The design pass is skipped whenever the builder judges the change small — and that judgement is the gate

[BaseInfinity]

The pattern

The two most expensive PRs of 2026-08-15 were both preceded by the builder judging the change small enough to skip the design pass. Both judgements were wrong, and in both cases the reviewers spent rounds finding what a design pass would have prevented.

PR #610 — 8 review rounds. Scores 3, 6, 4, 8, 8, 9/8, 9/9. Rounds 1–3 were spent modelling codex's option grammar in a regex, one correction at a time (an option's value read as the subcommand; compact short values; terminal -h/-V; variadic --image; per-wrapper arity). Round 4 deleted the grammar and the score jumped to 8 immediately. The design question — "should this predicate know the CLI's option grammar at all?" — was never asked before round 4. It was answerable on day one.

PR #614 — 2 rounds so far. Both priority rulings named #613 as next, and the builder went straight from "it's next" to writing code. Two defects followed:

1. The probe depended on timeout, which does not exist on stock macOS including this repo's own machine, justified by a code comment asserting "gh carries its own network timeouts." That claim was never verified. The reviewer checked the source (cli/cli api/http_client.go, go-gh pkg/api/client_options.go) and gh 2.92 sets no overall HTTP timeout. A stalled request would block before exec codex ran — codex exec hangs forever on stdin; every cross-model review leg needs < /dev/null #590 reintroduced by the fix for Review legs certify over a red build: make CI status a precondition, not more diff scrutiny #613.
2. The probe subshell inherited set -e, so a non-zero gh — exactly what a red build is — killed it before it wrote its status marker. Every red build would have burned the full deadline and reported "abandoned."

Neither is subtle. Both are the kind of thing a design pass surfaces as a question ("what enforces the deadline, and does it exist everywhere this runs?") rather than the kind a reviewer should be spending a round on.

Why the existing rungs do not catch it

The ladder is advisor/planner → builder → reviewer, and the planner rung is real — Fable ruled the #610 redesign and both models ruled the #613 priority. What is missing is that entry to the planner rung is at the builder's discretion, and the builder's own size estimate is the gate. "It's two lines" is not a measured property; it is the judgement of the party least positioned to make it, made before the work exists.

#593 Rung 1's stop condition measures the symptom — "no review round that changes zero behaviour" — but nothing measures the cause. A skipped design pass is invisible until the reviewer bills for it.

Proposal

A design pass is mandatory before any PR, with no size exemption. Concretely, the smallest form:

• The handoff's scope_decisions[0] (round 1, decision: "start") must record a design_ruling field: who ruled on the approach, and the one-sentence question they answered. Not "this is next" — the how, not the what.
• If no design pass happened, the field says so explicitly, so the omission is visible in the artifact the reviewer reads rather than inferable only from the round count afterwards.

That is one field in a file the gate already reads, and it modifies an existing surface rather than adding a guard — consistent with #593's standing "no new guard or tooling surface" ruling.

Deliberately not proposed: a hook or test that blocks on a missing design ruling. This repo's standing rule is that no test may cost more rounds than the change it guards, and #608 just closed for failing it. Visibility first; enforcement only if visibility proves insufficient.

Acceptance criteria

• The handoff contract requires a design-pass record at round 1, with an explicit "none" being a legal but visible value
• The review-leg prompt surfaces that field, so a reviewer can see whether the approach was ever ruled on
• Demonstrated on a real PR: the field is present and a reviewer references it

Honest uncertainty

This may be a discipline problem that no artifact fixes — the builder that skips the pass can also write "design ruled by: me". The counter-argument is that making the omission visible to the reviewer changes who gets to notice it, which is the same mechanism #613 uses for CI status: the fix was never more scrutiny, it was putting the fact where the reviewer already reads.

Worth ruling on before building. Which is the point.

Related

• Escalation ladder: fix the process, then Medium, then High, then Fable-driver + /doctor, and only then 4.6 #593 (the ladder and Rung 1's stop condition)
• Review legs certify over a red build: make CI status a precondition, not more diff scrutiny #613 / PR feat(review-leg): put the build in front of the reviewer (#613) #614 (the CI-status precedent — same "put the fact in front of the reviewer" shape)
• Review the uncommitted remainder, not the whole diff — commit each cleared fix so the review surface shrinks per round #521 (shrinking review surface per round — attacks the same round-count symptom from the other end)

[BaseInfinity]

Reframed, with a dual-model ruling — 2026-08-15

This issue said: the design pass is skipped whenever the builder judges the change small, and that judgement is the gate. It generalises. The same defect one layer over: the realign pass is skipped whenever the driver judges the round small, and that judgement is the gate. One issue, one mechanism, two insertion points — entry (before work) and loop (per recheck).

The evidence that reopened it

PR #646 (#563 + #636) ran nine rounds on two files. Rounds 6-8 reviewed a review_file path guard the driver volunteered mid-review, on a field disclosed as binding to nothing. Eleven findings; every round-8 finding was a false refusal. Deleted at round 9, both legs then certified with zero findings.

Five shipped prose rules in skills/sdlc/SKILL.md each independently end that, and none fired:

Line	Rule
:136	reviewers may return WRONG SHAPE (stop, redesign)
:152	no test costs more rounds than the change it guards
:163	blame the line — code nobody asked for, cut it, don't repair it
:273	second repair to one component means ask whether it should exist
:166	the reviewers are each other's tiebreaker; the driver never merges their words

All five target the DRIVER. In all five the driver was the party with momentum. :166 was broken during the conversation diagnosing this, minutes after the diagnosis, by the driver, while working on the fix — and was caught by the maintainer, not by the rule.

v1.98.0's convergence rule did not fire either, and its originating commit says why: "Not in scope, deliberately: enforcement. The rule is stated, not checked."

Diagnosis — the two legs split, then reconciled

Fable: the rule fired correctly by its own terms, because our scope cards are written as artifact-wide invariants ("a guard is asserted but not proven", "a round>=2 path gains a new requirement"), so any code added to the gate is in-card by construction.

Sol: the rule was already scope-bound ("out-of-scope findings are filed and authorize nothing") and the loop continued by misclassifying volunteered code as requested work.

Either way the destination is identical, and both returned FIX_IS_RIGHT: PARTIAL. Both independently ruled that "make scope_decisions logging unavoidable" is dead — round 6 logged two scope decisions and stopped nothing. Logging is disclosure; it bounds nothing about the response.

What ships

1. SHAPE: SOUND | CONCERN | WRONG_SHAPE required in every full-review and targeted-recheck verdict. :136's version lives only in the initial review; rounds 6-8 all lived in the recheck loop, whose prompt says "don't hunt new surfaces" and never re-asks the shape question.

2. Per-finding TARGET, defined by LINE PROVENANCE. This is the load-bearing sentence and it is quoted verbatim, deliberately:

   TARGET is assigned by LINE PROVENANCE, not by which rule the finding violates. A finding is VOLUNTEERED when the defective line traces to no requested behavior of the issues under review — it would not exist if those issues, and nothing else, had been implemented — even when the defect it causes violates an in-card invariant. A false refusal from a volunteered guard is a VOLUNTEERED finding, not an in-card one. VOLUNTEERED admits exactly two responses: DELETE (verified) or FILE. It cannot block certification and cannot authorize a repair pass; clause (a) counts only IN-CARD P0/P1s.

   The anchor is "the issues under review", never "the scope card" — invariant-shaped cards reclassify everything IN-CARD, which is the hole itself.

3. Amend clause (a) of the convergence rule to "an open IN-CARD P0/P1." Without this the rule "VOLUNTEERED cannot authorize a repair pass" is homeless. The launcher guarantees the tag EXISTS; the amended clause is what CONSUMES it.

4. An add-time check in the implementation checklist: before adding any guard, name the requested behavior or field it binds to; if none, do not add it. TARGET is reviewer-side and fires one round late — it saves rounds 7-8. Only this saves round 6.

5. Enforcement in the review-leg launcher, NOT the merge gate. --output-schema + --output-last-message (codex-cli 0.147.0 has both), persisting a closed JSON verdict alongside the transcript. The schema requires shape, requires target on every finding, and rejects VOLUNTEERED + REPAIR.

6. Four behavioral rows — valid output, missing shape, missing target, volunteered repair. No prose grep, no provenance validator, no merge-gate field, no semantic test.

The enforcement split, and how it reconciled

Fable capped it at prose-only: "the merge-gate contract just ate 8 rounds; do not feed it another required field." Sol held: "a prompt-only required field is still prose with a colon."

Fable conceded, and named where its line actually was: the veto was surface-specific. A false refusal in the merge gate trains --user-approved overrides and erodes the gate; a false refusal in the launcher costs one relaunch. Different failure asymmetry, so the cap moves.

Sol conceded line provenance and accepted that the launcher may validate presence and enum membership only — never whether a tag is correct. A semantic validator is a reviewer, and that rebuilds the thing that ate eight rounds. On why this is not #588 again: "#588's siege came from an open-ended regex trying to understand prose; validating a closed JSON schema cannot chase synonyms or interpretations."

Fable also killed its own "no test rows" cap along with the prose cap: "an asserted-untested validator is the next M9 waiting to happen."

Open question this raises — see #594

The enforcement lands in scripts/run-review-leg.sh. Per CLAUDE.md, scripts/ is repo-local and deliberately does not ship. Consumers would receive the prose and not the schema check — the exact failure mode being fixed, shipped to everyone. #594 ("Ship the review-leg launcher to consumers") is the dependency. Neither leg raised this; it is being put to both.

Related: #644 (why prose rules do not fire — the general audit, post-2.0), #609 (P3s in the termination rule's prose, same paragraph as the clause-(a) amendment), #616 (bound verdict metadata — the structured verdict lands here), #594 (ship the launcher), #645, #623.