Evidence you can inspect.

# REVIEW LEDGER — 35th-Pass Code Review (2026-06-20)

Bootstrap:
  session_id: [redacted]
  prior passes: 34 (all findings terminal at pass 34)
  prior HEAD: 28b0a978 → current HEAD: 51ded459
  project context loaded: Yes (carl / anthony / diana / abish)
  MUST-ENFORCE preferences honored: Yes

Scope:
  Single code delta since 34th all-green pass:
    commit c3d48923 — v5.4.49 verbosity ↔ output-style sync
    commit 51ded459 — EP15 greenhouse staging loader
  Files deep-reviewed:
    docpro-extension/src/SidebarProvider.ts
    docpro-extension/src/sidebar/MessageRouter.ts
    media/sidebar.template.html
    docs/SugarShack/Greenhouse/Episodes/scripts/load_ep15_episode.py
    dist/SidebarProvider.js (dist parity)
    tests/sidebar/VerbosityOutputStyle.spec.ts

———

SUMMARY

  Severity    Found   Remaining
  --------    -----   ---------
  Critical      0         0
  High          0         0
  Medium        0         0
  Low           1         0
  ANCHOR-CHAL   0         0
  Total         1         0

Net: 1 Low finding, FIXED-VERIFIED. 0 open.

———

LOW

  ID       Sev   Status           File:Line
  ------   ---   ------           ---------
  Ext-L1   Low   FIXED-VERIFIED   SidebarProvider.ts:~1473

  What: Dropdown-display test for "Explanatory" matches case-insensitively
  (onDisk.toLowerCase() === "explanatory"), but the self-heal that rewrites
  the value to canonical "Explanatory" fired only on the exact lowercase
  string (if (onDisk === "explanatory")). Result: "EXPLANATORY" displayed
  as Detailed but was never healed; Claude Code’s case-sensitive matcher
  silently ignored it, producing no Insight callouts.

  Fix: heal predicate changed to
    onDisk.toLowerCase() === "explanatory" && onDisk !== "Explanatory"
  First clause: exact case-insensitive match (same test as display branch).
  Second clause: excludes canonical value (idempotent).
  Regression test added: "EXPLANATORY" → displays Detailed + heals to canonical.
  Rebuilt dist from tsc. Version: 5.4.49 → 5.4.50. Gauge: 0 open.

———

HONORED, NOT RE-FLAGGED

  Native outputStyle mechanism, not prompt injection
    _setVerbosityMode writes the Claude Code outputStyle settings key.
    It injects no prompt text. Directly honors standing "DO NOT CHANGE
    PROMPTS / use the native mechanism" rule. Not a finding.

  FIX M20 $HOME write-guard
    _updateClaudeSettings:1535 — refuses to write when no workspace
    folder is open. Read and write targets match. Not a finding.

  EP15 staging loader
    ORM select/delete (no SQL string-building). Idempotent guard refuses
    to overwrite any row with mp3_path set or non-editing status.
    One-off staging script. Not a finding.

  Entire backend / frontend / migrations / extension remainder
    0 findings at 33rd/34th cold passes with no source change since.
    Dispositions honored under the cold-review pull model.

# RECONSTRUCTED REMEDIATION RECORD — SiteWork M3 finding (2026-06-21)
# Sources: SiteWork M3 fix list; SitePass2 M2 verification (2026-06-22)

———

FINDING (caught pre-deploy by Carl + security review)

  Claim on site: "Raw audio is not retained."

  Source check: grep "recording_data" backend/
    → voice client: recording_data = audio_bytes  [live write]
    → backend/models.py, ReachOutCall.recording_data = LargeBinary, nullable=True

  Verdict: OVERCLAIM. Binary audio data IS written to ReachOutCall.recording_data
  after a Meet the Team or Call Team session. The claim "not retained" was false.

———

CORRECTION

  Before (incorrect):
    "Raw audio is not retained."

  After (current wording, source-verified 2026-08-31):
    "Call audio is stored as binary in the database (ReachOutCall.recording_data,
    backend/models.py). It is cleared automatically after 30 days by
    cleanup_old_recordings() (idle_monitor_service.py). A separate
    cleanup_old_call_records() helper defaults to a 90-day cutoff, but it is
    not in the scheduled monitor; it currently runs only through the
    authorized Loam administrator cleanup endpoint (routes/reachout.py)."

  Pages corrected:
    security.html  — calls bullet + data table rows + auto-expire statement
    for-it.html    — data boundary list (line 706)
    episodes.html  — footnote (line 882)
    getting-started.html — no audio claim present; confirmed clean

  Correction method: read backend source first, write HTML second.
  No placeholder cells published. Table cells not yet verifiable → "Contact us."

———

VERIFICATION

  Abish Agent 1 (backend accuracy): 9/9 cells verified against backend/models.py
  Abish Agent 2 (cross-page consistency): zero vague phrases remaining
    grep "some calls" → 0 hits
    grep "expires on its own" → 0 hits
    grep "expiring status lifecycle" → 0 hits

  Conditional flag: Studio audio retention absent from episodes.html.
  Ruling: deferred to FIX-LIST (no Studio section exists to anchor it).
  Status: REMEDIATED. Deploy authorized.

# ANCHOR-CHALLENGE EXHIBIT — 35th-Pass Code Review (2026-06-20)
# Section: Honored, not re-flagged

Purpose: When a reviewer encounters a pattern that looks like a finding
but is actually a documented architectural decision, it is recorded here
rather than flagged. This prevents the same correct design from being
re-opened as a finding on every subsequent pass.

———

ANCHOR VERIFIED — Native outputStyle mechanism, not prompt injection

  Pattern observed:
    _setVerbosityMode() and _updateClaudeSettings() in SidebarProvider.ts
    write the Claude Code-native "outputStyle" key to .claude/settings.local.json
    when the user selects "Detailed" in the Response Style dropdown.

  Why this looks like a finding:
    Behavioral modification of Claude Code via a settings write is functionally
    adjacent to prompt injection. A cold reviewer unfamiliar with the standing
    decision might flag it.

  Why it was not flagged:
    Standing MUST-ENFORCE rule: "DO NOT CHANGE PROMPTS. Use the vendor’s native
    mechanism." The outputStyle settings key IS the native mechanism. Anthropic
    ships it specifically for this purpose. The alternative (injecting a prompt
    directive) was the prohibited path. This implementation is the correct one.

  Cross-references honored:
    REVIEW-2026-05-24 Ext-M14 — "terse" reserved-for-future (intentional no-op).
    FIX M20 $HOME write-guard — write path guarded, read path matches target.
    FIX M21 on-show reload — dropdown reloads from disk on sidebar open.

  Reviewer ruling: HONORED. Not a finding.
  Carried forward to pass 36+ as a standing not-a-finding.

———

ANCHOR-CHALLENGE count this pass: 0
(No anchor was successfully challenged. All 4 standing anchors verified accurate.)

# MEMORY COMPRESSION EXHIBIT
# Illustrative. The content is constructed; the format matches the code.
# No customer data, no real session IDs.

———

BEFORE COMPRESSION (appended session entries)

--- session (2026-05-14 09:41 UTC) ---
Rebuilt the MCP server after a source change and the fix still was not
live. The compiled output had not been checked before we called it shipped.
MUST-ENFORCE: After any MCP src change, grep dist/*.js for the changed token before declaring shipped.

--- session (2026-05-15 11:20 UTC) ---
The service crashed on the first request after a sync. Ownership on the
app path was wrong again; the terminal looked clean.
MUST-ENFORCE: After every rsync to [server redacted], run chown -R on the app path.

--- session (2026-05-16 14:05 UTC) ---
Publishing failed with a 401. The package was fine; the token was not.
MUST-ENFORCE: vsce 401 on publish — run the verify-pat probe first; do not repackage.
MUST-ENFORCE: After every rsync to [server redacted], run chown -R on the app path.

———

AFTER COMPRESSION

--- compressed (2026-05-21, from 818 to 511 chars, sessions distilled) ---

Deploys here have gone wrong while the terminal looked clean. Check the
compiled output before calling a fix shipped, fix ownership after every
sync, and treat a publish 401 as a token problem before a package problem.

--- HARD RULES ---
MUST-ENFORCE: After any MCP src change, grep dist/*.js for the changed token before declaring shipped.
MUST-ENFORCE: After every rsync to [server redacted], run chown -R on the app path.
MUST-ENFORCE: vsce 401 on publish — run the verify-pat probe first; do not repackage.

# BUILD MODE MILESTONE LOG — SiteWork (2026-06-21)
# Milestone 2: Fix Get Started (install safety + access)
# Source: docs/SiteWork_[redacted]/MILESTONES.md

Status: COMPLETE & LIVE
Commit: 3119e8c8
QA: Abish Code Sweep = SHIP
Sign-offs: Carl (security/hash gate), Diana (desktop + mobile visuals)
Deploy: git pull --ff-only (nginx direct-serve, no build step)

———

DELIVERABLES

  [x] Choose-your-path section after hero
        4 cards: Individual builder, Enterprise pilot, Research access,
        Security review. Enterprise card uses amber to mark higher intent.

  [x] Costs reframed
        "Loam is in limited access, moving deliberately."
        No published cost reason. No "pricing in refinement."

  [x] Before-you-install block
        Windows status, VS Code 1.93+ requirement, API key (dp_ prefix),
        Marketplace path, what installs (two user-space pieces),
        where data goes with links to /security and /for-it.

  [x] P0.4 install reorder
        Marketplace card (RECOMMENDED, green) first
        → inspectable PowerShell installer (download-only irm -OutFile)
        → Verify step (Get-AuthenticodeSignature + Get-FileHash,
              Expected SHA-256 visible near the command)
        → Run step (irm ... | iex LAST, after safety explanation)
        → Arrival → Uninstall/revoke/remove
        → Enterprise/security contact callout

  [x] Installer stated signed (Toast2IT LLC OV, valid to 2027-04-15)
        "No system service, kernel driver, or background telemetry agent."

  [x] JSON-LD HowTo rewritten to Marketplace-first safe order
        Was: pipe-first in Google-indexed structured data.
        Now: VS Code Extension first in HowToStep 1.

  [x] Cross-page fix
        for-it.html published a stale installer SHA-256.
        Corrected to live hash so both pages byte-match the served artifact.

ACCEPTANCE CRITERIA MET

  IT never sees irm | iex before the safer explanation.
  Proof: installer hash appears before pipe command in served HTML document order.
  Verified on-box + from public origin (curl body grep, not local file read).

  A visitor knows whether they can install today and how to request access.

QA GATE RESULT: SHIP

  Blast radius: getting-started.html (+407/-39), for-it.html (1 line)
  Security: hash-before-pipe ordering verified; no pipe-command-first exposure
  Regression: JSON-LD HowTo step order verified; no breaking change to step 2+
  Architectural consistency: install sequence matches security model on /for-it

# ILLUSTRATIVE RECORD — ReachOutCall + linked MeetSession
# Source schema: backend/models.py
#   ReachOutCall class: core call record, transcript, recording
#   MeetSession class: encrypted session fields, linked to ReachOutCall
# This is a constructed example. No customer data. No real session IDs.

———

  id                       [redacted UUID]
  user_id                  [redacted UUID]

  trigger                  meet_the_team
  persona_key              carl
  source                   ide
  status                   complete
  duration_seconds         263  (4m 23s)

  transcript               [stored]
                           Column type: Text, nullable=True (ReachOutCall.transcript)
                           Encryption: PLAINTEXT — not encrypted at rest
                           Note: The transcript field is readable by backend
                           processes without decryption. This is disclosed on
                           the security page.

  recording_data           [stored]
                           Column type: LargeBinary, nullable=True (ReachOutCall.recording_data)
                           Content: raw audio bytes, fetched post-call
                           recording_status: ready

  recording_duration_seconds  263

  guest_name               [redacted]
  guest_phone              [redacted]

  —— linked MeetSession record ——
  guest_context            [stored, encrypted]
                           Column type: EncryptedText (Fernet) (MeetSession.guest_context)
                           Note: These fields live on MeetSession, not on
                           ReachOutCall itself. One MeetSession row is created
                           per Meet the Team call and linked to the ReachOutCall.

  situational_brief        [stored, encrypted]
  canon_events             [stored, encrypted]
  guest_profile            [stored, encrypted]
  full_log                 [stored, encrypted]
  summary                  [stored, encrypted]

  created_at               2026-06-14 14:32:07 UTC

———

RETENTION CONTROLS (source: idle_monitor_service.py and routes/reachout.py)

  recording_data cleared:     30 days (scheduled cleanup_old_recordings)
  recording_status after:     "expired"
  Full record auto-deletion:  not currently scheduled
  Admin cleanup default:      records older than 90 days
                              (cleanup_old_call_records;
                               admin endpoint in routes/reachout.py)

  Note: retention_days=30 and retention_days=90 are Python default arguments,
  not database-driven config values. The 30-day audio cleanup is wired into
  the monitor loop. The 90-day full-record helper is admin-triggered only;
  the existence of the helper is not an automatic-retention promise.