[lawrencecchen]

Summary

Reward-hacking audit (cmux-ad, 2026-10-30). On perf/chrome-parity, blocking_allow_escapes went 0 -> 19 through ratchet exceptions that the tasks that needed them wrote, and app_lines went 143,610 -> 164,014 while it was report only. This PR ports the checker rule to feat-cmux-next first (lead decision), before the 6 tip rises are decided under it.

• An arch-ratchet.json exception allows nothing unless it has author, owner, an independent receipt (Review (<reviewer>): SHIP at <40-hex sha>, reviewer not the author) and an expiry.
• --update never records a blocking-escape rise as upstream debt.
• New escape_reviews record: a push that adds or edits a blocking escape site needs a reviewed entry for that site. --audit lists unreviewed, expired and stale entries.
• app_lines (CmuxNextApp physical lines) is a ratcheted row: a push may not raise it.

The checker and its tests only. No CI job, step or gate is added (the ratchet runs in the pre-push hook only). No arch-ratchet.json change.

Effect on this tip: the 9 pending exceptions on feat have no receipt, owner or expiry, so they now allow nothing. --update already refused at 84bca8e (6 rows over the record) and still refuses. app_lines is 158,210 here against the recorded 143,610, so it becomes a 7th row for the tip follow-up. A feature push that grows CmuxNextApp is now refused at pre-push. It must move the code to its own target or pay with removed App lines.

Testing

Python, on the VM (these are not CI jobs):

• scripts/cmux-next/tests/test_arch_ratchet.py OK. The 5 new tests fail on the old checker (4 FAIL, 1 ERROR).
• scripts/cmux-next/tests/test_layer_gate.py OK.
• scripts/cmux-next/tests/test_perf_cron_arch_report.py OK.
• tests/test_cmux_next_codebase_health.py OK.
• tests/test_cmux_next_guardrails.py 128 OK.

Observed / Not run

• Observed: the five suites above, and arch-ratchet.py --audit at this head (it lists the 3 unreviewed escapes and 7 rows over the record).
• Not run: no Swift build (Python only). A compile-check of the head is submitted for the risk:high evidence.

Changelog

none

Risk evidence (risk:high, gate enforcer)

• Review (independent review subagent, risk:high ratchet): SHIP at 59dc602 (arch-ratchet: independent receipt, owner and expiry per exception; app_lines ratchets; blocking escapes need a review record #28195 (comment))
• Compile: fleet job da4983f0e80f2b29fda923e8 passed at 59dc602 (CmuxNext, app, cmux-tui)
• Follow-ups, from the review and not blocking: the layer gate's refusal text and the arch_rules/__init__.py docstring still show the old exception form; a new entry is not checked against today's date; --audit does not list expired exceptions.

[blacksmith-sh]

Found 28 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp1rfe6xjs/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmp7k7lz0ih/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='success')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='success')	View Logs

...and 18 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 59dc602: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28195 -f ref=cp/feat-ratchet-review-rule -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: 3 commit(s) change the sidebar's drawing code without a Sidebar-Look: trailer or an entry in plans/cmux-next/sidebar-owner.md is not red on the base e863077; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4115488208801 (dd66817742)
• cmux NEXT nightly 1.0.0-nightly.4115755828101 (7c0adaf184)

[lawrencecchen]

Review (independent review subagent, risk:high ratchet): SHIP at 59dc602
perf claim: none
compile: da4983f0e80f2b29fda923e8 passed

What I checked (read-only, no Swift or Rust run):

• Holes for a ratcheted rise: a push gets allowance only from non-generated entries that pass review_problems (added_exceptions filters generated entries). A hand-written raised_by entry gives only what generated_allowance re-derives from upstream commits, and that function now skips blocking_allow_escapes. update() does not record an escape rise as upstream debt. Layer-gate entries go through the same valid_exception. A layer-map exceptions or relayered entry without review does not cover the count row. An edit of an applied entry is refused (verbatim compare). A site that moves to another file, or an edit of its text, makes a new (path, text) key and is refused without a reviewed escape_reviews entry (fail closed). A missing or broken head json gives no reviews (fail closed).
• Normal pushes: escape_rule reads the json only when a push adds a site. record() has one caller and the new parameter is optional.
• Tests: test_arch_ratchet 109 OK, test_layer_gate 55 OK, test_cmux_next_guardrails 128 OK, test_cmux_next_codebase_health 10 OK. --audit runs and lists 3 escape sites with no entry and 7 rows over the record.
• No .github change, no CI job, step or gate added. arch-ratchet.json and app-size-baseline.txt are not changed. No total is lowered and no limit is raised. app_lines changes from report only to ratcheted (stricter).

Notes (no block):

• The rule cannot prove identity. The self-review check is a casefold compare of the names only, and the receipt sha is not checked as a real commit or as the head. Any other name passes. The landing record must carry the receipt.
• expiry is not compared with today at push time. A new exception or escape review can be already expired. --audit lists expired escape_reviews entries only, not expired exceptions.
• Stale text: arch_rules/layer_gate.py escape() (and its docstring) and the arch_rules/__init__.py docstring still show the old form {"date", "row", "allow", "why"}. An agent that follows the layer-gate refusal text writes an entry that now allows nothing (fail closed; the ratchet note says what it lacks). Fix in a follow-up.
• The PR label is risk:normal. The change is to a gate enforcer, so it is risk:high.