context model: mechanical contract repairs — dangling load clauses, precedence, preflight wiring, registry lockstep

[manoldonev]

Cluster: context model · Source: exit audit (2026-07-13) · Type: mechanical contract repairs — one PR, no new machinery. File:line cited; every item independently verified.

1. Dangling load clauses. scope-completeness-reviewer.md:18 and unit-test-mutation-reviewer.md:24 say "load it after the shared review-context.md" but neither agent is ever instructed to load the shared file. Add the shared-load instruction (or drop the ordering clause).
2. db-reviewer contradictory load semantics. db-reviewer.md:14 (per-reviewer file else shared section) vs :16 (per-reviewer after shared). Standardize on both-ordered, and add the content-precedence sentence the whole surface is missing (panel GAP-6): when the shared core and a per-reviewer file state the same catalog section, the per-reviewer file wins for that reviewer only — and the section-catalog lint (separate issue) warns when the same section exists in both homes, since every other reader keeps the shared value (observed hazard: cadenza's restated thresholds).
3. Standardize the load-block wording. Three heading variants exist ("Repo stack context (load first)" / "Repo context (load first)" / "Repo context (load if present)"). One canonical block; a selftest greps every panel agent for it so the deleted-load-paragraph mutant class finally has a static tripwire.
4. Wire check-review-context.sh into dev-pipeline preflight next to check-extensions.sh. Today it is prose-invoked from review-lead only, with a self-described skip path — under a headless pipeline run the basename↔registry guarantee depends on prose compliance. Prerequisite (panel): pin the registry parse first — it regex-scrapes review-lead SKILL prose (grep -oE 'the plugin-shipped panel \(...\)'); add a fixture selftest that fails when the wording moves, or derive the registry from a structured source shared with check-reviewer-references.sh.
5. Registry widening, gated in lockstep. Non-panel context-consuming agents (unit-test-plan-reviewer, plan-reviewer) cannot have a review-context/<name>.md today (UNKNOWN-REVIEWER-FILE). Widen the lint's registry only together with adding the actual per-reviewer load block to those agents — widening alone converts today's loud false positive into a silent false negative (a file the lint blesses that no agent reads: the exact M4 disease at another door).
6. Found-but-empty semantics. Reviewer prompts define: a located section with an empty/TODO body = treat as absent (infer conservatively AND disclose). Closes the reviewer-side half of the empty-file mutant independent of any new lint.
7. Docs correction (panel GAP-5). extension-points.md:23 claims findings.md/CLAUDE.md are read "session start / all agents" — no plugin agent loads findings.md; it is respected only via consumer CLAUDE.md routing (e-commerce routes it; cadenza's CLAUDE.md never mentions it). Reword to "respected via consumer CLAUDE.md routing — never required". Also state in context-model.md the committed-surface precondition (see the surface-integrity issue): the pipeline consumes the surface as committed at origin/<base>, not the working tree.
8. Consistency sweep of extension declarations. doc-updater has shared-load but no per-reviewer block; plan-reviewer cites review-context.md/security-rules.md (:130, :284) with no load block. Align each with the canonical block from item 3 (or explicitly annotate why not).

Acceptance

• Selftest: every panel agent carries the canonical load block (item 3) — removing one goes red.
• check-review-context.sh runs in preflight.sh output on a fixture consumer; registry parse pinned by fixture.
• Per-reviewer files for unit-test-plan-reviewer/plan-reviewer accepted by the lint AND loaded by the agents in the same release.
• extension-points.md / context-model.md wording updated; db-reviewer contradiction gone.

[cadenza-dev-pipeline]

Datapoint from the #1 dogfooding retro (.claude/pipeline-state/1-retro.md) — relevant to the "preflight wiring" repair.

#1 shipped the Stage-1 pre-flight attestation feature, and its own dogfooding run mis-recorded it: stageCheckpoint["1"].preflight.workingTreeClean was written true while git status --porcelain was non-empty (the pipeline's own un-ignored .claude/worktrees/ entry). The independent retro scored criterion 1 FAIL for it.

Root cause #1 (the un-ignored worktree dir) is fixed in #80. But the deeper wiring gap remains: the attestation value is narrated by the executor, not measured. Step 1.P documents the if [[ -z "$(git status --porcelain)" ]] snippet, but nothing forces the executor to run it — a manual workingTreeClean:true sails through. Suggest wiring the preflight object to be emitted mechanically (a helper that runs git status --porcelain and prints the object), so workingTreeClean/guardOutcome can't be misreported — the enforcement-ladder rung-2 fix for this class.