Feature/Fix: Define lineage promotion gates

[iam-brain]

Stack dependency

This is slice 10 of 15. It follows Feature/Fix: Stream lineage families in two passes; review and merge that PR first.

Summary

• codify evidence-based promotion blockers without a fixed aggregate error threshold
• require target-day improvement, ordinary-day safety, reviewed residuals, and adversarial coverage
• require exclusive family routing, permanent containment, bounded operation, cancellation, and atomic publication
• preserve a verified whole-scan legacy rollback until its dedicated removal slice

Validation

• swift test --filter CodexLineagePromotionEvaluatorTests (7 passed)
• make check
• env SDKROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX26.5.sdk make test (645 selections, 54 groups, no failures or retries)

Related investigation: steipete/CodexBar#2037.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 13, 2026, 9:26 PM ET / July 14, 2026, 01:26 UTC.

Summary
The PR adds a cumulative experimental Codex rollout-lineage accounting pipeline, residual classification and promotion gates, plus focused coverage for discovery, reconciliation, cancellation, containment, and rollback evidence.

Reproducibility: yes. at source level: the linked investigation and scanner history identify fork-copy baseline handling and remaining historical-day undercount, although this review did not execute an affected real corpus.

Review metrics: 2 noteworthy metrics.

• Stacked scope: 10 commits, 16 files, +3787/-17. The branch contains preceding lineage slices as well as the promotion-gate slice, so review should be refreshed after its dependency lands.
• New lineage seams: 7 core files and 7 test files added. The focused coverage is substantial, but the number of interacting accounting components increases integration-review cost.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• After Feature/Fix: Stream lineage families in two passes #2148 lands, refresh the branch and rerun focused and full validation.
• [P1] Add redacted live output from an affected fork-heavy corpus showing target-day improvement, ordinary-day safety, bounded operation, and unchanged legacy rollback.

Proof guidance:

• [P1] Needs real behavior proof before merge: Synthetic tests and CI do not show after-fix behavior on affected real rollout data; add redacted terminal output comparing legacy and lineage results, then update the PR body to trigger review or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

• [P1] The cumulative branch depends on Feature/Fix: Stream lineage families in two passes #2148, so reviewing or landing it first would obscure which stack slice owns any regression.
• [P1] Synthetic corpora do not establish that residual classifications and promotion signals match the fork-heavy real data that motivated the work.

Maintainer options:

1. Decide the mitigation before merge
   Land and refresh the predecessor first, then validate this slice with redacted legacy-versus-lineage output from an affected real corpus while keeping lineage non-authoritative and preserving rollback.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P1] Keep the draft open for dependency-ordered review and contributor-supplied real-corpus proof; there is no narrow automated repair to dispatch.

Security
Cleared: The diff adds local parsing and in-memory accounting code without new dependencies, workflow permissions, secret access, downloads, or publishing changes.

Review details

Best possible solution:

Land and refresh the predecessor first, then validate this slice with redacted legacy-versus-lineage output from an affected real corpus while keeping lineage non-authoritative and preserving rollback.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: the linked investigation and scanner history identify fork-copy baseline handling and remaining historical-day undercount, although this review did not execute an affected real corpus.

Is this the best way to solve the issue?

Unclear as a merge-ready solution: the bounded lineage architecture and rollback gates are directionally appropriate, but the stacked dependency and absent real-corpus proof prevent validating the complete fix.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 0437067deaa8.

Label changes

Label changes:

• add P2: This is substantial progress on a real local accounting-accuracy problem, but the new path remains experimental and non-authoritative in this slice.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Synthetic tests and CI do not show after-fix behavior on affected real rollout data; add redacted terminal output comparing legacy and lineage results, then update the PR body to trigger review or ask a maintainer to comment @clawsweeper re-review.

Label justifications:

• P2: This is substantial progress on a real local accounting-accuracy problem, but the new path remains experimental and non-authoritative in this slice.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Synthetic tests and CI do not show after-fix behavior on affected real rollout data; add redacted terminal output comparing legacy and lineage results, then update the PR body to trigger review or ask a maintainer to comment @clawsweeper re-review.

Evidence reviewed

Acceptance criteria:

• [P1] swift test --filter CodexLineagePromotionEvaluatorTests.
• [P1] make check.
• [P1] make test.
• [P1] Run a redacted affected-corpus comparison of legacy and lineage accounting without invoking Keychain-backed provider probes.

What I checked:

• Active stacked work: The PR identifies itself as slice 10 of 15 and requires the still-open predecessor Feature/Fix: Stream lineage families in two passes #2148 to be reviewed and merged first. (ea9e382c606f)
• Current-main problem context: The linked investigation documents remaining historical-day undercount after merged fork-baseline work improved, but did not fully solve, the observable accounting problem. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift:1696, 0437067deaa8)
• Promotion policy coverage: Focused tests exercise evidence-based promotion, ordinary-day regression blocking, reviewed residuals, cancellation coverage, containment, and retained legacy rollback. (Tests/CodexBarTests/CodexLineagePromotionEvaluatorTests.swift:1, ea9e382c606f)
• No live proof: The PR body reports focused tests, repository checks, and the full test suite, but provides no redacted after-fix output from an affected real rollout corpus. (ea9e382c606f)

Likely related people:

• iam-brain: They authored the merged current-main fork-baseline reconciliation work linked from the investigation, so their connection extends beyond proposing this PR. (role: feature owner; confidence: high; commits: 0d6277c, 92948af, f3ccdd3; files: Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift, Tests/CodexBarTests/CostUsageScannerBreakdownTests.swift)
• steipete: They merged the recent current-main Codex fork-accounting correction and are directly connected to accepting the broader accounting direction. (role: merger and adjacent owner; confidence: medium; commits: b6999ba; files: Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift)
• Christopher J. Wolff: The linked investigation traces the earlier fork-baseline subtraction behavior to their history in the central scanner path. (role: introduced behavior; confidence: medium; commits: b497546; files: Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[iam-brain]

Superseded by the consolidated four-PR review stack. This slice is now included in #2157; closing this draft to keep the upstream review surface manageable.