Why
plugin-cs2 v0.1.2 ships a strict-by-default review gate whose per-pass leniency is an explicit --allow-deferrals flag in domain.json (fail-closed polarity, plus a drift-guard test). But the only unforgeable answer to "is this the harness-run terminal invocation?" is the harness saying so: img2 doctor validates command form only and cannot require or forbid a flag, so a future plugin's gates.json could carry a leniency flag and every tool reports green.
Proposed
gate_runner.run_gates already constructs the child env at a single chokepoint (img2_core/gate_runner.py:94, where IMG2_HOME is injected). Add IMG2_GATE_PHASE=terminal there. Contract addendum: a gate tool that supports lenient modes MUST treat IMG2_GATE_PHASE=terminal as overriding any leniency flag.
This is defense-in-depth layer 3 — it complements, never replaces, tool-side strict defaults: shipping it alone would reintroduce fail-open for agent-run per-pass invocations (no harness env there). Residual even with it: a hand-run tool can still write a lenient report to a shared --out path, which is why plugin reports carry a mode stamp.
Origin
Two-adversary OpenSpec review of plugin-cs2 phase-aware-cs2-review (design.md D9; contradiction C1 in the debate record).
Why
plugin-cs2 v0.1.2 ships a strict-by-default review gate whose per-pass leniency is an explicit
--allow-deferralsflag indomain.json(fail-closed polarity, plus a drift-guard test). But the only unforgeable answer to "is this the harness-run terminal invocation?" is the harness saying so:img2 doctorvalidates command form only and cannot require or forbid a flag, so a future plugin'sgates.jsoncould carry a leniency flag and every tool reports green.Proposed
gate_runner.run_gatesalready constructs the child env at a single chokepoint (img2_core/gate_runner.py:94, where IMG2_HOME is injected). AddIMG2_GATE_PHASE=terminalthere. Contract addendum: a gate tool that supports lenient modes MUST treatIMG2_GATE_PHASE=terminalas overriding any leniency flag.This is defense-in-depth layer 3 — it complements, never replaces, tool-side strict defaults: shipping it alone would reintroduce fail-open for agent-run per-pass invocations (no harness env there). Residual even with it: a hand-run tool can still write a lenient report to a shared --out path, which is why plugin reports carry a
modestamp.Origin
Two-adversary OpenSpec review of plugin-cs2
phase-aware-cs2-review(design.md D9; contradiction C1 in the debate record).