R82.K Audit — colibri-verification body + stale tasks-domain comments

Scope

Three files, all flagged in the R82 Phase A manifest drift inventory (Group 5, §3 of .agents/spawns/r82-phase-0-1-stabilization/manifest.md):

  1. .agents/skills/colibri-verification/SKILL.md — body rewrite (not the R76.H2 top-of-file reality stamp; that stays).
  2. src/domains/tasks/repository.ts — top block comment only; no code change.
  3. src/domains/tasks/state-machine.ts — comments only; no logic, type, schema, or export change.

The Phase 0 shipped 14-tool surface is the reference set for every naming decision: server_ping, server_health, skill_list, thought_record, thought_record_list, task_create, task_get, task_update, task_list, task_next_actions, audit_session_start, audit_verify_chain, merkle_finalize, merkle_root.

The Phase 0 shipped β surface is exactly five tools: task_create, task_get, task_update, task_list, task_next_actions (confirmed against src/server.ts registerTaskTools(ctx) at lines ~668–813 and registerColibriTool calls therein).

Drift inventory

1. .agents/skills/colibri-verification/SKILL.md

Pre-edit phantom-string sweep (one grep, combined regex):

grep -cE "roadmap_|unified_|task_eisenhower|task_deps|task_create_batch|task_link_roadmap|gsd_|context_|memory_pack|thought_plan|thought_decide|audit_session_set_context|unified_backup|merkle_attest" .agents/skills/colibri-verification/SKILL.md
# → 9

The 9 hits are confined to the HERITAGE note block (lines 11–23, the “Donor-era tool families are catalogued in the HERITAGE note below” paragraph) and a handful of legitimate-looking inline callouts. The HERITAGE block itself is a deliberate anti-catalogue (it tells executors not to invoke these donor families). Re-reading the body end-to-end confirms:

  • The body (lines 25–297) no longer invokes any phantom tool in active voice.
  • Every active-voice tool reference in the body already uses one of the 14 shipped names — e.g. line 52 (task_get), lines 65–66 (server_ping, server_health), line 70 (audit_session_start), lines 119–125 (thought_record / task_update), lines 133–134 (merkle_finalize, merkle_root), lines 209 (audit_verify_chain), etc.
  • The 9 phantom-string matches are ALL inside the HERITAGE note itself (the “do not invoke” warning block that names the donors to strike).

That is a contradiction with the slice brief, which reads the body sweep as “0 expected”. The correct interpretation per the slice DoD (“Skill body lists only tools from the 14-tool Phase 0 surface”) is:

  • The HERITAGE note block is itself the “list only tools from the 14-tool surface” violation because the donor names appear as bare code literals in bullet text, even though the surrounding prose is “do not invoke”.
  • The simplest reconciliation that preserves the grep -c ... → 0 contract is to rewrite the HERITAGE note so the donor tool families are described in prose (no backtick-fenced literals of the donor names) rather than enumerated as code tokens.

Grep-hit map (exact lines confirmed against the just-read file):

Line Token(s)
13 roadmap_*
14 unified_*, unified_init, unified_set_project, unified_vitals, unified_backup, unified_metrics
15 context_*, context_create, context_verify
16 memory_*, memory_pack, memory_bundle, memory_verify
17 gsd_*, gsd_plan, gsd_verify_comprehensive, gsd_workflow_create, gsd_agent_pool_create
18 task_eisenhower, task_deps, task_depends_on, task_link_roadmap, task_create_batch, task_transition, task_delete
19 thought_plan, thought_decide
20 audit_session_set_context
22 merkle_attest
(line 23 already clean for this regex — analysis_*, rag_*, ams_session_resume, server_info, server_shutdown don’t match)  

All 9 grep hits are in the HERITAGE note between lines 11–23. The body from §Quick Reference (line 27) downward is already clean of phantom-string references in active voice.

2. src/domains/tasks/repository.ts — TOP BLOCK COMMENT ONLY

Pre-edit sweep:

grep -cE "task_cancel|task_link|task_unlink" src/domains/tasks/repository.ts
# → 1

Hit lives on line 34 (inside the top block comment at lines 1–35):

  34:  *     `task_cancel`, `task_next_actions`, `task_link`, `task_unlink`).

This is the “Consumed by (future): P0.3.4 MCP tools” list. The comment claims nine β tools ship. Reality (confirmed at src/server.ts:568–570 and again in registerTaskTools at src/domains/tasks/repository.ts:667–814) is five: task_create, task_get, task_update, task_list, task_next_actions.

No code or type references task_cancel, task_link, or task_unlink. The deleteTask export (line 504) is a private module function used only by tests — it is not registered as an MCP tool. This is comment-only drift.

Lines to edit: 34 (single line — the list inside the parenthetical). No other line in the file contains any of the three phantom strings.

3. src/domains/tasks/state-machine.ts — COMMENTS ONLY

Pre-edit sweep:

grep -cE "task_transition" src/domains/tasks/state-machine.ts
# → 2

Hits (both in comment blocks — the file also exports an InvalidTransitionError type, but that type name is not task_transition):

Line Context Text
20 Top block comment, “consumers” list * task_transition / task_update MCP tools) wrap these functions with
124 InvalidTransitionError class comment * task_transition tool in P0.3.4) can map to the s17 error envelope

Both comments treat task_transition as a shipped MCP tool. Reality: task_transition was collapsed into task_update status routing during Phase 0 Wave D/E (P0.3.4); there is no separately-registered task_transition MCP tool. The transition() function in this file is the engine the task_update handler calls internally (via state-machine.ts imports in repository.ts’s updateTask path), but it is not directly exposed as an MCP tool.

Nothing in the file’s executable code (type exports, function bodies, error classes) needs to change. The file’s logic is correct. Only the two comment phrases above point at a phantom tool surface.

Lines to edit: 20 and 124.

Code-vs-comment discrimination (repository.ts + state-machine.ts)

Per slice contract, only comment lines may be edited. I confirm:

  • repository.ts line 34 is inside the /** ... */ block from line 1 to line 35 — comment-only.
  • state-machine.ts line 20 is inside the /** ... */ block from line 1 to line 33 — comment-only.
  • state-machine.ts line 124 is inside the /** ... */ block from line 121 to line 128, immediately above export class InvalidTransitionError — comment-only.

No comment-line edit in this slice will touch adjacent executable code.

Supporting evidence — 14 live tools and 5 live β tools

All 14 tool registrations in src/server.ts

From the bootstrap function at src/server.ts:528–585:

Line Registration call Registered tool names
538 Inline registerColibriTool(ctx, 'server_ping', ...) server_ping
555 registerHealthTool(ctx) server_health
559 registerThoughtTools(ctx) thought_record, thought_record_list
563 registerVerifyChainTool(ctx) audit_verify_chain
567 registerSkillTools(ctx) skill_list
570 registerTaskTools(ctx) task_create, task_get, task_update, task_list, task_next_actions
575 registerMerkleTools(ctx) audit_session_start, merkle_finalize, merkle_root

Total: 14 tools. No registration call adds task_cancel, task_link, task_unlink, task_transition, task_delete, server_info, server_shutdown, audit_session_end, merkle_attest, unified_*, roadmap_*, gsd_*, context_*, or memory_* to the tool surface. Every name in the slice-K rewrite must come from the 14 above.

5 β tools (slice contract for repository.ts)

The registerTaskTools function at src/domains/tasks/repository.ts:667–814 registers five tools via five registerColibriTool(...) calls:

  • Line 669 — 'task_create'
  • Line 689 — 'task_get'
  • Line 715 — 'task_update'
  • Line 770 — 'task_list'
  • Line 789 — 'task_next_actions'

No sixth call. The “Consumed by (future)” comment at lines 31–34 is the sole remaining drift in this file.

Acceptance criteria for later steps

  1. grep -cE "roadmap_|unified_|task_eisenhower|task_deps|task_create_batch|task_link_roadmap|gsd_|context_|memory_pack|thought_plan|thought_decide|audit_session_set_context|unified_backup|merkle_attest" .agents/skills/colibri-verification/SKILL.md → 0.
  2. grep -cE "task_cancel|task_link|task_unlink" src/domains/tasks/repository.ts → 0.
  3. grep -cE "task_transition" src/domains/tasks/state-machine.ts → 0.
  4. Skill body (post-rewrite) names at least 3 of the 14 shipped tools in active voice (should be ≈14 — every acceptance-criteria table already enumerates the shipped surface).
  5. Preserve the R76.H2 top-of-file reality stamp verbatim (lines 1–9 + 25 of the current file).
  6. npm run build && npm run lint && npm test → 1123/1123 green (baseline after R81 Wave 1: 1085 + 38 = 1123).

Non-goals

  • No src/ logic change. Every edit to repository.ts and state-machine.ts is inside a /** ... */ block.
  • No frontmatter change on SKILL.md.
  • No new sections added to SKILL.md other than an R82 reconcile stamp at the bottom of the file.
  • No change to any other skill, no change to the .claude/skills/ mirror (MIRROR zone is off-limits per CLAUDE.md §9.2; mirror resync is a separate wave).
  • No doc-corpus-wide phantom purge — this slice is K only.

Rollback plan

Three files, all small:

  • .agents/skills/colibri-verification/SKILL.md — git checkout -- <file> restores pre-edit state.
  • src/domains/tasks/repository.ts — same.
  • src/domains/tasks/state-machine.ts — same.

No migration, no DB change, no irreversible step. A git reset --hard HEAD~N on the feature branch undoes the entire slice.

Part of the R82 phase-0-1-stabilization round. Manifest at .agents/spawns/r82-phase-0-1-stabilization/manifest.md.

Back to top

Colibri — documentation-first MCP runtime. Apache 2.0 + Commons Clause.

This site uses Just the Docs, a documentation theme for Jekyll.