[JacobStephens2]

Summary

Implements the whole Scoring Spec, including all eight Tickets. Weekly Scoring runs sample merged factory pull requests across configured owners, grade them independently, and propose Bug origins for closed bugs.

score → seeded weekly sample → blind merge-time packets → independent five-criterion Scores
      → closed bugs → bounded history sessions → Bug-origin proposals
scores --mine → five human Scores → criterion calibration (18 of the latest 20)
bug-origins --confirm / --correct / --none → Run counts + proposed code-review Eval tasks
Console → the same Score entry and Bug-origin settlement operations
Built-with → Harness version + Model + Effort, with legacy lines still readable

Scoring keeps its Command record, Inbox and Stop behavior, resumes pending packets after plan-limit stops, excludes Security fixes, and retains private evidence locally. The first run adds 20 historical calibration pull requests and backfills closed bugs; later samples mark two pull requests for human scoring. Proposed Eval tasks require separate approval.

Closes #978

Evidence

• Before: the reviewers' exact commands reproduced the rejected scores 23 --mine --json action and model Score disclosure from an ordinary scores read. Both new whole-binary regressions failed before their fixes.
  After: both commands pass. Human entry returns valid JSON after saving all five Scores; list/detail reads in text and JSON withhold model Scores until human Scores exist. Calibration still reads the stored assessments before filtering the public view.
• All 35 active Scoring integration tests pass (one subprocess-only fixture is intentionally ignored), including the new regressions, rolling calibration, independent Graders, packet blinding, historical sampling and plan-limit resume.
• The three Console scoring/origin HTTP tests and the Scores/Bug origins browser test pass, including blind entry, settlement actions, CSRF, keyboard navigation and phone layout.
• /usr/bin/time -p scripts/affected-tests main passed: all 50 public-site browser tests and the full Rust suite (cargo test fallback; nextest unavailable). Whole selection wall time: 1513.63s (25m 14s), including 1m 24s of Rust compilation with cached dependencies. This is local execution time, not CI queue time.

Seams under test: the whole binary against fake GitHub and Harnesses, its retained private scoring folder and Command records, CLI text/JSON and terminal entry, and the Console's HTTP and browser interfaces. Built-with reader/writer coverage uses existing pull-request and factory-run tests.

Unaddressed findings

Standards

• Possible Duplicated Code in session execution — declined; the Standards reviewer retracted the recommendation after rechecking the contracts. Scoring Grader, lines 105–153 uses adapter.session, Command-linked Recording::capture, stream-only interpretation, explicit plan-limit stopping and sandbox startup diagnosis. Private runner, lines 43–98 uses adapter.trial_session, capped scoped commands, Recording::for_trial, private stderr/scope artifacts and a deadline. Both already share sandbox and recording modules; combining their orchestration would add policy options for these different contracts. No behavior failure or documented-standard breach was claimed for this heuristic.

Spec

None. The blind-scoring finding was reproduced and fixed. A provisional historical base-reference concern was withdrawn after a read-only GraphQL check of merged PR #1139: its baseRefOid (9ab1273) still equals the merge commit's first parent, although issue-978 has advanced to d305b7e.

Security

None.

Security review outcome

No unaddressed introduced findings.

Review coverage

Independent Standards and Spec reviews read all 98 changed paths since main, then both re-read all 14 paths changed by the review fixes. No changed file remains unread on either axis. Generated prompt and manual outputs were inspected directly; no generated files were excluded. Final reports with each axis's files-read list are retained as Session evidence in .thirdshift-review-eE0h5j/standards.md and .thirdshift-review-eE0h5j/spec.md.

Merge Danger

Door: Two-way.

Code can be reverted; retained private samples, judgments and proposed Eval tasks remain on the host. Weekly scheduling and initial human calibration are Day-shift steps.

Blast Radius: Factory.

Shared changes also touch Built-with attribution, sandbox sessions, Command recording and Console navigation.

Built with codex · gpt-6.1-sol · xhigh

Tickets

• thirdshift score: the Scoring run and its weekly sample #1024 done
• Blind packets for the sampled pull requests #1025 done
• Model Graders score the sample #1026 done
• Your Scores and calibration #1027 done
• Bug origins proposed for closed bugs #1028 done
• Confirm, correct or reject a Bug origin #1029 done
• The Harness version in the Built-with line #1030 done
• The Scores and Bug-origin pages in the Console #1031 done