# Matt Pocock two-axis code/spec review — Fusion PPC orchestration Lane 4 of the Fusion PPC system audit. Read-only. Produced 2026-08-30 on `lifeos-devbox`. Skill invoked: `code-review` (`/home/matt/.agents/skills/code-review/SKILL.md`), method followed in full — fixed point pinned, spec and standards sources identified, both axes run as parallel sub-agents with no shared context, aggregated here without reranking across axes. **The two axes are deliberately not merged.** A change can pass one and fail the other. Findings are ranked within each axis only. --- ## Fixed-point receipts ### The fixed point named by the mission does not resolve on the branch under review This is itself a finding, recorded on the Spec axis as ORCH-CORR-1. It is stated here first because every diff statistic downstream depends on it. | Check | Command | Result | | --- | --- | --- | | Fixed point resolves | `git rev-parse 638e7524` | `638e752430a7fbce735e46b9381f04e7b40356f8` — resolves | | Is it an ancestor of the reviewed branch? | `git merge-base --is-ancestor 638e7524 round-13-takeover` | **NO** | | Which branches contain it? | `git branch -a --contains 638e7524` | `origin/codex/fusion-ppc-architecture-orchestrator` only | | Merge-base of the two lines | `git merge-base 638e7524 round-13-takeover` | `08f52cd docs(r18): record hidden review strip` | | Commits reachable from `638e7524` but not from the branch | `git rev-list --count round-13-takeover..638e7524` | 18 | Consequence: `git diff 638e7524..round-13-takeover` (131 files, 5,703 insertions, **70,003 deletions**) is **cross-branch divergence, not a review range**. Independently confirmed, twice: ``` $ git log --oneline --diff-filter=D ce93cef..round-13-takeover -- ads-control/ \ deliverables/fusion-meta-ads-review-2026-08-24/ outputs/loop-runs/2026-08-28-fusiontables-report/ (no output — no commit in the range deletes anything) $ git log --oneline round-13-takeover -- ads-control/ (no output — 0 commits: ads-control/ never existed on this line of history) ``` Those ~70,000 "deletions" are 41 files that live only on the orchestrator branch. **No work was deleted.** Any review reporting them as deletions is wrong. ### Ranges actually reviewed | Range | Purpose | Commits | Diff stat | | --- | --- | --- | --- | | `ce93cef..round-13-takeover` | **Primary.** The integrated orchestration work on the reviewed line | 7 | 59 files, 4,010 insertions, 20 deletions | | `975e6c3...codex/fusion-ppc-t1-evidence` | The one child branch with real work, against the base SHA in its own `run-state.md:20` | 1 child commit (`74f7aef`) | 52 files, 2,747 insertions | | `08f52cd...round-13-takeover` | Three-dot, for context only | 12 | 90 files, 5,917 insertions, 34 deletions | Primary range commits (`git log --format='%h %s' ce93cef..round-13-takeover`): ``` 8351b59 orchestrator: release T2 from accepted T1 63b6e05 orchestrator: accept T1 and prepare T2 release 4459dfe docs: build Fusion PPC evidence corpus 087c0af orchestrator: register eight PPC child tasks a9a2458 orchestrator: normalize PPC control files 828e118 orchestrator: freeze all PPC child tasks a81322d orchestrator: freeze and prepare PPC T1 ``` Note: the brief named 13 commits and the orchestrator correction named 8. The measured linear count after the freeze commit is **7**; including `ce93cef` (the freeze itself) makes 8. The 13 figure comes from the invalid cross-branch range and includes five pre-mission commits. ### Three commits share one subject line | SHA | Parent | Line | Cited by | | --- | --- | --- | --- | | `638e752430a7fbce735e46b9381f04e7b40356f8` | `310758d` | `origin/codex/fusion-ppc-architecture-orchestrator` | the mission handoff, as the fixed point | | `ce93cef7a8f9ac1d372e232a88e7009a73bc5584` | `f427516` | `round-13-takeover` (reviewed) | — | | `975e6c3341cea71039a6d745d4d389cc42fcc54c` | `7619997` | the eight `codex/fusion-ppc-*` branches | `children/t1-evidence-corpus/run-state.md:20` | All three read `plan: freeze Fusion PPC architecture delegation`, no body, no trailer. The frozen goal blob is byte-identical across them (blob `2421c9e`, sha256 `547b20a3f969f6815afec9ebe52f90383b9908fbcda6f41558df95117e9a5f2f`). ### Child branches: verified, not assumed `git rev-list --count 638e7524..` and `git diff --stat round-13-takeover..`: | Branch | Ahead | HEAD | Child artifacts | | --- | --- | --- | --- | | `codex/fusion-ppc-t1-evidence` | 7 | `74f7aef docs: build Fusion PPC evidence corpus` | **YES** — 716 lines, accepted | | `codex/fusion-ppc-t2-audit` | 12 | `a286b77 orchestrator: release T2 from accepted T1` | NO | | `codex/fusion-ppc-t3-dashboard` | 8 | `9f92003 orchestrator: normalize PPC control files` | NO | | `codex/fusion-ppc-t4a-strategy` | 8 | `9f92003` | NO | | `codex/fusion-ppc-t4b-strategy` | 8 | `9f92003` | NO | | `codex/fusion-ppc-t5-report` | 8 | `9f92003` | NO | | `codex/fusion-ppc-t6-review` | 8 | `9f92003` | NO | | `codex/fusion-ppc-t7-targeting` | 8 | `9f92003` | NO | For T2 through T7, `git diff round-13-takeover..` is **purely subtractive** (52 insertions, 1,659 deletions, all inside the orchestration control tree) — they are behind the reviewed branch on control files and carry nothing of their own. Empty diffs were recorded, not reviewed. ### Files reviewed as code - `outputs/loop-runs/20260830-fusion-ppc-architecture-orchestration/launch_child.py` (291 lines) — the real program in this diff, reviewed line by line. - `deliverables/zsuzsanna-hentz-proposal-2026-08-28/render_and_qa.py` (118), `validate.py` (99) — secondary, present in the three-dot range only. - All 61 files of the orchestration tree (49 control, 12 artifact) inventoried. ### Repo-mandated checks, run `AGENTS.md:46` requires both. Results: ``` $ git diff --check ce93cef^ round-13-takeover outputs/loop-runs/20260830-fusion-ppc-architecture-orchestration/goal-v1.md:177: new blank line at EOF. exit=2 $ python3 scripts/validate_project_operations.py FAIL: OUTSTANDING mirrors differ exit=1 ``` The validator failure is **documented as expected** at `AGENTS.md:58-61` and is not charged as a new defect. The `git diff --check` failure is charged (Standards H1), attributable to `ce93cef`. ### Skill-contract incompatibility, recorded not worked around `code-review/SKILL.md` step 2 routes issue references through `docs/agents/issue-tracker.md` and says to run `/setup-matt-pocock-skills` if it is missing. **That file does not exist in this repo.** No setup was run, nothing was created, and no tracker configuration, `AGENTS.md` or `CLAUDE.md` was mutated. The skill's own step 2 fallback path 2 ("a path the user passed as an argument") applied: the spec was supplied by path, so the tracker was never needed. Both sub-agents ran normally. Two deliberate deviations from the skill text, both recorded: sub-agent word caps were raised from 400 to 700 to carry `path:line` citations, and the Spec agent was additionally briefed with Matt's verbatim requirements as a spec source. --- ## Standards *Does the code follow this repo's documented rules? Spec sources: `AGENTS.md`, `CLAUDE.md`, `docs/operations/README.md`, `PROJECT_STATE.md`, plus the skill's Fowler smell baseline. Documented repo standards override the baseline. Baseline smells are always judgement calls.* ### Hard violations **H1 — `git diff --check` fails on the reviewed range.** `AGENTS.md:46-47`: *"Run `python3 scripts/validate_project_operations.py` and `git diff --check` for operations-doc or state changes."* `outputs/loop-runs/20260830-fusion-ppc-architecture-orchestration/goal-v1.md:177: new blank line at EOF`. Introduced by `ce93cef`, the freeze commit itself. The checked-in artifact of a checksum-frozen contract does not pass the repo's own mandated whitespace gate. **H2 — no CHANGELOG entry for any of the orchestration work.** `AGENTS.md:4`: *"`CHANGELOG.md` is the chronological record."* All 7 commits of `ce93cef..round-13-takeover` (4,010 insertions across 59 files) leave `CHANGELOG.md:6` as the newest entry, dated 2026-08-28, describing unrelated proposal work. Independently confirmed: `git log --format='%h %s' ce93cef..round-13-takeover -- PROJECT_STATE.md CHANGELOG.md` returns **empty**. **H3 — `PROJECT_STATE.md` states something the same branch contradicts.** `docs/operations/state-and-evidence.md:7` puts *"Current `bundle_state.json`, `PROJECT_STATE.md`, and the three synchronized OUTSTANDING files"* at authority rank 3. `PROJECT_STATE.md:63-65` still reads *".claude/OUTSTANDING and .codex/OUTSTANDING are empty"*, but `3a80629` wrote 372 bytes into both, and the third mirror (`plans/cf-staging-round-12-full-site-polish/.codex/OUTSTANDING`) is 982 bytes — so the three are not synchronized. `PROJECT_STATE.md:3` reads `Last updated: 2026-08-28` while branch-tip work is dated 2026-08-30. *Attribution note: the sentinel refill predates the primary range (`3a80629`, `754be8f`). The orchestration run's fault is that it added 4,010 lines on top without correcting the state file it is required to read first.* **H4 — a checked-in state file pins a SHA unreachable from its own declared base branch.** `AGENTS.md:40`: *"Prefer authenticated readback and checked-in evidence over inference."* `children/t1-evidence-corpus/run-state.md:19-20` declares `Base branch: round-13-takeover` and `Parent-accepted base commit SHA: 975e6c3341cea71039a6d745d4d389cc42fcc54c`. `git branch -a --contains 975e6c3` lists only the eight `codex/fusion-ppc-*` branches, never `round-13-takeover`, whose corresponding commit is `ce93cef`. The file asserts a readback that does not hold. ### Judgement calls **J1 — Mysterious Name (commit subjects).** Three commits, byte-identical single-line subject, no body, no trailer, three different parents (`310758d`, `f427516`, `7619997`). `git log --oneline` cannot tell them apart. H4 is exactly the confusion this invites. **J2 — Duplicated Code: `launch_child.py` forks the platform launcher.** `launch_child.py:41-51` is a near-verbatim port of `/home/matt/ops/run-in-cloud.sh:263-269`. The `state_5.sqlite` reads, `~/ops/prompts/$SLUG.run.sh`, `tmux new-session` and `codex-app-sync.py decorate --pin true` all mirror `run-in-cloud.sh:226/394/439/500`. The whole file is `run-in-cloud.sh` minus the Slack post. Extract the shared launcher rather than fork it. `AGENTS.md:42-43` bans copying skill implementations into the repo but names only three skills, so this is a judgement call, not a breach. **J3 — Data Clumps / Primitive Obsession.** `slug, codename, workdir, prompt, title, model, effort, waiting_for` travel together through `main`, `runner_text`, `status_meta` and the session dict (`launch_child.py:149,191-205,217,222`). `effort` is a bare `str` checked against a set literal (`:22`, `:152`) where an `Enum` belongs. **J4 — Divergent Change.** `main()` (`launch_child.py:133-287`, 155 lines) handles arg validation, daemon bootstrap, config trust, git query, status side effects, tmux launch, DB write, readback and receipt printing. It changes for every one of those reasons. **J5 — Inconsistent sibling conventions.** `validate.py:95-99` wraps failures into `FAIL:` + exit 1. `render_and_qa.py:117-118` has no such handler, so the same class of failure surfaces as a raw traceback. ### `launch_child.py` code notes Reviewed as a program, not as a document. 1. **`:85-91`, `:247-251` — `with sqlite3.connect(...)` is a transaction manager, not a closer.** The connection is never closed. `capture_thread` can leak up to 60 connections in its poll loop. 2. **`:176-178`, `:277` — stale `daemon` payload.** If `version` reports not-running, `bootstrap` runs but `daemon` is never re-read, so the printed `"host": daemon.get("socketPath")` reports the pre-bootstrap value, likely `None`. The receipt can lie about the host. 3. **`:220-257` — the failure path is not atomic.** The handler kills tmux and sets `blocked`, but `trust()` (`:182`), the session JSON (`:206`), three `status` calls (`:207-213`), the 0700 runner script (`:215-218`) and possibly `UPDATE threads SET is_pinned = 1` (`:248`) are already committed. Re-runs start dirty, and the `~/.codex/config.toml` trust grant is never revoked. 4. **`:41-53` — regex TOML editing.** `text.lstrip()` (`:53`) rewrites leading whitespace of the whole user config, not just the edited section. A workdir containing `]` or a newline defeats the `(?ms)` header pattern. 5. **`:248` — raw `UPDATE` against another application's private database.** The `# ponytail:` note at `:245` excuses the *pin fallback*, not writing SQL into Codex internals. `state_5.sqlite` is hardcoded twice (`:82`, `:246`). 6. **Hardcoded to one run despite nine CLI flags.** `:201` `parent_task_id` is a literal UUID. `:154-156` requires the title to start `"[Fus] ↺"` and end `"[parent: PPC measurement delegation orchestrator]"`. `:106-117` hardcodes the four-step contract. Speculative Generality in the flags, single-use in the body. 7. **`:187` — `run_id` is write-only.** Stored in the session JSON, never read, never printed. 8. **Runnable check exists and passes** — `--self-check` returns `PASS`, exit 0. Credit where due. But `:127` `assert EFFORTS == {...}` is a tautology, all checks are bare `assert` (void under `python -O`), and nothing covers `trust`, `capture_thread`, or the `main` validation branches. 9. **`:63-64` hardcodes `--dangerously-bypass-approvals-and-sandbox` and `--dangerously-bypass-hook-trust`** for every child, with no opt-out flag. Not itself a breach of `AGENTS.md:21-22`, but worth an explicit note given the repo's read-only safety boundary. 10. **Secondary — `render_and_qa.py:38-40`** collects console and page errors and `:105` records them into the receipt, but **no assertion ever fails on them**. The browser gate cannot catch a console error. **Standards axis: 19 findings — 4 hard, 5 judgement calls, 10 code notes.** Worst within this axis: **H2** — 4,010 lines across 59 files landed with no CHANGELOG entry and no `PROJECT_STATE.md` update, in a repo whose first documented rule is that the changelog is the chronological record. A later agent reading state files cannot discover that this run happened. --- ## Spec *Missing or partial requirements, scope creep, and apparently-implemented-but-wrong behaviour. Spec sources: `handoffs/2026-08-30-fusion-ppc-system-audit.md`, the frozen `outputs/loop-runs/20260830-fusion-ppc-architecture-orchestration/goal-v1.md`, the eight child `goal-v1.md` files, and Matt's verbatim quotes.* ### Missing or partial **SPEC-1 — Matt's three named deliverables were architected behind an eight-stage serial chain, and none exist.** Spec: *"the next agent must create / - the suggested next tasks / - and the 2 possible PPC strategies for the one landing page only vs. the full product suite / - and the reports and the dashboard"*. `goal-v1.md:44-51` puts the dashboard (T3) third in the chain, the strategies fourth, the report fifth, the next-tasks last. The run stopped after stage 1, so **all three of Matt's named outputs are `UNAVAILABLE — never produced`**. The one thing that was built, the T1 evidence corpus, is not on Matt's list at all. *The defect is the serial gate, not the stopped run.* An 80/20 architecture would have run T3/T4A/T4B first against the already-committed report package. One stall at stage 1 yields zero of three named deliverables. **SPEC-2 — the KPC table repurpose is only partly carried.** Spec: *"Just in the table, instead of keywords, we will see the different creatives we are using and the targeting options, etc."* This names a **replacement**. `children/t3-decision-dashboard/goal-v1.md:42` (T3-05) instead lists creative and targeting *alongside* "keyword or search term" as co-equal dimensions, and `children/t7-targeting-pack/goal-v1.md:48` still specifies keyword tables. The substitution instruction appears in none of the eight goals. Partial, not missing. **SPEC-3 — no control document records the stopped run.** `.claude/OUTSTANDING:1-4` and `.codex/OUTSTANDING:1-4` still describe an unrelated 30-day-report blocker and never mention that seven children never started. `CHANGELOG.md` and `PROJECT_STATE.md:3` (`Last updated: 2026-08-28`) are untouched by all 7 commits. This breaches the mission's own fresh-agent premise, *"give to a fresh agent with zero prior context"*: at HEAD, that agent cannot discover the run from any state file. ### Scope creep **SPEC-4 — T7 buys keyword volume data Matt never asked for.** `goal-v1.md:120-135` allocates DataForSEO spend and `$scrape-seo-volumes` keyword research, and `access-ledger.md:12` records a completed pricing preflight for it. Matt's deliverable list has no targeting or keyword-research item, and his dashboard instruction moves *away* from keywords (SPEC-2). Against *"dont overengineer"*, T7 is an added ninth workstream. **SPEC-5 — 83% of the delivered bytes are ceremony.** Measured on the corrected range: 59 files, 4,010 insertions. Control files (goal-v1, acceptance-ledger, access-ledger, run-state, launch-prompt per child, plus `child-registry.md`, `dependency-handoff-ledger.md` and `launch_child.py`) = **49 files, 3,500 lines**. Actual evidence artifacts = **12 files, 716 lines**, all of them T1's. Seven children carry complete five-file control packages, roughly 2,800 lines, for zero output. Spec: *"give me a more consice prompt. i need the 80/20. dont overengineer."* **Not scope creep, and this correction matters:** the Zsuzsanna proposal deliverable, `docs/runs/2026-08-28-fusion-otter.md`, `handoffs/2026-08-28-zsuzsanna-proposal-cloud.md` and `inputs/zsuzsanna-proposal/*` are **outside** the orchestration work. `git diff --name-only ce93cef round-13-takeover` returns only `20260830-fusion-ppc-architecture-orchestration/` paths. They entered earlier drafts of this review purely as an artifact of the bad fixed point. ### Implemented but wrong **SPEC-6 (ORCH-CORR-1) — the goal was frozen onto a branch that lacks the evidence base its children must read.** The freeze is genuine: blob `2421c9e` / sha256 `547b20a3…a5f2f` is byte-identical on both lines. But `round-13-takeover` has **no `ads-control/`** and **no `deliverables/fusion-meta-ads-review-2026-08-24/`** (`git log --oneline round-13-takeover -- ads-control/` returns 0 commits). `children/t7-targeting-pack/goal-v1.md:48` and the mission's authoritative-resource list (`handoffs/2026-08-30-fusion-ppc-system-audit.md:351-354`) point at exactly those trees. T1 already recorded the consequence honestly — `children/t1-evidence-corpus/artifacts/created-file-inventory.md:211` marks `kpc-stage3` `UNAVAILABLE`, *"absent from current tree and all reachable Git objects"*. So T2 through T7 were released onto a branch where the Google Ads and Meta creative evidence they are contracted to audit does not exist. **This is the freeze executed correctly on the wrong line of history** — and it means the chain would likely have stalled at T2 even if nothing else had gone wrong. **SPEC-7 (ORCH-CORR-2) — the T1→T2 PASS fails the ledger's own stated gate.** `dependency-handoff-ledger.md:3-4` sets the rule: *"Only a parent-accepted child commit integrated into `round-13-takeover` can release its downstream task."* Line 8 then marks T1→T2 **PASS**, citing integration commit `b1013882…`. `git branch --contains` places that commit only on `codex/fusion-ppc-t2-audit`. The same is true of `7d119a2…` ("T2 branch fast-forwarded to"), `975e6c3…` (T1's declared base) and `638e7524`. Lines 14-15 self-describe this as the prohibited state: *"PASS requires every cell in a transition row to cite an exact immutable receipt."* **The evidence itself is safe.** `4459dfe` carries the T1 corpus on `round-13-takeover`, and `git diff 4459dfe b1013882 -- .../artifacts/` is **empty** — identical trees, 716 lines intact. The defect is receipt integrity, not data loss. Every accepted-and-integrated claim rests on an off-branch SHA. **SPEC-8 (ORCH-CORR-3) — four documents claim a T2 state the filesystem denies.** `run-state.md:25` *"T2 is active from release `01a05297…`"*; `child-registry.md:9` *"`ACTIVE`"*; `dependency-handoff-ledger.md:8` *"T2 acknowledged and began receipt verification"* — versus `children/t2-measurement-audit/run-state.md:3` `WAITING_DEPENDENCY`, `:24` `Runtime goal ID: PENDING`, `:33` `Started: PENDING`, `:34` *"awaiting explicit release queue"*. Commit `8351b59` flipped the ledger row VERIFY→PASS **without touching T2's run-state**. Parent `run-state.md:3` `Status: ACTIVE` with no session running compounds it, against `goal-v1.md:176`: *"Do not call the architecture goal complete until the originating parent sends explicit acceptance."* `child-registry.md:17` also claims *"Each exact worktree was live in tmux"* — `tmux ls` now shows zero `fusion-ppc` sessions. **SPEC-9 — T1 acceptance was earned on content, with one soft spot.** Stated plainly because it is the one thing that went right. The artifacts are real: `artifacts/evidence-matrix.md:25-27` marks qualified leads, purchases, revenue, GA4 and GSC `UNAVAILABLE`, *"Never represent as zero"*; `:10` and `:13` explicitly refuse channel attribution, honouring *"Do not claim Google Ads attribution until the conversion increment is visible."* `artifacts/created-file-inventory.md:13-40` carries real Git blob IDs and byte counts. No live mutation is claimed anywhere, and spend is USD 0. The soft spot: all 153 `T1-F-*` rows in `children/t1-evidence-corpus/acceptance-ledger.md` share one boilerplate requirement string and one evidence cell pointing at the same file — a per-row PASS with no per-row evidence (see the Ponytail audit, P1). And `children/t1-evidence-corpus/artifacts/corpus-index.md:3` still reads `READY_FOR_PARENT_ACCEPTANCE` after `run-state.md:3` became `PARENT_ACCEPTED`. **No constraint breach found in PPC scope.** No live Ads, Meta, GA4, GTM, CAPI, CRM, WordPress or production mutation is claimed or evidenced. `artifacts/return-receipt.md:57,70` records zero live mutation and USD 0 spend. **Spec axis: 9 findings — 3 missing/partial, 2 scope creep, 4 implemented-but-wrong.** Worst within this axis: **SPEC-6** — the entire eight-child architecture was frozen onto a branch that does not contain the PPC evidence its children are contracted to read. Every downstream task inherits a base that cannot satisfy its goal. --- ## Cross-axis note Per the skill, the axes are not merged and no single winner is picked across them. Both axes independently converge on one structural fact worth stating without ranking it: **the system's bookkeeping is more trusted than its filesystem.** Standards H4 and Spec SPEC-7 and SPEC-8 are the same failure seen from two directions — control documents assert states and SHAs that a `git branch --contains` or a `tmux ls` refutes in one command. The accepted T1 corpus is genuine, self-honest about what is `UNAVAILABLE`, and fully intact on the reviewed branch. Preserve it. The apparatus around it is what these findings are about.