missing ",{"type":45,"tag":60,"props":6217,"children":6219},{"className":6218},[],[6220],{"type":51,"value":6221},"coverage\u002Fworker-N.md",{"type":51,"value":6223},", missing coverage rows, invalid ",{"type":45,"tag":60,"props":6225,"children":6227},{"className":6226},[],[6228],{"type":51,"value":6229},"skipped:",{"type":51,"value":6231}," rows, filed IDs absent from the shard or disk, and claimed-count mismatches are all malformed completions. After the retry cap, leave the cluster task incomplete and surface the validator output in ",{"type":45,"tag":60,"props":6233,"children":6235},{"className":6234},[],[6236],{"type":51,"value":742},{"type":51,"value":6238}," and the final response. Only validation-clean provisional completions may be ",{"type":45,"tag":60,"props":6240,"children":6242},{"className":6241},[],[6243],{"type":51,"value":5394},{"type":51,"value":6245},"d to ",{"type":45,"tag":60,"props":6247,"children":6249},{"className":6248},[],[6250],{"type":51,"value":1268},{"type":51,"value":772},{"type":45,"tag":54,"props":6253,"children":6254},{},[6255,6257,6262,6264,6270],{"type":51,"value":6256},"Then build the index. The canonical index is the set of finding files ",{"type":45,"tag":282,"props":6258,"children":6259},{},[6260],{"type":51,"value":6261},"actually on disk",{"type":51,"value":6263},", not the shard union — building from disk guarantees that a finding written without a matching shard entry (a worker that crashed between its ",{"type":45,"tag":60,"props":6265,"children":6267},{"className":6266},[],[6268],{"type":51,"value":6269},"Write",{"type":51,"value":6271}," and its shard-append, or the single-prefix empty-shard trap the worker prompt warns about) is still picked up by dedup → fp-judge → REPORT\u002FSARIF instead of silently vanishing, and that every index entry resolves to a real file:",{"type":45,"tag":670,"props":6273,"children":6275},{"className":2017,"code":6274,"language":2019,"meta":678,"style":678},"# Canonical index = every finding file on disk. `find` never fails on no-match\n# (an empty findings\u002F yields an empty index — the unambiguous \"zero findings\"\n# signal). `sort -u` collapses Phase-7 retry duplicates: replacement workers reuse\n# deterministic ids, so the same path appears once.\nfind \"${output_dir}\u002Ffindings\" -maxdepth 1 -type f -name '*.md' 2>\u002Fdev\u002Fnull \\\n  | sort -u > \"${output_dir}\u002Ffindings-index.txt\"\n\n# Reconcile against the per-worker shards: any path on disk but in NO shard is an\n# orphan whose worker failed to record it. It is already in the index above (so it\n# is NOT dropped) — print it so the bookkeeping gap can be surfaced. Non-fatal.\nif [ -d \"${output_dir}\u002Ffindings-index.d\" ]; then\n  # Reconcile by basename (finding ids are unique), so a path-format difference\n  # between the worker `find` and this one (trailing slash, \u002Fvar↔\u002Fprivate\u002Fvar)\n  # cannot manufacture false orphans. Any basename on disk but in no shard is an\n  # orphan whose worker failed to record it.\n  comm -13 \\\n    \u003C(find \"${output_dir}\u002Ffindings-index.d\" -maxdepth 1 -type f -name 'worker-*.txt' -exec awk 1 {} + 2>\u002Fdev\u002Fnull | sed 's#.*\u002F##; \u002F^[[:space:]]*$\u002Fd' | sort -u) \\\n    \u003C(find \"${output_dir}\u002Ffindings\" -maxdepth 1 -type f -name '*.md' 2>\u002Fdev\u002Fnull | sed 's#.*\u002F##' | sort -u)\nfi\n",[6276],{"type":45,"tag":60,"props":6277,"children":6278},{"__ignoreMap":678},[6279,6287,6295,6303,6311,6385,6429,6436,6444,6452,6460,6509,6517,6525,6533,6541,6558,6684,6785],{"type":45,"tag":2025,"props":6280,"children":6281},{"class":2027,"line":2028},[6282],{"type":45,"tag":2025,"props":6283,"children":6284},{"style":2032},[6285],{"type":51,"value":6286},"# Canonical index = every finding file on disk. `find` never fails on no-match\n",{"type":45,"tag":2025,"props":6288,"children":6289},{"class":2027,"line":2038},[6290],{"type":45,"tag":2025,"props":6291,"children":6292},{"style":2032},[6293],{"type":51,"value":6294},"# (an empty findings\u002F yields an empty index — the unambiguous \"zero findings\"\n",{"type":45,"tag":2025,"props":6296,"children":6297},{"class":2027,"line":2102},[6298],{"type":45,"tag":2025,"props":6299,"children":6300},{"style":2032},[6301],{"type":51,"value":6302},"# signal). `sort -u` collapses Phase-7 retry duplicates: replacement workers reuse\n",{"type":45,"tag":2025,"props":6304,"children":6305},{"class":2027,"line":2112},[6306],{"type":45,"tag":2025,"props":6307,"children":6308},{"style":2032},[6309],{"type":51,"value":6310},"# deterministic ids, so the same path appears once.\n",{"type":45,"tag":2025,"props":6312,"children":6313},{"class":2027,"line":2121},[6314,6318,6322,6326,6330,6334,6338,6342,6346,6350,6354,6358,6362,6367,6371,6376,6381],{"type":45,"tag":2025,"props":6315,"children":6316},{"style":2042},[6317],{"type":51,"value":416},{"type":45,"tag":2025,"props":6319,"children":6320},{"style":2047},[6321],{"type":51,"value":2050},{"type":45,"tag":2025,"props":6323,"children":6324},{"style":2053},[6325],{"type":51,"value":3141},{"type":45,"tag":2025,"props":6327,"children":6328},{"style":2047},[6329],{"type":51,"value":3211},{"type":45,"tag":2025,"props":6331,"children":6332},{"style":2063},[6333],{"type":51,"value":3216},{"type":45,"tag":2025,"props":6335,"children":6336},{"style":2047},[6337],{"type":51,"value":999},{"type":45,"tag":2025,"props":6339,"children":6340},{"style":2063},[6341],{"type":51,"value":5693},{"type":45,"tag":2025,"props":6343,"children":6344},{"style":3982},[6345],{"type":51,"value":5698},{"type":45,"tag":2025,"props":6347,"children":6348},{"style":2063},[6349],{"type":51,"value":5703},{"type":45,"tag":2025,"props":6351,"children":6352},{"style":2063},[6353],{"type":51,"value":5708},{"type":45,"tag":2025,"props":6355,"children":6356},{"style":2063},[6357],{"type":51,"value":2075},{"type":45,"tag":2025,"props":6359,"children":6360},{"style":2047},[6361],{"type":51,"value":2080},{"type":45,"tag":2025,"props":6363,"children":6364},{"style":2063},[6365],{"type":51,"value":6366},"*.md",{"type":45,"tag":2025,"props":6368,"children":6369},{"style":2047},[6370],{"type":51,"value":2089},{"type":45,"tag":2025,"props":6372,"children":6373},{"style":2047},[6374],{"type":51,"value":6375}," 2>",{"type":45,"tag":2025,"props":6377,"children":6378},{"style":2063},[6379],{"type":51,"value":6380},"\u002Fdev\u002Fnull",{"type":45,"tag":2025,"props":6382,"children":6383},{"style":2053},[6384],{"type":51,"value":3709},{"type":45,"tag":2025,"props":6386,"children":6387},{"class":2027,"line":2199},[6388,6393,6398,6403,6408,6412,6416,6420,6425],{"type":45,"tag":2025,"props":6389,"children":6390},{"style":2047},[6391],{"type":51,"value":6392},"  |",{"type":45,"tag":2025,"props":6394,"children":6395},{"style":2042},[6396],{"type":51,"value":6397}," sort",{"type":45,"tag":2025,"props":6399,"children":6400},{"style":2063},[6401],{"type":51,"value":6402}," -u",{"type":45,"tag":2025,"props":6404,"children":6405},{"style":2047},[6406],{"type":51,"value":6407}," >",{"type":45,"tag":2025,"props":6409,"children":6410},{"style":2047},[6411],{"type":51,"value":2050},{"type":45,"tag":2025,"props":6413,"children":6414},{"style":2053},[6415],{"type":51,"value":3141},{"type":45,"tag":2025,"props":6417,"children":6418},{"style":2047},[6419],{"type":51,"value":3211},{"type":45,"tag":2025,"props":6421,"children":6422},{"style":2063},[6423],{"type":51,"value":6424},"\u002Ffindings-index.txt",{"type":45,"tag":2025,"props":6426,"children":6427},{"style":2047},[6428],{"type":51,"value":3242},{"type":45,"tag":2025,"props":6430,"children":6431},{"class":2027,"line":2207},[6432],{"type":45,"tag":2025,"props":6433,"children":6434},{"emptyLinePlaceholder":2106},[6435],{"type":51,"value":2109},{"type":45,"tag":2025,"props":6437,"children":6438},{"class":2027,"line":2216},[6439],{"type":45,"tag":2025,"props":6440,"children":6441},{"style":2032},[6442],{"type":51,"value":6443},"# Reconcile against the per-worker shards: any path on disk but in NO shard is an\n",{"type":45,"tag":2025,"props":6445,"children":6446},{"class":2027,"line":2289},[6447],{"type":45,"tag":2025,"props":6448,"children":6449},{"style":2032},[6450],{"type":51,"value":6451},"# orphan whose worker failed to record it. It is already in the index above (so it\n",{"type":45,"tag":2025,"props":6453,"children":6454},{"class":2027,"line":2297},[6455],{"type":45,"tag":2025,"props":6456,"children":6457},{"style":2032},[6458],{"type":51,"value":6459},"# is NOT dropped) — print it so the bookkeeping gap can be surfaced. Non-fatal.\n",{"type":45,"tag":2025,"props":6461,"children":6462},{"class":2027,"line":2306},[6463,6468,6473,6478,6482,6486,6490,6495,6499,6504],{"type":45,"tag":2025,"props":6464,"children":6465},{"style":3004},[6466],{"type":51,"value":6467},"if",{"type":45,"tag":2025,"props":6469,"children":6470},{"style":2047},[6471],{"type":51,"value":6472}," [",{"type":45,"tag":2025,"props":6474,"children":6475},{"style":2047},[6476],{"type":51,"value":6477}," -d",{"type":45,"tag":2025,"props":6479,"children":6480},{"style":2047},[6481],{"type":51,"value":2050},{"type":45,"tag":2025,"props":6483,"children":6484},{"style":2053},[6485],{"type":51,"value":3141},{"type":45,"tag":2025,"props":6487,"children":6488},{"style":2047},[6489],{"type":51,"value":3211},{"type":45,"tag":2025,"props":6491,"children":6492},{"style":2063},[6493],{"type":51,"value":6494},"\u002Ffindings-index.d",{"type":45,"tag":2025,"props":6496,"children":6497},{"style":2047},[6498],{"type":51,"value":999},{"type":45,"tag":2025,"props":6500,"children":6501},{"style":2047},[6502],{"type":51,"value":6503}," ];",{"type":45,"tag":2025,"props":6505,"children":6506},{"style":3004},[6507],{"type":51,"value":6508}," then\n",{"type":45,"tag":2025,"props":6510,"children":6511},{"class":2027,"line":2379},[6512],{"type":45,"tag":2025,"props":6513,"children":6514},{"style":2032},[6515],{"type":51,"value":6516},"  # Reconcile by basename (finding ids are unique), so a path-format difference\n",{"type":45,"tag":2025,"props":6518,"children":6519},{"class":2027,"line":2387},[6520],{"type":45,"tag":2025,"props":6521,"children":6522},{"style":2032},[6523],{"type":51,"value":6524},"  # between the worker `find` and this one (trailing slash, \u002Fvar↔\u002Fprivate\u002Fvar)\n",{"type":45,"tag":2025,"props":6526,"children":6527},{"class":2027,"line":2396},[6528],{"type":45,"tag":2025,"props":6529,"children":6530},{"style":2032},[6531],{"type":51,"value":6532},"  # cannot manufacture false orphans. Any basename on disk but in no shard is an\n",{"type":45,"tag":2025,"props":6534,"children":6535},{"class":2027,"line":2469},[6536],{"type":45,"tag":2025,"props":6537,"children":6538},{"style":2032},[6539],{"type":51,"value":6540},"  # orphan whose worker failed to record it.\n",{"type":45,"tag":2025,"props":6542,"children":6543},{"class":2027,"line":2477},[6544,6549,6554],{"type":45,"tag":2025,"props":6545,"children":6546},{"style":2042},[6547],{"type":51,"value":6548},"  comm",{"type":45,"tag":2025,"props":6550,"children":6551},{"style":2063},[6552],{"type":51,"value":6553}," -13",{"type":45,"tag":2025,"props":6555,"children":6556},{"style":2053},[6557],{"type":51,"value":3709},{"type":45,"tag":2025,"props":6559,"children":6560},{"class":2027,"line":2486},[6561,6566,6570,6574,6578,6582,6586,6590,6595,6599,6604,6608,6613,6617,6622,6626,6631,6636,6641,6646,6651,6655,6660,6664,6668,6672,6676,6680],{"type":45,"tag":2025,"props":6562,"children":6563},{"style":2047},[6564],{"type":51,"value":6565},"    \u003C(",{"type":45,"tag":2025,"props":6567,"children":6568},{"style":2042},[6569],{"type":51,"value":416},{"type":45,"tag":2025,"props":6571,"children":6572},{"style":2047},[6573],{"type":51,"value":2050},{"type":45,"tag":2025,"props":6575,"children":6576},{"style":2053},[6577],{"type":51,"value":3141},{"type":45,"tag":2025,"props":6579,"children":6580},{"style":2047},[6581],{"type":51,"value":3211},{"type":45,"tag":2025,"props":6583,"children":6584},{"style":2063},[6585],{"type":51,"value":6494},{"type":45,"tag":2025,"props":6587,"children":6588},{"style":2047},[6589],{"type":51,"value":999},{"type":45,"tag":2025,"props":6591,"children":6592},{"style":2063},[6593],{"type":51,"value":6594}," -maxdepth ",{"type":45,"tag":2025,"props":6596,"children":6597},{"style":3982},[6598],{"type":51,"value":5358},{"type":45,"tag":2025,"props":6600,"children":6601},{"style":2063},[6602],{"type":51,"value":6603}," -type f -name ",{"type":45,"tag":2025,"props":6605,"children":6606},{"style":2047},[6607],{"type":51,"value":2089},{"type":45,"tag":2025,"props":6609,"children":6610},{"style":2063},[6611],{"type":51,"value":6612},"worker-*.txt",{"type":45,"tag":2025,"props":6614,"children":6615},{"style":2047},[6616],{"type":51,"value":2089},{"type":45,"tag":2025,"props":6618,"children":6619},{"style":2063},[6620],{"type":51,"value":6621}," -exec awk ",{"type":45,"tag":2025,"props":6623,"children":6624},{"style":3982},[6625],{"type":51,"value":5358},{"type":45,"tag":2025,"props":6627,"children":6628},{"style":2063},[6629],{"type":51,"value":6630}," {} + ",{"type":45,"tag":2025,"props":6632,"children":6633},{"style":2047},[6634],{"type":51,"value":6635},"2>",{"type":45,"tag":2025,"props":6637,"children":6638},{"style":2063},[6639],{"type":51,"value":6640},"\u002Fdev\u002Fnull ",{"type":45,"tag":2025,"props":6642,"children":6643},{"style":2047},[6644],{"type":51,"value":6645},"|",{"type":45,"tag":2025,"props":6647,"children":6648},{"style":2042},[6649],{"type":51,"value":6650}," sed",{"type":45,"tag":2025,"props":6652,"children":6653},{"style":2047},[6654],{"type":51,"value":2080},{"type":45,"tag":2025,"props":6656,"children":6657},{"style":2063},[6658],{"type":51,"value":6659},"s#.*\u002F##; \u002F^[[:space:]]*$\u002Fd",{"type":45,"tag":2025,"props":6661,"children":6662},{"style":2047},[6663],{"type":51,"value":2089},{"type":45,"tag":2025,"props":6665,"children":6666},{"style":2047},[6667],{"type":51,"value":2186},{"type":45,"tag":2025,"props":6669,"children":6670},{"style":2042},[6671],{"type":51,"value":6397},{"type":45,"tag":2025,"props":6673,"children":6674},{"style":2063},[6675],{"type":51,"value":6402},{"type":45,"tag":2025,"props":6677,"children":6678},{"style":2047},[6679],{"type":51,"value":288},{"type":45,"tag":2025,"props":6681,"children":6682},{"style":2053},[6683],{"type":51,"value":3709},{"type":45,"tag":2025,"props":6685,"children":6686},{"class":2027,"line":2559},[6687,6691,6695,6699,6703,6707,6711,6715,6719,6723,6727,6731,6735,6739,6743,6747,6751,6755,6759,6764,6768,6772,6776,6780],{"type":45,"tag":2025,"props":6688,"children":6689},{"style":2047},[6690],{"type":51,"value":6565},{"type":45,"tag":2025,"props":6692,"children":6693},{"style":2042},[6694],{"type":51,"value":416},{"type":45,"tag":2025,"props":6696,"children":6697},{"style":2047},[6698],{"type":51,"value":2050},{"type":45,"tag":2025,"props":6700,"children":6701},{"style":2053},[6702],{"type":51,"value":3141},{"type":45,"tag":2025,"props":6704,"children":6705},{"style":2047},[6706],{"type":51,"value":3211},{"type":45,"tag":2025,"props":6708,"children":6709},{"style":2063},[6710],{"type":51,"value":3216},{"type":45,"tag":2025,"props":6712,"children":6713},{"style":2047},[6714],{"type":51,"value":999},{"type":45,"tag":2025,"props":6716,"children":6717},{"style":2063},[6718],{"type":51,"value":6594},{"type":45,"tag":2025,"props":6720,"children":6721},{"style":3982},[6722],{"type":51,"value":5358},{"type":45,"tag":2025,"props":6724,"children":6725},{"style":2063},[6726],{"type":51,"value":6603},{"type":45,"tag":2025,"props":6728,"children":6729},{"style":2047},[6730],{"type":51,"value":2089},{"type":45,"tag":2025,"props":6732,"children":6733},{"style":2063},[6734],{"type":51,"value":6366},{"type":45,"tag":2025,"props":6736,"children":6737},{"style":2047},[6738],{"type":51,"value":2089},{"type":45,"tag":2025,"props":6740,"children":6741},{"style":2047},[6742],{"type":51,"value":6375},{"type":45,"tag":2025,"props":6744,"children":6745},{"style":2063},[6746],{"type":51,"value":6640},{"type":45,"tag":2025,"props":6748,"children":6749},{"style":2047},[6750],{"type":51,"value":6645},{"type":45,"tag":2025,"props":6752,"children":6753},{"style":2042},[6754],{"type":51,"value":6650},{"type":45,"tag":2025,"props":6756,"children":6757},{"style":2047},[6758],{"type":51,"value":2080},{"type":45,"tag":2025,"props":6760,"children":6761},{"style":2063},[6762],{"type":51,"value":6763},"s#.*\u002F##",{"type":45,"tag":2025,"props":6765,"children":6766},{"style":2047},[6767],{"type":51,"value":2089},{"type":45,"tag":2025,"props":6769,"children":6770},{"style":2047},[6771],{"type":51,"value":2186},{"type":45,"tag":2025,"props":6773,"children":6774},{"style":2042},[6775],{"type":51,"value":6397},{"type":45,"tag":2025,"props":6777,"children":6778},{"style":2063},[6779],{"type":51,"value":6402},{"type":45,"tag":2025,"props":6781,"children":6782},{"style":2047},[6783],{"type":51,"value":6784},")\n",{"type":45,"tag":2025,"props":6786,"children":6787},{"class":2027,"line":2567},[6788],{"type":45,"tag":2025,"props":6789,"children":6790},{"style":3004},[6791],{"type":51,"value":6792},"fi\n",{"type":45,"tag":54,"props":6794,"children":6795},{},[6796,6798,6804,6806,6812,6814,6819,6821,6826,6828,6834],{"type":51,"value":6797},"The shards stay the per-worker audit trail (",{"type":45,"tag":60,"props":6799,"children":6801},{"className":6800},[],[6802],{"type":51,"value":6803},"validate_artifacts.py",{"type":51,"value":6805}," checks them) and the dedup-judge's crash-recovery fallback, but they no longer gate what reaches the pipeline. For each orphan basename the reconcile prints, map its ",{"type":45,"tag":60,"props":6807,"children":6809},{"className":6808},[],[6810],{"type":51,"value":6811},"\u003CPREFIX>",{"type":51,"value":6813}," to the owning worker via ",{"type":45,"tag":60,"props":6815,"children":6817},{"className":6816},[],[6818],{"type":51,"value":698},{"type":51,"value":6820}," and note in ",{"type":45,"tag":60,"props":6822,"children":6824},{"className":6823},[],[6825],{"type":51,"value":742},{"type":51,"value":6827}," that that worker's shard was incomplete — the finding is already in the index (so it is not lost), but the bookkeeping gap should be visible. Still cross-check the index line count against the sum of ",{"type":45,"tag":60,"props":6829,"children":6831},{"className":6830},[],[6832],{"type":51,"value":6833},"wrote N",{"type":51,"value":6835}," worker claims; log mismatches but don't abort.",{"type":45,"tag":54,"props":6837,"children":6838},{},[6839,6841,6847,6849,6855],{"type":51,"value":6840},"After task updates and index creation, run ",{"type":45,"tag":60,"props":6842,"children":6844},{"className":6843},[],[6845],{"type":51,"value":6846},"TaskList",{"type":51,"value":6848}," and write ",{"type":45,"tag":60,"props":6850,"children":6852},{"className":6851},[],[6853],{"type":51,"value":6854},"${output_dir}\u002Frun-summary.md",{"type":51,"value":6856}," with:",{"type":45,"tag":134,"props":6858,"children":6859},{},[6860,6915,6940,6950],{"type":45,"tag":138,"props":6861,"children":6862},{},[6863,6865,6870,6871,6876,6877,6882,6883,6888,6890,6895,6896,6901,6902,6907,6908,6913],{"type":51,"value":6864},"resolved parameters (",{"type":45,"tag":60,"props":6866,"children":6868},{"className":6867},[],[6869],{"type":51,"value":1409},{"type":51,"value":83},{"type":45,"tag":60,"props":6872,"children":6874},{"className":6873},[],[6875],{"type":51,"value":1423},{"type":51,"value":83},{"type":45,"tag":60,"props":6878,"children":6880},{"className":6879},[],[6881],{"type":51,"value":952},{"type":51,"value":83},{"type":45,"tag":60,"props":6884,"children":6886},{"className":6885},[],[6887],{"type":51,"value":963},{"type":51,"value":6889},", capability flags ",{"type":45,"tag":60,"props":6891,"children":6893},{"className":6892},[],[6894],{"type":51,"value":1014},{"type":51,"value":181},{"type":45,"tag":60,"props":6897,"children":6899},{"className":6898},[],[6900],{"type":51,"value":1835},{"type":51,"value":181},{"type":45,"tag":60,"props":6903,"children":6905},{"className":6904},[],[6906],{"type":51,"value":1842},{"type":51,"value":181},{"type":45,"tag":60,"props":6909,"children":6911},{"className":6910},[],[6912],{"type":51,"value":1849},{"type":51,"value":6914},", Cargo manifest status)",{"type":45,"tag":138,"props":6916,"children":6917},{},[6918,6920,6925,6926,6931,6933,6938],{"type":51,"value":6919},"worker outcome table (",{"type":45,"tag":60,"props":6921,"children":6923},{"className":6922},[],[6924],{"type":51,"value":4379},{"type":51,"value":83},{"type":45,"tag":60,"props":6927,"children":6929},{"className":6928},[],[6930],{"type":51,"value":4206},{"type":51,"value":6932},", claimed finding count, shard line count, coverage-file path (",{"type":45,"tag":60,"props":6934,"children":6936},{"className":6935},[],[6937],{"type":51,"value":3260},{"type":51,"value":6939},"), task status, retry\u002Fabort state)",{"type":45,"tag":138,"props":6941,"children":6942},{},[6943,6948],{"type":45,"tag":60,"props":6944,"children":6946},{"className":6945},[],[6947],{"type":51,"value":727},{"type":51,"value":6949}," line count and any mismatch against worker claims",{"type":45,"tag":138,"props":6951,"children":6952},{},[6953],{"type":51,"value":6954},"judge status once Phase 8 finishes, or the reason a judge was skipped\u002Ffailed",{"type":45,"tag":54,"props":6956,"children":6957},{},[6958,6960,6965,6966,6971,6973,6978,6980,6986,6988,6994,6996,7001,7003,7008,7010,7015,7017,7022],{"type":51,"value":6959},"If any Phase-5 cluster task is not ",{"type":45,"tag":60,"props":6961,"children":6963},{"className":6962},[],[6964],{"type":51,"value":1268},{"type":51,"value":820},{"type":45,"tag":282,"props":6967,"children":6968},{},[6969],{"type":51,"value":6970},"or",{"type":51,"value":6972}," any worker returned a ",{"type":45,"tag":60,"props":6974,"children":6976},{"className":6975},[],[6977],{"type":51,"value":5533},{"type":51,"value":6979}," line carrying the ",{"type":45,"tag":60,"props":6981,"children":6983},{"className":6982},[],[6984],{"type":51,"value":6985},"truncated at hard cap",{"type":51,"value":6987}," token (it hit the tool-call cap before searching every pass; its coverage file will show one or more ",{"type":45,"tag":60,"props":6989,"children":6991},{"className":6990},[],[6992],{"type":51,"value":6993},"cleared (NOT SEARCHED — truncated at hard cap)",{"type":51,"value":6995}," rows) — include it prominently in ",{"type":45,"tag":60,"props":6997,"children":6999},{"className":6998},[],[7000],{"type":51,"value":742},{"type":51,"value":7002}," and the final response. A hard-cap-truncated worker is marked ",{"type":45,"tag":60,"props":7004,"children":7006},{"className":7005},[],[7007],{"type":51,"value":1268},{"type":51,"value":7009}," for ledger purposes but is a ",{"type":45,"tag":282,"props":7011,"children":7012},{},[7013],{"type":51,"value":7014},"partial",{"type":51,"value":7016}," result: do not let that ",{"type":45,"tag":60,"props":7018,"children":7020},{"className":7019},[],[7021],{"type":51,"value":1268},{"type":51,"value":7023}," status hide the incomplete coverage behind a successful report.",{"type":45,"tag":54,"props":7025,"children":7026},{},[7027,7032,7034,7039,7041,7046,7047,7052],{"type":45,"tag":282,"props":7028,"children":7029},{},[7030],{"type":51,"value":7031},"Always run Phase 8 even on zero findings",{"type":51,"value":7033}," — both judges short-circuit on an empty index: dedup-judge writes a minimal no-op ",{"type":45,"tag":60,"props":7035,"children":7037},{"className":7036},[],[7038],{"type":51,"value":749},{"type":51,"value":7040},", and fp-judge writes empty ",{"type":45,"tag":60,"props":7042,"children":7044},{"className":7043},[],[7045],{"type":51,"value":763},{"type":51,"value":181},{"type":45,"tag":60,"props":7048,"children":7050},{"className":7049},[],[7051],{"type":51,"value":770},{"type":51,"value":7053}," so SARIF consumers get a stable artifact set.",{"type":45,"tag":1382,"props":7055,"children":7057},{"id":7056},"phase-8-judge-pipeline-sequential-dedup-fpseverity",[7058],{"type":51,"value":7059},"Phase 8: Judge Pipeline (sequential, dedup → fp+severity)",{"type":45,"tag":54,"props":7061,"children":7062},{},[7063,7067,7068,7073,7074,7078,7080,7085,7086,7091,7092,7097,7099,7104],{"type":45,"tag":282,"props":7064,"children":7065},{},[7066],{"type":51,"value":1395},{"type":51,"value":389},{"type":45,"tag":60,"props":7069,"children":7071},{"className":7070},[],[7072],{"type":51,"value":727},{"type":51,"value":3292},{"type":45,"tag":282,"props":7075,"children":7076},{},[7077],{"type":51,"value":1402},{"type":51,"value":7079}," dedup-judge and fp-judge have returned; ",{"type":45,"tag":60,"props":7081,"children":7083},{"className":7082},[],[7084],{"type":51,"value":749},{"type":51,"value":83},{"type":45,"tag":60,"props":7087,"children":7089},{"className":7088},[],[7090],{"type":51,"value":756},{"type":51,"value":83},{"type":45,"tag":60,"props":7093,"children":7095},{"className":7094},[],[7096],{"type":51,"value":763},{"type":51,"value":7098},", and ideally ",{"type":45,"tag":60,"props":7100,"children":7102},{"className":7101},[],[7103],{"type":51,"value":770},{"type":51,"value":7105}," are written.",{"type":45,"tag":54,"props":7107,"children":7108},{},[7109,7111,7117,7119,7123,7125,7131],{"type":51,"value":7110},"Each judge's full protocol is its system prompt (",{"type":45,"tag":60,"props":7112,"children":7114},{"className":7113},[],[7115],{"type":51,"value":7116},"agents\u002Frust-review-{dedup,fp}-judge.md",{"type":51,"value":7118},"); spawn prompts pass only per-run variables. Do ",{"type":45,"tag":282,"props":7120,"children":7121},{},[7122],{"type":51,"value":379},{"type":51,"value":7124}," reference ",{"type":45,"tag":60,"props":7126,"children":7128},{"className":7127},[],[7129],{"type":51,"value":7130},"prompts\u002Finternal\u002Fjudges\u002F",{"type":51,"value":7132}," — those files don't exist.",{"type":45,"tag":4641,"props":7134,"children":7135},{},[7136,7201],{"type":45,"tag":54,"props":7137,"children":7138},{},[7139,7144,7146,7151,7152,7156,7158,7164,7165,7171,7173,7178,7180,7185,7187,7192,7194,7199],{"type":45,"tag":282,"props":7140,"children":7141},{},[7142],{"type":51,"value":7143},"STOP — these two judges run in SEQUENCE, not in parallel.",{"type":51,"value":7145}," Unlike the Phase-6b workers (which you spawn as M ",{"type":45,"tag":60,"props":7147,"children":7149},{"className":7148},[],[7150],{"type":51,"value":336},{"type":51,"value":4849},{"type":45,"tag":547,"props":7153,"children":7154},{},[7155],{"type":51,"value":1494},{"type":51,"value":7157}," message precisely because that runs them concurrently), the judges have a hard data dependency: fp-judge must see the ",{"type":45,"tag":60,"props":7159,"children":7161},{"className":7160},[],[7162],{"type":51,"value":7163},"merged_into",{"type":51,"value":467},{"type":45,"tag":60,"props":7166,"children":7168},{"className":7167},[],[7169],{"type":51,"value":7170},"also_known_as",{"type":51,"value":7172}," annotations dedup-judge writes, and it only skips files already carrying ",{"type":45,"tag":60,"props":7174,"children":7176},{"className":7175},[],[7177],{"type":51,"value":7163},{"type":51,"value":7179},". If you emit both ",{"type":45,"tag":60,"props":7181,"children":7183},{"className":7182},[],[7184],{"type":51,"value":336},{"type":51,"value":7186}," calls in one message they run concurrently — fp-judge reads findings before any merge annotations exist, judges every duplicate as a separate primary, and (because ",{"type":45,"tag":60,"props":7188,"children":7190},{"className":7189},[],[7191],{"type":51,"value":749},{"type":51,"value":7193}," doesn't exist yet) trips its \"dedup did not run\" fallback, producing an inflated, duplicated ",{"type":45,"tag":60,"props":7195,"children":7197},{"className":7196},[],[7198],{"type":51,"value":763},{"type":51,"value":7200},"\u002FSARIF.",{"type":45,"tag":54,"props":7202,"children":7203},{},[7204,7206,7211,7213,7219,7221,7226,7228,7233,7235,7239,7241,7247,7249,7254,7256],{"type":51,"value":7205},"Spawn dedup-judge in its ",{"type":45,"tag":282,"props":7207,"children":7208},{},[7209],{"type":51,"value":7210},"own",{"type":51,"value":7212}," assistant message, wait for its ",{"type":45,"tag":60,"props":7214,"children":7216},{"className":7215},[],[7217],{"type":51,"value":7218},"dedup-judge complete:",{"type":51,"value":7220}," (or ",{"type":45,"tag":60,"props":7222,"children":7224},{"className":7223},[],[7225],{"type":51,"value":5540},{"type":51,"value":7227},") return, ",{"type":45,"tag":282,"props":7229,"children":7230},{},[7231],{"type":51,"value":7232},"then",{"type":51,"value":7234}," spawn fp-judge in a ",{"type":45,"tag":282,"props":7236,"children":7237},{},[7238],{"type":51,"value":4889},{"type":51,"value":7240}," message. Before composing the fp-judge spawn, confirm dedup finished — ",{"type":45,"tag":60,"props":7242,"children":7244},{"className":7243},[],[7245],{"type":51,"value":7246},"Bash: test -f ${output_dir}\u002Fdedup-summary.md",{"type":51,"value":7248}," must succeed (or you saw the dedup ",{"type":45,"tag":60,"props":7250,"children":7252},{"className":7251},[],[7253],{"type":51,"value":5533},{"type":51,"value":7255}," token). ",{"type":45,"tag":282,"props":7257,"children":7258},{},[7259,7261,7266],{"type":51,"value":7260},"Never put both judge ",{"type":45,"tag":60,"props":7262,"children":7264},{"className":7263},[],[7265],{"type":51,"value":336},{"type":51,"value":7267}," calls in the same message.",{"type":45,"tag":808,"props":7269,"children":7270},{},[7271,7288],{"type":45,"tag":138,"props":7272,"children":7273},{},[7274,7279,7280,7286],{"type":45,"tag":282,"props":7275,"children":7276},{},[7277],{"type":51,"value":7278},"First message",{"type":51,"value":820},{"type":45,"tag":60,"props":7281,"children":7283},{"className":7282},[],[7284],{"type":51,"value":7285},"Agent(subagent_type=\"rust-review:rust-review-dedup-judge\", description=\"Dedup judge\", prompt=f\"output_dir: {output_dir}\")",{"type":51,"value":7287},". Wait for its return and classify it (below) before continuing.",{"type":45,"tag":138,"props":7289,"children":7290},{},[7291,7296,7297,7303,7305,7311,7312,7318],{"type":45,"tag":282,"props":7292,"children":7293},{},[7294],{"type":51,"value":7295},"Then, in a separate message",{"type":51,"value":820},{"type":45,"tag":60,"props":7298,"children":7300},{"className":7299},[],[7301],{"type":51,"value":7302},"Agent(subagent_type=\"rust-review:rust-review-fp-judge\", description=\"FP + severity judge\", prompt=f\"output_dir: {output_dir}\\nsarif_generator_path: {sarif_generator_path}\")",{"type":51,"value":7304}," — resolve ",{"type":45,"tag":60,"props":7306,"children":7308},{"className":7307},[],[7309],{"type":51,"value":7310},"sarif_generator_path",{"type":51,"value":5396},{"type":45,"tag":60,"props":7313,"children":7315},{"className":7314},[],[7316],{"type":51,"value":7317},"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fgenerate_sarif.py",{"type":51,"value":772},{"type":45,"tag":54,"props":7320,"children":7321},{},[7322,7327],{"type":45,"tag":282,"props":7323,"children":7324},{},[7325],{"type":51,"value":7326},"Judge failure handling.",{"type":51,"value":7328}," Same shape as Phase 7's classifier, applied to judge return text:",{"type":45,"tag":134,"props":7330,"children":7331},{},[7332,7348,7393],{"type":45,"tag":138,"props":7333,"children":7334},{},[7335,7341,7343],{"type":45,"tag":60,"props":7336,"children":7338},{"className":7337},[],[7339],{"type":51,"value":7340},"… complete:",{"type":51,"value":7342}," → ",{"type":45,"tag":282,"props":7344,"children":7345},{},[7346],{"type":51,"value":7347},"success.",{"type":45,"tag":138,"props":7349,"children":7350},{},[7351,7357,7358,7363,7365,7371,7373,7378,7380,7385,7387,7391],{"type":45,"tag":60,"props":7352,"children":7354},{"className":7353},[],[7355],{"type":51,"value":7356},"… abort:",{"type":51,"value":7342},{"type":45,"tag":282,"props":7359,"children":7360},{},[7361],{"type":51,"value":7362},"non-retryable for that judge.",{"type":51,"value":7364}," Surface the abort line plus ",{"type":45,"tag":60,"props":7366,"children":7368},{"className":7367},[],[7369],{"type":51,"value":7370},"ls -l ${output_dir}\u002Ffindings-index.txt",{"type":51,"value":7372},", then ",{"type":45,"tag":282,"props":7374,"children":7375},{},[7376],{"type":51,"value":7377},"still run Phase 8b",{"type":51,"value":7379}," (its SARIF + ",{"type":45,"tag":60,"props":7381,"children":7383},{"className":7382},[],[7384],{"type":51,"value":763},{"type":51,"value":7386}," safety net guarantees the artifact set even when a judge aborts — see Phase 8b's \"fp-judge returned, or the run aborted early\" entry), and stop without spawning further judges. \"Stop\" means do not continue the judge pipeline — it does ",{"type":45,"tag":282,"props":7388,"children":7389},{},[7390],{"type":51,"value":379},{"type":51,"value":7392}," mean skip Phase 8b.",{"type":45,"tag":138,"props":7394,"children":7395},{},[7396,7398,7403,7405,7410,7411,7417,7419,7424],{"type":51,"value":7397},"No ",{"type":45,"tag":60,"props":7399,"children":7401},{"className":7400},[],[7402],{"type":51,"value":5533},{"type":51,"value":7404}," (help message \u002F error \u002F question) → ",{"type":45,"tag":282,"props":7406,"children":7407},{},[7408],{"type":51,"value":7409},"retryable once.",{"type":51,"value":389},{"type":45,"tag":60,"props":7412,"children":7414},{"className":7413},[],[7415],{"type":51,"value":7416},"SendMessage(to=\u003CagentId>, …)",{"type":51,"value":7418}," rather than a fresh spawn (the agent already paid the protocol-parse cost). Include the explicit finding paths from ",{"type":45,"tag":60,"props":7420,"children":7422},{"className":7421},[],[7423],{"type":51,"value":727},{"type":51,"value":7425},". If the second try still fails, surface the transcript and continue to Phase 8b.",{"type":45,"tag":1382,"props":7427,"children":7429},{"id":7428},"phase-8b-report-safety-net-sarif-reportmd",[7430],{"type":51,"value":7431},"Phase 8b: Report safety net (SARIF + REPORT.md)",{"type":45,"tag":54,"props":7433,"children":7434},{},[7435,7439,7441,7445,7446,7452,7453,7459],{"type":45,"tag":282,"props":7436,"children":7437},{},[7438],{"type":51,"value":1395},{"type":51,"value":7440}," fp-judge returned, or the run aborted early. ",{"type":45,"tag":282,"props":7442,"children":7443},{},[7444],{"type":51,"value":1402},{"type":51,"value":389},{"type":45,"tag":60,"props":7447,"children":7449},{"className":7448},[],[7450],{"type":51,"value":7451},"${output_dir}\u002FREPORT.sarif",{"type":51,"value":3150},{"type":45,"tag":60,"props":7454,"children":7456},{"className":7455},[],[7457],{"type":51,"value":7458},"${output_dir}\u002FREPORT.md",{"type":51,"value":7460}," both exist.",{"type":45,"tag":670,"props":7462,"children":7464},{"className":2017,"code":7463,"language":2019,"meta":678,"style":678},"test -d \"${output_dir}\u002Ffindings\" && python3 \"${RUST_REVIEW_PLUGIN_ROOT}\u002Fscripts\u002Fgenerate_sarif.py\" \"${output_dir}\"\n",[7465],{"type":45,"tag":60,"props":7466,"children":7467},{"__ignoreMap":678},[7468],{"type":45,"tag":2025,"props":7469,"children":7470},{"class":2027,"line":2028},[7471,7476,7480,7484,7488,7492,7496,7500,7505,7510,7514,7518,7522,7527,7531,7535,7539],{"type":45,"tag":2025,"props":7472,"children":7473},{"style":2939},[7474],{"type":51,"value":7475},"test",{"type":45,"tag":2025,"props":7477,"children":7478},{"style":2063},[7479],{"type":51,"value":6477},{"type":45,"tag":2025,"props":7481,"children":7482},{"style":2047},[7483],{"type":51,"value":2050},{"type":45,"tag":2025,"props":7485,"children":7486},{"style":2053},[7487],{"type":51,"value":3141},{"type":45,"tag":2025,"props":7489,"children":7490},{"style":2047},[7491],{"type":51,"value":3211},{"type":45,"tag":2025,"props":7493,"children":7494},{"style":2063},[7495],{"type":51,"value":3216},{"type":45,"tag":2025,"props":7497,"children":7498},{"style":2047},[7499],{"type":51,"value":999},{"type":45,"tag":2025,"props":7501,"children":7502},{"style":2047},[7503],{"type":51,"value":7504}," &&",{"type":45,"tag":2025,"props":7506,"children":7507},{"style":2042},[7508],{"type":51,"value":7509}," python3",{"type":45,"tag":2025,"props":7511,"children":7512},{"style":2047},[7513],{"type":51,"value":2050},{"type":45,"tag":2025,"props":7515,"children":7516},{"style":2053},[7517],{"type":51,"value":913},{"type":45,"tag":2025,"props":7519,"children":7520},{"style":2047},[7521],{"type":51,"value":3211},{"type":45,"tag":2025,"props":7523,"children":7524},{"style":2063},[7525],{"type":51,"value":7526},"\u002Fscripts\u002Fgenerate_sarif.py",{"type":45,"tag":2025,"props":7528,"children":7529},{"style":2047},[7530],{"type":51,"value":999},{"type":45,"tag":2025,"props":7532,"children":7533},{"style":2047},[7534],{"type":51,"value":2050},{"type":45,"tag":2025,"props":7536,"children":7537},{"style":2053},[7538],{"type":51,"value":3141},{"type":45,"tag":2025,"props":7540,"children":7541},{"style":2047},[7542],{"type":51,"value":7543},"}\"\n",{"type":45,"tag":54,"props":7545,"children":7546},{},[7547,7549,7554,7556,7561,7563,7569,7571,7577,7578,7588,7590,7596,7597,7603,7605,7611,7613,7618,7619,7624,7626,7631],{"type":51,"value":7548},"Run the SARIF generator unconditionally whenever ",{"type":45,"tag":60,"props":7550,"children":7552},{"className":7551},[],[7553],{"type":51,"value":712},{"type":51,"value":7555}," exists — it is idempotent (full overwrite), emits ",{"type":45,"tag":60,"props":7557,"children":7559},{"className":7558},[],[7560],{"type":51,"value":1313},{"type":51,"value":7562}," for zero-survivor runs, and handles partial runs (findings without ",{"type":45,"tag":60,"props":7564,"children":7566},{"className":7565},[],[7567],{"type":51,"value":7568},"fp_verdict",{"type":51,"value":7570}," are emitted as ",{"type":45,"tag":60,"props":7572,"children":7574},{"className":7573},[],[7575],{"type":51,"value":7576},"LIKELY_TP",{"type":51,"value":83},{"type":45,"tag":282,"props":7579,"children":7580},{},[7581,7583],{"type":51,"value":7582},"exempt from the ",{"type":45,"tag":60,"props":7584,"children":7586},{"className":7585},[],[7587],{"type":51,"value":1423},{"type":51,"value":7589}," since their severity was never judge-validated, and marked ",{"type":45,"tag":60,"props":7591,"children":7593},{"className":7592},[],[7594],{"type":51,"value":7595},"unjudged: true",{"type":51,"value":467},{"type":45,"tag":60,"props":7598,"children":7600},{"className":7599},[],[7601],{"type":51,"value":7602},"severity_validated: false",{"type":51,"value":7604}," with an ",{"type":45,"tag":60,"props":7606,"children":7608},{"className":7607},[],[7609],{"type":51,"value":7610},"[UNVALIDATED SEVERITY — not judged]",{"type":51,"value":7612}," message prefix — so an inferred severity guess can never silently drop them under a ",{"type":45,"tag":60,"props":7614,"children":7616},{"className":7615},[],[7617],{"type":51,"value":1654},{"type":51,"value":181},{"type":45,"tag":60,"props":7620,"children":7622},{"className":7621},[],[7623],{"type":51,"value":1661},{"type":51,"value":7625}," filter). Always overwriting protects against an fp-judge that crashed mid-write and left a corrupt ",{"type":45,"tag":60,"props":7627,"children":7629},{"className":7628},[],[7630],{"type":51,"value":770},{"type":51,"value":7632}," on disk.",{"type":45,"tag":54,"props":7634,"children":7635},{},[7636,7638,7644,7646,7652,7654,7660,7662,7667,7669,7674,7676,7681],{"type":51,"value":7637},"If the generator prints a ",{"type":45,"tag":60,"props":7639,"children":7641},{"className":7640},[],[7642],{"type":51,"value":7643},"WARNING: skipped N …",{"type":51,"value":7645}," line on stdout (it also records ",{"type":45,"tag":60,"props":7647,"children":7649},{"className":7648},[],[7650],{"type":51,"value":7651},"invocations[].properties.skipped_findings",{"type":51,"value":7653}," in the SARIF and a ",{"type":45,"tag":60,"props":7655,"children":7657},{"className":7656},[],[7658],{"type":51,"value":7659},"warning",{"type":51,"value":7661}," notification per dropped file), one or more finding files were unreadable or had no parseable frontmatter and were ",{"type":45,"tag":282,"props":7663,"children":7664},{},[7665],{"type":51,"value":7666},"excluded from the report",{"type":51,"value":7668},". This is a dropped result — surface it prominently in ",{"type":45,"tag":60,"props":7670,"children":7672},{"className":7671},[],[7673],{"type":51,"value":742},{"type":51,"value":7675}," and the final response with the count and paths, the same way a non-",{"type":45,"tag":60,"props":7677,"children":7679},{"className":7678},[],[7680],{"type":51,"value":1268},{"type":51,"value":7682}," cluster task is surfaced. Do not let the otherwise-clean SARIF hide the loss.",{"type":45,"tag":54,"props":7684,"children":7685},{},[7686,7688,7693,7695,7700,7702,7707,7709,7713,7715,7720,7722,7727,7729,7734,7736,7741,7743,7748,7750,7754,7756,7761,7763,7768,7770,7782],{"type":51,"value":7687},"Then guarantee ",{"type":45,"tag":60,"props":7689,"children":7691},{"className":7690},[],[7692],{"type":51,"value":763},{"type":51,"value":7694}," exists. Unlike SARIF (mechanical), ",{"type":45,"tag":60,"props":7696,"children":7698},{"className":7697},[],[7699],{"type":51,"value":763},{"type":51,"value":7701}," is the fp-judge's ",{"type":45,"tag":282,"props":7703,"children":7704},{},[7705],{"type":51,"value":7706},"curated",{"type":51,"value":7708}," artifact, so do ",{"type":45,"tag":282,"props":7710,"children":7711},{},[7712],{"type":51,"value":379},{"type":51,"value":7714}," overwrite a judge-written one. (The fp-judge writes ",{"type":45,"tag":60,"props":7716,"children":7718},{"className":7717},[],[7719],{"type":51,"value":763},{"type":51,"value":7721}," with a ",{"type":45,"tag":60,"props":7723,"children":7725},{"className":7724},[],[7726],{"type":51,"value":343},{"type":51,"value":7728}," heredoc, not the ",{"type":45,"tag":60,"props":7730,"children":7732},{"className":7731},[],[7733],{"type":51,"value":6269},{"type":51,"value":7735}," tool, because the harness blocks the ",{"type":45,"tag":60,"props":7737,"children":7739},{"className":7738},[],[7740],{"type":51,"value":6269},{"type":51,"value":7742}," tool for subagent report files — do not \"fix\" the judge by re-mandating ",{"type":45,"tag":60,"props":7744,"children":7746},{"className":7745},[],[7747],{"type":51,"value":6269},{"type":51,"value":7749},". The orchestrator is the main agent and is ",{"type":45,"tag":282,"props":7751,"children":7752},{},[7753],{"type":51,"value":379},{"type":51,"value":7755}," subject to that block, so its own ",{"type":45,"tag":60,"props":7757,"children":7759},{"className":7758},[],[7760],{"type":51,"value":6269},{"type":51,"value":7762}," below works.) Check for it, and if it is missing (the judge crashed, even its ",{"type":45,"tag":60,"props":7764,"children":7766},{"className":7765},[],[7767],{"type":51,"value":343},{"type":51,"value":7769},"-heredoc write failed, or it returned the report as chat text instead of writing the file), ",{"type":45,"tag":282,"props":7771,"children":7772},{},[7773,7775,7780],{"type":51,"value":7774},"the orchestrator writes ",{"type":45,"tag":60,"props":7776,"children":7778},{"className":7777},[],[7779],{"type":51,"value":763},{"type":51,"value":7781}," itself",{"type":51,"value":7783}," rather than failing the run:",{"type":45,"tag":134,"props":7785,"children":7786},{},[7787,7805],{"type":45,"tag":138,"props":7788,"children":7789},{},[7790,7792,7797,7799,7804],{"type":51,"value":7791},"If the fp-judge returned the report body in its transcript, ",{"type":45,"tag":60,"props":7793,"children":7795},{"className":7794},[],[7796],{"type":51,"value":6269},{"type":51,"value":7798}," that text verbatim to ",{"type":45,"tag":60,"props":7800,"children":7802},{"className":7801},[],[7803],{"type":51,"value":7458},{"type":51,"value":772},{"type":45,"tag":138,"props":7806,"children":7807},{},[7808,7810,7816,7817,7822,7824,7829,7831,7836,7838,7843,7845,7850,7851,7856,7858,7863,7865,7871,7873,7878,7880,7885,7887,7892,7894,7900,7901,7906,7907,7912,7913,7919,7920,7926],{"type":51,"value":7809},"Otherwise synthesize it from the on-disk findings: take the survivor primaries (",{"type":45,"tag":60,"props":7811,"children":7813},{"className":7812},[],[7814],{"type":51,"value":7815},"fp_verdict ∈ {TRUE_POSITIVE, LIKELY_TP}",{"type":51,"value":4566},{"type":45,"tag":60,"props":7818,"children":7820},{"className":7819},[],[7821],{"type":51,"value":7163},{"type":51,"value":7823},"; if the judge never ran, treat a finding with no ",{"type":45,"tag":60,"props":7825,"children":7827},{"className":7826},[],[7828],{"type":51,"value":7568},{"type":51,"value":7830}," as a survivor) listed in ",{"type":45,"tag":60,"props":7832,"children":7834},{"className":7833},[],[7835],{"type":51,"value":727},{"type":51,"value":7837},", apply ",{"type":45,"tag":60,"props":7839,"children":7841},{"className":7840},[],[7842],{"type":51,"value":1423},{"type":51,"value":7844}," from ",{"type":45,"tag":60,"props":7846,"children":7848},{"className":7847},[],[7849],{"type":51,"value":691},{"type":51,"value":389},{"type":45,"tag":282,"props":7852,"children":7853},{},[7854],{"type":51,"value":7855},"to judged survivors only",{"type":51,"value":7857}," — unjudged findings (no ",{"type":45,"tag":60,"props":7859,"children":7861},{"className":7860},[],[7862],{"type":51,"value":7568},{"type":51,"value":7864},") are included regardless of filter and rendered under an ",{"type":45,"tag":60,"props":7866,"children":7868},{"className":7867},[],[7869],{"type":51,"value":7870},"Unvalidated (severity not judged)",{"type":51,"value":7872}," section with a ",{"type":45,"tag":60,"props":7874,"children":7876},{"className":7875},[],[7877],{"type":51,"value":7610},{"type":51,"value":7879}," label, mirroring the SARIF behavior so a strict filter never silently drops them — and ",{"type":45,"tag":60,"props":7881,"children":7883},{"className":7882},[],[7884],{"type":51,"value":6269},{"type":51,"value":7886}," a ",{"type":45,"tag":60,"props":7888,"children":7890},{"className":7889},[],[7891],{"type":51,"value":763},{"type":51,"value":7893}," mirroring the fp-judge template — YAML frontmatter (",{"type":45,"tag":60,"props":7895,"children":7897},{"className":7896},[],[7898],{"type":51,"value":7899},"stage: final-report",{"type":51,"value":83},{"type":45,"tag":60,"props":7902,"children":7904},{"className":7903},[],[7905],{"type":51,"value":1409},{"type":51,"value":83},{"type":45,"tag":60,"props":7908,"children":7910},{"className":7909},[],[7911],{"type":51,"value":1423},{"type":51,"value":83},{"type":45,"tag":60,"props":7914,"children":7916},{"className":7915},[],[7917],{"type":51,"value":7918},"total_primaries",{"type":51,"value":83},{"type":45,"tag":60,"props":7921,"children":7923},{"className":7922},[],[7924],{"type":51,"value":7925},"reported_findings",{"type":51,"value":7927},"), a severity-distribution table, then one section per reported finding grouped by severity (embed the Description \u002F Code \u002F Data flow \u002F Impact \u002F Recommendation body for CRITICAL\u002FHIGH; reference the finding file for MEDIUM\u002FLOW).",{"type":45,"tag":54,"props":7929,"children":7930},{},[7931,7933,7938,7940,7945,7947,7952,7954,7959],{"type":51,"value":7932},"Either way, note in ",{"type":45,"tag":60,"props":7934,"children":7936},{"className":7935},[],[7937],{"type":51,"value":6854},{"type":51,"value":7939}," that ",{"type":45,"tag":60,"props":7941,"children":7943},{"className":7942},[],[7944],{"type":51,"value":763},{"type":51,"value":7946}," was orchestrator-synthesized (not judge-authored). Skip the SARIF generator and this check only if ",{"type":45,"tag":60,"props":7948,"children":7950},{"className":7949},[],[7951],{"type":51,"value":3148},{"type":51,"value":7953}," doesn't exist (Phase 2 failed). After this phase, update ",{"type":45,"tag":60,"props":7955,"children":7957},{"className":7956},[],[7958],{"type":51,"value":6854},{"type":51,"value":7960}," with judge \u002F SARIF \u002F report status.",{"type":45,"tag":1382,"props":7962,"children":7964},{"id":7963},"phase-9-return-report",[7965],{"type":51,"value":7966},"Phase 9: Return Report",{"type":45,"tag":54,"props":7968,"children":7969},{},[7970,7974,7976,7980,7982,7989,7991,7996],{"type":45,"tag":282,"props":7971,"children":7972},{},[7973],{"type":51,"value":1395},{"type":51,"value":7975}," Phase 8b complete. ",{"type":45,"tag":282,"props":7977,"children":7978},{},[7979],{"type":51,"value":1402},{"type":51,"value":7981}," every item in ",{"type":45,"tag":7983,"props":7984,"children":7986},"a",{"href":7985},"#success-criteria",[7987],{"type":51,"value":7988},"Success Criteria",{"type":51,"value":7990}," verified true; ",{"type":45,"tag":60,"props":7992,"children":7994},{"className":7993},[],[7995],{"type":51,"value":763},{"type":51,"value":7997}," returned to the caller.",{"type":45,"tag":54,"props":7999,"children":8000},{},[8001,8003,8007,8009,8014,8016,8022,8023,8028,8030,8034],{"type":51,"value":8002},"Before composing the response, walk the ",{"type":45,"tag":7983,"props":8004,"children":8005},{"href":7985},[8006],{"type":51,"value":7988},{"type":51,"value":8008}," checklist below and confirm each bullet against on-disk artifacts (",{"type":45,"tag":60,"props":8010,"children":8012},{"className":8011},[],[8013],{"type":51,"value":6846},{"type":51,"value":8015}," for cluster tasks, ",{"type":45,"tag":60,"props":8017,"children":8019},{"className":8018},[],[8020],{"type":51,"value":8021},"ls",{"type":51,"value":181},{"type":45,"tag":60,"props":8024,"children":8026},{"className":8025},[],[8027],{"type":51,"value":465},{"type":51,"value":8029}," for the files). If any criterion fails, surface the failure prominently in the response — do ",{"type":45,"tag":282,"props":8031,"children":8032},{},[8033],{"type":51,"value":379},{"type":51,"value":8035}," hide a partial run behind a successful report.",{"type":45,"tag":54,"props":8037,"children":8038},{},[8039,8041,8047,8049,8054,8055,8060,8061,8066,8067,8072,8073,8078,8079,8084,8085,8090],{"type":51,"value":8040},"Then ",{"type":45,"tag":60,"props":8042,"children":8044},{"className":8043},[],[8045],{"type":51,"value":8046},"Read ${output_dir}\u002FREPORT.md",{"type":51,"value":8048}," and return its content to the caller. Append an Artifacts list pointing at ",{"type":45,"tag":60,"props":8050,"children":8052},{"className":8051},[],[8053],{"type":51,"value":712},{"type":51,"value":83},{"type":45,"tag":60,"props":8056,"children":8058},{"className":8057},[],[8059],{"type":51,"value":727},{"type":51,"value":83},{"type":45,"tag":60,"props":8062,"children":8064},{"className":8063},[],[8065],{"type":51,"value":742},{"type":51,"value":83},{"type":45,"tag":60,"props":8068,"children":8070},{"className":8069},[],[8071],{"type":51,"value":749},{"type":51,"value":83},{"type":45,"tag":60,"props":8074,"children":8076},{"className":8075},[],[8077],{"type":51,"value":756},{"type":51,"value":83},{"type":45,"tag":60,"props":8080,"children":8082},{"className":8081},[],[8083],{"type":51,"value":763},{"type":51,"value":83},{"type":45,"tag":60,"props":8086,"children":8088},{"className":8087},[],[8089],{"type":51,"value":770},{"type":51,"value":772},{"type":45,"tag":660,"props":8092,"children":8093},{},[],{"type":45,"tag":108,"props":8095,"children":8097},{"id":8096},"finding-file-frontmatter-three-stages",[8098],{"type":51,"value":8099},"Finding file frontmatter — three stages",{"type":45,"tag":54,"props":8101,"children":8102},{},[8103,8105,8110],{"type":51,"value":8104},"Authoritative schema: ",{"type":45,"tag":60,"props":8106,"children":8108},{"className":8107},[],[8109],{"type":51,"value":3268},{"type":51,"value":8111}," (\"Finding File Format\"). Three-stage write:",{"type":45,"tag":808,"props":8113,"children":8114},{},[8115,8175,8206],{"type":45,"tag":138,"props":8116,"children":8117},{},[8118,8123,8125,8131,8132,8138,8139,8145,8146,8152,8153,8159,8160,8166,8167,8173],{"type":45,"tag":282,"props":8119,"children":8120},{},[8121],{"type":51,"value":8122},"Worker",{"type":51,"value":8124}," — base fields (",{"type":45,"tag":60,"props":8126,"children":8128},{"className":8127},[],[8129],{"type":51,"value":8130},"id",{"type":51,"value":83},{"type":45,"tag":60,"props":8133,"children":8135},{"className":8134},[],[8136],{"type":51,"value":8137},"bug_class",{"type":51,"value":83},{"type":45,"tag":60,"props":8140,"children":8142},{"className":8141},[],[8143],{"type":51,"value":8144},"title",{"type":51,"value":83},{"type":45,"tag":60,"props":8147,"children":8149},{"className":8148},[],[8150],{"type":51,"value":8151},"location",{"type":51,"value":83},{"type":45,"tag":60,"props":8154,"children":8156},{"className":8155},[],[8157],{"type":51,"value":8158},"function",{"type":51,"value":83},{"type":45,"tag":60,"props":8161,"children":8163},{"className":8162},[],[8164],{"type":51,"value":8165},"confidence",{"type":51,"value":83},{"type":45,"tag":60,"props":8168,"children":8170},{"className":8169},[],[8171],{"type":51,"value":8172},"worker",{"type":51,"value":8174},") + seven body sections.",{"type":45,"tag":138,"props":8176,"children":8177},{},[8178,8183,8185,8190,8192,8197,8198,8204],{"type":45,"tag":282,"props":8179,"children":8180},{},[8181],{"type":51,"value":8182},"Dedup-judge",{"type":51,"value":8184}," — adds ",{"type":45,"tag":60,"props":8186,"children":8188},{"className":8187},[],[8189],{"type":51,"value":7163},{"type":51,"value":8191}," on duplicates, or ",{"type":45,"tag":60,"props":8193,"children":8195},{"className":8194},[],[8196],{"type":51,"value":7170},{"type":51,"value":3997},{"type":45,"tag":60,"props":8199,"children":8201},{"className":8200},[],[8202],{"type":51,"value":8203},"locations",{"type":51,"value":8205}," on primaries that absorbed.",{"type":45,"tag":138,"props":8207,"children":8208},{},[8209,8214,8215,8220,8221,8227,8229,8235,8236,8241,8243,8249,8250,8256,8257,8263,8264,8270],{"type":45,"tag":282,"props":8210,"children":8211},{},[8212],{"type":51,"value":8213},"FP+Severity judge",{"type":51,"value":8184},{"type":45,"tag":60,"props":8216,"children":8218},{"className":8217},[],[8219],{"type":51,"value":7568},{"type":51,"value":3997},{"type":45,"tag":60,"props":8222,"children":8224},{"className":8223},[],[8225],{"type":51,"value":8226},"fp_rationale",{"type":51,"value":8228}," on every primary; on survivors (",{"type":45,"tag":60,"props":8230,"children":8232},{"className":8231},[],[8233],{"type":51,"value":8234},"TRUE_POSITIVE",{"type":51,"value":181},{"type":45,"tag":60,"props":8237,"children":8239},{"className":8238},[],[8240],{"type":51,"value":7576},{"type":51,"value":8242},") also adds ",{"type":45,"tag":60,"props":8244,"children":8246},{"className":8245},[],[8247],{"type":51,"value":8248},"severity",{"type":51,"value":83},{"type":45,"tag":60,"props":8251,"children":8253},{"className":8252},[],[8254],{"type":51,"value":8255},"attack_vector",{"type":51,"value":83},{"type":45,"tag":60,"props":8258,"children":8260},{"className":8259},[],[8261],{"type":51,"value":8262},"exploitability",{"type":51,"value":83},{"type":45,"tag":60,"props":8265,"children":8267},{"className":8266},[],[8268],{"type":51,"value":8269},"severity_rationale",{"type":51,"value":772},{"type":45,"tag":108,"props":8272,"children":8274},{"id":8273},"bug-classes-clusters",[8275],{"type":51,"value":8276},"Bug classes \u002F clusters",{"type":45,"tag":54,"props":8278,"children":8279},{},[8280,8282,8288,8290,8296,8298,8304,8306,8312,8314,8320,8322,8328,8330,8335,8337,8342,8344,8349,8351,8356,8358,8363,8364,8369,8371,8376,8378,8383,8385,8390,8392,8397,8398,8403],{"type":51,"value":8281},"Authoritative: ",{"type":45,"tag":60,"props":8283,"children":8285},{"className":8284},[],[8286],{"type":51,"value":8287},"prompts\u002Fclusters\u002Fmanifest.json",{"type":51,"value":8289},". 37 bug classes live in ",{"type":45,"tag":60,"props":8291,"children":8293},{"className":8292},[],[8294],{"type":51,"value":8295},"always",{"type":51,"value":8297},"-gated clusters (so the cluster always runs); of those, 35 always fire and 2 — ",{"type":45,"tag":60,"props":8299,"children":8301},{"className":8300},[],[8302],{"type":51,"value":8303},"adversarial-trait",{"type":51,"value":8305}," (TRAITADV) and ",{"type":45,"tag":60,"props":8307,"children":8309},{"className":8308},[],[8310],{"type":51,"value":8311},"closure-panic",{"type":51,"value":8313}," (CLOSUREPANIC) in ",{"type":45,"tag":60,"props":8315,"children":8317},{"className":8316},[],[8318],{"type":51,"value":8319},"logic-correctness",{"type":51,"value":8321}," — additionally carry ",{"type":45,"tag":60,"props":8323,"children":8325},{"className":8324},[],[8326],{"type":51,"value":8327},"requires: has_unsafe",{"type":51,"value":8329},", so they only fire when ",{"type":45,"tag":60,"props":8331,"children":8333},{"className":8332},[],[8334],{"type":51,"value":1059},{"type":51,"value":8336},". 69 bug classes across all clusters when every conditional gate is enabled. The ",{"type":45,"tag":60,"props":8338,"children":8340},{"className":8339},[],[8341],{"type":51,"value":1051},{"type":51,"value":8343}," cluster is gated on ",{"type":45,"tag":60,"props":8345,"children":8347},{"className":8346},[],[8348],{"type":51,"value":1014},{"type":51,"value":8350}," (all its bug classes require ",{"type":45,"tag":60,"props":8352,"children":8354},{"className":8353},[],[8355],{"type":51,"value":124},{"type":51,"value":8357},"); PATHJOIN and TOCTOU are gated behind ",{"type":45,"tag":60,"props":8359,"children":8361},{"className":8360},[],[8362],{"type":51,"value":1863},{"type":51,"value":432},{"type":45,"tag":60,"props":8365,"children":8367},{"className":8366},[],[8368],{"type":51,"value":4064},{"type":51,"value":8370},", and PACKEDREF lives in the conditional ",{"type":45,"tag":60,"props":8372,"children":8374},{"className":8373},[],[8375],{"type":51,"value":4078},{"type":51,"value":8377}," cluster (",{"type":45,"tag":60,"props":8379,"children":8381},{"className":8380},[],[8382],{"type":51,"value":1856},{"type":51,"value":8384},"); PTREXPOSE stays always-on via the ",{"type":45,"tag":60,"props":8386,"children":8388},{"className":8387},[],[8389],{"type":51,"value":4042},{"type":51,"value":8391}," cluster. ",{"type":45,"tag":60,"props":8393,"children":8395},{"className":8394},[],[8396],{"type":51,"value":1074},{"type":51,"value":3150},{"type":45,"tag":60,"props":8399,"children":8401},{"className":8400},[],[8402],{"type":51,"value":4134},{"type":51,"value":8404}," are fully consolidated (their sub-prompts are not re-read at runtime).",{"type":45,"tag":660,"props":8406,"children":8407},{},[],{"type":45,"tag":108,"props":8409,"children":8411},{"id":8410},"success-criteria",[8412],{"type":51,"value":7988},{"type":45,"tag":54,"props":8414,"children":8415},{},[8416],{"type":51,"value":8417},"The phase exits already cover most of this; the orchestrator-visible end-state is:",{"type":45,"tag":134,"props":8419,"children":8420},{},[8421,8439,8449,8511,8528],{"type":45,"tag":138,"props":8422,"children":8423},{},[8424,8426,8431,8433,8438],{"type":51,"value":8425},"Every Phase-5 cluster task is ",{"type":45,"tag":60,"props":8427,"children":8429},{"className":8428},[],[8430],{"type":51,"value":1268},{"type":51,"value":8432}," (verify via ",{"type":45,"tag":60,"props":8434,"children":8436},{"className":8435},[],[8437],{"type":51,"value":6846},{"type":51,"value":3600},{"type":45,"tag":138,"props":8440,"children":8441},{},[8442,8447],{"type":45,"tag":60,"props":8443,"children":8445},{"className":8444},[],[8446],{"type":51,"value":6854},{"type":51,"value":8448}," exists and records resolved scope\u002Fcontext, Cargo manifest probe result, worker claims vs index count, task status, and judge\u002FSARIF status.",{"type":45,"tag":138,"props":8450,"children":8451},{},[8452,8454,8459,8461,8466,8467,8472,8474,8479,8480,8485,8487,8492,8493,8498,8499,8504,8505,8510],{"type":51,"value":8453},"Every primary finding (no ",{"type":45,"tag":60,"props":8455,"children":8457},{"className":8456},[],[8458],{"type":51,"value":7163},{"type":51,"value":8460},") has ",{"type":45,"tag":60,"props":8462,"children":8464},{"className":8463},[],[8465],{"type":51,"value":7568},{"type":51,"value":3997},{"type":45,"tag":60,"props":8468,"children":8470},{"className":8469},[],[8471],{"type":51,"value":8226},{"type":51,"value":8473},"; every survivor (",{"type":45,"tag":60,"props":8475,"children":8477},{"className":8476},[],[8478],{"type":51,"value":8234},{"type":51,"value":181},{"type":45,"tag":60,"props":8481,"children":8483},{"className":8482},[],[8484],{"type":51,"value":7576},{"type":51,"value":8486},") also has ",{"type":45,"tag":60,"props":8488,"children":8490},{"className":8489},[],[8491],{"type":51,"value":8248},{"type":51,"value":83},{"type":45,"tag":60,"props":8494,"children":8496},{"className":8495},[],[8497],{"type":51,"value":8255},{"type":51,"value":83},{"type":45,"tag":60,"props":8500,"children":8502},{"className":8501},[],[8503],{"type":51,"value":8262},{"type":51,"value":83},{"type":45,"tag":60,"props":8506,"children":8508},{"className":8507},[],[8509],{"type":51,"value":8269},{"type":51,"value":772},{"type":45,"tag":138,"props":8512,"children":8513},{},[8514,8519,8521,8526],{"type":45,"tag":60,"props":8515,"children":8517},{"className":8516},[],[8518],{"type":51,"value":763},{"type":51,"value":8520}," exists, severity-filtered per ",{"type":45,"tag":60,"props":8522,"children":8524},{"className":8523},[],[8525],{"type":51,"value":1423},{"type":51,"value":8527}," (Phase 8b safety net guarantees this even when the fp-judge fails to write it).",{"type":45,"tag":138,"props":8529,"children":8530},{},[8531,8536],{"type":45,"tag":60,"props":8532,"children":8534},{"className":8533},[],[8535],{"type":51,"value":770},{"type":51,"value":8537}," exists (Phase 8b safety net guarantees this).",{"type":45,"tag":8539,"props":8540,"children":8541},"style",{},[8542],{"type":51,"value":8543},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":8545,"total":8641},[8546,8563,8573,8591,8606,8619,8631],{"slug":8547,"name":8547,"fn":8548,"description":8549,"org":8550,"tags":8551,"stars":26,"repoUrl":27,"updatedAt":8562},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8552,8555,8558,8559],{"name":8553,"slug":8554,"type":16},"C#","c",{"name":8556,"slug":8557,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":8560,"slug":8561,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":8564,"name":8564,"fn":8565,"description":8566,"org":8567,"tags":8568,"stars":26,"repoUrl":27,"updatedAt":8572},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8569,8570,8571],{"name":8553,"slug":8554,"type":16},{"name":14,"slug":15,"type":16},{"name":8560,"slug":8561,"type":16},"2026-07-17T06:05:12.433192",{"slug":8574,"name":8574,"fn":8575,"description":8576,"org":8577,"tags":8578,"stars":26,"repoUrl":27,"updatedAt":8590},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8579,8582,8585,8586,8589],{"name":8580,"slug":8581,"type":16},"Agents","agents",{"name":8583,"slug":8584,"type":16},"CI\u002FCD","ci-cd",{"name":24,"slug":25,"type":16},{"name":8587,"slug":8588,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":8592,"name":8592,"fn":8593,"description":8594,"org":8595,"tags":8596,"stars":26,"repoUrl":27,"updatedAt":8605},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8597,8600,8601,8602],{"name":8598,"slug":8599,"type":16},"Audit","audit",{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":8603,"slug":8604,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":8607,"name":8607,"fn":8608,"description":8609,"org":8610,"tags":8611,"stars":26,"repoUrl":27,"updatedAt":8618},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8612,8615],{"name":8613,"slug":8614,"type":16},"Engineering","engineering",{"name":8616,"slug":8617,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":8620,"name":8620,"fn":8621,"description":8622,"org":8623,"tags":8624,"stars":26,"repoUrl":27,"updatedAt":8630},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8625,8628,8629],{"name":8626,"slug":8627,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":8560,"slug":8561,"type":16},"2026-07-17T06:05:14.575191",{"slug":8632,"name":8632,"fn":8633,"description":8634,"org":8635,"tags":8636,"stars":26,"repoUrl":27,"updatedAt":8640},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8637,8638,8639],{"name":8598,"slug":8599,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",77,{"items":8643,"total":8744},[8644,8651,8657,8665,8672,8677,8683,8689,8700,8711,8723,8733],{"slug":8547,"name":8547,"fn":8548,"description":8549,"org":8645,"tags":8646,"stars":26,"repoUrl":27,"updatedAt":8562},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8647,8648,8649,8650],{"name":8553,"slug":8554,"type":16},{"name":8556,"slug":8557,"type":16},{"name":14,"slug":15,"type":16},{"name":8560,"slug":8561,"type":16},{"slug":8564,"name":8564,"fn":8565,"description":8566,"org":8652,"tags":8653,"stars":26,"repoUrl":27,"updatedAt":8572},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8654,8655,8656],{"name":8553,"slug":8554,"type":16},{"name":14,"slug":15,"type":16},{"name":8560,"slug":8561,"type":16},{"slug":8574,"name":8574,"fn":8575,"description":8576,"org":8658,"tags":8659,"stars":26,"repoUrl":27,"updatedAt":8590},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8660,8661,8662,8663,8664],{"name":8580,"slug":8581,"type":16},{"name":8583,"slug":8584,"type":16},{"name":24,"slug":25,"type":16},{"name":8587,"slug":8588,"type":16},{"name":14,"slug":15,"type":16},{"slug":8592,"name":8592,"fn":8593,"description":8594,"org":8666,"tags":8667,"stars":26,"repoUrl":27,"updatedAt":8605},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8668,8669,8670,8671],{"name":8598,"slug":8599,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":8603,"slug":8604,"type":16},{"slug":8607,"name":8607,"fn":8608,"description":8609,"org":8673,"tags":8674,"stars":26,"repoUrl":27,"updatedAt":8618},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8675,8676],{"name":8613,"slug":8614,"type":16},{"name":8616,"slug":8617,"type":16},{"slug":8620,"name":8620,"fn":8621,"description":8622,"org":8678,"tags":8679,"stars":26,"repoUrl":27,"updatedAt":8630},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8680,8681,8682],{"name":8626,"slug":8627,"type":16},{"name":14,"slug":15,"type":16},{"name":8560,"slug":8561,"type":16},{"slug":8632,"name":8632,"fn":8633,"description":8634,"org":8684,"tags":8685,"stars":26,"repoUrl":27,"updatedAt":8640},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8686,8687,8688],{"name":8598,"slug":8599,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"slug":8690,"name":8690,"fn":8691,"description":8692,"org":8693,"tags":8694,"stars":26,"repoUrl":27,"updatedAt":8699},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8695,8696,8697,8698],{"name":668,"slug":665,"type":16},{"name":8598,"slug":8599,"type":16},{"name":24,"slug":25,"type":16},{"name":8613,"slug":8614,"type":16},"2026-07-18T05:47:40.122449",{"slug":8701,"name":8701,"fn":8702,"description":8703,"org":8704,"tags":8705,"stars":26,"repoUrl":27,"updatedAt":8710},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8706,8707,8708,8709],{"name":8598,"slug":8599,"type":16},{"name":24,"slug":25,"type":16},{"name":8613,"slug":8614,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":8712,"name":8712,"fn":8713,"description":8714,"org":8715,"tags":8716,"stars":26,"repoUrl":27,"updatedAt":8722},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8717,8718,8721],{"name":8598,"slug":8599,"type":16},{"name":8719,"slug":8720,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":148,"name":148,"fn":8724,"description":8725,"org":8726,"tags":8727,"stars":26,"repoUrl":27,"updatedAt":8732},"audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8728,8729,8730,8731],{"name":8598,"slug":8599,"type":16},{"name":8553,"slug":8554,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":8734,"name":8734,"fn":8735,"description":8736,"org":8737,"tags":8738,"stars":26,"repoUrl":27,"updatedAt":8743},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[8739,8740,8741,8742],{"name":8598,"slug":8599,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":8603,"slug":8604,"type":16},"2026-07-18T05:47:42.84568",111]