Consensus loop: reviewer prompt rendering should fail closed on unresolved placeholders

[MarketingChronoAi]

Problem

Generic prompt rendering uses safe substitution, which leaves unknown placeholders unresolved. Some prompt paths have explicit fully-rendered checks, but reviewer prompt dispatch does not. This allowed ${REVIEW_ROUND} to remain in rendered reviewer prompts.

Confirmed missing behavior

• No reviewer-specific unresolved-placeholder validation after render.
• Existing unresolved-placeholder validators are present for other prompt types, proving the pattern exists but is not applied to reviewer prompts.

Evidence

• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/prompt_rendering.py uses Template(...).safe_substitute(...).
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/controller_actions.py: generic render_template() writes rendered text directly.
• Rebase-resolve and review-fix prompt paths have explicit fully-rendered checks.
• No equivalent check exists in dispatch_reviewers() after rendering reviewer prompts.

Suggested fix

• Add _ensure_reviewer_prompt_fully_rendered(prompt_path) or a shared fully-rendered check used by all prompt dispatch paths.
• Call it after rendering reviewer prompts and before appending HARNESS_SPAWN_INTENT.
• Fail closed with a clear error if unresolved placeholders remain.

Acceptance criteria

• Reviewer prompt dispatch fails before spawn intent if any ${...} placeholder remains unresolved.
• The failure is recorded with prompt path and placeholder names.
• Tests cover unresolved placeholder rejection for reviewer prompts.

Review status

This was independently reviewed in /Users/chronoai/Desktop/proposed-main-repo-issues-review-gate.md and classified high confidence.

⟦AI:AUTO-LOOP⟧
ISSUE_RAISED:review-gate-hardening:reviewer-render-fail-closed

[ctkm-aelf]

🤖 Minimal solver proposes fail-closed reviewer prompt validation

TL;DR

• What this is: Round 1 minimal-change solver output for issue Consensus loop: reviewer prompt rendering should fail closed on unresolved placeholders #44.
• Current state or conclusion: The issue is real; reviewer prompt dispatch renders with safe substitution and can write HARNESS_SPAWN_INTENT while ${...} placeholders remain.
• What the controller does next: Compare this with the other solver outputs and select the smallest consensus plan that fails before reviewer spawn intent.

---

Minimal framing

The minimum viable fix is to add reviewer-specific unresolved-placeholder validation immediately after reviewer prompt rendering in dispatch_reviewers() and before _append_harness_spawn_intent(...). HARNESS_SPAWN_INTENT is the controller queue entry that starts a worker; validating before it is written keeps malformed reviewer prompts from being dispatched.

Evidence checked:

Source	Why it matters
prompt_rendering.py	Template(...).safe_substitute(...) leaves unknown ${...} placeholders in rendered text.
controller_actions.py::dispatch_reviewers()	It calls render_template(...) for reviewer prompts and then appends spawn intent without a rendered-output check.
controller_actions.py::_ensure_rebase_resolve_prompt_fully_rendered() and _ensure_review_fix_prompt_fully_rendered()	These show the existing local fail-closed pattern for adjacent prompt dispatch paths.
wakeup_runner.py::_ensure_remote_ci_fix_prompt_fully_rendered()	Confirms the same pattern is used outside the controller action path too.

Recommended implementation:

Option	Files	Trade-off
Add _ensure_reviewer_prompt_fully_rendered(prompt_path) and call it inside dispatch_reviewers()	2 files, about +49 LOC total with test	Smallest change; duplicates an existing helper shape.
Share one generic prompt validation helper across all paths	More files/call sites	Less duplication, but broader than issue #44 needs.
Replace safe_substitute() with strict substitution	Broad render behavior change	Higher regression risk for unrelated staged-render paths.

Test coverage should add one focused test_controller_actions.py case: mock reviewer rendering to write contains ${REVIEW_ROUND}, assert RuntimeError includes the prompt path and placeholder name, and assert the pending-events log does not contain HARNESS_SPAWN_INTENT.

📎 Full raw codex output (archival)

---
solver: minimal
issue: 44
cluster: issue-44
verdict: propose
---

## Recommended framing
最小可行边界是在 `dispatch_reviewers()` 的 reviewer prompt 渲染后、写入 `HARNESS_SPAWN_INTENT` 前，复用现有 `${...}` 未解析占位符检查模式并为 reviewer 路径补一条回归测试。现有 `render_prompt_text()` 使用 `Template.safe_substitute()`，未知变量会原样保留；`dispatch_reviewers()` 当前直接把渲染结果交给 spawn intent，而 rebase-resolve、review-fix、remote-ci-fix 已经有同类 fail-closed 检查，所以这里不需要改渲染器语义或引入新抽象，只需把 reviewer 派发路径补齐到同一安全边界。Reference-frame note: fail-fast input validation at trust boundary; prompts are executable worker inputs, so validation belongs immediately before dispatch.

## Concrete plan
- Files: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/controller_actions.py` — add `_ensure_reviewer_prompt_fully_rendered(prompt_path: Path)`, called immediately after `self.render_template(...)` inside `dispatch_reviewers()` and before `_append_harness_spawn_intent(...)`; error should include `reviewer prompt render left unresolved placeholders`, the prompt path, and sorted unique placeholder names.
- Files: `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_controller_actions.py` — add one focused test near existing `dispatch_reviewers` tests that mocks reviewer render to write `contains ${REVIEW_ROUND}`, asserts `RuntimeError`, asserts message includes prompt path and `${REVIEW_ROUND}`, and asserts `.refactor-loop/.controller-pending-events.log` does not contain `HARNESS_SPAWN_INTENT`.
- LOC delta: ~+14 / -0 in implementation, ~+35 / -0 in tests.
- Tests to add/modify: add `test_dispatch_reviewers_fails_closed_on_unresolved_prompt_placeholder` in `test_controller_actions.py`; run the targeted Python unittest for that test or the full `test_controller_actions.py` file for this skill code path.
- Governance/ruleset change (if any): none.
- Migration path: no migration needed; existing valid reviewer prompts render unchanged.

## Risks
- The minimal duplicate-helper shape preserves existing local style but leaves three similar unresolved-placeholder helpers in the controller code.
- A plain regex `\$\{[^}]+\}` matches shell-style placeholders too; this is already the established behavior in rebase-resolve, review-fix, and remote-ci-fix paths, so the reviewer path should match it unless a later shared abstraction deliberately scopes exceptions.
- If reviewer templates intentionally contain literal `${...}` examples, they will now need escaping or replacement before dispatch; that is acceptable for fail-closed worker prompts.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — short, for meta-judge)
- Why this is the minimum: The violation is real in current source: `prompt_rendering.py` uses `Template(...).safe_substitute(...)`, and `controller_actions.py::dispatch_reviewers()` renders reviewer prompts then appends `HARNESS_SPAWN_INTENT` with no unresolved-placeholder validation. Existing `_ensure_rebase_resolve_prompt_fully_rendered()` and `_ensure_review_fix_prompt_fully_rendered()` prove the intended local pattern.
- What I considered but rejected: A shared prompt-render validation utility would reduce duplication but touches more call sites and risks changing generic rendering behavior. Changing `safe_substitute()` to `substitute()` is broader and could break templates that intentionally rely on staged or post-render replacement. Validating all `render_template()` outputs globally is also broader than issue #44.
- What I cannot decide alone: Whether a later cleanup should consolidate the three-plus prompt validators into a shared helper; not needed for this issue.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:add reviewer prompt unresolved-placeholder check before HARNESS_SPAWN_INTENT plus focused controller-actions regression test

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Structural solver proposes shared prompt-render validation

TL;DR

• What this is: Structural solver output for issue Consensus loop: reviewer prompt rendering should fail closed on unresolved placeholders #44, focused on reviewer prompt placeholders that survive rendering.
• Current state or conclusion: Propose a shared fail-closed rendered-prompt validation helper and require reviewer dispatch to pass it before writing any spawn intent.
• What the maintainer should do OR what the controller does next: The controller can route this to consensus judging; implementation should stay bounded to prompt rendering, reviewer dispatch, and focused regression tests.

---

Structural recommendation

The issue is real in the checked source shape: render_prompt_text uses Template.safe_substitute, which leaves unknown ${...} placeholders in place, and dispatch_reviewers renders each reviewer prompt before appending HARNESS_SPAWN_INTENT. HARNESS_SPAWN_INTENT is the queued worker-spawn record, so it should only be written after the rendered prompt has crossed a completeness check.

Recommended structure: add ensure_prompt_fully_rendered(prompt_path, prompt_kind=...) in the prompt-rendering module. This helper is a shared render-boundary validator: it reads the rendered prompt, finds unresolved ${...} placeholders, sorts and de-duplicates them, and raises a clear error containing the prompt path and placeholder names. PromptRenderValidationError would be the named exception for that boundary.

Option	Trade-off
Shared render-boundary helper	Preferred: one validation rule for reviewer, rebase-resolve, review-fix, and remote-ci-fix prompt paths; small cost, less duplicated regex logic.
Reviewer-only private helper	Fastest patch, but keeps the same validation rule copied in multiple controller paths.
Make render_template reject unresolved placeholders globally	Strongest invariant, but higher compatibility risk for templates that intentionally carry literal shell ${...} examples.

The implementation should call the shared helper immediately after reviewer render_template(...) and before _append_harness_spawn_intent(...). Regression coverage should assert that a rendered reviewer prompt containing ${REVIEW_ROUND} fails before any HARNESS_SPAWN_INTENT is appended, and that the error reports both the prompt path and placeholder name.

📎 Full raw codex output (archival)

---
solver: structural
issue: 44
cluster: issue-44
verdict: propose
---

## PROJECT_RULES clause violated (quoted verbatim)
> - FI-001 AI-authored artifacts are untrusted by default; before entering mainline, they must pass independent checks, including the applicable mix of consensus, review, or automated verification.
> - FI-005 Boundaries take precedence over convenience; responsibility, layering, protocol, and state ownership must be clear, and shortcut layers must not bypass the main path.
> - FI-006 Changes must be verifiable and evidence-based; failures, gaps, and out-of-scope promises must be exposed explicitly, and tests must not be disabled to force a pass.

## Recommended framing
把“prompt 渲染完成性”提升为共享的渲染后契约，而不是在每个调度路径里复制正则检查。当前 `prompt_rendering.py` 的 `Template(...).safe_substitute(...)` 会保留未知 `${...}`，而 `dispatch_reviewers()` 在 `controller_actions.py:1716` 写出 reviewer prompt 后直接在 `controller_actions.py:1728` 追加 `HARNESS_SPAWN_INTENT`。结构性修复是在 `codex_refactor_loop/prompt_rendering.py` 增加一个小型 `PromptRenderValidationError` + `ensure_prompt_fully_rendered(...)`，由 reviewer dispatch、rebase-resolve、review-fix、remote-ci-fix 这些已需要 fail-closed 的路径共用；这样 unresolved placeholder 的检测、去重、排序、错误消息形状都归同一个边界所有，reviewer spawn intent 在契约通过前不会进入队列。

Reference-frame note: fail-fast contract validation at trust-boundary handoff; rendered AI-worker prompts are untrusted artifacts crossing from template/controller state into an executable worker spawn queue.

## Concrete plan
- New abstractions (if any): `PromptRenderValidationError(ValueError)` and `ensure_prompt_fully_rendered(prompt_path: Path, *, prompt_kind: str) -> None` in Layer: consensus-loop prompt rendering boundary; Project: consensus-loop scripts; File: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/prompt_rendering.py`. The helper reads the rendered prompt, extracts unresolved `${NAME}`/`${...}` tokens with the existing pattern, sorts unique placeholders, and raises an error that includes `prompt_kind`, `prompt_path`, and placeholder names.
- Files: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/prompt_rendering.py` add shared validation helper and exported exception; `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/controller_actions.py` import the helper, call `ensure_prompt_fully_rendered(prompt, prompt_kind=f"reviewer-{role}")` immediately after `render_template(...)` in `dispatch_reviewers()` and before `_append_harness_spawn_intent(...)`, then replace `_ensure_rebase_resolve_prompt_fully_rendered()` and `_ensure_review_fix_prompt_fully_rendered()` bodies or remove those private wrappers if call sites stay clearer without them; `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py` should use the same helper for `_ensure_remote_ci_fix_prompt_fully_rendered()` to avoid a new one-off rule; `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_controller_actions.py` add reviewer dispatch regression coverage; `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_prompt_rendering.py` add helper-level extraction/error-message coverage if the implementation exposes the exception as part of the prompt-rendering boundary.
- LOC delta: ~+55 / -25 net across 5 files. Expected shape: +35 in `prompt_rendering.py`, +6 to +12 in `controller_actions.py`, -12 to -20 duplicated regex lines from private prompt checks, +25 to +35 focused tests.
- Tests to add: `test_dispatch_reviewers_rejects_unresolved_placeholder_before_spawn_intent` in `test_controller_actions.py`, with `render_template` writing `Review ${REVIEW_ROUND}\n` and asserting `RuntimeError`/`PromptRenderValidationError` mentions the prompt path and `${REVIEW_ROUND}`, while `.refactor-loop/.controller-pending-events.log` has no new `HARNESS_SPAWN_INTENT`; `test_ensure_prompt_fully_rendered_reports_path_and_placeholders` in `test_prompt_rendering.py`, asserting sorted unique placeholder names and the concrete prompt path; update any existing tests that directly inspect private `_ensure_*_prompt_fully_rendered` methods to call the shared helper if present.
- Schema/protocol changes (if any): none. This changes controller fail-closed behavior before worker spawn; no wire schema or GitHub lifecycle format changes.
- Governance/ruleset changes (if any): none. Existing FI-001/FI-005/FI-006 already require independent checks, clear boundaries, and evidence-backed failures; this plan applies those invariants to reviewer prompt dispatch.
- Runtime cost: one UTF-8 read and one regex scan per rendered prompt. Reviewer dispatch renders 3 prompts in the full path, so roughly 3 extra file reads and O(total prompt bytes) regex time; with 10-30 KB prompts this is normally <2 ms local disk latency and <100 KB transient string/set allocation per dispatch. Rebase/review-fix/remote-ci-fix keep their existing read+scan cost, just through shared code.
- If the structural answer is issue decomposition, use the controller-private `IssueDecompositionPlan` boundary and child body artifacts; forbid solver/judge/worker GitHub lifecycle, public issue factories, and any `wakeup_plan.py` decompose action/projection.
- Do not author helper-owned decomposition tracking comments or child fingerprint lines; the checked-in #403 helper is the only writer for the parent tracking grammar and per-child idempotency fingerprints.

## Risks
- The shared helper can over-match literal shell examples like `${PROJECT_RULES:-CLAUDE.md}`. Keep the existing path-specific default replacement before validation where it already exists, and if reviewer prompts intentionally include shell-default syntax, require an explicit local replacement or an allowlist parameter with a call-site comment naming why that literal is not a template placeholder.
- Moving all existing checks at once may obscure the targeted reviewer fix. Keep the first implementation bounded: add the shared helper, switch reviewer dispatch, and optionally switch only the two existing controller-owned checks in the same file; remote-ci-fix can be a follow-up if the diff grows past the small-change target.
- Raising an exception from `dispatch_reviewers()` may differ from paths that return numeric codes. That is already the behavior of the existing rebase/review-fix fully-rendered checks, so the structural plan preserves the local failure model rather than inventing a new status channel.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — for meta-judge)
- Why this structure beats a documented exception: Reviewer prompts are executable worker inputs. A note saying “reviewer templates should be complete” still leaves the spawn queue capable of carrying unresolved placeholders; a render-boundary helper makes incomplete prompts unspawnable.
- Why I picked this abstraction over alternatives: There are already at least three concrete callers with copied `re.findall(r"\$\{[^}]+\}", text)` checks (`rebase-resolve`, `review-fix`, `remote-ci-fix`) plus the missing reviewer caller. That satisfies the two-caller rule and makes a shared helper cheaper than another reviewer-specific private method.
- What I cannot decide alone: Whether literal shell placeholder syntax should be globally allowed in rendered prompts. The safe default is no; if maintainers need literal `${...}` examples in worker prompts, they should approve a narrow allowlist with tests for each allowed token family.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:structural:propose:centralize rendered-prompt completeness validation and gate reviewer spawn intents on it

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Delete-solver result: collapse duplicate prompt validation

TL;DR

• What this is: delete-framed design solver output for issue Consensus loop: reviewer prompt rendering should fail closed on unresolved placeholders #44.
• Current state or conclusion: keep reviewer dispatch, but delete the duplicated per-prompt validator helpers by collapsing them into one shared fail-closed prompt-render check.
• What the controller does next: compare this with the other solvers and, if consensus agrees, implement the shared check before any reviewer HARNESS_SPAWN_INTENT queue record is written.

---

Design Result

HARNESS_SPAWN_INTENT is the controller queue record that starts a spawned worker. The unsafe behavior is that reviewer prompt rendering can leave ${...} placeholders in the prompt and still write that queue record.

The delete position is not to remove reviewer dispatch. Reviewer dispatch is a real review-gate capability and the reviewer templates require review_round plus head_sha in GitHub-visible reviewer comments. The deletion target is the duplicated validator shape: rebase-resolve, review-fix, and remote-ci-fix each have their own private unresolved-placeholder check with the same core logic.

Option	Trade-off
Delete reviewer dispatch	Not safe: removes a live PR review-gate capability.
Add a fourth reviewer-only validator	Works, but increases duplicated validation code.
Collapse validators into one shared helper	Preferred: preserves the capability, fails closed before spawn, and deletes duplicate private helpers.

Recommended implementation shape:

• Add one shared prompt-rendering helper that finds sorted unique ${...} placeholders and raises with the prompt path plus placeholder names.
• Bind REVIEW_ROUND in reviewer prompt render env.
• Call the shared helper in dispatch_reviewers before appending the reviewer HARNESS_SPAWN_INTENT queue record.
• Migrate the existing rebase-resolve, review-fix, and remote-ci-fix checks to the same helper, then delete their duplicate private methods.
• Add focused tests proving unresolved reviewer placeholders stop before spawn intent and proving normal reviewer prompts render REVIEW_ROUND.

Local debug context

Internal artifact path: .refactor-loop/runs/phase9-issue44-r1-delete.md

📎 Full raw codex output (archival)

---

solver: delete
issue: 44
cluster: issue-44
verdict: propose

Classification

d) Genuinely needed but over-built

Recommended action

不要删除 reviewer dispatch 本身；它是 PR review gate 的真实能力，reviewer-*.md 模板明确要求 review_round 和 head_sha 出现在 GitHub-visible reviewer comments 中。应删除/折叠现有分散的 _ensure_*_prompt_fully_rendered 私有重复实现，把 unresolved-placeholder 检查下沉为一个共享 prompt-rendering helper，然后让 reviewer、review-fix、rebase-resolve、remote-ci-fix 这些 spawn 前路径统一调用；同时在 reviewer render env 中绑定 REVIEW_ROUND，并在 append HARNESS_SPAWN_INTENT 前 fail closed。

Concrete plan (if propose)

• Files to delete: none whole-file; delete duplicate private helper methods _ensure_rebase_resolve_prompt_fully_rendered and _ensure_review_fix_prompt_fully_rendered from /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/controller_actions.py, and _ensure_remote_ci_fix_prompt_fully_rendered from /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py.
• Caller migrations:
  • controller_actions.py:1886 rebase-resolve post-render check -> shared ensure_prompt_fully_rendered(prompt, context="rebase-resolve prompt render").
  • controller_actions.py:2503 review-fix post-render check -> shared ensure_prompt_fully_rendered(prompt_path, context="review-fix prompt render").
  • wakeup_runner.py:1718 remote-ci-fix post-render check -> shared ensure_prompt_fully_rendered(prompt, context="remote-ci-fix prompt render").
  • controller_actions.py:1716-1728 reviewer prompt dispatch -> add "REVIEW_ROUND": str(round_number) to the render env, then call shared ensure_prompt_fully_rendered(prompt, context=f"reviewer prompt render {prompt}") before _append_harness_spawn_intent(...).
  • prompt_rendering.py -> add one shared helper, for example unresolved_prompt_placeholders(text) -> tuple[str, ...] plus ensure_prompt_fully_rendered(prompt_path, *, context), returning sorted unique ${...} placeholders and raising with prompt path plus placeholder names.
• Tests to delete: none; existing review dispatch tests are load-bearing. Add/adjust focused tests in /Users/chronoai/.claude/skills/consensus-loop/scripts/test_controller_actions.py proving reviewer dispatch with an unresolved ${REVIEW_ROUND}-style placeholder returns/raises before a HARNESS_SPAWN_INTENT line is appended, and proving REVIEW_ROUND is rendered for the normal reviewer path.
• LOC delta: estimated -8 net LOC after removing 3 duplicate validator methods and adding 1 shared helper plus 3 migrated calls and 1 reviewer-specific call.
• Philosophy/CLAUDE.md/SPEC/Tier changes (if any): none.

Reverse-evidence (why this is safe to delete)

• No public API breaks: the deletions are private helper methods in controller/runtime implementation files; scans found no external callers beyond the immediate internal call sites.
• No external repo dependency on the code: $EXTERNAL_REPOS untouched; this plan affects local consensus-loop helper scripts only.
• Tests covering the path are themselves load-bearing, so they should be retained and extended rather than deleted.
• Reviewer dispatch is not dead code: dispatch_reviewers is reachable from controller_actions.py:1341, wakeup-runner dispatch paths, and wakeup-plan projections; reviewer artifacts are consumed by review gate logic.
• Existing fail-closed checks prove the pattern is valid but duplicated: controller_actions.py:2149-2153, controller_actions.py:2512-2516, and wakeup_runner.py:1726-1730 all implement the same regex-based unresolved-placeholder rejection.
• The issue is source-explainable locally: prompt_rendering.py:37 uses Template(...).safe_substitute(...), which preserves unknown placeholders; dispatch_reviewers currently renders at controller_actions.py:1716-1727 and appends spawn intent at controller_actions.py:1728-1737 without a fully-rendered check.
• The reviewer templates require the missing binding: reviewer-architect.md:71, reviewer-tests.md:73, and reviewer-quality.md:74 include ${REVIEW_ROUND} in required GitHub comment text.

Risks

• If any prompt intentionally leaves ${...} tokens for the spawned worker to interpret, a shared strict helper must not be applied globally by default. The safe plan applies it only to already-strict spawn paths plus reviewer prompts, not to every render_template call.
• If shell-style defaults such as ${PROJECT_RULES:-CLAUDE.md} remain in a strict path, keep the existing pre-check replacement steps (_replace_rebase_resolve_shell_defaults, _replace_review_fix_shell_defaults) before the shared check.
• Git history/blame could not be inspected for the cited .claude/skills/consensus-loop files from /Users/chronoai/Desktop/codex because that skill directory is outside the Git repository and has no local .git; this does not affect the local source/call-site evidence.

Escalation triggers (if any)

• none

Reasoning trace (internal — for meta-judge)

• Reference-frame note: fail-closed rendering is the mature security/reliability pattern for command prompts that spawn autonomous workers; unresolved template variables are malformed inputs, not best-effort text.
• Why I claim this can be deleted: the deletion target is not reviewer dispatch; it is the duplicated per-prompt validator implementation. Three private helpers perform the same sorted-regex unresolved-placeholder check and can collapse into one shared prompt-rendering helper without changing the runtime capability.
• What I checked to verify safety: searched for safe_substitute, _ensure_*prompt_fully_rendered, dispatch_reviewers, reviewer templates, test references, and HARNESS_SPAWN_INTENT; read prompt_rendering.py, controller_actions.py reviewer/rebase/review-fix paths, reviewer prompt templates, and wakeup-runner references.
• What I cannot decide alone: exact exception/return-code style for dispatch_reviewers on render failure should follow the surrounding controller action test expectations during implementation, but the design requirement is clear: no spawn intent after unresolved placeholders.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:delete:propose:collapse duplicate prompt fully-rendered validators into one shared fail-closed render check and apply it to reviewer dispatch before HARNESS_SPAWN_INTENT

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Meta-judge requests convergence on prompt validation scope

TL;DR

• What this is: Round 1 meta-judge decision for issue Consensus loop: reviewer prompt rendering should fail closed on unresolved placeholders #44.
• Current state or conclusion: All three solvers agree reviewer prompts must fail closed before HARNESS_SPAWN_INTENT, but they split on reviewer-local validation versus a shared prompt-render helper.
• What the controller does next: Run convergence round 2 with a narrowed question about validation ownership, migrated call sites, and whether REVIEW_ROUND binding is in scope.

---

Decision

HARNESS_SPAWN_INTENT is the queue record that starts a spawned worker. The agreed safety boundary is clear: reviewer prompt rendering must reject unresolved ${...} placeholders before that record is written.

The implementation shape is not yet a 3/3 consensus. The minimal solver proposed adding a reviewer-specific check in controller_actions.py; the structural solver proposed a shared prompt_rendering.py helper used by reviewer, rebase-resolve, review-fix, and remote-ci-fix paths; the delete solver also preferred the shared helper and deletion of duplicate private validators, and added that reviewer rendering should bind REVIEW_ROUND.

Option	Trade-off
Reviewer-local check	Smallest immediate patch, but leaves duplicated unresolved-placeholder validators in place.
Shared prompt-render helper	More files and call-site migration, but one validation rule owns prompt completeness across strict spawn paths.
Strict global render_template behavior	Strong invariant, but broader than the current issue and higher regression risk for templates that carry literal shell syntax.

The next solver round should pick exactly one implementation boundary, list exact scope_paths, define whether existing rebase-resolve/review-fix/remote-ci-fix validators are in scope, and state whether binding REVIEW_ROUND is required in addition to fail-closed validation.

📎 Full raw codex output (archival)

---
issue: 44
cluster: issue-44
convergence_round: 1
solver_verdicts:
  minimal: propose
  structural: propose
  delete: propose
decision: converge
action_mode: plan
canonical_key: ChronoAIProject/codex#44
next_action: plan
---

## Decision
三份 solver 都确认问题真实存在，并且都同意 reviewer prompt 必须在写入 `HARNESS_SPAWN_INTENT` 前 fail closed；但它们没有形成同一个 implementation-bearing framing。minimal 方案只在 reviewer dispatch 增加本地校验，structural 和 delete 方案则把未解析 placeholder 校验抽成共享 helper，并迁移已有 rebase-resolve、review-fix、remote-ci-fix 校验；delete 方案还明确要求绑定 `REVIEW_ROUND` 并覆盖正常渲染路径。因此本轮不能授权 implement，需要第二轮只回答这个命名分歧。

Reference-frame note: fail-fast validation at a trust-boundary handoff. Rendered prompts become worker-spawn inputs, so unresolved template variables should be rejected before queueing spawn work; the remaining design question is the smallest acceptable ownership boundary for that validation rule.

## If converge
- Convergence question (specific): Should issue #44 be implemented as a reviewer-local fully-rendered check, or as a shared prompt-rendering validation helper that also replaces the existing duplicate strict prompt checks; and is binding `REVIEW_ROUND` part of the required implementation?
- What each solver should address explicitly:
  - Pick exactly one implementation boundary: reviewer-only helper in `controller_actions.py`, or shared helper in `prompt_rendering.py` with named migrated call sites.
  - State whether existing rebase-resolve, review-fix, and remote-ci-fix validators are in scope for the same PR, or explicitly out of scope.
  - State whether reviewer render env must bind `REVIEW_ROUND`, in addition to failing closed when any `${...}` placeholder remains.
  - Give the exact allowed `scope_paths`, expected tests, and error-message contract including prompt path plus sorted placeholder names.
  - Keep `HARNESS_SPAWN_INTENT` after the validation boundary in every proposed reviewer path.
- Round number this fires: 2; marker payload uses source round `1`
- Progress since prior round: first round established source-explainable agreement that reviewer dispatch currently lacks a post-render unresolved-placeholder guard before spawn intent, and narrowed the remaining split to local versus shared validation plus `REVIEW_ROUND` binding scope.
- Human-intervention threshold: not reached

## Round audit trail (links to local artifacts)
- solver-minimal: .refactor-loop/logs/phase9-issue44-r1-minimal.log
- solver-structural: .refactor-loop/logs/phase9-issue44-r1-structural.log
- solver-delete: .refactor-loop/logs/phase9-issue44-r1-delete.log
- work-unit-producer: manual-issue (prompt-only provenance)
- work-unit-source-ref: gh-issue-44
- action_mode: plan
- canonical_key: ChronoAIProject/codex#44
- duplicate_search_summary: router-scoped review only; issue source snapshot and the three listed solver logs were used, and sibling judge artifacts or unrelated issue artifacts were not searched by prompt boundary.
- branch: none
- PR: none
- commit: none
- unique_diff_status: not-applicable
- tests_verification: not run; this meta-judge arbitrates solver plans only and made no production source changes.
- resolution: converge
- next_action: plan

⟦AI:AUTO-LOOP⟧
META_JUDGE_DONE:converge:round-1:Choose reviewer-local validation vs shared prompt-render validation, and decide whether REVIEW_ROUND binding is in scope.

⟦AI:AUTO-LOOP⟧