T094: phase 3's consumer pins, openDox e1e3a3c3 and openXdox 9564d5d9, with phase 3's host wiring: openXdox's columns and the governed binding-trust policy (plan 034)

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

Plan 034, task T094: phase 3's consumer pins (T090 step 6) with phase 3's host wiring, specs/034-opendox-standalone-operation/tasks.md at openxFactory main. The precedents are T047 (opensoft/openXdox#20, then #1181) and T064 (opensoft/openXdox#21, then #1215).

• Claim: openDox + openXdox: two open-source layers, an installable app with users, projects and a database; domain descendants pin openXdox (Brett's ruling 2026-09-04) #656 (comment) (it covers T087 and T094).
• Landing order, done:
  • T087: T087, phase 3's openDox root pin: code → dede32b4 (plan 034, T090 steps 1–2) openDox#18 → e1e3a3c3 (openDox-code dede32b4, the 0.1.0 commit T099 publishes).
  • T086: T086, openXdox contributes its columns: the governed gate, scope, kickoff and register at openDox's seams, the two route columns through the facet, the direction at (0, 0) (plan 034) openXdox-code#37 → 56e1c238.
  • T090 step 5: openXdox root: code -> 56e1c238 (T086) and openDox -> e1e3a3c3 (T087) (plan 034 T094, T090 step 5) openXdox#22 → 9564d5d9.
  • Lane openXfactory-3's ahead PR (D2, non-arc: the CLI help golden, the usage line and the rebound-Host case at both pins) → T094's ahead PR: the CLI help golden, the usage line and the rebound-Host case hold at both pins (T066's form; not an arc landing) (plan 034) #1234, ca1c148646f1111bc8049bc9cceb3c14ef276967. This branch merges main in at 9cd1bf23 (a merge, never a rebase).
• Holder decisions in force (2026-10-05):
  • (a) both pin pairs move in ONE commit, as in T047 and T064 (below);
  • (b) T092's phase-3 edits[].note annotations ride in T089's checkpoint PR (lane openXfactory-3's D3; openDox + openXdox: two open-source layers, an installable app with users, projects and a database; domain descendants pin openXdox (Brett's ruling 2026-09-04) #656 comment 5987195870, D5), NOT here. This PR touches no manifest note;
  • (c) the stale src/opendox/consumer_reach.py admission is removed and asserted ABSENT;
  • (d) the 4 + 3 carve-time files the walk still names stay as T064 left them;
  • (e) the merge of main (9cd1bf23) carries the Lane: line and no Arc: line. T091's trailer belongs on realization commits and on the landing, and the squash landing writes Arc: from this body. On the merge, F11.1's guard would charge T094's ahead PR: the CLI help golden, the usage line and the rebound-Host case hold at both pins (T066's form; not an arc landing) (plan 034) #1234's non-arc files to the arc.
• It stays a DRAFT until the holder marks it READY.

The pins: both pairs in ONE commit (caa8d377)

pair	gitlink	pin file commit:	digests.tree_sha256
openDox	d5098297 → e1e3a3c3	same (contracts/opendox-pin.yaml:118)	2815ca23…57cc → 55a110f49d268e22d382d47d778dfaf9298c93b555e3c4fcb621afc99f9d011b (28 records)
openXdox	f257e021 → 9564d5d9	same (contracts/openxdox-pin.yaml:109)	52f0598e…6959 → 11585eadf4fef2ffcb4419194fa6a52444f56759cfc427d41c352a6b8803cbd2 (29 records)

• e1e3a3c3 is T087, phase 3's openDox root pin: code → dede32b4 (plan 034, T090 steps 1–2) openDox#18's squash (T087), one commit above d5098297. It moves code 047bb4fa → dede32b4 with contracts/code-pin.yaml and changes no other path, so openDox's contracts/manifest.yaml, its spec gitlink and the bundle (dox-v1.1) are unchanged. openDox's main has since moved to 504324de (T076, 10.3: the root README documents the one command openDox#17, T076, the root README only). Step 2's root commit is the one T090 pins, and no check reads main's tip.

• 9564d5d9 is opensoft/openXdox main, where Record Omnigent worker event bridge proof #22 squash-landed (its tree equals Record Omnigent worker event bridge proof #22's head db6cc2a4). It moves code 6a3b93b9 → 56e1c238, which is openXdox-code main after Fix brainstorm Captured header (validator contract) #37 (T086), and contracts/opendox-pin.yaml d5098297 → e1e3a3c3 (T090 step 5).

• Every digest was recomputed three ways: repo_shape.tree_digest, an independent ls-tree + sha256, and the forge's tree listing (repo_shape.tree_digest_from_gh). Controls: the same three methods reproduce the recorded 52f0598e…6959 at f257e021 and 2815ca23…57cc at d5098297.

• Why one commit and not "one commit each" (T090 step 6). Record Omnigent worker event bridge proof #22 changes the openDox pin that verify-opendox-pin.py check 5 reads through the openXdox gitlink, and docs/openxdox-pin-resync-runbook.md § 4 prints DIFFERENT. Each split order was measured on this branch's base, and verify-opendox-pin.py exits 2 in both:

  • the openDox pair alone: REFUSE opendox-pin-lockstep-mismatch: this pin names openDox@e1e3a3c3f8dd38214510412b71a2e858c6179532, but openXdox's own openXdox/contracts/opendox-pin.yaml names openDox@d5098297a5c262f9977193305210bccb4ec51e89; two direct declarations of one product's bytes disagree.
  • the openXdox pair alone: REFUSE opendox-pin-lockstep-mismatch: this pin names openDox@d5098297a5c262f9977193305210bccb4ec51e89, but openXdox's own openXdox/contracts/opendox-pin.yaml names openDox@e1e3a3c3f8dd38214510412b71a2e858c6179532; two direct declarations of one product's bytes disagree.

  So "one commit each" cannot be met without an intermediate red commit. The holder ruled the single commit for phase 3 on 2026-10-05, as for phase 1 (T047, T047 (DRAFT): phase 1's consumer pins, openDox 663ac683 and openXdox 57e2b8f2, with T045 and T046's host wiring (plan 034) #1181) and phase 2 (T064, T064: phase 2's consumer pins, openDox d5098297 and openXdox f257e021, with openXdox's governed projection registered by the host (plan 034) #1215, decided 2026-09-28). This PR therefore departs from T090 step 6's "one commit each" for the third time. Each pair still moves as one unit (box 9.5).

• Both pin files are edited in place, keeping their line counts (216 and 154). The openDox migration: block keeps range (0001..0002) and reversible (false): no migration path changes over openDox-code 047bb4fa..dede32b4. Its runbook names the new code leg dede32b4, and the block is identical to openXdox's derived copy at 9564d5d9, which tests/opendox_pin asserts.

• Gates.

  • verify-opendox-pin.py: OK opendox-pin verified: openDox@e1e3a3c3f8dd38214510412b71a2e858c6179532, gitlink read from HEAD, sorted-ls-tree-r-v1 tree digest recomputed (55a110f4…011b), lockstep with openXdox confirmed.
  • verify-openxdox-pin.py: OK openxdox-pin verified: openXdox@9564d5d9462ffd1a3155d9177206368e5061efa8, gitlink read from HEAD, sorted-ls-tree-r-v1 tree digest recomputed (11585ead…cbd2).

What else it carries

commit	what	F11.1 surface
3c1c1146	The host wiring. scripts/opendox_host.register_openxfactory() calls openxdox.column_contributions.register() (T086) after the projection line, and refuses by name when it registers nothing. GovernedBindingTrust (RULED #656 5970369724, "Governance approval (Recommended)") is the sixth seams() entry, before the home seam, with its take-back row. Its verdicts: a binding pending in the governed declarations is untrusted (host basis, the governed reason); an unreadable declarations document admits nothing; otherwise trusted, host basis. It answers the console intake's own question, intake_verdict, as plan 034's T100 entry says a host policy must. Its record() writes nothing and returns None, which openDox-code#86 reads as "no record" (doxbench_trust.recording_for; #656 5986391296, applied to T094 by 5988088910), so a failed add or edit write is refused as the write's own failure and never with REASON_NO_WITHDRAWAL. tests/domain_profile/test_host_registers_binding_trust.py (new, 9 tests, 11 cases at 7e31eca1) and test_openxfactory_host_wiring.py (six seams; the three columns the facet composes; each declared once) cover it. They pin openDox-code#86's final REMEDY_NOT_BY_TRUST and INTAKE_HOST_NOT_ADMITTED strings. Planted mutants, measured over the draft rounds of this same code, are each killed: M1-M3 and M5 by test_host_registers_binding_trust.py, the column line removed (M4) by test_doxbench_routes, intake_verdict removed or admitting everything (M6, M7), and record() returning the verdict, returning True, or writing MachineTrust's store (M8, M9, M11).	HOST, HOST_TESTS
3c1c1146	Composition tests, amended in the arc: test_extension_point_parity.py (the /capabilities arm of T073 and T103, and the MRO's T084 layout), test_serve_column_split.py (the snapshot arm's four handlers are the core's own after T086's trim; every column method is the column's own), and test_doxbench_status_exemption.py (T085's register_default_status_exemption joins the readers of the registered rail).	COMPOSITION_TESTS
1c5f8edb	The render lane's RENDER_LEG_MODULES and the seal test's RENDER_UNIT_IMPORTS gain opendox/doxbench_trust.py, opendox/doxbench_intake.py and openxdox/column_contributions.py, which the host bootstrap now imports. The seal carries a leg's whole src/, so no sealed artifact changes. scripts/profile_openxfactory.py's note on the two openXdox columns moves to the past tense.	ADMITTED_ARC_EDITS (both paths); HOST
24215223	test_ruling_q7_two_direct_upstreams_in_lockstep's snapshot literal moves d5098297 → e1e3a3c3, as its comment says it does on every bump.	ADMITTED_ARC_EDITS
eda75977	The lane route's predicate check (T086's Q8 (a)). openXdox-code's test_the_hosted_session_arrival_path_is_recorded_and_not_built no longer reads openxFactory's _handle_refresh_action (opensoft/openXdox-code#37 narrowed its loop to the leg's own routes), so tests/domain_profile/test_lane_route_asks_the_hosted_ref_predicate.py (new, 2 tests) asserts it here: the route's body calls hosted_ref_refused( (openXdox's predicate), and on a hosted plane a refresh naming a session ref is refused with session_unavailable before it runs, while a ref-less one runs. Three planted mutants are each killed: the check removed, the call kept but not deciding, and the call asked as loopback.	HOST_TESTS
b3a4b6e0	29 created: admissions in docs/opendox-carve-admissions.yaml, pinned in tests/carve_arrival by path, since and count, as T047's 37 and T064's 129 are, and one removed (below).	ADMITTED_ARC_EDITS (both paths)
16136990	The admissions test's ordinal paragraph and its sixteenth-bump docstring and comment name this PR, #1236 (a follow-up commit: the number did not exist before the PR).	ADMITTED_ARC_EDITS
9cd1bf23	Merge of main at ca1c1486 (lane openXfactory-3's ahead PR). It merged with no conflict, and its four files are byte-identical to the ahead commits this branch was measured over. It is not a realization commit, so it carries the Lane: line and no Arc: line (T091): F11.1's guard selects commits by that line, and walked over this branch it would otherwise charge #1234's two non-arc files to the arc.	(not on main's first-parent line)
7e31eca1	Copilot's finding at 16136990, and the pre-review's six fix-now findings. (Copilot) A refusal now gives back the unread defaults this call replaced: _DEFAULTS names the two globals and the default-registration call of each default-holding seam (T085's doxBench pair, T100's trust default). A write that replaced an unread default is recorded with it, and the take-back registers it again as the unread default, as openxdox.column_contributions does. The pre-review's six: (1) the no-columns refusal is tested, and no host seam is written; (2) a refusal at the trust seam is tested on fakes and on the pinned leg; (3) "five seams" becomes six where the count is meant; (4) GovernedBindingTrust's docstring names the one case that changed; (5) the failed-write case skips as root; (6) __all__ is in ASCII order and names GOVERNED_PENDING_REASON. The give-back case, the six-seam message and the exports case each failed before the fix. Planted mutants M12-M19 are each killed.	HOST, HOST_TESTS

The 29 admissions, each since the leg's own squash landing (git log --diff-filter=A), each path present at the new pin, and none placed by a row or declared before:

• opendox_code, 25: doxBench prompt panel: model picker and effort slider inside the composer #65 (T088) 1, add-wheel-action-verbs: tick 4.3 — live browser check green #67 (T070) 1, Speak nlm notebook create in the plain form 0.5.26 accepts (F8 drift) #69 (T072) 1, add-wheel-action-verbs: 4.4 complete — Brett's first commissions, full lifecycle traversal (22/22) #71 (T085) 2, Archive add-wheel-action-verbs (realized contract-v1.29; verification 4.1–4.4 complete) #72 (T073) 1, Realize add-project-scoped-selection: create-project commission + project-scoped selection #74 (T081) 1, Pending create-project commissions render in the picker (dashboard-project-scoping D-e) #77 (T084) 9, Propose add-project-merged-projection (dashboard-project-scoping exit 2) #78 (T099) 1, doxBench R-4: sending a new turn silently discards a pending proposal #80 (T103) 1, doxBench R-5: the Save summary leads with a downstream row's message, not the first failing cause #81 (T102) 1, doxBench R-6: the selector duplicates the ref in its option label #82 (T100) 2, doxBench R-8 (V2 family): lens subtabs + docs subpane wheel split with distilled abstracts #84 (T104) 3, Realize add-project-merged-projection: the D1 merged view (exit 2) #85 (T102 follow-on) 1. All are openDox-code landings over 047bb4fa..dede32b4.
• openxdox_code, 4: Fix brainstorm Captured header (validator contract) #37 (T086) at 56e1c238: src/openxdox/column_contributions.py, tests/test_column_contributions.py, tests/test_column_contributions_governed.py and tests/test_host_plane.py.
• One leaves: src/opendox/consumer_reach.py (openDox-code#9, da8aae96). openDox-code#77 (T084) deleted it at e49b17c3 when it retired the reach module, so the walk at dede32b4 never consumes the admission and the verifier would report it stale (declared_admissions_unused). It is removed, as split-opendox § 3.4 slice S5 removed its two re-homed modules', and tests/carve_arrival asserts it ABSENT. openXdox-code's own src/openxdox/consumer_reach.py (the RULED seed) is still at 56e1c238, and its entry stays.
• Neither spec leg moved (f7ee3c76, f088b097), so neither admits anything.
• Derived, not run green, for the -code legs, as at T047 and T064: the walk, with every rule verify-carve-arrival.py applies, reports stale 0 and only the carve-time files that are unchanged since the old pins (4 at opendox_code, 3 at openxdox_code), which T064 left as well (decision (d)).

T094's "Owed elsewhere" list from opensoft/openXdox-code#37, each item to the file that carries it

• scripts/opendox_host.register_openxfactory() calls column_contributions.register() after T064's projection line (Q6 (a)): scripts/opendox_host.py (3c1c1146).
• The module seals: scripts/ideation_dashboard/dashboard_refresh_lane.py and tests/ideation-dashboard/test_dashboard_source_seal.py (1c5f8edb). The carve admissions (created: gains src/openxdox/column_contributions.py, tests/test_column_contributions.py, tests/test_column_contributions_governed.py and tests/test_host_plane.py): docs/opendox-carve-admissions.yaml and tests/carve_arrival/test_verify_carve_arrival.py (b3a4b6e0).
• The parity test's MRO layout and test_serve_column_split.py's four snapshot rows, which move to the core: tests/ideation-dashboard/test_extension_point_parity.py and tests/ideation-dashboard/test_serve_column_split.py (3c1c1146).
• test_openxfactory_host_wiring.py's "second copy of the column" check and its contributed tuple, which now has three entries: tests/domain_profile/test_openxfactory_host_wiring.py (3c1c1146): test_no_route_extension_declares_a_second_copy_of_the_column holds each column to one declaration, and CONTRIBUTED_COLUMNS is LaneRoutes, GateRoutes, ProjectionRoutes.
• The lane route's hosted_ref_refused( check (Q8 (a)): tests/domain_profile/test_lane_route_asks_the_hosted_ref_predicate.py (eda75977).
• The trust policy at T100's seam (openXdox registers none; "Governance approval", openDox + openXdox: two open-source layers, an installable app with users, projects and a database; domain descendants pin openXdox (Brett's ruling 2026-09-04) #656 comment 5970369724): GovernedBindingTrust in scripts/opendox_host.py, tested by tests/domain_profile/test_host_registers_binding_trust.py (3c1c1146).

F11.1, on the real commits

PACKET_MERGE=94b6f7f1… ARC_TIP=<this branch's head> over the guard extracted from openspec/changes/add-neutral-product-standalone-operability/tasks.md prints:

requirement 1 holds: 0 note(s) annotated, every other path a declared surface (11.1)

Every path this PR touches is on a declared surface:

• PIN_PAIRS: openDox, contracts/opendox-pin.yaml, openXdox, contracts/openxdox-pin.yaml;
• HOST: scripts/opendox_host.py, scripts/profile_openxfactory.py;
• HOST_TESTS: tests/domain_profile/test_host_registers_binding_trust.py, tests/domain_profile/test_lane_route_asks_the_hosted_ref_predicate.py, tests/domain_profile/test_openxfactory_host_wiring.py;
• COMPOSITION_TESTS: tests/ideation-dashboard/test_extension_point_parity.py, tests/ideation-dashboard/test_serve_column_split.py, tests/ideation-dashboard/test_doxbench_status_exemption.py;
• ADMITTED_ARC_EDITS: scripts/ideation_dashboard/dashboard_refresh_lane.py, tests/ideation-dashboard/test_dashboard_source_seal.py, tests/openxdox_pin/test_openxdox_pin_verifier.py, docs/opendox-carve-admissions.yaml and tests/carve_arrival/test_verify_carve_arrival.py.

The admitted list does not grow, and no manifest note is annotated here (decision (b)).

The falsifiers, at the COMMITTED pins

run	head	verifiers	pytest-suite	other checks
CI	16136990	OK, OK	selected=9362 passed=9356 skipped=6 failures=0 errors=0, floors met (margin 2312), run 37315023063	all success, openxdox-consumer-gate included
local	eda75977 (16136990 changes only a docstring and a comment)	OK, OK	8943 passed, 7 skipped, 0 failed (pytest tests/ -q -m "not postgres")	the composition, domain_profile, carve-mapping, both pin dirs and carve_arrival: 569 passed
CI	7e31eca1		PENDING	PENDING
local	7e31eca1	OK, OK	PENDING	domain_profile, the seal and the carve mapping: 626 passed; mutants M12-M19 killed

Each local run uses Python 3.12.3, with TMPDIR and --basetemp under ~/.local/state, outside the aggregation tree, in a checkout named openxFactory. A local run skips 7 where CI skips 6: the work tree sits inside an aggregation checkout, so the aggregation ignore-file case runs and passes there (#1215's reason).

• validate-carve-manifest.py prints OK (456 rows), and validate-former-id-arrival.py --base origin/main --head HEAD passes.

Accepted limits

• A leg from before T100 now fails with an ImportError, because seams() imports doxbench_trust, rather than with HostSeamsIncomplete by name. The pins only move forward.
• A directory at the declarations path reads as "no document". That is openDox's own store rule (document_present checks for a regular file), and the change opens no new hole.
• Under the governed host, model-binding trust prints trusted "m1" on this machine although record() records nothing. That wording is openDox-code's (cli_model_binding._trusted_line ignores recording.recorded), and it is deferred to an openDox-code follow-on after release 1.
• The trust seam's take-back entry cannot fire today. Only the home seam follows it, and the home seam refuses nothing. Nit: _TAKE_BACK is keyed by the bare call name "register".

What this leaves for the aggregation

This PR does not do the opensoft/xFactory root pin-sync. When it runs, it needs:

• the root openDox gitlink → e1e3a3c3f8dd38214510412b71a2e858c6179532;
• the root openXdox gitlink → 9564d5d9462ffd1a3155d9177206368e5061efa8;
• the root openxFactory gitlink → this PR's landed sha, with .github/clearing/openxfactory/PIN.yaml in the same commit (CLAUDE.md rule 2);
• .github/workflows/dashboard-image-worker.yml's RENDER_LEG_MODULES and its mirror in tests/test_dashboard_image_worker_contract.py gain the same three modules as this PR's 1c5f8edb.

Arc: neutral-product-standalone-operability

🤖 Generated with Claude Code

[sourcery-ai]

Reviewer's Guide

This PR lands phase 3 by advancing the openDox and openXdox pins together, registering openxFactory’s governed binding-trust policy, wiring openXdox’s contributed columns through the host composition facet, and updating the associated composition, routing, seal, and carve-arrival proofs.

Sequence diagram for governed binding trust evaluation

sequenceDiagram
    participant Client
    participant OpenDox
    participant GovernedBindingTrust
    participant DeclarationStore

    Client->>OpenDox: verdict(binding, root)
    OpenDox->>GovernedBindingTrust: verdict(binding, root)
    GovernedBindingTrust->>DeclarationStore: pending_binding_ids()
    alt declarations unreadable
        DeclarationStore-->>GovernedBindingTrust: IntakeRefused
        GovernedBindingTrust-->>OpenDox: TrustVerdict.untrusted_for()
    else binding is pending
        DeclarationStore-->>GovernedBindingTrust: pending binding id
        GovernedBindingTrust-->>OpenDox: TrustVerdict.untrusted_for()
    else binding is not pending
        DeclarationStore-->>GovernedBindingTrust: declarations
        GovernedBindingTrust-->>OpenDox: TrustVerdict.trusted_for()
    end
    OpenDox-->>Client: trust verdict

Loading

Sequence diagram for synchronized product pin verification

sequenceDiagram
    participant Verify as verify-opendox-pin.py
    participant OpenDoxPin as contracts/opendox-pin.yaml
    participant OpenXdoxPin as contracts/openxdox-pin.yaml
    participant VerifyXdox as verify-openxdox-pin.py

    Verify->>OpenDoxPin: read commit e1e3a3c3
    Verify->>OpenDoxPin: recompute tree_sha256
    Verify->>OpenXdoxPin: check lockstep declaration
    OpenXdoxPin-->>Verify: openDox e1e3a3c3
    Verify-->>Verify: pin verified
    VerifyXdox->>OpenXdoxPin: read commit 9564d5d9
    VerifyXdox->>OpenXdoxPin: recompute tree_sha256
    VerifyXdox-->>VerifyXdox: pin verified

Loading

File-Level Changes

Change	Details	Files
Advanced both product pins together and synchronized their recorded tree digests and migration metadata.	Moved the openDox gitlink and pin from d5098297 to e1e3a3c3 and updated its digest. Moved the openXdox gitlink and pin from f257e021 to 9564d5d9 and updated its digest. Retained lockstep validation and documented the updated openDox code-leg runbook reference.	contracts/opendox-pin.yaml contracts/openxdox-pin.yaml openDox openXdox tests/openxdox_pin/test_openxdox_pin_verifier.py
Registered the host’s governed binding-trust policy and wired openXdox’s contributed columns into the host.	Added GovernedBindingTrust with pending, unreadable-document, approved, undeclared, intake, and no-op recording behavior. Registered the trust policy as a host seam and verified registration order, replacement refusal, and host-basis verdicts. Registered openXdox column contributions and rejected assemblies that contribute no columns. Updated host/profile documentation for the new trust and column wiring.	scripts/opendox_host.py scripts/profile_openxfactory.py tests/domain_profile/test_host_registers_binding_trust.py tests/domain_profile/test_openxfactory_host_wiring.py
Updated composition, routing, and source-seal tests for phase-3 column ownership and hosted-reference enforcement.	Composed LaneRoutes, GateRoutes, and ProjectionRoutes through the handler facet without duplicate declarations. Retargeted snapshot and capability ownership assertions to the core handler after openXdox’s column trim. Added hosted refresh rejection coverage for non-main session references. Added the newly imported host and contributed modules to render/seal expectations.	tests/domain_profile/test_lane_route_asks_the_hosted_ref_predicate.py tests/ideation-dashboard/test_extension_point_parity.py tests/ideation-dashboard/test_serve_column_split.py tests/ideation-dashboard/test_doxbench_status_exemption.py tests/ideation-dashboard/test_dashboard_source_seal.py scripts/ideation_dashboard/dashboard_refresh_lane.py
Rebased carve-arrival admissions on the new code-leg pins and removed the stale retired consumer-reach admission.	Added 25 openDox-code and 4 openXdox-code created-file admissions with introducing commits. Removed src/opendox/consumer_reach.py and asserted that its admission remains absent. Updated the ordinal/count assertions for the sixteenth bump while preserving unchanged carve-time files.	docs/opendox-carve-admissions.yaml tests/carve_arrival/test_verify_carve_arrival.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[Copilot]

Copilot review overview

🟡 Changes recommended

A trust-registration conflict can leave earlier seam replacements installed after rollback.

Review effort: Balanced
Findings: 1

Open (1)

• Restore displaced seams when trust registration fails · New

What changed in this PR

Advances plan 034’s phase-3 consumer pins and integrates the new openDox/openXdox interfaces into openxFactory.

Changes:

• Updates both consumer pins and their recorded digests.
• Registers governed columns and the host’s binding-trust policy.
• Updates composition tests, render dependencies, and carve admissions.

File	Description
tests/​openxdox_pin/​test_openxdox_pin_verifier.py	Updates the lockstep pin assertion.
tests/​ideation-dashboard/​test_serve_column_split.py	Checks updated handler ownership.
tests/​ideation-dashboard/​test_extension_point_parity.py	Updates dispatch and handler composition expectations.
tests/​ideation-dashboard/​test_doxbench_status_exemption.py	Accounts for default registration.
tests/​ideation-dashboard/​test_dashboard_source_seal.py	Adds required module expectations.
tests/​domain_profile/​test_openxfactory_host_wiring.py	Checks six seams and three columns.
tests/​domain_profile/​test_lane_route_asks_the_hosted_ref_predicate.py	Tests hosted session-ref refusal.
tests/​domain_profile/​test_host_registers_binding_trust.py	Tests governed trust and intake behavior.
tests/​carve_arrival/​test_verify_carve_arrival.py	Checks new admissions and retired-path absence.
scripts/​profile_openxfactory.py	Clarifies column ownership in comments.
scripts/​opendox_host.py	Registers governed columns and binding trust.
scripts/​ideation_dashboard/​dashboard_refresh_lane.py	Updates render module requirements.
docs/​opendox-carve-admissions.yaml	Adds 29 admissions and removes one stale entry.
contracts/​openxdox-pin.yaml	Advances the openXdox pin and digest.
contracts/​opendox-pin.yaml	Advances the openDox pin, digest, and migration reference.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Copilot review overview

🟡 Changes recommended

The trust policy admits bindings when the declarations path is an existing non-regular file instead of refusing it.

Review effort: Balanced
Findings: 1

Open (1)

• Reject non-regular declarations paths instead of trusting bindings · New

Resolved since last review (1)

• Restore displaced seams when trust registration fails

[brettheap]

READY (holder's manual landing, Copilot label overridden) at 7e31eca — Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

Holder: T094, T090 step 6, phase 3's consumer pins and host wiring. It is an arc landing.

• The pins. Both pairs move in ONE commit (caa8d377): openDox → e1e3a3c3 (T087) and openXdox → 9564d5d9 (step 5, openXdox#22). That departs from step 6's "one commit each", as T047 and T064 did. verify-opendox-pin refuses either split order (opendox-pin-lockstep-mismatch; both REFUSE lines are quoted in the body).

• The host wiring.

  • openXdox's columns are registered after T064's projection line.
  • The governed binding-trust policy (5970369724) is the sixth seam, with its take-back. A replaced unread default is given back.
  • The composition rows have moved.
  • The lane route's hosted_ref_refused( check is tested (Q8 (a)).
  • There are 29 carve admissions, and consumer_reach.py's admission is removed and asserted absent.
  • The merge-of-main commit carries no Arc: line, by the holder's ruling: it is neither a realization commit nor a landing (T091).

• Review.

  • An independent pre-review found six fix-now items, and all six are fixed in 7e31eca1, each red-first, with mutants M12 to M19 killed.
  • Copilot's r4184406714, at 16136990, is fixed in the same commit.

• Gates at the head.

  • All 15 check-runs pass. pytest-suite (run 37319092077) reads selected 9376, passed 9370, skipped 6, failures 0.
  • Both pin verifiers print OK.
  • F11.1's guard holds: "requirement 1 holds: 0 note(s) annotated, every other path a declared surface (11.1)".
  • 0 unresolved threads, and no closing keyword.

• Copilot's review at the head says "Changes recommended", with one new finding, r4184739661 (High): a directory or FIFO at the declarations path reads as no document, so every binding is trusted. The holder rules it an ACCEPTED LIMIT under the convergence rule (5988818366). It is not a bypass:

  • anyone who can put a directory at that path can delete or edit the declarations document, and a deletion has the same effect, because an undeclared binding is trusted under 5970369724;
  • the case is openDox's own store rule (document_present reads a regular file only);
  • a document that exists but cannot be read still fails closed.

  Tightening it belongs to an openDox-code DeclarationStore follow-on after release 1. The body lists it under accepted limits. The landing uses the lander's override for Copilot's label.

• What follows.

  • Lane openXfactory-3's T098 runs the interim F11.1 with ARC_TIP at this landing, then T089.
  • The aggregation pin-sync (D4) mirrors the root gitlinks, PIN.yaml and RENDER_LEG_MODULES.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 4 days and 6 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

LANDING — lane openxfactory-4, session faabad8b-8c31-4958-abd5-b35bdc9cd282@Eagle, 2026-10-05T14:06:37Z, PR #1236 into opensoft/openxFactory main

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

LANDED — lane openxfactory-4, 2026-10-05T14:06:53Z, PR #1236 → 3690848 (opensoft/openxFactory main; squash)