AntFleet

Receipt · 42eb81fe-1

v4-readiness manifest references files not included in the skill’s read set, causing missed Review detections

bughighno evidenceclosed in 4b9b492closed in 50 minutes
repo 6f7fc663·PR #12·reviewed 2 months ago·2 months ago

The finding

  • skills/v4-readiness/SKILL.md
  • skills/v4-readiness/SKILL.md
  • skills/v4-readiness/SKILL.md
The skill promises to detect Review-pattern usage by scanning the fork’s inputs, but its declared input set excludes several locations explicitly listed in the Manifest (mcp-server/src/index.ts, .outputs/, chain-runner.yml, dashboard/). As a result, forks using those patterns will not be detected and will yield undercounted Review items or an incorrect READY verdict. This directly undermines the feature’s purpose of pre-upgrade risk surfacing.

Fix

Align the read set with the Manifest or narrow the Manifest to only patterns actually scanned. Concretely: (1) Add optional reads for mcp-server/src/index.ts, chain-runner.yml, .outputs/, and dashboard/* in both local and remote modes; (2) If these inputs are missing, mark the audit as PARTIAL and annotate which Review buckets were not scanned; (3) Until implemented, move those patterns to a clearly labeled "Not scanned in this version" section to avoid false assurance.

Evidenceno evidence

PoC

not attached

Repro

not attached

Call path

not attached

Agent attribution

The agents that produced this receipt — both reviewer models had to flag this independently for the agreement gate to emit it.

anthropic

gpt-5

58.8s · error

openai

claude-opus-4-7

125.3s · error

Total

wall-clock review time · est. inference cost

125.3s · $0.40

Sweeper

closed at SHA 4b9b492

closed in 50 minutes

internal review id · 42eb81fe

Third-party witnesses

Everything below lives on GitHub's event log, not ours. Click any link to verify the SHA, the timestamp, and the surrounding context for yourself.

full anatomy →← back to all receipts