@fro.bot/systematic 3.13.3 → 3.13.5

package/dist/cli.js

@@ -2116,6 +2116,11 @@ var CoverageSchema = exports_external.object({
   validator_failures: exports_external.array(ReasonSchema).max(MAX_PERSONAS),
   intent_uncertainty: exports_external.array(ReasonSchema).max(MAX_PERSONAS)
 }).strict();
+var DeclinedMergeSchema = exports_external.object({
+  file: RepoRelativePathSchema,
+  input_finding_ids: exports_external.array(boundedText(MAX_INPUT_ID_LENGTH)).min(2).max(MAX_FINDINGS),
+  reason: ReasonSchema
+}).strict();
 var ReviewArtifactSchema = exports_external.object({
   schema_version: exports_external.literal(1),
   run_id: boundedText(MAX_RUN_ID_LENGTH),
@@ -2134,6 +2139,7 @@ var ReviewArtifactSchema = exports_external.object({
   dispatches: exports_external.array(DispatchSchema).max(MAX_PERSONAS),
   input_findings: exports_external.array(InputFindingSchema).max(MAX_FINDINGS * MAX_PERSONAS),
   findings: exports_external.array(SynthesizedFindingSchema).max(MAX_FINDINGS),
+  declined_merges: exports_external.array(DeclinedMergeSchema).max(MAX_FINDINGS).optional(),
   disposition_counts: DispositionCountsSchema,
   applied_fixes: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
   residual_actionable_work: exports_external.array(ReasonSchema).max(MAX_FINDINGS),

package/dist/lib/review-artifact-schema.d.ts

@@ -218,6 +218,11 @@ export declare const ReviewArtifactSchema: z.ZodObject<{
             agreement_credit: string[];
         };
     }>>>;
+    declined_merges: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        file: z.ZodString;
+        input_finding_ids: z.ZodArray<z.ZodString>;
+        reason: z.ZodString;
+    }, z.core.$strict>>>;
     disposition_counts: z.ZodObject<{
         surviving: z.ZodNumber;
         merged: z.ZodNumber;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fro.bot/systematic",
-  "version": "3.13.3",
+  "version": "3.13.5",
   "description": "Compound-engineering loops for OpenCode, Pi, and Claude Code",
   "type": "module",
   "homepage": "https://fro.bot/systematic",

package/skills/ce-plan/SKILL.md

@@ -443,6 +443,8 @@ For each unit, include:
 
 Every feature-bearing unit should include the test file path in `**Files:**`.
 
+When a unit creates a file in a directory that carries registration obligations — a manifest, index, codemap, module table, or generated artifact that must list it — name those surfaces in the same unit's `**Files:**`, and name the regeneration command in its `**Verification**`. Phase 1.1 already collects this from the repository's own contributor guidance; carry it into the unit rather than leaving it for a failing gate to report. An obligation that no gate enforces is the one most likely to be missed, so state it even when nothing will fail.
+
 Use `Execution note` sparingly. Good uses include:
 - `Execution note: Start with a failing integration test for the request/response contract.`
 - `Execution note: Add characterization coverage before modifying this legacy parser.`

package/skills/ce-review/SKILL.md

@@ -468,8 +468,10 @@ Before applying the confidence gate, keep the parent-owned ledger through every
    - **Dispatch outcome:** Record the parent-owned dispatch outcomes and ledger dispositions according to the [synthesis artifact contract](./references/synthesis-artifact-contract.md); keep dispatch outcomes separate from finding dispositions.
    - **Rejection policy: degrade, do not fail the whole review.** Continue merging conforming returns when a persona or finding is rejected; record the rejection and apply the risk-aware verdict according to the [synthesis artifact contract](./references/synthesis-artifact-contract.md). If every persona fails or times out, use the existing degraded-review behavior.
 2. **Confidence gate.** Suppress findings below 0.60 confidence. Exception: P0 findings at 0.50+ confidence survive the gate -- critical-but-uncertain issues must not be silently dropped. Record the suppressed finding's original confidence and an explicit reason in the input ledger. A retained P0 at 0.50+ is recorded as `surviving` unless it later participates in a deduplication merge. This matches the persona instructions and the schema's confidence thresholds.
-3. **Deduplicate.** Compute fingerprint: `normalize(file) + line_bucket(line, +/-3) + normalize(title)`. When fingerprints match, merge: keep highest severity, keep highest confidence, preserve the exact fingerprint, and retain the input IDs that produced the merged entry. A singleton that passes the gate is `surviving`; each input in a multi-input merge is provisionally `merged`.
-4. **Cross-reviewer agreement.** When 2+ independent reviewers flag the same issue (same fingerprint), boost the merged confidence by 0.10 (capped at 1.0). Cross-reviewer agreement is strong signal -- independent reviewers converging on the same issue is more reliable than any single reviewer's confidence. Preserve the distinction in the merged finding's artifact provenance according to the [synthesis artifact contract](./references/synthesis-artifact-contract.md).
+3. **Deduplicate.** Group all gated findings by `normalize(file)`. A file with two or more findings from different personas forms a candidate group. Do not use line number to form groups. Sort findings within each group by line. Adjudicate each candidate group: merge findings judged to describe the same underlying defect; keep genuinely different defects separate. Adjacency creates a candidate, not a conclusion -- findings on the same line that describe different defects must not merge. For each resulting finding, derive the fingerprint from its file and line as `normalize(file) + "|" + line`. Keep highest severity, keep highest confidence, and retain the input IDs that produced the merged entry. Record each declined merge in the artifact's optional `declined_merges` field with the normalized file, input finding IDs considered but not merged, and a brief reason. A singleton that passes the gate is `surviving`; each input in a multi-input merge is provisionally `merged`.
+
+   Worked example: at `src/lib/model-availability.ts:139`, reliability's `Config hook awaits providers API without a timeout` and adversarial's `Config startup can hang forever behind a stalled /config` describe the same underlying defect in different words, so they merge.
+4. **Cross-reviewer agreement.** When an adjudicated merge contains findings from 2+ independent reviewers, boost the merged confidence by 0.10 (capped at 1.0). Cross-reviewer agreement is strong signal -- independent reviewers converging on the same issue is more reliable than any single reviewer's confidence. Preserve the distinction in the merged finding's artifact provenance according to the [synthesis artifact contract](./references/synthesis-artifact-contract.md).
 5. **Separate pre-existing.** Pull out findings with `pre_existing: true` into a separate list.
 6. **Resolve disagreements.** When reviewers flag the same code region but disagree on severity, autofix_class, or owner, annotate the Reviewer column with the disagreement (e.g., "security (P0), correctness (P1) -- kept P0"). This transparency helps the user understand why a finding was routed the way it was.
 7. **Normalize routing.** For each merged finding, set the final `autofix_class`, `owner`, and `requires_verification`. If reviewers disagree, keep the most conservative route. Synthesis may narrow a finding from `safe_auto` to `gated_auto` or `manual`, but must not widen it without new evidence.
@@ -596,7 +598,7 @@ Review complete
 
 **Detail enrichment (headless only):** The headless envelope includes `Why:`, `Evidence:`, and `Suggested fix:` lines. After merge (Stage 5), use the validated full persona returns retained in parent memory for only the findings that survived dedup and confidence gating.
    - **Field tiers:** `Why:` and `Evidence:` are detail-tier and are already present in the validated inline return. `Suggested fix:` is also available directly from that return and survives merge as optional fix context.
-   - **In-memory matching:** For each surviving finding, look up its detail-tier fields in the validated returns of the contributing reviewers. Match on `file + line_bucket(line, +/-3)` (the same tolerance used in Stage 5 dedup). When multiple entries fall within the line bucket, apply `normalize(title)` to the merged finding's title and each candidate entry's title as a tie-breaker.
+   - **In-memory matching:** For each surviving finding, look up its detail-tier fields in the validated returns of the contributing reviewers. Use the merged finding's `input_finding_ids` (`<reviewer>#<1-based finding index>`) to identify the contributing return and source finding. When an input ID cannot be resolved or multiple candidates remain, match on normalized `file`, then use line and `normalize(title)` only as tie-breakers.
    - **Reviewer order:** Try contributing reviewers in the order they appear in the merged finding's reviewer list; use the first validated match.
    - **No-match fallback:** If no validated in-memory return contains a match, omit the `Why:` and `Evidence:` lines for that finding and note the gap in Coverage. This should indicate a synthesis/matching gap, not a failed artifact-file write. Never re-read per-agent files to recover detail.
 

package/skills/ce-review/references/review-summary-schema.json

@@ -374,6 +374,49 @@
         "additionalProperties": false
       }
     },
+    "declined_merges": {
+      "maxItems": 32,
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "file": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "allOf": [
+              {
+                "type": "string",
+                "pattern": "\\S"
+              },
+              {
+                "type": "string",
+                "pattern": "^(?!\\/)(?![A-Za-z]:[\\\\/])(?!\\\\).+"
+              }
+            ]
+          },
+          "input_finding_ids": {
+            "minItems": 2,
+            "maxItems": 32,
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128,
+              "pattern": "\\S"
+            }
+          },
+          "reason": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048,
+            "pattern": "\\S"
+          }
+        },
+        "required": ["file", "input_finding_ids", "reason"],
+        "additionalProperties": false
+      }
+    },
     "disposition_counts": {
       "type": "object",
       "properties": {

package/skills/ce-review/references/synthesis-artifact-contract.md

@@ -78,12 +78,19 @@ The artifact must preserve these distinctions:
       "title": "<merged finding>",
       "input_finding_ids": ["correctness#2", "testing#1"],
       "provenance": {
-        "fingerprint": "<normalize(file) + line_bucket(line, +/-3) + normalize(title)>",
+        "fingerprint": "<normalize(file) + \"|\" + line>",
         "submitters": ["correctness", "testing"],
         "agreement_credit": []
       }
     }
   ],
+  "declined_merges": [
+    {
+      "file": "src/example.ts",
+      "input_finding_ids": ["correctness#3", "testing#2"],
+      "reason": "The findings concern separate validation paths."
+    }
+  ],
   "disposition_counts": {
     "surviving": 0,
     "merged": 2,
@@ -119,12 +126,24 @@ The artifact must preserve these distinctions:
   finding has zero ledger entries, not a fabricated finding. Never include the
   offending value in a rejection reason.
 - Synthesized and filtered findings retain their original fields plus
-  `input_finding_ids` and provenance. Provenance contains the exact dedup
-  fingerprint `normalize(file) + line_bucket(line, +/-3) + normalize(title)`,
-  `submitters`, and `agreement_credit` arrays.
-- `submitters` contains only personas with an input finding in the merged
-  fingerprint group. `agreement_credit` contains only personas credited by the
-  cross-reviewer agreement boost without an input finding in that group. A
+  `input_finding_ids` and provenance. Provenance contains the fingerprint
+  `normalize(file) + "|" + line`, derived from the merged finding's file and
+  line, plus `submitters` and `agreement_credit` arrays.
+- `declined_merges` is optional. For each candidate group that is not merged,
+  record the normalized file, the input finding IDs considered and not merged,
+  and a brief reason. Candidate groups contain two or more findings from
+  different personas on the same normalized file; sort their findings by line.
+  Adjacency creates a candidate, not a conclusion: genuinely different
+  defects on the same line remain separate.
+- A candidate group may resolve partially. When some findings in a group merge
+  and others stay separate, record one entry per declined separation, listing
+  the input finding IDs on both sides of it. A group of three where two merge
+  and one stays separate records a single entry naming all three IDs, with a
+  reason describing why the third is a different defect. Record the separation,
+  not the merge; a fully merged group produces no entry.
+- `submitters` contains only personas with an input finding in the adjudicated
+  merge. `agreement_credit` contains only personas credited by the
+  cross-reviewer agreement boost without an input finding in that merge. A
   persona returning zero findings never appears in `submitters`; do not infer
   submission from the report's Reviewer column.
 - A `filtered` finding remains available for human review with the validator's