Experiment: bind HTTP knowledge candidate arm

[Wenjie Fan (gggdttt)]

Current status: v2 preparation only

Prepare the new, unrun v2 candidate arm of the HTTP knowledge A/B, dependent on #911. This ordinary dependent draft PR continues to target gggdttt-http-knowledge-ab-gate; it is not a native stack registration. Do not merge as a product change. No auto-merge is enabled.

V2 is a revised seven-entry experiment, not a retry or continuation of the earlier paid authorization. A new explicit user approval through ask_user is required before any v2 reviewer generation, gold-judge call or evaluation dispatch. V2 has no evaluation results.

Immutable v1 history retained

V1 used Bench A 32a4c2190f996ef68e696716fed201e0d005cebd and prepared B 385cf73a9aa217692a43af4ec6c4997967efd668. Baseline smoke 36839547719 stopped with 6/8 complete observations and two partial original root reports caused by consumer-contract rejections, as recorded in #911. The v1 candidate was not dispatched. Its run, inputs, artifacts, hashes and STOP receipt remain immutable historical evidence; they are not reused or pooled into v2 results.

The original v1 candidate-preparation protocol and receipt are retained unchanged. V2 receives a separate preparation protocol and receipt. The earlier preparatory Bench refs b67844aea3834ecc4e63698bf76cb1190da24d3b, 9f6d25cff24d84ea95aa1b4a5d78abf6160afda5 and 8cc5a7d52d585cd4aa1f32728ed1917deaaebe8a also remain historical, not v2 execution identities.

Final v2 immutable comparison

Arm	BC-Bench commit	BC-ALAgents commit	Engine-owned BCQuality commit
Baseline A (#911)	0cbb709caaf92fcb2017bcfa0b1c77185d37cbc6	da9236a6f43d47c37e0bd59ebced33b6fe73f277	130d5de6c4bd72d2158240fe431862b6434c735a
Candidate B (this PR)	043ddc2c38bd1e71f5dedc5a9487b441d38d13de	1e61e1eacbd7e0a55cb63dc4e9418a8ed9059b19	4287233f80678fd4fb02aca6455d9cf046ca9262

Engine B remains the direct child of engine A and changes only the BCQuality ref, from the parent of microsoft/BCQuality#196 to its merged commit. Both share engine source 2ad4f65b231707d5222be27f4a7c6ab442662722; provenance and engine CI are recorded in microsoft/BC-ALAgents#78.

Exact candidate delta

Relative to the v2 baseline, exactly two files differ, each by one SHA replacement (+2/-2):

• .github/actions/install-agent-harnesses/action.yml: default ENGINE_SHA fallback A -> B.
• tests/test_review_workflows.py: matching DEFAULT_ENGINE_SHA A -> B.

All other tracked paths, modes and blob contents are identical to the v2 baseline, including its revised fixture, tests and documentation. The package version remains exactly 0.14.0.dev1. Runtime, scorer, judge, PR Review CLI 1.0.88, generic harness/model choices, dependency locks, workflows, concurrency, diagnostics, artifact selection and no-publish behavior are unchanged between arms.

There are three commits relative to the baseline: the original pin commit, the prior stable-baseline merge, and the new normal v2-baseline merge. This preserves all published history; no amend, rebase, force push, PR replacement or native stack operation was used.

Inherited v2 scope and gate

The complete protocol remains owned by #911 and its versioned docs/code-review.md. Its seven entries are synthetic__privacy-008, synthetic__privacy-015, synthetic__security-clean-02, synthetic__errh-tryfunction-swallowed-01, synthetic__http-optional-clean-01, synthetic__http-consumed-false-01 and synthetic__http-status-body-01.

synthetic__privacy-010 is excluded from the input only; its dataset row and all 145 original rows remain unchanged. V2 inherits the single-line consumed-false control anchored at line 12 and the two controlled bare GET/Post target sites at lines 12 and 27. Four historical plus two controlled sites give six targets; three positive controls, eight expected gold comments and five judge-eligible entries are retained. Syntax/structural checks are not AL compilation.

Baseline eligibility requires valid reports for all seven entries, all three controls and at least one of the six target misreads, with historical and controlled sites reported separately. Candidate acceptance requires no target or mixed assertion at any of the six sites in original leaf, root or normalized output, with controls retained. Missing signal, invalid reports or a missing control means STOP without retry. No new adjudicator is introduced; unrelated findings remain inventoried.

Any future approved run must use the exact seven-entry input, test-run=true, modified-only=false, repeat=1, and explicit engine-sha equal to its declared pin. Summary mock prevents result publication but does not mock reviewer generation or gold judging. This preparation authorizes none of those operations, and the old authorization does not carry forward.

New unpaid preparation evidence

• On candidate 043ddc2c38bd1e71f5dedc5a9487b441d38d13de: uv run --locked pytest -q tests\test_codereview_fixtures.py tests\test_review_workflows.py tests\test_pr_review_run_manifest.py: 93 passed in 16.21 seconds.
• Focused Ruff lint/format checks and git diff --check passed.
• Complete tree proof: identical path sets and modes, exactly one A-to-B SHA replacement in each allowed file, every other blob identical.
• V2 baseline: 16/16 automatic checks successful, including CodeQL.
• Candidate full remote CI is not claimed: CI.yml triggers only on pushes to main or PRs targeting main, not this dependent base. No workflow is dispatched to bypass that scope.

Exact v2 comparison.

Candidate tree: 4ce8fe1f1ea03ea2146666956c675571ebffd6cb.

Dataset SHA-256: 027fcf04cdbf506aeada64ef70498b059006d946e6804162a662ccbba45ef1d8.

SHA-256 of git diff --no-ext-diff --no-color --binary 0cbb709caaf92fcb2017bcfa0b1c77185d37cbc6...043ddc2c38bd1e71f5dedc5a9487b441d38d13de --: fe574e90cc1281198cfe1eca181f10286168fd0067118c95b095eda71b22b712.

PREPARATION ONLY / NOT_AUTHORIZED: no v2 model invocation, evaluation dispatch/rerun, result publication, release or product merge was performed. Ordinary automatic CI is the only permitted remote execution; paid approval remains pending.